![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to pflash_cfi01.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu / hw|
Return to pflash_cfi01.c CVS log | Up to [Qemu by Fabrice Bellard] / qemu / hw |
1.1 root 1: /*
2: * CFI parallel flash with Intel command set emulation
3: *
4: * Copyright (c) 2006 Thorsten Zitterell
5: * Copyright (c) 2005 Jocelyn Mayer
6: *
7: * This library is free software; you can redistribute it and/or
8: * modify it under the terms of the GNU Lesser General Public
9: * License as published by the Free Software Foundation; either
10: * version 2 of the License, or (at your option) any later version.
11: *
12: * This library is distributed in the hope that it will be useful,
13: * but WITHOUT ANY WARRANTY; without even the implied warranty of
14: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15: * Lesser General Public License for more details.
16: *
17: * You should have received a copy of the GNU Lesser General Public
18: * License along with this library; if not, write to the Free Software
19: * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20: */
21:
22: /*
23: * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
24: * Supported commands/modes are:
25: * - flash read
26: * - flash write
27: * - flash ID read
28: * - sector erase
29: * - CFI queries
30: *
31: * It does not support timings
32: * It does not support flash interleaving
33: * It does not implement software data protection as found in many real chips
34: * It does not implement erase suspend/resume commands
35: * It does not implement multiple sectors erase
36: *
37: * It does not implement much more ...
38: */
39:
40: #include "hw.h"
41: #include "flash.h"
42: #include "block.h"
43: #include "qemu-timer.h"
44:
45: #define PFLASH_BUG(fmt, args...) \
46: do { \
47: printf("PFLASH: Possible BUG - " fmt, ##args); \
48: exit(1); \
49: } while(0)
50:
51: /* #define PFLASH_DEBUG */
52: #ifdef PFLASH_DEBUG
53: #define DPRINTF(fmt, args...) \
54: do { \
55: printf("PFLASH: " fmt , ##args); \
56: } while (0)
57: #else
58: #define DPRINTF(fmt, args...) do { } while (0)
59: #endif
60:
61: struct pflash_t {
62: BlockDriverState *bs;
63: target_ulong base;
64: target_ulong sector_len;
65: target_ulong total_len;
66: int width;
67: int wcycle; /* if 0, the flash is read normally */
68: int bypass;
69: int ro;
70: uint8_t cmd;
71: uint8_t status;
72: uint16_t ident[4];
73: uint8_t cfi_len;
74: uint8_t cfi_table[0x52];
75: target_ulong counter;
76: QEMUTimer *timer;
77: ram_addr_t off;
78: int fl_mem;
79: void *storage;
80: };
81:
82: static void pflash_timer (void *opaque)
83: {
84: pflash_t *pfl = opaque;
85:
86: DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
87: /* Reset flash */
88: pfl->status ^= 0x80;
89: if (pfl->bypass) {
90: pfl->wcycle = 2;
91: } else {
92: cpu_register_physical_memory(pfl->base, pfl->total_len,
93: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
94: pfl->wcycle = 0;
95: }
96: pfl->cmd = 0;
97: }
98:
99: static uint32_t pflash_read (pflash_t *pfl, target_ulong offset, int width)
100: {
101: target_ulong boff;
102: uint32_t ret;
103: uint8_t *p;
104:
105: ret = -1;
106: offset -= pfl->base;
107: boff = offset & 0xFF; /* why this here ?? */
108:
109: if (pfl->width == 2)
110: boff = boff >> 1;
111: else if (pfl->width == 4)
112: boff = boff >> 2;
113:
114: DPRINTF("%s: reading offset " TARGET_FMT_lx " under cmd %02x\n",
115: __func__, boff, pfl->cmd);
116:
117: switch (pfl->cmd) {
118: case 0x00:
119: /* Flash area read */
120: p = pfl->storage;
121: switch (width) {
122: case 1:
123: ret = p[offset];
124: DPRINTF("%s: data offset " TARGET_FMT_lx " %02x\n",
125: __func__, offset, ret);
126: break;
127: case 2:
128: #if defined(TARGET_WORDS_BIGENDIAN)
129: ret = p[offset] << 8;
130: ret |= p[offset + 1];
131: #else
132: ret = p[offset];
133: ret |= p[offset + 1] << 8;
134: #endif
135: DPRINTF("%s: data offset " TARGET_FMT_lx " %04x\n",
136: __func__, offset, ret);
137: break;
138: case 4:
139: #if defined(TARGET_WORDS_BIGENDIAN)
140: ret = p[offset] << 24;
141: ret |= p[offset + 1] << 16;
142: ret |= p[offset + 2] << 8;
143: ret |= p[offset + 3];
144: #else
145: ret = p[offset];
146: ret |= p[offset + 1] << 8;
147: ret |= p[offset + 1] << 8;
148: ret |= p[offset + 2] << 16;
149: ret |= p[offset + 3] << 24;
150: #endif
151: DPRINTF("%s: data offset " TARGET_FMT_lx " %08x\n",
152: __func__, offset, ret);
153: break;
154: default:
155: DPRINTF("BUG in %s\n", __func__);
156: }
157:
158: break;
159: case 0x20: /* Block erase */
160: case 0x50: /* Clear status register */
161: case 0x60: /* Block /un)lock */
162: case 0x70: /* Status Register */
163: case 0xe8: /* Write block */
164: /* Status register read */
165: ret = pfl->status;
166: DPRINTF("%s: status %x\n", __func__, ret);
167: break;
168: case 0x98: /* Query mode */
169: if (boff > pfl->cfi_len)
170: ret = 0;
171: else
172: ret = pfl->cfi_table[boff];
173: break;
174: default:
175: /* This should never happen : reset state & treat it as a read */
176: DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
177: pfl->wcycle = 0;
178: pfl->cmd = 0;
179: }
180: return ret;
181: }
182:
183: /* update flash content on disk */
184: static void pflash_update(pflash_t *pfl, int offset,
185: int size)
186: {
187: int offset_end;
188: if (pfl->bs) {
189: offset_end = offset + size;
190: /* round to sectors */
191: offset = offset >> 9;
192: offset_end = (offset_end + 511) >> 9;
193: bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
194: offset_end - offset);
195: }
196: }
197:
198: static void pflash_write (pflash_t *pfl, target_ulong offset, uint32_t value,
199: int width)
200: {
201: target_ulong boff;
202: uint8_t *p;
203: uint8_t cmd;
204:
205: /* WARNING: when the memory area is in ROMD mode, the offset is a
206: ram offset, not a physical address */
207: cmd = value;
208:
209: if (pfl->wcycle == 0)
210: offset -= (target_ulong)(long)pfl->storage;
211: else
212: offset -= pfl->base;
213:
214: DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d wcycle 0x%x\n",
215: __func__, offset, value, width, pfl->wcycle);
216:
217: /* Set the device in I/O access mode */
218: cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
219: boff = offset & (pfl->sector_len - 1);
220:
221: if (pfl->width == 2)
222: boff = boff >> 1;
223: else if (pfl->width == 4)
224: boff = boff >> 2;
225:
226: switch (pfl->wcycle) {
227: case 0:
228: /* read mode */
229: switch (cmd) {
230: case 0x00: /* ??? */
231: goto reset_flash;
232: case 0x20: /* Block erase */
233: p = pfl->storage;
234: offset &= ~(pfl->sector_len - 1);
235:
236: DPRINTF("%s: block erase at " TARGET_FMT_lx " bytes "
237: TARGET_FMT_lx "\n",
238: __func__, offset, pfl->sector_len);
239:
240: memset(p + offset, 0xff, pfl->sector_len);
241: pflash_update(pfl, offset, pfl->sector_len);
242: pfl->status |= 0x80; /* Ready! */
243: break;
244: case 0x50: /* Clear status bits */
245: DPRINTF("%s: Clear status bits\n", __func__);
246: pfl->status = 0x0;
247: goto reset_flash;
248: case 0x60: /* Block (un)lock */
249: DPRINTF("%s: Block unlock\n", __func__);
250: break;
251: case 0x70: /* Status Register */
252: DPRINTF("%s: Read status register\n", __func__);
253: pfl->cmd = cmd;
254: return;
255: case 0x98: /* CFI query */
256: DPRINTF("%s: CFI query\n", __func__);
257: break;
258: case 0xe8: /* Write to buffer */
259: DPRINTF("%s: Write to buffer\n", __func__);
260: pfl->status |= 0x80; /* Ready! */
261: break;
262: case 0xff: /* Read array mode */
263: DPRINTF("%s: Read array mode\n", __func__);
264: goto reset_flash;
265: default:
266: goto error_flash;
267: }
268: pfl->wcycle++;
269: pfl->cmd = cmd;
270: return;
271: case 1:
272: switch (pfl->cmd) {
273: case 0x20: /* Block erase */
274: case 0x28:
275: if (cmd == 0xd0) { /* confirm */
276: pfl->wcycle = 1;
277: pfl->status |= 0x80;
278: } if (cmd == 0xff) { /* read array mode */
279: goto reset_flash;
280: } else
281: goto error_flash;
282:
283: break;
284: case 0xe8:
285: DPRINTF("%s: block write of %x bytes\n", __func__, cmd);
286: pfl->counter = cmd;
287: pfl->wcycle++;
288: break;
289: case 0x60:
290: if (cmd == 0xd0) {
291: pfl->wcycle = 0;
292: pfl->status |= 0x80;
293: } else if (cmd == 0x01) {
294: pfl->wcycle = 0;
295: pfl->status |= 0x80;
296: } else if (cmd == 0xff) {
297: goto reset_flash;
298: } else {
299: DPRINTF("%s: Unknown (un)locking command\n", __func__);
300: goto reset_flash;
301: }
302: break;
303: case 0x98:
304: if (cmd == 0xff) {
305: goto reset_flash;
306: } else {
307: DPRINTF("%s: leaving query mode\n", __func__);
308: }
309: break;
310: default:
311: goto error_flash;
312: }
313: return;
314: case 2:
315: switch (pfl->cmd) {
316: case 0xe8: /* Block write */
317: p = pfl->storage;
318: DPRINTF("%s: block write offset " TARGET_FMT_lx
319: " value %x counter " TARGET_FMT_lx "\n",
320: __func__, offset, value, pfl->counter);
321: switch (width) {
322: case 1:
323: p[offset] = value;
324: pflash_update(pfl, offset, 1);
325: break;
326: case 2:
327: #if defined(TARGET_WORDS_BIGENDIAN)
328: p[offset] = value >> 8;
329: p[offset + 1] = value;
330: #else
331: p[offset] = value;
332: p[offset + 1] = value >> 8;
333: #endif
334: pflash_update(pfl, offset, 2);
335: break;
336: case 4:
337: #if defined(TARGET_WORDS_BIGENDIAN)
338: p[offset] = value >> 24;
339: p[offset + 1] = value >> 16;
340: p[offset + 2] = value >> 8;
341: p[offset + 3] = value;
342: #else
343: p[offset] = value;
344: p[offset + 1] = value >> 8;
345: p[offset + 2] = value >> 16;
346: p[offset + 3] = value >> 24;
347: #endif
348: pflash_update(pfl, offset, 4);
349: break;
350: }
351:
352: pfl->status |= 0x80;
353:
354: if (!pfl->counter) {
355: DPRINTF("%s: block write finished\n", __func__);
356: pfl->wcycle++;
357: }
358:
359: pfl->counter--;
360: break;
361: default:
362: goto error_flash;
363: }
364: return;
365: case 3: /* Confirm mode */
366: switch (pfl->cmd) {
367: case 0xe8: /* Block write */
368: if (cmd == 0xd0) {
369: pfl->wcycle = 0;
370: pfl->status |= 0x80;
371: } else {
372: DPRINTF("%s: unknown command for \"write block\"\n", __func__);
373: PFLASH_BUG("Write block confirm");
374: goto reset_flash;
375: }
376: break;
377: default:
378: goto error_flash;
379: }
380: return;
381: default:
382: /* Should never happen */
383: DPRINTF("%s: invalid write state\n", __func__);
384: goto reset_flash;
385: }
386: return;
387:
388: error_flash:
389: printf("%s: Unimplemented flash cmd sequence "
390: "(offset " TARGET_FMT_lx ", wcycle 0x%x cmd 0x%x value 0x%x\n",
391: __func__, offset, pfl->wcycle, pfl->cmd, value);
392:
393: reset_flash:
394: cpu_register_physical_memory(pfl->base, pfl->total_len,
395: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
396:
397: pfl->bypass = 0;
398: pfl->wcycle = 0;
399: pfl->cmd = 0;
400: return;
401: }
402:
403:
404: static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
405: {
406: return pflash_read(opaque, addr, 1);
407: }
408:
409: static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
410: {
411: pflash_t *pfl = opaque;
412:
413: return pflash_read(pfl, addr, 2);
414: }
415:
416: static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
417: {
418: pflash_t *pfl = opaque;
419:
420: return pflash_read(pfl, addr, 4);
421: }
422:
423: static void pflash_writeb (void *opaque, target_phys_addr_t addr,
424: uint32_t value)
425: {
426: pflash_write(opaque, addr, value, 1);
427: }
428:
429: static void pflash_writew (void *opaque, target_phys_addr_t addr,
430: uint32_t value)
431: {
432: pflash_t *pfl = opaque;
433:
434: pflash_write(pfl, addr, value, 2);
435: }
436:
437: static void pflash_writel (void *opaque, target_phys_addr_t addr,
438: uint32_t value)
439: {
440: pflash_t *pfl = opaque;
441:
442: pflash_write(pfl, addr, value, 4);
443: }
444:
445: static CPUWriteMemoryFunc *pflash_write_ops[] = {
446: &pflash_writeb,
447: &pflash_writew,
448: &pflash_writel,
449: };
450:
451: static CPUReadMemoryFunc *pflash_read_ops[] = {
452: &pflash_readb,
453: &pflash_readw,
454: &pflash_readl,
455: };
456:
457: /* Count trailing zeroes of a 32 bits quantity */
458: static int ctz32 (uint32_t n)
459: {
460: int ret;
461:
462: ret = 0;
463: if (!(n & 0xFFFF)) {
464: ret += 16;
465: n = n >> 16;
466: }
467: if (!(n & 0xFF)) {
468: ret += 8;
469: n = n >> 8;
470: }
471: if (!(n & 0xF)) {
472: ret += 4;
473: n = n >> 4;
474: }
475: if (!(n & 0x3)) {
476: ret += 2;
477: n = n >> 2;
478: }
479: if (!(n & 0x1)) {
480: ret++;
481: n = n >> 1;
482: }
483: #if 0 /* This is not necessary as n is never 0 */
484: if (!n)
485: ret++;
486: #endif
487:
488: return ret;
489: }
490:
491: pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
492: BlockDriverState *bs, uint32_t sector_len,
493: int nb_blocs, int width,
494: uint16_t id0, uint16_t id1,
495: uint16_t id2, uint16_t id3)
496: {
497: pflash_t *pfl;
498: target_long total_len;
499:
500: total_len = sector_len * nb_blocs;
501:
502: /* XXX: to be fixed */
503: #if 0
504: if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
505: total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
506: return NULL;
507: #endif
508:
509: pfl = qemu_mallocz(sizeof(pflash_t));
510:
511: if (pfl == NULL)
512: return NULL;
513: pfl->storage = phys_ram_base + off;
514: pfl->fl_mem = cpu_register_io_memory(0,
515: pflash_read_ops, pflash_write_ops, pfl);
516: pfl->off = off;
517: cpu_register_physical_memory(base, total_len,
518: off | pfl->fl_mem | IO_MEM_ROMD);
519:
520: pfl->bs = bs;
521: if (pfl->bs) {
522: /* read the initial flash content */
523: bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
524: }
525: #if 0 /* XXX: there should be a bit to set up read-only,
526: * the same way the hardware does (with WP pin).
527: */
528: pfl->ro = 1;
529: #else
530: pfl->ro = 0;
531: #endif
532: pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
533: pfl->base = base;
534: pfl->sector_len = sector_len;
535: pfl->total_len = total_len;
536: pfl->width = width;
537: pfl->wcycle = 0;
538: pfl->cmd = 0;
539: pfl->status = 0;
540: pfl->ident[0] = id0;
541: pfl->ident[1] = id1;
542: pfl->ident[2] = id2;
543: pfl->ident[3] = id3;
544: /* Hardcoded CFI table */
545: pfl->cfi_len = 0x52;
546: /* Standard "QRY" string */
547: pfl->cfi_table[0x10] = 'Q';
548: pfl->cfi_table[0x11] = 'R';
549: pfl->cfi_table[0x12] = 'Y';
550: /* Command set (Intel) */
551: pfl->cfi_table[0x13] = 0x01;
552: pfl->cfi_table[0x14] = 0x00;
553: /* Primary extended table address (none) */
554: pfl->cfi_table[0x15] = 0x31;
555: pfl->cfi_table[0x16] = 0x00;
556: /* Alternate command set (none) */
557: pfl->cfi_table[0x17] = 0x00;
558: pfl->cfi_table[0x18] = 0x00;
559: /* Alternate extended table (none) */
560: pfl->cfi_table[0x19] = 0x00;
561: pfl->cfi_table[0x1A] = 0x00;
562: /* Vcc min */
563: pfl->cfi_table[0x1B] = 0x45;
564: /* Vcc max */
565: pfl->cfi_table[0x1C] = 0x55;
566: /* Vpp min (no Vpp pin) */
567: pfl->cfi_table[0x1D] = 0x00;
568: /* Vpp max (no Vpp pin) */
569: pfl->cfi_table[0x1E] = 0x00;
570: /* Reserved */
571: pfl->cfi_table[0x1F] = 0x07;
572: /* Timeout for min size buffer write */
573: pfl->cfi_table[0x20] = 0x07;
574: /* Typical timeout for block erase */
575: pfl->cfi_table[0x21] = 0x0a;
576: /* Typical timeout for full chip erase (4096 ms) */
577: pfl->cfi_table[0x22] = 0x00;
578: /* Reserved */
579: pfl->cfi_table[0x23] = 0x04;
580: /* Max timeout for buffer write */
581: pfl->cfi_table[0x24] = 0x04;
582: /* Max timeout for block erase */
583: pfl->cfi_table[0x25] = 0x04;
584: /* Max timeout for chip erase */
585: pfl->cfi_table[0x26] = 0x00;
586: /* Device size */
587: pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
588: /* Flash device interface (8 & 16 bits) */
589: pfl->cfi_table[0x28] = 0x02;
590: pfl->cfi_table[0x29] = 0x00;
591: /* Max number of bytes in multi-bytes write */
592: pfl->cfi_table[0x2A] = 0x04;
593: pfl->cfi_table[0x2B] = 0x00;
594: /* Number of erase block regions (uniform) */
595: pfl->cfi_table[0x2C] = 0x01;
596: /* Erase block region 1 */
597: pfl->cfi_table[0x2D] = nb_blocs - 1;
598: pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
599: pfl->cfi_table[0x2F] = sector_len >> 8;
600: pfl->cfi_table[0x30] = sector_len >> 16;
601:
602: /* Extended */
603: pfl->cfi_table[0x31] = 'P';
604: pfl->cfi_table[0x32] = 'R';
605: pfl->cfi_table[0x33] = 'I';
606:
607: pfl->cfi_table[0x34] = '1';
608: pfl->cfi_table[0x35] = '1';
609:
610: pfl->cfi_table[0x36] = 0x00;
611: pfl->cfi_table[0x37] = 0x00;
612: pfl->cfi_table[0x38] = 0x00;
613: pfl->cfi_table[0x39] = 0x00;
614:
615: pfl->cfi_table[0x3a] = 0x00;
616:
617: pfl->cfi_table[0x3b] = 0x00;
618: pfl->cfi_table[0x3c] = 0x00;
619:
620: return pfl;
621: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.