![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to pflash_cfi01.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu / hw|
Return to pflash_cfi01.c CVS log | Up to [Qemu by Fabrice Bellard] / qemu / hw |
1.1 root 1: /*
2: * CFI parallel flash with Intel command set emulation
3: *
4: * Copyright (c) 2006 Thorsten Zitterell
5: * Copyright (c) 2005 Jocelyn Mayer
6: *
7: * This library is free software; you can redistribute it and/or
8: * modify it under the terms of the GNU Lesser General Public
9: * License as published by the Free Software Foundation; either
10: * version 2 of the License, or (at your option) any later version.
11: *
12: * This library is distributed in the hope that it will be useful,
13: * but WITHOUT ANY WARRANTY; without even the implied warranty of
14: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15: * Lesser General Public License for more details.
16: *
17: * You should have received a copy of the GNU Lesser General Public
1.1.1.3 root 18: * License along with this library; if not, see <http://www.gnu.org/licenses/>.
1.1 root 19: */
20:
21: /*
22: * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23: * Supported commands/modes are:
24: * - flash read
25: * - flash write
26: * - flash ID read
27: * - sector erase
28: * - CFI queries
29: *
30: * It does not support timings
31: * It does not support flash interleaving
32: * It does not implement software data protection as found in many real chips
33: * It does not implement erase suspend/resume commands
34: * It does not implement multiple sectors erase
35: *
36: * It does not implement much more ...
37: */
38:
39: #include "hw.h"
40: #include "flash.h"
41: #include "block.h"
42: #include "qemu-timer.h"
43:
1.1.1.3 root 44: #define PFLASH_BUG(fmt, ...) \
1.1 root 45: do { \
1.1.1.3 root 46: printf("PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
1.1 root 47: exit(1); \
48: } while(0)
49:
50: /* #define PFLASH_DEBUG */
51: #ifdef PFLASH_DEBUG
1.1.1.3 root 52: #define DPRINTF(fmt, ...) \
1.1 root 53: do { \
1.1.1.3 root 54: printf("PFLASH: " fmt , ## __VA_ARGS__); \
1.1 root 55: } while (0)
56: #else
1.1.1.3 root 57: #define DPRINTF(fmt, ...) do { } while (0)
1.1 root 58: #endif
59:
60: struct pflash_t {
61: BlockDriverState *bs;
1.1.1.3 root 62: target_phys_addr_t base;
63: target_phys_addr_t sector_len;
64: target_phys_addr_t total_len;
1.1 root 65: int width;
66: int wcycle; /* if 0, the flash is read normally */
67: int bypass;
68: int ro;
69: uint8_t cmd;
70: uint8_t status;
71: uint16_t ident[4];
72: uint8_t cfi_len;
73: uint8_t cfi_table[0x52];
1.1.1.3 root 74: target_phys_addr_t counter;
1.1 root 75: QEMUTimer *timer;
76: ram_addr_t off;
77: int fl_mem;
78: void *storage;
79: };
80:
81: static void pflash_timer (void *opaque)
82: {
83: pflash_t *pfl = opaque;
84:
85: DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
86: /* Reset flash */
87: pfl->status ^= 0x80;
88: if (pfl->bypass) {
89: pfl->wcycle = 2;
90: } else {
91: cpu_register_physical_memory(pfl->base, pfl->total_len,
92: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
93: pfl->wcycle = 0;
94: }
95: pfl->cmd = 0;
96: }
97:
1.1.1.3 root 98: static uint32_t pflash_read (pflash_t *pfl, target_phys_addr_t offset,
99: int width)
1.1 root 100: {
1.1.1.3 root 101: target_phys_addr_t boff;
1.1 root 102: uint32_t ret;
103: uint8_t *p;
104:
105: ret = -1;
106: boff = offset & 0xFF; /* why this here ?? */
107:
108: if (pfl->width == 2)
109: boff = boff >> 1;
110: else if (pfl->width == 4)
111: boff = boff >> 2;
112:
1.1.1.4 ! root 113: #if 0
! 114: DPRINTF("%s: reading offset " TARGET_FMT_plx " under cmd %02x width %d\n",
1.1.1.2 root 115: __func__, offset, pfl->cmd, width);
1.1.1.4 ! root 116: #endif
1.1 root 117: switch (pfl->cmd) {
118: case 0x00:
119: /* Flash area read */
120: p = pfl->storage;
121: switch (width) {
122: case 1:
123: ret = p[offset];
1.1.1.4 ! root 124: DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
1.1 root 125: __func__, offset, ret);
126: break;
127: case 2:
128: #if defined(TARGET_WORDS_BIGENDIAN)
129: ret = p[offset] << 8;
130: ret |= p[offset + 1];
131: #else
132: ret = p[offset];
133: ret |= p[offset + 1] << 8;
134: #endif
1.1.1.4 ! root 135: DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
1.1 root 136: __func__, offset, ret);
137: break;
138: case 4:
139: #if defined(TARGET_WORDS_BIGENDIAN)
140: ret = p[offset] << 24;
141: ret |= p[offset + 1] << 16;
142: ret |= p[offset + 2] << 8;
143: ret |= p[offset + 3];
144: #else
145: ret = p[offset];
146: ret |= p[offset + 1] << 8;
147: ret |= p[offset + 1] << 8;
148: ret |= p[offset + 2] << 16;
149: ret |= p[offset + 3] << 24;
150: #endif
1.1.1.4 ! root 151: DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
1.1 root 152: __func__, offset, ret);
153: break;
154: default:
155: DPRINTF("BUG in %s\n", __func__);
156: }
157:
158: break;
159: case 0x20: /* Block erase */
160: case 0x50: /* Clear status register */
161: case 0x60: /* Block /un)lock */
162: case 0x70: /* Status Register */
163: case 0xe8: /* Write block */
164: /* Status register read */
165: ret = pfl->status;
166: DPRINTF("%s: status %x\n", __func__, ret);
167: break;
168: case 0x98: /* Query mode */
169: if (boff > pfl->cfi_len)
170: ret = 0;
171: else
172: ret = pfl->cfi_table[boff];
173: break;
174: default:
175: /* This should never happen : reset state & treat it as a read */
176: DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
177: pfl->wcycle = 0;
178: pfl->cmd = 0;
179: }
180: return ret;
181: }
182:
183: /* update flash content on disk */
184: static void pflash_update(pflash_t *pfl, int offset,
185: int size)
186: {
187: int offset_end;
188: if (pfl->bs) {
189: offset_end = offset + size;
190: /* round to sectors */
191: offset = offset >> 9;
192: offset_end = (offset_end + 511) >> 9;
193: bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
194: offset_end - offset);
195: }
196: }
197:
1.1.1.4 ! root 198: static inline void pflash_data_write(pflash_t *pfl, target_phys_addr_t offset,
1.1.1.2 root 199: uint32_t value, int width)
200: {
201: uint8_t *p = pfl->storage;
202:
1.1.1.4 ! root 203: DPRINTF("%s: block write offset " TARGET_FMT_plx
! 204: " value %x counter " TARGET_FMT_plx "\n",
1.1.1.2 root 205: __func__, offset, value, pfl->counter);
206: switch (width) {
207: case 1:
208: p[offset] = value;
209: pflash_update(pfl, offset, 1);
210: break;
211: case 2:
212: #if defined(TARGET_WORDS_BIGENDIAN)
213: p[offset] = value >> 8;
214: p[offset + 1] = value;
215: #else
216: p[offset] = value;
217: p[offset + 1] = value >> 8;
218: #endif
219: pflash_update(pfl, offset, 2);
220: break;
221: case 4:
222: #if defined(TARGET_WORDS_BIGENDIAN)
223: p[offset] = value >> 24;
224: p[offset + 1] = value >> 16;
225: p[offset + 2] = value >> 8;
226: p[offset + 3] = value;
227: #else
228: p[offset] = value;
229: p[offset + 1] = value >> 8;
230: p[offset + 2] = value >> 16;
231: p[offset + 3] = value >> 24;
232: #endif
233: pflash_update(pfl, offset, 4);
234: break;
235: }
236:
237: }
238:
1.1.1.3 root 239: static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
240: uint32_t value, int width)
1.1 root 241: {
1.1.1.3 root 242: target_phys_addr_t boff;
1.1 root 243: uint8_t *p;
244: uint8_t cmd;
245:
246: cmd = value;
247:
1.1.1.4 ! root 248: DPRINTF("%s: writing offset " TARGET_FMT_plx " value %08x width %d wcycle 0x%x\n",
1.1 root 249: __func__, offset, value, width, pfl->wcycle);
250:
251: /* Set the device in I/O access mode */
252: cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
253: boff = offset & (pfl->sector_len - 1);
254:
255: if (pfl->width == 2)
256: boff = boff >> 1;
257: else if (pfl->width == 4)
258: boff = boff >> 2;
259:
260: switch (pfl->wcycle) {
261: case 0:
262: /* read mode */
263: switch (cmd) {
264: case 0x00: /* ??? */
265: goto reset_flash;
1.1.1.2 root 266: case 0x10: /* Single Byte Program */
267: case 0x40: /* Single Byte Program */
1.1.1.4 ! root 268: DPRINTF("%s: Single Byte Program\n", __func__);
1.1.1.2 root 269: break;
1.1 root 270: case 0x20: /* Block erase */
271: p = pfl->storage;
272: offset &= ~(pfl->sector_len - 1);
273:
1.1.1.4 ! root 274: DPRINTF("%s: block erase at " TARGET_FMT_plx " bytes "
! 275: TARGET_FMT_plx "\n",
1.1 root 276: __func__, offset, pfl->sector_len);
277:
278: memset(p + offset, 0xff, pfl->sector_len);
279: pflash_update(pfl, offset, pfl->sector_len);
280: pfl->status |= 0x80; /* Ready! */
281: break;
282: case 0x50: /* Clear status bits */
283: DPRINTF("%s: Clear status bits\n", __func__);
284: pfl->status = 0x0;
285: goto reset_flash;
286: case 0x60: /* Block (un)lock */
287: DPRINTF("%s: Block unlock\n", __func__);
288: break;
289: case 0x70: /* Status Register */
290: DPRINTF("%s: Read status register\n", __func__);
291: pfl->cmd = cmd;
292: return;
293: case 0x98: /* CFI query */
294: DPRINTF("%s: CFI query\n", __func__);
295: break;
296: case 0xe8: /* Write to buffer */
297: DPRINTF("%s: Write to buffer\n", __func__);
298: pfl->status |= 0x80; /* Ready! */
299: break;
300: case 0xff: /* Read array mode */
301: DPRINTF("%s: Read array mode\n", __func__);
302: goto reset_flash;
303: default:
304: goto error_flash;
305: }
306: pfl->wcycle++;
307: pfl->cmd = cmd;
308: return;
309: case 1:
310: switch (pfl->cmd) {
1.1.1.2 root 311: case 0x10: /* Single Byte Program */
312: case 0x40: /* Single Byte Program */
313: DPRINTF("%s: Single Byte Program\n", __func__);
314: pflash_data_write(pfl, offset, value, width);
315: pfl->status |= 0x80; /* Ready! */
316: pfl->wcycle = 0;
317: break;
1.1 root 318: case 0x20: /* Block erase */
319: case 0x28:
320: if (cmd == 0xd0) { /* confirm */
1.1.1.2 root 321: pfl->wcycle = 0;
1.1 root 322: pfl->status |= 0x80;
1.1.1.2 root 323: } else if (cmd == 0xff) { /* read array mode */
1.1 root 324: goto reset_flash;
325: } else
326: goto error_flash;
327:
328: break;
329: case 0xe8:
1.1.1.2 root 330: DPRINTF("%s: block write of %x bytes\n", __func__, value);
331: pfl->counter = value;
1.1 root 332: pfl->wcycle++;
333: break;
334: case 0x60:
335: if (cmd == 0xd0) {
336: pfl->wcycle = 0;
337: pfl->status |= 0x80;
338: } else if (cmd == 0x01) {
339: pfl->wcycle = 0;
340: pfl->status |= 0x80;
341: } else if (cmd == 0xff) {
342: goto reset_flash;
343: } else {
344: DPRINTF("%s: Unknown (un)locking command\n", __func__);
345: goto reset_flash;
346: }
347: break;
348: case 0x98:
349: if (cmd == 0xff) {
350: goto reset_flash;
351: } else {
352: DPRINTF("%s: leaving query mode\n", __func__);
353: }
354: break;
355: default:
356: goto error_flash;
357: }
358: return;
359: case 2:
360: switch (pfl->cmd) {
361: case 0xe8: /* Block write */
1.1.1.2 root 362: pflash_data_write(pfl, offset, value, width);
1.1 root 363:
364: pfl->status |= 0x80;
365:
366: if (!pfl->counter) {
367: DPRINTF("%s: block write finished\n", __func__);
368: pfl->wcycle++;
369: }
370:
371: pfl->counter--;
372: break;
373: default:
374: goto error_flash;
375: }
376: return;
377: case 3: /* Confirm mode */
378: switch (pfl->cmd) {
379: case 0xe8: /* Block write */
380: if (cmd == 0xd0) {
381: pfl->wcycle = 0;
382: pfl->status |= 0x80;
383: } else {
384: DPRINTF("%s: unknown command for \"write block\"\n", __func__);
385: PFLASH_BUG("Write block confirm");
386: goto reset_flash;
387: }
388: break;
389: default:
390: goto error_flash;
391: }
392: return;
393: default:
394: /* Should never happen */
395: DPRINTF("%s: invalid write state\n", __func__);
396: goto reset_flash;
397: }
398: return;
399:
400: error_flash:
401: printf("%s: Unimplemented flash cmd sequence "
1.1.1.3 root 402: "(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)\n",
1.1 root 403: __func__, offset, pfl->wcycle, pfl->cmd, value);
404:
405: reset_flash:
406: cpu_register_physical_memory(pfl->base, pfl->total_len,
407: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
408:
409: pfl->bypass = 0;
410: pfl->wcycle = 0;
411: pfl->cmd = 0;
412: return;
413: }
414:
415:
416: static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
417: {
418: return pflash_read(opaque, addr, 1);
419: }
420:
421: static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
422: {
423: pflash_t *pfl = opaque;
424:
425: return pflash_read(pfl, addr, 2);
426: }
427:
428: static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
429: {
430: pflash_t *pfl = opaque;
431:
432: return pflash_read(pfl, addr, 4);
433: }
434:
435: static void pflash_writeb (void *opaque, target_phys_addr_t addr,
436: uint32_t value)
437: {
438: pflash_write(opaque, addr, value, 1);
439: }
440:
441: static void pflash_writew (void *opaque, target_phys_addr_t addr,
442: uint32_t value)
443: {
444: pflash_t *pfl = opaque;
445:
446: pflash_write(pfl, addr, value, 2);
447: }
448:
449: static void pflash_writel (void *opaque, target_phys_addr_t addr,
450: uint32_t value)
451: {
452: pflash_t *pfl = opaque;
453:
454: pflash_write(pfl, addr, value, 4);
455: }
456:
1.1.1.4 ! root 457: static CPUWriteMemoryFunc * const pflash_write_ops[] = {
1.1 root 458: &pflash_writeb,
459: &pflash_writew,
460: &pflash_writel,
461: };
462:
1.1.1.4 ! root 463: static CPUReadMemoryFunc * const pflash_read_ops[] = {
1.1 root 464: &pflash_readb,
465: &pflash_readw,
466: &pflash_readl,
467: };
468:
469: /* Count trailing zeroes of a 32 bits quantity */
470: static int ctz32 (uint32_t n)
471: {
472: int ret;
473:
474: ret = 0;
475: if (!(n & 0xFFFF)) {
476: ret += 16;
477: n = n >> 16;
478: }
479: if (!(n & 0xFF)) {
480: ret += 8;
481: n = n >> 8;
482: }
483: if (!(n & 0xF)) {
484: ret += 4;
485: n = n >> 4;
486: }
487: if (!(n & 0x3)) {
488: ret += 2;
489: n = n >> 2;
490: }
491: if (!(n & 0x1)) {
492: ret++;
493: n = n >> 1;
494: }
495: #if 0 /* This is not necessary as n is never 0 */
496: if (!n)
497: ret++;
498: #endif
499:
500: return ret;
501: }
502:
503: pflash_t *pflash_cfi01_register(target_phys_addr_t base, ram_addr_t off,
504: BlockDriverState *bs, uint32_t sector_len,
505: int nb_blocs, int width,
506: uint16_t id0, uint16_t id1,
507: uint16_t id2, uint16_t id3)
508: {
509: pflash_t *pfl;
1.1.1.3 root 510: target_phys_addr_t total_len;
1.1.1.4 ! root 511: int ret;
1.1 root 512:
513: total_len = sector_len * nb_blocs;
514:
515: /* XXX: to be fixed */
516: #if 0
517: if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
518: total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
519: return NULL;
520: #endif
521:
522: pfl = qemu_mallocz(sizeof(pflash_t));
523:
1.1.1.3 root 524: /* FIXME: Allocate ram ourselves. */
525: pfl->storage = qemu_get_ram_ptr(off);
526: pfl->fl_mem = cpu_register_io_memory(
1.1 root 527: pflash_read_ops, pflash_write_ops, pfl);
528: pfl->off = off;
529: cpu_register_physical_memory(base, total_len,
530: off | pfl->fl_mem | IO_MEM_ROMD);
531:
532: pfl->bs = bs;
533: if (pfl->bs) {
534: /* read the initial flash content */
1.1.1.4 ! root 535: ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
! 536: if (ret < 0) {
! 537: cpu_unregister_io_memory(pfl->fl_mem);
! 538: qemu_free(pfl);
! 539: return NULL;
! 540: }
1.1 root 541: }
542: #if 0 /* XXX: there should be a bit to set up read-only,
543: * the same way the hardware does (with WP pin).
544: */
545: pfl->ro = 1;
546: #else
547: pfl->ro = 0;
548: #endif
549: pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
550: pfl->base = base;
551: pfl->sector_len = sector_len;
552: pfl->total_len = total_len;
553: pfl->width = width;
554: pfl->wcycle = 0;
555: pfl->cmd = 0;
556: pfl->status = 0;
557: pfl->ident[0] = id0;
558: pfl->ident[1] = id1;
559: pfl->ident[2] = id2;
560: pfl->ident[3] = id3;
561: /* Hardcoded CFI table */
562: pfl->cfi_len = 0x52;
563: /* Standard "QRY" string */
564: pfl->cfi_table[0x10] = 'Q';
565: pfl->cfi_table[0x11] = 'R';
566: pfl->cfi_table[0x12] = 'Y';
567: /* Command set (Intel) */
568: pfl->cfi_table[0x13] = 0x01;
569: pfl->cfi_table[0x14] = 0x00;
570: /* Primary extended table address (none) */
571: pfl->cfi_table[0x15] = 0x31;
572: pfl->cfi_table[0x16] = 0x00;
573: /* Alternate command set (none) */
574: pfl->cfi_table[0x17] = 0x00;
575: pfl->cfi_table[0x18] = 0x00;
576: /* Alternate extended table (none) */
577: pfl->cfi_table[0x19] = 0x00;
578: pfl->cfi_table[0x1A] = 0x00;
579: /* Vcc min */
580: pfl->cfi_table[0x1B] = 0x45;
581: /* Vcc max */
582: pfl->cfi_table[0x1C] = 0x55;
583: /* Vpp min (no Vpp pin) */
584: pfl->cfi_table[0x1D] = 0x00;
585: /* Vpp max (no Vpp pin) */
586: pfl->cfi_table[0x1E] = 0x00;
587: /* Reserved */
588: pfl->cfi_table[0x1F] = 0x07;
589: /* Timeout for min size buffer write */
590: pfl->cfi_table[0x20] = 0x07;
591: /* Typical timeout for block erase */
592: pfl->cfi_table[0x21] = 0x0a;
593: /* Typical timeout for full chip erase (4096 ms) */
594: pfl->cfi_table[0x22] = 0x00;
595: /* Reserved */
596: pfl->cfi_table[0x23] = 0x04;
597: /* Max timeout for buffer write */
598: pfl->cfi_table[0x24] = 0x04;
599: /* Max timeout for block erase */
600: pfl->cfi_table[0x25] = 0x04;
601: /* Max timeout for chip erase */
602: pfl->cfi_table[0x26] = 0x00;
603: /* Device size */
604: pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
605: /* Flash device interface (8 & 16 bits) */
606: pfl->cfi_table[0x28] = 0x02;
607: pfl->cfi_table[0x29] = 0x00;
608: /* Max number of bytes in multi-bytes write */
1.1.1.2 root 609: pfl->cfi_table[0x2A] = 0x0B;
1.1 root 610: pfl->cfi_table[0x2B] = 0x00;
611: /* Number of erase block regions (uniform) */
612: pfl->cfi_table[0x2C] = 0x01;
613: /* Erase block region 1 */
614: pfl->cfi_table[0x2D] = nb_blocs - 1;
615: pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
616: pfl->cfi_table[0x2F] = sector_len >> 8;
617: pfl->cfi_table[0x30] = sector_len >> 16;
618:
619: /* Extended */
620: pfl->cfi_table[0x31] = 'P';
621: pfl->cfi_table[0x32] = 'R';
622: pfl->cfi_table[0x33] = 'I';
623:
624: pfl->cfi_table[0x34] = '1';
625: pfl->cfi_table[0x35] = '1';
626:
627: pfl->cfi_table[0x36] = 0x00;
628: pfl->cfi_table[0x37] = 0x00;
629: pfl->cfi_table[0x38] = 0x00;
630: pfl->cfi_table[0x39] = 0x00;
631:
632: pfl->cfi_table[0x3a] = 0x00;
633:
634: pfl->cfi_table[0x3b] = 0x00;
635: pfl->cfi_table[0x3c] = 0x00;
636:
637: return pfl;
638: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.