![[BACK]](/cvsweb/icons/back.gif){kind=icon}
Return to pflash_cfi02.c CVS log ![[TXT]](/cvsweb/icons/text.gif){kind=icon}
![[DIR]](/cvsweb/icons/dir.gif){kind=icon}
Up to [Qemu by Fabrice Bellard] / qemu / hw|
Return to pflash_cfi02.c CVS log | Up to [Qemu by Fabrice Bellard] / qemu / hw |
1.1 root 1: /*
2: * CFI parallel flash with AMD command set emulation
3: *
4: * Copyright (c) 2005 Jocelyn Mayer
5: *
6: * This library is free software; you can redistribute it and/or
7: * modify it under the terms of the GNU Lesser General Public
8: * License as published by the Free Software Foundation; either
9: * version 2 of the License, or (at your option) any later version.
10: *
11: * This library is distributed in the hope that it will be useful,
12: * but WITHOUT ANY WARRANTY; without even the implied warranty of
13: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14: * Lesser General Public License for more details.
15: *
16: * You should have received a copy of the GNU Lesser General Public
17: * License along with this library; if not, write to the Free Software
18: * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
19: */
20:
21: /*
22: * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23: * Supported commands/modes are:
24: * - flash read
25: * - flash write
26: * - flash ID read
27: * - sector erase
28: * - chip erase
29: * - unlock bypass command
30: * - CFI queries
31: *
32: * It does not support flash interleaving.
33: * It does not implement boot blocs with reduced size
34: * It does not implement software data protection as found in many real chips
35: * It does not implement erase suspend/resume commands
36: * It does not implement multiple sectors erase
37: */
38:
39: #include "vl.h"
40:
41: //#define PFLASH_DEBUG
42: #ifdef PFLASH_DEBUG
43: #define DPRINTF(fmt, args...) \
44: do { \
45: printf("PFLASH: " fmt , ##args); \
46: } while (0)
47: #else
48: #define DPRINTF(fmt, args...) do { } while (0)
49: #endif
50:
51: struct pflash_t {
52: BlockDriverState *bs;
53: target_ulong base;
54: target_ulong sector_len;
55: target_ulong total_len;
56: int width;
57: int wcycle; /* if 0, the flash is read normally */
58: int bypass;
59: int ro;
60: uint8_t cmd;
61: uint8_t status;
62: uint16_t ident[4];
63: uint8_t cfi_len;
64: uint8_t cfi_table[0x52];
65: QEMUTimer *timer;
66: ram_addr_t off;
67: int fl_mem;
68: void *storage;
69: };
70:
71: static void pflash_timer (void *opaque)
72: {
73: pflash_t *pfl = opaque;
74:
75: DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
76: /* Reset flash */
77: pfl->status ^= 0x80;
78: if (pfl->bypass) {
79: pfl->wcycle = 2;
80: } else {
81: cpu_register_physical_memory(pfl->base, pfl->total_len,
82: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
83: pfl->wcycle = 0;
84: }
85: pfl->cmd = 0;
86: }
87:
88: static uint32_t pflash_read (pflash_t *pfl, target_ulong offset, int width)
89: {
90: target_ulong boff;
91: uint32_t ret;
92: uint8_t *p;
93:
94: DPRINTF("%s: offset %08x\n", __func__, offset);
95: ret = -1;
96: offset -= pfl->base;
97: boff = offset & 0xFF;
98: if (pfl->width == 2)
99: boff = boff >> 1;
100: else if (pfl->width == 4)
101: boff = boff >> 2;
102: switch (pfl->cmd) {
103: default:
104: /* This should never happen : reset state & treat it as a read*/
105: DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
106: pfl->wcycle = 0;
107: pfl->cmd = 0;
108: case 0x80:
109: /* We accept reads during second unlock sequence... */
110: case 0x00:
111: flash_read:
112: /* Flash area read */
113: p = pfl->storage;
114: switch (width) {
115: case 1:
116: ret = p[offset];
117: // DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);
118: break;
119: case 2:
120: #if defined(TARGET_WORDS_BIGENDIAN)
121: ret = p[offset] << 8;
122: ret |= p[offset + 1];
123: #else
124: ret = p[offset];
125: ret |= p[offset + 1] << 8;
126: #endif
127: // DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);
128: break;
129: case 4:
130: #if defined(TARGET_WORDS_BIGENDIAN)
131: ret = p[offset] << 24;
132: ret |= p[offset + 1] << 16;
133: ret |= p[offset + 2] << 8;
134: ret |= p[offset + 3];
135: #else
136: ret = p[offset];
137: ret |= p[offset + 1] << 8;
138: ret |= p[offset + 2] << 16;
139: ret |= p[offset + 3] << 24;
140: #endif
141: // DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);
142: break;
143: }
144: break;
145: case 0x90:
146: /* flash ID read */
147: switch (boff) {
148: case 0x00:
149: case 0x01:
150: ret = pfl->ident[boff & 0x01];
151: break;
152: case 0x02:
153: ret = 0x00; /* Pretend all sectors are unprotected */
154: break;
155: case 0x0E:
156: case 0x0F:
157: if (pfl->ident[2 + (boff & 0x01)] == (uint8_t)-1)
158: goto flash_read;
159: ret = pfl->ident[2 + (boff & 0x01)];
160: break;
161: default:
162: goto flash_read;
163: }
164: DPRINTF("%s: ID %d %x\n", __func__, boff, ret);
165: break;
166: case 0xA0:
167: case 0x10:
168: case 0x30:
169: /* Status register read */
170: ret = pfl->status;
171: DPRINTF("%s: status %x\n", __func__, ret);
172: /* Toggle bit 6 */
173: pfl->status ^= 0x40;
174: break;
175: case 0x98:
176: /* CFI query mode */
177: if (boff > pfl->cfi_len)
178: ret = 0;
179: else
180: ret = pfl->cfi_table[boff];
181: break;
182: }
183:
184: return ret;
185: }
186:
187: /* update flash content on disk */
188: static void pflash_update(pflash_t *pfl, int offset,
189: int size)
190: {
191: int offset_end;
192: if (pfl->bs) {
193: offset_end = offset + size;
194: /* round to sectors */
195: offset = offset >> 9;
196: offset_end = (offset_end + 511) >> 9;
197: bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
198: offset_end - offset);
199: }
200: }
201:
202: static void pflash_write (pflash_t *pfl, target_ulong offset, uint32_t value,
203: int width)
204: {
205: target_ulong boff;
206: uint8_t *p;
207: uint8_t cmd;
208:
209: /* WARNING: when the memory area is in ROMD mode, the offset is a
210: ram offset, not a physical address */
211: if (pfl->wcycle == 0)
212: offset -= (target_ulong)(long)pfl->storage;
213: else
214: offset -= pfl->base;
215:
216: cmd = value;
217: DPRINTF("%s: offset %08x %08x %d\n", __func__, offset, value, width);
218: if (pfl->cmd != 0xA0 && cmd == 0xF0) {
219: DPRINTF("%s: flash reset asked (%02x %02x)\n",
220: __func__, pfl->cmd, cmd);
221: goto reset_flash;
222: }
223: /* Set the device in I/O access mode */
224: cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);
225: boff = offset & (pfl->sector_len - 1);
226: if (pfl->width == 2)
227: boff = boff >> 1;
228: else if (pfl->width == 4)
229: boff = boff >> 2;
230: switch (pfl->wcycle) {
231: case 0:
232: /* We're in read mode */
233: check_unlock0:
234: if (boff == 0x55 && cmd == 0x98) {
235: enter_CFI_mode:
236: /* Enter CFI query mode */
237: pfl->wcycle = 7;
238: pfl->cmd = 0x98;
239: return;
240: }
241: if (boff != 0x555 || cmd != 0xAA) {
242: DPRINTF("%s: unlock0 failed %04x %02x %04x\n",
243: __func__, boff, cmd, 0x555);
244: goto reset_flash;
245: }
246: DPRINTF("%s: unlock sequence started\n", __func__);
247: break;
248: case 1:
249: /* We started an unlock sequence */
250: check_unlock1:
251: if (boff != 0x2AA || cmd != 0x55) {
252: DPRINTF("%s: unlock1 failed %04x %02x\n", __func__, boff, cmd);
253: goto reset_flash;
254: }
255: DPRINTF("%s: unlock sequence done\n", __func__);
256: break;
257: case 2:
258: /* We finished an unlock sequence */
259: if (!pfl->bypass && boff != 0x555) {
260: DPRINTF("%s: command failed %04x %02x\n", __func__, boff, cmd);
261: goto reset_flash;
262: }
263: switch (cmd) {
264: case 0x20:
265: pfl->bypass = 1;
266: goto do_bypass;
267: case 0x80:
268: case 0x90:
269: case 0xA0:
270: pfl->cmd = cmd;
271: DPRINTF("%s: starting command %02x\n", __func__, cmd);
272: break;
273: default:
274: DPRINTF("%s: unknown command %02x\n", __func__, cmd);
275: goto reset_flash;
276: }
277: break;
278: case 3:
279: switch (pfl->cmd) {
280: case 0x80:
281: /* We need another unlock sequence */
282: goto check_unlock0;
283: case 0xA0:
284: DPRINTF("%s: write data offset %08x %08x %d\n",
285: __func__, offset, value, width);
286: p = pfl->storage;
287: switch (width) {
288: case 1:
289: p[offset] &= value;
290: pflash_update(pfl, offset, 1);
291: break;
292: case 2:
293: #if defined(TARGET_WORDS_BIGENDIAN)
294: p[offset] &= value >> 8;
295: p[offset + 1] &= value;
296: #else
297: p[offset] &= value;
298: p[offset + 1] &= value >> 8;
299: #endif
300: pflash_update(pfl, offset, 2);
301: break;
302: case 4:
303: #if defined(TARGET_WORDS_BIGENDIAN)
304: p[offset] &= value >> 24;
305: p[offset + 1] &= value >> 16;
306: p[offset + 2] &= value >> 8;
307: p[offset + 3] &= value;
308: #else
309: p[offset] &= value;
310: p[offset + 1] &= value >> 8;
311: p[offset + 2] &= value >> 16;
312: p[offset + 3] &= value >> 24;
313: #endif
314: pflash_update(pfl, offset, 4);
315: break;
316: }
317: pfl->status = 0x00 | ~(value & 0x80);
318: /* Let's pretend write is immediate */
319: if (pfl->bypass)
320: goto do_bypass;
321: goto reset_flash;
322: case 0x90:
323: if (pfl->bypass && cmd == 0x00) {
324: /* Unlock bypass reset */
325: goto reset_flash;
326: }
327: /* We can enter CFI query mode from autoselect mode */
328: if (boff == 0x55 && cmd == 0x98)
329: goto enter_CFI_mode;
330: /* No break here */
331: default:
332: DPRINTF("%s: invalid write for command %02x\n",
333: __func__, pfl->cmd);
334: goto reset_flash;
335: }
336: case 4:
337: switch (pfl->cmd) {
338: case 0xA0:
339: /* Ignore writes while flash data write is occuring */
340: /* As we suppose write is immediate, this should never happen */
341: return;
342: case 0x80:
343: goto check_unlock1;
344: default:
345: /* Should never happen */
346: DPRINTF("%s: invalid command state %02x (wc 4)\n",
347: __func__, pfl->cmd);
348: goto reset_flash;
349: }
350: break;
351: case 5:
352: switch (cmd) {
353: case 0x10:
354: if (boff != 0x555) {
355: DPRINTF("%s: chip erase: invalid address %04x\n",
356: __func__, offset);
357: goto reset_flash;
358: }
359: /* Chip erase */
360: DPRINTF("%s: start chip erase\n", __func__);
361: memset(pfl->storage, 0xFF, pfl->total_len);
362: pfl->status = 0x00;
363: pflash_update(pfl, 0, pfl->total_len);
364: /* Let's wait 5 seconds before chip erase is done */
365: qemu_mod_timer(pfl->timer,
366: qemu_get_clock(vm_clock) + (ticks_per_sec * 5));
367: break;
368: case 0x30:
369: /* Sector erase */
370: p = pfl->storage;
371: offset &= ~(pfl->sector_len - 1);
372: DPRINTF("%s: start sector erase at %08x\n", __func__, offset);
373: memset(p + offset, 0xFF, pfl->sector_len);
374: pflash_update(pfl, offset, pfl->sector_len);
375: pfl->status = 0x00;
376: /* Let's wait 1/2 second before sector erase is done */
377: qemu_mod_timer(pfl->timer,
378: qemu_get_clock(vm_clock) + (ticks_per_sec / 2));
379: break;
380: default:
381: DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
382: goto reset_flash;
383: }
384: pfl->cmd = cmd;
385: break;
386: case 6:
387: switch (pfl->cmd) {
388: case 0x10:
389: /* Ignore writes during chip erase */
390: return;
391: case 0x30:
392: /* Ignore writes during sector erase */
393: return;
394: default:
395: /* Should never happen */
396: DPRINTF("%s: invalid command state %02x (wc 6)\n",
397: __func__, pfl->cmd);
398: goto reset_flash;
399: }
400: break;
401: case 7: /* Special value for CFI queries */
402: DPRINTF("%s: invalid write in CFI query mode\n", __func__);
403: goto reset_flash;
404: default:
405: /* Should never happen */
406: DPRINTF("%s: invalid write state (wc 7)\n", __func__);
407: goto reset_flash;
408: }
409: pfl->wcycle++;
410:
411: return;
412:
413: /* Reset flash */
414: reset_flash:
415: if (pfl->wcycle != 0) {
416: cpu_register_physical_memory(pfl->base, pfl->total_len,
417: pfl->off | IO_MEM_ROMD | pfl->fl_mem);
418: }
419: pfl->bypass = 0;
420: pfl->wcycle = 0;
421: pfl->cmd = 0;
422: return;
423:
424: do_bypass:
425: pfl->wcycle = 2;
426: pfl->cmd = 0;
427: return;
428: }
429:
430:
431: static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
432: {
433: return pflash_read(opaque, addr, 1);
434: }
435:
436: static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
437: {
438: pflash_t *pfl = opaque;
439:
440: return pflash_read(pfl, addr, 2);
441: }
442:
443: static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
444: {
445: pflash_t *pfl = opaque;
446:
447: return pflash_read(pfl, addr, 4);
448: }
449:
450: static void pflash_writeb (void *opaque, target_phys_addr_t addr,
451: uint32_t value)
452: {
453: pflash_write(opaque, addr, value, 1);
454: }
455:
456: static void pflash_writew (void *opaque, target_phys_addr_t addr,
457: uint32_t value)
458: {
459: pflash_t *pfl = opaque;
460:
461: pflash_write(pfl, addr, value, 2);
462: }
463:
464: static void pflash_writel (void *opaque, target_phys_addr_t addr,
465: uint32_t value)
466: {
467: pflash_t *pfl = opaque;
468:
469: pflash_write(pfl, addr, value, 4);
470: }
471:
472: static CPUWriteMemoryFunc *pflash_write_ops[] = {
473: &pflash_writeb,
474: &pflash_writew,
475: &pflash_writel,
476: };
477:
478: static CPUReadMemoryFunc *pflash_read_ops[] = {
479: &pflash_readb,
480: &pflash_readw,
481: &pflash_readl,
482: };
483:
484: /* Count trailing zeroes of a 32 bits quantity */
485: static int ctz32 (uint32_t n)
486: {
487: int ret;
488:
489: ret = 0;
490: if (!(n & 0xFFFF)) {
491: ret += 16;
492: n = n >> 16;
493: }
494: if (!(n & 0xFF)) {
495: ret += 8;
496: n = n >> 8;
497: }
498: if (!(n & 0xF)) {
499: ret += 4;
500: n = n >> 4;
501: }
502: if (!(n & 0x3)) {
503: ret += 2;
504: n = n >> 2;
505: }
506: if (!(n & 0x1)) {
507: ret++;
508: n = n >> 1;
509: }
510: #if 0 /* This is not necessary as n is never 0 */
511: if (!n)
512: ret++;
513: #endif
514:
515: return ret;
516: }
517:
518: pflash_t *pflash_register (target_ulong base, ram_addr_t off,
519: BlockDriverState *bs,
520: target_ulong sector_len, int nb_blocs, int width,
521: uint16_t id0, uint16_t id1,
522: uint16_t id2, uint16_t id3)
523: {
524: pflash_t *pfl;
525: target_long total_len;
526:
527: total_len = sector_len * nb_blocs;
528: /* XXX: to be fixed */
529: if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
530: total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
531: return NULL;
532: pfl = qemu_mallocz(sizeof(pflash_t));
533: if (pfl == NULL)
534: return NULL;
535: pfl->storage = phys_ram_base + off;
536: pfl->fl_mem = cpu_register_io_memory(0, pflash_read_ops, pflash_write_ops, pfl);
537: pfl->off = off;
538: cpu_register_physical_memory(base, total_len,
539: off | pfl->fl_mem | IO_MEM_ROMD);
540: pfl->bs = bs;
541: if (pfl->bs) {
542: /* read the initial flash content */
543: bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
544: }
545: #if 0 /* XXX: there should be a bit to set up read-only,
546: * the same way the hardware does (with WP pin).
547: */
548: pfl->ro = 1;
549: #else
550: pfl->ro = 0;
551: #endif
552: pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
553: pfl->base = base;
554: pfl->sector_len = sector_len;
555: pfl->total_len = total_len;
556: pfl->width = width;
557: pfl->wcycle = 0;
558: pfl->cmd = 0;
559: pfl->status = 0;
560: pfl->ident[0] = id0;
561: pfl->ident[1] = id1;
562: pfl->ident[2] = id2;
563: pfl->ident[3] = id3;
564: /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
565: pfl->cfi_len = 0x52;
566: /* Standard "QRY" string */
567: pfl->cfi_table[0x10] = 'Q';
568: pfl->cfi_table[0x11] = 'R';
569: pfl->cfi_table[0x12] = 'Y';
570: /* Command set (AMD/Fujitsu) */
571: pfl->cfi_table[0x13] = 0x02;
572: pfl->cfi_table[0x14] = 0x00;
573: /* Primary extended table address (none) */
574: pfl->cfi_table[0x15] = 0x00;
575: pfl->cfi_table[0x16] = 0x00;
576: /* Alternate command set (none) */
577: pfl->cfi_table[0x17] = 0x00;
578: pfl->cfi_table[0x18] = 0x00;
579: /* Alternate extended table (none) */
580: pfl->cfi_table[0x19] = 0x00;
581: pfl->cfi_table[0x1A] = 0x00;
582: /* Vcc min */
583: pfl->cfi_table[0x1B] = 0x27;
584: /* Vcc max */
585: pfl->cfi_table[0x1C] = 0x36;
586: /* Vpp min (no Vpp pin) */
587: pfl->cfi_table[0x1D] = 0x00;
588: /* Vpp max (no Vpp pin) */
589: pfl->cfi_table[0x1E] = 0x00;
590: /* Reserved */
591: pfl->cfi_table[0x1F] = 0x07;
592: /* Timeout for min size buffer write (16 �s) */
593: pfl->cfi_table[0x20] = 0x04;
594: /* Typical timeout for block erase (512 ms) */
595: pfl->cfi_table[0x21] = 0x09;
596: /* Typical timeout for full chip erase (4096 ms) */
597: pfl->cfi_table[0x22] = 0x0C;
598: /* Reserved */
599: pfl->cfi_table[0x23] = 0x01;
600: /* Max timeout for buffer write */
601: pfl->cfi_table[0x24] = 0x04;
602: /* Max timeout for block erase */
603: pfl->cfi_table[0x25] = 0x0A;
604: /* Max timeout for chip erase */
605: pfl->cfi_table[0x26] = 0x0D;
606: /* Device size */
607: pfl->cfi_table[0x27] = ctz32(total_len) + 1;
608: /* Flash device interface (8 & 16 bits) */
609: pfl->cfi_table[0x28] = 0x02;
610: pfl->cfi_table[0x29] = 0x00;
611: /* Max number of bytes in multi-bytes write */
612: pfl->cfi_table[0x2A] = 0x05;
613: pfl->cfi_table[0x2B] = 0x00;
614: /* Number of erase block regions (uniform) */
615: pfl->cfi_table[0x2C] = 0x01;
616: /* Erase block region 1 */
617: pfl->cfi_table[0x2D] = nb_blocs - 1;
618: pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
619: pfl->cfi_table[0x2F] = sector_len >> 8;
620: pfl->cfi_table[0x30] = sector_len >> 16;
621:
622: return pfl;
623: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.