2
* CFI parallel flash with Intel command set emulation
4
* Copyright (c) 2006 Thorsten Zitterell
5
* Copyright (c) 2005 Jocelyn Mayer
7
* This library is free software; you can redistribute it and/or
8
* modify it under the terms of the GNU Lesser General Public
9
* License as published by the Free Software Foundation; either
10
* version 2 of the License, or (at your option) any later version.
12
* This library is distributed in the hope that it will be useful,
13
* but WITHOUT ANY WARRANTY; without even the implied warranty of
14
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15
* Lesser General Public License for more details.
17
* You should have received a copy of the GNU Lesser General Public
18
* License along with this library; if not, see <http://www.gnu.org/licenses/>.
22
* For now, this code can emulate flashes of 1, 2 or 4 bytes width.
23
* Supported commands/modes are:
30
* It does not support timings
31
* It does not support flash interleaving
32
* It does not implement software data protection as found in many real chips
33
* It does not implement erase suspend/resume commands
34
* It does not implement multiple sectors erase
36
* It does not implement much more ...
42
#include "qemu-timer.h"
43
#include "exec-memory.h"
45
#define PFLASH_BUG(fmt, ...) \
47
printf("PFLASH: Possible BUG - " fmt, ## __VA_ARGS__); \
51
/* #define PFLASH_DEBUG */
53
#define DPRINTF(fmt, ...) \
55
printf("PFLASH: " fmt , ## __VA_ARGS__); \
58
#define DPRINTF(fmt, ...) do { } while (0)
63
target_phys_addr_t base;
64
target_phys_addr_t sector_len;
65
target_phys_addr_t total_len;
67
int wcycle; /* if 0, the flash is read normally */
74
uint8_t cfi_table[0x52];
75
target_phys_addr_t counter;
76
unsigned int writeblock_size;
82
static void pflash_timer (void *opaque)
84
pflash_t *pfl = opaque;
86
DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
92
memory_region_rom_device_set_readable(&pfl->mem, true);
98
static uint32_t pflash_read (pflash_t *pfl, target_phys_addr_t offset,
101
target_phys_addr_t boff;
106
boff = offset & 0xFF; /* why this here ?? */
110
else if (pfl->width == 4)
114
DPRINTF("%s: reading offset " TARGET_FMT_plx " under cmd %02x width %d\n",
115
__func__, offset, pfl->cmd, width);
119
/* Flash area read */
124
DPRINTF("%s: data offset " TARGET_FMT_plx " %02x\n",
125
__func__, offset, ret);
129
ret = p[offset] << 8;
130
ret |= p[offset + 1];
133
ret |= p[offset + 1] << 8;
135
DPRINTF("%s: data offset " TARGET_FMT_plx " %04x\n",
136
__func__, offset, ret);
140
ret = p[offset] << 24;
141
ret |= p[offset + 1] << 16;
142
ret |= p[offset + 2] << 8;
143
ret |= p[offset + 3];
146
ret |= p[offset + 1] << 8;
147
ret |= p[offset + 1] << 8;
148
ret |= p[offset + 2] << 16;
149
ret |= p[offset + 3] << 24;
151
DPRINTF("%s: data offset " TARGET_FMT_plx " %08x\n",
152
__func__, offset, ret);
155
DPRINTF("BUG in %s\n", __func__);
159
case 0x20: /* Block erase */
160
case 0x50: /* Clear status register */
161
case 0x60: /* Block /un)lock */
162
case 0x70: /* Status Register */
163
case 0xe8: /* Write block */
164
/* Status register read */
166
DPRINTF("%s: status %x\n", __func__, ret);
171
ret = pfl->ident[0] << 8 | pfl->ident[1];
172
DPRINTF("%s: Manufacturer Code %04x\n", __func__, ret);
175
ret = pfl->ident[2] << 8 | pfl->ident[3];
176
DPRINTF("%s: Device ID Code %04x\n", __func__, ret);
179
DPRINTF("%s: Read Device Information boff=%x\n", __func__, boff);
184
case 0x98: /* Query mode */
185
if (boff > pfl->cfi_len)
188
ret = pfl->cfi_table[boff];
191
/* This should never happen : reset state & treat it as a read */
192
DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
199
/* update flash content on disk */
200
static void pflash_update(pflash_t *pfl, int offset,
205
offset_end = offset + size;
206
/* round to sectors */
207
offset = offset >> 9;
208
offset_end = (offset_end + 511) >> 9;
209
bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
210
offset_end - offset);
214
static inline void pflash_data_write(pflash_t *pfl, target_phys_addr_t offset,
215
uint32_t value, int width, int be)
217
uint8_t *p = pfl->storage;
219
DPRINTF("%s: block write offset " TARGET_FMT_plx
220
" value %x counter " TARGET_FMT_plx "\n",
221
__func__, offset, value, pfl->counter);
228
p[offset] = value >> 8;
229
p[offset + 1] = value;
232
p[offset + 1] = value >> 8;
237
p[offset] = value >> 24;
238
p[offset + 1] = value >> 16;
239
p[offset + 2] = value >> 8;
240
p[offset + 3] = value;
243
p[offset + 1] = value >> 8;
244
p[offset + 2] = value >> 16;
245
p[offset + 3] = value >> 24;
252
static void pflash_write(pflash_t *pfl, target_phys_addr_t offset,
253
uint32_t value, int width, int be)
260
DPRINTF("%s: writing offset " TARGET_FMT_plx " value %08x width %d wcycle 0x%x\n",
261
__func__, offset, value, width, pfl->wcycle);
264
/* Set the device in I/O access mode */
265
memory_region_rom_device_set_readable(&pfl->mem, false);
268
switch (pfl->wcycle) {
274
case 0x10: /* Single Byte Program */
275
case 0x40: /* Single Byte Program */
276
DPRINTF("%s: Single Byte Program\n", __func__);
278
case 0x20: /* Block erase */
280
offset &= ~(pfl->sector_len - 1);
282
DPRINTF("%s: block erase at " TARGET_FMT_plx " bytes "
284
__func__, offset, pfl->sector_len);
286
memset(p + offset, 0xff, pfl->sector_len);
287
pflash_update(pfl, offset, pfl->sector_len);
288
pfl->status |= 0x80; /* Ready! */
290
case 0x50: /* Clear status bits */
291
DPRINTF("%s: Clear status bits\n", __func__);
294
case 0x60: /* Block (un)lock */
295
DPRINTF("%s: Block unlock\n", __func__);
297
case 0x70: /* Status Register */
298
DPRINTF("%s: Read status register\n", __func__);
301
case 0x90: /* Read Device ID */
302
DPRINTF("%s: Read Device information\n", __func__);
305
case 0x98: /* CFI query */
306
DPRINTF("%s: CFI query\n", __func__);
308
case 0xe8: /* Write to buffer */
309
DPRINTF("%s: Write to buffer\n", __func__);
310
pfl->status |= 0x80; /* Ready! */
312
case 0xff: /* Read array mode */
313
DPRINTF("%s: Read array mode\n", __func__);
323
case 0x10: /* Single Byte Program */
324
case 0x40: /* Single Byte Program */
325
DPRINTF("%s: Single Byte Program\n", __func__);
326
pflash_data_write(pfl, offset, value, width, be);
327
pflash_update(pfl, offset, width);
328
pfl->status |= 0x80; /* Ready! */
331
case 0x20: /* Block erase */
333
if (cmd == 0xd0) { /* confirm */
336
} else if (cmd == 0xff) { /* read array mode */
343
DPRINTF("%s: block write of %x bytes\n", __func__, value);
344
pfl->counter = value;
351
} else if (cmd == 0x01) {
354
} else if (cmd == 0xff) {
357
DPRINTF("%s: Unknown (un)locking command\n", __func__);
365
DPRINTF("%s: leaving query mode\n", __func__);
374
case 0xe8: /* Block write */
375
pflash_data_write(pfl, offset, value, width, be);
380
target_phys_addr_t mask = pfl->writeblock_size - 1;
383
DPRINTF("%s: block write finished\n", __func__);
385
/* Flush the entire write buffer onto backing storage. */
386
pflash_update(pfl, offset & mask, pfl->writeblock_size);
395
case 3: /* Confirm mode */
397
case 0xe8: /* Block write */
402
DPRINTF("%s: unknown command for \"write block\"\n", __func__);
403
PFLASH_BUG("Write block confirm");
412
/* Should never happen */
413
DPRINTF("%s: invalid write state\n", __func__);
419
printf("%s: Unimplemented flash cmd sequence "
420
"(offset " TARGET_FMT_plx ", wcycle 0x%x cmd 0x%x value 0x%x)\n",
421
__func__, offset, pfl->wcycle, pfl->cmd, value);
424
memory_region_rom_device_set_readable(&pfl->mem, true);
433
static uint32_t pflash_readb_be(void *opaque, target_phys_addr_t addr)
435
return pflash_read(opaque, addr, 1, 1);
438
static uint32_t pflash_readb_le(void *opaque, target_phys_addr_t addr)
440
return pflash_read(opaque, addr, 1, 0);
443
static uint32_t pflash_readw_be(void *opaque, target_phys_addr_t addr)
445
pflash_t *pfl = opaque;
447
return pflash_read(pfl, addr, 2, 1);
450
static uint32_t pflash_readw_le(void *opaque, target_phys_addr_t addr)
452
pflash_t *pfl = opaque;
454
return pflash_read(pfl, addr, 2, 0);
457
static uint32_t pflash_readl_be(void *opaque, target_phys_addr_t addr)
459
pflash_t *pfl = opaque;
461
return pflash_read(pfl, addr, 4, 1);
464
static uint32_t pflash_readl_le(void *opaque, target_phys_addr_t addr)
466
pflash_t *pfl = opaque;
468
return pflash_read(pfl, addr, 4, 0);
471
static void pflash_writeb_be(void *opaque, target_phys_addr_t addr,
474
pflash_write(opaque, addr, value, 1, 1);
477
static void pflash_writeb_le(void *opaque, target_phys_addr_t addr,
480
pflash_write(opaque, addr, value, 1, 0);
483
static void pflash_writew_be(void *opaque, target_phys_addr_t addr,
486
pflash_t *pfl = opaque;
488
pflash_write(pfl, addr, value, 2, 1);
491
static void pflash_writew_le(void *opaque, target_phys_addr_t addr,
494
pflash_t *pfl = opaque;
496
pflash_write(pfl, addr, value, 2, 0);
499
static void pflash_writel_be(void *opaque, target_phys_addr_t addr,
502
pflash_t *pfl = opaque;
504
pflash_write(pfl, addr, value, 4, 1);
507
static void pflash_writel_le(void *opaque, target_phys_addr_t addr,
510
pflash_t *pfl = opaque;
512
pflash_write(pfl, addr, value, 4, 0);
515
static const MemoryRegionOps pflash_cfi01_ops_be = {
517
.read = { pflash_readb_be, pflash_readw_be, pflash_readl_be, },
518
.write = { pflash_writeb_be, pflash_writew_be, pflash_writel_be, },
520
.endianness = DEVICE_NATIVE_ENDIAN,
523
static const MemoryRegionOps pflash_cfi01_ops_le = {
525
.read = { pflash_readb_le, pflash_readw_le, pflash_readl_le, },
526
.write = { pflash_writeb_le, pflash_writew_le, pflash_writel_le, },
528
.endianness = DEVICE_NATIVE_ENDIAN,
531
/* Count trailing zeroes of a 32 bits quantity */
532
static int ctz32 (uint32_t n)
555
#if 0 /* This is not necessary as n is never 0 */
559
#if 0 /* This is not necessary as n is never 0 */
567
pflash_t *pflash_cfi01_register(target_phys_addr_t base,
568
DeviceState *qdev, const char *name,
569
target_phys_addr_t size,
570
BlockDriverState *bs, uint32_t sector_len,
571
int nb_blocs, int width,
572
uint16_t id0, uint16_t id1,
573
uint16_t id2, uint16_t id3, int be)
576
target_phys_addr_t total_len;
579
total_len = sector_len * nb_blocs;
581
/* XXX: to be fixed */
583
if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
584
total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
588
pfl = g_malloc0(sizeof(pflash_t));
590
memory_region_init_rom_device(
591
&pfl->mem, be ? &pflash_cfi01_ops_be : &pflash_cfi01_ops_le, pfl,
593
pfl->storage = memory_region_get_ram_ptr(&pfl->mem);
594
memory_region_add_subregion(get_system_memory(), base, &pfl->mem);
598
/* read the initial flash content */
599
ret = bdrv_read(pfl->bs, 0, pfl->storage, total_len >> 9);
601
memory_region_del_subregion(get_system_memory(), &pfl->mem);
602
memory_region_destroy(&pfl->mem);
606
bdrv_attach_dev_nofail(pfl->bs, pfl);
608
#if 0 /* XXX: there should be a bit to set up read-only,
609
* the same way the hardware does (with WP pin).
615
pfl->timer = qemu_new_timer_ns(vm_clock, pflash_timer, pfl);
617
pfl->sector_len = sector_len;
618
pfl->total_len = total_len;
627
/* Hardcoded CFI table */
629
/* Standard "QRY" string */
630
pfl->cfi_table[0x10] = 'Q';
631
pfl->cfi_table[0x11] = 'R';
632
pfl->cfi_table[0x12] = 'Y';
633
/* Command set (Intel) */
634
pfl->cfi_table[0x13] = 0x01;
635
pfl->cfi_table[0x14] = 0x00;
636
/* Primary extended table address (none) */
637
pfl->cfi_table[0x15] = 0x31;
638
pfl->cfi_table[0x16] = 0x00;
639
/* Alternate command set (none) */
640
pfl->cfi_table[0x17] = 0x00;
641
pfl->cfi_table[0x18] = 0x00;
642
/* Alternate extended table (none) */
643
pfl->cfi_table[0x19] = 0x00;
644
pfl->cfi_table[0x1A] = 0x00;
646
pfl->cfi_table[0x1B] = 0x45;
648
pfl->cfi_table[0x1C] = 0x55;
649
/* Vpp min (no Vpp pin) */
650
pfl->cfi_table[0x1D] = 0x00;
651
/* Vpp max (no Vpp pin) */
652
pfl->cfi_table[0x1E] = 0x00;
654
pfl->cfi_table[0x1F] = 0x07;
655
/* Timeout for min size buffer write */
656
pfl->cfi_table[0x20] = 0x07;
657
/* Typical timeout for block erase */
658
pfl->cfi_table[0x21] = 0x0a;
659
/* Typical timeout for full chip erase (4096 ms) */
660
pfl->cfi_table[0x22] = 0x00;
662
pfl->cfi_table[0x23] = 0x04;
663
/* Max timeout for buffer write */
664
pfl->cfi_table[0x24] = 0x04;
665
/* Max timeout for block erase */
666
pfl->cfi_table[0x25] = 0x04;
667
/* Max timeout for chip erase */
668
pfl->cfi_table[0x26] = 0x00;
670
pfl->cfi_table[0x27] = ctz32(total_len); // + 1;
671
/* Flash device interface (8 & 16 bits) */
672
pfl->cfi_table[0x28] = 0x02;
673
pfl->cfi_table[0x29] = 0x00;
674
/* Max number of bytes in multi-bytes write */
676
pfl->cfi_table[0x2A] = 0x08;
678
pfl->cfi_table[0x2A] = 0x0B;
680
pfl->writeblock_size = 1 << pfl->cfi_table[0x2A];
682
pfl->cfi_table[0x2B] = 0x00;
683
/* Number of erase block regions (uniform) */
684
pfl->cfi_table[0x2C] = 0x01;
685
/* Erase block region 1 */
686
pfl->cfi_table[0x2D] = nb_blocs - 1;
687
pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
688
pfl->cfi_table[0x2F] = sector_len >> 8;
689
pfl->cfi_table[0x30] = sector_len >> 16;
692
pfl->cfi_table[0x31] = 'P';
693
pfl->cfi_table[0x32] = 'R';
694
pfl->cfi_table[0x33] = 'I';
696
pfl->cfi_table[0x34] = '1';
697
pfl->cfi_table[0x35] = '1';
699
pfl->cfi_table[0x36] = 0x00;
700
pfl->cfi_table[0x37] = 0x00;
701
pfl->cfi_table[0x38] = 0x00;
702
pfl->cfi_table[0x39] = 0x00;
704
pfl->cfi_table[0x3a] = 0x00;
706
pfl->cfi_table[0x3b] = 0x00;
707
pfl->cfi_table[0x3c] = 0x00;
712
MemoryRegion *pflash_cfi01_get_memory(pflash_t *fl)