blob: 135c85079761bb1e499668c9f5a54770d2879c4b [file] [log] [blame]
bellard29133e92006-06-25 22:28:15 +00001/*
2 * CFI parallel flash with AMD command set emulation
ths5fafdf22007-09-16 21:08:06 +00003 *
bellard29133e92006-06-25 22:28:15 +00004 * Copyright (c) 2005 Jocelyn Mayer
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
Blue Swirl8167ee82009-07-16 20:47:01 +000017 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
bellard29133e92006-06-25 22:28:15 +000018 */
19
20/*
21 * For now, this code can emulate flashes of 1, 2 or 4 bytes width.
22 * Supported commands/modes are:
23 * - flash read
24 * - flash write
25 * - flash ID read
26 * - sector erase
27 * - chip erase
28 * - unlock bypass command
29 * - CFI queries
30 *
31 * It does not support flash interleaving.
32 * It does not implement boot blocs with reduced size
33 * It does not implement software data protection as found in many real chips
34 * It does not implement erase suspend/resume commands
35 * It does not implement multiple sectors erase
36 */
37
pbrook87ecb682007-11-17 17:14:51 +000038#include "hw.h"
39#include "flash.h"
40#include "qemu-timer.h"
41#include "block.h"
bellard29133e92006-06-25 22:28:15 +000042
43//#define PFLASH_DEBUG
44#ifdef PFLASH_DEBUG
Blue Swirl001faf32009-05-13 17:53:17 +000045#define DPRINTF(fmt, ...) \
bellard29133e92006-06-25 22:28:15 +000046do { \
Blue Swirl001faf32009-05-13 17:53:17 +000047 printf("PFLASH: " fmt , ## __VA_ARGS__); \
bellard29133e92006-06-25 22:28:15 +000048} while (0)
49#else
Blue Swirl001faf32009-05-13 17:53:17 +000050#define DPRINTF(fmt, ...) do { } while (0)
bellard29133e92006-06-25 22:28:15 +000051#endif
52
Anthony Liguoric227f092009-10-01 16:12:16 -050053struct pflash_t {
bellard29133e92006-06-25 22:28:15 +000054 BlockDriverState *bs;
Anthony Liguoric227f092009-10-01 16:12:16 -050055 target_phys_addr_t base;
blueswir171db7102007-06-08 16:45:23 +000056 uint32_t sector_len;
balrog4fbd24b2008-04-16 23:45:36 +000057 uint32_t chip_len;
58 int mappings;
bellard29133e92006-06-25 22:28:15 +000059 int width;
60 int wcycle; /* if 0, the flash is read normally */
61 int bypass;
62 int ro;
63 uint8_t cmd;
64 uint8_t status;
65 uint16_t ident[4];
balrog67250702008-04-16 23:37:15 +000066 uint16_t unlock_addr[2];
bellard29133e92006-06-25 22:28:15 +000067 uint8_t cfi_len;
68 uint8_t cfi_table[0x52];
69 QEMUTimer *timer;
Anthony Liguoric227f092009-10-01 16:12:16 -050070 ram_addr_t off;
bellard29133e92006-06-25 22:28:15 +000071 int fl_mem;
balrog9c9bb6c2008-04-16 23:58:02 +000072 int rom_mode;
bellard29133e92006-06-25 22:28:15 +000073 void *storage;
74};
75
Anthony Liguoric227f092009-10-01 16:12:16 -050076static void pflash_register_memory(pflash_t *pfl, int rom_mode)
balrog4fbd24b2008-04-16 23:45:36 +000077{
78 unsigned long phys_offset = pfl->fl_mem;
79 int i;
80
81 if (rom_mode)
82 phys_offset |= pfl->off | IO_MEM_ROMD;
balrog9c9bb6c2008-04-16 23:58:02 +000083 pfl->rom_mode = rom_mode;
balrog4fbd24b2008-04-16 23:45:36 +000084
85 for (i = 0; i < pfl->mappings; i++)
86 cpu_register_physical_memory(pfl->base + i * pfl->chip_len,
87 pfl->chip_len, phys_offset);
88}
89
bellard29133e92006-06-25 22:28:15 +000090static void pflash_timer (void *opaque)
91{
Anthony Liguoric227f092009-10-01 16:12:16 -050092 pflash_t *pfl = opaque;
bellard29133e92006-06-25 22:28:15 +000093
94 DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);
95 /* Reset flash */
96 pfl->status ^= 0x80;
97 if (pfl->bypass) {
98 pfl->wcycle = 2;
99 } else {
balrog4fbd24b2008-04-16 23:45:36 +0000100 pflash_register_memory(pfl, 1);
bellard29133e92006-06-25 22:28:15 +0000101 pfl->wcycle = 0;
102 }
103 pfl->cmd = 0;
104}
105
Anthony Liguoric227f092009-10-01 16:12:16 -0500106static uint32_t pflash_read (pflash_t *pfl, uint32_t offset, int width)
bellard29133e92006-06-25 22:28:15 +0000107{
blueswir171db7102007-06-08 16:45:23 +0000108 uint32_t boff;
bellard29133e92006-06-25 22:28:15 +0000109 uint32_t ret;
110 uint8_t *p;
111
j_mayere96efcf2007-04-14 12:17:09 +0000112 DPRINTF("%s: offset " TARGET_FMT_lx "\n", __func__, offset);
bellard29133e92006-06-25 22:28:15 +0000113 ret = -1;
balrog9c9bb6c2008-04-16 23:58:02 +0000114 if (pfl->rom_mode) {
balrog9c9bb6c2008-04-16 23:58:02 +0000115 /* Lazy reset of to ROMD mode */
116 if (pfl->wcycle == 0)
117 pflash_register_memory(pfl, 1);
pbrook0f459d12008-06-09 00:20:13 +0000118 }
balrog4fbd24b2008-04-16 23:45:36 +0000119 offset &= pfl->chip_len - 1;
bellard29133e92006-06-25 22:28:15 +0000120 boff = offset & 0xFF;
121 if (pfl->width == 2)
122 boff = boff >> 1;
123 else if (pfl->width == 4)
124 boff = boff >> 2;
125 switch (pfl->cmd) {
126 default:
127 /* This should never happen : reset state & treat it as a read*/
128 DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);
129 pfl->wcycle = 0;
130 pfl->cmd = 0;
131 case 0x80:
132 /* We accept reads during second unlock sequence... */
133 case 0x00:
134 flash_read:
135 /* Flash area read */
136 p = pfl->storage;
137 switch (width) {
138 case 1:
139 ret = p[offset];
140// DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);
141 break;
142 case 2:
143#if defined(TARGET_WORDS_BIGENDIAN)
144 ret = p[offset] << 8;
145 ret |= p[offset + 1];
146#else
147 ret = p[offset];
148 ret |= p[offset + 1] << 8;
149#endif
150// DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);
151 break;
152 case 4:
153#if defined(TARGET_WORDS_BIGENDIAN)
154 ret = p[offset] << 24;
155 ret |= p[offset + 1] << 16;
156 ret |= p[offset + 2] << 8;
157 ret |= p[offset + 3];
158#else
159 ret = p[offset];
160 ret |= p[offset + 1] << 8;
bellard29133e92006-06-25 22:28:15 +0000161 ret |= p[offset + 2] << 16;
162 ret |= p[offset + 3] << 24;
163#endif
164// DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);
165 break;
166 }
167 break;
168 case 0x90:
169 /* flash ID read */
170 switch (boff) {
171 case 0x00:
172 case 0x01:
173 ret = pfl->ident[boff & 0x01];
174 break;
175 case 0x02:
176 ret = 0x00; /* Pretend all sectors are unprotected */
177 break;
178 case 0x0E:
179 case 0x0F:
180 if (pfl->ident[2 + (boff & 0x01)] == (uint8_t)-1)
181 goto flash_read;
182 ret = pfl->ident[2 + (boff & 0x01)];
183 break;
184 default:
185 goto flash_read;
186 }
j_mayere96efcf2007-04-14 12:17:09 +0000187 DPRINTF("%s: ID " TARGET_FMT_ld " %x\n", __func__, boff, ret);
bellard29133e92006-06-25 22:28:15 +0000188 break;
189 case 0xA0:
190 case 0x10:
191 case 0x30:
192 /* Status register read */
193 ret = pfl->status;
194 DPRINTF("%s: status %x\n", __func__, ret);
195 /* Toggle bit 6 */
196 pfl->status ^= 0x40;
197 break;
198 case 0x98:
199 /* CFI query mode */
200 if (boff > pfl->cfi_len)
201 ret = 0;
202 else
203 ret = pfl->cfi_table[boff];
204 break;
205 }
206
207 return ret;
208}
209
210/* update flash content on disk */
Anthony Liguoric227f092009-10-01 16:12:16 -0500211static void pflash_update(pflash_t *pfl, int offset,
bellard29133e92006-06-25 22:28:15 +0000212 int size)
213{
214 int offset_end;
215 if (pfl->bs) {
216 offset_end = offset + size;
217 /* round to sectors */
218 offset = offset >> 9;
219 offset_end = (offset_end + 511) >> 9;
ths5fafdf22007-09-16 21:08:06 +0000220 bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),
bellard29133e92006-06-25 22:28:15 +0000221 offset_end - offset);
222 }
223}
224
Anthony Liguoric227f092009-10-01 16:12:16 -0500225static void pflash_write (pflash_t *pfl, uint32_t offset, uint32_t value,
bellard29133e92006-06-25 22:28:15 +0000226 int width)
227{
blueswir171db7102007-06-08 16:45:23 +0000228 uint32_t boff;
bellard29133e92006-06-25 22:28:15 +0000229 uint8_t *p;
230 uint8_t cmd;
231
j_mayer95d1f3e2007-04-16 07:14:26 +0000232 cmd = value;
233 if (pfl->cmd != 0xA0 && cmd == 0xF0) {
234#if 0
235 DPRINTF("%s: flash reset asked (%02x %02x)\n",
236 __func__, pfl->cmd, cmd);
237#endif
238 goto reset_flash;
239 }
240 DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d %d\n", __func__,
241 offset, value, width, pfl->wcycle);
balrog4fbd24b2008-04-16 23:45:36 +0000242 offset &= pfl->chip_len - 1;
ths3b46e622007-09-17 08:09:54 +0000243
j_mayere96efcf2007-04-14 12:17:09 +0000244 DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d\n", __func__,
245 offset, value, width);
bellard29133e92006-06-25 22:28:15 +0000246 boff = offset & (pfl->sector_len - 1);
247 if (pfl->width == 2)
248 boff = boff >> 1;
249 else if (pfl->width == 4)
250 boff = boff >> 2;
251 switch (pfl->wcycle) {
252 case 0:
balrog9c9bb6c2008-04-16 23:58:02 +0000253 /* Set the device in I/O access mode if required */
254 if (pfl->rom_mode)
255 pflash_register_memory(pfl, 0);
bellard29133e92006-06-25 22:28:15 +0000256 /* We're in read mode */
257 check_unlock0:
258 if (boff == 0x55 && cmd == 0x98) {
259 enter_CFI_mode:
260 /* Enter CFI query mode */
261 pfl->wcycle = 7;
262 pfl->cmd = 0x98;
263 return;
264 }
balrog67250702008-04-16 23:37:15 +0000265 if (boff != pfl->unlock_addr[0] || cmd != 0xAA) {
j_mayere96efcf2007-04-14 12:17:09 +0000266 DPRINTF("%s: unlock0 failed " TARGET_FMT_lx " %02x %04x\n",
balrog67250702008-04-16 23:37:15 +0000267 __func__, boff, cmd, pfl->unlock_addr[0]);
bellard29133e92006-06-25 22:28:15 +0000268 goto reset_flash;
269 }
270 DPRINTF("%s: unlock sequence started\n", __func__);
271 break;
272 case 1:
273 /* We started an unlock sequence */
274 check_unlock1:
balrog67250702008-04-16 23:37:15 +0000275 if (boff != pfl->unlock_addr[1] || cmd != 0x55) {
j_mayere96efcf2007-04-14 12:17:09 +0000276 DPRINTF("%s: unlock1 failed " TARGET_FMT_lx " %02x\n", __func__,
277 boff, cmd);
bellard29133e92006-06-25 22:28:15 +0000278 goto reset_flash;
279 }
280 DPRINTF("%s: unlock sequence done\n", __func__);
281 break;
282 case 2:
283 /* We finished an unlock sequence */
balrog67250702008-04-16 23:37:15 +0000284 if (!pfl->bypass && boff != pfl->unlock_addr[0]) {
j_mayere96efcf2007-04-14 12:17:09 +0000285 DPRINTF("%s: command failed " TARGET_FMT_lx " %02x\n", __func__,
286 boff, cmd);
bellard29133e92006-06-25 22:28:15 +0000287 goto reset_flash;
288 }
289 switch (cmd) {
290 case 0x20:
291 pfl->bypass = 1;
292 goto do_bypass;
293 case 0x80:
294 case 0x90:
295 case 0xA0:
296 pfl->cmd = cmd;
297 DPRINTF("%s: starting command %02x\n", __func__, cmd);
298 break;
299 default:
300 DPRINTF("%s: unknown command %02x\n", __func__, cmd);
301 goto reset_flash;
302 }
303 break;
304 case 3:
305 switch (pfl->cmd) {
306 case 0x80:
307 /* We need another unlock sequence */
308 goto check_unlock0;
309 case 0xA0:
j_mayere96efcf2007-04-14 12:17:09 +0000310 DPRINTF("%s: write data offset " TARGET_FMT_lx " %08x %d\n",
bellard29133e92006-06-25 22:28:15 +0000311 __func__, offset, value, width);
312 p = pfl->storage;
313 switch (width) {
314 case 1:
315 p[offset] &= value;
316 pflash_update(pfl, offset, 1);
317 break;
318 case 2:
319#if defined(TARGET_WORDS_BIGENDIAN)
320 p[offset] &= value >> 8;
321 p[offset + 1] &= value;
322#else
323 p[offset] &= value;
324 p[offset + 1] &= value >> 8;
325#endif
326 pflash_update(pfl, offset, 2);
327 break;
328 case 4:
329#if defined(TARGET_WORDS_BIGENDIAN)
330 p[offset] &= value >> 24;
331 p[offset + 1] &= value >> 16;
332 p[offset + 2] &= value >> 8;
333 p[offset + 3] &= value;
334#else
335 p[offset] &= value;
336 p[offset + 1] &= value >> 8;
337 p[offset + 2] &= value >> 16;
338 p[offset + 3] &= value >> 24;
339#endif
340 pflash_update(pfl, offset, 4);
341 break;
342 }
343 pfl->status = 0x00 | ~(value & 0x80);
344 /* Let's pretend write is immediate */
345 if (pfl->bypass)
346 goto do_bypass;
347 goto reset_flash;
348 case 0x90:
349 if (pfl->bypass && cmd == 0x00) {
350 /* Unlock bypass reset */
351 goto reset_flash;
352 }
353 /* We can enter CFI query mode from autoselect mode */
354 if (boff == 0x55 && cmd == 0x98)
355 goto enter_CFI_mode;
356 /* No break here */
357 default:
358 DPRINTF("%s: invalid write for command %02x\n",
359 __func__, pfl->cmd);
360 goto reset_flash;
361 }
362 case 4:
363 switch (pfl->cmd) {
364 case 0xA0:
365 /* Ignore writes while flash data write is occuring */
366 /* As we suppose write is immediate, this should never happen */
367 return;
368 case 0x80:
369 goto check_unlock1;
370 default:
371 /* Should never happen */
372 DPRINTF("%s: invalid command state %02x (wc 4)\n",
373 __func__, pfl->cmd);
374 goto reset_flash;
375 }
376 break;
377 case 5:
378 switch (cmd) {
379 case 0x10:
balrog67250702008-04-16 23:37:15 +0000380 if (boff != pfl->unlock_addr[0]) {
j_mayere96efcf2007-04-14 12:17:09 +0000381 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_lx "\n",
bellard29133e92006-06-25 22:28:15 +0000382 __func__, offset);
383 goto reset_flash;
384 }
385 /* Chip erase */
386 DPRINTF("%s: start chip erase\n", __func__);
balrog4fbd24b2008-04-16 23:45:36 +0000387 memset(pfl->storage, 0xFF, pfl->chip_len);
bellard29133e92006-06-25 22:28:15 +0000388 pfl->status = 0x00;
balrog4fbd24b2008-04-16 23:45:36 +0000389 pflash_update(pfl, 0, pfl->chip_len);
bellard29133e92006-06-25 22:28:15 +0000390 /* Let's wait 5 seconds before chip erase is done */
ths5fafdf22007-09-16 21:08:06 +0000391 qemu_mod_timer(pfl->timer,
Juan Quintela6ee093c2009-09-10 03:04:26 +0200392 qemu_get_clock(vm_clock) + (get_ticks_per_sec() * 5));
bellard29133e92006-06-25 22:28:15 +0000393 break;
394 case 0x30:
395 /* Sector erase */
396 p = pfl->storage;
397 offset &= ~(pfl->sector_len - 1);
j_mayere96efcf2007-04-14 12:17:09 +0000398 DPRINTF("%s: start sector erase at " TARGET_FMT_lx "\n", __func__,
399 offset);
bellard29133e92006-06-25 22:28:15 +0000400 memset(p + offset, 0xFF, pfl->sector_len);
401 pflash_update(pfl, offset, pfl->sector_len);
402 pfl->status = 0x00;
403 /* Let's wait 1/2 second before sector erase is done */
ths5fafdf22007-09-16 21:08:06 +0000404 qemu_mod_timer(pfl->timer,
Juan Quintela6ee093c2009-09-10 03:04:26 +0200405 qemu_get_clock(vm_clock) + (get_ticks_per_sec() / 2));
bellard29133e92006-06-25 22:28:15 +0000406 break;
407 default:
408 DPRINTF("%s: invalid command %02x (wc 5)\n", __func__, cmd);
409 goto reset_flash;
410 }
411 pfl->cmd = cmd;
412 break;
413 case 6:
414 switch (pfl->cmd) {
415 case 0x10:
416 /* Ignore writes during chip erase */
417 return;
418 case 0x30:
419 /* Ignore writes during sector erase */
420 return;
421 default:
422 /* Should never happen */
423 DPRINTF("%s: invalid command state %02x (wc 6)\n",
424 __func__, pfl->cmd);
425 goto reset_flash;
426 }
427 break;
428 case 7: /* Special value for CFI queries */
429 DPRINTF("%s: invalid write in CFI query mode\n", __func__);
430 goto reset_flash;
431 default:
432 /* Should never happen */
433 DPRINTF("%s: invalid write state (wc 7)\n", __func__);
434 goto reset_flash;
435 }
436 pfl->wcycle++;
437
438 return;
439
440 /* Reset flash */
441 reset_flash:
bellard29133e92006-06-25 22:28:15 +0000442 pfl->bypass = 0;
443 pfl->wcycle = 0;
444 pfl->cmd = 0;
445 return;
446
447 do_bypass:
448 pfl->wcycle = 2;
449 pfl->cmd = 0;
450 return;
451}
452
453
Anthony Liguoric227f092009-10-01 16:12:16 -0500454static uint32_t pflash_readb (void *opaque, target_phys_addr_t addr)
bellard29133e92006-06-25 22:28:15 +0000455{
456 return pflash_read(opaque, addr, 1);
457}
458
Anthony Liguoric227f092009-10-01 16:12:16 -0500459static uint32_t pflash_readw (void *opaque, target_phys_addr_t addr)
bellard29133e92006-06-25 22:28:15 +0000460{
Anthony Liguoric227f092009-10-01 16:12:16 -0500461 pflash_t *pfl = opaque;
bellard29133e92006-06-25 22:28:15 +0000462
463 return pflash_read(pfl, addr, 2);
464}
465
Anthony Liguoric227f092009-10-01 16:12:16 -0500466static uint32_t pflash_readl (void *opaque, target_phys_addr_t addr)
bellard29133e92006-06-25 22:28:15 +0000467{
Anthony Liguoric227f092009-10-01 16:12:16 -0500468 pflash_t *pfl = opaque;
bellard29133e92006-06-25 22:28:15 +0000469
470 return pflash_read(pfl, addr, 4);
471}
472
Anthony Liguoric227f092009-10-01 16:12:16 -0500473static void pflash_writeb (void *opaque, target_phys_addr_t addr,
bellard29133e92006-06-25 22:28:15 +0000474 uint32_t value)
475{
476 pflash_write(opaque, addr, value, 1);
477}
478
Anthony Liguoric227f092009-10-01 16:12:16 -0500479static void pflash_writew (void *opaque, target_phys_addr_t addr,
bellard29133e92006-06-25 22:28:15 +0000480 uint32_t value)
481{
Anthony Liguoric227f092009-10-01 16:12:16 -0500482 pflash_t *pfl = opaque;
bellard29133e92006-06-25 22:28:15 +0000483
484 pflash_write(pfl, addr, value, 2);
485}
486
Anthony Liguoric227f092009-10-01 16:12:16 -0500487static void pflash_writel (void *opaque, target_phys_addr_t addr,
bellard29133e92006-06-25 22:28:15 +0000488 uint32_t value)
489{
Anthony Liguoric227f092009-10-01 16:12:16 -0500490 pflash_t *pfl = opaque;
bellard29133e92006-06-25 22:28:15 +0000491
492 pflash_write(pfl, addr, value, 4);
493}
494
Blue Swirld60efc62009-08-25 18:29:31 +0000495static CPUWriteMemoryFunc * const pflash_write_ops[] = {
bellard29133e92006-06-25 22:28:15 +0000496 &pflash_writeb,
497 &pflash_writew,
498 &pflash_writel,
499};
500
Blue Swirld60efc62009-08-25 18:29:31 +0000501static CPUReadMemoryFunc * const pflash_read_ops[] = {
bellard29133e92006-06-25 22:28:15 +0000502 &pflash_readb,
503 &pflash_readw,
504 &pflash_readl,
505};
506
507/* Count trailing zeroes of a 32 bits quantity */
508static int ctz32 (uint32_t n)
509{
510 int ret;
511
512 ret = 0;
513 if (!(n & 0xFFFF)) {
514 ret += 16;
515 n = n >> 16;
516 }
517 if (!(n & 0xFF)) {
518 ret += 8;
519 n = n >> 8;
520 }
521 if (!(n & 0xF)) {
522 ret += 4;
523 n = n >> 4;
524 }
525 if (!(n & 0x3)) {
526 ret += 2;
527 n = n >> 2;
528 }
529 if (!(n & 0x1)) {
530 ret++;
531 n = n >> 1;
532 }
533#if 0 /* This is not necessary as n is never 0 */
534 if (!n)
535 ret++;
536#endif
537
538 return ret;
539}
540
Anthony Liguoric227f092009-10-01 16:12:16 -0500541pflash_t *pflash_cfi02_register(target_phys_addr_t base, ram_addr_t off,
balrogcf6d9112007-12-10 01:07:47 +0000542 BlockDriverState *bs, uint32_t sector_len,
balrog4fbd24b2008-04-16 23:45:36 +0000543 int nb_blocs, int nb_mappings, int width,
balrog88eeee02007-12-10 00:28:27 +0000544 uint16_t id0, uint16_t id1,
balrog67250702008-04-16 23:37:15 +0000545 uint16_t id2, uint16_t id3,
546 uint16_t unlock_addr0, uint16_t unlock_addr1)
bellard29133e92006-06-25 22:28:15 +0000547{
Anthony Liguoric227f092009-10-01 16:12:16 -0500548 pflash_t *pfl;
balrog4fbd24b2008-04-16 23:45:36 +0000549 int32_t chip_len;
Vijay Kumard0e76052009-08-21 10:27:38 +0530550 int ret;
bellard29133e92006-06-25 22:28:15 +0000551
balrog4fbd24b2008-04-16 23:45:36 +0000552 chip_len = sector_len * nb_blocs;
bellard29133e92006-06-25 22:28:15 +0000553 /* XXX: to be fixed */
j_mayer95d1f3e2007-04-16 07:14:26 +0000554#if 0
bellard29133e92006-06-25 22:28:15 +0000555 if (total_len != (8 * 1024 * 1024) && total_len != (16 * 1024 * 1024) &&
556 total_len != (32 * 1024 * 1024) && total_len != (64 * 1024 * 1024))
557 return NULL;
j_mayer95d1f3e2007-04-16 07:14:26 +0000558#endif
Anthony Liguoric227f092009-10-01 16:12:16 -0500559 pfl = qemu_mallocz(sizeof(pflash_t));
pbrook5c130f62009-04-10 14:29:45 +0000560 /* FIXME: Allocate ram ourselves. */
561 pfl->storage = qemu_get_ram_ptr(off);
Avi Kivity1eed09c2009-06-14 11:38:51 +0300562 pfl->fl_mem = cpu_register_io_memory(pflash_read_ops, pflash_write_ops,
j_mayer95d1f3e2007-04-16 07:14:26 +0000563 pfl);
bellard29133e92006-06-25 22:28:15 +0000564 pfl->off = off;
balrog4fbd24b2008-04-16 23:45:36 +0000565 pfl->base = base;
566 pfl->chip_len = chip_len;
567 pfl->mappings = nb_mappings;
568 pflash_register_memory(pfl, 1);
bellard29133e92006-06-25 22:28:15 +0000569 pfl->bs = bs;
570 if (pfl->bs) {
571 /* read the initial flash content */
Vijay Kumard0e76052009-08-21 10:27:38 +0530572 ret = bdrv_read(pfl->bs, 0, pfl->storage, chip_len >> 9);
573 if (ret < 0) {
574 cpu_unregister_io_memory(pfl->fl_mem);
575 qemu_free(pfl);
576 return NULL;
577 }
bellard29133e92006-06-25 22:28:15 +0000578 }
579#if 0 /* XXX: there should be a bit to set up read-only,
580 * the same way the hardware does (with WP pin).
581 */
582 pfl->ro = 1;
583#else
584 pfl->ro = 0;
585#endif
586 pfl->timer = qemu_new_timer(vm_clock, pflash_timer, pfl);
bellard29133e92006-06-25 22:28:15 +0000587 pfl->sector_len = sector_len;
bellard29133e92006-06-25 22:28:15 +0000588 pfl->width = width;
589 pfl->wcycle = 0;
590 pfl->cmd = 0;
591 pfl->status = 0;
592 pfl->ident[0] = id0;
593 pfl->ident[1] = id1;
594 pfl->ident[2] = id2;
595 pfl->ident[3] = id3;
balrog67250702008-04-16 23:37:15 +0000596 pfl->unlock_addr[0] = unlock_addr0;
597 pfl->unlock_addr[1] = unlock_addr1;
bellard29133e92006-06-25 22:28:15 +0000598 /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
599 pfl->cfi_len = 0x52;
600 /* Standard "QRY" string */
601 pfl->cfi_table[0x10] = 'Q';
602 pfl->cfi_table[0x11] = 'R';
603 pfl->cfi_table[0x12] = 'Y';
604 /* Command set (AMD/Fujitsu) */
605 pfl->cfi_table[0x13] = 0x02;
606 pfl->cfi_table[0x14] = 0x00;
edgar_igl78556822008-05-08 21:02:43 +0000607 /* Primary extended table address */
608 pfl->cfi_table[0x15] = 0x31;
bellard29133e92006-06-25 22:28:15 +0000609 pfl->cfi_table[0x16] = 0x00;
610 /* Alternate command set (none) */
611 pfl->cfi_table[0x17] = 0x00;
612 pfl->cfi_table[0x18] = 0x00;
613 /* Alternate extended table (none) */
614 pfl->cfi_table[0x19] = 0x00;
615 pfl->cfi_table[0x1A] = 0x00;
616 /* Vcc min */
617 pfl->cfi_table[0x1B] = 0x27;
618 /* Vcc max */
619 pfl->cfi_table[0x1C] = 0x36;
620 /* Vpp min (no Vpp pin) */
621 pfl->cfi_table[0x1D] = 0x00;
622 /* Vpp max (no Vpp pin) */
623 pfl->cfi_table[0x1E] = 0x00;
624 /* Reserved */
625 pfl->cfi_table[0x1F] = 0x07;
edgar_igl78556822008-05-08 21:02:43 +0000626 /* Timeout for min size buffer write (NA) */
627 pfl->cfi_table[0x20] = 0x00;
bellard29133e92006-06-25 22:28:15 +0000628 /* Typical timeout for block erase (512 ms) */
629 pfl->cfi_table[0x21] = 0x09;
630 /* Typical timeout for full chip erase (4096 ms) */
631 pfl->cfi_table[0x22] = 0x0C;
632 /* Reserved */
633 pfl->cfi_table[0x23] = 0x01;
edgar_igl78556822008-05-08 21:02:43 +0000634 /* Max timeout for buffer write (NA) */
635 pfl->cfi_table[0x24] = 0x00;
bellard29133e92006-06-25 22:28:15 +0000636 /* Max timeout for block erase */
637 pfl->cfi_table[0x25] = 0x0A;
638 /* Max timeout for chip erase */
639 pfl->cfi_table[0x26] = 0x0D;
640 /* Device size */
edgar_igl78556822008-05-08 21:02:43 +0000641 pfl->cfi_table[0x27] = ctz32(chip_len);
bellard29133e92006-06-25 22:28:15 +0000642 /* Flash device interface (8 & 16 bits) */
643 pfl->cfi_table[0x28] = 0x02;
644 pfl->cfi_table[0x29] = 0x00;
645 /* Max number of bytes in multi-bytes write */
j_mayer95d1f3e2007-04-16 07:14:26 +0000646 /* XXX: disable buffered write as it's not supported */
647 // pfl->cfi_table[0x2A] = 0x05;
648 pfl->cfi_table[0x2A] = 0x00;
bellard29133e92006-06-25 22:28:15 +0000649 pfl->cfi_table[0x2B] = 0x00;
650 /* Number of erase block regions (uniform) */
651 pfl->cfi_table[0x2C] = 0x01;
652 /* Erase block region 1 */
653 pfl->cfi_table[0x2D] = nb_blocs - 1;
654 pfl->cfi_table[0x2E] = (nb_blocs - 1) >> 8;
655 pfl->cfi_table[0x2F] = sector_len >> 8;
656 pfl->cfi_table[0x30] = sector_len >> 16;
657
edgar_igl78556822008-05-08 21:02:43 +0000658 /* Extended */
659 pfl->cfi_table[0x31] = 'P';
660 pfl->cfi_table[0x32] = 'R';
661 pfl->cfi_table[0x33] = 'I';
662
663 pfl->cfi_table[0x34] = '1';
664 pfl->cfi_table[0x35] = '0';
665
666 pfl->cfi_table[0x36] = 0x00;
667 pfl->cfi_table[0x37] = 0x00;
668 pfl->cfi_table[0x38] = 0x00;
669 pfl->cfi_table[0x39] = 0x00;
670
671 pfl->cfi_table[0x3a] = 0x00;
672
673 pfl->cfi_table[0x3b] = 0x00;
674 pfl->cfi_table[0x3c] = 0x00;
675
bellard29133e92006-06-25 22:28:15 +0000676 return pfl;
677}