]>
Commit | Line | Data |
---|---|---|
60b725b6 SC |
1 | /* |
2 | * QTest testcase for parallel flash with AMD command set | |
3 | * | |
4 | * Copyright (c) 2019 Stephen Checkoway | |
5 | * | |
6 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
7 | * See the COPYING file in the top-level directory. | |
8 | */ | |
9 | ||
10 | #include "qemu/osdep.h" | |
11 | #include "libqtest.h" | |
12 | ||
13 | /* | |
14 | * To test the pflash_cfi02 device, we run QEMU with the musicpal machine with | |
15 | * a pflash drive. This enables us to test some flash configurations, but not | |
16 | * all. In particular, we're limited to a 16-bit wide flash device. | |
17 | */ | |
18 | ||
19 | #define MP_FLASH_SIZE_MAX (32 * 1024 * 1024) | |
91d02312 | 20 | #define FLASH_SIZE (8 * 1024 * 1024) |
60b725b6 SC |
21 | #define BASE_ADDR (0x100000000ULL - MP_FLASH_SIZE_MAX) |
22 | ||
91d02312 PMD |
23 | /* Use a newtype to keep flash addresses separate from byte addresses. */ |
24 | typedef struct { | |
25 | uint64_t addr; | |
26 | } faddr; | |
27 | #define FLASH_ADDR(x) ((faddr) { .addr = (x) }) | |
28 | ||
29 | #define CFI_ADDR FLASH_ADDR(0x55) | |
30 | #define UNLOCK0_ADDR FLASH_ADDR(0x555) | |
31 | #define UNLOCK1_ADDR FLASH_ADDR(0x2AA) | |
60b725b6 SC |
32 | |
33 | #define CFI_CMD 0x98 | |
34 | #define UNLOCK0_CMD 0xAA | |
35 | #define UNLOCK1_CMD 0x55 | |
36 | #define AUTOSELECT_CMD 0x90 | |
37 | #define RESET_CMD 0xF0 | |
38 | #define PROGRAM_CMD 0xA0 | |
39 | #define SECTOR_ERASE_CMD 0x30 | |
40 | #define CHIP_ERASE_CMD 0x10 | |
41 | #define UNLOCK_BYPASS_CMD 0x20 | |
42 | #define UNLOCK_BYPASS_RESET_CMD 0x00 | |
43 | ||
91d02312 PMD |
44 | typedef struct { |
45 | int bank_width; | |
46 | ||
47 | QTestState *qtest; | |
48 | } FlashConfig; | |
49 | ||
60b725b6 SC |
50 | static char image_path[] = "/tmp/qtest.XXXXXX"; |
51 | ||
91d02312 PMD |
52 | /* |
53 | * The pflash implementation allows some parameters to be unspecified. We want | |
54 | * to test those configurations but we also need to know the real values in | |
55 | * our testing code. So after we launch qemu, we'll need a new FlashConfig | |
56 | * with the correct values filled in. | |
57 | */ | |
58 | static FlashConfig expand_config_defaults(const FlashConfig *c) | |
59 | { | |
60 | FlashConfig ret = *c; | |
61 | ||
62 | if (ret.bank_width == 0) { | |
63 | ret.bank_width = 2; | |
64 | } | |
65 | ||
66 | /* XXX: Limitations of test harness. */ | |
67 | assert(ret.bank_width == 2); | |
68 | return ret; | |
69 | } | |
70 | ||
71 | /* | |
72 | * Return a bit mask suitable for extracting the least significant | |
73 | * status/query response from an interleaved response. | |
74 | */ | |
75 | static inline uint64_t device_mask(const FlashConfig *c) | |
76 | { | |
77 | return (uint64_t)-1; | |
78 | } | |
79 | ||
80 | /* | |
81 | * Return a bit mask exactly as long as the bank_width. | |
82 | */ | |
83 | static inline uint64_t bank_mask(const FlashConfig *c) | |
84 | { | |
85 | if (c->bank_width == 8) { | |
86 | return (uint64_t)-1; | |
87 | } | |
88 | return (1ULL << (c->bank_width * 8)) - 1ULL; | |
89 | } | |
90 | ||
91 | static inline void flash_write(const FlashConfig *c, uint64_t byte_addr, | |
92 | uint64_t data) | |
93 | { | |
94 | /* Sanity check our tests. */ | |
95 | assert((data & ~bank_mask(c)) == 0); | |
96 | uint64_t addr = BASE_ADDR + byte_addr; | |
97 | switch (c->bank_width) { | |
98 | case 1: | |
99 | qtest_writeb(c->qtest, addr, data); | |
100 | break; | |
101 | case 2: | |
102 | qtest_writew(c->qtest, addr, data); | |
103 | break; | |
104 | case 4: | |
105 | qtest_writel(c->qtest, addr, data); | |
106 | break; | |
107 | case 8: | |
108 | qtest_writeq(c->qtest, addr, data); | |
109 | break; | |
110 | default: | |
111 | abort(); | |
112 | } | |
113 | } | |
114 | ||
115 | static inline uint64_t flash_read(const FlashConfig *c, uint64_t byte_addr) | |
116 | { | |
117 | uint64_t addr = BASE_ADDR + byte_addr; | |
118 | switch (c->bank_width) { | |
119 | case 1: | |
120 | return qtest_readb(c->qtest, addr); | |
121 | case 2: | |
122 | return qtest_readw(c->qtest, addr); | |
123 | case 4: | |
124 | return qtest_readl(c->qtest, addr); | |
125 | case 8: | |
126 | return qtest_readq(c->qtest, addr); | |
127 | default: | |
128 | abort(); | |
129 | } | |
130 | } | |
131 | ||
132 | /* | |
133 | * Convert a flash address expressed in the maximum width of the device as a | |
134 | * byte address. | |
135 | */ | |
136 | static inline uint64_t as_byte_addr(const FlashConfig *c, faddr flash_addr) | |
60b725b6 | 137 | { |
91d02312 PMD |
138 | /* |
139 | * Command addresses are always given as addresses in the maximum | |
140 | * supported bus size for the flash chip. So an x8/x16 chip in x8 mode | |
141 | * uses addresses 0xAAA and 0x555 to unlock because the least significant | |
142 | * bit is ignored. (0x555 rather than 0x554 is traditional.) | |
143 | * | |
144 | * In general we need to multiply by the maximum device width. | |
145 | */ | |
146 | return flash_addr.addr * c->bank_width; | |
60b725b6 SC |
147 | } |
148 | ||
91d02312 PMD |
149 | /* |
150 | * Return the command value or expected status replicated across all devices. | |
151 | */ | |
152 | static inline uint64_t replicate(const FlashConfig *c, uint64_t data) | |
60b725b6 | 153 | { |
91d02312 PMD |
154 | /* Sanity check our tests. */ |
155 | assert((data & ~device_mask(c)) == 0); | |
156 | return data; | |
60b725b6 SC |
157 | } |
158 | ||
91d02312 PMD |
159 | static inline void flash_cmd(const FlashConfig *c, faddr cmd_addr, |
160 | uint8_t cmd) | |
60b725b6 | 161 | { |
91d02312 | 162 | flash_write(c, as_byte_addr(c, cmd_addr), replicate(c, cmd)); |
60b725b6 SC |
163 | } |
164 | ||
91d02312 | 165 | static inline uint64_t flash_query(const FlashConfig *c, faddr query_addr) |
60b725b6 | 166 | { |
91d02312 | 167 | return flash_read(c, as_byte_addr(c, query_addr)); |
60b725b6 SC |
168 | } |
169 | ||
91d02312 | 170 | static inline uint64_t flash_query_1(const FlashConfig *c, faddr query_addr) |
60b725b6 | 171 | { |
91d02312 | 172 | return flash_query(c, query_addr) & device_mask(c); |
60b725b6 SC |
173 | } |
174 | ||
91d02312 PMD |
175 | static void unlock(const FlashConfig *c) |
176 | { | |
177 | flash_cmd(c, UNLOCK0_ADDR, UNLOCK0_CMD); | |
178 | flash_cmd(c, UNLOCK1_ADDR, UNLOCK1_CMD); | |
179 | } | |
180 | ||
181 | static void reset(const FlashConfig *c) | |
182 | { | |
183 | flash_cmd(c, FLASH_ADDR(0), RESET_CMD); | |
184 | } | |
185 | ||
186 | static void sector_erase(const FlashConfig *c, uint64_t byte_addr) | |
187 | { | |
188 | unlock(c); | |
189 | flash_cmd(c, UNLOCK0_ADDR, 0x80); | |
190 | unlock(c); | |
191 | flash_write(c, byte_addr, replicate(c, SECTOR_ERASE_CMD)); | |
192 | } | |
193 | ||
194 | static void wait_for_completion(const FlashConfig *c, uint64_t byte_addr) | |
60b725b6 SC |
195 | { |
196 | /* If DQ6 is toggling, step the clock and ensure the toggle stops. */ | |
91d02312 PMD |
197 | const uint64_t dq6 = replicate(c, 0x40); |
198 | if ((flash_read(c, byte_addr) & dq6) ^ (flash_read(c, byte_addr) & dq6)) { | |
60b725b6 | 199 | /* Wait for erase or program to finish. */ |
91d02312 | 200 | qtest_clock_step_next(c->qtest); |
60b725b6 | 201 | /* Ensure that DQ6 has stopped toggling. */ |
91d02312 | 202 | g_assert_cmphex(flash_read(c, byte_addr), ==, flash_read(c, byte_addr)); |
60b725b6 SC |
203 | } |
204 | } | |
205 | ||
91d02312 PMD |
206 | static void bypass_program(const FlashConfig *c, uint64_t byte_addr, |
207 | uint16_t data) | |
60b725b6 | 208 | { |
91d02312 PMD |
209 | flash_cmd(c, UNLOCK0_ADDR, PROGRAM_CMD); |
210 | flash_write(c, byte_addr, data); | |
60b725b6 SC |
211 | /* |
212 | * Data isn't valid until DQ6 stops toggling. We don't model this as | |
213 | * writes are immediate, but if this changes in the future, we can wait | |
214 | * until the program is complete. | |
215 | */ | |
91d02312 | 216 | wait_for_completion(c, byte_addr); |
60b725b6 SC |
217 | } |
218 | ||
91d02312 | 219 | static void program(const FlashConfig *c, uint64_t byte_addr, uint16_t data) |
60b725b6 | 220 | { |
91d02312 PMD |
221 | unlock(c); |
222 | bypass_program(c, byte_addr, data); | |
60b725b6 SC |
223 | } |
224 | ||
91d02312 | 225 | static void chip_erase(const FlashConfig *c) |
60b725b6 | 226 | { |
91d02312 PMD |
227 | unlock(c); |
228 | flash_cmd(c, UNLOCK0_ADDR, 0x80); | |
229 | unlock(c); | |
230 | flash_cmd(c, UNLOCK0_ADDR, CHIP_ERASE_CMD); | |
60b725b6 SC |
231 | } |
232 | ||
91d02312 | 233 | static void test_flash(const void *opaque) |
60b725b6 | 234 | { |
91d02312 PMD |
235 | const FlashConfig *config = opaque; |
236 | QTestState *qtest; | |
237 | qtest = qtest_initf("-M musicpal,accel=qtest" | |
238 | " -drive if=pflash,file=%s,format=raw,copy-on-read", | |
239 | image_path); | |
240 | FlashConfig explicit_config = expand_config_defaults(config); | |
241 | explicit_config.qtest = qtest; | |
242 | const FlashConfig *c = &explicit_config; | |
243 | ||
60b725b6 | 244 | /* Check the IDs. */ |
91d02312 PMD |
245 | unlock(c); |
246 | flash_cmd(c, UNLOCK0_ADDR, AUTOSELECT_CMD); | |
247 | g_assert_cmphex(flash_query(c, FLASH_ADDR(0)), ==, replicate(c, 0xBF)); | |
248 | if (c->bank_width >= 2) { | |
249 | /* | |
250 | * XXX: The ID returned by the musicpal flash chip is 16 bits which | |
251 | * wouldn't happen with an 8-bit device. It would probably be best to | |
252 | * prohibit addresses larger than the device width in pflash_cfi02.c, | |
253 | * but then we couldn't test smaller device widths at all. | |
254 | */ | |
255 | g_assert_cmphex(flash_query(c, FLASH_ADDR(1)), ==, | |
256 | replicate(c, 0x236D)); | |
257 | } | |
258 | reset(c); | |
60b725b6 SC |
259 | |
260 | /* Check the erase blocks. */ | |
91d02312 PMD |
261 | flash_cmd(c, CFI_ADDR, CFI_CMD); |
262 | g_assert_cmphex(flash_query(c, FLASH_ADDR(0x10)), ==, replicate(c, 'Q')); | |
263 | g_assert_cmphex(flash_query(c, FLASH_ADDR(0x11)), ==, replicate(c, 'R')); | |
264 | g_assert_cmphex(flash_query(c, FLASH_ADDR(0x12)), ==, replicate(c, 'Y')); | |
265 | ||
60b725b6 | 266 | /* Num erase regions. */ |
91d02312 | 267 | g_assert_cmphex(flash_query_1(c, FLASH_ADDR(0x2C)), >=, 1); |
60b725b6 | 268 | |
91d02312 PMD |
269 | uint32_t nb_sectors = flash_query_1(c, FLASH_ADDR(0x2D)) + |
270 | (flash_query_1(c, FLASH_ADDR(0x2E)) << 8) + 1; | |
271 | uint32_t sector_len = (flash_query_1(c, FLASH_ADDR(0x2F)) << 8) + | |
272 | (flash_query_1(c, FLASH_ADDR(0x30)) << 16); | |
273 | reset(c); | |
274 | ||
275 | const uint64_t dq7 = replicate(c, 0x80); | |
276 | const uint64_t dq6 = replicate(c, 0x40); | |
60b725b6 SC |
277 | /* Erase and program sector. */ |
278 | for (uint32_t i = 0; i < nb_sectors; ++i) { | |
279 | uint64_t byte_addr = i * sector_len; | |
91d02312 | 280 | sector_erase(c, byte_addr); |
60b725b6 | 281 | /* Read toggle. */ |
91d02312 | 282 | uint64_t status0 = flash_read(c, byte_addr); |
60b725b6 | 283 | /* DQ7 is 0 during an erase. */ |
91d02312 PMD |
284 | g_assert_cmphex(status0 & dq7, ==, 0); |
285 | uint64_t status1 = flash_read(c, byte_addr); | |
60b725b6 | 286 | /* DQ6 toggles during an erase. */ |
91d02312 | 287 | g_assert_cmphex(status0 & dq6, ==, ~status1 & dq6); |
60b725b6 | 288 | /* Wait for erase to complete. */ |
91d02312 | 289 | qtest_clock_step_next(c->qtest); |
60b725b6 | 290 | /* Ensure DQ6 has stopped toggling. */ |
91d02312 | 291 | g_assert_cmphex(flash_read(c, byte_addr), ==, flash_read(c, byte_addr)); |
60b725b6 | 292 | /* Now the data should be valid. */ |
91d02312 | 293 | g_assert_cmphex(flash_read(c, byte_addr), ==, bank_mask(c)); |
60b725b6 SC |
294 | |
295 | /* Program a bit pattern. */ | |
91d02312 PMD |
296 | program(c, byte_addr, 0x55); |
297 | g_assert_cmphex(flash_read(c, byte_addr) & 0xFF, ==, 0x55); | |
298 | program(c, byte_addr, 0xA5); | |
299 | g_assert_cmphex(flash_read(c, byte_addr) & 0xFF, ==, 0x05); | |
60b725b6 SC |
300 | } |
301 | ||
302 | /* Erase the chip. */ | |
91d02312 | 303 | chip_erase(c); |
60b725b6 | 304 | /* Read toggle. */ |
91d02312 | 305 | uint64_t status0 = flash_read(c, 0); |
60b725b6 | 306 | /* DQ7 is 0 during an erase. */ |
91d02312 PMD |
307 | g_assert_cmphex(status0 & dq7, ==, 0); |
308 | uint64_t status1 = flash_read(c, 0); | |
60b725b6 | 309 | /* DQ6 toggles during an erase. */ |
91d02312 | 310 | g_assert_cmphex(status0 & dq6, ==, ~status1 & dq6); |
60b725b6 | 311 | /* Wait for erase to complete. */ |
91d02312 | 312 | qtest_clock_step_next(c->qtest); |
60b725b6 | 313 | /* Ensure DQ6 has stopped toggling. */ |
91d02312 | 314 | g_assert_cmphex(flash_read(c, 0), ==, flash_read(c, 0)); |
60b725b6 | 315 | /* Now the data should be valid. */ |
91d02312 PMD |
316 | |
317 | for (uint32_t i = 0; i < nb_sectors; ++i) { | |
318 | uint64_t byte_addr = i * sector_len; | |
319 | g_assert_cmphex(flash_read(c, byte_addr), ==, bank_mask(c)); | |
320 | } | |
60b725b6 SC |
321 | |
322 | /* Unlock bypass */ | |
91d02312 PMD |
323 | unlock(c); |
324 | flash_cmd(c, UNLOCK0_ADDR, UNLOCK_BYPASS_CMD); | |
325 | bypass_program(c, 0 * c->bank_width, 0x01); | |
326 | bypass_program(c, 1 * c->bank_width, 0x23); | |
327 | bypass_program(c, 2 * c->bank_width, 0x45); | |
60b725b6 SC |
328 | /* |
329 | * Test that bypass programming, unlike normal programming can use any | |
330 | * address for the PROGRAM_CMD. | |
331 | */ | |
91d02312 PMD |
332 | flash_cmd(c, FLASH_ADDR(3 * c->bank_width), PROGRAM_CMD); |
333 | flash_write(c, 3 * c->bank_width, 0x67); | |
334 | wait_for_completion(c, 3 * c->bank_width); | |
335 | flash_cmd(c, FLASH_ADDR(0), UNLOCK_BYPASS_RESET_CMD); | |
336 | bypass_program(c, 4 * c->bank_width, 0x89); /* Should fail. */ | |
337 | g_assert_cmphex(flash_read(c, 0 * c->bank_width), ==, 0x01); | |
338 | g_assert_cmphex(flash_read(c, 1 * c->bank_width), ==, 0x23); | |
339 | g_assert_cmphex(flash_read(c, 2 * c->bank_width), ==, 0x45); | |
340 | g_assert_cmphex(flash_read(c, 3 * c->bank_width), ==, 0x67); | |
341 | g_assert_cmphex(flash_read(c, 4 * c->bank_width), ==, bank_mask(c)); | |
60b725b6 | 342 | |
6682bc1e | 343 | /* Test ignored high order bits of address. */ |
91d02312 PMD |
344 | flash_cmd(c, FLASH_ADDR(0x5555), UNLOCK0_CMD); |
345 | flash_cmd(c, FLASH_ADDR(0x2AAA), UNLOCK1_CMD); | |
346 | flash_cmd(c, FLASH_ADDR(0x5555), AUTOSELECT_CMD); | |
347 | g_assert_cmphex(flash_query(c, FLASH_ADDR(0)), ==, replicate(c, 0xBF)); | |
348 | reset(c); | |
6682bc1e | 349 | |
91d02312 | 350 | qtest_quit(qtest); |
60b725b6 SC |
351 | } |
352 | ||
353 | static void cleanup(void *opaque) | |
354 | { | |
355 | unlink(image_path); | |
356 | } | |
357 | ||
91d02312 PMD |
358 | /* |
359 | * XXX: Tests are limited to bank_width = 2 for now because that's what | |
360 | * hw/arm/musicpal.c has. | |
361 | */ | |
362 | static const FlashConfig configuration[] = { | |
363 | /* One x16 device. */ | |
364 | { | |
365 | .bank_width = 2, | |
366 | }, | |
367 | }; | |
368 | ||
60b725b6 SC |
369 | int main(int argc, char **argv) |
370 | { | |
371 | int fd = mkstemp(image_path); | |
372 | if (fd == -1) { | |
373 | g_printerr("Failed to create temporary file %s: %s\n", image_path, | |
374 | strerror(errno)); | |
375 | exit(EXIT_FAILURE); | |
376 | } | |
91d02312 | 377 | if (ftruncate(fd, FLASH_SIZE) < 0) { |
60b725b6 SC |
378 | int error_code = errno; |
379 | close(fd); | |
380 | unlink(image_path); | |
91d02312 PMD |
381 | g_printerr("Failed to truncate file %s to %u MB: %s\n", image_path, |
382 | FLASH_SIZE, strerror(error_code)); | |
60b725b6 SC |
383 | exit(EXIT_FAILURE); |
384 | } | |
385 | close(fd); | |
386 | ||
387 | qtest_add_abrt_handler(cleanup, NULL); | |
388 | g_test_init(&argc, &argv, NULL); | |
91d02312 PMD |
389 | |
390 | size_t nb_configurations = sizeof configuration / sizeof configuration[0]; | |
391 | for (size_t i = 0; i < nb_configurations; ++i) { | |
392 | const FlashConfig *config = &configuration[i]; | |
393 | char *path = g_strdup_printf("pflash-cfi02/%d", | |
394 | config->bank_width); | |
395 | qtest_add_data_func(path, config, test_flash); | |
396 | g_free(path); | |
397 | } | |
60b725b6 SC |
398 | int result = g_test_run(); |
399 | cleanup(NULL); | |
400 | return result; | |
401 | } |