]>
git.proxmox.com Git - qemu.git/blob - hw/onenand.c
2 * OneNAND flash memories emulation.
4 * Copyright (C) 2008 Nokia Corporation
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu-common.h"
27 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
31 #define BLOCK_SHIFT (PAGE_SHIFT + 6)
40 target_phys_addr_t base
;
43 BlockDriverState
*bdrv
;
44 BlockDriverState
*bdrv_cur
;
77 ONEN_BUF_DEST_BLOCK
= 2,
78 ONEN_BUF_DEST_PAGE
= 3,
83 ONEN_ERR_CMD
= 1 << 10,
84 ONEN_ERR_ERASE
= 1 << 11,
85 ONEN_ERR_PROG
= 1 << 12,
86 ONEN_ERR_LOAD
= 1 << 13,
90 ONEN_INT_RESET
= 1 << 4,
91 ONEN_INT_ERASE
= 1 << 5,
92 ONEN_INT_PROG
= 1 << 6,
93 ONEN_INT_LOAD
= 1 << 7,
98 ONEN_LOCK_LOCKTIGHTEN
= 1 << 0,
99 ONEN_LOCK_LOCKED
= 1 << 1,
100 ONEN_LOCK_UNLOCKED
= 1 << 2,
103 void onenand_base_update(void *opaque
, target_phys_addr_t
new)
105 OneNANDState
*s
= (OneNANDState
*) opaque
;
109 /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
110 * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
111 * write boot commands. Also take note of the BWPS bit. */
112 cpu_register_physical_memory(s
->base
+ (0x0000 << s
->shift
),
113 0x0200 << s
->shift
, s
->iomemtype
);
114 cpu_register_physical_memory(s
->base
+ (0x0200 << s
->shift
),
116 (s
->ram
+(0x0200 << s
->shift
)) | IO_MEM_RAM
);
118 cpu_register_physical_memory_offset(s
->base
+ (0xc000 << s
->shift
),
119 0x4000 << s
->shift
, s
->iomemtype
, (0xc000 << s
->shift
));
122 void onenand_base_unmap(void *opaque
)
124 OneNANDState
*s
= (OneNANDState
*) opaque
;
126 cpu_register_physical_memory(s
->base
,
127 0x10000 << s
->shift
, IO_MEM_UNASSIGNED
);
130 static void onenand_intr_update(OneNANDState
*s
)
132 qemu_set_irq(s
->intr
, ((s
->intstatus
>> 15) ^ (~s
->config
[0] >> 6)) & 1);
135 /* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
136 static void onenand_reset(OneNANDState
*s
, int cold
)
138 memset(&s
->addr
, 0, sizeof(s
->addr
));
142 s
->config
[0] = 0x40c0;
143 s
->config
[1] = 0x0000;
144 onenand_intr_update(s
);
145 qemu_irq_raise(s
->rdy
);
147 s
->intstatus
= cold
? 0x8080 : 0x8010;
150 s
->wpstatus
= 0x0002;
153 s
->bdrv_cur
= s
->bdrv
;
154 s
->current
= s
->image
;
155 s
->secs_cur
= s
->secs
;
158 /* Lock the whole flash */
159 memset(s
->blockwp
, ONEN_LOCK_LOCKED
, s
->blocks
);
161 if (s
->bdrv
&& bdrv_read(s
->bdrv
, 0, s
->boot
[0], 8) < 0)
162 hw_error("%s: Loading the BootRAM failed.\n", __FUNCTION__
);
166 static inline int onenand_load_main(OneNANDState
*s
, int sec
, int secn
,
170 return bdrv_read(s
->bdrv_cur
, sec
, dest
, secn
) < 0;
171 else if (sec
+ secn
> s
->secs_cur
)
174 memcpy(dest
, s
->current
+ (sec
<< 9), secn
<< 9);
179 static inline int onenand_prog_main(OneNANDState
*s
, int sec
, int secn
,
183 return bdrv_write(s
->bdrv_cur
, sec
, src
, secn
) < 0;
184 else if (sec
+ secn
> s
->secs_cur
)
187 memcpy(s
->current
+ (sec
<< 9), src
, secn
<< 9);
192 static inline int onenand_load_spare(OneNANDState
*s
, int sec
, int secn
,
198 if (bdrv_read(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0)
200 memcpy(dest
, buf
+ ((sec
& 31) << 4), secn
<< 4);
201 } else if (sec
+ secn
> s
->secs_cur
)
204 memcpy(dest
, s
->current
+ (s
->secs_cur
<< 9) + (sec
<< 4), secn
<< 4);
209 static inline int onenand_prog_spare(OneNANDState
*s
, int sec
, int secn
,
215 if (bdrv_read(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0)
217 memcpy(buf
+ ((sec
& 31) << 4), src
, secn
<< 4);
218 return bdrv_write(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0;
219 } else if (sec
+ secn
> s
->secs_cur
)
222 memcpy(s
->current
+ (s
->secs_cur
<< 9) + (sec
<< 4), src
, secn
<< 4);
227 static inline int onenand_erase(OneNANDState
*s
, int sec
, int num
)
232 memset(buf
, 0xff, sizeof(buf
));
233 for (; num
> 0; num
--, sec
++) {
234 if (onenand_prog_main(s
, sec
, 1, buf
))
236 if (onenand_prog_spare(s
, sec
, 1, buf
))
243 static void onenand_command(OneNANDState
*s
, int cmd
)
248 #define SETADDR(block, page) \
249 sec = (s->addr[page] & 3) + \
250 ((((s->addr[page] >> 2) & 0x3f) + \
251 (((s->addr[block] & 0xfff) | \
252 (s->addr[block] >> 15 ? \
253 s->density_mask : 0)) << 6)) << (PAGE_SHIFT - 9));
255 buf = (s->bufaddr & 8) ? \
256 s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0]; \
257 buf += (s->bufaddr & 3) << 9;
259 buf = (s->bufaddr & 8) ? \
260 s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1]; \
261 buf += (s->bufaddr & 3) << 4;
264 case 0x00: /* Load single/multiple sector data unit into buffer */
265 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
268 if (onenand_load_main(s
, sec
, s
->count
, buf
))
269 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
273 if (onenand_load_spare(s
, sec
, s
->count
, buf
))
274 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
277 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
278 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
279 * then we need two split the read/write into two chunks.
281 s
->intstatus
|= ONEN_INT
| ONEN_INT_LOAD
;
283 case 0x13: /* Load single/multiple spare sector into buffer */
284 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
287 if (onenand_load_spare(s
, sec
, s
->count
, buf
))
288 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
290 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
291 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
292 * then we need two split the read/write into two chunks.
294 s
->intstatus
|= ONEN_INT
| ONEN_INT_LOAD
;
296 case 0x80: /* Program single/multiple sector data unit from buffer */
297 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
300 if (onenand_prog_main(s
, sec
, s
->count
, buf
))
301 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
305 if (onenand_prog_spare(s
, sec
, s
->count
, buf
))
306 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
309 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
310 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
311 * then we need two split the read/write into two chunks.
313 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
315 case 0x1a: /* Program single/multiple spare area sector from buffer */
316 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
319 if (onenand_prog_spare(s
, sec
, s
->count
, buf
))
320 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
322 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
323 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
324 * then we need two split the read/write into two chunks.
326 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
328 case 0x1b: /* Copy-back program */
331 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
332 if (onenand_load_main(s
, sec
, s
->count
, buf
))
333 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
335 SETADDR(ONEN_BUF_DEST_BLOCK
, ONEN_BUF_DEST_PAGE
)
336 if (onenand_prog_main(s
, sec
, s
->count
, buf
))
337 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
339 /* TODO: spare areas */
341 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
344 case 0x23: /* Unlock NAND array block(s) */
345 s
->intstatus
|= ONEN_INT
;
347 /* XXX the previous (?) area should be locked automatically */
348 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
349 if (b
>= s
->blocks
) {
350 s
->status
|= ONEN_ERR_CMD
;
353 if (s
->blockwp
[b
] == ONEN_LOCK_LOCKTIGHTEN
)
356 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_UNLOCKED
;
359 case 0x27: /* Unlock All NAND array blocks */
360 s
->intstatus
|= ONEN_INT
;
362 for (b
= 0; b
< s
->blocks
; b
++) {
363 if (b
>= s
->blocks
) {
364 s
->status
|= ONEN_ERR_CMD
;
367 if (s
->blockwp
[b
] == ONEN_LOCK_LOCKTIGHTEN
)
370 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_UNLOCKED
;
374 case 0x2a: /* Lock NAND array block(s) */
375 s
->intstatus
|= ONEN_INT
;
377 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
378 if (b
>= s
->blocks
) {
379 s
->status
|= ONEN_ERR_CMD
;
382 if (s
->blockwp
[b
] == ONEN_LOCK_LOCKTIGHTEN
)
385 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_LOCKED
;
388 case 0x2c: /* Lock-tight NAND array block(s) */
389 s
->intstatus
|= ONEN_INT
;
391 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
392 if (b
>= s
->blocks
) {
393 s
->status
|= ONEN_ERR_CMD
;
396 if (s
->blockwp
[b
] == ONEN_LOCK_UNLOCKED
)
399 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_LOCKTIGHTEN
;
403 case 0x71: /* Erase-Verify-Read */
404 s
->intstatus
|= ONEN_INT
;
406 case 0x95: /* Multi-block erase */
407 qemu_irq_pulse(s
->intr
);
409 case 0x94: /* Block erase */
410 sec
= ((s
->addr
[ONEN_BUF_BLOCK
] & 0xfff) |
411 (s
->addr
[ONEN_BUF_BLOCK
] >> 15 ? s
->density_mask
: 0))
412 << (BLOCK_SHIFT
- 9);
413 if (onenand_erase(s
, sec
, 1 << (BLOCK_SHIFT
- 9)))
414 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_ERASE
;
416 s
->intstatus
|= ONEN_INT
| ONEN_INT_ERASE
;
418 case 0xb0: /* Erase suspend */
420 case 0x30: /* Erase resume */
421 s
->intstatus
|= ONEN_INT
| ONEN_INT_ERASE
;
424 case 0xf0: /* Reset NAND Flash core */
427 case 0xf3: /* Reset OneNAND */
431 case 0x65: /* OTP Access */
432 s
->intstatus
|= ONEN_INT
;
435 s
->secs_cur
= 1 << (BLOCK_SHIFT
- 9);
436 s
->addr
[ONEN_BUF_BLOCK
] = 0;
441 s
->status
|= ONEN_ERR_CMD
;
442 s
->intstatus
|= ONEN_INT
;
443 fprintf(stderr
, "%s: unknown OneNAND command %x\n",
447 onenand_intr_update(s
);
450 static uint32_t onenand_read(void *opaque
, target_phys_addr_t addr
)
452 OneNANDState
*s
= (OneNANDState
*) opaque
;
453 int offset
= addr
>> s
->shift
;
456 case 0x0000 ... 0xc000:
457 return lduw_le_p(s
->boot
[0] + addr
);
459 case 0xf000: /* Manufacturer ID */
461 case 0xf001: /* Device ID */
463 case 0xf002: /* Version ID */
465 /* TODO: get the following values from a real chip! */
466 case 0xf003: /* Data Buffer size */
467 return 1 << PAGE_SHIFT
;
468 case 0xf004: /* Boot Buffer size */
470 case 0xf005: /* Amount of buffers */
472 case 0xf006: /* Technology */
475 case 0xf100 ... 0xf107: /* Start addresses */
476 return s
->addr
[offset
- 0xf100];
478 case 0xf200: /* Start buffer */
479 return (s
->bufaddr
<< 8) | ((s
->count
- 1) & (1 << (PAGE_SHIFT
- 10)));
481 case 0xf220: /* Command */
483 case 0xf221: /* System Configuration 1 */
484 return s
->config
[0] & 0xffe0;
485 case 0xf222: /* System Configuration 2 */
488 case 0xf240: /* Controller Status */
490 case 0xf241: /* Interrupt */
492 case 0xf24c: /* Unlock Start Block Address */
493 return s
->unladdr
[0];
494 case 0xf24d: /* Unlock End Block Address */
495 return s
->unladdr
[1];
496 case 0xf24e: /* Write Protection Status */
499 case 0xff00: /* ECC Status */
501 case 0xff01: /* ECC Result of main area data */
502 case 0xff02: /* ECC Result of spare area data */
503 case 0xff03: /* ECC Result of main area data */
504 case 0xff04: /* ECC Result of spare area data */
505 hw_error("%s: imeplement ECC\n", __FUNCTION__
);
509 fprintf(stderr
, "%s: unknown OneNAND register %x\n",
510 __FUNCTION__
, offset
);
514 static void onenand_write(void *opaque
, target_phys_addr_t addr
,
517 OneNANDState
*s
= (OneNANDState
*) opaque
;
518 int offset
= addr
>> s
->shift
;
522 case 0x0000 ... 0x01ff:
523 case 0x8000 ... 0x800f:
527 if (value
== 0x0000) {
528 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
529 onenand_load_main(s
, sec
,
530 1 << (PAGE_SHIFT
- 9), s
->data
[0][0]);
531 s
->addr
[ONEN_BUF_PAGE
] += 4;
532 s
->addr
[ONEN_BUF_PAGE
] &= 0xff;
538 case 0x00f0: /* Reset OneNAND */
542 case 0x00e0: /* Load Data into Buffer */
546 case 0x0090: /* Read Identification Data */
547 memset(s
->boot
[0], 0, 3 << s
->shift
);
548 s
->boot
[0][0 << s
->shift
] = s
->id
.man
& 0xff;
549 s
->boot
[0][1 << s
->shift
] = s
->id
.dev
& 0xff;
550 s
->boot
[0][2 << s
->shift
] = s
->wpstatus
& 0xff;
554 fprintf(stderr
, "%s: unknown OneNAND boot command %x\n",
555 __FUNCTION__
, value
);
559 case 0xf100 ... 0xf107: /* Start addresses */
560 s
->addr
[offset
- 0xf100] = value
;
563 case 0xf200: /* Start buffer */
564 s
->bufaddr
= (value
>> 8) & 0xf;
565 if (PAGE_SHIFT
== 11)
566 s
->count
= (value
& 3) ?: 4;
567 else if (PAGE_SHIFT
== 10)
568 s
->count
= (value
& 1) ?: 2;
571 case 0xf220: /* Command */
572 if (s
->intstatus
& (1 << 15))
575 onenand_command(s
, s
->command
);
577 case 0xf221: /* System Configuration 1 */
578 s
->config
[0] = value
;
579 onenand_intr_update(s
);
580 qemu_set_irq(s
->rdy
, (s
->config
[0] >> 7) & 1);
582 case 0xf222: /* System Configuration 2 */
583 s
->config
[1] = value
;
586 case 0xf241: /* Interrupt */
587 s
->intstatus
&= value
;
588 if ((1 << 15) & ~s
->intstatus
)
589 s
->status
&= ~(ONEN_ERR_CMD
| ONEN_ERR_ERASE
|
590 ONEN_ERR_PROG
| ONEN_ERR_LOAD
);
591 onenand_intr_update(s
);
593 case 0xf24c: /* Unlock Start Block Address */
594 s
->unladdr
[0] = value
& (s
->blocks
- 1);
595 /* For some reason we have to set the end address to by default
596 * be same as start because the software forgets to write anything
598 s
->unladdr
[1] = value
& (s
->blocks
- 1);
600 case 0xf24d: /* Unlock End Block Address */
601 s
->unladdr
[1] = value
& (s
->blocks
- 1);
605 fprintf(stderr
, "%s: unknown OneNAND register %x\n",
606 __FUNCTION__
, offset
);
610 static CPUReadMemoryFunc
* const onenand_readfn
[] = {
611 onenand_read
, /* TODO */
616 static CPUWriteMemoryFunc
* const onenand_writefn
[] = {
617 onenand_write
, /* TODO */
622 void *onenand_init(BlockDriverState
*bdrv
,
623 uint16_t man_id
, uint16_t dev_id
, uint16_t ver_id
,
624 int regshift
, qemu_irq irq
)
626 OneNANDState
*s
= (OneNANDState
*) qemu_mallocz(sizeof(*s
));
627 uint32_t size
= 1 << (24 + ((dev_id
>> 4) & 7));
636 s
->blocks
= size
>> BLOCK_SHIFT
;
638 s
->blockwp
= qemu_malloc(s
->blocks
);
639 s
->density_mask
= (dev_id
& 0x08) ? (1 << (6 + ((dev_id
>> 4) & 7))) : 0;
640 s
->iomemtype
= cpu_register_io_memory(onenand_readfn
,
641 onenand_writefn
, s
, DEVICE_NATIVE_ENDIAN
);
644 s
->image
= memset(qemu_malloc(size
+ (size
>> 5)),
645 0xff, size
+ (size
>> 5));
646 s
->otp
= memset(qemu_malloc((64 + 2) << PAGE_SHIFT
),
647 0xff, (64 + 2) << PAGE_SHIFT
);
648 s
->ram
= qemu_ram_alloc(NULL
, "onenand.ram", 0xc000 << s
->shift
);
649 ram
= qemu_get_ram_ptr(s
->ram
);
650 s
->boot
[0] = ram
+ (0x0000 << s
->shift
);
651 s
->boot
[1] = ram
+ (0x8000 << s
->shift
);
652 s
->data
[0][0] = ram
+ ((0x0200 + (0 << (PAGE_SHIFT
- 1))) << s
->shift
);
653 s
->data
[0][1] = ram
+ ((0x8010 + (0 << (PAGE_SHIFT
- 6))) << s
->shift
);
654 s
->data
[1][0] = ram
+ ((0x0200 + (1 << (PAGE_SHIFT
- 1))) << s
->shift
);
655 s
->data
[1][1] = ram
+ ((0x8010 + (1 << (PAGE_SHIFT
- 6))) << s
->shift
);
662 void *onenand_raw_otp(void *opaque
)
664 OneNANDState
*s
= (OneNANDState
*) opaque
;