]>
git.proxmox.com Git - qemu.git/blob - hw/onenand.c
2 * OneNAND flash memories emulation.
4 * Copyright (C) 2008 Nokia Corporation
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
23 #include "qemu-common.h"
29 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
33 #define BLOCK_SHIFT (PAGE_SHIFT + 6)
38 target_phys_addr_t base
;
41 BlockDriverState
*bdrv
;
42 BlockDriverState
*bdrv_cur
;
63 struct ecc_state_s ecc
;
75 ONEN_BUF_DEST_BLOCK
= 2,
76 ONEN_BUF_DEST_PAGE
= 3,
81 ONEN_ERR_CMD
= 1 << 10,
82 ONEN_ERR_ERASE
= 1 << 11,
83 ONEN_ERR_PROG
= 1 << 12,
84 ONEN_ERR_LOAD
= 1 << 13,
88 ONEN_INT_RESET
= 1 << 4,
89 ONEN_INT_ERASE
= 1 << 5,
90 ONEN_INT_PROG
= 1 << 6,
91 ONEN_INT_LOAD
= 1 << 7,
96 ONEN_LOCK_LOCKTIGHTEN
= 1 << 0,
97 ONEN_LOCK_LOCKED
= 1 << 1,
98 ONEN_LOCK_UNLOCKED
= 1 << 2,
101 void onenand_base_update(void *opaque
, target_phys_addr_t
new)
103 struct onenand_s
*s
= (struct onenand_s
*) opaque
;
107 /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
108 * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
109 * write boot commands. Also take note of the BWPS bit. */
110 cpu_register_physical_memory(s
->base
+ (0x0000 << s
->shift
),
111 0x0200 << s
->shift
, s
->iomemtype
);
112 cpu_register_physical_memory(s
->base
+ (0x0200 << s
->shift
),
114 (s
->ram
+(0x0200 << s
->shift
)) | IO_MEM_RAM
);
116 cpu_register_physical_memory(s
->base
+ (0xc000 << s
->shift
),
117 0x4000 << s
->shift
, s
->iomemtype
);
120 void onenand_base_unmap(void *opaque
)
122 struct onenand_s
*s
= (struct onenand_s
*) opaque
;
124 cpu_register_physical_memory(s
->base
,
125 0x10000 << s
->shift
, IO_MEM_UNASSIGNED
);
128 static void onenand_intr_update(struct onenand_s
*s
)
130 qemu_set_irq(s
->intr
, ((s
->intstatus
>> 15) ^ (~s
->config
[0] >> 6)) & 1);
133 /* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
134 static void onenand_reset(struct onenand_s
*s
, int cold
)
136 memset(&s
->addr
, 0, sizeof(s
->addr
));
140 s
->config
[0] = 0x40c0;
141 s
->config
[1] = 0x0000;
142 onenand_intr_update(s
);
143 qemu_irq_raise(s
->rdy
);
145 s
->intstatus
= cold
? 0x8080 : 0x8010;
148 s
->wpstatus
= 0x0002;
151 s
->bdrv_cur
= s
->bdrv
;
152 s
->current
= s
->image
;
153 s
->secs_cur
= s
->secs
;
156 /* Lock the whole flash */
157 memset(s
->blockwp
, ONEN_LOCK_LOCKED
, s
->blocks
);
159 if (s
->bdrv
&& bdrv_read(s
->bdrv
, 0, s
->boot
[0], 8) < 0)
160 cpu_abort(cpu_single_env
, "%s: Loading the BootRAM failed.\n",
165 static inline int onenand_load_main(struct onenand_s
*s
, int sec
, int secn
,
169 return bdrv_read(s
->bdrv_cur
, sec
, dest
, secn
) < 0;
170 else if (sec
+ secn
> s
->secs_cur
)
173 memcpy(dest
, s
->current
+ (sec
<< 9), secn
<< 9);
178 static inline int onenand_prog_main(struct onenand_s
*s
, int sec
, int secn
,
182 return bdrv_write(s
->bdrv_cur
, sec
, src
, secn
) < 0;
183 else if (sec
+ secn
> s
->secs_cur
)
186 memcpy(s
->current
+ (sec
<< 9), src
, secn
<< 9);
191 static inline int onenand_load_spare(struct onenand_s
*s
, int sec
, int secn
,
197 if (bdrv_read(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0)
199 memcpy(dest
, buf
+ ((sec
& 31) << 4), secn
<< 4);
200 } else if (sec
+ secn
> s
->secs_cur
)
203 memcpy(dest
, s
->current
+ (s
->secs_cur
<< 9) + (sec
<< 4), secn
<< 4);
208 static inline int onenand_prog_spare(struct onenand_s
*s
, int sec
, int secn
,
214 if (bdrv_read(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0)
216 memcpy(buf
+ ((sec
& 31) << 4), src
, secn
<< 4);
217 return bdrv_write(s
->bdrv_cur
, s
->secs_cur
+ (sec
>> 5), buf
, 1) < 0;
218 } else if (sec
+ secn
> s
->secs_cur
)
221 memcpy(s
->current
+ (s
->secs_cur
<< 9) + (sec
<< 4), src
, secn
<< 4);
226 static inline int onenand_erase(struct onenand_s
*s
, int sec
, int num
)
231 memset(buf
, 0xff, sizeof(buf
));
232 for (; num
> 0; num
--, sec
++) {
233 if (onenand_prog_main(s
, sec
, 1, buf
))
235 if (onenand_prog_spare(s
, sec
, 1, buf
))
242 static void onenand_command(struct onenand_s
*s
, int cmd
)
247 #define SETADDR(block, page) \
248 sec = (s->addr[page] & 3) + \
249 ((((s->addr[page] >> 2) & 0x3f) + \
250 (((s->addr[block] & 0xfff) | \
251 (s->addr[block] >> 15 ? \
252 s->density_mask : 0)) << 6)) << (PAGE_SHIFT - 9));
254 buf = (s->bufaddr & 8) ? \
255 s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0]; \
256 buf += (s->bufaddr & 3) << 9;
258 buf = (s->bufaddr & 8) ? \
259 s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1]; \
260 buf += (s->bufaddr & 3) << 4;
263 case 0x00: /* Load single/multiple sector data unit into buffer */
264 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
267 if (onenand_load_main(s
, sec
, s
->count
, buf
))
268 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
272 if (onenand_load_spare(s
, sec
, s
->count
, buf
))
273 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
276 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
277 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
278 * then we need two split the read/write into two chunks.
280 s
->intstatus
|= ONEN_INT
| ONEN_INT_LOAD
;
282 case 0x13: /* Load single/multiple spare sector into buffer */
283 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
286 if (onenand_load_spare(s
, sec
, s
->count
, buf
))
287 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_LOAD
;
289 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
290 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
291 * then we need two split the read/write into two chunks.
293 s
->intstatus
|= ONEN_INT
| ONEN_INT_LOAD
;
295 case 0x80: /* Program single/multiple sector data unit from buffer */
296 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
299 if (onenand_prog_main(s
, sec
, s
->count
, buf
))
300 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
304 if (onenand_prog_spare(s
, sec
, s
->count
, buf
))
305 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
308 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
309 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
310 * then we need two split the read/write into two chunks.
312 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
314 case 0x1a: /* Program single/multiple spare area sector from buffer */
315 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
318 if (onenand_prog_spare(s
, sec
, s
->count
, buf
))
319 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
321 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
322 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
323 * then we need two split the read/write into two chunks.
325 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
327 case 0x1b: /* Copy-back program */
330 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
331 if (onenand_load_main(s
, sec
, s
->count
, buf
))
332 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
334 SETADDR(ONEN_BUF_DEST_BLOCK
, ONEN_BUF_DEST_PAGE
)
335 if (onenand_prog_main(s
, sec
, s
->count
, buf
))
336 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_PROG
;
338 /* TODO: spare areas */
340 s
->intstatus
|= ONEN_INT
| ONEN_INT_PROG
;
343 case 0x23: /* Unlock NAND array block(s) */
344 s
->intstatus
|= ONEN_INT
;
346 /* XXX the previous (?) area should be locked automatically */
347 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
348 if (b
>= s
->blocks
) {
349 s
->status
|= ONEN_ERR_CMD
;
352 if (s
->blockwp
[b
] == ONEN_LOCK_LOCKTIGHTEN
)
355 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_UNLOCKED
;
358 case 0x2a: /* Lock NAND array block(s) */
359 s
->intstatus
|= ONEN_INT
;
361 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
362 if (b
>= s
->blocks
) {
363 s
->status
|= ONEN_ERR_CMD
;
366 if (s
->blockwp
[b
] == ONEN_LOCK_LOCKTIGHTEN
)
369 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_LOCKED
;
372 case 0x2c: /* Lock-tight NAND array block(s) */
373 s
->intstatus
|= ONEN_INT
;
375 for (b
= s
->unladdr
[0]; b
<= s
->unladdr
[1]; b
++) {
376 if (b
>= s
->blocks
) {
377 s
->status
|= ONEN_ERR_CMD
;
380 if (s
->blockwp
[b
] == ONEN_LOCK_UNLOCKED
)
383 s
->wpstatus
= s
->blockwp
[b
] = ONEN_LOCK_LOCKTIGHTEN
;
387 case 0x71: /* Erase-Verify-Read */
388 s
->intstatus
|= ONEN_INT
;
390 case 0x95: /* Multi-block erase */
391 qemu_irq_pulse(s
->intr
);
393 case 0x94: /* Block erase */
394 sec
= ((s
->addr
[ONEN_BUF_BLOCK
] & 0xfff) |
395 (s
->addr
[ONEN_BUF_BLOCK
] >> 15 ? s
->density_mask
: 0))
396 << (BLOCK_SHIFT
- 9);
397 if (onenand_erase(s
, sec
, 1 << (BLOCK_SHIFT
- 9)))
398 s
->status
|= ONEN_ERR_CMD
| ONEN_ERR_ERASE
;
400 s
->intstatus
|= ONEN_INT
| ONEN_INT_ERASE
;
402 case 0xb0: /* Erase suspend */
404 case 0x30: /* Erase resume */
405 s
->intstatus
|= ONEN_INT
| ONEN_INT_ERASE
;
408 case 0xf0: /* Reset NAND Flash core */
411 case 0xf3: /* Reset OneNAND */
415 case 0x65: /* OTP Access */
416 s
->intstatus
|= ONEN_INT
;
419 s
->secs_cur
= 1 << (BLOCK_SHIFT
- 9);
420 s
->addr
[ONEN_BUF_BLOCK
] = 0;
425 s
->status
|= ONEN_ERR_CMD
;
426 s
->intstatus
|= ONEN_INT
;
427 fprintf(stderr
, "%s: unknown OneNAND command %x\n",
431 onenand_intr_update(s
);
434 static uint32_t onenand_read(void *opaque
, target_phys_addr_t addr
)
436 struct onenand_s
*s
= (struct onenand_s
*) opaque
;
437 int offset
= (addr
- s
->base
) >> s
->shift
;
440 case 0x0000 ... 0xc000:
441 return lduw_le_p(s
->boot
[0] + (addr
- s
->base
));
443 case 0xf000: /* Manufacturer ID */
444 return (s
->id
>> 16) & 0xff;
445 case 0xf001: /* Device ID */
446 return (s
->id
>> 8) & 0xff;
447 /* TODO: get the following values from a real chip! */
448 case 0xf002: /* Version ID */
449 return (s
->id
>> 0) & 0xff;
450 case 0xf003: /* Data Buffer size */
451 return 1 << PAGE_SHIFT
;
452 case 0xf004: /* Boot Buffer size */
454 case 0xf005: /* Amount of buffers */
456 case 0xf006: /* Technology */
459 case 0xf100 ... 0xf107: /* Start addresses */
460 return s
->addr
[offset
- 0xf100];
462 case 0xf200: /* Start buffer */
463 return (s
->bufaddr
<< 8) | ((s
->count
- 1) & (1 << (PAGE_SHIFT
- 10)));
465 case 0xf220: /* Command */
467 case 0xf221: /* System Configuration 1 */
468 return s
->config
[0] & 0xffe0;
469 case 0xf222: /* System Configuration 2 */
472 case 0xf240: /* Controller Status */
474 case 0xf241: /* Interrupt */
476 case 0xf24c: /* Unlock Start Block Address */
477 return s
->unladdr
[0];
478 case 0xf24d: /* Unlock End Block Address */
479 return s
->unladdr
[1];
480 case 0xf24e: /* Write Protection Status */
483 case 0xff00: /* ECC Status */
485 case 0xff01: /* ECC Result of main area data */
486 case 0xff02: /* ECC Result of spare area data */
487 case 0xff03: /* ECC Result of main area data */
488 case 0xff04: /* ECC Result of spare area data */
489 cpu_abort(cpu_single_env
, "%s: imeplement ECC\n", __FUNCTION__
);
493 fprintf(stderr
, "%s: unknown OneNAND register %x\n",
494 __FUNCTION__
, offset
);
498 static void onenand_write(void *opaque
, target_phys_addr_t addr
,
501 struct onenand_s
*s
= (struct onenand_s
*) opaque
;
502 int offset
= (addr
- s
->base
) >> s
->shift
;
506 case 0x0000 ... 0x01ff:
507 case 0x8000 ... 0x800f:
511 if (value
== 0x0000) {
512 SETADDR(ONEN_BUF_BLOCK
, ONEN_BUF_PAGE
)
513 onenand_load_main(s
, sec
,
514 1 << (PAGE_SHIFT
- 9), s
->data
[0][0]);
515 s
->addr
[ONEN_BUF_PAGE
] += 4;
516 s
->addr
[ONEN_BUF_PAGE
] &= 0xff;
522 case 0x00f0: /* Reset OneNAND */
526 case 0x00e0: /* Load Data into Buffer */
530 case 0x0090: /* Read Identification Data */
531 memset(s
->boot
[0], 0, 3 << s
->shift
);
532 s
->boot
[0][0 << s
->shift
] = (s
->id
>> 16) & 0xff;
533 s
->boot
[0][1 << s
->shift
] = (s
->id
>> 8) & 0xff;
534 s
->boot
[0][2 << s
->shift
] = s
->wpstatus
& 0xff;
538 fprintf(stderr
, "%s: unknown OneNAND boot command %x\n",
539 __FUNCTION__
, value
);
543 case 0xf100 ... 0xf107: /* Start addresses */
544 s
->addr
[offset
- 0xf100] = value
;
547 case 0xf200: /* Start buffer */
548 s
->bufaddr
= (value
>> 8) & 0xf;
549 if (PAGE_SHIFT
== 11)
550 s
->count
= (value
& 3) ?: 4;
551 else if (PAGE_SHIFT
== 10)
552 s
->count
= (value
& 1) ?: 2;
555 case 0xf220: /* Command */
556 if (s
->intstatus
& (1 << 15))
559 onenand_command(s
, s
->command
);
561 case 0xf221: /* System Configuration 1 */
562 s
->config
[0] = value
;
563 onenand_intr_update(s
);
564 qemu_set_irq(s
->rdy
, (s
->config
[0] >> 7) & 1);
566 case 0xf222: /* System Configuration 2 */
567 s
->config
[1] = value
;
570 case 0xf241: /* Interrupt */
571 s
->intstatus
&= value
;
572 if ((1 << 15) & ~s
->intstatus
)
573 s
->status
&= ~(ONEN_ERR_CMD
| ONEN_ERR_ERASE
|
574 ONEN_ERR_PROG
| ONEN_ERR_LOAD
);
575 onenand_intr_update(s
);
577 case 0xf24c: /* Unlock Start Block Address */
578 s
->unladdr
[0] = value
& (s
->blocks
- 1);
579 /* For some reason we have to set the end address to by default
580 * be same as start because the software forgets to write anything
582 s
->unladdr
[1] = value
& (s
->blocks
- 1);
584 case 0xf24d: /* Unlock End Block Address */
585 s
->unladdr
[1] = value
& (s
->blocks
- 1);
589 fprintf(stderr
, "%s: unknown OneNAND register %x\n",
590 __FUNCTION__
, offset
);
594 static CPUReadMemoryFunc
*onenand_readfn
[] = {
595 onenand_read
, /* TODO */
600 static CPUWriteMemoryFunc
*onenand_writefn
[] = {
601 onenand_write
, /* TODO */
606 void *onenand_init(uint32_t id
, int regshift
, qemu_irq irq
)
608 struct onenand_s
*s
= (struct onenand_s
*) qemu_mallocz(sizeof(*s
));
609 int bdrv_index
= drive_get_index(IF_MTD
, 0, 0);
610 uint32_t size
= 1 << (24 + ((id
>> 12) & 7));
617 s
->blocks
= size
>> BLOCK_SHIFT
;
619 s
->blockwp
= qemu_malloc(s
->blocks
);
620 s
->density_mask
= (id
& (1 << 11)) ? (1 << (6 + ((id
>> 12) & 7))) : 0;
621 s
->iomemtype
= cpu_register_io_memory(0, onenand_readfn
,
623 if (bdrv_index
== -1)
624 s
->image
= memset(qemu_malloc(size
+ (size
>> 5)),
625 0xff, size
+ (size
>> 5));
627 s
->bdrv
= drives_table
[bdrv_index
].bdrv
;
628 s
->otp
= memset(qemu_malloc((64 + 2) << PAGE_SHIFT
),
629 0xff, (64 + 2) << PAGE_SHIFT
);
630 s
->ram
= qemu_ram_alloc(0xc000 << s
->shift
);
631 ram
= phys_ram_base
+ s
->ram
;
632 s
->boot
[0] = ram
+ (0x0000 << s
->shift
);
633 s
->boot
[1] = ram
+ (0x8000 << s
->shift
);
634 s
->data
[0][0] = ram
+ ((0x0200 + (0 << (PAGE_SHIFT
- 1))) << s
->shift
);
635 s
->data
[0][1] = ram
+ ((0x8010 + (0 << (PAGE_SHIFT
- 6))) << s
->shift
);
636 s
->data
[1][0] = ram
+ ((0x0200 + (1 << (PAGE_SHIFT
- 1))) << s
->shift
);
637 s
->data
[1][1] = ram
+ ((0x8010 + (1 << (PAGE_SHIFT
- 6))) << s
->shift
);