/* *  CFI parallel flash with AMD command set emulation * *  Copyright (c) 2005 Jocelyn Mayer * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA *//* * For now, this code can emulate flashes of 1, 2 or 4 bytes width. * Supported commands/modes are: * - flash read * - flash write * - flash ID read * - sector erase * - chip erase * - unlock bypass command * - CFI queries * * It does not support flash interleaving. * It does not implement boot blocs with reduced size * It does not implement software data protection as found in many real chips * It does not implement erase suspend/resume commands * It does not implement multiple sectors erase */#include "hw.h"#include "flash.h"#include "qemu-timer.h"#include "block.h"//#define PFLASH_DEBUG#ifdef PFLASH_DEBUG#define DPRINTF(fmt, args...)                      \do {                                               \        printf("PFLASH: " fmt , ##args);           \} while (0)#else#define DPRINTF(fmt, args...) do { } while (0)#endifstruct pflash_t {    BlockDriverState *bs;    target_phys_addr_t base;    uint32_t sector_len;    uint32_t total_len;    int width;    int wcycle; /* if 0, the flash is read normally */    int bypass;    int ro;    uint8_t cmd;    uint8_t status;    uint16_t ident[4];    uint8_t cfi_len;    uint8_t cfi_table[0x52];    QEMUTimer *timer;    ram_addr_t off;    int fl_mem;    void *storage;};static void pflash_timer (void *opaque){    pflash_t *pfl = opaque;    DPRINTF("%s: command %02x done\n", __func__, pfl->cmd);    /* Reset flash */    pfl->status ^= 0x80;    if (pfl->bypass) {        pfl->wcycle = 2;    } else {        cpu_register_physical_memory(pfl->base, pfl->total_len,                                     pfl->off | IO_MEM_ROMD | pfl->fl_mem);        pfl->wcycle = 0;    }    pfl->cmd = 0;}static uint32_t pflash_read (pflash_t *pfl, uint32_t offset, int width){    uint32_t boff;    uint32_t ret;    uint8_t *p;    DPRINTF("%s: offset " TARGET_FMT_lx "\n", __func__, offset);    ret = -1;    offset -= pfl->base;    boff = offset & 0xFF;    if (pfl->width == 2)        boff = boff >> 1;    else if (pfl->width == 4)        boff = boff >> 2;    switch (pfl->cmd) {    default:        /* This should never happen : reset state & treat it as a read*/        DPRINTF("%s: unknown command state: %x\n", __func__, pfl->cmd);        pfl->wcycle = 0;        pfl->cmd = 0;    case 0x80:        /* We accept reads during second unlock sequence... */    case 0x00:    flash_read:        /* Flash area read */        p = pfl->storage;        switch (width) {        case 1:            ret = p[offset];//            DPRINTF("%s: data offset %08x %02x\n", __func__, offset, ret);            break;        case 2:#if defined(TARGET_WORDS_BIGENDIAN)            ret = p[offset] << 8;            ret |= p[offset + 1];#else            ret = p[offset];            ret |= p[offset + 1] << 8;#endif//            DPRINTF("%s: data offset %08x %04x\n", __func__, offset, ret);            break;        case 4:#if defined(TARGET_WORDS_BIGENDIAN)            ret = p[offset] << 24;            ret |= p[offset + 1] << 16;            ret |= p[offset + 2] << 8;            ret |= p[offset + 3];#else            ret = p[offset];            ret |= p[offset + 1] << 8;            ret |= p[offset + 2] << 16;            ret |= p[offset + 3] << 24;#endif//            DPRINTF("%s: data offset %08x %08x\n", __func__, offset, ret);            break;        }        break;    case 0x90:        /* flash ID read */        switch (boff) {        case 0x00:        case 0x01:            ret = pfl->ident[boff & 0x01];            break;        case 0x02:            ret = 0x00; /* Pretend all sectors are unprotected */            break;        case 0x0E:        case 0x0F:            if (pfl->ident[2 + (boff & 0x01)] == (uint8_t)-1)                goto flash_read;            ret = pfl->ident[2 + (boff & 0x01)];            break;        default:            goto flash_read;        }        DPRINTF("%s: ID " TARGET_FMT_ld " %x\n", __func__, boff, ret);        break;    case 0xA0:    case 0x10:    case 0x30:        /* Status register read */        ret = pfl->status;        DPRINTF("%s: status %x\n", __func__, ret);        /* Toggle bit 6 */        pfl->status ^= 0x40;        break;    case 0x98:        /* CFI query mode */        if (boff > pfl->cfi_len)            ret = 0;        else            ret = pfl->cfi_table[boff];        break;    }    return ret;}/* update flash content on disk */static void pflash_update(pflash_t *pfl, int offset,                          int size){    int offset_end;    if (pfl->bs) {        offset_end = offset + size;        /* round to sectors */        offset = offset >> 9;        offset_end = (offset_end + 511) >> 9;        bdrv_write(pfl->bs, offset, pfl->storage + (offset << 9),                   offset_end - offset);    }}static void pflash_write (pflash_t *pfl, uint32_t offset, uint32_t value,                          int width){    uint32_t boff;    uint8_t *p;    uint8_t cmd;    /* WARNING: when the memory area is in ROMD mode, the offset is a       ram offset, not a physical address */    cmd = value;    if (pfl->cmd != 0xA0 && cmd == 0xF0) {#if 0        DPRINTF("%s: flash reset asked (%02x %02x)\n",                __func__, pfl->cmd, cmd);#endif        goto reset_flash;    }    DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d %d\n", __func__,            offset, value, width, pfl->wcycle);    if (pfl->wcycle == 0)        offset -= (uint32_t)(long)pfl->storage;    else        offset -= pfl->base;    DPRINTF("%s: offset " TARGET_FMT_lx " %08x %d\n", __func__,            offset, value, width);    /* Set the device in I/O access mode */    cpu_register_physical_memory(pfl->base, pfl->total_len, pfl->fl_mem);    boff = offset & (pfl->sector_len - 1);    if (pfl->width == 2)        boff = boff >> 1;    else if (pfl->width == 4)        boff = boff >> 2;    switch (pfl->wcycle) {    case 0:        /* We're in read mode */    check_unlock0:        if (boff == 0x55 && cmd == 0x98) {        enter_CFI_mode:            /* Enter CFI query mode */            pfl->wcycle = 7;            pfl->cmd = 0x98;            return;        }        if (boff != 0x555 || cmd != 0xAA) {            DPRINTF("%s: unlock0 failed " TARGET_FMT_lx " %02x %04x\n",                    __func__, boff, cmd, 0x555);            goto reset_flash;        }        DPRINTF("%s: unlock sequence started\n", __func__);        break;    case 1:        /* We started an unlock sequence */    check_unlock1:        if (boff != 0x2AA || cmd != 0x55) {            DPRINTF("%s: unlock1 failed " TARGET_FMT_lx " %02x\n", __func__,                    boff, cmd);            goto reset_flash;        }        DPRINTF("%s: unlock sequence done\n", __func__);        break;    case 2:        /* We finished an unlock sequence */        if (!pfl->bypass && boff != 0x555) {            DPRINTF("%s: command failed " TARGET_FMT_lx " %02x\n", __func__,                    boff, cmd);            goto reset_flash;        }        switch (cmd) {        case 0x20:            pfl->bypass = 1;            goto do_bypass;        case 0x80:        case 0x90:        case 0xA0:            pfl->cmd = cmd;            DPRINTF("%s: starting command %02x\n", __func__, cmd);            break;        default:            DPRINTF("%s: unknown command %02x\n", __func__, cmd);            goto reset_flash;        }        break;    case 3:        switch (pfl->cmd) {        case 0x80:            /* We need another unlock sequence */            goto check_unlock0;        case 0xA0:            DPRINTF("%s: write data offset " TARGET_FMT_lx " %08x %d\n",                    __func__, offset, value, width);            p = pfl->storage;            switch (width) {            case 1:                p[offset] &= value;                pflash_update(pfl, offset, 1);                break;            case 2:#if defined(TARGET_WORDS_BIGENDIAN)                p[offset] &= value >> 8;                p[offset + 1] &= value;#else                p[offset] &= value;                p[offset + 1] &= value >> 8;#endif                pflash_update(pfl, offset, 2);                break;            case 4:#if defined(TARGET_WORDS_BIGENDIAN)                p[offset] &= value >> 24;                p[offset + 1] &= value >> 16;                p[offset + 2] &= value >> 8;                p[offset + 3] &= value;#else                p[offset] &= value;