1 /*
2 * OneNAND flash memories emulation.
3 *
4 * Copyright (C) 2008 Nokia Corporation
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/hw.h"
24 #include "hw/block/flash.h"
25 #include "hw/irq.h"
26 #include "hw/qdev-properties.h"
27 #include "hw/qdev-properties-system.h"
28 #include "sysemu/block-backend.h"
29 #include "exec/memory.h"
30 #include "hw/sysbus.h"
31 #include "migration/vmstate.h"
32 #include "qemu/error-report.h"
33 #include "qemu/log.h"
34 #include "qemu/module.h"
35 #include "qom/object.h"
36
37 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
38 #define PAGE_SHIFT 11
39
40 /* Fixed */
41 #define BLOCK_SHIFT (PAGE_SHIFT + 6)
42
43 #define TYPE_ONE_NAND "onenand"
44 OBJECT_DECLARE_SIMPLE_TYPE(OneNANDState, ONE_NAND)
45
46 struct OneNANDState {
47 SysBusDevice parent_obj;
48
49 struct {
50 uint16_t man;
51 uint16_t dev;
52 uint16_t ver;
53 } id;
54 int shift;
55 hwaddr base;
56 qemu_irq intr;
57 qemu_irq rdy;
58 BlockBackend *blk;
59 BlockBackend *blk_cur;
60 uint8_t *image;
61 uint8_t *otp;
62 uint8_t *current;
63 MemoryRegion ram;
64 MemoryRegion mapped_ram;
65 uint8_t current_direction;
66 uint8_t *boot[2];
67 uint8_t *data[2][2];
68 MemoryRegion iomem;
69 MemoryRegion container;
70 int cycle;
71 int otpmode;
72
73 uint16_t addr[8];
74 uint16_t unladdr[8];
75 int bufaddr;
76 int count;
77 uint16_t command;
78 uint16_t config[2];
79 uint16_t status;
80 uint16_t intstatus;
81 uint16_t wpstatus;
82
83 ECCState ecc;
84
85 int density_mask;
86 int secs;
87 int secs_cur;
88 int blocks;
89 uint8_t *blockwp;
90 };
91
92 enum {
93 ONEN_BUF_BLOCK = 0,
94 ONEN_BUF_BLOCK2 = 1,
95 ONEN_BUF_DEST_BLOCK = 2,
96 ONEN_BUF_DEST_PAGE = 3,
97 ONEN_BUF_PAGE = 7,
98 };
99
100 enum {
101 ONEN_ERR_CMD = 1 << 10,
102 ONEN_ERR_ERASE = 1 << 11,
103 ONEN_ERR_PROG = 1 << 12,
104 ONEN_ERR_LOAD = 1 << 13,
105 };
106
107 enum {
108 ONEN_INT_RESET = 1 << 4,
109 ONEN_INT_ERASE = 1 << 5,
110 ONEN_INT_PROG = 1 << 6,
111 ONEN_INT_LOAD = 1 << 7,
112 ONEN_INT = 1 << 15,
113 };
114
115 enum {
116 ONEN_LOCK_LOCKTIGHTEN = 1 << 0,
117 ONEN_LOCK_LOCKED = 1 << 1,
118 ONEN_LOCK_UNLOCKED = 1 << 2,
119 };
120
onenand_mem_setup(OneNANDState * s)121 static void onenand_mem_setup(OneNANDState *s)
122 {
123 /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
124 * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
125 * write boot commands. Also take note of the BWPS bit. */
126 memory_region_init(&s->container, OBJECT(s), "onenand",
127 0x10000 << s->shift);
128 memory_region_add_subregion(&s->container, 0, &s->iomem);
129 memory_region_init_alias(&s->mapped_ram, OBJECT(s), "onenand-mapped-ram",
130 &s->ram, 0x0200 << s->shift,
131 0xbe00 << s->shift);
132 memory_region_add_subregion_overlap(&s->container,
133 0x0200 << s->shift,
134 &s->mapped_ram,
135 1);
136 }
137
onenand_intr_update(OneNANDState * s)138 static void onenand_intr_update(OneNANDState *s)
139 {
140 qemu_set_irq(s->intr, ((s->intstatus >> 15) ^ (~s->config[0] >> 6)) & 1);
141 }
142
onenand_pre_save(void * opaque)143 static int onenand_pre_save(void *opaque)
144 {
145 OneNANDState *s = opaque;
146 if (s->current == s->otp) {
147 s->current_direction = 1;
148 } else if (s->current == s->image) {
149 s->current_direction = 2;
150 } else {
151 s->current_direction = 0;
152 }
153
154 return 0;
155 }
156
onenand_post_load(void * opaque,int version_id)157 static int onenand_post_load(void *opaque, int version_id)
158 {
159 OneNANDState *s = opaque;
160 switch (s->current_direction) {
161 case 0:
162 break;
163 case 1:
164 s->current = s->otp;
165 break;
166 case 2:
167 s->current = s->image;
168 break;
169 default:
170 return -1;
171 }
172 onenand_intr_update(s);
173 return 0;
174 }
175
176 static const VMStateDescription vmstate_onenand = {
177 .name = "onenand",
178 .version_id = 1,
179 .minimum_version_id = 1,
180 .pre_save = onenand_pre_save,
181 .post_load = onenand_post_load,
182 .fields = (const VMStateField[]) {
183 VMSTATE_UINT8(current_direction, OneNANDState),
184 VMSTATE_INT32(cycle, OneNANDState),
185 VMSTATE_INT32(otpmode, OneNANDState),
186 VMSTATE_UINT16_ARRAY(addr, OneNANDState, 8),
187 VMSTATE_UINT16_ARRAY(unladdr, OneNANDState, 8),
188 VMSTATE_INT32(bufaddr, OneNANDState),
189 VMSTATE_INT32(count, OneNANDState),
190 VMSTATE_UINT16(command, OneNANDState),
191 VMSTATE_UINT16_ARRAY(config, OneNANDState, 2),
192 VMSTATE_UINT16(status, OneNANDState),
193 VMSTATE_UINT16(intstatus, OneNANDState),
194 VMSTATE_UINT16(wpstatus, OneNANDState),
195 VMSTATE_INT32(secs_cur, OneNANDState),
196 VMSTATE_PARTIAL_VBUFFER(blockwp, OneNANDState, blocks),
197 VMSTATE_UINT8(ecc.cp, OneNANDState),
198 VMSTATE_UINT16_ARRAY(ecc.lp, OneNANDState, 2),
199 VMSTATE_UINT16(ecc.count, OneNANDState),
200 VMSTATE_BUFFER_POINTER_UNSAFE(otp, OneNANDState, 0,
201 ((64 + 2) << PAGE_SHIFT)),
202 VMSTATE_END_OF_LIST()
203 }
204 };
205
206 /* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
onenand_reset(OneNANDState * s,int cold)207 static void onenand_reset(OneNANDState *s, int cold)
208 {
209 memset(&s->addr, 0, sizeof(s->addr));
210 s->command = 0;
211 s->count = 1;
212 s->bufaddr = 0;
213 s->config[0] = 0x40c0;
214 s->config[1] = 0x0000;
215 onenand_intr_update(s);
216 qemu_irq_raise(s->rdy);
217 s->status = 0x0000;
218 s->intstatus = cold ? 0x8080 : 0x8010;
219 s->unladdr[0] = 0;
220 s->unladdr[1] = 0;
221 s->wpstatus = 0x0002;
222 s->cycle = 0;
223 s->otpmode = 0;
224 s->blk_cur = s->blk;
225 s->current = s->image;
226 s->secs_cur = s->secs;
227
228 if (cold) {
229 /* Lock the whole flash */
230 memset(s->blockwp, ONEN_LOCK_LOCKED, s->blocks);
231
232 if (s->blk_cur && blk_pread(s->blk_cur, 0, 8 << BDRV_SECTOR_BITS,
233 s->boot[0], 0) < 0) {
234 hw_error("%s: Loading the BootRAM failed.\n", __func__);
235 }
236 }
237 }
238
onenand_system_reset(DeviceState * dev)239 static void onenand_system_reset(DeviceState *dev)
240 {
241 OneNANDState *s = ONE_NAND(dev);
242
243 onenand_reset(s, 1);
244 }
245
onenand_load_main(OneNANDState * s,int sec,int secn,void * dest)246 static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
247 void *dest)
248 {
249 assert(UINT32_MAX >> BDRV_SECTOR_BITS > sec);
250 assert(UINT32_MAX >> BDRV_SECTOR_BITS > secn);
251 if (s->blk_cur) {
252 return blk_pread(s->blk_cur, sec << BDRV_SECTOR_BITS,
253 secn << BDRV_SECTOR_BITS, dest, 0) < 0;
254 } else if (sec + secn > s->secs_cur) {
255 return 1;
256 }
257
258 memcpy(dest, s->current + (sec << 9), secn << 9);
259
260 return 0;
261 }
262
onenand_prog_main(OneNANDState * s,int sec,int secn,void * src)263 static inline int onenand_prog_main(OneNANDState *s, int sec, int secn,
264 void *src)
265 {
266 int result = 0;
267
268 if (secn > 0) {
269 uint32_t size = secn << BDRV_SECTOR_BITS;
270 uint32_t offset = sec << BDRV_SECTOR_BITS;
271 assert(UINT32_MAX >> BDRV_SECTOR_BITS > sec);
272 assert(UINT32_MAX >> BDRV_SECTOR_BITS > secn);
273 const uint8_t *sp = (const uint8_t *)src;
274 uint8_t *dp = 0;
275 if (s->blk_cur) {
276 dp = g_malloc(size);
277 if (!dp || blk_pread(s->blk_cur, offset, size, dp, 0) < 0) {
278 result = 1;
279 }
280 } else {
281 if (sec + secn > s->secs_cur) {
282 result = 1;
283 } else {
284 dp = (uint8_t *)s->current + offset;
285 }
286 }
287 if (!result) {
288 uint32_t i;
289 for (i = 0; i < size; i++) {
290 dp[i] &= sp[i];
291 }
292 if (s->blk_cur) {
293 result = blk_pwrite(s->blk_cur, offset, size, dp, 0) < 0;
294 }
295 }
296 if (dp && s->blk_cur) {
297 g_free(dp);
298 }
299 }
300
301 return result;
302 }
303
onenand_load_spare(OneNANDState * s,int sec,int secn,void * dest)304 static inline int onenand_load_spare(OneNANDState *s, int sec, int secn,
305 void *dest)
306 {
307 uint8_t buf[512];
308
309 if (s->blk_cur) {
310 uint32_t offset = (s->secs_cur + (sec >> 5)) << BDRV_SECTOR_BITS;
311 if (blk_pread(s->blk_cur, offset, BDRV_SECTOR_SIZE, buf, 0) < 0) {
312 return 1;
313 }
314 memcpy(dest, buf + ((sec & 31) << 4), secn << 4);
315 } else if (sec + secn > s->secs_cur) {
316 return 1;
317 } else {
318 memcpy(dest, s->current + (s->secs_cur << 9) + (sec << 4), secn << 4);
319 }
320
321 return 0;
322 }
323
onenand_prog_spare(OneNANDState * s,int sec,int secn,void * src)324 static inline int onenand_prog_spare(OneNANDState *s, int sec, int secn,
325 void *src)
326 {
327 int result = 0;
328 if (secn > 0) {
329 const uint8_t *sp = (const uint8_t *)src;
330 uint8_t *dp = 0, *dpp = 0;
331 uint32_t offset = (s->secs_cur + (sec >> 5)) << BDRV_SECTOR_BITS;
332 assert(UINT32_MAX >> BDRV_SECTOR_BITS > s->secs_cur + (sec >> 5));
333 if (s->blk_cur) {
334 dp = g_malloc(512);
335 if (!dp
336 || blk_pread(s->blk_cur, offset, BDRV_SECTOR_SIZE, dp, 0) < 0) {
337 result = 1;
338 } else {
339 dpp = dp + ((sec & 31) << 4);
340 }
341 } else {
342 if (sec + secn > s->secs_cur) {
343 result = 1;
344 } else {
345 dpp = s->current + (s->secs_cur << 9) + (sec << 4);
346 }
347 }
348 if (!result) {
349 uint32_t i;
350 for (i = 0; i < (secn << 4); i++) {
351 dpp[i] &= sp[i];
352 }
353 if (s->blk_cur) {
354 result = blk_pwrite(s->blk_cur, offset, BDRV_SECTOR_SIZE, dp,
355 0) < 0;
356 }
357 }
358 g_free(dp);
359 }
360 return result;
361 }
362
onenand_erase(OneNANDState * s,int sec,int num)363 static inline int onenand_erase(OneNANDState *s, int sec, int num)
364 {
365 uint8_t *blankbuf, *tmpbuf;
366
367 blankbuf = g_malloc(512);
368 tmpbuf = g_malloc(512);
369 memset(blankbuf, 0xff, 512);
370 for (; num > 0; num--, sec++) {
371 if (s->blk_cur) {
372 int erasesec = s->secs_cur + (sec >> 5);
373 if (blk_pwrite(s->blk_cur, sec << BDRV_SECTOR_BITS,
374 BDRV_SECTOR_SIZE, blankbuf, 0) < 0) {
375 goto fail;
376 }
377 if (blk_pread(s->blk_cur, erasesec << BDRV_SECTOR_BITS,
378 BDRV_SECTOR_SIZE, tmpbuf, 0) < 0) {
379 goto fail;
380 }
381 memcpy(tmpbuf + ((sec & 31) << 4), blankbuf, 1 << 4);
382 if (blk_pwrite(s->blk_cur, erasesec << BDRV_SECTOR_BITS,
383 BDRV_SECTOR_SIZE, tmpbuf, 0) < 0) {
384 goto fail;
385 }
386 } else {
387 if (sec + 1 > s->secs_cur) {
388 goto fail;
389 }
390 memcpy(s->current + (sec << 9), blankbuf, 512);
391 memcpy(s->current + (s->secs_cur << 9) + (sec << 4),
392 blankbuf, 1 << 4);
393 }
394 }
395
396 g_free(tmpbuf);
397 g_free(blankbuf);
398 return 0;
399
400 fail:
401 g_free(tmpbuf);
402 g_free(blankbuf);
403 return 1;
404 }
405
onenand_command(OneNANDState * s)406 static void onenand_command(OneNANDState *s)
407 {
408 int b;
409 int sec;
410 void *buf;
411 #define SETADDR(block, page) \
412 sec = (s->addr[page] & 3) + \
413 ((((s->addr[page] >> 2) & 0x3f) + \
414 (((s->addr[block] & 0xfff) | \
415 (s->addr[block] >> 15 ? s->density_mask : 0)) \
416 << 6)) \
417 << (PAGE_SHIFT - 9));
418 #define SETBUF_M() \
419 buf = (s->bufaddr & 8) ? s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0]; \
420 buf += (s->bufaddr & 3) << 9;
421 #define SETBUF_S() \
422 buf = (s->bufaddr & 8) ? \
423 s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1]; \
424 buf += (s->bufaddr & 3) << 4;
425
426 switch (s->command) {
427 case 0x00: /* Load single/multiple sector data unit into buffer */
428 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
429
430 SETBUF_M()
431 if (onenand_load_main(s, sec, s->count, buf))
432 s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
433
434 #if 0
435 SETBUF_S()
436 if (onenand_load_spare(s, sec, s->count, buf))
437 s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
438 #endif
439
440 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
441 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
442 * then we need two split the read/write into two chunks.
443 */
444 s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
445 break;
446 case 0x13: /* Load single/multiple spare sector into buffer */
447 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
448
449 SETBUF_S()
450 if (onenand_load_spare(s, sec, s->count, buf))
451 s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
452
453 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
454 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
455 * then we need two split the read/write into two chunks.
456 */
457 s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
458 break;
459 case 0x80: /* Program single/multiple sector data unit from buffer */
460 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
461
462 SETBUF_M()
463 if (onenand_prog_main(s, sec, s->count, buf))
464 s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
465
466 #if 0
467 SETBUF_S()
468 if (onenand_prog_spare(s, sec, s->count, buf))
469 s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
470 #endif
471
472 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
473 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
474 * then we need two split the read/write into two chunks.
475 */
476 s->intstatus |= ONEN_INT | ONEN_INT_PROG;
477 break;
478 case 0x1a: /* Program single/multiple spare area sector from buffer */
479 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
480
481 SETBUF_S()
482 if (onenand_prog_spare(s, sec, s->count, buf))
483 s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
484
485 /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
486 * or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
487 * then we need two split the read/write into two chunks.
488 */
489 s->intstatus |= ONEN_INT | ONEN_INT_PROG;
490 break;
491 case 0x1b: /* Copy-back program */
492 SETBUF_S()
493
494 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
495 if (onenand_load_main(s, sec, s->count, buf))
496 s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
497
498 SETADDR(ONEN_BUF_DEST_BLOCK, ONEN_BUF_DEST_PAGE)
499 if (onenand_prog_main(s, sec, s->count, buf))
500 s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
501
502 /* TODO: spare areas */
503
504 s->intstatus |= ONEN_INT | ONEN_INT_PROG;
505 break;
506
507 case 0x23: /* Unlock NAND array block(s) */
508 s->intstatus |= ONEN_INT;
509
510 /* XXX the previous (?) area should be locked automatically */
511 for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
512 if (b >= s->blocks) {
513 s->status |= ONEN_ERR_CMD;
514 break;
515 }
516 if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
517 break;
518
519 s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
520 }
521 break;
522 case 0x27: /* Unlock All NAND array blocks */
523 s->intstatus |= ONEN_INT;
524
525 for (b = 0; b < s->blocks; b ++) {
526 if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
527 break;
528
529 s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
530 }
531 break;
532
533 case 0x2a: /* Lock NAND array block(s) */
534 s->intstatus |= ONEN_INT;
535
536 for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
537 if (b >= s->blocks) {
538 s->status |= ONEN_ERR_CMD;
539 break;
540 }
541 if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
542 break;
543
544 s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKED;
545 }
546 break;
547 case 0x2c: /* Lock-tight NAND array block(s) */
548 s->intstatus |= ONEN_INT;
549
550 for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
551 if (b >= s->blocks) {
552 s->status |= ONEN_ERR_CMD;
553 break;
554 }
555 if (s->blockwp[b] == ONEN_LOCK_UNLOCKED)
556 continue;
557
558 s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKTIGHTEN;
559 }
560 break;
561
562 case 0x71: /* Erase-Verify-Read */
563 s->intstatus |= ONEN_INT;
564 break;
565 case 0x95: /* Multi-block erase */
566 qemu_irq_pulse(s->intr);
567 /* Fall through. */
568 case 0x94: /* Block erase */
569 sec = ((s->addr[ONEN_BUF_BLOCK] & 0xfff) |
570 (s->addr[ONEN_BUF_BLOCK] >> 15 ? s->density_mask : 0))
571 << (BLOCK_SHIFT - 9);
572 if (onenand_erase(s, sec, 1 << (BLOCK_SHIFT - 9)))
573 s->status |= ONEN_ERR_CMD | ONEN_ERR_ERASE;
574
575 s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
576 break;
577 case 0xb0: /* Erase suspend */
578 break;
579 case 0x30: /* Erase resume */
580 s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
581 break;
582
583 case 0xf0: /* Reset NAND Flash core */
584 onenand_reset(s, 0);
585 break;
586 case 0xf3: /* Reset OneNAND */
587 onenand_reset(s, 0);
588 break;
589
590 case 0x65: /* OTP Access */
591 s->intstatus |= ONEN_INT;
592 s->blk_cur = NULL;
593 s->current = s->otp;
594 s->secs_cur = 1 << (BLOCK_SHIFT - 9);
595 s->addr[ONEN_BUF_BLOCK] = 0;
596 s->otpmode = 1;
597 break;
598
599 default:
600 s->status |= ONEN_ERR_CMD;
601 s->intstatus |= ONEN_INT;
602 qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
603 s->command);
604 }
605
606 onenand_intr_update(s);
607 }
608
onenand_read(void * opaque,hwaddr addr,unsigned size)609 static uint64_t onenand_read(void *opaque, hwaddr addr,
610 unsigned size)
611 {
612 OneNANDState *s = (OneNANDState *) opaque;
613 int offset = addr >> s->shift;
614
615 switch (offset) {
616 case 0x0000 ... 0xbffe:
617 return lduw_le_p(s->boot[0] + addr);
618
619 case 0xf000: /* Manufacturer ID */
620 return s->id.man;
621 case 0xf001: /* Device ID */
622 return s->id.dev;
623 case 0xf002: /* Version ID */
624 return s->id.ver;
625 /* TODO: get the following values from a real chip! */
626 case 0xf003: /* Data Buffer size */
627 return 1 << PAGE_SHIFT;
628 case 0xf004: /* Boot Buffer size */
629 return 0x200;
630 case 0xf005: /* Amount of buffers */
631 return 1 | (2 << 8);
632 case 0xf006: /* Technology */
633 return 0;
634
635 case 0xf100 ... 0xf107: /* Start addresses */
636 return s->addr[offset - 0xf100];
637
638 case 0xf200: /* Start buffer */
639 return (s->bufaddr << 8) | ((s->count - 1) & (1 << (PAGE_SHIFT - 10)));
640
641 case 0xf220: /* Command */
642 return s->command;
643 case 0xf221: /* System Configuration 1 */
644 return s->config[0] & 0xffe0;
645 case 0xf222: /* System Configuration 2 */
646 return s->config[1];
647
648 case 0xf240: /* Controller Status */
649 return s->status;
650 case 0xf241: /* Interrupt */
651 return s->intstatus;
652 case 0xf24c: /* Unlock Start Block Address */
653 return s->unladdr[0];
654 case 0xf24d: /* Unlock End Block Address */
655 return s->unladdr[1];
656 case 0xf24e: /* Write Protection Status */
657 return s->wpstatus;
658
659 case 0xff00: /* ECC Status */
660 return 0x00;
661 case 0xff01: /* ECC Result of main area data */
662 case 0xff02: /* ECC Result of spare area data */
663 case 0xff03: /* ECC Result of main area data */
664 case 0xff04: /* ECC Result of spare area data */
665 qemu_log_mask(LOG_UNIMP,
666 "onenand: ECC result registers unimplemented\n");
667 return 0x0000;
668 }
669
670 qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
671 offset);
672 return 0;
673 }
674
onenand_write(void * opaque,hwaddr addr,uint64_t value,unsigned size)675 static void onenand_write(void *opaque, hwaddr addr,
676 uint64_t value, unsigned size)
677 {
678 OneNANDState *s = (OneNANDState *) opaque;
679 int offset = addr >> s->shift;
680 int sec;
681
682 switch (offset) {
683 case 0x0000 ... 0x01ff:
684 case 0x8000 ... 0x800f:
685 if (s->cycle) {
686 s->cycle = 0;
687
688 if (value == 0x0000) {
689 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
690 onenand_load_main(s, sec,
691 1 << (PAGE_SHIFT - 9), s->data[0][0]);
692 s->addr[ONEN_BUF_PAGE] += 4;
693 s->addr[ONEN_BUF_PAGE] &= 0xff;
694 }
695 break;
696 }
697
698 switch (value) {
699 case 0x00f0: /* Reset OneNAND */
700 onenand_reset(s, 0);
701 break;
702
703 case 0x00e0: /* Load Data into Buffer */
704 s->cycle = 1;
705 break;
706
707 case 0x0090: /* Read Identification Data */
708 memset(s->boot[0], 0, 3 << s->shift);
709 s->boot[0][0 << s->shift] = s->id.man & 0xff;
710 s->boot[0][1 << s->shift] = s->id.dev & 0xff;
711 s->boot[0][2 << s->shift] = s->wpstatus & 0xff;
712 break;
713
714 default:
715 qemu_log_mask(LOG_GUEST_ERROR,
716 "unknown OneNAND boot command %" PRIx64 "\n",
717 value);
718 }
719 break;
720
721 case 0xf100 ... 0xf107: /* Start addresses */
722 s->addr[offset - 0xf100] = value;
723 break;
724
725 case 0xf200: /* Start buffer */
726 s->bufaddr = (value >> 8) & 0xf;
727 if (PAGE_SHIFT == 11)
728 s->count = (value & 3) ?: 4;
729 else if (PAGE_SHIFT == 10)
730 s->count = (value & 1) ?: 2;
731 break;
732
733 case 0xf220: /* Command */
734 if (s->intstatus & (1 << 15))
735 break;
736 s->command = value;
737 onenand_command(s);
738 break;
739 case 0xf221: /* System Configuration 1 */
740 s->config[0] = value;
741 onenand_intr_update(s);
742 qemu_set_irq(s->rdy, (s->config[0] >> 7) & 1);
743 break;
744 case 0xf222: /* System Configuration 2 */
745 s->config[1] = value;
746 break;
747
748 case 0xf241: /* Interrupt */
749 s->intstatus &= value;
750 if ((1 << 15) & ~s->intstatus)
751 s->status &= ~(ONEN_ERR_CMD | ONEN_ERR_ERASE |
752 ONEN_ERR_PROG | ONEN_ERR_LOAD);
753 onenand_intr_update(s);
754 break;
755 case 0xf24c: /* Unlock Start Block Address */
756 s->unladdr[0] = value & (s->blocks - 1);
757 /* For some reason we have to set the end address to by default
758 * be same as start because the software forgets to write anything
759 * in there. */
760 s->unladdr[1] = value & (s->blocks - 1);
761 break;
762 case 0xf24d: /* Unlock End Block Address */
763 s->unladdr[1] = value & (s->blocks - 1);
764 break;
765
766 default:
767 qemu_log_mask(LOG_GUEST_ERROR,
768 "write to unknown OneNAND register 0x%x\n",
769 offset);
770 }
771 }
772
773 static const MemoryRegionOps onenand_ops = {
774 .read = onenand_read,
775 .write = onenand_write,
776 .endianness = DEVICE_NATIVE_ENDIAN,
777 };
778
onenand_realize(DeviceState * dev,Error ** errp)779 static void onenand_realize(DeviceState *dev, Error **errp)
780 {
781 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
782 OneNANDState *s = ONE_NAND(dev);
783 uint32_t size = 1 << (24 + ((s->id.dev >> 4) & 7));
784 void *ram;
785 Error *local_err = NULL;
786
787 s->base = (hwaddr)-1;
788 s->rdy = NULL;
789 s->blocks = size >> BLOCK_SHIFT;
790 s->secs = size >> 9;
791 s->blockwp = g_malloc(s->blocks);
792 s->density_mask = (s->id.dev & 0x08)
793 ? (1 << (6 + ((s->id.dev >> 4) & 7))) : 0;
794 memory_region_init_io(&s->iomem, OBJECT(s), &onenand_ops, s, "onenand",
795 0x10000 << s->shift);
796 if (!s->blk) {
797 s->image = memset(g_malloc(size + (size >> 5)),
798 0xff, size + (size >> 5));
799 } else {
800 if (!blk_supports_write_perm(s->blk)) {
801 error_setg(errp, "Can't use a read-only drive");
802 return;
803 }
804 blk_set_perm(s->blk, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
805 BLK_PERM_ALL, &local_err);
806 if (local_err) {
807 error_propagate(errp, local_err);
808 return;
809 }
810 s->blk_cur = s->blk;
811 }
812 s->otp = memset(g_malloc((64 + 2) << PAGE_SHIFT),
813 0xff, (64 + 2) << PAGE_SHIFT);
814 memory_region_init_ram_nomigrate(&s->ram, OBJECT(s), "onenand.ram",
815 0xc000 << s->shift, &error_fatal);
816 vmstate_register_ram_global(&s->ram);
817 ram = memory_region_get_ram_ptr(&s->ram);
818 s->boot[0] = ram + (0x0000 << s->shift);
819 s->boot[1] = ram + (0x8000 << s->shift);
820 s->data[0][0] = ram + ((0x0200 + (0 << (PAGE_SHIFT - 1))) << s->shift);
821 s->data[0][1] = ram + ((0x8010 + (0 << (PAGE_SHIFT - 6))) << s->shift);
822 s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
823 s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
824 onenand_mem_setup(s);
825 sysbus_init_irq(sbd, &s->intr);
826 sysbus_init_mmio(sbd, &s->container);
827 vmstate_register(VMSTATE_IF(dev),
828 ((s->shift & 0x7f) << 24)
829 | ((s->id.man & 0xff) << 16)
830 | ((s->id.dev & 0xff) << 8)
831 | (s->id.ver & 0xff),
832 &vmstate_onenand, s);
833 }
834
835 static Property onenand_properties[] = {
836 DEFINE_PROP_UINT16("manufacturer_id", OneNANDState, id.man, 0),
837 DEFINE_PROP_UINT16("device_id", OneNANDState, id.dev, 0),
838 DEFINE_PROP_UINT16("version_id", OneNANDState, id.ver, 0),
839 DEFINE_PROP_INT32("shift", OneNANDState, shift, 0),
840 DEFINE_PROP_DRIVE("drive", OneNANDState, blk),
841 DEFINE_PROP_END_OF_LIST(),
842 };
843
onenand_class_init(ObjectClass * klass,void * data)844 static void onenand_class_init(ObjectClass *klass, void *data)
845 {
846 DeviceClass *dc = DEVICE_CLASS(klass);
847
848 dc->realize = onenand_realize;
849 dc->reset = onenand_system_reset;
850 device_class_set_props(dc, onenand_properties);
851 }
852
853 static const TypeInfo onenand_info = {
854 .name = TYPE_ONE_NAND,
855 .parent = TYPE_SYS_BUS_DEVICE,
856 .instance_size = sizeof(OneNANDState),
857 .class_init = onenand_class_init,
858 };
859
onenand_register_types(void)860 static void onenand_register_types(void)
861 {
862 type_register_static(&onenand_info);
863 }
864
onenand_raw_otp(DeviceState * onenand_device)865 void *onenand_raw_otp(DeviceState *onenand_device)
866 {
867 OneNANDState *s = ONE_NAND(onenand_device);
868
869 return s->otp;
870 }
871
872 type_init(onenand_register_types)
873