[qemu.git] / hw / onenand.c

/*
 * OneNAND flash memories emulation.
 *
 * Copyright (C) 2008 Nokia Corporation
 * Written by Andrzej Zaborowski <[email protected]>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 or
 * (at your option) version 3 of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, see <http://www.gnu.org/licenses/>.
 */

#include "qemu-common.h"
#include "hw.h"
#include "flash.h"
#include "irq.h"
#include "blockdev.h"

/* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
#define PAGE_SHIFT	11

/* Fixed */
#define BLOCK_SHIFT	(PAGE_SHIFT + 6)

typedef struct {
    struct {
        uint16_t man;
        uint16_t dev;
        uint16_t ver;
    } id;
    int shift;
    target_phys_addr_t base;
    qemu_irq intr;
    qemu_irq rdy;
    BlockDriverState *bdrv;
    BlockDriverState *bdrv_cur;
    uint8_t *image;
    uint8_t *otp;
    uint8_t *current;
    ram_addr_t ram;
    uint8_t *boot[2];
    uint8_t *data[2][2];
    int iomemtype;
    int cycle;
    int otpmode;

    uint16_t addr[8];
    uint16_t unladdr[8];
    int bufaddr;
    int count;
    uint16_t command;
    uint16_t config[2];
    uint16_t status;
    uint16_t intstatus;
    uint16_t wpstatus;

    ECCState ecc;

    int density_mask;
    int secs;
    int secs_cur;
    int blocks;
    uint8_t *blockwp;
} OneNANDState;

enum {
    ONEN_BUF_BLOCK = 0,
    ONEN_BUF_BLOCK2 = 1,
    ONEN_BUF_DEST_BLOCK = 2,
    ONEN_BUF_DEST_PAGE = 3,
    ONEN_BUF_PAGE = 7,
};

enum {
    ONEN_ERR_CMD = 1 << 10,
    ONEN_ERR_ERASE = 1 << 11,
    ONEN_ERR_PROG = 1 << 12,
    ONEN_ERR_LOAD = 1 << 13,
};

enum {
    ONEN_INT_RESET = 1 << 4,
    ONEN_INT_ERASE = 1 << 5,
    ONEN_INT_PROG = 1 << 6,
    ONEN_INT_LOAD = 1 << 7,
    ONEN_INT = 1 << 15,
};

enum {
    ONEN_LOCK_LOCKTIGHTEN = 1 << 0,
    ONEN_LOCK_LOCKED = 1 << 1,
    ONEN_LOCK_UNLOCKED = 1 << 2,
};

void onenand_base_update(void *opaque, target_phys_addr_t new)
{
    OneNANDState *s = (OneNANDState *) opaque;

    s->base = new;

    /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
     * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
     * write boot commands.  Also take note of the BWPS bit.  */
    cpu_register_physical_memory(s->base + (0x0000 << s->shift),
                    0x0200 << s->shift, s->iomemtype);
    cpu_register_physical_memory(s->base + (0x0200 << s->shift),
                    0xbe00 << s->shift,
                    (s->ram +(0x0200 << s->shift)) | IO_MEM_RAM);
    if (s->iomemtype)
        cpu_register_physical_memory_offset(s->base + (0xc000 << s->shift),
                    0x4000 << s->shift, s->iomemtype, (0xc000 << s->shift));
}

void onenand_base_unmap(void *opaque)
{
    OneNANDState *s = (OneNANDState *) opaque;

    cpu_register_physical_memory(s->base,
                    0x10000 << s->shift, IO_MEM_UNASSIGNED);
}

static void onenand_intr_update(OneNANDState *s)
{
    qemu_set_irq(s->intr, ((s->intstatus >> 15) ^ (~s->config[0] >> 6)) & 1);
}

/* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
static void onenand_reset(OneNANDState *s, int cold)
{
    memset(&s->addr, 0, sizeof(s->addr));
    s->command = 0;
    s->count = 1;
    s->bufaddr = 0;
    s->config[0] = 0x40c0;
    s->config[1] = 0x0000;
    onenand_intr_update(s);
    qemu_irq_raise(s->rdy);
    s->status = 0x0000;
    s->intstatus = cold ? 0x8080 : 0x8010;
    s->unladdr[0] = 0;
    s->unladdr[1] = 0;
    s->wpstatus = 0x0002;
    s->cycle = 0;
    s->otpmode = 0;
    s->bdrv_cur = s->bdrv;
    s->current = s->image;
    s->secs_cur = s->secs;

    if (cold) {
        /* Lock the whole flash */
        memset(s->blockwp, ONEN_LOCK_LOCKED, s->blocks);

        if (s->bdrv && bdrv_read(s->bdrv, 0, s->boot[0], 8) < 0)
            hw_error("%s: Loading the BootRAM failed.\n", __FUNCTION__);
    }
}

static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
                void *dest)
{
    if (s->bdrv_cur)
        return bdrv_read(s->bdrv_cur, sec, dest, secn) < 0;
    else if (sec + secn > s->secs_cur)
        return 1;

    memcpy(dest, s->current + (sec << 9), secn << 9);

    return 0;
}

static inline int onenand_prog_main(OneNANDState *s, int sec, int secn,
                void *src)
{
    int result = 0;

    if (secn > 0) {
        uint32_t size = (uint32_t) secn * 512;
        const uint8_t *sp = (const uint8_t *) src;
        uint8_t *dp = 0;
        if (s->bdrv_cur) {
            dp = qemu_malloc(size);
            if (!dp || bdrv_read(s->bdrv_cur, sec, dp, secn) < 0) {
                result = 1;
            }
        } else {
            if (sec + secn > s->secs_cur) {
                result = 1;
            } else {
                dp = (uint8_t *) s->current + (sec << 9);
            }
        }
        if (!result) {
            uint32_t i;
            for (i = 0; i < size; i++) {
                dp[i] &= sp[i];
            }
            if (s->bdrv_cur) {
                result = bdrv_write(s->bdrv_cur, sec, dp, secn) < 0;
            }
        }
        if (dp && s->bdrv_cur) {
            qemu_free(dp);
        }
    }

    return result;
}

static inline int onenand_load_spare(OneNANDState *s, int sec, int secn,
                void *dest)
{
    uint8_t buf[512];

    if (s->bdrv_cur) {
        if (bdrv_read(s->bdrv_cur, s->secs_cur + (sec >> 5), buf, 1) < 0)
            return 1;
        memcpy(dest, buf + ((sec & 31) << 4), secn << 4);
    } else if (sec + secn > s->secs_cur)
        return 1;
    else
        memcpy(dest, s->current + (s->secs_cur << 9) + (sec << 4), secn << 4);
 
    return 0;
}

static inline int onenand_prog_spare(OneNANDState *s, int sec, int secn,
                void *src)
{
    int result = 0;
    if (secn > 0) {
        const uint8_t *sp = (const uint8_t *) src;
        uint8_t *dp = 0, *dpp = 0;
        if (s->bdrv_cur) {
            dp = qemu_malloc(512);
            if (!dp || bdrv_read(s->bdrv_cur,
                                s->secs_cur + (sec >> 5),
                                dp, 1) < 0) {
                result = 1;
            } else {
                dpp = dp + ((sec & 31) << 4);
            }
        } else {
            if (sec + secn > s->secs_cur) {
                result = 1;
            } else {
                dpp = s->current + (s->secs_cur << 9) + (sec << 4);
            }
        }
        if (!result) {
            uint32_t i;
            for (i = 0; i < (secn << 4); i++) {
                dpp[i] &= sp[i];
            }
            if (s->bdrv_cur) {
                result = bdrv_write(s->bdrv_cur, s->secs_cur + (sec >> 5),
                                dp, 1) < 0;
            }
        }
        if (dp) {
            qemu_free(dp);
        }
    }
    return result;
}

static inline int onenand_erase(OneNANDState *s, int sec, int num)
{
    uint8_t *blankbuf, *tmpbuf;
    blankbuf = qemu_malloc(512);
    if (!blankbuf) {
        return 1;
    }
    tmpbuf = qemu_malloc(512);
    if (!tmpbuf) {
        qemu_free(blankbuf);
        return 1;
    }
    memset(blankbuf, 0xff, 512);
    for (; num > 0; num--, sec++) {
        if (s->bdrv_cur) {
            int erasesec = s->secs_cur + (sec >> 5);
            if (bdrv_write(s->bdrv_cur, sec, blankbuf, 1)) {
                goto fail;
            }
            if (bdrv_read(s->bdrv_cur, erasesec, tmpbuf, 1) < 0) {
                goto fail;
            }
            memcpy(tmpbuf + ((sec & 31) << 4), blankbuf, 1 << 4);
            if (bdrv_write(s->bdrv_cur, erasesec, tmpbuf, 1) < 0) {
                goto fail;
            }
        } else {
            if (sec + 1 > s->secs_cur) {
                goto fail;
            }
            memcpy(s->current + (sec << 9), blankbuf, 512);
            memcpy(s->current + (s->secs_cur << 9) + (sec << 4),
                   blankbuf, 1 << 4);
        }
    }

    qemu_free(tmpbuf);
    qemu_free(blankbuf);
    return 0;

fail:
    qemu_free(tmpbuf);
    qemu_free(blankbuf);
    return 1;
}

static void onenand_command(OneNANDState *s, int cmd)
{
    int b;
    int sec;
    void *buf;
#define SETADDR(block, page)			\
    sec = (s->addr[page] & 3) +			\
            ((((s->addr[page] >> 2) & 0x3f) +	\
              (((s->addr[block] & 0xfff) |	\
                (s->addr[block] >> 15 ?		\
                 s->density_mask : 0)) << 6)) << (PAGE_SHIFT - 9));
#define SETBUF_M()				\
    buf = (s->bufaddr & 8) ?			\
            s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0];	\
    buf += (s->bufaddr & 3) << 9;
#define SETBUF_S()				\
    buf = (s->bufaddr & 8) ?			\
            s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1];	\
    buf += (s->bufaddr & 3) << 4;

    switch (cmd) {
    case 0x00:	/* Load single/multiple sector data unit into buffer */
        SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)

        SETBUF_M()
        if (onenand_load_main(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;

#if 0
        SETBUF_S()
        if (onenand_load_spare(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
#endif

        /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
         * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
         * then we need two split the read/write into two chunks.
         */
        s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
        break;
    case 0x13:	/* Load single/multiple spare sector into buffer */
        SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)

        SETBUF_S()
        if (onenand_load_spare(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;

        /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
         * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
         * then we need two split the read/write into two chunks.
         */
        s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
        break;
    case 0x80:	/* Program single/multiple sector data unit from buffer */
        SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)

        SETBUF_M()
        if (onenand_prog_main(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;

#if 0
        SETBUF_S()
        if (onenand_prog_spare(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
#endif

        /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
         * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
         * then we need two split the read/write into two chunks.
         */
        s->intstatus |= ONEN_INT | ONEN_INT_PROG;
        break;
    case 0x1a:	/* Program single/multiple spare area sector from buffer */
        SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)

        SETBUF_S()
        if (onenand_prog_spare(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;

        /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
         * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
         * then we need two split the read/write into two chunks.
         */
        s->intstatus |= ONEN_INT | ONEN_INT_PROG;
        break;
    case 0x1b:	/* Copy-back program */
        SETBUF_S()

        SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
        if (onenand_load_main(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;

        SETADDR(ONEN_BUF_DEST_BLOCK, ONEN_BUF_DEST_PAGE)
        if (onenand_prog_main(s, sec, s->count, buf))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;

        /* TODO: spare areas */

        s->intstatus |= ONEN_INT | ONEN_INT_PROG;
        break;

    case 0x23:	/* Unlock NAND array block(s) */
        s->intstatus |= ONEN_INT;

        /* XXX the previous (?) area should be locked automatically */
        for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
            if (b >= s->blocks) {
                s->status |= ONEN_ERR_CMD;
                break;
            }
            if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
                break;

            s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
        }
        break;
    case 0x27:	/* Unlock All NAND array blocks */
        s->intstatus |= ONEN_INT;

        for (b = 0; b < s->blocks; b ++) {
            if (b >= s->blocks) {
                s->status |= ONEN_ERR_CMD;
                break;
            }
            if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
                break;

            s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
        }
        break;

    case 0x2a:	/* Lock NAND array block(s) */
        s->intstatus |= ONEN_INT;

        for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
            if (b >= s->blocks) {
                s->status |= ONEN_ERR_CMD;
                break;
            }
            if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
                break;

            s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKED;
        }
        break;
    case 0x2c:	/* Lock-tight NAND array block(s) */
        s->intstatus |= ONEN_INT;

        for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
            if (b >= s->blocks) {
                s->status |= ONEN_ERR_CMD;
                break;
            }
            if (s->blockwp[b] == ONEN_LOCK_UNLOCKED)
                continue;

            s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKTIGHTEN;
        }
        break;

    case 0x71:	/* Erase-Verify-Read */
        s->intstatus |= ONEN_INT;
        break;
    case 0x95:	/* Multi-block erase */
        qemu_irq_pulse(s->intr);
        /* Fall through.  */
    case 0x94:	/* Block erase */
        sec = ((s->addr[ONEN_BUF_BLOCK] & 0xfff) |
                        (s->addr[ONEN_BUF_BLOCK] >> 15 ? s->density_mask : 0))
                << (BLOCK_SHIFT - 9);
        if (onenand_erase(s, sec, 1 << (BLOCK_SHIFT - 9)))
            s->status |= ONEN_ERR_CMD | ONEN_ERR_ERASE;

        s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
        break;
    case 0xb0:	/* Erase suspend */
        break;
    case 0x30:	/* Erase resume */
        s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
        break;

    case 0xf0:	/* Reset NAND Flash core */
        onenand_reset(s, 0);
        break;
    case 0xf3:	/* Reset OneNAND */
        onenand_reset(s, 0);
        break;

    case 0x65:	/* OTP Access */
        s->intstatus |= ONEN_INT;
        s->bdrv_cur = NULL;
        s->current = s->otp;
        s->secs_cur = 1 << (BLOCK_SHIFT - 9);
        s->addr[ONEN_BUF_BLOCK] = 0;
        s->otpmode = 1;
        break;

    default:
        s->status |= ONEN_ERR_CMD;
        s->intstatus |= ONEN_INT;
        fprintf(stderr, "%s: unknown OneNAND command %x\n",
                        __FUNCTION__, cmd);
    }

    onenand_intr_update(s);
}

static uint32_t onenand_read(void *opaque, target_phys_addr_t addr)
{
    OneNANDState *s = (OneNANDState *) opaque;
    int offset = addr >> s->shift;

    switch (offset) {
    case 0x0000 ... 0xc000:
        return lduw_le_p(s->boot[0] + addr);

    case 0xf000:	/* Manufacturer ID */
        return s->id.man;
    case 0xf001:	/* Device ID */
        return s->id.dev;
    case 0xf002:	/* Version ID */
        return s->id.ver;
    /* TODO: get the following values from a real chip!  */
    case 0xf003:	/* Data Buffer size */
        return 1 << PAGE_SHIFT;
    case 0xf004:	/* Boot Buffer size */
        return 0x200;
    case 0xf005:	/* Amount of buffers */
        return 1 | (2 << 8);
    case 0xf006:	/* Technology */
        return 0;

    case 0xf100 ... 0xf107:	/* Start addresses */
        return s->addr[offset - 0xf100];

    case 0xf200:	/* Start buffer */
        return (s->bufaddr << 8) | ((s->count - 1) & (1 << (PAGE_SHIFT - 10)));

    case 0xf220:	/* Command */
        return s->command;
    case 0xf221:	/* System Configuration 1 */
        return s->config[0] & 0xffe0;
    case 0xf222:	/* System Configuration 2 */
        return s->config[1];

    case 0xf240:	/* Controller Status */
        return s->status;
    case 0xf241:	/* Interrupt */
        return s->intstatus;
    case 0xf24c:	/* Unlock Start Block Address */
        return s->unladdr[0];
    case 0xf24d:	/* Unlock End Block Address */
        return s->unladdr[1];
    case 0xf24e:	/* Write Protection Status */
        return s->wpstatus;

    case 0xff00:	/* ECC Status */
        return 0x00;
    case 0xff01:	/* ECC Result of main area data */
    case 0xff02:	/* ECC Result of spare area data */
    case 0xff03:	/* ECC Result of main area data */
    case 0xff04:	/* ECC Result of spare area data */
        hw_error("%s: imeplement ECC\n", __FUNCTION__);
        return 0x0000;
    }

    fprintf(stderr, "%s: unknown OneNAND register %x\n",
                    __FUNCTION__, offset);
    return 0;
}

static void onenand_write(void *opaque, target_phys_addr_t addr,
                uint32_t value)
{
    OneNANDState *s = (OneNANDState *) opaque;
    int offset = addr >> s->shift;
    int sec;

    switch (offset) {
    case 0x0000 ... 0x01ff:
    case 0x8000 ... 0x800f:
        if (s->cycle) {
            s->cycle = 0;

            if (value == 0x0000) {
                SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
                onenand_load_main(s, sec,
                                1 << (PAGE_SHIFT - 9), s->data[0][0]);
                s->addr[ONEN_BUF_PAGE] += 4;
                s->addr[ONEN_BUF_PAGE] &= 0xff;
            }
            break;
        }

        switch (value) {
        case 0x00f0:	/* Reset OneNAND */
            onenand_reset(s, 0);
            break;

        case 0x00e0:	/* Load Data into Buffer */
            s->cycle = 1;
            break;

        case 0x0090:	/* Read Identification Data */
            memset(s->boot[0], 0, 3 << s->shift);
            s->boot[0][0 << s->shift] = s->id.man & 0xff;
            s->boot[0][1 << s->shift] = s->id.dev & 0xff;
            s->boot[0][2 << s->shift] = s->wpstatus & 0xff;
            break;

        default:
            fprintf(stderr, "%s: unknown OneNAND boot command %x\n",
                            __FUNCTION__, value);
        }
        break;

    case 0xf100 ... 0xf107:	/* Start addresses */
        s->addr[offset - 0xf100] = value;
        break;

    case 0xf200:	/* Start buffer */
        s->bufaddr = (value >> 8) & 0xf;
        if (PAGE_SHIFT == 11)
            s->count = (value & 3) ?: 4;
        else if (PAGE_SHIFT == 10)
            s->count = (value & 1) ?: 2;
        break;

    case 0xf220:	/* Command */
        if (s->intstatus & (1 << 15))
            break;
        s->command = value;
        onenand_command(s, s->command);
        break;
    case 0xf221:	/* System Configuration 1 */
        s->config[0] = value;
        onenand_intr_update(s);
        qemu_set_irq(s->rdy, (s->config[0] >> 7) & 1);
        break;
    case 0xf222:	/* System Configuration 2 */
        s->config[1] = value;
        break;

    case 0xf241:	/* Interrupt */
        s->intstatus &= value;
        if ((1 << 15) & ~s->intstatus)
            s->status &= ~(ONEN_ERR_CMD | ONEN_ERR_ERASE |
                            ONEN_ERR_PROG | ONEN_ERR_LOAD);
        onenand_intr_update(s);
        break;
    case 0xf24c:	/* Unlock Start Block Address */
        s->unladdr[0] = value & (s->blocks - 1);
        /* For some reason we have to set the end address to by default
         * be same as start because the software forgets to write anything
         * in there.  */
        s->unladdr[1] = value & (s->blocks - 1);
        break;
    case 0xf24d:	/* Unlock End Block Address */
        s->unladdr[1] = value & (s->blocks - 1);
        break;

    default:
        fprintf(stderr, "%s: unknown OneNAND register %x\n",
                        __FUNCTION__, offset);
    }
}

static CPUReadMemoryFunc * const onenand_readfn[] = {
    onenand_read,	/* TODO */
    onenand_read,
    onenand_read,
};

static CPUWriteMemoryFunc * const onenand_writefn[] = {
    onenand_write,	/* TODO */
    onenand_write,
    onenand_write,
};

void *onenand_init(BlockDriverState *bdrv,
                uint16_t man_id, uint16_t dev_id, uint16_t ver_id,
                int regshift, qemu_irq irq)
{
    OneNANDState *s = (OneNANDState *) qemu_mallocz(sizeof(*s));
    uint32_t size = 1 << (24 + ((dev_id >> 4) & 7));
    void *ram;

    s->shift = regshift;
    s->intr = irq;
    s->rdy = NULL;
    s->id.man = man_id;
    s->id.dev = dev_id;
    s->id.ver = ver_id;
    s->blocks = size >> BLOCK_SHIFT;
    s->secs = size >> 9;
    s->blockwp = qemu_malloc(s->blocks);
    s->density_mask = (dev_id & 0x08) ? (1 << (6 + ((dev_id >> 4) & 7))) : 0;
    s->iomemtype = cpu_register_io_memory(onenand_readfn,
                    onenand_writefn, s, DEVICE_NATIVE_ENDIAN);
    s->bdrv = bdrv;
    if (!s->bdrv) {
        s->image = memset(qemu_malloc(size + (size >> 5)),
                        0xff, size + (size >> 5));
    }
    s->otp = memset(qemu_malloc((64 + 2) << PAGE_SHIFT),
                    0xff, (64 + 2) << PAGE_SHIFT);
    s->ram = qemu_ram_alloc(NULL, "onenand.ram", 0xc000 << s->shift);
    ram = qemu_get_ram_ptr(s->ram);
    s->boot[0] = ram + (0x0000 << s->shift);
    s->boot[1] = ram + (0x8000 << s->shift);
    s->data[0][0] = ram + ((0x0200 + (0 << (PAGE_SHIFT - 1))) << s->shift);
    s->data[0][1] = ram + ((0x8010 + (0 << (PAGE_SHIFT - 6))) << s->shift);
    s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
    s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);

    onenand_reset(s, 1);

    return s;
}

void *onenand_raw_otp(void *opaque)
{
    OneNANDState *s = (OneNANDState *) opaque;

    return s->otp;
}
Commit	Line	Data
7e7c5e4c AZ	1	/*
	2	* OneNAND flash memories emulation.
	3	*
	4	* Copyright (C) 2008 Nokia Corporation
	5	* Written by Andrzej Zaborowski <[email protected]>
	6	*
	7	* This program is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU General Public License as
	9	* published by the Free Software Foundation; either version 2 or
	10	* (at your option) version 3 of the License.
	11	*
	12	* This program is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
fad6cb1a	17	* You should have received a copy of the GNU General Public License along
8167ee88	18	* with this program; if not, see <http://www.gnu.org/licenses/>.
7e7c5e4c AZ	19	*/
	20
	21	#include "qemu-common.h"
34f9f0b5	22	#include "hw.h"
7e7c5e4c AZ	23	#include "flash.h"
7e7c5e4c AZ	24	#include "irq.h"
666daa68	25	#include "blockdev.h"
7e7c5e4c AZ	26
	27	/* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
	28	#define PAGE_SHIFT 11
	29
	30	/* Fixed */
	31	#define BLOCK_SHIFT (PAGE_SHIFT + 6)
	32
bc24a225	33	typedef struct {
5923ba42 JR	34	struct {
	35	uint16_t man;
	36	uint16_t dev;
	37	uint16_t ver;
	38	} id;
7e7c5e4c	39	int shift;
c227f099	40	target_phys_addr_t base;
7e7c5e4c AZ	41	qemu_irq intr;
	42	qemu_irq rdy;
	43	BlockDriverState *bdrv;
	44	BlockDriverState *bdrv_cur;
	45	uint8_t *image;
	46	uint8_t *otp;
	47	uint8_t *current;
c227f099	48	ram_addr_t ram;
7e7c5e4c AZ	49	uint8_t *boot[2];
	50	uint8_t *data[2][2];
	51	int iomemtype;
	52	int cycle;
	53	int otpmode;
	54
	55	uint16_t addr[8];
	56	uint16_t unladdr[8];
	57	int bufaddr;
	58	int count;
	59	uint16_t command;
	60	uint16_t config[2];
	61	uint16_t status;
	62	uint16_t intstatus;
	63	uint16_t wpstatus;
	64
bc24a225	65	ECCState ecc;
7e7c5e4c AZ	66
	67	int density_mask;
	68	int secs;
	69	int secs_cur;
	70	int blocks;
	71	uint8_t *blockwp;
bc24a225	72	} OneNANDState;
7e7c5e4c AZ	73
	74	enum {
	75	ONEN_BUF_BLOCK = 0,
	76	ONEN_BUF_BLOCK2 = 1,
	77	ONEN_BUF_DEST_BLOCK = 2,
	78	ONEN_BUF_DEST_PAGE = 3,
	79	ONEN_BUF_PAGE = 7,
	80	};
	81
	82	enum {
	83	ONEN_ERR_CMD = 1 << 10,
	84	ONEN_ERR_ERASE = 1 << 11,
	85	ONEN_ERR_PROG = 1 << 12,
	86	ONEN_ERR_LOAD = 1 << 13,
	87	};
	88
	89	enum {
	90	ONEN_INT_RESET = 1 << 4,
	91	ONEN_INT_ERASE = 1 << 5,
	92	ONEN_INT_PROG = 1 << 6,
	93	ONEN_INT_LOAD = 1 << 7,
	94	ONEN_INT = 1 << 15,
	95	};
	96
	97	enum {
	98	ONEN_LOCK_LOCKTIGHTEN = 1 << 0,
	99	ONEN_LOCK_LOCKED = 1 << 1,
	100	ONEN_LOCK_UNLOCKED = 1 << 2,
	101	};
	102
c227f099	103	void onenand_base_update(void *opaque, target_phys_addr_t new)
7e7c5e4c	104	{
bc24a225	105	OneNANDState s = (OneNANDState ) opaque;
7e7c5e4c AZ	106
	107	s->base = new;
	108
	109	/* XXX: We should use IO_MEM_ROMD but we broke it earlier...
	110	* Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
	111	* write boot commands. Also take note of the BWPS bit. */
	112	cpu_register_physical_memory(s->base + (0x0000 << s->shift),
	113	0x0200 << s->shift, s->iomemtype);
	114	cpu_register_physical_memory(s->base + (0x0200 << s->shift),
	115	0xbe00 << s->shift,
	116	(s->ram +(0x0200 << s->shift)) \| IO_MEM_RAM);
	117	if (s->iomemtype)
8da3ff18 PB	118	cpu_register_physical_memory_offset(s->base + (0xc000 << s->shift),
8da3ff18 PB	119	0x4000 << s->shift, s->iomemtype, (0xc000 << s->shift));
7e7c5e4c AZ	120	}
	121
	122	void onenand_base_unmap(void *opaque)
	123	{
bc24a225	124	OneNANDState s = (OneNANDState ) opaque;
7e7c5e4c AZ	125
	126	cpu_register_physical_memory(s->base,
	127	0x10000 << s->shift, IO_MEM_UNASSIGNED);
	128	}
	129
bc24a225	130	static void onenand_intr_update(OneNANDState *s)
7e7c5e4c AZ	131	{
	132	qemu_set_irq(s->intr, ((s->intstatus >> 15) ^ (~s->config[0] >> 6)) & 1);
	133	}
	134
	135	/* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
bc24a225	136	static void onenand_reset(OneNANDState *s, int cold)
7e7c5e4c AZ	137	{
	138	memset(&s->addr, 0, sizeof(s->addr));
	139	s->command = 0;
	140	s->count = 1;
	141	s->bufaddr = 0;
	142	s->config[0] = 0x40c0;
	143	s->config[1] = 0x0000;
	144	onenand_intr_update(s);
	145	qemu_irq_raise(s->rdy);
	146	s->status = 0x0000;
	147	s->intstatus = cold ? 0x8080 : 0x8010;
	148	s->unladdr[0] = 0;
	149	s->unladdr[1] = 0;
	150	s->wpstatus = 0x0002;
	151	s->cycle = 0;
	152	s->otpmode = 0;
	153	s->bdrv_cur = s->bdrv;
	154	s->current = s->image;
	155	s->secs_cur = s->secs;
	156
	157	if (cold) {
	158	/* Lock the whole flash */
	159	memset(s->blockwp, ONEN_LOCK_LOCKED, s->blocks);
	160
	161	if (s->bdrv && bdrv_read(s->bdrv, 0, s->boot[0], 8) < 0)
2ac71179	162	hw_error("%s: Loading the BootRAM failed.\n", __FUNCTION__);
7e7c5e4c AZ	163	}
	164	}
	165
bc24a225	166	static inline int onenand_load_main(OneNANDState *s, int sec, int secn,
7e7c5e4c AZ	167	void *dest)
	168	{
	169	if (s->bdrv_cur)
	170	return bdrv_read(s->bdrv_cur, sec, dest, secn) < 0;
	171	else if (sec + secn > s->secs_cur)
	172	return 1;
	173
	174	memcpy(dest, s->current + (sec << 9), secn << 9);
	175
	176	return 0;
	177	}
	178
bc24a225	179	static inline int onenand_prog_main(OneNANDState *s, int sec, int secn,
7e7c5e4c AZ	180	void *src)
7e7c5e4c AZ	181	{
f1588dd2 JR	182	int result = 0;
	183
	184	if (secn > 0) {
	185	uint32_t size = (uint32_t) secn * 512;
	186	const uint8_t sp = (const uint8_t ) src;
	187	uint8_t *dp = 0;
	188	if (s->bdrv_cur) {
	189	dp = qemu_malloc(size);
	190	if (!dp \|\| bdrv_read(s->bdrv_cur, sec, dp, secn) < 0) {
	191	result = 1;
	192	}
	193	} else {
	194	if (sec + secn > s->secs_cur) {
	195	result = 1;
	196	} else {
	197	dp = (uint8_t *) s->current + (sec << 9);
	198	}
	199	}
	200	if (!result) {
	201	uint32_t i;
	202	for (i = 0; i < size; i++) {
	203	dp[i] &= sp[i];
	204	}
	205	if (s->bdrv_cur) {
	206	result = bdrv_write(s->bdrv_cur, sec, dp, secn) < 0;
	207	}
	208	}
	209	if (dp && s->bdrv_cur) {
	210	qemu_free(dp);
	211	}
	212	}
7e7c5e4c	213
f1588dd2	214	return result;
7e7c5e4c AZ	215	}
7e7c5e4c AZ	216
bc24a225	217	static inline int onenand_load_spare(OneNANDState *s, int sec, int secn,
7e7c5e4c AZ	218	void *dest)
	219	{
	220	uint8_t buf[512];
	221
	222	if (s->bdrv_cur) {
	223	if (bdrv_read(s->bdrv_cur, s->secs_cur + (sec >> 5), buf, 1) < 0)
	224	return 1;
	225	memcpy(dest, buf + ((sec & 31) << 4), secn << 4);
	226	} else if (sec + secn > s->secs_cur)
	227	return 1;
	228	else
	229	memcpy(dest, s->current + (s->secs_cur << 9) + (sec << 4), secn << 4);
	230
	231	return 0;
	232	}
	233
bc24a225	234	static inline int onenand_prog_spare(OneNANDState *s, int sec, int secn,
7e7c5e4c AZ	235	void *src)
7e7c5e4c AZ	236	{
f1588dd2 JR	237	int result = 0;
	238	if (secn > 0) {
	239	const uint8_t sp = (const uint8_t ) src;
	240	uint8_t dp = 0, dpp = 0;
	241	if (s->bdrv_cur) {
	242	dp = qemu_malloc(512);
	243	if (!dp \|\| bdrv_read(s->bdrv_cur,
	244	s->secs_cur + (sec >> 5),
	245	dp, 1) < 0) {
	246	result = 1;
	247	} else {
	248	dpp = dp + ((sec & 31) << 4);
	249	}
	250	} else {
	251	if (sec + secn > s->secs_cur) {
	252	result = 1;
	253	} else {
	254	dpp = s->current + (s->secs_cur << 9) + (sec << 4);
	255	}
	256	}
	257	if (!result) {
	258	uint32_t i;
	259	for (i = 0; i < (secn << 4); i++) {
	260	dpp[i] &= sp[i];
	261	}
	262	if (s->bdrv_cur) {
	263	result = bdrv_write(s->bdrv_cur, s->secs_cur + (sec >> 5),
	264	dp, 1) < 0;
	265	}
	266	}
	267	if (dp) {
	268	qemu_free(dp);
	269	}
	270	}
	271	return result;
7e7c5e4c AZ	272	}
7e7c5e4c AZ	273
bc24a225	274	static inline int onenand_erase(OneNANDState *s, int sec, int num)
7e7c5e4c	275	{
f1588dd2 JR	276	uint8_t blankbuf, tmpbuf;
	277	blankbuf = qemu_malloc(512);
	278	if (!blankbuf) {
	279	return 1;
	280	}
	281	tmpbuf = qemu_malloc(512);
	282	if (!tmpbuf) {
	283	qemu_free(blankbuf);
	284	return 1;
	285	}
	286	memset(blankbuf, 0xff, 512);
	287	for (; num > 0; num--, sec++) {
	288	if (s->bdrv_cur) {
	289	int erasesec = s->secs_cur + (sec >> 5);
	290	if (bdrv_write(s->bdrv_cur, sec, blankbuf, 1)) {
	291	goto fail;
	292	}
	293	if (bdrv_read(s->bdrv_cur, erasesec, tmpbuf, 1) < 0) {
	294	goto fail;
	295	}
	296	memcpy(tmpbuf + ((sec & 31) << 4), blankbuf, 1 << 4);
	297	if (bdrv_write(s->bdrv_cur, erasesec, tmpbuf, 1) < 0) {
	298	goto fail;
	299	}
	300	} else {
	301	if (sec + 1 > s->secs_cur) {
	302	goto fail;
	303	}
	304	memcpy(s->current + (sec << 9), blankbuf, 512);
	305	memcpy(s->current + (s->secs_cur << 9) + (sec << 4),
	306	blankbuf, 1 << 4);
	307	}
7e7c5e4c AZ	308	}
7e7c5e4c AZ	309
f1588dd2 JR	310	qemu_free(tmpbuf);
f1588dd2 JR	311	qemu_free(blankbuf);
7e7c5e4c	312	return 0;
f1588dd2 JR	313
	314	fail:
	315	qemu_free(tmpbuf);
	316	qemu_free(blankbuf);
	317	return 1;
7e7c5e4c AZ	318	}
7e7c5e4c AZ	319
bc24a225	320	static void onenand_command(OneNANDState *s, int cmd)
7e7c5e4c AZ	321	{
	322	int b;
	323	int sec;
	324	void *buf;
	325	#define SETADDR(block, page) \
	326	sec = (s->addr[page] & 3) + \
	327	((((s->addr[page] >> 2) & 0x3f) + \
	328	(((s->addr[block] & 0xfff) \| \
	329	(s->addr[block] >> 15 ? \
	330	s->density_mask : 0)) << 6)) << (PAGE_SHIFT - 9));
	331	#define SETBUF_M() \
	332	buf = (s->bufaddr & 8) ? \
	333	s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0]; \
	334	buf += (s->bufaddr & 3) << 9;
	335	#define SETBUF_S() \
	336	buf = (s->bufaddr & 8) ? \
	337	s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1]; \
	338	buf += (s->bufaddr & 3) << 4;
	339
	340	switch (cmd) {
	341	case 0x00: /* Load single/multiple sector data unit into buffer */
	342	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
	343
	344	SETBUF_M()
	345	if (onenand_load_main(s, sec, s->count, buf))
	346	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_LOAD;
	347
	348	#if 0
	349	SETBUF_S()
	350	if (onenand_load_spare(s, sec, s->count, buf))
	351	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_LOAD;
	352	#endif
	353
	354	/* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
	355	* or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
	356	* then we need two split the read/write into two chunks.
	357	*/
	358	s->intstatus \|= ONEN_INT \| ONEN_INT_LOAD;
	359	break;
	360	case 0x13: /* Load single/multiple spare sector into buffer */
	361	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
	362
	363	SETBUF_S()
	364	if (onenand_load_spare(s, sec, s->count, buf))
	365	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_LOAD;
	366
	367	/* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
	368	* or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
	369	* then we need two split the read/write into two chunks.
	370	*/
	371	s->intstatus \|= ONEN_INT \| ONEN_INT_LOAD;
	372	break;
	373	case 0x80: /* Program single/multiple sector data unit from buffer */
	374	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
	375
	376	SETBUF_M()
	377	if (onenand_prog_main(s, sec, s->count, buf))
	378	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_PROG;
	379
	380	#if 0
	381	SETBUF_S()
	382	if (onenand_prog_spare(s, sec, s->count, buf))
	383	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_PROG;
	384	#endif
385
386	/* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
387	* or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
388	* then we need two split the read/write into two chunks.
389	*/
390	s->intstatus \|= ONEN_INT \| ONEN_INT_PROG;
391	break;
392	case 0x1a: /* Program single/multiple spare area sector from buffer */
393	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
394
395	SETBUF_S()
396	if (onenand_prog_spare(s, sec, s->count, buf))
397	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_PROG;
398
399	/* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
400	* or if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
401	* then we need two split the read/write into two chunks.
402	*/
403	s->intstatus \|= ONEN_INT \| ONEN_INT_PROG;
404	break;
405	case 0x1b: /* Copy-back program */
406	SETBUF_S()
407
408	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
409	if (onenand_load_main(s, sec, s->count, buf))
410	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_PROG;
411
412	SETADDR(ONEN_BUF_DEST_BLOCK, ONEN_BUF_DEST_PAGE)
413	if (onenand_prog_main(s, sec, s->count, buf))
414	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_PROG;
415
416	/* TODO: spare areas */
417
418	s->intstatus \|= ONEN_INT \| ONEN_INT_PROG;
419	break;
420
421	case 0x23: /* Unlock NAND array block(s) */
422	s->intstatus \|= ONEN_INT;
423
424	/* XXX the previous (?) area should be locked automatically */
425	for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
426	if (b >= s->blocks) {
427	s->status \|= ONEN_ERR_CMD;
428	break;
429	}
430	if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
431	break;
432
433	s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
434	}
435	break;
89588a4b AZ	436	case 0x27: /* Unlock All NAND array blocks */
	437	s->intstatus \|= ONEN_INT;
	438
	439	for (b = 0; b < s->blocks; b ++) {
	440	if (b >= s->blocks) {
	441	s->status \|= ONEN_ERR_CMD;
	442	break;
	443	}
	444	if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
	445	break;
	446
	447	s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
	448	}
	449	break;
	450
7e7c5e4c AZ	451	case 0x2a: /* Lock NAND array block(s) */
	452	s->intstatus \|= ONEN_INT;
	453
	454	for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
	455	if (b >= s->blocks) {
	456	s->status \|= ONEN_ERR_CMD;
	457	break;
	458	}
	459	if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
	460	break;
	461
	462	s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKED;
	463	}
	464	break;
	465	case 0x2c: /* Lock-tight NAND array block(s) */
	466	s->intstatus \|= ONEN_INT;
	467
	468	for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
	469	if (b >= s->blocks) {
	470	s->status \|= ONEN_ERR_CMD;
	471	break;
	472	}
	473	if (s->blockwp[b] == ONEN_LOCK_UNLOCKED)
	474	continue;
	475
	476	s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKTIGHTEN;
	477	}
	478	break;
	479
	480	case 0x71: /* Erase-Verify-Read */
	481	s->intstatus \|= ONEN_INT;
	482	break;
	483	case 0x95: /* Multi-block erase */
	484	qemu_irq_pulse(s->intr);
	485	/* Fall through. */
	486	case 0x94: /* Block erase */
	487	sec = ((s->addr[ONEN_BUF_BLOCK] & 0xfff) \|
	488	(s->addr[ONEN_BUF_BLOCK] >> 15 ? s->density_mask : 0))
	489	<< (BLOCK_SHIFT - 9);
	490	if (onenand_erase(s, sec, 1 << (BLOCK_SHIFT - 9)))
	491	s->status \|= ONEN_ERR_CMD \| ONEN_ERR_ERASE;
	492
	493	s->intstatus \|= ONEN_INT \| ONEN_INT_ERASE;
	494	break;
	495	case 0xb0: /* Erase suspend */
	496	break;
	497	case 0x30: /* Erase resume */
	498	s->intstatus \|= ONEN_INT \| ONEN_INT_ERASE;
	499	break;
	500
	501	case 0xf0: /* Reset NAND Flash core */
	502	onenand_reset(s, 0);
	503	break;
	504	case 0xf3: /* Reset OneNAND */
	505	onenand_reset(s, 0);
	506	break;
	507
	508	case 0x65: /* OTP Access */
	509	s->intstatus \|= ONEN_INT;
b9d38e95	510	s->bdrv_cur = NULL;
7e7c5e4c AZ	511	s->current = s->otp;
	512	s->secs_cur = 1 << (BLOCK_SHIFT - 9);
	513	s->addr[ONEN_BUF_BLOCK] = 0;
	514	s->otpmode = 1;
	515	break;
	516
	517	default:
	518	s->status \|= ONEN_ERR_CMD;
	519	s->intstatus \|= ONEN_INT;
	520	fprintf(stderr, "%s: unknown OneNAND command %x\n",
	521	__FUNCTION__, cmd);
	522	}
	523
	524	onenand_intr_update(s);
	525	}
	526
c227f099	527	static uint32_t onenand_read(void *opaque, target_phys_addr_t addr)
7e7c5e4c	528	{
bc24a225	529	OneNANDState s = (OneNANDState ) opaque;
8da3ff18	530	int offset = addr >> s->shift;
7e7c5e4c AZ	531
	532	switch (offset) {
	533	case 0x0000 ... 0xc000:
8da3ff18	534	return lduw_le_p(s->boot[0] + addr);
7e7c5e4c AZ	535
7e7c5e4c AZ	536	case 0xf000: /* Manufacturer ID */
5923ba42	537	return s->id.man;
7e7c5e4c	538	case 0xf001: /* Device ID */
5923ba42	539	return s->id.dev;
7e7c5e4c	540	case 0xf002: /* Version ID */
5923ba42 JR	541	return s->id.ver;
5923ba42 JR	542	/* TODO: get the following values from a real chip! */
7e7c5e4c AZ	543	case 0xf003: /* Data Buffer size */
	544	return 1 << PAGE_SHIFT;
	545	case 0xf004: /* Boot Buffer size */
	546	return 0x200;
	547	case 0xf005: /* Amount of buffers */
	548	return 1 \| (2 << 8);
	549	case 0xf006: /* Technology */
	550	return 0;
	551
	552	case 0xf100 ... 0xf107: /* Start addresses */
	553	return s->addr[offset - 0xf100];
	554
	555	case 0xf200: /* Start buffer */
	556	return (s->bufaddr << 8) \| ((s->count - 1) & (1 << (PAGE_SHIFT - 10)));
	557
	558	case 0xf220: /* Command */
	559	return s->command;
	560	case 0xf221: /* System Configuration 1 */
	561	return s->config[0] & 0xffe0;
	562	case 0xf222: /* System Configuration 2 */
	563	return s->config[1];
	564
	565	case 0xf240: /* Controller Status */
	566	return s->status;
	567	case 0xf241: /* Interrupt */
	568	return s->intstatus;
	569	case 0xf24c: /* Unlock Start Block Address */
	570	return s->unladdr[0];
	571	case 0xf24d: /* Unlock End Block Address */
	572	return s->unladdr[1];
	573	case 0xf24e: /* Write Protection Status */
	574	return s->wpstatus;
	575
	576	case 0xff00: /* ECC Status */
	577	return 0x00;
	578	case 0xff01: /* ECC Result of main area data */
	579	case 0xff02: /* ECC Result of spare area data */
	580	case 0xff03: /* ECC Result of main area data */
	581	case 0xff04: /* ECC Result of spare area data */
2ac71179	582	hw_error("%s: imeplement ECC\n", __FUNCTION__);
7e7c5e4c AZ	583	return 0x0000;
	584	}
	585
	586	fprintf(stderr, "%s: unknown OneNAND register %x\n",
	587	__FUNCTION__, offset);
	588	return 0;
	589	}
	590
c227f099	591	static void onenand_write(void *opaque, target_phys_addr_t addr,
7e7c5e4c AZ	592	uint32_t value)
7e7c5e4c AZ	593	{
bc24a225	594	OneNANDState s = (OneNANDState ) opaque;
8da3ff18	595	int offset = addr >> s->shift;
7e7c5e4c AZ	596	int sec;
	597
	598	switch (offset) {
	599	case 0x0000 ... 0x01ff:
	600	case 0x8000 ... 0x800f:
	601	if (s->cycle) {
	602	s->cycle = 0;
	603
	604	if (value == 0x0000) {
	605	SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
	606	onenand_load_main(s, sec,
	607	1 << (PAGE_SHIFT - 9), s->data[0][0]);
	608	s->addr[ONEN_BUF_PAGE] += 4;
	609	s->addr[ONEN_BUF_PAGE] &= 0xff;
	610	}
	611	break;
	612	}
	613
	614	switch (value) {
	615	case 0x00f0: /* Reset OneNAND */
	616	onenand_reset(s, 0);
	617	break;
	618
	619	case 0x00e0: /* Load Data into Buffer */
	620	s->cycle = 1;
	621	break;
	622
	623	case 0x0090: /* Read Identification Data */
	624	memset(s->boot[0], 0, 3 << s->shift);
5923ba42 JR	625	s->boot[0][0 << s->shift] = s->id.man & 0xff;
5923ba42 JR	626	s->boot[0][1 << s->shift] = s->id.dev & 0xff;
7e7c5e4c AZ	627	s->boot[0][2 << s->shift] = s->wpstatus & 0xff;
	628	break;
	629
	630	default:
	631	fprintf(stderr, "%s: unknown OneNAND boot command %x\n",
	632	__FUNCTION__, value);
	633	}
	634	break;
	635
	636	case 0xf100 ... 0xf107: /* Start addresses */
	637	s->addr[offset - 0xf100] = value;
	638	break;
	639
	640	case 0xf200: /* Start buffer */
	641	s->bufaddr = (value >> 8) & 0xf;
	642	if (PAGE_SHIFT == 11)
	643	s->count = (value & 3) ?: 4;
	644	else if (PAGE_SHIFT == 10)
	645	s->count = (value & 1) ?: 2;
	646	break;
	647
	648	case 0xf220: /* Command */
	649	if (s->intstatus & (1 << 15))
	650	break;
	651	s->command = value;
	652	onenand_command(s, s->command);
	653	break;
	654	case 0xf221: /* System Configuration 1 */
	655	s->config[0] = value;
	656	onenand_intr_update(s);
	657	qemu_set_irq(s->rdy, (s->config[0] >> 7) & 1);
	658	break;
	659	case 0xf222: /* System Configuration 2 */
	660	s->config[1] = value;
	661	break;
	662
	663	case 0xf241: /* Interrupt */
	664	s->intstatus &= value;
	665	if ((1 << 15) & ~s->intstatus)
	666	s->status &= ~(ONEN_ERR_CMD \| ONEN_ERR_ERASE \|
	667	ONEN_ERR_PROG \| ONEN_ERR_LOAD);
	668	onenand_intr_update(s);
	669	break;
	670	case 0xf24c: /* Unlock Start Block Address */
	671	s->unladdr[0] = value & (s->blocks - 1);
	672	/* For some reason we have to set the end address to by default
	673	* be same as start because the software forgets to write anything
	674	* in there. */
	675	s->unladdr[1] = value & (s->blocks - 1);
	676	break;
	677	case 0xf24d: /* Unlock End Block Address */
	678	s->unladdr[1] = value & (s->blocks - 1);
	679	break;
	680
	681	default:
	682	fprintf(stderr, "%s: unknown OneNAND register %x\n",
	683	__FUNCTION__, offset);
	684	}
	685	}
	686
d60efc6b	687	static CPUReadMemoryFunc * const onenand_readfn[] = {
7e7c5e4c AZ	688	onenand_read, /* TODO */
	689	onenand_read,
	690	onenand_read,
	691	};
	692
d60efc6b	693	static CPUWriteMemoryFunc * const onenand_writefn[] = {
7e7c5e4c AZ	694	onenand_write, /* TODO */
	695	onenand_write,
	696	onenand_write,
	697	};
	698
5923ba42 JR	699	void onenand_init(BlockDriverState bdrv,
5923ba42 JR	700	uint16_t man_id, uint16_t dev_id, uint16_t ver_id,
af5a75f4	701	int regshift, qemu_irq irq)
7e7c5e4c	702	{
bc24a225	703	OneNANDState s = (OneNANDState ) qemu_mallocz(sizeof(*s));
5923ba42	704	uint32_t size = 1 << (24 + ((dev_id >> 4) & 7));
7e7c5e4c AZ	705	void *ram;
	706
	707	s->shift = regshift;
	708	s->intr = irq;
b9d38e95	709	s->rdy = NULL;
5923ba42 JR	710	s->id.man = man_id;
	711	s->id.dev = dev_id;
	712	s->id.ver = ver_id;
7e7c5e4c AZ	713	s->blocks = size >> BLOCK_SHIFT;
	714	s->secs = size >> 9;
	715	s->blockwp = qemu_malloc(s->blocks);
5923ba42	716	s->density_mask = (dev_id & 0x08) ? (1 << (6 + ((dev_id >> 4) & 7))) : 0;
1eed09cb	717	s->iomemtype = cpu_register_io_memory(onenand_readfn,
2507c12a	718	onenand_writefn, s, DEVICE_NATIVE_ENDIAN);
af5a75f4 PM	719	s->bdrv = bdrv;
af5a75f4 PM	720	if (!s->bdrv) {
7e7c5e4c AZ	721	s->image = memset(qemu_malloc(size + (size >> 5)),
7e7c5e4c AZ	722	0xff, size + (size >> 5));
63efb1d9	723	}
7e7c5e4c AZ	724	s->otp = memset(qemu_malloc((64 + 2) << PAGE_SHIFT),
7e7c5e4c AZ	725	0xff, (64 + 2) << PAGE_SHIFT);
1724f049	726	s->ram = qemu_ram_alloc(NULL, "onenand.ram", 0xc000 << s->shift);
5c130f65	727	ram = qemu_get_ram_ptr(s->ram);
7e7c5e4c AZ	728	s->boot[0] = ram + (0x0000 << s->shift);
	729	s->boot[1] = ram + (0x8000 << s->shift);
	730	s->data[0][0] = ram + ((0x0200 + (0 << (PAGE_SHIFT - 1))) << s->shift);
	731	s->data[0][1] = ram + ((0x8010 + (0 << (PAGE_SHIFT - 6))) << s->shift);
	732	s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
	733	s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
	734
	735	onenand_reset(s, 1);
	736
	737	return s;
	738	}
c580d92b AZ	739
	740	void onenand_raw_otp(void opaque)
	741	{
bc24a225	742	OneNANDState s = (OneNANDState ) opaque;
c580d92b AZ	743
	744	return s->otp;
	745	}