2 * Flash NAND memory emulation. Based on "16M x 8 Bit NAND Flash
3 * Memory" datasheet for the KM29U128AT / K9F2808U0A chips from
6 * Copyright (c) 2006 Openedhand Ltd.
9 * This code is licensed under the GNU GPL v2.
17 /* FIXME: Pass block device as an argument. */
20 # define NAND_CMD_READ0 0x00
21 # define NAND_CMD_READ1 0x01
22 # define NAND_CMD_READ2 0x50
23 # define NAND_CMD_LPREAD2 0x30
24 # define NAND_CMD_NOSERIALREAD2 0x35
25 # define NAND_CMD_RANDOMREAD1 0x05
26 # define NAND_CMD_RANDOMREAD2 0xe0
27 # define NAND_CMD_READID 0x90
28 # define NAND_CMD_RESET 0xff
29 # define NAND_CMD_PAGEPROGRAM1 0x80
30 # define NAND_CMD_PAGEPROGRAM2 0x10
31 # define NAND_CMD_CACHEPROGRAM2 0x15
32 # define NAND_CMD_BLOCKERASE1 0x60
33 # define NAND_CMD_BLOCKERASE2 0xd0
34 # define NAND_CMD_READSTATUS 0x70
35 # define NAND_CMD_COPYBACKPRG1 0x85
37 # define NAND_IOSTATUS_ERROR (1 << 0)
38 # define NAND_IOSTATUS_PLANE0 (1 << 1)
39 # define NAND_IOSTATUS_PLANE1 (1 << 2)
40 # define NAND_IOSTATUS_PLANE2 (1 << 3)
41 # define NAND_IOSTATUS_PLANE3 (1 << 4)
42 # define NAND_IOSTATUS_BUSY (1 << 6)
43 # define NAND_IOSTATUS_UNPROTCT (1 << 7)
45 # define MAX_PAGE 0x800
49 uint8_t manf_id, chip_id;
51 int page_shift, oob_shift, erase_shift, addr_shift;
53 BlockDriverState *bdrv;
56 int cle, ale, ce, wp, gnd;
58 uint8_t io[MAX_PAGE + MAX_OOB + 0x400];
67 void (*blk_write)(struct nand_flash_s *s);
68 void (*blk_erase)(struct nand_flash_s *s);
69 void (*blk_load)(struct nand_flash_s *s, uint32_t addr, int offset);
72 # define NAND_NO_AUTOINCR 0x00000001
73 # define NAND_BUSWIDTH_16 0x00000002
74 # define NAND_NO_PADDING 0x00000004
75 # define NAND_CACHEPRG 0x00000008
76 # define NAND_COPYBACK 0x00000010
77 # define NAND_IS_AND 0x00000020
78 # define NAND_4PAGE_ARRAY 0x00000040
79 # define NAND_NO_READRDY 0x00000100
80 # define NAND_SAMSUNG_LP (NAND_NO_PADDING | NAND_COPYBACK)
84 # define PAGE(addr) ((addr) >> ADDR_SHIFT)
85 # define PAGE_START(page) (PAGE(page) * (PAGE_SIZE + OOB_SIZE))
86 # define PAGE_MASK ((1 << ADDR_SHIFT) - 1)
87 # define OOB_SHIFT (PAGE_SHIFT - 5)
88 # define OOB_SIZE (1 << OOB_SHIFT)
89 # define SECTOR(addr) ((addr) >> (9 + ADDR_SHIFT - PAGE_SHIFT))
90 # define SECTOR_OFFSET(addr) ((addr) & ((511 >> PAGE_SHIFT) << 8))
92 # define PAGE_SIZE 256
94 # define PAGE_SECTORS 1
97 # define PAGE_SIZE 512
99 # define PAGE_SECTORS 1
100 # define ADDR_SHIFT 8
102 # define PAGE_SIZE 2048
103 # define PAGE_SHIFT 11
104 # define PAGE_SECTORS 4
105 # define ADDR_SHIFT 16
108 /* Information based on Linux drivers/mtd/nand/nand_ids.c */
109 static const struct nand_info_s {
115 } nand_flash_ids[0x100] = {
116 [0 ... 0xff] = { 0 },
118 [0x6e] = { 1, 8, 8, 4, 0 },
119 [0x64] = { 2, 8, 8, 4, 0 },
120 [0x6b] = { 4, 8, 9, 4, 0 },
121 [0xe8] = { 1, 8, 8, 4, 0 },
122 [0xec] = { 1, 8, 8, 4, 0 },
123 [0xea] = { 2, 8, 8, 4, 0 },
124 [0xd5] = { 4, 8, 9, 4, 0 },
125 [0xe3] = { 4, 8, 9, 4, 0 },
126 [0xe5] = { 4, 8, 9, 4, 0 },
127 [0xd6] = { 8, 8, 9, 4, 0 },
129 [0x39] = { 8, 8, 9, 4, 0 },
130 [0xe6] = { 8, 8, 9, 4, 0 },
131 [0x49] = { 8, 16, 9, 4, NAND_BUSWIDTH_16 },
132 [0x59] = { 8, 16, 9, 4, NAND_BUSWIDTH_16 },
134 [0x33] = { 16, 8, 9, 5, 0 },
135 [0x73] = { 16, 8, 9, 5, 0 },
136 [0x43] = { 16, 16, 9, 5, NAND_BUSWIDTH_16 },
137 [0x53] = { 16, 16, 9, 5, NAND_BUSWIDTH_16 },
139 [0x35] = { 32, 8, 9, 5, 0 },
140 [0x75] = { 32, 8, 9, 5, 0 },
141 [0x45] = { 32, 16, 9, 5, NAND_BUSWIDTH_16 },
142 [0x55] = { 32, 16, 9, 5, NAND_BUSWIDTH_16 },
144 [0x36] = { 64, 8, 9, 5, 0 },
145 [0x76] = { 64, 8, 9, 5, 0 },
146 [0x46] = { 64, 16, 9, 5, NAND_BUSWIDTH_16 },
147 [0x56] = { 64, 16, 9, 5, NAND_BUSWIDTH_16 },
149 [0x78] = { 128, 8, 9, 5, 0 },
150 [0x39] = { 128, 8, 9, 5, 0 },
151 [0x79] = { 128, 8, 9, 5, 0 },
152 [0x72] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
153 [0x49] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
154 [0x74] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
155 [0x59] = { 128, 16, 9, 5, NAND_BUSWIDTH_16 },
157 [0x71] = { 256, 8, 9, 5, 0 },
160 * These are the new chips with large page size. The pagesize and the
161 * erasesize is determined from the extended id bytes
163 # define LP_OPTIONS (NAND_SAMSUNG_LP | NAND_NO_READRDY | NAND_NO_AUTOINCR)
164 # define LP_OPTIONS16 (LP_OPTIONS | NAND_BUSWIDTH_16)
167 [0xa2] = { 64, 8, 0, 0, LP_OPTIONS },
168 [0xf2] = { 64, 8, 0, 0, LP_OPTIONS },
169 [0xb2] = { 64, 16, 0, 0, LP_OPTIONS16 },
170 [0xc2] = { 64, 16, 0, 0, LP_OPTIONS16 },
173 [0xa1] = { 128, 8, 0, 0, LP_OPTIONS },
174 [0xf1] = { 128, 8, 0, 0, LP_OPTIONS },
175 [0xb1] = { 128, 16, 0, 0, LP_OPTIONS16 },
176 [0xc1] = { 128, 16, 0, 0, LP_OPTIONS16 },
179 [0xaa] = { 256, 8, 0, 0, LP_OPTIONS },
180 [0xda] = { 256, 8, 0, 0, LP_OPTIONS },
181 [0xba] = { 256, 16, 0, 0, LP_OPTIONS16 },
182 [0xca] = { 256, 16, 0, 0, LP_OPTIONS16 },
185 [0xac] = { 512, 8, 0, 0, LP_OPTIONS },
186 [0xdc] = { 512, 8, 0, 0, LP_OPTIONS },
187 [0xbc] = { 512, 16, 0, 0, LP_OPTIONS16 },
188 [0xcc] = { 512, 16, 0, 0, LP_OPTIONS16 },
191 [0xa3] = { 1024, 8, 0, 0, LP_OPTIONS },
192 [0xd3] = { 1024, 8, 0, 0, LP_OPTIONS },
193 [0xb3] = { 1024, 16, 0, 0, LP_OPTIONS16 },
194 [0xc3] = { 1024, 16, 0, 0, LP_OPTIONS16 },
197 [0xa5] = { 2048, 8, 0, 0, LP_OPTIONS },
198 [0xd5] = { 2048, 8, 0, 0, LP_OPTIONS },
199 [0xb5] = { 2048, 16, 0, 0, LP_OPTIONS16 },
200 [0xc5] = { 2048, 16, 0, 0, LP_OPTIONS16 },
203 static void nand_reset(struct nand_flash_s *s)
205 s->cmd = NAND_CMD_READ0;
210 s->status &= NAND_IOSTATUS_UNPROTCT;
213 static void nand_command(struct nand_flash_s *s)
220 case NAND_CMD_READID:
221 s->io[0] = s->manf_id;
222 s->io[1] = s->chip_id;
223 s->io[2] = 'Q'; /* Don't-care byte (often 0xa5) */
224 if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP)
225 s->io[3] = 0x15; /* Page Size, Block Size, Spare Size.. */
227 s->io[3] = 0xc0; /* Multi-plane */
232 case NAND_CMD_RANDOMREAD2:
233 case NAND_CMD_NOSERIALREAD2:
234 if (!(nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP))
237 s->blk_load(s, s->addr, s->addr & ((1 << s->addr_shift) - 1));
244 case NAND_CMD_PAGEPROGRAM1:
249 case NAND_CMD_PAGEPROGRAM2:
255 case NAND_CMD_BLOCKERASE1:
258 case NAND_CMD_BLOCKERASE2:
259 if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP)
269 case NAND_CMD_READSTATUS:
270 s->io[0] = s->status;
276 printf("%s: Unknown NAND command 0x%02x\n", __FUNCTION__, s->cmd);
280 static void nand_save(QEMUFile *f, void *opaque)
282 struct nand_flash_s *s = (struct nand_flash_s *) opaque;
283 qemu_put_byte(f, s->cle);
284 qemu_put_byte(f, s->ale);
285 qemu_put_byte(f, s->ce);
286 qemu_put_byte(f, s->wp);
287 qemu_put_byte(f, s->gnd);
288 qemu_put_buffer(f, s->io, sizeof(s->io));
289 qemu_put_be32(f, s->ioaddr - s->io);
290 qemu_put_be32(f, s->iolen);
292 qemu_put_be32s(f, &s->cmd);
293 qemu_put_be32s(f, &s->addr);
294 qemu_put_be32(f, s->addrlen);
295 qemu_put_be32(f, s->status);
296 qemu_put_be32(f, s->offset);
297 /* XXX: do we want to save s->storage too? */
300 static int nand_load(QEMUFile *f, void *opaque, int version_id)
302 struct nand_flash_s *s = (struct nand_flash_s *) opaque;
303 s->cle = qemu_get_byte(f);
304 s->ale = qemu_get_byte(f);
305 s->ce = qemu_get_byte(f);
306 s->wp = qemu_get_byte(f);
307 s->gnd = qemu_get_byte(f);
308 qemu_get_buffer(f, s->io, sizeof(s->io));
309 s->ioaddr = s->io + qemu_get_be32(f);
310 s->iolen = qemu_get_be32(f);
311 if (s->ioaddr >= s->io + sizeof(s->io) || s->ioaddr < s->io)
314 qemu_get_be32s(f, &s->cmd);
315 qemu_get_be32s(f, &s->addr);
316 s->addrlen = qemu_get_be32(f);
317 s->status = qemu_get_be32(f);
318 s->offset = qemu_get_be32(f);
323 * Chip inputs are CLE, ALE, CE, WP, GND and eight I/O pins. Chip
324 * outputs are R/B and eight I/O pins.
326 * CE, WP and R/B are active low.
328 void nand_setpins(struct nand_flash_s *s,
329 int cle, int ale, int ce, int wp, int gnd)
337 s->status |= NAND_IOSTATUS_UNPROTCT;
339 s->status &= ~NAND_IOSTATUS_UNPROTCT;
342 void nand_getpins(struct nand_flash_s *s, int *rb)
347 void nand_setio(struct nand_flash_s *s, uint8_t value)
349 if (!s->ce && s->cle) {
350 if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
351 if (s->cmd == NAND_CMD_READ0 && value == NAND_CMD_LPREAD2)
353 if (value == NAND_CMD_RANDOMREAD1) {
354 s->addr &= ~((1 << s->addr_shift) - 1);
359 if (value == NAND_CMD_READ0)
361 else if (value == NAND_CMD_READ1) {
363 value = NAND_CMD_READ0;
365 else if (value == NAND_CMD_READ2) {
366 s->offset = 1 << s->page_shift;
367 value = NAND_CMD_READ0;
372 if (s->cmd == NAND_CMD_READSTATUS ||
373 s->cmd == NAND_CMD_PAGEPROGRAM2 ||
374 s->cmd == NAND_CMD_BLOCKERASE1 ||
375 s->cmd == NAND_CMD_BLOCKERASE2 ||
376 s->cmd == NAND_CMD_NOSERIALREAD2 ||
377 s->cmd == NAND_CMD_RANDOMREAD2 ||
378 s->cmd == NAND_CMD_RESET)
381 if (s->cmd != NAND_CMD_RANDOMREAD2) {
388 s->addr |= value << (s->addrlen * 8);
391 if (s->addrlen == 1 && s->cmd == NAND_CMD_READID)
394 if (!(nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) &&
396 s->cmd == NAND_CMD_READ0 ||
397 s->cmd == NAND_CMD_PAGEPROGRAM1))
399 if ((nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) &&
401 s->cmd == NAND_CMD_READ0 ||
402 s->cmd == NAND_CMD_PAGEPROGRAM1))
406 if (!s->cle && !s->ale && s->cmd == NAND_CMD_PAGEPROGRAM1) {
407 if (s->iolen < (1 << s->page_shift) + (1 << s->oob_shift))
408 s->io[s->iolen ++] = value;
409 } else if (!s->cle && !s->ale && s->cmd == NAND_CMD_COPYBACKPRG1) {
410 if ((s->addr & ((1 << s->addr_shift) - 1)) <
411 (1 << s->page_shift) + (1 << s->oob_shift)) {
412 s->io[s->iolen + (s->addr & ((1 << s->addr_shift) - 1))] = value;
418 uint8_t nand_getio(struct nand_flash_s *s)
422 /* Allow sequential reading */
423 if (!s->iolen && s->cmd == NAND_CMD_READ0) {
424 offset = (s->addr & ((1 << s->addr_shift) - 1)) + s->offset;
427 s->blk_load(s, s->addr, offset);
429 s->iolen = (1 << s->page_shift) - offset;
431 s->iolen = (1 << s->page_shift) + (1 << s->oob_shift) - offset;
434 if (s->ce || s->iolen <= 0)
438 return *(s->ioaddr ++);
441 struct nand_flash_s *nand_init(int manf_id, int chip_id)
444 struct nand_flash_s *s;
447 if (nand_flash_ids[chip_id].size == 0) {
448 hw_error("%s: Unsupported NAND chip ID.\n", __FUNCTION__);
451 s = (struct nand_flash_s *) qemu_mallocz(sizeof(struct nand_flash_s));
452 index = drive_get_index(IF_MTD, 0, 0);
454 s->bdrv = drives_table[index].bdrv;
455 s->manf_id = manf_id;
456 s->chip_id = chip_id;
457 s->size = nand_flash_ids[s->chip_id].size << 20;
458 if (nand_flash_ids[s->chip_id].options & NAND_SAMSUNG_LP) {
462 s->page_shift = nand_flash_ids[s->chip_id].page_shift;
463 s->erase_shift = nand_flash_ids[s->chip_id].erase_shift;
466 switch (1 << s->page_shift) {
477 hw_error("%s: Unsupported NAND block size.\n", __FUNCTION__);
480 pagesize = 1 << s->oob_shift;
482 if (s->bdrv && bdrv_getlength(s->bdrv) >=
483 (s->pages << s->page_shift) + (s->pages << s->oob_shift)) {
489 pagesize += 1 << s->page_shift;
491 s->storage = (uint8_t *) memset(qemu_malloc(s->pages * pagesize),
492 0xff, s->pages * pagesize);
493 /* Give s->ioaddr a sane value in case we save state before it
497 register_savevm("nand", -1, 0, nand_save, nand_load, s);
502 void nand_done(struct nand_flash_s *s)
506 bdrv_delete(s->bdrv);
509 if (!s->bdrv || s->mem_oob)
517 /* Program a single page */
518 static void glue(nand_blk_write_, PAGE_SIZE)(struct nand_flash_s *s)
520 uint32_t off, page, sector, soff;
521 uint8_t iobuf[(PAGE_SECTORS + 2) * 0x200];
522 if (PAGE(s->addr) >= s->pages)
526 memcpy(s->storage + PAGE_START(s->addr) + (s->addr & PAGE_MASK) +
527 s->offset, s->io, s->iolen);
528 } else if (s->mem_oob) {
529 sector = SECTOR(s->addr);
530 off = (s->addr & PAGE_MASK) + s->offset;
531 soff = SECTOR_OFFSET(s->addr);
532 if (bdrv_read(s->bdrv, sector, iobuf, PAGE_SECTORS) == -1) {
533 printf("%s: read error in sector %i\n", __FUNCTION__, sector);
537 memcpy(iobuf + (soff | off), s->io, MIN(s->iolen, PAGE_SIZE - off));
538 if (off + s->iolen > PAGE_SIZE) {
539 page = PAGE(s->addr);
540 memcpy(s->storage + (page << OOB_SHIFT), s->io + PAGE_SIZE - off,
541 MIN(OOB_SIZE, off + s->iolen - PAGE_SIZE));
544 if (bdrv_write(s->bdrv, sector, iobuf, PAGE_SECTORS) == -1)
545 printf("%s: write error in sector %i\n", __FUNCTION__, sector);
547 off = PAGE_START(s->addr) + (s->addr & PAGE_MASK) + s->offset;
550 if (bdrv_read(s->bdrv, sector, iobuf, PAGE_SECTORS + 2) == -1) {
551 printf("%s: read error in sector %i\n", __FUNCTION__, sector);
555 memcpy(iobuf + soff, s->io, s->iolen);
557 if (bdrv_write(s->bdrv, sector, iobuf, PAGE_SECTORS + 2) == -1)
558 printf("%s: write error in sector %i\n", __FUNCTION__, sector);
563 /* Erase a single block */
564 static void glue(nand_blk_erase_, PAGE_SIZE)(struct nand_flash_s *s)
566 uint32_t i, page, addr;
567 uint8_t iobuf[0x200] = { [0 ... 0x1ff] = 0xff, };
568 addr = s->addr & ~((1 << (ADDR_SHIFT + s->erase_shift)) - 1);
570 if (PAGE(addr) >= s->pages)
574 memset(s->storage + PAGE_START(addr),
575 0xff, (PAGE_SIZE + OOB_SIZE) << s->erase_shift);
576 } else if (s->mem_oob) {
577 memset(s->storage + (PAGE(addr) << OOB_SHIFT),
578 0xff, OOB_SIZE << s->erase_shift);
580 page = SECTOR(addr + (ADDR_SHIFT + s->erase_shift));
581 for (; i < page; i ++)
582 if (bdrv_write(s->bdrv, i, iobuf, 1) == -1)
583 printf("%s: write error in sector %i\n", __FUNCTION__, i);
585 addr = PAGE_START(addr);
587 if (bdrv_read(s->bdrv, page, iobuf, 1) == -1)
588 printf("%s: read error in sector %i\n", __FUNCTION__, page);
589 memset(iobuf + (addr & 0x1ff), 0xff, (~addr & 0x1ff) + 1);
590 if (bdrv_write(s->bdrv, page, iobuf, 1) == -1)
591 printf("%s: write error in sector %i\n", __FUNCTION__, page);
593 memset(iobuf, 0xff, 0x200);
594 i = (addr & ~0x1ff) + 0x200;
595 for (addr += ((PAGE_SIZE + OOB_SIZE) << s->erase_shift) - 0x200;
596 i < addr; i += 0x200)
597 if (bdrv_write(s->bdrv, i >> 9, iobuf, 1) == -1)
598 printf("%s: write error in sector %i\n", __FUNCTION__, i >> 9);
601 if (bdrv_read(s->bdrv, page, iobuf, 1) == -1)
602 printf("%s: read error in sector %i\n", __FUNCTION__, page);
603 memset(iobuf, 0xff, ((addr - 1) & 0x1ff) + 1);
604 if (bdrv_write(s->bdrv, page, iobuf, 1) == -1)
605 printf("%s: write error in sector %i\n", __FUNCTION__, page);
609 static void glue(nand_blk_load_, PAGE_SIZE)(struct nand_flash_s *s,
610 uint32_t addr, int offset)
612 if (PAGE(addr) >= s->pages)
617 if (bdrv_read(s->bdrv, SECTOR(addr), s->io, PAGE_SECTORS) == -1)
618 printf("%s: read error in sector %i\n",
619 __FUNCTION__, SECTOR(addr));
620 memcpy(s->io + SECTOR_OFFSET(s->addr) + PAGE_SIZE,
621 s->storage + (PAGE(s->addr) << OOB_SHIFT),
623 s->ioaddr = s->io + SECTOR_OFFSET(s->addr) + offset;
625 if (bdrv_read(s->bdrv, PAGE_START(addr) >> 9,
626 s->io, (PAGE_SECTORS + 2)) == -1)
627 printf("%s: read error in sector %i\n",
628 __FUNCTION__, PAGE_START(addr) >> 9);
629 s->ioaddr = s->io + (PAGE_START(addr) & 0x1ff) + offset;
632 memcpy(s->io, s->storage + PAGE_START(s->addr) +
633 offset, PAGE_SIZE + OOB_SIZE - offset);
637 s->addr &= PAGE_SIZE - 1;
638 s->addr += PAGE_SIZE;
641 static void glue(nand_init_, PAGE_SIZE)(struct nand_flash_s *s)
643 s->oob_shift = PAGE_SHIFT - 5;
644 s->pages = s->size >> PAGE_SHIFT;
645 s->addr_shift = ADDR_SHIFT;
647 s->blk_erase = glue(nand_blk_erase_, PAGE_SIZE);
648 s->blk_write = glue(nand_blk_write_, PAGE_SIZE);
649 s->blk_load = glue(nand_blk_load_, PAGE_SIZE);