1 /* Common Flash Memory Interface (CFI) model.
2 http://www.spansion.com/Support/AppNotes/CFI_Spec_AN_03.pdf
3 http://www.spansion.com/Support/AppNotes/cfi_100_20011201.pdf
5 Copyright (C) 2010-2011 Free Software Foundation, Inc.
6 Contributed by Analog Devices, Inc.
8 This file is part of simulators.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
23 /* TODO: support vendor query tables. */
31 #ifdef HAVE_SYS_MMAN_H
40 /* Flashes are simple state machines, so here we cover all the
41 different states a device might be in at any particular time. */
51 CFI_STATE_WRITE_BUFFER
,
52 CFI_STATE_WRITE_BUFFER_CONFIRM
,
55 /* This is the structure that all CFI conforming devices must provided
56 when asked for it. This allows a single driver to dynamically support
57 different flash geometries without having to hardcode specs.
59 If you want to start mucking about here, you should just grab the
60 CFI spec and review that (see top of this file for URIs). */
63 /* This is always 'Q' 'R' 'Y'. */
65 /* Primary vendor ID. */
66 unsigned char p_id
[2];
67 /* Primary query table address. */
68 unsigned char p_adr
[2];
69 /* Alternate vendor ID. */
70 unsigned char a_id
[2];
71 /* Alternate query table address. */
72 unsigned char a_adr
[2];
76 unsigned char voltages
[4];
79 /* Normal min voltage level. */
80 unsigned char vcc_min
;
81 /* Normal max voltage level. */
82 unsigned char vcc_max
;
83 /* Programming min volage level. */
84 unsigned char vpp_min
;
85 /* Programming max volage level. */
86 unsigned char vpp_max
;
91 /* Operational timeouts. */
92 unsigned char timeouts
[8];
95 /* Typical timeout for writing a single "unit". */
96 unsigned char timeout_typ_unit_write
;
97 /* Typical timeout for writing a single "buffer". */
98 unsigned char timeout_typ_buf_write
;
99 /* Typical timeout for erasing a block. */
100 unsigned char timeout_typ_block_erase
;
101 /* Typical timeout for erasing the chip. */
102 unsigned char timeout_typ_chip_erase
;
103 /* Max timeout for writing a single "unit". */
104 unsigned char timeout_max_unit_write
;
105 /* Max timeout for writing a single "buffer". */
106 unsigned char timeout_max_buf_write
;
107 /* Max timeout for erasing a block. */
108 unsigned char timeout_max_block_erase
;
109 /* Max timeout for erasing the chip. */
110 unsigned char timeout_max_chip_erase
;
113 /* Flash size is 2^dev_size bytes. */
114 unsigned char dev_size
;
115 /* Flash device interface description. */
116 unsigned char iface_desc
[2];
117 /* Max length of a single buffer write is 2^max_buf_write_len bytes. */
118 unsigned char max_buf_write_len
[2];
119 /* Number of erase regions. */
120 unsigned char num_erase_regions
;
121 /* The erase regions would now be an array after this point, but since
122 it is dynamic, we'll provide that from "struct cfi" when requested. */
123 /*unsigned char erase_region_info;*/
126 /* Flashes may have regions with different erase sizes. There is one
127 structure per erase region. */
128 struct cfi_erase_region
138 /* Flashes are accessed via commands -- you write a certain number to
139 a special address to change the flash state and access info other
140 than the data. Diff companies have implemented their own command
141 set. This structure abstracts the different command sets so that
142 we can support multiple ones with just a single sim driver. */
146 void (*setup
) (struct hw
*me
, struct cfi
*cfi
);
147 bool (*write
) (struct hw
*me
, struct cfi
*cfi
, const void *source
,
148 unsigned offset
, unsigned value
, unsigned nr_bytes
);
149 bool (*read
) (struct hw
*me
, struct cfi
*cfi
, void *dest
,
150 unsigned offset
, unsigned shifted_offset
, unsigned nr_bytes
);
153 /* The per-flash state. Much of this comes from the device tree which
154 people declare themselves. See top of attach_cfi_regs() for more
158 unsigned width
, dev_size
, status
;
159 enum cfi_state state
;
160 unsigned char *data
, *mmap
;
162 struct cfi_query query
;
163 const struct cfi_cmdset
*cmdset
;
165 unsigned char *erase_region_info
;
166 struct cfi_erase_region
*erase_regions
;
169 /* Helpful strings which are used with HW_TRACE. */
170 static const char * const state_names
[] =
172 "READ", "READ_ID", "CFI_QUERY", "PROTECT", "STATUS", "ERASE", "WRITE",
173 "WRITE_BUFFER", "WRITE_BUFFER_CONFIRM",
176 /* Erase the block specified by the offset into the given CFI flash. */
178 cfi_erase_block (struct hw
*me
, struct cfi
*cfi
, unsigned offset
)
181 struct cfi_erase_region
*region
;
183 /* If no erase regions, then we can only do whole chip erase. */
184 /* XXX: Is this within spec ? Or must there always be at least one ? */
185 if (!cfi
->query
.num_erase_regions
)
186 memset (cfi
->data
, 0xff, cfi
->dev_size
);
188 for (i
= 0; i
< cfi
->query
.num_erase_regions
; ++i
)
190 region
= &cfi
->erase_regions
[i
];
192 if (offset
>= region
->end
)
195 /* XXX: Does spec require the erase addr to be erase block aligned ?
196 Maybe this is check is overly cautious ... */
197 offset
&= ~(region
->size
- 1);
198 memset (cfi
->data
+ offset
, 0xff, region
->size
);
203 /* Depending on the bus width, addresses might be bit shifted. This
204 helps us normalize everything without cluttering up the rest of
207 cfi_unshift_addr (struct cfi
*cfi
, unsigned addr
)
211 case 4: addr
>>= 1; /* fallthrough. */
217 /* CFI requires all values to be little endian in its structure, so
218 this helper writes a 16bit value into a little endian byte buffer. */
220 cfi_encode_16bit (unsigned char *data
, unsigned num
)
226 /* The functions required to implement the Intel command set. */
229 cmdset_intel_write (struct hw
*me
, struct cfi
*cfi
, const void *source
,
230 unsigned offset
, unsigned value
, unsigned nr_bytes
)
235 case CFI_STATE_READ_ID
:
238 case INTEL_CMD_ERASE_BLOCK
:
239 cfi
->state
= CFI_STATE_ERASE
;
241 case INTEL_CMD_WRITE
:
242 case INTEL_CMD_WRITE_ALT
:
243 cfi
->state
= CFI_STATE_WRITE
;
245 case INTEL_CMD_STATUS_CLEAR
:
246 cfi
->status
= INTEL_SR_DWS
;
248 case INTEL_CMD_LOCK_SETUP
:
249 cfi
->state
= CFI_STATE_PROTECT
;
256 case CFI_STATE_ERASE
:
257 if (value
== INTEL_CMD_ERASE_CONFIRM
)
259 cfi_erase_block (me
, cfi
, offset
);
260 cfi
->status
&= ~(INTEL_SR_PS
| INTEL_SR_ES
);
263 cfi
->status
|= INTEL_SR_PS
| INTEL_SR_ES
;
264 cfi
->state
= CFI_STATE_STATUS
;
267 case CFI_STATE_PROTECT
:
270 case INTEL_CMD_LOCK_BLOCK
:
271 case INTEL_CMD_UNLOCK_BLOCK
:
272 case INTEL_CMD_LOCK_DOWN_BLOCK
:
273 /* XXX: Handle the command. */
277 cfi
->status
|= INTEL_SR_PS
| INTEL_SR_ES
;
280 cfi
->state
= CFI_STATE_STATUS
;
291 cmdset_intel_read (struct hw
*me
, struct cfi
*cfi
, void *dest
,
292 unsigned offset
, unsigned shifted_offset
, unsigned nr_bytes
)
294 unsigned char *sdest
= dest
;
298 case CFI_STATE_STATUS
:
299 case CFI_STATE_ERASE
:
300 *sdest
= cfi
->status
;
303 case CFI_STATE_READ_ID
:
304 switch (shifted_offset
& 0x1ff)
306 case 0x00: /* Manufacturer Code. */
307 cfi_encode_16bit (dest
, INTEL_ID_MANU
);
309 case 0x01: /* Device ID Code. */
310 /* XXX: Push to device tree ? */
311 cfi_encode_16bit (dest
, 0xad);
313 case 0x02: /* Block lock state. */
314 /* XXX: This is per-block ... */
317 case 0x05: /* Read Configuration Register. */
318 cfi_encode_16bit (dest
, (1 << 15));
333 cmdset_intel_setup (struct hw
*me
, struct cfi
*cfi
)
335 cfi
->status
= INTEL_SR_DWS
;
338 static const struct cfi_cmdset cfi_cmdset_intel
=
340 CFI_CMDSET_INTEL
, cmdset_intel_setup
, cmdset_intel_write
, cmdset_intel_read
,
343 /* All of the supported command sets get listed here. We then walk this
344 array to see if the user requested command set is implemented. */
345 static const struct cfi_cmdset
* const cfi_cmdsets
[] =
350 /* All writes to the flash address space come here. Using the state
351 machine, we figure out what to do with this specific write. All
352 common code sits here and if there is a request we can't process,
353 we hand it off to the command set-specific write function. */
355 cfi_io_write_buffer (struct hw
*me
, const void *source
, int space
,
356 address_word addr
, unsigned nr_bytes
)
358 struct cfi
*cfi
= hw_data (me
);
359 const unsigned char *ssource
= source
;
360 enum cfi_state old_state
;
361 unsigned offset
, shifted_offset
, value
;
363 offset
= addr
& (cfi
->dev_size
- 1);
364 shifted_offset
= cfi_unshift_addr (cfi
, offset
);
366 if (cfi
->width
!= nr_bytes
)
368 HW_TRACE ((me
, "write 0x%08lx length %u does not match flash width %u",
369 (unsigned long) addr
, nr_bytes
, cfi
->width
));
373 if (cfi
->state
== CFI_STATE_WRITE
)
375 /* NOR flash can only go from 1 to 0. */
378 HW_TRACE ((me
, "program %#x length %u", offset
, nr_bytes
));
380 for (i
= 0; i
< nr_bytes
; ++i
)
381 cfi
->data
[offset
+ i
] &= ssource
[i
];
383 cfi
->state
= CFI_STATE_STATUS
;
390 old_state
= cfi
->state
;
392 if (value
== CFI_CMD_READ
|| value
== CFI_CMD_RESET
)
394 cfi
->state
= CFI_STATE_READ
;
401 case CFI_STATE_READ_ID
:
402 if (value
== CFI_CMD_CFI_QUERY
)
404 if (shifted_offset
== CFI_ADDR_CFI_QUERY_START
)
405 cfi
->state
= CFI_STATE_CFI_QUERY
;
409 if (value
== CFI_CMD_READ_ID
)
411 cfi
->state
= CFI_STATE_READ_ID
;
418 if (!cfi
->cmdset
->write (me
, cfi
, source
, offset
, value
, nr_bytes
))
419 HW_TRACE ((me
, "unhandled command %#x at %#x", value
, offset
));
424 HW_TRACE ((me
, "write 0x%08lx command {%#x,%#x,%#x,%#x}; state %s -> %s",
425 (unsigned long) addr
, ssource
[0],
426 nr_bytes
> 1 ? ssource
[1] : 0,
427 nr_bytes
> 2 ? ssource
[2] : 0,
428 nr_bytes
> 3 ? ssource
[3] : 0,
429 state_names
[old_state
], state_names
[cfi
->state
]));
434 /* All reads to the flash address space come here. Using the state
435 machine, we figure out what to return -- actual data stored in the
436 flash, the CFI query structure, some status info, or something else ?
437 Any requests that we can't handle are passed to the command set-
438 specific read function. */
440 cfi_io_read_buffer (struct hw
*me
, void *dest
, int space
,
441 address_word addr
, unsigned nr_bytes
)
443 struct cfi
*cfi
= hw_data (me
);
444 unsigned char *sdest
= dest
;
445 unsigned offset
, shifted_offset
;
447 offset
= addr
& (cfi
->dev_size
- 1);
448 shifted_offset
= cfi_unshift_addr (cfi
, offset
);
450 /* XXX: Is this OK to enforce ? */
452 if (cfi
->state
!= CFI_STATE_READ
&& cfi
->width
!= nr_bytes
)
454 HW_TRACE ((me
, "read 0x%08lx length %u does not match flash width %u",
455 (unsigned long) addr
, nr_bytes
, cfi
->width
));
460 HW_TRACE ((me
, "%s read 0x%08lx length %u",
461 state_names
[cfi
->state
], (unsigned long) addr
, nr_bytes
));
466 memcpy (dest
, cfi
->data
+ offset
, nr_bytes
);
469 case CFI_STATE_CFI_QUERY
:
470 if (shifted_offset
>= CFI_ADDR_CFI_QUERY_RESULT
&&
471 shifted_offset
< CFI_ADDR_CFI_QUERY_RESULT
+ sizeof (cfi
->query
) +
472 (cfi
->query
.num_erase_regions
* 4))
476 shifted_offset
-= CFI_ADDR_CFI_QUERY_RESULT
;
477 if (shifted_offset
>= sizeof (cfi
->query
))
479 qry
= cfi
->erase_region_info
;
480 shifted_offset
-= sizeof (cfi
->query
);
483 qry
= (void *) &cfi
->query
;
485 sdest
[0] = qry
[shifted_offset
];
486 memset (sdest
+ 1, 0, nr_bytes
- 1);
492 if (!cfi
->cmdset
->read (me
, cfi
, dest
, offset
, shifted_offset
, nr_bytes
))
493 HW_TRACE ((me
, "unhandled state %s", state_names
[cfi
->state
]));
500 /* Clean up any state when this device is removed (e.g. when shutting
501 down, or when reloading via gdb). */
503 cfi_delete_callback (struct hw
*me
)
506 struct cfi
*cfi
= hw_data (me
);
509 munmap (cfi
->mmap
, cfi
->dev_size
);
513 /* Helper function to easily add CFI erase regions to the existing set. */
515 cfi_add_erase_region (struct hw
*me
, struct cfi
*cfi
,
516 unsigned blocks
, unsigned size
)
518 unsigned num_regions
= cfi
->query
.num_erase_regions
;
519 struct cfi_erase_region
*region
;
520 unsigned char *qry_region
;
522 /* Store for our own usage. */
523 region
= &cfi
->erase_regions
[num_regions
];
524 region
->blocks
= blocks
;
526 if (num_regions
== 0)
529 region
->start
= region
[-1].end
;
530 region
->end
= region
->start
+ (blocks
* size
);
532 /* Regions are 4 bytes long. */
533 qry_region
= cfi
->erase_region_info
+ 4 * num_regions
;
535 /* [0][1] = number erase blocks - 1 */
536 if (blocks
> 0xffff + 1)
537 hw_abort (me
, "erase blocks %u too big to fit into region info", blocks
);
538 cfi_encode_16bit (&qry_region
[0], blocks
- 1);
540 /* [2][3] = block size / 256 bytes */
541 if (size
> 0xffff * 256)
542 hw_abort (me
, "erase size %u too big to fit into region info", size
);
543 cfi_encode_16bit (&qry_region
[2], size
/ 256);
545 /* Yet another region. */
546 cfi
->query
.num_erase_regions
= num_regions
+ 1;
549 /* Device tree options:
552 .../cmdset <primary; integer> [alt; integer]
554 .../size <device size (must be pow of 2)>
556 .../write_size <integer (must be pow of 2)>
557 .../erase_regions <number blocks> <block size> \
558 [<number blocks> <block size> ...]
559 .../voltage <vcc min> <vcc max> <vpp min> <vpp max>
560 .../timeouts <typ unit write> <typ buf write> \
561 <typ block erase> <typ chip erase> \
562 <max unit write> <max buf write> \
563 <max block erase> <max chip erase>
564 .../file <file> [ro|rw]
566 size: <len> from "reg"
568 write_size: 0 (not supported)
569 erase_region: 1 (can only erase whole chip)
570 voltage: 0.0V (for all)
571 timeouts: typ: 1µs, not supported, 1ms, not supported
572 max: 1µs, 1ms, 1ms, not supported
574 TODO: Verify user args are valid (e.g. voltage is 8 bits). */
576 attach_cfi_regs (struct hw
*me
, struct cfi
*cfi
)
578 address_word attach_address
;
580 unsigned attach_size
;
581 reg_property_spec reg
;
586 if (hw_find_property (me
, "reg") == NULL
)
587 hw_abort (me
, "Missing \"reg\" property");
588 if (hw_find_property (me
, "cmdset") == NULL
)
589 hw_abort (me
, "Missing \"cmdset\" property");
591 if (!hw_find_reg_array_property (me
, "reg", 0, ®
))
592 hw_abort (me
, "\"reg\" property must contain three addr/size entries");
594 hw_unit_address_to_attach_address (hw_parent (me
),
596 &attach_space
, &attach_address
, me
);
597 hw_unit_size_to_attach_size (hw_parent (me
), ®
.size
, &attach_size
, me
);
599 hw_attach_address (hw_parent (me
),
600 0, attach_space
, attach_address
, attach_size
, me
);
602 /* Extract the desired flash command set. */
603 ret
= hw_find_integer_array_property (me
, "cmdset", 0, &ival
);
604 if (ret
!= 1 && ret
!= 2)
605 hw_abort (me
, "\"cmdset\" property takes 1 or 2 entries");
606 cfi_encode_16bit (cfi
->query
.p_id
, ival
);
608 for (i
= 0; i
< ARRAY_SIZE (cfi_cmdsets
); ++i
)
609 if (cfi_cmdsets
[i
]->id
== ival
)
610 cfi
->cmdset
= cfi_cmdsets
[i
];
611 if (cfi
->cmdset
== NULL
)
612 hw_abort (me
, "cmdset %u not supported", ival
);
616 hw_find_integer_array_property (me
, "cmdset", 1, &ival
);
617 cfi_encode_16bit (cfi
->query
.a_id
, ival
);
620 /* Extract the desired device size. */
621 if (hw_find_property (me
, "size"))
622 cfi
->dev_size
= hw_find_integer_property (me
, "size");
624 cfi
->dev_size
= attach_size
;
625 cfi
->query
.dev_size
= log2 (cfi
->dev_size
);
627 /* Extract the desired flash width. */
628 if (hw_find_property (me
, "width"))
630 cfi
->width
= hw_find_integer_property (me
, "width");
631 if (cfi
->width
!= 8 && cfi
->width
!= 16 && cfi
->width
!= 32)
632 hw_abort (me
, "\"width\" must be 8 or 16 or 32, not %u", cfi
->width
);
635 /* Default to 8 bit. */
637 /* Turn 8/16/32 into 1/2/4. */
640 /* Extract optional write buffer size. */
641 if (hw_find_property (me
, "write_size"))
643 ival
= hw_find_integer_property (me
, "write_size");
644 cfi_encode_16bit (cfi
->query
.max_buf_write_len
, log2 (ival
));
647 /* Extract optional erase regions. */
648 if (hw_find_property (me
, "erase_regions"))
650 ret
= hw_find_integer_array_property (me
, "erase_regions", 0, &ival
);
652 hw_abort (me
, "\"erase_regions\" must be specified in sets of 2");
654 cfi
->erase_region_info
= HW_NALLOC (me
, unsigned char, ret
/ 2);
655 cfi
->erase_regions
= HW_NALLOC (me
, struct cfi_erase_region
, ret
/ 2);
657 for (i
= 0; i
< ret
; i
+= 2)
659 unsigned blocks
, size
;
661 hw_find_integer_array_property (me
, "erase_regions", i
, &ival
);
664 hw_find_integer_array_property (me
, "erase_regions", i
+ 1, &ival
);
667 cfi_add_erase_region (me
, cfi
, blocks
, size
);
671 /* Extract optional voltages. */
672 if (hw_find_property (me
, "voltage"))
674 unsigned num
= ARRAY_SIZE (cfi
->query
.voltages
);
676 ret
= hw_find_integer_array_property (me
, "voltage", 0, &ival
);
678 hw_abort (me
, "\"voltage\" may have only %u arguments", num
);
680 for (i
= 0; i
< ret
; ++i
)
682 hw_find_integer_array_property (me
, "voltage", i
, &ival
);
683 cfi
->query
.voltages
[i
] = ival
;
687 /* Extract optional timeouts. */
688 if (hw_find_property (me
, "timeout"))
690 unsigned num
= ARRAY_SIZE (cfi
->query
.timeouts
);
692 ret
= hw_find_integer_array_property (me
, "timeout", 0, &ival
);
694 hw_abort (me
, "\"timeout\" may have only %u arguments", num
);
696 for (i
= 0; i
< ret
; ++i
)
698 hw_find_integer_array_property (me
, "timeout", i
, &ival
);
699 cfi
->query
.timeouts
[i
] = ival
;
703 /* Extract optional file. */
706 if (hw_find_property (me
, "file"))
710 ret
= hw_find_string_array_property (me
, "file", 0, &file
);
712 hw_abort (me
, "\"file\" may take only one argument");
715 const char *writable
;
717 hw_find_string_array_property (me
, "file", 1, &writable
);
718 fd_writable
= !strcmp (writable
, "rw");
721 fd
= open (file
, fd_writable
? O_RDWR
: O_RDONLY
);
723 hw_abort (me
, "unable to read file `%s': %s", file
, strerror (errno
));
726 /* Figure out where our initial flash data is coming from. */
727 if (fd
!= -1 && fd_writable
)
730 posix_fallocate (fd
, 0, cfi
->dev_size
);
732 cfi
->mmap
= mmap (NULL
, cfi
->dev_size
,
733 PROT_READ
| (fd_writable
? PROT_WRITE
: 0),
736 if (cfi
->mmap
== MAP_FAILED
)
739 cfi
->data
= cfi
->mmap
;
741 sim_io_eprintf (hw_system (me
),
742 "cfi: sorry, file write support requires mmap()\n");
749 cfi
->data
= HW_NALLOC (me
, unsigned char, cfi
->dev_size
);
753 /* Use stdio to avoid EINTR issues with read(). */
754 FILE *fp
= fdopen (fd
, "r");
757 read_len
= fread (cfi
->data
, 1, cfi
->dev_size
, fp
);
761 /* Don't need to fclose() with fdopen("r"). */
766 memset (cfi
->data
, 0xff, cfi
->dev_size
- read_len
);
772 /* Once we've been declared in the device tree, this is the main
773 entry point. So allocate state, attach memory addresses, and
774 all that fun stuff. */
776 cfi_finish (struct hw
*me
)
780 cfi
= HW_ZALLOC (me
, struct cfi
);
782 set_hw_data (me
, cfi
);
783 set_hw_io_read_buffer (me
, cfi_io_read_buffer
);
784 set_hw_io_write_buffer (me
, cfi_io_write_buffer
);
785 set_hw_delete (me
, cfi_delete_callback
);
787 attach_cfi_regs (me
, cfi
);
789 /* Initialize the CFI. */
790 cfi
->state
= CFI_STATE_READ
;
791 memcpy (cfi
->query
.qry
, "QRY", 3);
792 cfi
->cmdset
->setup (me
, cfi
);
795 /* Every device is required to declare this. */
796 const struct hw_descriptor dv_cfi_descriptor
[] =
798 {"cfi", cfi_finish
,},