1 /* Common Flash Memory Interface (CFI) model.
2 http://www.spansion.com/Support/AppNotes/CFI_Spec_AN_03.pdf
3 http://www.spansion.com/Support/AppNotes/cfi_100_20011201.pdf
5 Copyright (C) 2010-2011 Free Software Foundation, Inc.
6 Contributed by Analog Devices, Inc.
8 This file is part of simulators.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>. */
23 /* TODO: support vendor query tables. */
31 #ifdef HAVE_SYS_MMAN_H
39 /* Flashes are simple state machines, so here we cover all the
40 different states a device might be in at any particular time. */
50 CFI_STATE_WRITE_BUFFER
,
51 CFI_STATE_WRITE_BUFFER_CONFIRM
,
54 /* This is the structure that all CFI conforming devices must provided
55 when asked for it. This allows a single driver to dynamically support
56 different flash geometries without having to hardcode specs.
58 If you want to start mucking about here, you should just grab the
59 CFI spec and review that (see top of this file for URIs). */
62 /* This is always 'Q' 'R' 'Y'. */
64 /* Primary vendor ID. */
65 unsigned char p_id
[2];
66 /* Primary query table address. */
67 unsigned char p_adr
[2];
68 /* Alternate vendor ID. */
69 unsigned char a_id
[2];
70 /* Alternate query table address. */
71 unsigned char a_adr
[2];
75 unsigned char voltages
[4];
78 /* Normal min voltage level. */
79 unsigned char vcc_min
;
80 /* Normal max voltage level. */
81 unsigned char vcc_max
;
82 /* Programming min volage level. */
83 unsigned char vpp_min
;
84 /* Programming max volage level. */
85 unsigned char vpp_max
;
90 /* Operational timeouts. */
91 unsigned char timeouts
[8];
94 /* Typical timeout for writing a single "unit". */
95 unsigned char timeout_typ_unit_write
;
96 /* Typical timeout for writing a single "buffer". */
97 unsigned char timeout_typ_buf_write
;
98 /* Typical timeout for erasing a block. */
99 unsigned char timeout_typ_block_erase
;
100 /* Typical timeout for erasing the chip. */
101 unsigned char timeout_typ_chip_erase
;
102 /* Max timeout for writing a single "unit". */
103 unsigned char timeout_max_unit_write
;
104 /* Max timeout for writing a single "buffer". */
105 unsigned char timeout_max_buf_write
;
106 /* Max timeout for erasing a block. */
107 unsigned char timeout_max_block_erase
;
108 /* Max timeout for erasing the chip. */
109 unsigned char timeout_max_chip_erase
;
112 /* Flash size is 2^dev_size bytes. */
113 unsigned char dev_size
;
114 /* Flash device interface description. */
115 unsigned char iface_desc
[2];
116 /* Max length of a single buffer write is 2^max_buf_write_len bytes. */
117 unsigned char max_buf_write_len
[2];
118 /* Number of erase regions. */
119 unsigned char num_erase_regions
;
120 /* The erase regions would now be an array after this point, but since
121 it is dynamic, we'll provide that from "struct cfi" when requested. */
122 /*unsigned char erase_region_info;*/
125 /* Flashes may have regions with different erase sizes. There is one
126 structure per erase region. */
127 struct cfi_erase_region
137 /* Flashes are accessed via commands -- you write a certain number to
138 a special address to change the flash state and access info other
139 than the data. Diff companies have implemented their own command
140 set. This structure abstracts the different command sets so that
141 we can support multiple ones with just a single sim driver. */
145 void (*setup
) (struct hw
*me
, struct cfi
*cfi
);
146 bool (*write
) (struct hw
*me
, struct cfi
*cfi
, const void *source
,
147 unsigned offset
, unsigned value
, unsigned nr_bytes
);
148 bool (*read
) (struct hw
*me
, struct cfi
*cfi
, void *dest
,
149 unsigned offset
, unsigned shifted_offset
, unsigned nr_bytes
);
152 /* The per-flash state. Much of this comes from the device tree which
153 people declare themselves. See top of attach_cfi_regs() for more
157 unsigned width
, dev_size
, status
;
158 enum cfi_state state
;
159 unsigned char *data
, *mmap
;
161 struct cfi_query query
;
162 const struct cfi_cmdset
*cmdset
;
164 unsigned char *erase_region_info
;
165 struct cfi_erase_region
*erase_regions
;
168 /* Helpful strings which are used with HW_TRACE. */
169 static const char * const state_names
[] =
171 "READ", "READ_ID", "CFI_QUERY", "PROTECT", "STATUS", "ERASE", "WRITE",
172 "WRITE_BUFFER", "WRITE_BUFFER_CONFIRM",
175 /* Erase the block specified by the offset into the given CFI flash. */
177 cfi_erase_block (struct hw
*me
, struct cfi
*cfi
, unsigned offset
)
180 struct cfi_erase_region
*region
;
182 /* If no erase regions, then we can only do whole chip erase. */
183 /* XXX: Is this within spec ? Or must there always be at least one ? */
184 if (!cfi
->query
.num_erase_regions
)
185 memset (cfi
->data
, 0xff, cfi
->dev_size
);
187 for (i
= 0; i
< cfi
->query
.num_erase_regions
; ++i
)
189 region
= &cfi
->erase_regions
[i
];
191 if (offset
>= region
->end
)
194 /* XXX: Does spec require the erase addr to be erase block aligned ?
195 Maybe this is check is overly cautious ... */
196 offset
&= ~(region
->size
- 1);
197 memset (cfi
->data
+ offset
, 0xff, region
->size
);
202 /* Depending on the bus width, addresses might be bit shifted. This
203 helps us normalize everything without cluttering up the rest of
206 cfi_unshift_addr (struct cfi
*cfi
, unsigned addr
)
210 case 4: addr
>>= 1; /* fallthrough. */
216 /* CFI requires all values to be little endian in its structure, so
217 this helper writes a 16bit value into a little endian byte buffer. */
219 cfi_encode_16bit (unsigned char *data
, unsigned num
)
225 /* The functions required to implement the Intel command set. */
228 cmdset_intel_write (struct hw
*me
, struct cfi
*cfi
, const void *source
,
229 unsigned offset
, unsigned value
, unsigned nr_bytes
)
234 case CFI_STATE_READ_ID
:
237 case INTEL_CMD_ERASE_BLOCK
:
238 cfi
->state
= CFI_STATE_ERASE
;
240 case INTEL_CMD_WRITE
:
241 case INTEL_CMD_WRITE_ALT
:
242 cfi
->state
= CFI_STATE_WRITE
;
244 case INTEL_CMD_STATUS_CLEAR
:
245 cfi
->status
= INTEL_SR_DWS
;
247 case INTEL_CMD_LOCK_SETUP
:
248 cfi
->state
= CFI_STATE_PROTECT
;
255 case CFI_STATE_ERASE
:
256 if (value
== INTEL_CMD_ERASE_CONFIRM
)
258 cfi_erase_block (me
, cfi
, offset
);
259 cfi
->status
&= ~(INTEL_SR_PS
| INTEL_SR_ES
);
262 cfi
->status
|= INTEL_SR_PS
| INTEL_SR_ES
;
263 cfi
->state
= CFI_STATE_STATUS
;
266 case CFI_STATE_PROTECT
:
269 case INTEL_CMD_LOCK_BLOCK
:
270 case INTEL_CMD_UNLOCK_BLOCK
:
271 case INTEL_CMD_LOCK_DOWN_BLOCK
:
272 /* XXX: Handle the command. */
276 cfi
->status
|= INTEL_SR_PS
| INTEL_SR_ES
;
279 cfi
->state
= CFI_STATE_STATUS
;
290 cmdset_intel_read (struct hw
*me
, struct cfi
*cfi
, void *dest
,
291 unsigned offset
, unsigned shifted_offset
, unsigned nr_bytes
)
293 unsigned char *sdest
= dest
;
297 case CFI_STATE_STATUS
:
298 case CFI_STATE_ERASE
:
299 *sdest
= cfi
->status
;
302 case CFI_STATE_READ_ID
:
303 switch (shifted_offset
& 0x1ff)
305 case 0x00: /* Manufacturer Code. */
306 cfi_encode_16bit (dest
, INTEL_ID_MANU
);
308 case 0x01: /* Device ID Code. */
309 /* XXX: Push to device tree ? */
310 cfi_encode_16bit (dest
, 0xad);
312 case 0x02: /* Block lock state. */
313 /* XXX: This is per-block ... */
316 case 0x05: /* Read Configuration Register. */
317 cfi_encode_16bit (dest
, (1 << 15));
332 cmdset_intel_setup (struct hw
*me
, struct cfi
*cfi
)
334 cfi
->status
= INTEL_SR_DWS
;
337 static const struct cfi_cmdset cfi_cmdset_intel
=
339 CFI_CMDSET_INTEL
, cmdset_intel_setup
, cmdset_intel_write
, cmdset_intel_read
,
342 /* All of the supported command sets get listed here. We then walk this
343 array to see if the user requested command set is implemented. */
344 static const struct cfi_cmdset
* const cfi_cmdsets
[] =
349 /* All writes to the flash address space come here. Using the state
350 machine, we figure out what to do with this specific write. All
351 common code sits here and if there is a request we can't process,
352 we hand it off to the command set-specific write function. */
354 cfi_io_write_buffer (struct hw
*me
, const void *source
, int space
,
355 address_word addr
, unsigned nr_bytes
)
357 struct cfi
*cfi
= hw_data (me
);
358 const unsigned char *ssource
= source
;
359 enum cfi_state old_state
;
360 unsigned offset
, shifted_offset
, value
;
362 offset
= addr
& (cfi
->dev_size
- 1);
363 shifted_offset
= cfi_unshift_addr (cfi
, offset
);
365 if (cfi
->width
!= nr_bytes
)
367 HW_TRACE ((me
, "write 0x%08lx length %u does not match flash width %u",
368 (unsigned long) addr
, nr_bytes
, cfi
->width
));
372 if (cfi
->state
== CFI_STATE_WRITE
)
374 /* NOR flash can only go from 1 to 0. */
377 HW_TRACE ((me
, "program %#x length %u", offset
, nr_bytes
));
379 for (i
= 0; i
< nr_bytes
; ++i
)
380 cfi
->data
[offset
+ i
] &= ssource
[i
];
382 cfi
->state
= CFI_STATE_STATUS
;
389 old_state
= cfi
->state
;
391 if (value
== CFI_CMD_READ
|| value
== CFI_CMD_RESET
)
393 cfi
->state
= CFI_STATE_READ
;
400 case CFI_STATE_READ_ID
:
401 if (value
== CFI_CMD_CFI_QUERY
)
403 if (shifted_offset
== CFI_ADDR_CFI_QUERY_START
)
404 cfi
->state
= CFI_STATE_CFI_QUERY
;
408 if (value
== CFI_CMD_READ_ID
)
410 cfi
->state
= CFI_STATE_READ_ID
;
417 if (!cfi
->cmdset
->write (me
, cfi
, source
, offset
, value
, nr_bytes
))
418 HW_TRACE ((me
, "unhandled command %#x at %#x", value
, offset
));
423 HW_TRACE ((me
, "write 0x%08lx command {%#x,%#x,%#x,%#x}; state %s -> %s",
424 (unsigned long) addr
, ssource
[0],
425 nr_bytes
> 1 ? ssource
[1] : 0,
426 nr_bytes
> 2 ? ssource
[2] : 0,
427 nr_bytes
> 3 ? ssource
[3] : 0,
428 state_names
[old_state
], state_names
[cfi
->state
]));
433 /* All reads to the flash address space come here. Using the state
434 machine, we figure out what to return -- actual data stored in the
435 flash, the CFI query structure, some status info, or something else ?
436 Any requests that we can't handle are passed to the command set-
437 specific read function. */
439 cfi_io_read_buffer (struct hw
*me
, void *dest
, int space
,
440 address_word addr
, unsigned nr_bytes
)
442 struct cfi
*cfi
= hw_data (me
);
443 unsigned char *sdest
= dest
;
444 unsigned offset
, shifted_offset
;
446 offset
= addr
& (cfi
->dev_size
- 1);
447 shifted_offset
= cfi_unshift_addr (cfi
, offset
);
449 /* XXX: Is this OK to enforce ? */
451 if (cfi
->state
!= CFI_STATE_READ
&& cfi
->width
!= nr_bytes
)
453 HW_TRACE ((me
, "read 0x%08lx length %u does not match flash width %u",
454 (unsigned long) addr
, nr_bytes
, cfi
->width
));
459 HW_TRACE ((me
, "%s read 0x%08lx length %u",
460 state_names
[cfi
->state
], (unsigned long) addr
, nr_bytes
));
465 memcpy (dest
, cfi
->data
+ offset
, nr_bytes
);
468 case CFI_STATE_CFI_QUERY
:
469 if (shifted_offset
>= CFI_ADDR_CFI_QUERY_RESULT
&&
470 shifted_offset
< CFI_ADDR_CFI_QUERY_RESULT
+ sizeof (cfi
->query
) +
471 (cfi
->query
.num_erase_regions
* 4))
475 shifted_offset
-= CFI_ADDR_CFI_QUERY_RESULT
;
476 if (shifted_offset
>= sizeof (cfi
->query
))
478 qry
= cfi
->erase_region_info
;
479 shifted_offset
-= sizeof (cfi
->query
);
482 qry
= (void *) &cfi
->query
;
484 sdest
[0] = qry
[shifted_offset
];
485 memset (sdest
+ 1, 0, nr_bytes
- 1);
491 if (!cfi
->cmdset
->read (me
, cfi
, dest
, offset
, shifted_offset
, nr_bytes
))
492 HW_TRACE ((me
, "unhandled state %s", state_names
[cfi
->state
]));
499 /* Clean up any state when this device is removed (e.g. when shutting
500 down, or when reloading via gdb). */
502 cfi_delete_callback (struct hw
*me
)
505 struct cfi
*cfi
= hw_data (me
);
508 munmap (cfi
->mmap
, cfi
->dev_size
);
512 /* Helper function to easily add CFI erase regions to the existing set. */
514 cfi_add_erase_region (struct hw
*me
, struct cfi
*cfi
,
515 unsigned blocks
, unsigned size
)
517 unsigned num_regions
= cfi
->query
.num_erase_regions
;
518 struct cfi_erase_region
*region
;
519 unsigned char *qry_region
;
521 /* Store for our own usage. */
522 region
= &cfi
->erase_regions
[num_regions
];
523 region
->blocks
= blocks
;
525 if (num_regions
== 0)
528 region
->start
= region
[-1].end
;
529 region
->end
= region
->start
+ (blocks
* size
);
531 /* Regions are 4 bytes long. */
532 qry_region
= cfi
->erase_region_info
+ 4 * num_regions
;
534 /* [0][1] = number erase blocks - 1 */
535 if (blocks
> 0xffff + 1)
536 hw_abort (me
, "erase blocks %u too big to fit into region info", blocks
);
537 cfi_encode_16bit (&qry_region
[0], blocks
- 1);
539 /* [2][3] = block size / 256 bytes */
540 if (size
> 0xffff * 256)
541 hw_abort (me
, "erase size %u too big to fit into region info", size
);
542 cfi_encode_16bit (&qry_region
[2], size
/ 256);
544 /* Yet another region. */
545 cfi
->query
.num_erase_regions
= num_regions
+ 1;
548 /* Device tree options:
551 .../cmdset <primary; integer> [alt; integer]
553 .../size <device size (must be pow of 2)>
555 .../write_size <integer (must be pow of 2)>
556 .../erase_regions <number blocks> <block size> \
557 [<number blocks> <block size> ...]
558 .../voltage <vcc min> <vcc max> <vpp min> <vpp max>
559 .../timeouts <typ unit write> <typ buf write> \
560 <typ block erase> <typ chip erase> \
561 <max unit write> <max buf write> \
562 <max block erase> <max chip erase>
563 .../file <file> [ro|rw]
565 size: <len> from "reg"
567 write_size: 0 (not supported)
568 erase_region: 1 (can only erase whole chip)
569 voltage: 0.0V (for all)
570 timeouts: typ: 1µs, not supported, 1ms, not supported
571 max: 1µs, 1ms, 1ms, not supported
573 TODO: Verify user args are valid (e.g. voltage is 8 bits). */
575 attach_cfi_regs (struct hw
*me
, struct cfi
*cfi
)
577 address_word attach_address
;
579 unsigned attach_size
;
580 reg_property_spec reg
;
585 if (hw_find_property (me
, "reg") == NULL
)
586 hw_abort (me
, "Missing \"reg\" property");
587 if (hw_find_property (me
, "cmdset") == NULL
)
588 hw_abort (me
, "Missing \"cmdset\" property");
590 if (!hw_find_reg_array_property (me
, "reg", 0, ®
))
591 hw_abort (me
, "\"reg\" property must contain three addr/size entries");
593 hw_unit_address_to_attach_address (hw_parent (me
),
595 &attach_space
, &attach_address
, me
);
596 hw_unit_size_to_attach_size (hw_parent (me
), ®
.size
, &attach_size
, me
);
598 hw_attach_address (hw_parent (me
),
599 0, attach_space
, attach_address
, attach_size
, me
);
601 /* Extract the desired flash command set. */
602 ret
= hw_find_integer_array_property (me
, "cmdset", 0, &ival
);
603 if (ret
!= 1 && ret
!= 2)
604 hw_abort (me
, "\"cmdset\" property takes 1 or 2 entries");
605 cfi_encode_16bit (cfi
->query
.p_id
, ival
);
607 for (i
= 0; i
< ARRAY_SIZE (cfi_cmdsets
); ++i
)
608 if (cfi_cmdsets
[i
]->id
== ival
)
609 cfi
->cmdset
= cfi_cmdsets
[i
];
610 if (cfi
->cmdset
== NULL
)
611 hw_abort (me
, "cmdset %u not supported", ival
);
615 hw_find_integer_array_property (me
, "cmdset", 1, &ival
);
616 cfi_encode_16bit (cfi
->query
.a_id
, ival
);
619 /* Extract the desired device size. */
620 if (hw_find_property (me
, "size"))
621 cfi
->dev_size
= hw_find_integer_property (me
, "size");
623 cfi
->dev_size
= attach_size
;
624 cfi
->query
.dev_size
= log2 (cfi
->dev_size
);
626 /* Extract the desired flash width. */
627 if (hw_find_property (me
, "width"))
629 cfi
->width
= hw_find_integer_property (me
, "width");
630 if (cfi
->width
!= 8 && cfi
->width
!= 16 && cfi
->width
!= 32)
631 hw_abort (me
, "\"width\" must be 8 or 16 or 32, not %u", cfi
->width
);
634 /* Default to 8 bit. */
636 /* Turn 8/16/32 into 1/2/4. */
639 /* Extract optional write buffer size. */
640 if (hw_find_property (me
, "write_size"))
642 ival
= hw_find_integer_property (me
, "write_size");
643 cfi_encode_16bit (cfi
->query
.max_buf_write_len
, log2 (ival
));
646 /* Extract optional erase regions. */
647 if (hw_find_property (me
, "erase_regions"))
649 ret
= hw_find_integer_array_property (me
, "erase_regions", 0, &ival
);
651 hw_abort (me
, "\"erase_regions\" must be specified in sets of 2");
653 cfi
->erase_region_info
= HW_NALLOC (me
, unsigned char, ret
/ 2);
654 cfi
->erase_regions
= HW_NALLOC (me
, struct cfi_erase_region
, ret
/ 2);
656 for (i
= 0; i
< ret
; i
+= 2)
658 unsigned blocks
, size
;
660 hw_find_integer_array_property (me
, "erase_regions", i
, &ival
);
663 hw_find_integer_array_property (me
, "erase_regions", i
+ 1, &ival
);
666 cfi_add_erase_region (me
, cfi
, blocks
, size
);
670 /* Extract optional voltages. */
671 if (hw_find_property (me
, "voltage"))
673 unsigned num
= ARRAY_SIZE (cfi
->query
.voltages
);
675 ret
= hw_find_integer_array_property (me
, "voltage", 0, &ival
);
677 hw_abort (me
, "\"voltage\" may have only %u arguments", num
);
679 for (i
= 0; i
< ret
; ++i
)
681 hw_find_integer_array_property (me
, "voltage", i
, &ival
);
682 cfi
->query
.voltages
[i
] = ival
;
686 /* Extract optional timeouts. */
687 if (hw_find_property (me
, "timeout"))
689 unsigned num
= ARRAY_SIZE (cfi
->query
.timeouts
);
691 ret
= hw_find_integer_array_property (me
, "timeout", 0, &ival
);
693 hw_abort (me
, "\"timeout\" may have only %u arguments", num
);
695 for (i
= 0; i
< ret
; ++i
)
697 hw_find_integer_array_property (me
, "timeout", i
, &ival
);
698 cfi
->query
.timeouts
[i
] = ival
;
702 /* Extract optional file. */
705 if (hw_find_property (me
, "file"))
709 ret
= hw_find_string_array_property (me
, "file", 0, &file
);
711 hw_abort (me
, "\"file\" may take only one argument");
714 const char *writable
;
716 hw_find_string_array_property (me
, "file", 1, &writable
);
717 fd_writable
= !strcmp (writable
, "rw");
720 fd
= open (file
, fd_writable
? O_RDWR
: O_RDONLY
);
722 hw_abort (me
, "unable to read file `%s': %s", file
, strerror (errno
));
725 /* Figure out where our initial flash data is coming from. */
726 if (fd
!= -1 && fd_writable
)
729 posix_fallocate (fd
, 0, cfi
->dev_size
);
731 cfi
->mmap
= mmap (NULL
, cfi
->dev_size
,
732 PROT_READ
| (fd_writable
? PROT_WRITE
: 0),
735 if (cfi
->mmap
== MAP_FAILED
)
738 cfi
->data
= cfi
->mmap
;
740 sim_io_eprintf (hw_system (me
),
741 "cfi: sorry, file write support requires mmap()\n");
748 cfi
->data
= HW_NALLOC (me
, unsigned char, cfi
->dev_size
);
752 /* Use stdio to avoid EINTR issues with read(). */
753 FILE *fp
= fdopen (fd
, "r");
756 read_len
= fread (cfi
->data
, 1, cfi
->dev_size
, fp
);
760 /* Don't need to fclose() with fdopen("r"). */
765 memset (cfi
->data
, 0xff, cfi
->dev_size
- read_len
);
771 /* Once we've been declared in the device tree, this is the main
772 entry point. So allocate state, attach memory addresses, and
773 all that fun stuff. */
775 cfi_finish (struct hw
*me
)
779 cfi
= HW_ZALLOC (me
, struct cfi
);
781 set_hw_data (me
, cfi
);
782 set_hw_io_read_buffer (me
, cfi_io_read_buffer
);
783 set_hw_io_write_buffer (me
, cfi_io_write_buffer
);
784 set_hw_delete (me
, cfi_delete_callback
);
786 attach_cfi_regs (me
, cfi
);
788 /* Initialize the CFI. */
789 cfi
->state
= CFI_STATE_READ
;
790 memcpy (cfi
->query
.qry
, "QRY", 3);
791 cfi
->cmdset
->setup (me
, cfi
);
794 /* Every device is required to declare this. */
795 const struct hw_descriptor dv_cfi_descriptor
[] =
797 {"cfi", cfi_finish
,},