qemu/hw/onenand.c

   1 /*
   2  * OneNAND flash memories emulation.
   3  *
   4  * Copyright (C) 2008 Nokia Corporation
   5  * Written by Andrzej Zaborowski <andrew@openedhand.com>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation; either version 2 or
  10  * (at your option) version 3 of the License.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "qemu-common.h"
  23 #include "flash.h"
  24 #include "irq.h"
  25 #include "sysemu.h"
  26 #include "block.h"
  27
  28 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
  29 #define PAGE_SHIFT      11
  30
  31 /* Fixed */
  32 #define BLOCK_SHIFT     (PAGE_SHIFT + 6)
  33
  34 struct onenand_s {
  35     uint32_t id;
  36     int shift;
  37     target_phys_addr_t base;
  38     qemu_irq intr;
  39     qemu_irq rdy;
  40     BlockDriverState *bdrv;
  41     BlockDriverState *bdrv_cur;
  42     uint8_t *image;
  43     uint8_t *otp;
  44     uint8_t *current;
  45     ram_addr_t ram;
  46     uint8_t *boot[2];
  47     uint8_t *data[2][2];
  48     int iomemtype;
  49     int cycle;
  50     int otpmode;
  51
  52     uint16_t addr[8];
  53     uint16_t unladdr[8];
  54     int bufaddr;
  55     int count;
  56     uint16_t command;
  57     uint16_t config[2];
  58     uint16_t status;
  59     uint16_t intstatus;
  60     uint16_t wpstatus;
  61
  62     struct ecc_state_s ecc;
  63
  64     int density_mask;
  65     int secs;
  66     int secs_cur;
  67     int blocks;
  68     uint8_t *blockwp;
  69 };
  70
  71 enum {
  72     ONEN_BUF_BLOCK = 0,
  73     ONEN_BUF_BLOCK2 = 1,
  74     ONEN_BUF_DEST_BLOCK = 2,
  75     ONEN_BUF_DEST_PAGE = 3,
  76     ONEN_BUF_PAGE = 7,
  77 };
  78
  79 enum {
  80     ONEN_ERR_CMD = 1 << 10,
  81     ONEN_ERR_ERASE = 1 << 11,
  82     ONEN_ERR_PROG = 1 << 12,
  83     ONEN_ERR_LOAD = 1 << 13,
  84 };
  85
  86 enum {
  87     ONEN_INT_RESET = 1 << 4,
  88     ONEN_INT_ERASE = 1 << 5,
  89     ONEN_INT_PROG = 1 << 6,
  90     ONEN_INT_LOAD = 1 << 7,
  91     ONEN_INT = 1 << 15,
  92 };
  93
  94 enum {
  95     ONEN_LOCK_LOCKTIGHTEN = 1 << 0,
  96     ONEN_LOCK_LOCKED = 1 << 1,
  97     ONEN_LOCK_UNLOCKED = 1 << 2,
  98 };
  99
 100 void onenand_base_update(void *opaque, target_phys_addr_t new)
 101 {
 102     struct onenand_s *s = (struct onenand_s *) opaque;
 103
 104     s->base = new;
 105
 106     /* XXX: We should use IO_MEM_ROMD but we broke it earlier...
 107      * Both 0x0000 ... 0x01ff and 0x8000 ... 0x800f can be used to
 108      * write boot commands.  Also take note of the BWPS bit.  */
 109     cpu_register_physical_memory(s->base + (0x0000 << s->shift),
 110                     0x0200 << s->shift, s->iomemtype);
 111     cpu_register_physical_memory(s->base + (0x0200 << s->shift),
 112                     0xbe00 << s->shift,
 113                     (s->ram +(0x0200 << s->shift)) | IO_MEM_RAM);
 114     if (s->iomemtype)
 115         cpu_register_physical_memory_offset(s->base + (0xc000 << s->shift),
 116                     0x4000 << s->shift, s->iomemtype, (0xc000 << s->shift));
 117 }
 118
 119 void onenand_base_unmap(void *opaque)
 120 {
 121     struct onenand_s *s = (struct onenand_s *) opaque;
 122
 123     cpu_register_physical_memory(s->base,
 124                     0x10000 << s->shift, IO_MEM_UNASSIGNED);
 125 }
 126
 127 static void onenand_intr_update(struct onenand_s *s)
 128 {
 129     qemu_set_irq(s->intr, ((s->intstatus >> 15) ^ (~s->config[0] >> 6)) & 1);
 130 }
 131
 132 /* Hot reset (Reset OneNAND command) or warm reset (RP pin low) */
 133 static void onenand_reset(struct onenand_s *s, int cold)
 134 {
 135     memset(&s->addr, 0, sizeof(s->addr));
 136     s->command = 0;
 137     s->count = 1;
 138     s->bufaddr = 0;
 139     s->config[0] = 0x40c0;
 140     s->config[1] = 0x0000;
 141     onenand_intr_update(s);
 142     qemu_irq_raise(s->rdy);
 143     s->status = 0x0000;
 144     s->intstatus = cold ? 0x8080 : 0x8010;
 145     s->unladdr[0] = 0;
 146     s->unladdr[1] = 0;
 147     s->wpstatus = 0x0002;
 148     s->cycle = 0;
 149     s->otpmode = 0;
 150     s->bdrv_cur = s->bdrv;
 151     s->current = s->image;
 152     s->secs_cur = s->secs;
 153
 154     if (cold) {
 155         /* Lock the whole flash */
 156         memset(s->blockwp, ONEN_LOCK_LOCKED, s->blocks);
 157
 158         if (s->bdrv && bdrv_read(s->bdrv, 0, s->boot[0], 8) < 0)
 159             cpu_abort(cpu_single_env, "%s: Loading the BootRAM failed.\n",
 160                             __FUNCTION__);
 161     }
 162 }
 163
 164 static inline int onenand_load_main(struct onenand_s *s, int sec, int secn,
 165                 void *dest)
 166 {
 167     if (s->bdrv_cur)
 168         return bdrv_read(s->bdrv_cur, sec, dest, secn) < 0;
 169     else if (sec + secn > s->secs_cur)
 170         return 1;
 171
 172     memcpy(dest, s->current + (sec << 9), secn << 9);
 173
 174     return 0;
 175 }
 176
 177 static inline int onenand_prog_main(struct onenand_s *s, int sec, int secn,
 178                 void *src)
 179 {
 180     if (s->bdrv_cur)
 181         return bdrv_write(s->bdrv_cur, sec, src, secn) < 0;
 182     else if (sec + secn > s->secs_cur)
 183         return 1;
 184
 185     memcpy(s->current + (sec << 9), src, secn << 9);
 186
 187     return 0;
 188 }
 189
 190 static inline int onenand_load_spare(struct onenand_s *s, int sec, int secn,
 191                 void *dest)
 192 {
 193     uint8_t buf[512];
 194
 195     if (s->bdrv_cur) {
 196         if (bdrv_read(s->bdrv_cur, s->secs_cur + (sec >> 5), buf, 1) < 0)
 197             return 1;
 198         memcpy(dest, buf + ((sec & 31) << 4), secn << 4);
 199     } else if (sec + secn > s->secs_cur)
 200         return 1;
 201     else
 202         memcpy(dest, s->current + (s->secs_cur << 9) + (sec << 4), secn << 4);
 203
 204     return 0;
 205 }
 206
 207 static inline int onenand_prog_spare(struct onenand_s *s, int sec, int secn,
 208                 void *src)
 209 {
 210     uint8_t buf[512];
 211
 212     if (s->bdrv_cur) {
 213         if (bdrv_read(s->bdrv_cur, s->secs_cur + (sec >> 5), buf, 1) < 0)
 214             return 1;
 215         memcpy(buf + ((sec & 31) << 4), src, secn << 4);
 216         return bdrv_write(s->bdrv_cur, s->secs_cur + (sec >> 5), buf, 1) < 0;
 217     } else if (sec + secn > s->secs_cur)
 218         return 1;
 219
 220     memcpy(s->current + (s->secs_cur << 9) + (sec << 4), src, secn << 4);
 221
 222     return 0;
 223 }
 224
 225 static inline int onenand_erase(struct onenand_s *s, int sec, int num)
 226 {
 227     /* TODO: optimise */
 228     uint8_t buf[512];
 229
 230     memset(buf, 0xff, sizeof(buf));
 231     for (; num > 0; num --, sec ++) {
 232         if (onenand_prog_main(s, sec, 1, buf))
 233             return 1;
 234         if (onenand_prog_spare(s, sec, 1, buf))
 235             return 1;
 236     }
 237
 238     return 0;
 239 }
 240
 241 static void onenand_command(struct onenand_s *s, int cmd)
 242 {
 243     int b;
 244     int sec;
 245     void *buf;
 246 #define SETADDR(block, page)                    \
 247     sec = (s->addr[page] & 3) +                 \
 248             ((((s->addr[page] >> 2) & 0x3f) +   \
 249               (((s->addr[block] & 0xfff) |      \
 250                 (s->addr[block] >> 15 ?         \
 251                  s->density_mask : 0)) << 6)) << (PAGE_SHIFT - 9));
 252 #define SETBUF_M()                              \
 253     buf = (s->bufaddr & 8) ?                    \
 254             s->data[(s->bufaddr >> 2) & 1][0] : s->boot[0];     \
 255     buf += (s->bufaddr & 3) << 9;
 256 #define SETBUF_S()                              \
 257     buf = (s->bufaddr & 8) ?                    \
 258             s->data[(s->bufaddr >> 2) & 1][1] : s->boot[1];     \
 259     buf += (s->bufaddr & 3) << 4;
 260
 261     switch (cmd) {
 262     case 0x00:  /* Load single/multiple sector data unit into buffer */
 263         SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 264
 265         SETBUF_M()
 266         if (onenand_load_main(s, sec, s->count, buf))
 267             s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
 268
 269 #if 0
 270         SETBUF_S()
 271         if (onenand_load_spare(s, sec, s->count, buf))
 272             s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
 273 #endif
 274
 275         /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
 276          * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
 277          * then we need two split the read/write into two chunks.
 278          */
 279         s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
 280         break;
 281     case 0x13:  /* Load single/multiple spare sector into buffer */
 282         SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 283
 284         SETBUF_S()
 285         if (onenand_load_spare(s, sec, s->count, buf))
 286             s->status |= ONEN_ERR_CMD | ONEN_ERR_LOAD;
 287
 288         /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
 289          * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
 290          * then we need two split the read/write into two chunks.
 291          */
 292         s->intstatus |= ONEN_INT | ONEN_INT_LOAD;
 293         break;
 294     case 0x80:  /* Program single/multiple sector data unit from buffer */
 295         SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 296
 297         SETBUF_M()
 298         if (onenand_prog_main(s, sec, s->count, buf))
 299             s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
 300
 301 #if 0
 302         SETBUF_S()
 303         if (onenand_prog_spare(s, sec, s->count, buf))
 304             s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
 305 #endif
 306
 307         /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
 308          * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
 309          * then we need two split the read/write into two chunks.
 310          */
 311         s->intstatus |= ONEN_INT | ONEN_INT_PROG;
 312         break;
 313     case 0x1a:  /* Program single/multiple spare area sector from buffer */
 314         SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 315
 316         SETBUF_S()
 317         if (onenand_prog_spare(s, sec, s->count, buf))
 318             s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
 319
 320         /* TODO: if (s->bufaddr & 3) + s->count was > 4 (2k-pages)
 321          * or    if (s->bufaddr & 1) + s->count was > 2 (1k-pages)
 322          * then we need two split the read/write into two chunks.
 323          */
 324         s->intstatus |= ONEN_INT | ONEN_INT_PROG;
 325         break;
 326     case 0x1b:  /* Copy-back program */
 327         SETBUF_S()
 328
 329         SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 330         if (onenand_load_main(s, sec, s->count, buf))
 331             s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
 332
 333         SETADDR(ONEN_BUF_DEST_BLOCK, ONEN_BUF_DEST_PAGE)
 334         if (onenand_prog_main(s, sec, s->count, buf))
 335             s->status |= ONEN_ERR_CMD | ONEN_ERR_PROG;
 336
 337         /* TODO: spare areas */
 338
 339         s->intstatus |= ONEN_INT | ONEN_INT_PROG;
 340         break;
 341
 342     case 0x23:  /* Unlock NAND array block(s) */
 343         s->intstatus |= ONEN_INT;
 344
 345         /* XXX the previous (?) area should be locked automatically */
 346         for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
 347             if (b >= s->blocks) {
 348                 s->status |= ONEN_ERR_CMD;
 349                 break;
 350             }
 351             if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
 352                 break;
 353
 354             s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
 355         }
 356         break;
 357     case 0x27:  /* Unlock All NAND array blocks */
 358         s->intstatus |= ONEN_INT;
 359
 360         for (b = 0; b < s->blocks; b ++) {
 361             if (b >= s->blocks) {
 362                 s->status |= ONEN_ERR_CMD;
 363                 break;
 364             }
 365             if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
 366                 break;
 367
 368             s->wpstatus = s->blockwp[b] = ONEN_LOCK_UNLOCKED;
 369         }
 370         break;
 371
 372     case 0x2a:  /* Lock NAND array block(s) */
 373         s->intstatus |= ONEN_INT;
 374
 375         for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
 376             if (b >= s->blocks) {
 377                 s->status |= ONEN_ERR_CMD;
 378                 break;
 379             }
 380             if (s->blockwp[b] == ONEN_LOCK_LOCKTIGHTEN)
 381                 break;
 382
 383             s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKED;
 384         }
 385         break;
 386     case 0x2c:  /* Lock-tight NAND array block(s) */
 387         s->intstatus |= ONEN_INT;
 388
 389         for (b = s->unladdr[0]; b <= s->unladdr[1]; b ++) {
 390             if (b >= s->blocks) {
 391                 s->status |= ONEN_ERR_CMD;
 392                 break;
 393             }
 394             if (s->blockwp[b] == ONEN_LOCK_UNLOCKED)
 395                 continue;
 396
 397             s->wpstatus = s->blockwp[b] = ONEN_LOCK_LOCKTIGHTEN;
 398         }
 399         break;
 400
 401     case 0x71:  /* Erase-Verify-Read */
 402         s->intstatus |= ONEN_INT;
 403         break;
 404     case 0x95:  /* Multi-block erase */
 405         qemu_irq_pulse(s->intr);
 406         /* Fall through.  */
 407     case 0x94:  /* Block erase */
 408         sec = ((s->addr[ONEN_BUF_BLOCK] & 0xfff) |
 409                         (s->addr[ONEN_BUF_BLOCK] >> 15 ? s->density_mask : 0))
 410                 << (BLOCK_SHIFT - 9);
 411         if (onenand_erase(s, sec, 1 << (BLOCK_SHIFT - 9)))
 412             s->status |= ONEN_ERR_CMD | ONEN_ERR_ERASE;
 413
 414         s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
 415         break;
 416     case 0xb0:  /* Erase suspend */
 417         break;
 418     case 0x30:  /* Erase resume */
 419         s->intstatus |= ONEN_INT | ONEN_INT_ERASE;
 420         break;
 421
 422     case 0xf0:  /* Reset NAND Flash core */
 423         onenand_reset(s, 0);
 424         break;
 425     case 0xf3:  /* Reset OneNAND */
 426         onenand_reset(s, 0);
 427         break;
 428
 429     case 0x65:  /* OTP Access */
 430         s->intstatus |= ONEN_INT;
 431         s->bdrv_cur = 0;
 432         s->current = s->otp;
 433         s->secs_cur = 1 << (BLOCK_SHIFT - 9);
 434         s->addr[ONEN_BUF_BLOCK] = 0;
 435         s->otpmode = 1;
 436         break;
 437
 438     default:
 439         s->status |= ONEN_ERR_CMD;
 440         s->intstatus |= ONEN_INT;
 441         fprintf(stderr, "%s: unknown OneNAND command %x\n",
 442                         __FUNCTION__, cmd);
 443     }
 444
 445     onenand_intr_update(s);
 446 }
 447
 448 static uint32_t onenand_read(void *opaque, target_phys_addr_t addr)
 449 {
 450     struct onenand_s *s = (struct onenand_s *) opaque;
 451     int offset = addr >> s->shift;
 452
 453     switch (offset) {
 454     case 0x0000 ... 0xc000:
 455         return lduw_le_p(s->boot[0] + addr);
 456
 457     case 0xf000:        /* Manufacturer ID */
 458         return (s->id >> 16) & 0xff;
 459     case 0xf001:        /* Device ID */
 460         return (s->id >>  8) & 0xff;
 461     /* TODO: get the following values from a real chip!  */
 462     case 0xf002:        /* Version ID */
 463         return (s->id >>  0) & 0xff;
 464     case 0xf003:        /* Data Buffer size */
 465         return 1 << PAGE_SHIFT;
 466     case 0xf004:        /* Boot Buffer size */
 467         return 0x200;
 468     case 0xf005:        /* Amount of buffers */
 469         return 1 | (2 << 8);
 470     case 0xf006:        /* Technology */
 471         return 0;
 472
 473     case 0xf100 ... 0xf107:     /* Start addresses */
 474         return s->addr[offset - 0xf100];
 475
 476     case 0xf200:        /* Start buffer */
 477         return (s->bufaddr << 8) | ((s->count - 1) & (1 << (PAGE_SHIFT - 10)));
 478
 479     case 0xf220:        /* Command */
 480         return s->command;
 481     case 0xf221:        /* System Configuration 1 */
 482         return s->config[0] & 0xffe0;
 483     case 0xf222:        /* System Configuration 2 */
 484         return s->config[1];
 485
 486     case 0xf240:        /* Controller Status */
 487         return s->status;
 488     case 0xf241:        /* Interrupt */
 489         return s->intstatus;
 490     case 0xf24c:        /* Unlock Start Block Address */
 491         return s->unladdr[0];
 492     case 0xf24d:        /* Unlock End Block Address */
 493         return s->unladdr[1];
 494     case 0xf24e:        /* Write Protection Status */
 495         return s->wpstatus;
 496
 497     case 0xff00:        /* ECC Status */
 498         return 0x00;
 499     case 0xff01:        /* ECC Result of main area data */
 500     case 0xff02:        /* ECC Result of spare area data */
 501     case 0xff03:        /* ECC Result of main area data */
 502     case 0xff04:        /* ECC Result of spare area data */
 503         cpu_abort(cpu_single_env, "%s: imeplement ECC\n", __FUNCTION__);
 504         return 0x0000;
 505     }
 506
 507     fprintf(stderr, "%s: unknown OneNAND register %x\n",
 508                     __FUNCTION__, offset);
 509     return 0;
 510 }
 511
 512 static void onenand_write(void *opaque, target_phys_addr_t addr,
 513                 uint32_t value)
 514 {
 515     struct onenand_s *s = (struct onenand_s *) opaque;
 516     int offset = addr >> s->shift;
 517     int sec;
 518
 519     switch (offset) {
 520     case 0x0000 ... 0x01ff:
 521     case 0x8000 ... 0x800f:
 522         if (s->cycle) {
 523             s->cycle = 0;
 524
 525             if (value == 0x0000) {
 526                 SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE)
 527                 onenand_load_main(s, sec,
 528                                 1 << (PAGE_SHIFT - 9), s->data[0][0]);
 529                 s->addr[ONEN_BUF_PAGE] += 4;
 530                 s->addr[ONEN_BUF_PAGE] &= 0xff;
 531             }
 532             break;
 533         }
 534
 535         switch (value) {
 536         case 0x00f0:    /* Reset OneNAND */
 537             onenand_reset(s, 0);
 538             break;
 539
 540         case 0x00e0:    /* Load Data into Buffer */
 541             s->cycle = 1;
 542             break;
 543
 544         case 0x0090:    /* Read Identification Data */
 545             memset(s->boot[0], 0, 3 << s->shift);
 546             s->boot[0][0 << s->shift] = (s->id >> 16) & 0xff;
 547             s->boot[0][1 << s->shift] = (s->id >>  8) & 0xff;
 548             s->boot[0][2 << s->shift] = s->wpstatus & 0xff;
 549             break;
 550
 551         default:
 552             fprintf(stderr, "%s: unknown OneNAND boot command %x\n",
 553                             __FUNCTION__, value);
 554         }
 555         break;
 556
 557     case 0xf100 ... 0xf107:     /* Start addresses */
 558         s->addr[offset - 0xf100] = value;
 559         break;
 560
 561     case 0xf200:        /* Start buffer */
 562         s->bufaddr = (value >> 8) & 0xf;
 563         if (PAGE_SHIFT == 11)
 564             s->count = (value & 3) ?: 4;
 565         else if (PAGE_SHIFT == 10)
 566             s->count = (value & 1) ?: 2;
 567         break;
 568
 569     case 0xf220:        /* Command */
 570         if (s->intstatus & (1 << 15))
 571             break;
 572         s->command = value;
 573         onenand_command(s, s->command);
 574         break;
 575     case 0xf221:        /* System Configuration 1 */
 576         s->config[0] = value;
 577         onenand_intr_update(s);
 578         qemu_set_irq(s->rdy, (s->config[0] >> 7) & 1);
 579         break;
 580     case 0xf222:        /* System Configuration 2 */
 581         s->config[1] = value;
 582         break;
 583
 584     case 0xf241:        /* Interrupt */
 585         s->intstatus &= value;
 586         if ((1 << 15) & ~s->intstatus)
 587             s->status &= ~(ONEN_ERR_CMD | ONEN_ERR_ERASE |
 588                             ONEN_ERR_PROG | ONEN_ERR_LOAD);
 589         onenand_intr_update(s);
 590         break;
 591     case 0xf24c:        /* Unlock Start Block Address */
 592         s->unladdr[0] = value & (s->blocks - 1);
 593         /* For some reason we have to set the end address to by default
 594          * be same as start because the software forgets to write anything
 595          * in there.  */
 596         s->unladdr[1] = value & (s->blocks - 1);
 597         break;
 598     case 0xf24d:        /* Unlock End Block Address */
 599         s->unladdr[1] = value & (s->blocks - 1);
 600         break;
 601
 602     default:
 603         fprintf(stderr, "%s: unknown OneNAND register %x\n",
 604                         __FUNCTION__, offset);
 605     }
 606 }
 607
 608 static CPUReadMemoryFunc *onenand_readfn[] = {
 609     onenand_read,       /* TODO */
 610     onenand_read,
 611     onenand_read,
 612 };
 613
 614 static CPUWriteMemoryFunc *onenand_writefn[] = {
 615     onenand_write,      /* TODO */
 616     onenand_write,
 617     onenand_write,
 618 };
 619
 620 void *onenand_init(uint32_t id, int regshift, qemu_irq irq)
 621 {
 622     struct onenand_s *s = (struct onenand_s *) qemu_mallocz(sizeof(*s));
 623     int bdrv_index = drive_get_index(IF_MTD, 0, 0);
 624     uint32_t size = 1 << (24 + ((id >> 12) & 7));
 625     void *ram;
 626
 627     s->shift = regshift;
 628     s->intr = irq;
 629     s->rdy = 0;
 630     s->id = id;
 631     s->blocks = size >> BLOCK_SHIFT;
 632     s->secs = size >> 9;
 633     s->blockwp = qemu_malloc(s->blocks);
 634     s->density_mask = (id & (1 << 11)) ? (1 << (6 + ((id >> 12) & 7))) : 0;
 635     s->iomemtype = cpu_register_io_memory(0, onenand_readfn,
 636                     onenand_writefn, s);
 637     if (bdrv_index == -1)
 638         s->image = memset(qemu_malloc(size + (size >> 5)),
 639                         0xff, size + (size >> 5));
 640     else
 641         s->bdrv = drives_table[bdrv_index].bdrv;
 642     s->otp = memset(qemu_malloc((64 + 2) << PAGE_SHIFT),
 643                     0xff, (64 + 2) << PAGE_SHIFT);
 644     s->ram = qemu_ram_alloc(0xc000 << s->shift);
 645     ram = phys_ram_base + s->ram;
 646     s->boot[0] = ram + (0x0000 << s->shift);
 647     s->boot[1] = ram + (0x8000 << s->shift);
 648     s->data[0][0] = ram + ((0x0200 + (0 << (PAGE_SHIFT - 1))) << s->shift);
 649     s->data[0][1] = ram + ((0x8010 + (0 << (PAGE_SHIFT - 6))) << s->shift);
 650     s->data[1][0] = ram + ((0x0200 + (1 << (PAGE_SHIFT - 1))) << s->shift);
 651     s->data[1][1] = ram + ((0x8010 + (1 << (PAGE_SHIFT - 6))) << s->shift);
 652
 653     onenand_reset(s, 1);
 654
 655     return s;
 656 }
 657
 658 void *onenand_raw_otp(void *opaque)
 659 {
 660     struct onenand_s *s = (struct onenand_s *) opaque;
 661
 662     return s->otp;
 663 }