hw/misc/omap_gpmc.c

   1 /*
   2  * TI OMAP general purpose memory controller emulation.
   3  *
   4  * Copyright (C) 2007-2009 Nokia Corporation
   5  * Original code written by Andrzej Zaborowski <andrew@openedhand.com>
   6  * Enhancements for OMAP3 and NAND support written by Juha Riihimäki
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU General Public License as
  10  * published by the Free Software Foundation; either version 2 or
  11  * (at your option) any later version of the License.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "hw/hw.h"
  24 #include "hw/irq.h"
  25 #include "hw/block/flash.h"
  26 #include "hw/arm/omap.h"
  27 #include "exec/memory.h"
  28 #include "exec/address-spaces.h"
  29
  30 /* General-Purpose Memory Controller */
  31 struct omap_gpmc_s {
  32     qemu_irq irq;
  33     qemu_irq drq;
  34     MemoryRegion iomem;
  35     int accept_256;
  36
  37     uint8_t revision;
  38     uint8_t sysconfig;
  39     uint16_t irqst;
  40     uint16_t irqen;
  41     uint16_t lastirq;
  42     uint16_t timeout;
  43     uint16_t config;
  44     struct omap_gpmc_cs_file_s {
  45         uint32_t config[7];
  46         MemoryRegion *iomem;
  47         MemoryRegion container;
  48         MemoryRegion nandiomem;
  49         DeviceState *dev;
  50     } cs_file[8];
  51     int ecc_cs;
  52     int ecc_ptr;
  53     uint32_t ecc_cfg;
  54     ECCState ecc[9];
  55     struct prefetch {
  56         uint32_t config1; /* GPMC_PREFETCH_CONFIG1 */
  57         uint32_t transfercount; /* GPMC_PREFETCH_CONFIG2:TRANSFERCOUNT */
  58         int startengine; /* GPMC_PREFETCH_CONTROL:STARTENGINE */
  59         int fifopointer; /* GPMC_PREFETCH_STATUS:FIFOPOINTER */
  60         int count; /* GPMC_PREFETCH_STATUS:COUNTVALUE */
  61         MemoryRegion iomem;
  62         uint8_t fifo[64];
  63     } prefetch;
  64 };
  65
  66 #define OMAP_GPMC_8BIT 0
  67 #define OMAP_GPMC_16BIT 1
  68 #define OMAP_GPMC_NOR 0
  69 #define OMAP_GPMC_NAND 2
  70
  71 static int omap_gpmc_devtype(struct omap_gpmc_cs_file_s *f)
  72 {
  73     return (f->config[0] >> 10) & 3;
  74 }
  75
  76 static int omap_gpmc_devsize(struct omap_gpmc_cs_file_s *f)
  77 {
  78     /* devsize field is really 2 bits but we ignore the high
  79      * bit to ensure consistent behaviour if the guest sets
  80      * it (values 2 and 3 are reserved in the TRM)
  81      */
  82     return (f->config[0] >> 12) & 1;
  83 }
  84
  85 /* Extract the chip-select value from the prefetch config1 register */
  86 static int prefetch_cs(uint32_t config1)
  87 {
  88     return (config1 >> 24) & 7;
  89 }
  90
  91 static int prefetch_threshold(uint32_t config1)
  92 {
  93     return (config1 >> 8) & 0x7f;
  94 }
  95
  96 static void omap_gpmc_int_update(struct omap_gpmc_s *s)
  97 {
  98     /* The TRM is a bit unclear, but it seems to say that
  99      * the TERMINALCOUNTSTATUS bit is set only on the
 100      * transition when the prefetch engine goes from
 101      * active to inactive, whereas the FIFOEVENTSTATUS
 102      * bit is held high as long as the fifo has at
 103      * least THRESHOLD bytes available.
 104      * So we do the latter here, but TERMINALCOUNTSTATUS
 105      * is set elsewhere.
 106      */
 107     if (s->prefetch.fifopointer >= prefetch_threshold(s->prefetch.config1)) {
 108         s->irqst |= 1;
 109     }
 110     if ((s->irqen & s->irqst) != s->lastirq) {
 111         s->lastirq = s->irqen & s->irqst;
 112         qemu_set_irq(s->irq, s->lastirq);
 113     }
 114 }
 115
 116 static void omap_gpmc_dma_update(struct omap_gpmc_s *s, int value)
 117 {
 118     if (s->prefetch.config1 & 4) {
 119         qemu_set_irq(s->drq, value);
 120     }
 121 }
 122
 123 /* Access functions for when a NAND-like device is mapped into memory:
 124  * all addresses in the region behave like accesses to the relevant
 125  * GPMC_NAND_DATA_i register (which is actually implemented to call these)
 126  */
 127 static uint64_t omap_nand_read(void *opaque, hwaddr addr,
 128                                unsigned size)
 129 {
 130     struct omap_gpmc_cs_file_s *f = (struct omap_gpmc_cs_file_s *)opaque;
 131     uint64_t v;
 132     nand_setpins(f->dev, 0, 0, 0, 1, 0);
 133     switch (omap_gpmc_devsize(f)) {
 134     case OMAP_GPMC_8BIT:
 135         v = nand_getio(f->dev);
 136         if (size == 1) {
 137             return v;
 138         }
 139         v |= (nand_getio(f->dev) << 8);
 140         if (size == 2) {
 141             return v;
 142         }
 143         v |= (nand_getio(f->dev) << 16);
 144         v |= (nand_getio(f->dev) << 24);
 145         return v;
 146     case OMAP_GPMC_16BIT:
 147         v = nand_getio(f->dev);
 148         if (size == 1) {
 149             /* 8 bit read from 16 bit device : probably a guest bug */
 150             return v & 0xff;
 151         }
 152         if (size == 2) {
 153             return v;
 154         }
 155         v |= (nand_getio(f->dev) << 16);
 156         return v;
 157     default:
 158         abort();
 159     }
 160 }
 161
 162 static void omap_nand_setio(DeviceState *dev, uint64_t value,
 163                             int nandsize, int size)
 164 {
 165     /* Write the specified value to the NAND device, respecting
 166      * both size of the NAND device and size of the write access.
 167      */
 168     switch (nandsize) {
 169     case OMAP_GPMC_8BIT:
 170         switch (size) {
 171         case 1:
 172             nand_setio(dev, value & 0xff);
 173             break;
 174         case 2:
 175             nand_setio(dev, value & 0xff);
 176             nand_setio(dev, (value >> 8) & 0xff);
 177             break;
 178         case 4:
 179         default:
 180             nand_setio(dev, value & 0xff);
 181             nand_setio(dev, (value >> 8) & 0xff);
 182             nand_setio(dev, (value >> 16) & 0xff);
 183             nand_setio(dev, (value >> 24) & 0xff);
 184             break;
 185         }
 186         break;
 187     case OMAP_GPMC_16BIT:
 188         switch (size) {
 189         case 1:
 190             /* writing to a 16bit device with 8bit access is probably a guest
 191              * bug; pass the value through anyway.
 192              */
 193         case 2:
 194             nand_setio(dev, value & 0xffff);
 195             break;
 196         case 4:
 197         default:
 198             nand_setio(dev, value & 0xffff);
 199             nand_setio(dev, (value >> 16) & 0xffff);
 200             break;
 201         }
 202         break;
 203     }
 204 }
 205
 206 static void omap_nand_write(void *opaque, hwaddr addr,
 207                             uint64_t value, unsigned size)
 208 {
 209     struct omap_gpmc_cs_file_s *f = (struct omap_gpmc_cs_file_s *)opaque;
 210     nand_setpins(f->dev, 0, 0, 0, 1, 0);
 211     omap_nand_setio(f->dev, value, omap_gpmc_devsize(f), size);
 212 }
 213
 214 static const MemoryRegionOps omap_nand_ops = {
 215     .read = omap_nand_read,
 216     .write = omap_nand_write,
 217     .endianness = DEVICE_NATIVE_ENDIAN,
 218 };
 219
 220 static void fill_prefetch_fifo(struct omap_gpmc_s *s)
 221 {
 222     /* Fill the prefetch FIFO by reading data from NAND.
 223      * We do this synchronously, unlike the hardware which
 224      * will do this asynchronously. We refill when the
 225      * FIFO has THRESHOLD bytes free, and we always refill
 226      * as much data as possible starting at the top end
 227      * of the FIFO.
 228      * (We have to refill at THRESHOLD rather than waiting
 229      * for the FIFO to empty to allow for the case where
 230      * the FIFO size isn't an exact multiple of THRESHOLD
 231      * and we're doing DMA transfers.)
 232      * This means we never need to handle wrap-around in
 233      * the fifo-reading code, and the next byte of data
 234      * to read is always fifo[63 - fifopointer].
 235      */
 236     int fptr;
 237     int cs = prefetch_cs(s->prefetch.config1);
 238     int is16bit = (((s->cs_file[cs].config[0] >> 12) & 3) != 0);
 239     int bytes;
 240     /* Don't believe the bit of the OMAP TRM that says that COUNTVALUE
 241      * and TRANSFERCOUNT are in units of 16 bit words for 16 bit NAND.
 242      * Instead believe the bit that says it is always a byte count.
 243      */
 244     bytes = 64 - s->prefetch.fifopointer;
 245     if (bytes > s->prefetch.count) {
 246         bytes = s->prefetch.count;
 247     }
 248     if (is16bit) {
 249         bytes &= ~1;
 250     }
 251
 252     s->prefetch.count -= bytes;
 253     s->prefetch.fifopointer += bytes;
 254     fptr = 64 - s->prefetch.fifopointer;
 255     /* Move the existing data in the FIFO so it sits just
 256      * before what we're about to read in
 257      */
 258     while (fptr < (64 - bytes)) {
 259         s->prefetch.fifo[fptr] = s->prefetch.fifo[fptr + bytes];
 260         fptr++;
 261     }
 262     while (fptr < 64) {
 263         if (is16bit) {
 264             uint32_t v = omap_nand_read(&s->cs_file[cs], 0, 2);
 265             s->prefetch.fifo[fptr++] = v & 0xff;
 266             s->prefetch.fifo[fptr++] = (v >> 8) & 0xff;
 267         } else {
 268             s->prefetch.fifo[fptr++] = omap_nand_read(&s->cs_file[cs], 0, 1);
 269         }
 270     }
 271     if (s->prefetch.startengine && (s->prefetch.count == 0)) {
 272         /* This was the final transfer: raise TERMINALCOUNTSTATUS */
 273         s->irqst |= 2;
 274         s->prefetch.startengine = 0;
 275     }
 276     /* If there are any bytes in the FIFO at this point then
 277      * we must raise a DMA request (either this is a final part
 278      * transfer, or we filled the FIFO in which case we certainly
 279      * have THRESHOLD bytes available)
 280      */
 281     if (s->prefetch.fifopointer != 0) {
 282         omap_gpmc_dma_update(s, 1);
 283     }
 284     omap_gpmc_int_update(s);
 285 }
 286
 287 /* Access functions for a NAND-like device when the prefetch/postwrite
 288  * engine is enabled -- all addresses in the region behave alike:
 289  * data is read or written to the FIFO.
 290  */
 291 static uint64_t omap_gpmc_prefetch_read(void *opaque, hwaddr addr,
 292                                         unsigned size)
 293 {
 294     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
 295     uint32_t data;
 296     if (s->prefetch.config1 & 1) {
 297         /* The TRM doesn't define the behaviour if you read from the
 298          * FIFO when the prefetch engine is in write mode. We choose
 299          * to always return zero.
 300          */
 301         return 0;
 302     }
 303     /* Note that trying to read an empty fifo repeats the last byte */
 304     if (s->prefetch.fifopointer) {
 305         s->prefetch.fifopointer--;
 306     }
 307     data = s->prefetch.fifo[63 - s->prefetch.fifopointer];
 308     if (s->prefetch.fifopointer ==
 309         (64 - prefetch_threshold(s->prefetch.config1))) {
 310         /* We've drained THRESHOLD bytes now. So deassert the
 311          * DMA request, then refill the FIFO (which will probably
 312          * assert it again.)
 313          */
 314         omap_gpmc_dma_update(s, 0);
 315         fill_prefetch_fifo(s);
 316     }
 317     omap_gpmc_int_update(s);
 318     return data;
 319 }
 320
 321 static void omap_gpmc_prefetch_write(void *opaque, hwaddr addr,
 322                                      uint64_t value, unsigned size)
 323 {
 324     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
 325     int cs = prefetch_cs(s->prefetch.config1);
 326     if ((s->prefetch.config1 & 1) == 0) {
 327         /* The TRM doesn't define the behaviour of writing to the
 328          * FIFO when the prefetch engine is in read mode. We
 329          * choose to ignore the write.
 330          */
 331         return;
 332     }
 333     if (s->prefetch.count == 0) {
 334         /* The TRM doesn't define the behaviour of writing to the
 335          * FIFO if the transfer is complete. We choose to ignore.
 336          */
 337         return;
 338     }
 339     /* The only reason we do any data buffering in postwrite
 340      * mode is if we are talking to a 16 bit NAND device, in
 341      * which case we need to buffer the first byte of the
 342      * 16 bit word until the other byte arrives.
 343      */
 344     int is16bit = (((s->cs_file[cs].config[0] >> 12) & 3) != 0);
 345     if (is16bit) {
 346         /* fifopointer alternates between 64 (waiting for first
 347          * byte of word) and 63 (waiting for second byte)
 348          */
 349         if (s->prefetch.fifopointer == 64) {
 350             s->prefetch.fifo[0] = value;
 351             s->prefetch.fifopointer--;
 352         } else {
 353             value = (value << 8) | s->prefetch.fifo[0];
 354             omap_nand_write(&s->cs_file[cs], 0, value, 2);
 355             s->prefetch.count--;
 356             s->prefetch.fifopointer = 64;
 357         }
 358     } else {
 359         /* Just write the byte : fifopointer remains 64 at all times */
 360         omap_nand_write(&s->cs_file[cs], 0, value, 1);
 361         s->prefetch.count--;
 362     }
 363     if (s->prefetch.count == 0) {
 364         /* Final transfer: raise TERMINALCOUNTSTATUS */
 365         s->irqst |= 2;
 366         s->prefetch.startengine = 0;
 367     }
 368     omap_gpmc_int_update(s);
 369 }
 370
 371 static const MemoryRegionOps omap_prefetch_ops = {
 372     .read = omap_gpmc_prefetch_read,
 373     .write = omap_gpmc_prefetch_write,
 374     .endianness = DEVICE_NATIVE_ENDIAN,
 375     .impl.min_access_size = 1,
 376     .impl.max_access_size = 1,
 377 };
 378
 379 static MemoryRegion *omap_gpmc_cs_memregion(struct omap_gpmc_s *s, int cs)
 380 {
 381     /* Return the MemoryRegion* to map/unmap for this chipselect */
 382     struct omap_gpmc_cs_file_s *f = &s->cs_file[cs];
 383     if (omap_gpmc_devtype(f) == OMAP_GPMC_NOR) {
 384         return f->iomem;
 385     }
 386     if ((s->prefetch.config1 & 0x80) &&
 387         (prefetch_cs(s->prefetch.config1) == cs)) {
 388         /* The prefetch engine is enabled for this CS: map the FIFO */
 389         return &s->prefetch.iomem;
 390     }
 391     return &f->nandiomem;
 392 }
 393
 394 static void omap_gpmc_cs_map(struct omap_gpmc_s *s, int cs)
 395 {
 396     struct omap_gpmc_cs_file_s *f = &s->cs_file[cs];
 397     uint32_t mask = (f->config[6] >> 8) & 0xf;
 398     uint32_t base = f->config[6] & 0x3f;
 399     uint32_t size;
 400
 401     if (!f->iomem && !f->dev) {
 402         return;
 403     }
 404
 405     if (!(f->config[6] & (1 << 6))) {
 406         /* Do nothing unless CSVALID */
 407         return;
 408     }
 409
 410     /* TODO: check for overlapping regions and report access errors */
 411     if (mask != 0x8 && mask != 0xc && mask != 0xe && mask != 0xf
 412          && !(s->accept_256 && !mask)) {
 413         fprintf(stderr, "%s: invalid chip-select mask address (0x%x)\n",
 414                  __func__, mask);
 415     }
 416
 417     base <<= 24;
 418     size = (0x0fffffff & ~(mask << 24)) + 1;
 419     /* TODO: rather than setting the size of the mapping (which should be
 420      * constant), the mask should cause wrapping of the address space, so
 421      * that the same memory becomes accessible at every <i>size</i> bytes
 422      * starting from <i>base</i>.  */
 423     memory_region_init(&f->container, NULL, "omap-gpmc-file", size);
 424     memory_region_add_subregion(&f->container, 0,
 425                                 omap_gpmc_cs_memregion(s, cs));
 426     memory_region_add_subregion(get_system_memory(), base,
 427                                 &f->container);
 428 }
 429
 430 static void omap_gpmc_cs_unmap(struct omap_gpmc_s *s, int cs)
 431 {
 432     struct omap_gpmc_cs_file_s *f = &s->cs_file[cs];
 433     if (!(f->config[6] & (1 << 6))) {
 434         /* Do nothing unless CSVALID */
 435         return;
 436     }
 437     if (!f->iomem && !f->dev) {
 438         return;
 439     }
 440     memory_region_del_subregion(get_system_memory(), &f->container);
 441     memory_region_del_subregion(&f->container, omap_gpmc_cs_memregion(s, cs));
 442     object_unparent(OBJECT(&f->container));
 443 }
 444
 445 void omap_gpmc_reset(struct omap_gpmc_s *s)
 446 {
 447     int i;
 448
 449     s->sysconfig = 0;
 450     s->irqst = 0;
 451     s->irqen = 0;
 452     omap_gpmc_int_update(s);
 453     for (i = 0; i < 8; i++) {
 454         /* This has to happen before we change any of the config
 455          * used to determine which memory regions are mapped or unmapped.
 456          */
 457         omap_gpmc_cs_unmap(s, i);
 458     }
 459     s->timeout = 0;
 460     s->config = 0xa00;
 461     s->prefetch.config1 = 0x00004000;
 462     s->prefetch.transfercount = 0x00000000;
 463     s->prefetch.startengine = 0;
 464     s->prefetch.fifopointer = 0;
 465     s->prefetch.count = 0;
 466     for (i = 0; i < 8; i ++) {
 467         s->cs_file[i].config[1] = 0x101001;
 468         s->cs_file[i].config[2] = 0x020201;
 469         s->cs_file[i].config[3] = 0x10031003;
 470         s->cs_file[i].config[4] = 0x10f1111;
 471         s->cs_file[i].config[5] = 0;
 472         s->cs_file[i].config[6] = 0xf00;
 473         /* In theory we could probe attached devices for some CFG1
 474          * bits here, but we just retain them across resets as they
 475          * were set initially by omap_gpmc_attach().
 476          */
 477         if (i == 0) {
 478             s->cs_file[i].config[0] &= 0x00433e00;
 479             s->cs_file[i].config[6] |= 1 << 6; /* CSVALID */
 480             omap_gpmc_cs_map(s, i);
 481         } else {
 482             s->cs_file[i].config[0] &= 0x00403c00;
 483         }
 484     }
 485     s->ecc_cs = 0;
 486     s->ecc_ptr = 0;
 487     s->ecc_cfg = 0x3fcff000;
 488     for (i = 0; i < 9; i ++)
 489         ecc_reset(&s->ecc[i]);
 490 }
 491
 492 static int gpmc_wordaccess_only(hwaddr addr)
 493 {
 494     /* Return true if the register offset is to a register that
 495      * only permits word width accesses.
 496      * Non-word accesses are only OK for GPMC_NAND_DATA/ADDRESS/COMMAND
 497      * for any chipselect.
 498      */
 499     if (addr >= 0x60 && addr <= 0x1d4) {
 500         int cs = (addr - 0x60) / 0x30;
 501         addr -= cs * 0x30;
 502         if (addr >= 0x7c && addr < 0x88) {
 503             /* GPMC_NAND_COMMAND, GPMC_NAND_ADDRESS, GPMC_NAND_DATA */
 504             return 0;
 505         }
 506     }
 507     return 1;
 508 }
 509
 510 static uint64_t omap_gpmc_read(void *opaque, hwaddr addr,
 511                                unsigned size)
 512 {
 513     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
 514     int cs;
 515     struct omap_gpmc_cs_file_s *f;
 516
 517     if (size != 4 && gpmc_wordaccess_only(addr)) {
 518         return omap_badwidth_read32(opaque, addr);
 519     }
 520
 521     switch (addr) {
 522     case 0x000: /* GPMC_REVISION */
 523         return s->revision;
 524
 525     case 0x010: /* GPMC_SYSCONFIG */
 526         return s->sysconfig;
 527
 528     case 0x014: /* GPMC_SYSSTATUS */
 529         return 1;                                               /* RESETDONE */
 530
 531     case 0x018: /* GPMC_IRQSTATUS */
 532         return s->irqst;
 533
 534     case 0x01c: /* GPMC_IRQENABLE */
 535         return s->irqen;
 536
 537     case 0x040: /* GPMC_TIMEOUT_CONTROL */
 538         return s->timeout;
 539
 540     case 0x044: /* GPMC_ERR_ADDRESS */
 541     case 0x048: /* GPMC_ERR_TYPE */
 542         return 0;
 543
 544     case 0x050: /* GPMC_CONFIG */
 545         return s->config;
 546
 547     case 0x054: /* GPMC_STATUS */
 548         return 0x001;
 549
 550     case 0x060 ... 0x1d4:
 551         cs = (addr - 0x060) / 0x30;
 552         addr -= cs * 0x30;
 553         f = s->cs_file + cs;
 554         switch (addr) {
 555         case 0x60:      /* GPMC_CONFIG1 */
 556             return f->config[0];
 557         case 0x64:      /* GPMC_CONFIG2 */
 558             return f->config[1];
 559         case 0x68:      /* GPMC_CONFIG3 */
 560             return f->config[2];
 561         case 0x6c:      /* GPMC_CONFIG4 */
 562             return f->config[3];
 563         case 0x70:      /* GPMC_CONFIG5 */
 564             return f->config[4];
 565         case 0x74:      /* GPMC_CONFIG6 */
 566             return f->config[5];
 567         case 0x78:      /* GPMC_CONFIG7 */
 568             return f->config[6];
 569         case 0x84 ... 0x87: /* GPMC_NAND_DATA */
 570             if (omap_gpmc_devtype(f) == OMAP_GPMC_NAND) {
 571                 return omap_nand_read(f, 0, size);
 572             }
 573             return 0;
 574         }
 575         break;
 576
 577     case 0x1e0: /* GPMC_PREFETCH_CONFIG1 */
 578         return s->prefetch.config1;
 579     case 0x1e4: /* GPMC_PREFETCH_CONFIG2 */
 580         return s->prefetch.transfercount;
 581     case 0x1ec: /* GPMC_PREFETCH_CONTROL */
 582         return s->prefetch.startengine;
 583     case 0x1f0: /* GPMC_PREFETCH_STATUS */
 584         /* NB: The OMAP3 TRM is inconsistent about whether the GPMC
 585          * FIFOTHRESHOLDSTATUS bit should be set when
 586          * FIFOPOINTER > FIFOTHRESHOLD or when it is >= FIFOTHRESHOLD.
 587          * Apparently the underlying functional spec from which the TRM was
 588          * created states that the behaviour is ">=", and this also
 589          * makes more conceptual sense.
 590          */
 591         return (s->prefetch.fifopointer << 24) |
 592                 ((s->prefetch.fifopointer >=
 593                   ((s->prefetch.config1 >> 8) & 0x7f) ? 1 : 0) << 16) |
 594                 s->prefetch.count;
 595
 596     case 0x1f4: /* GPMC_ECC_CONFIG */
 597         return s->ecc_cs;
 598     case 0x1f8: /* GPMC_ECC_CONTROL */
 599         return s->ecc_ptr;
 600     case 0x1fc: /* GPMC_ECC_SIZE_CONFIG */
 601         return s->ecc_cfg;
 602     case 0x200 ... 0x220:       /* GPMC_ECC_RESULT */
 603         cs = (addr & 0x1f) >> 2;
 604         /* TODO: check correctness */
 605         return
 606                 ((s->ecc[cs].cp    &  0x07) <<  0) |
 607                 ((s->ecc[cs].cp    &  0x38) << 13) |
 608                 ((s->ecc[cs].lp[0] & 0x1ff) <<  3) |
 609                 ((s->ecc[cs].lp[1] & 0x1ff) << 19);
 610
 611     case 0x230: /* GPMC_TESTMODE_CTRL */
 612         return 0;
 613     case 0x234: /* GPMC_PSA_LSB */
 614     case 0x238: /* GPMC_PSA_MSB */
 615         return 0x00000000;
 616     }
 617
 618     OMAP_BAD_REG(addr);
 619     return 0;
 620 }
 621
 622 static void omap_gpmc_write(void *opaque, hwaddr addr,
 623                             uint64_t value, unsigned size)
 624 {
 625     struct omap_gpmc_s *s = (struct omap_gpmc_s *) opaque;
 626     int cs;
 627     struct omap_gpmc_cs_file_s *f;
 628
 629     if (size != 4 && gpmc_wordaccess_only(addr)) {
 630         omap_badwidth_write32(opaque, addr, value);
 631         return;
 632     }
 633
 634     switch (addr) {
 635     case 0x000: /* GPMC_REVISION */
 636     case 0x014: /* GPMC_SYSSTATUS */
 637     case 0x054: /* GPMC_STATUS */
 638     case 0x1f0: /* GPMC_PREFETCH_STATUS */
 639     case 0x200 ... 0x220:       /* GPMC_ECC_RESULT */
 640     case 0x234: /* GPMC_PSA_LSB */
 641     case 0x238: /* GPMC_PSA_MSB */
 642         OMAP_RO_REG(addr);
 643         break;
 644
 645     case 0x010: /* GPMC_SYSCONFIG */
 646         if ((value >> 3) == 0x3)
 647             fprintf(stderr, "%s: bad SDRAM idle mode %"PRIi64"\n",
 648                             __func__, value >> 3);
 649         if (value & 2)
 650             omap_gpmc_reset(s);
 651         s->sysconfig = value & 0x19;
 652         break;
 653
 654     case 0x018: /* GPMC_IRQSTATUS */
 655         s->irqst &= ~value;
 656         omap_gpmc_int_update(s);
 657         break;
 658
 659     case 0x01c: /* GPMC_IRQENABLE */
 660         s->irqen = value & 0xf03;
 661         omap_gpmc_int_update(s);
 662         break;
 663
 664     case 0x040: /* GPMC_TIMEOUT_CONTROL */
 665         s->timeout = value & 0x1ff1;
 666         break;
 667
 668     case 0x044: /* GPMC_ERR_ADDRESS */
 669     case 0x048: /* GPMC_ERR_TYPE */
 670         break;
 671
 672     case 0x050: /* GPMC_CONFIG */
 673         s->config = value & 0xf13;
 674         break;
 675
 676     case 0x060 ... 0x1d4:
 677         cs = (addr - 0x060) / 0x30;
 678         addr -= cs * 0x30;
 679         f = s->cs_file + cs;
 680         switch (addr) {
 681         case 0x60:      /* GPMC_CONFIG1 */
 682             f->config[0] = value & 0xffef3e13;
 683             break;
 684         case 0x64:      /* GPMC_CONFIG2 */
 685             f->config[1] = value & 0x001f1f8f;
 686             break;
 687         case 0x68:      /* GPMC_CONFIG3 */
 688             f->config[2] = value & 0x001f1f8f;
 689             break;
 690         case 0x6c:      /* GPMC_CONFIG4 */
 691             f->config[3] = value & 0x1f8f1f8f;
 692             break;
 693         case 0x70:      /* GPMC_CONFIG5 */
 694             f->config[4] = value & 0x0f1f1f1f;
 695             break;
 696         case 0x74:      /* GPMC_CONFIG6 */
 697             f->config[5] = value & 0x00000fcf;
 698             break;
 699         case 0x78:      /* GPMC_CONFIG7 */
 700             if ((f->config[6] ^ value) & 0xf7f) {
 701                 omap_gpmc_cs_unmap(s, cs);
 702                 f->config[6] = value & 0x00000f7f;
 703                 omap_gpmc_cs_map(s, cs);
 704             }
 705             break;
 706         case 0x7c ... 0x7f: /* GPMC_NAND_COMMAND */
 707             if (omap_gpmc_devtype(f) == OMAP_GPMC_NAND) {
 708                 nand_setpins(f->dev, 1, 0, 0, 1, 0); /* CLE */
 709                 omap_nand_setio(f->dev, value, omap_gpmc_devsize(f), size);
 710             }
 711             break;
 712         case 0x80 ... 0x83: /* GPMC_NAND_ADDRESS */
 713             if (omap_gpmc_devtype(f) == OMAP_GPMC_NAND) {
 714                 nand_setpins(f->dev, 0, 1, 0, 1, 0); /* ALE */
 715                 omap_nand_setio(f->dev, value, omap_gpmc_devsize(f), size);
 716             }
 717             break;
 718         case 0x84 ... 0x87: /* GPMC_NAND_DATA */
 719             if (omap_gpmc_devtype(f) == OMAP_GPMC_NAND) {
 720                 omap_nand_write(f, 0, value, size);
 721             }
 722             break;
 723         default:
 724             goto bad_reg;
 725         }
 726         break;
 727
 728     case 0x1e0: /* GPMC_PREFETCH_CONFIG1 */
 729         if (!s->prefetch.startengine) {
 730             uint32_t newconfig1 = value & 0x7f8f7fbf;
 731             uint32_t changed;
 732             changed = newconfig1 ^ s->prefetch.config1;
 733             if (changed & (0x80 | 0x7000000)) {
 734                 /* Turning the engine on or off, or mapping it somewhere else.
 735                  * cs_map() and cs_unmap() check the prefetch config and
 736                  * overall CSVALID bits, so it is sufficient to unmap-and-map
 737                  * both the old cs and the new one. Note that we adhere to
 738                  * the "unmap/change config/map" order (and not unmap twice
 739                  * if newcs == oldcs), otherwise we'll try to delete the wrong
 740                  * memory region.
 741                  */
 742                 int oldcs = prefetch_cs(s->prefetch.config1);
 743                 int newcs = prefetch_cs(newconfig1);
 744                 omap_gpmc_cs_unmap(s, oldcs);
 745                 if (oldcs != newcs) {
 746                     omap_gpmc_cs_unmap(s, newcs);
 747                 }
 748                 s->prefetch.config1 = newconfig1;
 749                 omap_gpmc_cs_map(s, oldcs);
 750                 if (oldcs != newcs) {
 751                     omap_gpmc_cs_map(s, newcs);
 752                 }
 753             } else {
 754                 s->prefetch.config1 = newconfig1;
 755             }
 756         }
 757         break;
 758
 759     case 0x1e4: /* GPMC_PREFETCH_CONFIG2 */
 760         if (!s->prefetch.startengine) {
 761             s->prefetch.transfercount = value & 0x3fff;
 762         }
 763         break;
 764
 765     case 0x1ec: /* GPMC_PREFETCH_CONTROL */
 766         if (s->prefetch.startengine != (value & 1)) {
 767             s->prefetch.startengine = value & 1;
 768             if (s->prefetch.startengine) {
 769                 /* Prefetch engine start */
 770                 s->prefetch.count = s->prefetch.transfercount;
 771                 if (s->prefetch.config1 & 1) {
 772                     /* Write */
 773                     s->prefetch.fifopointer = 64;
 774                 } else {
 775                     /* Read */
 776                     s->prefetch.fifopointer = 0;
 777                     fill_prefetch_fifo(s);
 778                 }
 779             } else {
 780                 /* Prefetch engine forcibly stopped. The TRM
 781                  * doesn't define the behaviour if you do this.
 782                  * We clear the prefetch count, which means that
 783                  * we permit no more writes, and don't read any
 784                  * more data from NAND. The CPU can still drain
 785                  * the FIFO of unread data.
 786                  */
 787                 s->prefetch.count = 0;
 788             }
 789             omap_gpmc_int_update(s);
 790         }
 791         break;
 792
 793     case 0x1f4: /* GPMC_ECC_CONFIG */
 794         s->ecc_cs = 0x8f;
 795         break;
 796     case 0x1f8: /* GPMC_ECC_CONTROL */
 797         if (value & (1 << 8))
 798             for (cs = 0; cs < 9; cs ++)
 799                 ecc_reset(&s->ecc[cs]);
 800         s->ecc_ptr = value & 0xf;
 801         if (s->ecc_ptr == 0 || s->ecc_ptr > 9) {
 802             s->ecc_ptr = 0;
 803             s->ecc_cs &= ~1;
 804         }
 805         break;
 806     case 0x1fc: /* GPMC_ECC_SIZE_CONFIG */
 807         s->ecc_cfg = value & 0x3fcff1ff;
 808         break;
 809     case 0x230: /* GPMC_TESTMODE_CTRL */
 810         if (value & 7)
 811             fprintf(stderr, "%s: test mode enable attempt\n", __func__);
 812         break;
 813
 814     default:
 815     bad_reg:
 816         OMAP_BAD_REG(addr);
 817         return;
 818     }
 819 }
 820
 821 static const MemoryRegionOps omap_gpmc_ops = {
 822     .read = omap_gpmc_read,
 823     .write = omap_gpmc_write,
 824     .endianness = DEVICE_NATIVE_ENDIAN,
 825 };
 826
 827 struct omap_gpmc_s *omap_gpmc_init(struct omap_mpu_state_s *mpu,
 828                                    hwaddr base,
 829                                    qemu_irq irq, qemu_irq drq)
 830 {
 831     int cs;
 832     struct omap_gpmc_s *s = g_new0(struct omap_gpmc_s, 1);
 833
 834     memory_region_init_io(&s->iomem, NULL, &omap_gpmc_ops, s, "omap-gpmc", 0x1000);
 835     memory_region_add_subregion(get_system_memory(), base, &s->iomem);
 836
 837     s->irq = irq;
 838     s->drq = drq;
 839     s->accept_256 = cpu_is_omap3630(mpu);
 840     s->revision = cpu_class_omap3(mpu) ? 0x50 : 0x20;
 841     s->lastirq = 0;
 842     omap_gpmc_reset(s);
 843
 844     /* We have to register a different IO memory handler for each
 845      * chip select region in case a NAND device is mapped there. We
 846      * make the region the worst-case size of 256MB and rely on the
 847      * container memory region in cs_map to chop it down to the actual
 848      * guest-requested size.
 849      */
 850     for (cs = 0; cs < 8; cs++) {
 851         memory_region_init_io(&s->cs_file[cs].nandiomem, NULL,
 852                               &omap_nand_ops,
 853                               &s->cs_file[cs],
 854                               "omap-nand",
 855                               256 * 1024 * 1024);
 856     }
 857
 858     memory_region_init_io(&s->prefetch.iomem, NULL, &omap_prefetch_ops, s,
 859                           "omap-gpmc-prefetch", 256 * 1024 * 1024);
 860     return s;
 861 }
 862
 863 void omap_gpmc_attach(struct omap_gpmc_s *s, int cs, MemoryRegion *iomem)
 864 {
 865     struct omap_gpmc_cs_file_s *f;
 866     assert(iomem);
 867
 868     if (cs < 0 || cs >= 8) {
 869         fprintf(stderr, "%s: bad chip-select %i\n", __func__, cs);
 870         exit(-1);
 871     }
 872     f = &s->cs_file[cs];
 873
 874     omap_gpmc_cs_unmap(s, cs);
 875     f->config[0] &= ~(0xf << 10);
 876     f->iomem = iomem;
 877     omap_gpmc_cs_map(s, cs);
 878 }
 879
 880 void omap_gpmc_attach_nand(struct omap_gpmc_s *s, int cs, DeviceState *nand)
 881 {
 882     struct omap_gpmc_cs_file_s *f;
 883     assert(nand);
 884
 885     if (cs < 0 || cs >= 8) {
 886         fprintf(stderr, "%s: bad chip-select %i\n", __func__, cs);
 887         exit(-1);
 888     }
 889     f = &s->cs_file[cs];
 890
 891     omap_gpmc_cs_unmap(s, cs);
 892     f->config[0] &= ~(0xf << 10);
 893     f->config[0] |= (OMAP_GPMC_NAND << 10);
 894     f->dev = nand;
 895     if (nand_getbuswidth(f->dev) == 16) {
 896         f->config[0] |= OMAP_GPMC_16BIT << 12;
 897     }
 898     omap_gpmc_cs_map(s, cs);
 899 }