dummyflasher.c

   1 /*
   2  * This file is part of the flashrom project.
   3  *
   4  * Copyright (C) 2009,2010 Carl-Daniel Hailfinger
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; version 2 of the License.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  18  */
  19
  20 #include <string.h>
  21 #include <stdlib.h>
  22 #include <stdio.h>
  23 #include <ctype.h>
  24 #include <errno.h>
  25 #include "flash.h"
  26 #include "chipdrivers.h"
  27 #include "programmer.h"
  28
  29 /* Remove the #define below if you don't want SPI flash chip emulation. */
  30 #define EMULATE_SPI_CHIP 1
  31
  32 #if EMULATE_SPI_CHIP
  33 #define EMULATE_CHIP 1
  34 #include "spi.h"
  35 #endif
  36
  37 #if EMULATE_CHIP
  38 #include <sys/types.h>
  39 #include <sys/stat.h>
  40 #endif
  41
  42 #if EMULATE_CHIP
  43 static uint8_t *flashchip_contents = NULL;
  44 enum emu_chip {
  45         EMULATE_NONE,
  46         EMULATE_ST_M25P10_RES,
  47         EMULATE_SST_SST25VF040_REMS,
  48         EMULATE_SST_SST25VF032B,
  49         EMULATE_MACRONIX_MX25L6436,
  50 };
  51 static enum emu_chip emu_chip = EMULATE_NONE;
  52 static char *emu_persistent_image = NULL;
  53 static unsigned int emu_chip_size = 0;
  54 #if EMULATE_SPI_CHIP
  55 static unsigned int emu_max_byteprogram_size = 0;
  56 static unsigned int emu_max_aai_size = 0;
  57 static unsigned int emu_jedec_se_size = 0;
  58 static unsigned int emu_jedec_be_52_size = 0;
  59 static unsigned int emu_jedec_be_d8_size = 0;
  60 static unsigned int emu_jedec_ce_60_size = 0;
  61 static unsigned int emu_jedec_ce_c7_size = 0;
  62 unsigned char spi_blacklist[256];
  63 unsigned char spi_ignorelist[256];
  64 int spi_blacklist_size = 0;
  65 int spi_ignorelist_size = 0;
  66 static uint8_t emu_status = 0;
  67
  68 /* A legit complete SFDP table based on the MX25L6436E (rev. 1.8) datasheet. */
  69 static const uint8_t const sfdp_table[] = {
  70         0x53, 0x46, 0x44, 0x50, // @0x00: SFDP signature
  71         0x00, 0x01, 0x01, 0xFF, // @0x04: revision 1.0, 2 headers
  72         0x00, 0x00, 0x01, 0x09, // @0x08: JEDEC SFDP header rev. 1.0, 9 DW long
  73         0x1C, 0x00, 0x00, 0xFF, // @0x0C: PTP0 = 0x1C (instead of 0x30)
  74         0xC2, 0x00, 0x01, 0x04, // @0x10: Macronix header rev. 1.0, 4 DW long
  75         0x48, 0x00, 0x00, 0xFF, // @0x14: PTP1 = 0x48 (instead of 0x60)
  76         0xFF, 0xFF, 0xFF, 0xFF, // @0x18: hole.
  77         0xE5, 0x20, 0xC9, 0xFF, // @0x1C: SFDP parameter table start
  78         0xFF, 0xFF, 0xFF, 0x03, // @0x20
  79         0x00, 0xFF, 0x08, 0x6B, // @0x24
  80         0x08, 0x3B, 0x00, 0xFF, // @0x28
  81         0xEE, 0xFF, 0xFF, 0xFF, // @0x2C
  82         0xFF, 0xFF, 0x00, 0x00, // @0x30
  83         0xFF, 0xFF, 0x00, 0xFF, // @0x34
  84         0x0C, 0x20, 0x0F, 0x52, // @0x38
  85         0x10, 0xD8, 0x00, 0xFF, // @0x3C: SFDP parameter table end
  86         0xFF, 0xFF, 0xFF, 0xFF, // @0x40: hole.
  87         0xFF, 0xFF, 0xFF, 0xFF, // @0x44: hole.
  88         0x00, 0x36, 0x00, 0x27, // @0x48: Macronix parameter table start
  89         0xF4, 0x4F, 0xFF, 0xFF, // @0x4C
  90         0xD9, 0xC8, 0xFF, 0xFF, // @0x50
  91         0xFF, 0xFF, 0xFF, 0xFF, // @0x54: Macronix parameter table end
  92 };
  93
  94 #endif
  95 #endif
  96
  97 static unsigned int spi_write_256_chunksize = 256;
  98
  99 static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt,
 100                                   unsigned int readcnt,
 101                                   const unsigned char *writearr,
 102                                   unsigned char *readarr);
 103 static int dummy_spi_write_256(struct flashctx *flash, uint8_t *buf,
 104                                unsigned int start, unsigned int len);
 105 static void dummy_chip_writeb(const struct flashctx *flash, uint8_t val,
 106                               chipaddr addr);
 107 static void dummy_chip_writew(const struct flashctx *flash, uint16_t val,
 108                               chipaddr addr);
 109 static void dummy_chip_writel(const struct flashctx *flash, uint32_t val,
 110                               chipaddr addr);
 111 static void dummy_chip_writen(const struct flashctx *flash, uint8_t *buf,
 112                               chipaddr addr, size_t len);
 113 static uint8_t dummy_chip_readb(const struct flashctx *flash,
 114                                 const chipaddr addr);
 115 static uint16_t dummy_chip_readw(const struct flashctx *flash,
 116                                  const chipaddr addr);
 117 static uint32_t dummy_chip_readl(const struct flashctx *flash,
 118                                  const chipaddr addr);
 119 static void dummy_chip_readn(const struct flashctx *flash, uint8_t *buf,
 120                              const chipaddr addr, size_t len);
 121
 122 static const struct spi_programmer spi_programmer_dummyflasher = {
 123         .type           = SPI_CONTROLLER_DUMMY,
 124         .max_data_read  = MAX_DATA_READ_UNLIMITED,
 125         .max_data_write = MAX_DATA_UNSPECIFIED,
 126         .command        = dummy_spi_send_command,
 127         .multicommand   = default_spi_send_multicommand,
 128         .read           = default_spi_read,
 129         .write_256      = dummy_spi_write_256,
 130         .write_aai      = default_spi_write_aai,
 131 };
 132
 133 static const struct par_programmer par_programmer_dummy = {
 134                 .chip_readb             = dummy_chip_readb,
 135                 .chip_readw             = dummy_chip_readw,
 136                 .chip_readl             = dummy_chip_readl,
 137                 .chip_readn             = dummy_chip_readn,
 138                 .chip_writeb            = dummy_chip_writeb,
 139                 .chip_writew            = dummy_chip_writew,
 140                 .chip_writel            = dummy_chip_writel,
 141                 .chip_writen            = dummy_chip_writen,
 142 };
 143
 144 enum chipbustype dummy_buses_supported = BUS_NONE;
 145
 146 static int dummy_shutdown(void *data)
 147 {
 148         msg_pspew("%s\n", __func__);
 149 #if EMULATE_CHIP
 150         if (emu_chip != EMULATE_NONE) {
 151                 if (emu_persistent_image) {
 152                         msg_pdbg("Writing %s\n", emu_persistent_image);
 153                         write_buf_to_file(flashchip_contents, emu_chip_size,
 154                                           emu_persistent_image);
 155                 }
 156                 free(flashchip_contents);
 157         }
 158 #endif
 159         return 0;
 160 }
 161
 162 int dummy_init(void)
 163 {
 164         char *bustext = NULL;
 165         char *tmp = NULL;
 166         int i;
 167 #if EMULATE_SPI_CHIP
 168         char *status = NULL;
 169 #endif
 170 #if EMULATE_CHIP
 171         struct stat image_stat;
 172 #endif
 173
 174         msg_pspew("%s\n", __func__);
 175
 176         bustext = extract_programmer_param("bus");
 177         msg_pdbg("Requested buses are: %s\n", bustext ? bustext : "default");
 178         if (!bustext)
 179                 bustext = strdup("parallel+lpc+fwh+spi");
 180         /* Convert the parameters to lowercase. */
 181         tolower_string(bustext);
 182
 183         dummy_buses_supported = BUS_NONE;
 184         if (strstr(bustext, "parallel")) {
 185                 dummy_buses_supported |= BUS_PARALLEL;
 186                 msg_pdbg("Enabling support for %s flash.\n", "parallel");
 187         }
 188         if (strstr(bustext, "lpc")) {
 189                 dummy_buses_supported |= BUS_LPC;
 190                 msg_pdbg("Enabling support for %s flash.\n", "LPC");
 191         }
 192         if (strstr(bustext, "fwh")) {
 193                 dummy_buses_supported |= BUS_FWH;
 194                 msg_pdbg("Enabling support for %s flash.\n", "FWH");
 195         }
 196         if (strstr(bustext, "spi")) {
 197                 dummy_buses_supported |= BUS_SPI;
 198                 msg_pdbg("Enabling support for %s flash.\n", "SPI");
 199         }
 200         if (dummy_buses_supported == BUS_NONE)
 201                 msg_pdbg("Support for all flash bus types disabled.\n");
 202         free(bustext);
 203
 204         tmp = extract_programmer_param("spi_write_256_chunksize");
 205         if (tmp) {
 206                 spi_write_256_chunksize = atoi(tmp);
 207                 free(tmp);
 208                 if (spi_write_256_chunksize < 1) {
 209                         msg_perr("invalid spi_write_256_chunksize\n");
 210                         return 1;
 211                 }
 212         }
 213
 214         tmp = extract_programmer_param("spi_blacklist");
 215         if (tmp) {
 216                 i = strlen(tmp);
 217                 if (!strncmp(tmp, "0x", 2)) {
 218                         i -= 2;
 219                         memmove(tmp, tmp + 2, i + 1);
 220                 }
 221                 if ((i > 512) || (i % 2)) {
 222                         msg_perr("Invalid SPI command blacklist length\n");
 223                         free(tmp);
 224                         return 1;
 225                 }
 226                 spi_blacklist_size = i / 2;
 227                 for (i = 0; i < spi_blacklist_size * 2; i++) {
 228                         if (!isxdigit((unsigned char)tmp[i])) {
 229                                 msg_perr("Invalid char \"%c\" in SPI command "
 230                                          "blacklist\n", tmp[i]);
 231                                 free(tmp);
 232                                 return 1;
 233                         }
 234                 }
 235                 for (i = 0; i < spi_blacklist_size; i++) {
 236                         unsigned int tmp2;
 237                         /* SCNx8 is apparently not supported by MSVC (and thus
 238                          * MinGW), so work around it with an extra variable
 239                          */
 240                         sscanf(tmp + i * 2, "%2x", &tmp2);
 241                         spi_blacklist[i] = (uint8_t)tmp2;
 242                 }
 243                 msg_pdbg("SPI blacklist is ");
 244                 for (i = 0; i < spi_blacklist_size; i++)
 245                         msg_pdbg("%02x ", spi_blacklist[i]);
 246                 msg_pdbg(", size %i\n", spi_blacklist_size);
 247         }
 248         free(tmp);
 249
 250         tmp = extract_programmer_param("spi_ignorelist");
 251         if (tmp) {
 252                 i = strlen(tmp);
 253                 if (!strncmp(tmp, "0x", 2)) {
 254                         i -= 2;
 255                         memmove(tmp, tmp + 2, i + 1);
 256                 }
 257                 if ((i > 512) || (i % 2)) {
 258                         msg_perr("Invalid SPI command ignorelist length\n");
 259                         free(tmp);
 260                         return 1;
 261                 }
 262                 spi_ignorelist_size = i / 2;
 263                 for (i = 0; i < spi_ignorelist_size * 2; i++) {
 264                         if (!isxdigit((unsigned char)tmp[i])) {
 265                                 msg_perr("Invalid char \"%c\" in SPI command "
 266                                          "ignorelist\n", tmp[i]);
 267                                 free(tmp);
 268                                 return 1;
 269                         }
 270                 }
 271                 for (i = 0; i < spi_ignorelist_size; i++) {
 272                         unsigned int tmp2;
 273                         /* SCNx8 is apparently not supported by MSVC (and thus
 274                          * MinGW), so work around it with an extra variable
 275                          */
 276                         sscanf(tmp + i * 2, "%2x", &tmp2);
 277                         spi_ignorelist[i] = (uint8_t)tmp2;
 278                 }
 279                 msg_pdbg("SPI ignorelist is ");
 280                 for (i = 0; i < spi_ignorelist_size; i++)
 281                         msg_pdbg("%02x ", spi_ignorelist[i]);
 282                 msg_pdbg(", size %i\n", spi_ignorelist_size);
 283         }
 284         free(tmp);
 285
 286 #if EMULATE_CHIP
 287         tmp = extract_programmer_param("emulate");
 288         if (!tmp) {
 289                 msg_pdbg("Not emulating any flash chip.\n");
 290                 /* Nothing else to do. */
 291                 goto dummy_init_out;
 292         }
 293 #if EMULATE_SPI_CHIP
 294         if (!strcmp(tmp, "M25P10.RES")) {
 295                 emu_chip = EMULATE_ST_M25P10_RES;
 296                 emu_chip_size = 128 * 1024;
 297                 emu_max_byteprogram_size = 128;
 298                 emu_max_aai_size = 0;
 299                 emu_jedec_se_size = 0;
 300                 emu_jedec_be_52_size = 0;
 301                 emu_jedec_be_d8_size = 32 * 1024;
 302                 emu_jedec_ce_60_size = 0;
 303                 emu_jedec_ce_c7_size = emu_chip_size;
 304                 msg_pdbg("Emulating ST M25P10.RES SPI flash chip (RES, page "
 305                          "write)\n");
 306         }
 307         if (!strcmp(tmp, "SST25VF040.REMS")) {
 308                 emu_chip = EMULATE_SST_SST25VF040_REMS;
 309                 emu_chip_size = 512 * 1024;
 310                 emu_max_byteprogram_size = 1;
 311                 emu_max_aai_size = 0;
 312                 emu_jedec_se_size = 4 * 1024;
 313                 emu_jedec_be_52_size = 32 * 1024;
 314                 emu_jedec_be_d8_size = 0;
 315                 emu_jedec_ce_60_size = emu_chip_size;
 316                 emu_jedec_ce_c7_size = 0;
 317                 msg_pdbg("Emulating SST SST25VF040.REMS SPI flash chip (REMS, "
 318                          "byte write)\n");
 319         }
 320         if (!strcmp(tmp, "SST25VF032B")) {
 321                 emu_chip = EMULATE_SST_SST25VF032B;
 322                 emu_chip_size = 4 * 1024 * 1024;
 323                 emu_max_byteprogram_size = 1;
 324                 emu_max_aai_size = 2;
 325                 emu_jedec_se_size = 4 * 1024;
 326                 emu_jedec_be_52_size = 32 * 1024;
 327                 emu_jedec_be_d8_size = 64 * 1024;
 328                 emu_jedec_ce_60_size = emu_chip_size;
 329                 emu_jedec_ce_c7_size = emu_chip_size;
 330                 msg_pdbg("Emulating SST SST25VF032B SPI flash chip (RDID, AAI "
 331                          "write)\n");
 332         }
 333         if (!strcmp(tmp, "MX25L6436")) {
 334                 emu_chip = EMULATE_MACRONIX_MX25L6436;
 335                 emu_chip_size = 8 * 1024 * 1024;
 336                 emu_max_byteprogram_size = 256;
 337                 emu_max_aai_size = 0;
 338                 emu_jedec_se_size = 4 * 1024;
 339                 emu_jedec_be_52_size = 32 * 1024;
 340                 emu_jedec_be_d8_size = 64 * 1024;
 341                 emu_jedec_ce_60_size = emu_chip_size;
 342                 emu_jedec_ce_c7_size = emu_chip_size;
 343                 msg_pdbg("Emulating Macronix MX25L6436 SPI flash chip (RDID, "
 344                          "SFDP)\n");
 345         }
 346 #endif
 347         if (emu_chip == EMULATE_NONE) {
 348                 msg_perr("Invalid chip specified for emulation: %s\n", tmp);
 349                 free(tmp);
 350                 return 1;
 351         }
 352         free(tmp);
 353         flashchip_contents = malloc(emu_chip_size);
 354         if (!flashchip_contents) {
 355                 msg_perr("Out of memory!\n");
 356                 return 1;
 357         }
 358
 359 #ifdef EMULATE_SPI_CHIP
 360         status = extract_programmer_param("spi_status");
 361         if (status) {
 362                 char *endptr;
 363                 errno = 0;
 364                 emu_status = strtoul(status, &endptr, 0);
 365                 free(status);
 366                 if (errno != 0 || status == endptr) {
 367                         msg_perr("Error: initial status register specified, "
 368                                  "but the value could not be converted.\n");
 369                         return 1;
 370                 }
 371                 msg_pdbg("Initial status register is set to 0x%02x.\n",
 372                          emu_status);
 373         }
 374 #endif
 375
 376         msg_pdbg("Filling fake flash chip with 0xff, size %i\n", emu_chip_size);
 377         memset(flashchip_contents, 0xff, emu_chip_size);
 378
 379         emu_persistent_image = extract_programmer_param("image");
 380         if (!emu_persistent_image) {
 381                 /* Nothing else to do. */
 382                 goto dummy_init_out;
 383         }
 384         if (!stat(emu_persistent_image, &image_stat)) {
 385                 msg_pdbg("Found persistent image %s, size %li ",
 386                          emu_persistent_image, (long)image_stat.st_size);
 387                 if (image_stat.st_size == emu_chip_size) {
 388                         msg_pdbg("matches.\n");
 389                         msg_pdbg("Reading %s\n", emu_persistent_image);
 390                         read_buf_from_file(flashchip_contents, emu_chip_size,
 391                                            emu_persistent_image);
 392                 } else {
 393                         msg_pdbg("doesn't match.\n");
 394                 }
 395         }
 396 #endif
 397
 398 dummy_init_out:
 399         if (register_shutdown(dummy_shutdown, NULL)) {
 400                 free(flashchip_contents);
 401                 return 1;
 402         }
 403         if (dummy_buses_supported & (BUS_PARALLEL | BUS_LPC | BUS_FWH))
 404                 register_par_programmer(&par_programmer_dummy,
 405                                         dummy_buses_supported &
 406                                                 (BUS_PARALLEL | BUS_LPC |
 407                                                  BUS_FWH));
 408         if (dummy_buses_supported & BUS_SPI)
 409                 register_spi_programmer(&spi_programmer_dummyflasher);
 410
 411         return 0;
 412 }
 413
 414 void *dummy_map(const char *descr, unsigned long phys_addr, size_t len)
 415 {
 416         msg_pspew("%s: Mapping %s, 0x%lx bytes at 0x%08lx\n",
 417                   __func__, descr, (unsigned long)len, phys_addr);
 418         return (void *)phys_addr;
 419 }
 420
 421 void dummy_unmap(void *virt_addr, size_t len)
 422 {
 423         msg_pspew("%s: Unmapping 0x%lx bytes at %p\n",
 424                   __func__, (unsigned long)len, virt_addr);
 425 }
 426
 427 static void dummy_chip_writeb(const struct flashctx *flash, uint8_t val,
 428                               chipaddr addr)
 429 {
 430         msg_pspew("%s: addr=0x%lx, val=0x%02x\n", __func__, addr, val);
 431 }
 432
 433 static void dummy_chip_writew(const struct flashctx *flash, uint16_t val,
 434                               chipaddr addr)
 435 {
 436         msg_pspew("%s: addr=0x%lx, val=0x%04x\n", __func__, addr, val);
 437 }
 438
 439 static void dummy_chip_writel(const struct flashctx *flash, uint32_t val,
 440                               chipaddr addr)
 441 {
 442         msg_pspew("%s: addr=0x%lx, val=0x%08x\n", __func__, addr, val);
 443 }
 444
 445 static void dummy_chip_writen(const struct flashctx *flash, uint8_t *buf,
 446                               chipaddr addr, size_t len)
 447 {
 448         size_t i;
 449         msg_pspew("%s: addr=0x%lx, len=0x%08lx, writing data (hex):",
 450                   __func__, addr, (unsigned long)len);
 451         for (i = 0; i < len; i++) {
 452                 if ((i % 16) == 0)
 453                         msg_pspew("\n");
 454                 msg_pspew("%02x ", buf[i]);
 455         }
 456 }
 457
 458 static uint8_t dummy_chip_readb(const struct flashctx *flash,
 459                                 const chipaddr addr)
 460 {
 461         msg_pspew("%s:  addr=0x%lx, returning 0xff\n", __func__, addr);
 462         return 0xff;
 463 }
 464
 465 static uint16_t dummy_chip_readw(const struct flashctx *flash,
 466                                  const chipaddr addr)
 467 {
 468         msg_pspew("%s:  addr=0x%lx, returning 0xffff\n", __func__, addr);
 469         return 0xffff;
 470 }
 471
 472 static uint32_t dummy_chip_readl(const struct flashctx *flash,
 473                                  const chipaddr addr)
 474 {
 475         msg_pspew("%s:  addr=0x%lx, returning 0xffffffff\n", __func__, addr);
 476         return 0xffffffff;
 477 }
 478
 479 static void dummy_chip_readn(const struct flashctx *flash, uint8_t *buf,
 480                              const chipaddr addr, size_t len)
 481 {
 482         msg_pspew("%s:  addr=0x%lx, len=0x%lx, returning array of 0xff\n",
 483                   __func__, addr, (unsigned long)len);
 484         memset(buf, 0xff, len);
 485         return;
 486 }
 487
 488 #if EMULATE_SPI_CHIP
 489 static int emulate_spi_chip_response(unsigned int writecnt,
 490                                      unsigned int readcnt,
 491                                      const unsigned char *writearr,
 492                                      unsigned char *readarr)
 493 {
 494         unsigned int offs, i, toread;
 495         static int unsigned aai_offs;
 496
 497         if (writecnt == 0) {
 498                 msg_perr("No command sent to the chip!\n");
 499                 return 1;
 500         }
 501         /* spi_blacklist has precedence over spi_ignorelist. */
 502         for (i = 0; i < spi_blacklist_size; i++) {
 503                 if (writearr[0] == spi_blacklist[i]) {
 504                         msg_pdbg("Refusing blacklisted SPI command 0x%02x\n",
 505                                  spi_blacklist[i]);
 506                         return SPI_INVALID_OPCODE;
 507                 }
 508         }
 509         for (i = 0; i < spi_ignorelist_size; i++) {
 510                 if (writearr[0] == spi_ignorelist[i]) {
 511                         msg_cdbg("Ignoring ignorelisted SPI command 0x%02x\n",
 512                                  spi_ignorelist[i]);
 513                         /* Return success because the command does not fail,
 514                          * it is simply ignored.
 515                          */
 516                         return 0;
 517                 }
 518         }
 519
 520         if (emu_max_aai_size && (emu_status & SPI_SR_AAI)) {
 521                 if (writearr[0] != JEDEC_AAI_WORD_PROGRAM &&
 522                     writearr[0] != JEDEC_WRDI &&
 523                     writearr[0] != JEDEC_RDSR) {
 524                         msg_perr("Forbidden opcode (0x%02x) attempted during "
 525                                  "AAI sequence!\n", writearr[0]);
 526                         return 0;
 527                 }
 528         }
 529
 530         switch (writearr[0]) {
 531         case JEDEC_RES:
 532                 if (emu_chip != EMULATE_ST_M25P10_RES)
 533                         break;
 534                 /* Respond with ST_M25P10_RES. */
 535                 if (readcnt > 0)
 536                         readarr[0] = 0x10;
 537                 break;
 538         case JEDEC_REMS:
 539                 if (emu_chip != EMULATE_SST_SST25VF040_REMS)
 540                         break;
 541                 /* Respond with SST_SST25VF040_REMS. */
 542                 if (readcnt > 0)
 543                         readarr[0] = 0xbf;
 544                 if (readcnt > 1)
 545                         readarr[1] = 0x44;
 546                 break;
 547         case JEDEC_RDID:
 548                 switch (emu_chip) {
 549                 case EMULATE_SST_SST25VF032B:
 550                         if (readcnt > 0)
 551                                 readarr[0] = 0xbf;
 552                         if (readcnt > 1)
 553                                 readarr[1] = 0x25;
 554                         if (readcnt > 2)
 555                                 readarr[2] = 0x4a;
 556                         break;
 557                 case EMULATE_MACRONIX_MX25L6436:
 558                         if (readcnt > 0)
 559                                 readarr[0] = 0xc2;
 560                         if (readcnt > 1)
 561                                 readarr[1] = 0x20;
 562                         if (readcnt > 2)
 563                                 readarr[2] = 0x17;
 564                         break;
 565                 default: /* ignore */
 566                         break;
 567                 }
 568                 break;
 569         case JEDEC_RDSR:
 570                 memset(readarr, emu_status, readcnt);
 571                 break;
 572         /* FIXME: this should be chip-specific. */
 573         case JEDEC_EWSR:
 574         case JEDEC_WREN:
 575                 emu_status |= SPI_SR_WEL;
 576                 break;
 577         case JEDEC_WRSR:
 578                 if (!(emu_status & SPI_SR_WEL)) {
 579                         msg_perr("WRSR attempted, but WEL is 0!\n");
 580                         break;
 581                 }
 582                 /* FIXME: add some reasonable simulation of the busy flag */
 583                 emu_status = writearr[1] & ~SPI_SR_WIP;
 584                 msg_pdbg2("WRSR wrote 0x%02x.\n", emu_status);
 585                 break;
 586         case JEDEC_READ:
 587                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 588                 /* Truncate to emu_chip_size. */
 589                 offs %= emu_chip_size;
 590                 if (readcnt > 0)
 591                         memcpy(readarr, flashchip_contents + offs, readcnt);
 592                 break;
 593         case JEDEC_BYTE_PROGRAM:
 594                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 595                 /* Truncate to emu_chip_size. */
 596                 offs %= emu_chip_size;
 597                 if (writecnt < 5) {
 598                         msg_perr("BYTE PROGRAM size too short!\n");
 599                         return 1;
 600                 }
 601                 if (writecnt - 4 > emu_max_byteprogram_size) {
 602                         msg_perr("Max BYTE PROGRAM size exceeded!\n");
 603                         return 1;
 604                 }
 605                 memcpy(flashchip_contents + offs, writearr + 4, writecnt - 4);
 606                 break;
 607         case JEDEC_AAI_WORD_PROGRAM:
 608                 if (!emu_max_aai_size)
 609                         break;
 610                 if (!(emu_status & SPI_SR_AAI)) {
 611                         if (writecnt < JEDEC_AAI_WORD_PROGRAM_OUTSIZE) {
 612                                 msg_perr("Initial AAI WORD PROGRAM size too "
 613                                          "short!\n");
 614                                 return 1;
 615                         }
 616                         if (writecnt > JEDEC_AAI_WORD_PROGRAM_OUTSIZE) {
 617                                 msg_perr("Initial AAI WORD PROGRAM size too "
 618                                          "long!\n");
 619                                 return 1;
 620                         }
 621                         emu_status |= SPI_SR_AAI;
 622                         aai_offs = writearr[1] << 16 | writearr[2] << 8 |
 623                                    writearr[3];
 624                         /* Truncate to emu_chip_size. */
 625                         aai_offs %= emu_chip_size;
 626                         memcpy(flashchip_contents + aai_offs, writearr + 4, 2);
 627                         aai_offs += 2;
 628                 } else {
 629                         if (writecnt < JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE) {
 630                                 msg_perr("Continuation AAI WORD PROGRAM size "
 631                                          "too short!\n");
 632                                 return 1;
 633                         }
 634                         if (writecnt > JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE) {
 635                                 msg_perr("Continuation AAI WORD PROGRAM size "
 636                                          "too long!\n");
 637                                 return 1;
 638                         }
 639                         memcpy(flashchip_contents + aai_offs, writearr + 1, 2);
 640                         aai_offs += 2;
 641                 }
 642                 break;
 643         case JEDEC_WRDI:
 644                 if (emu_max_aai_size)
 645                         emu_status &= ~SPI_SR_AAI;
 646                 break;
 647         case JEDEC_SE:
 648                 if (!emu_jedec_se_size)
 649                         break;
 650                 if (writecnt != JEDEC_SE_OUTSIZE) {
 651                         msg_perr("SECTOR ERASE 0x20 outsize invalid!\n");
 652                         return 1;
 653                 }
 654                 if (readcnt != JEDEC_SE_INSIZE) {
 655                         msg_perr("SECTOR ERASE 0x20 insize invalid!\n");
 656                         return 1;
 657                 }
 658                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 659                 if (offs & (emu_jedec_se_size - 1))
 660                         msg_pdbg("Unaligned SECTOR ERASE 0x20: 0x%x\n", offs);
 661                 offs &= ~(emu_jedec_se_size - 1);
 662                 memset(flashchip_contents + offs, 0xff, emu_jedec_se_size);
 663                 break;
 664         case JEDEC_BE_52:
 665                 if (!emu_jedec_be_52_size)
 666                         break;
 667                 if (writecnt != JEDEC_BE_52_OUTSIZE) {
 668                         msg_perr("BLOCK ERASE 0x52 outsize invalid!\n");
 669                         return 1;
 670                 }
 671                 if (readcnt != JEDEC_BE_52_INSIZE) {
 672                         msg_perr("BLOCK ERASE 0x52 insize invalid!\n");
 673                         return 1;
 674                 }
 675                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 676                 if (offs & (emu_jedec_be_52_size - 1))
 677                         msg_pdbg("Unaligned BLOCK ERASE 0x52: 0x%x\n", offs);
 678                 offs &= ~(emu_jedec_be_52_size - 1);
 679                 memset(flashchip_contents + offs, 0xff, emu_jedec_be_52_size);
 680                 break;
 681         case JEDEC_BE_D8:
 682                 if (!emu_jedec_be_d8_size)
 683                         break;
 684                 if (writecnt != JEDEC_BE_D8_OUTSIZE) {
 685                         msg_perr("BLOCK ERASE 0xd8 outsize invalid!\n");
 686                         return 1;
 687                 }
 688                 if (readcnt != JEDEC_BE_D8_INSIZE) {
 689                         msg_perr("BLOCK ERASE 0xd8 insize invalid!\n");
 690                         return 1;
 691                 }
 692                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 693                 if (offs & (emu_jedec_be_d8_size - 1))
 694                         msg_pdbg("Unaligned BLOCK ERASE 0xd8: 0x%x\n", offs);
 695                 offs &= ~(emu_jedec_be_d8_size - 1);
 696                 memset(flashchip_contents + offs, 0xff, emu_jedec_be_d8_size);
 697                 break;
 698         case JEDEC_CE_60:
 699                 if (!emu_jedec_ce_60_size)
 700                         break;
 701                 if (writecnt != JEDEC_CE_60_OUTSIZE) {
 702                         msg_perr("CHIP ERASE 0x60 outsize invalid!\n");
 703                         return 1;
 704                 }
 705                 if (readcnt != JEDEC_CE_60_INSIZE) {
 706                         msg_perr("CHIP ERASE 0x60 insize invalid!\n");
 707                         return 1;
 708                 }
 709                 /* JEDEC_CE_60_OUTSIZE is 1 (no address) -> no offset. */
 710                 /* emu_jedec_ce_60_size is emu_chip_size. */
 711                 memset(flashchip_contents, 0xff, emu_jedec_ce_60_size);
 712                 break;
 713         case JEDEC_CE_C7:
 714                 if (!emu_jedec_ce_c7_size)
 715                         break;
 716                 if (writecnt != JEDEC_CE_C7_OUTSIZE) {
 717                         msg_perr("CHIP ERASE 0xc7 outsize invalid!\n");
 718                         return 1;
 719                 }
 720                 if (readcnt != JEDEC_CE_C7_INSIZE) {
 721                         msg_perr("CHIP ERASE 0xc7 insize invalid!\n");
 722                         return 1;
 723                 }
 724                 /* JEDEC_CE_C7_OUTSIZE is 1 (no address) -> no offset. */
 725                 /* emu_jedec_ce_c7_size is emu_chip_size. */
 726                 memset(flashchip_contents, 0xff, emu_jedec_ce_c7_size);
 727                 break;
 728         case JEDEC_SFDP:
 729                 if (emu_chip != EMULATE_MACRONIX_MX25L6436)
 730                         break;
 731                 if (writecnt < 4)
 732                         break;
 733                 offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3];
 734
 735                 /* SFDP expects one dummy byte after the address. */
 736                 if (writecnt == 4) {
 737                         /* The dummy byte was not written, make sure it is read instead.
 738                          * Shifting and shortening the read array does achieve this goal.
 739                          */
 740                         readarr++;
 741                         readcnt--;
 742                 } else {
 743                         /* The response is shifted if more than 5 bytes are written, because SFDP data is
 744                          * already shifted out by the chip while those superfluous bytes are written. */
 745                         offs += writecnt - 5;
 746                 }
 747
 748                 /* The SFDP spec implies that the start address of an SFDP read may be truncated to fit in the
 749                  * SFDP table address space, i.e. the start address may be wrapped around at SFDP table size.
 750                  * This is a reasonable implementation choice in hardware because it saves a few gates. */
 751                 if (offs >= sizeof(sfdp_table)) {
 752                         msg_pdbg("Wrapping the start address around the SFDP table boundary (using 0x%x "
 753                                  "instead of 0x%x).\n", (unsigned int)(offs % sizeof(sfdp_table)), offs);
 754                         offs %= sizeof(sfdp_table);
 755                 }
 756                 toread = min(sizeof(sfdp_table) - offs, readcnt);
 757                 memcpy(readarr, sfdp_table + offs, toread);
 758                 if (toread < readcnt)
 759                         msg_pdbg("Crossing the SFDP table boundary in a single "
 760                                  "continuous chunk produces undefined results "
 761                                  "after that point.\n");
 762                 break;
 763         default:
 764                 /* No special response. */
 765                 break;
 766         }
 767         if (writearr[0] != JEDEC_WREN && writearr[0] != JEDEC_EWSR)
 768                 emu_status &= ~SPI_SR_WEL;
 769         return 0;
 770 }
 771 #endif
 772
 773 static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt,
 774                                   unsigned int readcnt,
 775                                   const unsigned char *writearr,
 776                                   unsigned char *readarr)
 777 {
 778         int i;
 779
 780         msg_pspew("%s:", __func__);
 781
 782         msg_pspew(" writing %u bytes:", writecnt);
 783         for (i = 0; i < writecnt; i++)
 784                 msg_pspew(" 0x%02x", writearr[i]);
 785
 786         /* Response for unknown commands and missing chip is 0xff. */
 787         memset(readarr, 0xff, readcnt);
 788 #if EMULATE_SPI_CHIP
 789         switch (emu_chip) {
 790         case EMULATE_ST_M25P10_RES:
 791         case EMULATE_SST_SST25VF040_REMS:
 792         case EMULATE_SST_SST25VF032B:
 793         case EMULATE_MACRONIX_MX25L6436:
 794                 if (emulate_spi_chip_response(writecnt, readcnt, writearr,
 795                                               readarr)) {
 796                         msg_pdbg("Invalid command sent to flash chip!\n");
 797                         return 1;
 798                 }
 799                 break;
 800         default:
 801                 break;
 802         }
 803 #endif
 804         msg_pspew(" reading %u bytes:", readcnt);
 805         for (i = 0; i < readcnt; i++)
 806                 msg_pspew(" 0x%02x", readarr[i]);
 807         msg_pspew("\n");
 808         return 0;
 809 }
 810
 811 static int dummy_spi_write_256(struct flashctx *flash, uint8_t *buf,
 812                                unsigned int start, unsigned int len)
 813 {
 814         return spi_write_chunked(flash, buf, start, len,
 815                                  spi_write_256_chunksize);
 816 }