1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * SPI NOR Software Write Protection logic.
4 *
5 * Copyright (C) 2005, Intec Automation Inc.
6 * Copyright (C) 2014, Freescale Semiconductor, Inc.
7 */
8 #include <linux/mtd/mtd.h>
9 #include <linux/mtd/spi-nor.h>
10
11 #include "core.h"
12
spi_nor_get_sr_bp_mask(struct spi_nor * nor)13 static u8 spi_nor_get_sr_bp_mask(struct spi_nor *nor)
14 {
15 u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
16
17 if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6)
18 return mask | SR_BP3_BIT6;
19
20 if (nor->flags & SNOR_F_HAS_4BIT_BP)
21 return mask | SR_BP3;
22
23 return mask;
24 }
25
spi_nor_get_sr_tb_mask(struct spi_nor * nor)26 static u8 spi_nor_get_sr_tb_mask(struct spi_nor *nor)
27 {
28 if (nor->flags & SNOR_F_HAS_SR_TB_BIT6)
29 return SR_TB_BIT6;
30 else
31 return SR_TB_BIT5;
32 }
33
spi_nor_get_min_prot_length_sr(struct spi_nor * nor)34 static u64 spi_nor_get_min_prot_length_sr(struct spi_nor *nor)
35 {
36 unsigned int bp_slots, bp_slots_needed;
37 /*
38 * sector_size will eventually be replaced with the max erase size of
39 * the flash. For now, we need to have that ugly default.
40 */
41 unsigned int sector_size = nor->info->sector_size ?: SPI_NOR_DEFAULT_SECTOR_SIZE;
42 u64 n_sectors = div_u64(nor->params->size, sector_size);
43 u8 mask = spi_nor_get_sr_bp_mask(nor);
44
45 /* Reserved one for "protect none" and one for "protect all". */
46 bp_slots = (1 << hweight8(mask)) - 2;
47 bp_slots_needed = ilog2(n_sectors);
48
49 if (bp_slots_needed > bp_slots)
50 return sector_size << (bp_slots_needed - bp_slots);
51 else
52 return sector_size;
53 }
54
spi_nor_get_locked_range_sr(struct spi_nor * nor,u8 sr,loff_t * ofs,u64 * len)55 static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs,
56 u64 *len)
57 {
58 struct mtd_info *mtd = &nor->mtd;
59 u64 min_prot_len;
60 u8 mask = spi_nor_get_sr_bp_mask(nor);
61 u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
62 u8 bp, val = sr & mask;
63
64 if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3_BIT6)
65 val = (val & ~SR_BP3_BIT6) | SR_BP3;
66
67 bp = val >> SR_BP_SHIFT;
68
69 if (!bp) {
70 /* No protection */
71 *ofs = 0;
72 *len = 0;
73 return;
74 }
75
76 min_prot_len = spi_nor_get_min_prot_length_sr(nor);
77 *len = min_prot_len << (bp - 1);
78
79 if (*len > mtd->size)
80 *len = mtd->size;
81
82 if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask)
83 *ofs = 0;
84 else
85 *ofs = mtd->size - *len;
86 }
87
88 /*
89 * Return true if the entire region is locked (if @locked is true) or unlocked
90 * (if @locked is false); false otherwise.
91 */
spi_nor_check_lock_status_sr(struct spi_nor * nor,loff_t ofs,u64 len,u8 sr,bool locked)92 static bool spi_nor_check_lock_status_sr(struct spi_nor *nor, loff_t ofs,
93 u64 len, u8 sr, bool locked)
94 {
95 loff_t lock_offs, lock_offs_max, offs_max;
96 u64 lock_len;
97
98 if (!len)
99 return true;
100
101 spi_nor_get_locked_range_sr(nor, sr, &lock_offs, &lock_len);
102
103 lock_offs_max = lock_offs + lock_len;
104 offs_max = ofs + len;
105
106 if (locked)
107 /* Requested range is a sub-range of locked range */
108 return (offs_max <= lock_offs_max) && (ofs >= lock_offs);
109 else
110 /* Requested range does not overlap with locked range */
111 return (ofs >= lock_offs_max) || (offs_max <= lock_offs);
112 }
113
spi_nor_is_locked_sr(struct spi_nor * nor,loff_t ofs,u64 len,u8 sr)114 static bool spi_nor_is_locked_sr(struct spi_nor *nor, loff_t ofs, u64 len, u8 sr)
115 {
116 return spi_nor_check_lock_status_sr(nor, ofs, len, sr, true);
117 }
118
spi_nor_is_unlocked_sr(struct spi_nor * nor,loff_t ofs,u64 len,u8 sr)119 static bool spi_nor_is_unlocked_sr(struct spi_nor *nor, loff_t ofs, u64 len,
120 u8 sr)
121 {
122 return spi_nor_check_lock_status_sr(nor, ofs, len, sr, false);
123 }
124
125 /*
126 * Lock a region of the flash. Compatible with ST Micro and similar flash.
127 * Supports the block protection bits BP{0,1,2}/BP{0,1,2,3} in the status
128 * register
129 * (SR). Does not support these features found in newer SR bitfields:
130 * - SEC: sector/block protect - only handle SEC=0 (block protect)
131 * - CMP: complement protect - only support CMP=0 (range is not complemented)
132 *
133 * Support for the following is provided conditionally for some flash:
134 * - TB: top/bottom protect
135 *
136 * Sample table portion for 8MB flash (Winbond w25q64fw):
137 *
138 * SEC | TB | BP2 | BP1 | BP0 | Prot Length | Protected Portion
139 * --------------------------------------------------------------------------
140 * X | X | 0 | 0 | 0 | NONE | NONE
141 * 0 | 0 | 0 | 0 | 1 | 128 KB | Upper 1/64
142 * 0 | 0 | 0 | 1 | 0 | 256 KB | Upper 1/32
143 * 0 | 0 | 0 | 1 | 1 | 512 KB | Upper 1/16
144 * 0 | 0 | 1 | 0 | 0 | 1 MB | Upper 1/8
145 * 0 | 0 | 1 | 0 | 1 | 2 MB | Upper 1/4
146 * 0 | 0 | 1 | 1 | 0 | 4 MB | Upper 1/2
147 * X | X | 1 | 1 | 1 | 8 MB | ALL
148 * ------|-------|-------|-------|-------|---------------|-------------------
149 * 0 | 1 | 0 | 0 | 1 | 128 KB | Lower 1/64
150 * 0 | 1 | 0 | 1 | 0 | 256 KB | Lower 1/32
151 * 0 | 1 | 0 | 1 | 1 | 512 KB | Lower 1/16
152 * 0 | 1 | 1 | 0 | 0 | 1 MB | Lower 1/8
153 * 0 | 1 | 1 | 0 | 1 | 2 MB | Lower 1/4
154 * 0 | 1 | 1 | 1 | 0 | 4 MB | Lower 1/2
155 *
156 * Returns negative on errors, 0 on success.
157 */
spi_nor_sr_lock(struct spi_nor * nor,loff_t ofs,u64 len)158 static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
159 {
160 struct mtd_info *mtd = &nor->mtd;
161 u64 min_prot_len;
162 int ret, status_old, status_new;
163 u8 mask = spi_nor_get_sr_bp_mask(nor);
164 u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
165 u8 pow, val;
166 loff_t lock_len;
167 bool can_be_top = true, can_be_bottom = nor->flags & SNOR_F_HAS_SR_TB;
168 bool use_top;
169
170 ret = spi_nor_read_sr(nor, nor->bouncebuf);
171 if (ret)
172 return ret;
173
174 status_old = nor->bouncebuf[0];
175
176 /* If nothing in our range is unlocked, we don't need to do anything */
177 if (spi_nor_is_locked_sr(nor, ofs, len, status_old))
178 return 0;
179
180 /* If anything below us is unlocked, we can't use 'bottom' protection */
181 if (!spi_nor_is_locked_sr(nor, 0, ofs, status_old))
182 can_be_bottom = false;
183
184 /* If anything above us is unlocked, we can't use 'top' protection */
185 if (!spi_nor_is_locked_sr(nor, ofs + len, mtd->size - (ofs + len),
186 status_old))
187 can_be_top = false;
188
189 if (!can_be_bottom && !can_be_top)
190 return -EINVAL;
191
192 /* Prefer top, if both are valid */
193 use_top = can_be_top;
194
195 /* lock_len: length of region that should end up locked */
196 if (use_top)
197 lock_len = mtd->size - ofs;
198 else
199 lock_len = ofs + len;
200
201 if (lock_len == mtd->size) {
202 val = mask;
203 } else {
204 min_prot_len = spi_nor_get_min_prot_length_sr(nor);
205 pow = ilog2(lock_len) - ilog2(min_prot_len) + 1;
206 val = pow << SR_BP_SHIFT;
207
208 if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3)
209 val = (val & ~SR_BP3) | SR_BP3_BIT6;
210
211 if (val & ~mask)
212 return -EINVAL;
213
214 /* Don't "lock" with no region! */
215 if (!(val & mask))
216 return -EINVAL;
217 }
218
219 status_new = (status_old & ~mask & ~tb_mask) | val;
220
221 /*
222 * Disallow further writes if WP# pin is neither left floating nor
223 * wrongly tied to GND (that includes internal pull-downs).
224 * WP# pin hard strapped to GND can be a valid use case.
225 */
226 if (!(nor->flags & SNOR_F_NO_WP))
227 status_new |= SR_SRWD;
228
229 if (!use_top)
230 status_new |= tb_mask;
231
232 /* Don't bother if they're the same */
233 if (status_new == status_old)
234 return 0;
235
236 /* Only modify protection if it will not unlock other areas */
237 if ((status_new & mask) < (status_old & mask))
238 return -EINVAL;
239
240 return spi_nor_write_sr_and_check(nor, status_new);
241 }
242
243 /*
244 * Unlock a region of the flash. See spi_nor_sr_lock() for more info
245 *
246 * Returns negative on errors, 0 on success.
247 */
spi_nor_sr_unlock(struct spi_nor * nor,loff_t ofs,u64 len)248 static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
249 {
250 struct mtd_info *mtd = &nor->mtd;
251 u64 min_prot_len;
252 int ret, status_old, status_new;
253 u8 mask = spi_nor_get_sr_bp_mask(nor);
254 u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
255 u8 pow, val;
256 loff_t lock_len;
257 bool can_be_top = true, can_be_bottom = nor->flags & SNOR_F_HAS_SR_TB;
258 bool use_top;
259
260 ret = spi_nor_read_sr(nor, nor->bouncebuf);
261 if (ret)
262 return ret;
263
264 status_old = nor->bouncebuf[0];
265
266 /* If nothing in our range is locked, we don't need to do anything */
267 if (spi_nor_is_unlocked_sr(nor, ofs, len, status_old))
268 return 0;
269
270 /* If anything below us is locked, we can't use 'top' protection */
271 if (!spi_nor_is_unlocked_sr(nor, 0, ofs, status_old))
272 can_be_top = false;
273
274 /* If anything above us is locked, we can't use 'bottom' protection */
275 if (!spi_nor_is_unlocked_sr(nor, ofs + len, mtd->size - (ofs + len),
276 status_old))
277 can_be_bottom = false;
278
279 if (!can_be_bottom && !can_be_top)
280 return -EINVAL;
281
282 /* Prefer top, if both are valid */
283 use_top = can_be_top;
284
285 /* lock_len: length of region that should remain locked */
286 if (use_top)
287 lock_len = mtd->size - (ofs + len);
288 else
289 lock_len = ofs;
290
291 if (lock_len == 0) {
292 val = 0; /* fully unlocked */
293 } else {
294 min_prot_len = spi_nor_get_min_prot_length_sr(nor);
295 pow = ilog2(lock_len) - ilog2(min_prot_len) + 1;
296 val = pow << SR_BP_SHIFT;
297
298 if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3)
299 val = (val & ~SR_BP3) | SR_BP3_BIT6;
300
301 /* Some power-of-two sizes are not supported */
302 if (val & ~mask)
303 return -EINVAL;
304 }
305
306 status_new = (status_old & ~mask & ~tb_mask) | val;
307
308 /* Don't protect status register if we're fully unlocked */
309 if (lock_len == 0)
310 status_new &= ~SR_SRWD;
311
312 if (!use_top)
313 status_new |= tb_mask;
314
315 /* Don't bother if they're the same */
316 if (status_new == status_old)
317 return 0;
318
319 /* Only modify protection if it will not lock other areas */
320 if ((status_new & mask) > (status_old & mask))
321 return -EINVAL;
322
323 return spi_nor_write_sr_and_check(nor, status_new);
324 }
325
326 /*
327 * Check if a region of the flash is (completely) locked. See spi_nor_sr_lock()
328 * for more info.
329 *
330 * Returns 1 if entire region is locked, 0 if any portion is unlocked, and
331 * negative on errors.
332 */
spi_nor_sr_is_locked(struct spi_nor * nor,loff_t ofs,u64 len)333 static int spi_nor_sr_is_locked(struct spi_nor *nor, loff_t ofs, u64 len)
334 {
335 int ret;
336
337 ret = spi_nor_read_sr(nor, nor->bouncebuf);
338 if (ret)
339 return ret;
340
341 return spi_nor_is_locked_sr(nor, ofs, len, nor->bouncebuf[0]);
342 }
343
344 static const struct spi_nor_locking_ops spi_nor_sr_locking_ops = {
345 .lock = spi_nor_sr_lock,
346 .unlock = spi_nor_sr_unlock,
347 .is_locked = spi_nor_sr_is_locked,
348 };
349
spi_nor_init_default_locking_ops(struct spi_nor * nor)350 void spi_nor_init_default_locking_ops(struct spi_nor *nor)
351 {
352 nor->params->locking_ops = &spi_nor_sr_locking_ops;
353 }
354
spi_nor_lock(struct mtd_info * mtd,loff_t ofs,u64 len)355 static int spi_nor_lock(struct mtd_info *mtd, loff_t ofs, u64 len)
356 {
357 struct spi_nor *nor = mtd_to_spi_nor(mtd);
358 int ret;
359
360 ret = spi_nor_prep_and_lock(nor);
361 if (ret)
362 return ret;
363
364 ret = nor->params->locking_ops->lock(nor, ofs, len);
365
366 spi_nor_unlock_and_unprep(nor);
367 return ret;
368 }
369
spi_nor_unlock(struct mtd_info * mtd,loff_t ofs,u64 len)370 static int spi_nor_unlock(struct mtd_info *mtd, loff_t ofs, u64 len)
371 {
372 struct spi_nor *nor = mtd_to_spi_nor(mtd);
373 int ret;
374
375 ret = spi_nor_prep_and_lock(nor);
376 if (ret)
377 return ret;
378
379 ret = nor->params->locking_ops->unlock(nor, ofs, len);
380
381 spi_nor_unlock_and_unprep(nor);
382 return ret;
383 }
384
spi_nor_is_locked(struct mtd_info * mtd,loff_t ofs,u64 len)385 static int spi_nor_is_locked(struct mtd_info *mtd, loff_t ofs, u64 len)
386 {
387 struct spi_nor *nor = mtd_to_spi_nor(mtd);
388 int ret;
389
390 ret = spi_nor_prep_and_lock(nor);
391 if (ret)
392 return ret;
393
394 ret = nor->params->locking_ops->is_locked(nor, ofs, len);
395
396 spi_nor_unlock_and_unprep(nor);
397 return ret;
398 }
399
400 /**
401 * spi_nor_try_unlock_all() - Tries to unlock the entire flash memory array.
402 * @nor: pointer to a 'struct spi_nor'.
403 *
404 * Some SPI NOR flashes are write protected by default after a power-on reset
405 * cycle, in order to avoid inadvertent writes during power-up. Backward
406 * compatibility imposes to unlock the entire flash memory array at power-up
407 * by default.
408 *
409 * Unprotecting the entire flash array will fail for boards which are hardware
410 * write-protected. Thus any errors are ignored.
411 */
spi_nor_try_unlock_all(struct spi_nor * nor)412 void spi_nor_try_unlock_all(struct spi_nor *nor)
413 {
414 int ret;
415
416 if (!(nor->flags & SNOR_F_HAS_LOCK))
417 return;
418
419 dev_dbg(nor->dev, "Unprotecting entire flash array\n");
420
421 ret = spi_nor_unlock(&nor->mtd, 0, nor->params->size);
422 if (ret)
423 dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
424 }
425
spi_nor_set_mtd_locking_ops(struct spi_nor * nor)426 void spi_nor_set_mtd_locking_ops(struct spi_nor *nor)
427 {
428 struct mtd_info *mtd = &nor->mtd;
429
430 if (!nor->params->locking_ops)
431 return;
432
433 mtd->_lock = spi_nor_lock;
434 mtd->_unlock = spi_nor_unlock;
435 mtd->_is_locked = spi_nor_is_locked;
436 }
437