1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2007, Juniper Networks, Inc. 5 * Copyright (c) 2012-2013, SRI International 6 * All rights reserved. 7 * 8 * Portions of this software were developed by SRI International and the 9 * University of Cambridge Computer Laboratory under DARPA/AFRL contract 10 * (FA8750-10-C-0237) ("CTSRD"), as part of the DARPA CRASH research 11 * programme. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. Neither the name of the author nor the names of any co-contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 32 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 33 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include <sys/cdefs.h> 39 #include "opt_cfi.h" 40 41 #include <sys/param.h> 42 #include <sys/systm.h> 43 #include <sys/bus.h> 44 #include <sys/conf.h> 45 #include <sys/endian.h> 46 #include <sys/kenv.h> 47 #include <sys/kernel.h> 48 #include <sys/malloc.h> 49 #include <sys/module.h> 50 #include <sys/rman.h> 51 #include <sys/sysctl.h> 52 53 #include <machine/bus.h> 54 55 #include <dev/cfi/cfi_reg.h> 56 #include <dev/cfi/cfi_var.h> 57 58 static void cfi_add_sysctls(struct cfi_softc *); 59 60 extern struct cdevsw cfi_cdevsw; 61 62 char cfi_driver_name[] = "cfi"; 63 64 uint32_t 65 cfi_read_raw(struct cfi_softc *sc, u_int ofs) 66 { 67 uint32_t val; 68 69 ofs &= ~(sc->sc_width - 1); 70 switch (sc->sc_width) { 71 case 1: 72 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 73 break; 74 case 2: 75 val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 76 break; 77 case 4: 78 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 79 break; 80 default: 81 val = ~0; 82 break; 83 } 84 return (val); 85 } 86 87 uint32_t 88 cfi_read(struct cfi_softc *sc, u_int ofs) 89 { 90 uint32_t val; 91 uint16_t sval; 92 93 ofs &= ~(sc->sc_width - 1); 94 switch (sc->sc_width) { 95 case 1: 96 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 97 break; 98 case 2: 99 sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 100 #ifdef CFI_HARDWAREBYTESWAP 101 val = sval; 102 #else 103 val = le16toh(sval); 104 #endif 105 break; 106 case 4: 107 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 108 #ifndef CFI_HARDWAREBYTESWAP 109 val = le32toh(val); 110 #endif 111 break; 112 default: 113 val = ~0; 114 break; 115 } 116 return (val); 117 } 118 119 static void 120 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val) 121 { 122 123 ofs &= ~(sc->sc_width - 1); 124 switch (sc->sc_width) { 125 case 1: 126 bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val); 127 break; 128 case 2: 129 #ifdef CFI_HARDWAREBYTESWAP 130 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, val); 131 #else 132 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val)); 133 134 #endif 135 break; 136 case 4: 137 #ifdef CFI_HARDWAREBYTESWAP 138 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, val); 139 #else 140 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val)); 141 #endif 142 break; 143 } 144 } 145 146 /* 147 * This is same workaound as NetBSD sys/dev/nor/cfi.c cfi_reset_default() 148 */ 149 static void 150 cfi_reset_default(struct cfi_softc *sc) 151 { 152 153 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2); 154 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 155 } 156 157 uint8_t 158 cfi_read_qry(struct cfi_softc *sc, u_int ofs) 159 { 160 uint8_t val; 161 162 cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA); 163 val = cfi_read(sc, ofs * sc->sc_width); 164 cfi_reset_default(sc); 165 return (val); 166 } 167 168 static void 169 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data) 170 { 171 172 cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK); 173 cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK); 174 cfi_write(sc, ofs + addr, data); 175 } 176 177 static char * 178 cfi_fmtsize(uint32_t sz) 179 { 180 static char buf[8]; 181 static const char *sfx[] = { "", "K", "M", "G" }; 182 int sfxidx; 183 184 sfxidx = 0; 185 while (sfxidx < 3 && sz > 1023) { 186 sz /= 1024; 187 sfxidx++; 188 } 189 190 sprintf(buf, "%u%sB", sz, sfx[sfxidx]); 191 return (buf); 192 } 193 194 int 195 cfi_probe(device_t dev) 196 { 197 char desc[80]; 198 struct cfi_softc *sc; 199 char *vend_str; 200 int error; 201 uint16_t iface, vend; 202 203 sc = device_get_softc(dev); 204 sc->sc_dev = dev; 205 206 sc->sc_rid = 0; 207 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 208 RF_ACTIVE); 209 if (sc->sc_res == NULL) 210 return (ENXIO); 211 212 sc->sc_tag = rman_get_bustag(sc->sc_res); 213 sc->sc_handle = rman_get_bushandle(sc->sc_res); 214 215 if (sc->sc_width == 0) { 216 sc->sc_width = 1; 217 while (sc->sc_width <= 4) { 218 if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q') 219 break; 220 sc->sc_width <<= 1; 221 } 222 } else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') { 223 error = ENXIO; 224 goto out; 225 } 226 if (sc->sc_width > 4) { 227 error = ENXIO; 228 goto out; 229 } 230 231 /* We got a Q. Check if we also have the R and the Y. */ 232 if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' || 233 cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') { 234 error = ENXIO; 235 goto out; 236 } 237 238 /* Get the vendor and command set. */ 239 vend = cfi_read_qry(sc, CFI_QRY_VEND) | 240 (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8); 241 242 sc->sc_cmdset = vend; 243 244 switch (vend) { 245 case CFI_VEND_AMD_ECS: 246 case CFI_VEND_AMD_SCS: 247 vend_str = "AMD/Fujitsu"; 248 break; 249 case CFI_VEND_INTEL_ECS: 250 vend_str = "Intel/Sharp"; 251 break; 252 case CFI_VEND_INTEL_SCS: 253 vend_str = "Intel"; 254 break; 255 case CFI_VEND_MITSUBISHI_ECS: 256 case CFI_VEND_MITSUBISHI_SCS: 257 vend_str = "Mitsubishi"; 258 break; 259 default: 260 vend_str = "Unknown vendor"; 261 break; 262 } 263 264 /* Get the device size. */ 265 sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE); 266 267 /* Sanity-check the I/F */ 268 iface = cfi_read_qry(sc, CFI_QRY_IFACE) | 269 (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8); 270 271 /* 272 * Adding 1 to iface will give us a bit-wise "switch" 273 * that allows us to test for the interface width by 274 * testing a single bit. 275 */ 276 iface++; 277 278 error = (iface & sc->sc_width) ? 0 : EINVAL; 279 if (error) 280 goto out; 281 282 snprintf(desc, sizeof(desc), "%s - %s", vend_str, 283 cfi_fmtsize(sc->sc_size)); 284 device_set_desc_copy(dev, desc); 285 286 out: 287 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 288 return (error); 289 } 290 291 int 292 cfi_attach(device_t dev) 293 { 294 struct cfi_softc *sc; 295 u_int blksz, blocks; 296 u_int r, u; 297 uint64_t mtoexp, ttoexp; 298 #ifdef CFI_SUPPORT_STRATAFLASH 299 uint64_t ppr; 300 char name[KENV_MNAMELEN], value[32]; 301 #endif 302 303 sc = device_get_softc(dev); 304 sc->sc_dev = dev; 305 306 sc->sc_rid = 0; 307 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 308 #ifndef ATSE_CFI_HACK 309 RF_ACTIVE); 310 #else 311 RF_ACTIVE | RF_SHAREABLE); 312 #endif 313 if (sc->sc_res == NULL) 314 return (ENXIO); 315 316 sc->sc_tag = rman_get_bustag(sc->sc_res); 317 sc->sc_handle = rman_get_bushandle(sc->sc_res); 318 319 /* Get time-out values for erase, write, and buffer write. */ 320 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_ERASE); 321 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_ERASE); 322 if (ttoexp == 0) { 323 device_printf(dev, "erase timeout == 0, using 2^16ms\n"); 324 ttoexp = 16; 325 } 326 if (ttoexp > 41) { 327 device_printf(dev, "insane timeout: 2^%jdms\n", ttoexp); 328 return (EINVAL); 329 } 330 if (mtoexp == 0) { 331 device_printf(dev, "max erase timeout == 0, using 2^%jdms\n", 332 ttoexp + 4); 333 mtoexp = 4; 334 } 335 if (ttoexp + mtoexp > 41) { 336 device_printf(dev, "insane max erase timeout: 2^%jd\n", 337 ttoexp + mtoexp); 338 return (EINVAL); 339 } 340 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] = SBT_1MS * (1ULL << ttoexp); 341 sc->sc_max_timeouts[CFI_TIMEOUT_ERASE] = 342 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] * (1ULL << mtoexp); 343 344 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_WRITE); 345 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_WRITE); 346 if (ttoexp == 0) { 347 device_printf(dev, "write timeout == 0, using 2^18ns\n"); 348 ttoexp = 18; 349 } 350 if (ttoexp > 51) { 351 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp); 352 return (EINVAL); 353 } 354 if (mtoexp == 0) { 355 device_printf(dev, "max write timeout == 0, using 2^%jdms\n", 356 ttoexp + 4); 357 mtoexp = 4; 358 } 359 if (ttoexp + mtoexp > 51) { 360 device_printf(dev, "insane max write timeout: 2^%jdus\n", 361 ttoexp + mtoexp); 362 return (EINVAL); 363 } 364 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] = SBT_1US * (1ULL << ttoexp); 365 sc->sc_max_timeouts[CFI_TIMEOUT_WRITE] = 366 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] * (1ULL << mtoexp); 367 368 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE); 369 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE); 370 /* Don't check for 0, it means not-supported. */ 371 if (ttoexp > 51) { 372 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp); 373 return (EINVAL); 374 } 375 if (ttoexp + mtoexp > 51) { 376 device_printf(dev, "insane max write timeout: 2^%jdus\n", 377 ttoexp + mtoexp); 378 return (EINVAL); 379 } 380 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] = 381 SBT_1US * (1ULL << cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE)); 382 sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE] = 383 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] * 384 (1ULL << cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE)); 385 386 /* Get the maximum size of a multibyte program */ 387 if (sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] != 0) 388 sc->sc_maxbuf = 1 << (cfi_read_qry(sc, CFI_QRY_MAXBUF) | 389 cfi_read_qry(sc, CFI_QRY_MAXBUF) << 8); 390 else 391 sc->sc_maxbuf = 0; 392 393 /* Get erase regions. */ 394 sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS); 395 sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region), 396 M_TEMP, M_WAITOK | M_ZERO); 397 for (r = 0; r < sc->sc_regions; r++) { 398 blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) | 399 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8); 400 sc->sc_region[r].r_blocks = blocks + 1; 401 402 blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) | 403 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8); 404 sc->sc_region[r].r_blksz = (blksz == 0) ? 128 : 405 blksz * 256; 406 } 407 408 /* Reset the device to a default state. */ 409 cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS); 410 411 if (bootverbose) { 412 device_printf(dev, "["); 413 for (r = 0; r < sc->sc_regions; r++) { 414 printf("%ux%s%s", sc->sc_region[r].r_blocks, 415 cfi_fmtsize(sc->sc_region[r].r_blksz), 416 (r == sc->sc_regions - 1) ? "]\n" : ","); 417 } 418 } 419 420 if (sc->sc_cmdset == CFI_VEND_AMD_ECS || 421 sc->sc_cmdset == CFI_VEND_AMD_SCS) { 422 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_AUTO_SELECT); 423 sc->sc_manid = cfi_read(sc, 0); 424 sc->sc_devid = cfi_read(sc, 2); 425 device_printf(dev, "Manufacturer ID:%x Device ID:%x\n", 426 sc->sc_manid, sc->sc_devid); 427 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2); 428 } 429 430 u = device_get_unit(dev); 431 sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600, 432 "%s%u", cfi_driver_name, u); 433 sc->sc_nod->si_drv1 = sc; 434 435 cfi_add_sysctls(sc); 436 437 #ifdef CFI_SUPPORT_STRATAFLASH 438 /* 439 * Store the Intel factory PPR in the environment. In some 440 * cases it is the most unique ID on a board. 441 */ 442 if (cfi_intel_get_factory_pr(sc, &ppr) == 0) { 443 if (snprintf(name, sizeof(name), "%s.factory_ppr", 444 device_get_nameunit(dev)) < (sizeof(name) - 1) && 445 snprintf(value, sizeof(value), "0x%016jx", ppr) < 446 (sizeof(value) - 1)) 447 (void) kern_setenv(name, value); 448 } 449 #endif 450 451 device_add_child(dev, "cfid", -1); 452 bus_generic_attach(dev); 453 454 return (0); 455 } 456 457 static void 458 cfi_add_sysctls(struct cfi_softc *sc) 459 { 460 struct sysctl_ctx_list *ctx; 461 struct sysctl_oid_list *children; 462 463 ctx = device_get_sysctl_ctx(sc->sc_dev); 464 children = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev)); 465 466 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 467 "typical_erase_timout_count", 468 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_ERASE], 469 0, "Number of times the typical erase timeout was exceeded"); 470 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 471 "max_erase_timout_count", 472 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_ERASE], 0, 473 "Number of times the maximum erase timeout was exceeded"); 474 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 475 "typical_write_timout_count", 476 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_WRITE], 0, 477 "Number of times the typical write timeout was exceeded"); 478 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 479 "max_write_timout_count", 480 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_WRITE], 0, 481 "Number of times the maximum write timeout was exceeded"); 482 if (sc->sc_maxbuf > 0) { 483 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 484 "typical_bufwrite_timout_count", 485 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_BUFWRITE], 0, 486 "Number of times the typical buffered write timeout was " 487 "exceeded"); 488 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 489 "max_bufwrite_timout_count", 490 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_BUFWRITE], 0, 491 "Number of times the maximum buffered write timeout was " 492 "exceeded"); 493 } 494 } 495 496 int 497 cfi_detach(device_t dev) 498 { 499 struct cfi_softc *sc; 500 501 sc = device_get_softc(dev); 502 503 destroy_dev(sc->sc_nod); 504 free(sc->sc_region, M_TEMP); 505 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 506 return (0); 507 } 508 509 static bool 510 cfi_check_erase(struct cfi_softc *sc, u_int ofs, u_int sz) 511 { 512 bool result; 513 int i; 514 uint32_t val; 515 516 result = FALSE; 517 for (i = 0; i < sz; i += sc->sc_width) { 518 val = cfi_read(sc, ofs + i); 519 switch (sc->sc_width) { 520 case 1: 521 if (val != 0xff) 522 goto out; 523 continue; 524 case 2: 525 if (val != 0xffff) 526 goto out; 527 continue; 528 case 4: 529 if (val != 0xffffffff) 530 goto out; 531 continue; 532 } 533 } 534 result = TRUE; 535 536 out: 537 return (result); 538 } 539 540 static int 541 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, sbintime_t start, 542 enum cfi_wait_cmd cmd) 543 { 544 int done, error, tto_exceeded; 545 uint32_t st0 = 0, st = 0; 546 sbintime_t now; 547 548 done = 0; 549 error = 0; 550 tto_exceeded = 0; 551 while (!done && !error) { 552 /* 553 * Save time before we start so we always do one check 554 * after the timeout has expired. 555 */ 556 now = sbinuptime(); 557 558 switch (sc->sc_cmdset) { 559 case CFI_VEND_INTEL_ECS: 560 case CFI_VEND_INTEL_SCS: 561 st = cfi_read(sc, ofs); 562 done = (st & CFI_INTEL_STATUS_WSMS); 563 if (done) { 564 /* NB: bit 0 is reserved */ 565 st &= ~(CFI_INTEL_XSTATUS_RSVD | 566 CFI_INTEL_STATUS_WSMS | 567 CFI_INTEL_STATUS_RSVD); 568 if (st & CFI_INTEL_STATUS_DPS) 569 error = EPERM; 570 else if (st & CFI_INTEL_STATUS_PSLBS) 571 error = EIO; 572 else if (st & CFI_INTEL_STATUS_ECLBS) 573 error = ENXIO; 574 else if (st) 575 error = EACCES; 576 } 577 break; 578 case CFI_VEND_AMD_SCS: 579 case CFI_VEND_AMD_ECS: 580 st0 = cfi_read(sc, ofs); 581 st = cfi_read(sc, ofs); 582 done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0; 583 break; 584 } 585 586 if (tto_exceeded || 587 now > start + sc->sc_typical_timeouts[cmd]) { 588 if (!tto_exceeded) { 589 tto_exceeded = 1; 590 sc->sc_tto_counts[cmd]++; 591 #ifdef CFI_DEBUG_TIMEOUT 592 device_printf(sc->sc_dev, 593 "typical timeout exceeded (cmd %d)", cmd); 594 #endif 595 } 596 if (now > start + sc->sc_max_timeouts[cmd]) { 597 sc->sc_mto_counts[cmd]++; 598 #ifdef CFI_DEBUG_TIMEOUT 599 device_printf(sc->sc_dev, 600 "max timeout exceeded (cmd %d)", cmd); 601 #endif 602 } 603 } 604 } 605 if (!done && !error) 606 error = ETIMEDOUT; 607 if (error) 608 printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0); 609 return (error); 610 } 611 612 int 613 cfi_write_block(struct cfi_softc *sc) 614 { 615 union { 616 uint8_t *x8; 617 uint16_t *x16; 618 uint32_t *x32; 619 } ptr, cpyprt; 620 register_t intr; 621 int error, i, j, neederase = 0; 622 uint32_t st; 623 u_int wlen; 624 sbintime_t start; 625 u_int minsz; 626 uint32_t val; 627 628 /* Intel flash must be unlocked before modification */ 629 switch (sc->sc_cmdset) { 630 case CFI_VEND_INTEL_ECS: 631 case CFI_VEND_INTEL_SCS: 632 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS); 633 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_UB); 634 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY); 635 break; 636 } 637 638 /* Check if an erase is required. */ 639 for (i = 0; i < sc->sc_wrbufsz; i++) 640 if ((sc->sc_wrbuf[i] & sc->sc_wrbufcpy[i]) != sc->sc_wrbuf[i]) { 641 neederase = 1; 642 break; 643 } 644 645 if (neederase) { 646 intr = intr_disable(); 647 start = sbinuptime(); 648 /* Erase the block. */ 649 switch (sc->sc_cmdset) { 650 case CFI_VEND_INTEL_ECS: 651 case CFI_VEND_INTEL_SCS: 652 cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE); 653 cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM); 654 break; 655 case CFI_VEND_AMD_SCS: 656 case CFI_VEND_AMD_ECS: 657 /* find minimum sector size */ 658 minsz = sc->sc_region[0].r_blksz; 659 for (i = 1; i < sc->sc_regions; i++) { 660 if (sc->sc_region[i].r_blksz < minsz) 661 minsz = sc->sc_region[i].r_blksz; 662 } 663 cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START, 664 CFI_AMD_ERASE_SECTOR); 665 cfi_amd_write(sc, sc->sc_wrofs, 666 sc->sc_wrofs >> (ffs(minsz) - 1), 667 CFI_AMD_BLOCK_ERASE); 668 for (i = 0; i < CFI_AMD_MAXCHK; ++i) { 669 if (cfi_check_erase(sc, sc->sc_wrofs, 670 sc->sc_wrbufsz)) 671 break; 672 DELAY(10); 673 } 674 if (i == CFI_AMD_MAXCHK) { 675 printf("\nCFI Sector Erase time out error\n"); 676 return (ENODEV); 677 } 678 break; 679 default: 680 /* Better safe than sorry... */ 681 intr_restore(intr); 682 return (ENODEV); 683 } 684 intr_restore(intr); 685 error = cfi_wait_ready(sc, sc->sc_wrofs, start, 686 CFI_TIMEOUT_ERASE); 687 if (error) 688 goto out; 689 } else 690 error = 0; 691 692 /* Write the block using a multibyte write if supported. */ 693 ptr.x8 = sc->sc_wrbuf; 694 cpyprt.x8 = sc->sc_wrbufcpy; 695 if (sc->sc_maxbuf > sc->sc_width) { 696 switch (sc->sc_cmdset) { 697 case CFI_VEND_INTEL_ECS: 698 case CFI_VEND_INTEL_SCS: 699 for (i = 0; i < sc->sc_wrbufsz; i += wlen) { 700 wlen = MIN(sc->sc_maxbuf, sc->sc_wrbufsz - i); 701 702 intr = intr_disable(); 703 704 start = sbinuptime(); 705 do { 706 cfi_write(sc, sc->sc_wrofs + i, 707 CFI_BCS_BUF_PROG_SETUP); 708 if (sbinuptime() > start + sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE]) { 709 error = ETIMEDOUT; 710 goto out; 711 } 712 st = cfi_read(sc, sc->sc_wrofs + i); 713 } while (! (st & CFI_INTEL_STATUS_WSMS)); 714 715 cfi_write(sc, sc->sc_wrofs + i, 716 (wlen / sc->sc_width) - 1); 717 switch (sc->sc_width) { 718 case 1: 719 bus_space_write_region_1(sc->sc_tag, 720 sc->sc_handle, sc->sc_wrofs + i, 721 ptr.x8 + i, wlen); 722 break; 723 case 2: 724 bus_space_write_region_2(sc->sc_tag, 725 sc->sc_handle, sc->sc_wrofs + i, 726 ptr.x16 + i / 2, wlen / 2); 727 break; 728 case 4: 729 bus_space_write_region_4(sc->sc_tag, 730 sc->sc_handle, sc->sc_wrofs + i, 731 ptr.x32 + i / 4, wlen / 4); 732 break; 733 } 734 735 cfi_write(sc, sc->sc_wrofs + i, 736 CFI_BCS_CONFIRM); 737 738 intr_restore(intr); 739 740 error = cfi_wait_ready(sc, sc->sc_wrofs + i, 741 start, CFI_TIMEOUT_BUFWRITE); 742 if (error != 0) 743 goto out; 744 } 745 goto out; 746 default: 747 /* Fall through to single word case */ 748 break; 749 } 750 } 751 752 /* Write the block one byte/word at a time. */ 753 for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) { 754 /* Avoid writing unless we are actually changing bits */ 755 if (!neederase) { 756 switch (sc->sc_width) { 757 case 1: 758 if(*(ptr.x8 + i) == *(cpyprt.x8 + i)) 759 continue; 760 break; 761 case 2: 762 if(*(ptr.x16 + i / 2) == *(cpyprt.x16 + i / 2)) 763 continue; 764 break; 765 case 4: 766 if(*(ptr.x32 + i / 4) == *(cpyprt.x32 + i / 4)) 767 continue; 768 break; 769 } 770 } 771 772 /* 773 * Make sure the command to start a write and the 774 * actual write happens back-to-back without any 775 * excessive delays. 776 */ 777 intr = intr_disable(); 778 779 start = sbinuptime(); 780 switch (sc->sc_cmdset) { 781 case CFI_VEND_INTEL_ECS: 782 case CFI_VEND_INTEL_SCS: 783 cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM); 784 break; 785 case CFI_VEND_AMD_SCS: 786 case CFI_VEND_AMD_ECS: 787 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM); 788 break; 789 } 790 switch (sc->sc_width) { 791 case 1: 792 bus_space_write_1(sc->sc_tag, sc->sc_handle, 793 sc->sc_wrofs + i, *(ptr.x8 + i)); 794 break; 795 case 2: 796 bus_space_write_2(sc->sc_tag, sc->sc_handle, 797 sc->sc_wrofs + i, *(ptr.x16 + i / 2)); 798 break; 799 case 4: 800 bus_space_write_4(sc->sc_tag, sc->sc_handle, 801 sc->sc_wrofs + i, *(ptr.x32 + i / 4)); 802 break; 803 } 804 805 intr_restore(intr); 806 807 if (sc->sc_cmdset == CFI_VEND_AMD_ECS || 808 sc->sc_cmdset == CFI_VEND_AMD_SCS) { 809 for (j = 0; j < CFI_AMD_MAXCHK; ++j) { 810 switch (sc->sc_width) { 811 case 1: 812 val = *(ptr.x8 + i); 813 break; 814 case 2: 815 val = *(ptr.x16 + i / 2); 816 break; 817 case 4: 818 val = *(ptr.x32 + i / 4); 819 break; 820 } 821 822 if (cfi_read(sc, sc->sc_wrofs + i) == val) 823 break; 824 825 DELAY(10); 826 } 827 if (j == CFI_AMD_MAXCHK) { 828 printf("\nCFI Program Verify time out error\n"); 829 error = ENXIO; 830 goto out; 831 } 832 } else { 833 error = cfi_wait_ready(sc, sc->sc_wrofs, start, 834 CFI_TIMEOUT_WRITE); 835 if (error) 836 goto out; 837 } 838 } 839 840 /* error is 0. */ 841 842 out: 843 cfi_reset_default(sc); 844 845 /* Relock Intel flash */ 846 switch (sc->sc_cmdset) { 847 case CFI_VEND_INTEL_ECS: 848 case CFI_VEND_INTEL_SCS: 849 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS); 850 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LB); 851 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY); 852 break; 853 } 854 return (error); 855 } 856 857 #ifdef CFI_SUPPORT_STRATAFLASH 858 /* 859 * Intel StrataFlash Protection Register Support. 860 * 861 * The memory includes a 128-bit Protection Register that can be 862 * used for security. There are two 64-bit segments; one is programmed 863 * at the factory with a unique 64-bit number which is immutable. 864 * The other segment is left blank for User (OEM) programming. 865 * The User/OEM segment is One Time Programmable (OTP). It can also 866 * be locked to prevent any further writes by setting bit 0 of the 867 * Protection Lock Register (PLR). The PLR can written only once. 868 */ 869 870 static uint16_t 871 cfi_get16(struct cfi_softc *sc, int off) 872 { 873 uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1); 874 return v; 875 } 876 877 #ifdef CFI_ARMEDANDDANGEROUS 878 static void 879 cfi_put16(struct cfi_softc *sc, int off, uint16_t v) 880 { 881 bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v); 882 } 883 #endif 884 885 /* 886 * Read the factory-defined 64-bit segment of the PR. 887 */ 888 int 889 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id) 890 { 891 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 892 return EOPNOTSUPP; 893 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 894 895 cfi_write(sc, 0, CFI_INTEL_READ_ID); 896 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 | 897 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 | 898 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 | 899 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3))); 900 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 901 return 0; 902 } 903 904 /* 905 * Read the User/OEM 64-bit segment of the PR. 906 */ 907 int 908 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id) 909 { 910 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 911 return EOPNOTSUPP; 912 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 913 914 cfi_write(sc, 0, CFI_INTEL_READ_ID); 915 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 | 916 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 | 917 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 | 918 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7))); 919 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 920 return 0; 921 } 922 923 /* 924 * Write the User/OEM 64-bit segment of the PR. 925 * XXX should allow writing individual words/bytes 926 */ 927 int 928 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id) 929 { 930 #ifdef CFI_ARMEDANDDANGEROUS 931 register_t intr; 932 int i, error; 933 sbintime_t start; 934 #endif 935 936 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 937 return EOPNOTSUPP; 938 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 939 940 #ifdef CFI_ARMEDANDDANGEROUS 941 for (i = 7; i >= 4; i--, id >>= 16) { 942 intr = intr_disable(); 943 start = sbinuptime(); 944 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 945 cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff); 946 intr_restore(intr); 947 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start, 948 CFI_TIMEOUT_WRITE); 949 if (error) 950 break; 951 } 952 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 953 return error; 954 #else 955 device_printf(sc->sc_dev, "%s: OEM PR not set, " 956 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 957 return ENXIO; 958 #endif 959 } 960 961 /* 962 * Read the contents of the Protection Lock Register. 963 */ 964 int 965 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr) 966 { 967 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 968 return EOPNOTSUPP; 969 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 970 971 cfi_write(sc, 0, CFI_INTEL_READ_ID); 972 *plr = cfi_get16(sc, CFI_INTEL_PLR); 973 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 974 return 0; 975 } 976 977 /* 978 * Write the Protection Lock Register to lock down the 979 * user-settable segment of the Protection Register. 980 * NOTE: this operation is not reversible. 981 */ 982 int 983 cfi_intel_set_plr(struct cfi_softc *sc) 984 { 985 #ifdef CFI_ARMEDANDDANGEROUS 986 register_t intr; 987 int error; 988 sbintime_t start; 989 #endif 990 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 991 return EOPNOTSUPP; 992 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 993 994 #ifdef CFI_ARMEDANDDANGEROUS 995 /* worthy of console msg */ 996 device_printf(sc->sc_dev, "set PLR\n"); 997 intr = intr_disable(); 998 binuptime(&start); 999 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 1000 cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD); 1001 intr_restore(intr); 1002 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start, 1003 CFI_TIMEOUT_WRITE); 1004 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 1005 return error; 1006 #else 1007 device_printf(sc->sc_dev, "%s: PLR not set, " 1008 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 1009 return ENXIO; 1010 #endif 1011 } 1012 #endif /* CFI_SUPPORT_STRATAFLASH */ 1013