1 /*- 2 * Copyright (c) 2007, Juniper Networks, Inc. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. Neither the name of the author nor the names of any co-contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include "opt_cfi.h" 34 35 #include <sys/param.h> 36 #include <sys/systm.h> 37 #include <sys/bus.h> 38 #include <sys/conf.h> 39 #include <sys/endian.h> 40 #include <sys/kenv.h> 41 #include <sys/kernel.h> 42 #include <sys/malloc.h> 43 #include <sys/module.h> 44 #include <sys/rman.h> 45 #include <sys/sysctl.h> 46 47 #include <machine/bus.h> 48 49 #include <dev/cfi/cfi_reg.h> 50 #include <dev/cfi/cfi_var.h> 51 52 extern struct cdevsw cfi_cdevsw; 53 54 char cfi_driver_name[] = "cfi"; 55 devclass_t cfi_devclass; 56 devclass_t cfi_diskclass; 57 58 uint32_t 59 cfi_read_raw(struct cfi_softc *sc, u_int ofs) 60 { 61 uint32_t val; 62 63 ofs &= ~(sc->sc_width - 1); 64 switch (sc->sc_width) { 65 case 1: 66 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 67 break; 68 case 2: 69 val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 70 break; 71 case 4: 72 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 73 break; 74 default: 75 val = ~0; 76 break; 77 } 78 return (val); 79 } 80 81 uint32_t 82 cfi_read(struct cfi_softc *sc, u_int ofs) 83 { 84 uint32_t val; 85 uint16_t sval; 86 87 ofs &= ~(sc->sc_width - 1); 88 switch (sc->sc_width) { 89 case 1: 90 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 91 break; 92 case 2: 93 sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 94 val = le16toh(sval); 95 break; 96 case 4: 97 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 98 val = le32toh(val); 99 break; 100 default: 101 val = ~0; 102 break; 103 } 104 return (val); 105 } 106 107 static void 108 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val) 109 { 110 111 ofs &= ~(sc->sc_width - 1); 112 switch (sc->sc_width) { 113 case 1: 114 bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val); 115 break; 116 case 2: 117 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val)); 118 break; 119 case 4: 120 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val)); 121 break; 122 } 123 } 124 125 uint8_t 126 cfi_read_qry(struct cfi_softc *sc, u_int ofs) 127 { 128 uint8_t val; 129 130 cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA); 131 val = cfi_read(sc, ofs * sc->sc_width); 132 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 133 return (val); 134 } 135 136 static void 137 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data) 138 { 139 140 cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK); 141 cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK); 142 cfi_write(sc, ofs + addr, data); 143 } 144 145 static char * 146 cfi_fmtsize(uint32_t sz) 147 { 148 static char buf[8]; 149 static const char *sfx[] = { "", "K", "M", "G" }; 150 int sfxidx; 151 152 sfxidx = 0; 153 while (sfxidx < 3 && sz > 1023) { 154 sz /= 1024; 155 sfxidx++; 156 } 157 158 sprintf(buf, "%u%sB", sz, sfx[sfxidx]); 159 return (buf); 160 } 161 162 int 163 cfi_probe(device_t dev) 164 { 165 char desc[80]; 166 struct cfi_softc *sc; 167 char *vend_str; 168 int error; 169 uint16_t iface, vend; 170 171 sc = device_get_softc(dev); 172 sc->sc_dev = dev; 173 174 sc->sc_rid = 0; 175 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 176 RF_ACTIVE); 177 if (sc->sc_res == NULL) 178 return (ENXIO); 179 180 sc->sc_tag = rman_get_bustag(sc->sc_res); 181 sc->sc_handle = rman_get_bushandle(sc->sc_res); 182 183 if (sc->sc_width == 0) { 184 sc->sc_width = 1; 185 while (sc->sc_width <= 4) { 186 if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q') 187 break; 188 sc->sc_width <<= 1; 189 } 190 } else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') { 191 error = ENXIO; 192 goto out; 193 } 194 if (sc->sc_width > 4) { 195 error = ENXIO; 196 goto out; 197 } 198 199 /* We got a Q. Check if we also have the R and the Y. */ 200 if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' || 201 cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') { 202 error = ENXIO; 203 goto out; 204 } 205 206 /* Get the vendor and command set. */ 207 vend = cfi_read_qry(sc, CFI_QRY_VEND) | 208 (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8); 209 210 sc->sc_cmdset = vend; 211 212 switch (vend) { 213 case CFI_VEND_AMD_ECS: 214 case CFI_VEND_AMD_SCS: 215 vend_str = "AMD/Fujitsu"; 216 break; 217 case CFI_VEND_INTEL_ECS: 218 vend_str = "Intel/Sharp"; 219 break; 220 case CFI_VEND_INTEL_SCS: 221 vend_str = "Intel"; 222 break; 223 case CFI_VEND_MITSUBISHI_ECS: 224 case CFI_VEND_MITSUBISHI_SCS: 225 vend_str = "Mitsubishi"; 226 break; 227 default: 228 vend_str = "Unknown vendor"; 229 break; 230 } 231 232 /* Get the device size. */ 233 sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE); 234 235 /* Sanity-check the I/F */ 236 iface = cfi_read_qry(sc, CFI_QRY_IFACE) | 237 (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8); 238 239 /* 240 * Adding 1 to iface will give us a bit-wise "switch" 241 * that allows us to test for the interface width by 242 * testing a single bit. 243 */ 244 iface++; 245 246 error = (iface & sc->sc_width) ? 0 : EINVAL; 247 if (error) 248 goto out; 249 250 snprintf(desc, sizeof(desc), "%s - %s", vend_str, 251 cfi_fmtsize(sc->sc_size)); 252 device_set_desc_copy(dev, desc); 253 254 out: 255 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 256 return (error); 257 } 258 259 int 260 cfi_attach(device_t dev) 261 { 262 struct cfi_softc *sc; 263 u_int blksz, blocks; 264 u_int r, u; 265 #ifdef CFI_SUPPORT_STRATAFLASH 266 uint64_t ppr; 267 char name[KENV_MNAMELEN], value[32]; 268 #endif 269 270 sc = device_get_softc(dev); 271 sc->sc_dev = dev; 272 273 sc->sc_rid = 0; 274 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 275 RF_ACTIVE); 276 if (sc->sc_res == NULL) 277 return (ENXIO); 278 279 sc->sc_tag = rman_get_bustag(sc->sc_res); 280 sc->sc_handle = rman_get_bushandle(sc->sc_res); 281 282 /* Get time-out values for erase and write. */ 283 sc->sc_write_timeout = 1 << cfi_read_qry(sc, CFI_QRY_TTO_WRITE); 284 sc->sc_erase_timeout = 1 << cfi_read_qry(sc, CFI_QRY_TTO_ERASE); 285 sc->sc_write_timeout *= 1 << cfi_read_qry(sc, CFI_QRY_MTO_WRITE); 286 sc->sc_erase_timeout *= 1 << cfi_read_qry(sc, CFI_QRY_MTO_ERASE); 287 288 /* Get erase regions. */ 289 sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS); 290 sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region), 291 M_TEMP, M_WAITOK | M_ZERO); 292 for (r = 0; r < sc->sc_regions; r++) { 293 blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) | 294 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8); 295 sc->sc_region[r].r_blocks = blocks + 1; 296 297 blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) | 298 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8); 299 sc->sc_region[r].r_blksz = (blksz == 0) ? 128 : 300 blksz * 256; 301 } 302 303 /* Reset the device to a default state. */ 304 cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS); 305 306 if (bootverbose) { 307 device_printf(dev, "["); 308 for (r = 0; r < sc->sc_regions; r++) { 309 printf("%ux%s%s", sc->sc_region[r].r_blocks, 310 cfi_fmtsize(sc->sc_region[r].r_blksz), 311 (r == sc->sc_regions - 1) ? "]\n" : ","); 312 } 313 } 314 315 u = device_get_unit(dev); 316 sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600, 317 "%s%u", cfi_driver_name, u); 318 sc->sc_nod->si_drv1 = sc; 319 320 #ifdef CFI_SUPPORT_STRATAFLASH 321 /* 322 * Store the Intel factory PPR in the environment. In some 323 * cases it is the most unique ID on a board. 324 */ 325 if (cfi_intel_get_factory_pr(sc, &ppr) == 0) { 326 if (snprintf(name, sizeof(name), "%s.factory_ppr", 327 device_get_nameunit(dev)) < (sizeof(name) - 1) && 328 snprintf(value, sizeof(value), "0x%016jx", ppr) < 329 (sizeof(value) - 1)) 330 (void) setenv(name, value); 331 } 332 #endif 333 334 device_add_child(dev, "cfid", -1); 335 bus_generic_attach(dev); 336 337 return (0); 338 } 339 340 int 341 cfi_detach(device_t dev) 342 { 343 struct cfi_softc *sc; 344 345 sc = device_get_softc(dev); 346 347 destroy_dev(sc->sc_nod); 348 free(sc->sc_region, M_TEMP); 349 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 350 return (0); 351 } 352 353 static int 354 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, u_int timeout) 355 { 356 int done, error; 357 uint32_t st0 = 0, st = 0; 358 359 done = 0; 360 error = 0; 361 timeout *= 10; 362 while (!done && !error && timeout) { 363 DELAY(100); 364 timeout--; 365 366 switch (sc->sc_cmdset) { 367 case CFI_VEND_INTEL_ECS: 368 case CFI_VEND_INTEL_SCS: 369 st = cfi_read(sc, ofs); 370 done = (st & CFI_INTEL_STATUS_WSMS); 371 if (done) { 372 /* NB: bit 0 is reserved */ 373 st &= ~(CFI_INTEL_XSTATUS_RSVD | 374 CFI_INTEL_STATUS_WSMS | 375 CFI_INTEL_STATUS_RSVD); 376 if (st & CFI_INTEL_STATUS_DPS) 377 error = EPERM; 378 else if (st & CFI_INTEL_STATUS_PSLBS) 379 error = EIO; 380 else if (st & CFI_INTEL_STATUS_ECLBS) 381 error = ENXIO; 382 else if (st) 383 error = EACCES; 384 } 385 break; 386 case CFI_VEND_AMD_SCS: 387 case CFI_VEND_AMD_ECS: 388 st0 = cfi_read(sc, ofs); 389 st = cfi_read(sc, ofs); 390 done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0; 391 break; 392 } 393 } 394 if (!done && !error) 395 error = ETIMEDOUT; 396 if (error) 397 printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0); 398 return (error); 399 } 400 401 int 402 cfi_write_block(struct cfi_softc *sc) 403 { 404 union { 405 uint8_t *x8; 406 uint16_t *x16; 407 uint32_t *x32; 408 } ptr; 409 register_t intr; 410 int error, i; 411 412 /* Erase the block. */ 413 switch (sc->sc_cmdset) { 414 case CFI_VEND_INTEL_ECS: 415 case CFI_VEND_INTEL_SCS: 416 cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE); 417 cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM); 418 break; 419 case CFI_VEND_AMD_SCS: 420 case CFI_VEND_AMD_ECS: 421 cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START, 422 CFI_AMD_ERASE_SECTOR); 423 cfi_amd_write(sc, sc->sc_wrofs, 0, CFI_AMD_BLOCK_ERASE); 424 break; 425 default: 426 /* Better safe than sorry... */ 427 return (ENODEV); 428 } 429 error = cfi_wait_ready(sc, sc->sc_wrofs, sc->sc_erase_timeout); 430 if (error) 431 goto out; 432 433 /* Write the block. */ 434 ptr.x8 = sc->sc_wrbuf; 435 for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) { 436 437 /* 438 * Make sure the command to start a write and the 439 * actual write happens back-to-back without any 440 * excessive delays. 441 */ 442 intr = intr_disable(); 443 444 switch (sc->sc_cmdset) { 445 case CFI_VEND_INTEL_ECS: 446 case CFI_VEND_INTEL_SCS: 447 cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM); 448 break; 449 case CFI_VEND_AMD_SCS: 450 case CFI_VEND_AMD_ECS: 451 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM); 452 break; 453 } 454 switch (sc->sc_width) { 455 case 1: 456 bus_space_write_1(sc->sc_tag, sc->sc_handle, 457 sc->sc_wrofs + i, *(ptr.x8)++); 458 break; 459 case 2: 460 bus_space_write_2(sc->sc_tag, sc->sc_handle, 461 sc->sc_wrofs + i, *(ptr.x16)++); 462 break; 463 case 4: 464 bus_space_write_4(sc->sc_tag, sc->sc_handle, 465 sc->sc_wrofs + i, *(ptr.x32)++); 466 break; 467 } 468 469 intr_restore(intr); 470 471 error = cfi_wait_ready(sc, sc->sc_wrofs, sc->sc_write_timeout); 472 if (error) 473 goto out; 474 } 475 476 /* error is 0. */ 477 478 out: 479 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 480 return (error); 481 } 482 483 #ifdef CFI_SUPPORT_STRATAFLASH 484 /* 485 * Intel StrataFlash Protection Register Support. 486 * 487 * The memory includes a 128-bit Protection Register that can be 488 * used for security. There are two 64-bit segments; one is programmed 489 * at the factory with a unique 64-bit number which is immutable. 490 * The other segment is left blank for User (OEM) programming. 491 * The User/OEM segment is One Time Programmable (OTP). It can also 492 * be locked to prevent any further writes by setting bit 0 of the 493 * Protection Lock Register (PLR). The PLR can written only once. 494 */ 495 496 static uint16_t 497 cfi_get16(struct cfi_softc *sc, int off) 498 { 499 uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1); 500 return v; 501 } 502 503 #ifdef CFI_ARMEDANDDANGEROUS 504 static void 505 cfi_put16(struct cfi_softc *sc, int off, uint16_t v) 506 { 507 bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v); 508 } 509 #endif 510 511 /* 512 * Read the factory-defined 64-bit segment of the PR. 513 */ 514 int 515 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id) 516 { 517 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 518 return EOPNOTSUPP; 519 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 520 521 cfi_write(sc, 0, CFI_INTEL_READ_ID); 522 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 | 523 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 | 524 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 | 525 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3))); 526 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 527 return 0; 528 } 529 530 /* 531 * Read the User/OEM 64-bit segment of the PR. 532 */ 533 int 534 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id) 535 { 536 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 537 return EOPNOTSUPP; 538 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 539 540 cfi_write(sc, 0, CFI_INTEL_READ_ID); 541 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 | 542 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 | 543 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 | 544 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7))); 545 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 546 return 0; 547 } 548 549 /* 550 * Write the User/OEM 64-bit segment of the PR. 551 * XXX should allow writing individual words/bytes 552 */ 553 int 554 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id) 555 { 556 #ifdef CFI_ARMEDANDDANGEROUS 557 register_t intr; 558 int i, error; 559 #endif 560 561 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 562 return EOPNOTSUPP; 563 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 564 565 #ifdef CFI_ARMEDANDDANGEROUS 566 for (i = 7; i >= 4; i--, id >>= 16) { 567 intr = intr_disable(); 568 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 569 cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff); 570 intr_restore(intr); 571 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, 572 sc->sc_write_timeout); 573 if (error) 574 break; 575 } 576 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 577 return error; 578 #else 579 device_printf(sc->sc_dev, "%s: OEM PR not set, " 580 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 581 return ENXIO; 582 #endif 583 } 584 585 /* 586 * Read the contents of the Protection Lock Register. 587 */ 588 int 589 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr) 590 { 591 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 592 return EOPNOTSUPP; 593 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 594 595 cfi_write(sc, 0, CFI_INTEL_READ_ID); 596 *plr = cfi_get16(sc, CFI_INTEL_PLR); 597 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 598 return 0; 599 } 600 601 /* 602 * Write the Protection Lock Register to lock down the 603 * user-settable segment of the Protection Register. 604 * NOTE: this operation is not reversible. 605 */ 606 int 607 cfi_intel_set_plr(struct cfi_softc *sc) 608 { 609 #ifdef CFI_ARMEDANDDANGEROUS 610 register_t intr; 611 int error; 612 #endif 613 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 614 return EOPNOTSUPP; 615 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 616 617 #ifdef CFI_ARMEDANDDANGEROUS 618 /* worthy of console msg */ 619 device_printf(sc->sc_dev, "set PLR\n"); 620 intr = intr_disable(); 621 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 622 cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD); 623 intr_restore(intr); 624 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, sc->sc_write_timeout); 625 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 626 return error; 627 #else 628 device_printf(sc->sc_dev, "%s: PLR not set, " 629 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 630 return ENXIO; 631 #endif 632 } 633 #endif /* CFI_SUPPORT_STRATAFLASH */ 634