1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2007, Juniper Networks, Inc. 5 * Copyright (c) 2012-2013, SRI International 6 * All rights reserved. 7 * 8 * Portions of this software were developed by SRI International and the 9 * University of Cambridge Computer Laboratory under DARPA/AFRL contract 10 * (FA8750-10-C-0237) ("CTSRD"), as part of the DARPA CRASH research 11 * programme. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. Neither the name of the author nor the names of any co-contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 32 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 33 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 */ 37 38 #include <sys/cdefs.h> 39 __FBSDID("$FreeBSD$"); 40 41 #include "opt_cfi.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/bus.h> 46 #include <sys/conf.h> 47 #include <sys/endian.h> 48 #include <sys/kenv.h> 49 #include <sys/kernel.h> 50 #include <sys/malloc.h> 51 #include <sys/module.h> 52 #include <sys/rman.h> 53 #include <sys/sysctl.h> 54 55 #include <machine/bus.h> 56 57 #include <dev/cfi/cfi_reg.h> 58 #include <dev/cfi/cfi_var.h> 59 60 static void cfi_add_sysctls(struct cfi_softc *); 61 62 extern struct cdevsw cfi_cdevsw; 63 64 char cfi_driver_name[] = "cfi"; 65 devclass_t cfi_devclass; 66 devclass_t cfi_diskclass; 67 68 uint32_t 69 cfi_read_raw(struct cfi_softc *sc, u_int ofs) 70 { 71 uint32_t val; 72 73 ofs &= ~(sc->sc_width - 1); 74 switch (sc->sc_width) { 75 case 1: 76 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 77 break; 78 case 2: 79 val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 80 break; 81 case 4: 82 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 83 break; 84 default: 85 val = ~0; 86 break; 87 } 88 return (val); 89 } 90 91 uint32_t 92 cfi_read(struct cfi_softc *sc, u_int ofs) 93 { 94 uint32_t val; 95 uint16_t sval; 96 97 ofs &= ~(sc->sc_width - 1); 98 switch (sc->sc_width) { 99 case 1: 100 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs); 101 break; 102 case 2: 103 sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs); 104 #ifdef CFI_HARDWAREBYTESWAP 105 val = sval; 106 #else 107 val = le16toh(sval); 108 #endif 109 break; 110 case 4: 111 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs); 112 #ifndef CFI_HARDWAREBYTESWAP 113 val = le32toh(val); 114 #endif 115 break; 116 default: 117 val = ~0; 118 break; 119 } 120 return (val); 121 } 122 123 static void 124 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val) 125 { 126 127 ofs &= ~(sc->sc_width - 1); 128 switch (sc->sc_width) { 129 case 1: 130 bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val); 131 break; 132 case 2: 133 #ifdef CFI_HARDWAREBYTESWAP 134 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, val); 135 #else 136 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val)); 137 138 #endif 139 break; 140 case 4: 141 #ifdef CFI_HARDWAREBYTESWAP 142 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, val); 143 #else 144 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val)); 145 #endif 146 break; 147 } 148 } 149 150 /* 151 * This is same workaound as NetBSD sys/dev/nor/cfi.c cfi_reset_default() 152 */ 153 static void 154 cfi_reset_default(struct cfi_softc *sc) 155 { 156 157 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2); 158 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 159 } 160 161 uint8_t 162 cfi_read_qry(struct cfi_softc *sc, u_int ofs) 163 { 164 uint8_t val; 165 166 cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA); 167 val = cfi_read(sc, ofs * sc->sc_width); 168 cfi_reset_default(sc); 169 return (val); 170 } 171 172 static void 173 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data) 174 { 175 176 cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK); 177 cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK); 178 cfi_write(sc, ofs + addr, data); 179 } 180 181 static char * 182 cfi_fmtsize(uint32_t sz) 183 { 184 static char buf[8]; 185 static const char *sfx[] = { "", "K", "M", "G" }; 186 int sfxidx; 187 188 sfxidx = 0; 189 while (sfxidx < 3 && sz > 1023) { 190 sz /= 1024; 191 sfxidx++; 192 } 193 194 sprintf(buf, "%u%sB", sz, sfx[sfxidx]); 195 return (buf); 196 } 197 198 int 199 cfi_probe(device_t dev) 200 { 201 char desc[80]; 202 struct cfi_softc *sc; 203 char *vend_str; 204 int error; 205 uint16_t iface, vend; 206 207 sc = device_get_softc(dev); 208 sc->sc_dev = dev; 209 210 sc->sc_rid = 0; 211 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 212 RF_ACTIVE); 213 if (sc->sc_res == NULL) 214 return (ENXIO); 215 216 sc->sc_tag = rman_get_bustag(sc->sc_res); 217 sc->sc_handle = rman_get_bushandle(sc->sc_res); 218 219 if (sc->sc_width == 0) { 220 sc->sc_width = 1; 221 while (sc->sc_width <= 4) { 222 if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q') 223 break; 224 sc->sc_width <<= 1; 225 } 226 } else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') { 227 error = ENXIO; 228 goto out; 229 } 230 if (sc->sc_width > 4) { 231 error = ENXIO; 232 goto out; 233 } 234 235 /* We got a Q. Check if we also have the R and the Y. */ 236 if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' || 237 cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') { 238 error = ENXIO; 239 goto out; 240 } 241 242 /* Get the vendor and command set. */ 243 vend = cfi_read_qry(sc, CFI_QRY_VEND) | 244 (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8); 245 246 sc->sc_cmdset = vend; 247 248 switch (vend) { 249 case CFI_VEND_AMD_ECS: 250 case CFI_VEND_AMD_SCS: 251 vend_str = "AMD/Fujitsu"; 252 break; 253 case CFI_VEND_INTEL_ECS: 254 vend_str = "Intel/Sharp"; 255 break; 256 case CFI_VEND_INTEL_SCS: 257 vend_str = "Intel"; 258 break; 259 case CFI_VEND_MITSUBISHI_ECS: 260 case CFI_VEND_MITSUBISHI_SCS: 261 vend_str = "Mitsubishi"; 262 break; 263 default: 264 vend_str = "Unknown vendor"; 265 break; 266 } 267 268 /* Get the device size. */ 269 sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE); 270 271 /* Sanity-check the I/F */ 272 iface = cfi_read_qry(sc, CFI_QRY_IFACE) | 273 (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8); 274 275 /* 276 * Adding 1 to iface will give us a bit-wise "switch" 277 * that allows us to test for the interface width by 278 * testing a single bit. 279 */ 280 iface++; 281 282 error = (iface & sc->sc_width) ? 0 : EINVAL; 283 if (error) 284 goto out; 285 286 snprintf(desc, sizeof(desc), "%s - %s", vend_str, 287 cfi_fmtsize(sc->sc_size)); 288 device_set_desc_copy(dev, desc); 289 290 out: 291 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 292 return (error); 293 } 294 295 int 296 cfi_attach(device_t dev) 297 { 298 struct cfi_softc *sc; 299 u_int blksz, blocks; 300 u_int r, u; 301 uint64_t mtoexp, ttoexp; 302 #ifdef CFI_SUPPORT_STRATAFLASH 303 uint64_t ppr; 304 char name[KENV_MNAMELEN], value[32]; 305 #endif 306 307 sc = device_get_softc(dev); 308 sc->sc_dev = dev; 309 310 sc->sc_rid = 0; 311 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid, 312 #ifndef ATSE_CFI_HACK 313 RF_ACTIVE); 314 #else 315 RF_ACTIVE | RF_SHAREABLE); 316 #endif 317 if (sc->sc_res == NULL) 318 return (ENXIO); 319 320 sc->sc_tag = rman_get_bustag(sc->sc_res); 321 sc->sc_handle = rman_get_bushandle(sc->sc_res); 322 323 /* Get time-out values for erase, write, and buffer write. */ 324 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_ERASE); 325 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_ERASE); 326 if (ttoexp == 0) { 327 device_printf(dev, "erase timeout == 0, using 2^16ms\n"); 328 ttoexp = 16; 329 } 330 if (ttoexp > 41) { 331 device_printf(dev, "insane timeout: 2^%jdms\n", ttoexp); 332 return (EINVAL); 333 } 334 if (mtoexp == 0) { 335 device_printf(dev, "max erase timeout == 0, using 2^%jdms\n", 336 ttoexp + 4); 337 mtoexp = 4; 338 } 339 if (ttoexp + mtoexp > 41) { 340 device_printf(dev, "insane max erase timeout: 2^%jd\n", 341 ttoexp + mtoexp); 342 return (EINVAL); 343 } 344 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] = SBT_1MS * (1ULL << ttoexp); 345 sc->sc_max_timeouts[CFI_TIMEOUT_ERASE] = 346 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] * (1ULL << mtoexp); 347 348 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_WRITE); 349 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_WRITE); 350 if (ttoexp == 0) { 351 device_printf(dev, "write timeout == 0, using 2^18ns\n"); 352 ttoexp = 18; 353 } 354 if (ttoexp > 51) { 355 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp); 356 return (EINVAL); 357 } 358 if (mtoexp == 0) { 359 device_printf(dev, "max write timeout == 0, using 2^%jdms\n", 360 ttoexp + 4); 361 mtoexp = 4; 362 } 363 if (ttoexp + mtoexp > 51) { 364 device_printf(dev, "insane max write timeout: 2^%jdus\n", 365 ttoexp + mtoexp); 366 return (EINVAL); 367 } 368 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] = SBT_1US * (1ULL << ttoexp); 369 sc->sc_max_timeouts[CFI_TIMEOUT_WRITE] = 370 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] * (1ULL << mtoexp); 371 372 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE); 373 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE); 374 /* Don't check for 0, it means not-supported. */ 375 if (ttoexp > 51) { 376 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp); 377 return (EINVAL); 378 } 379 if (ttoexp + mtoexp > 51) { 380 device_printf(dev, "insane max write timeout: 2^%jdus\n", 381 ttoexp + mtoexp); 382 return (EINVAL); 383 } 384 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] = 385 SBT_1US * (1ULL << cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE)); 386 sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE] = 387 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] * 388 (1ULL << cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE)); 389 390 /* Get the maximum size of a multibyte program */ 391 if (sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] != 0) 392 sc->sc_maxbuf = 1 << (cfi_read_qry(sc, CFI_QRY_MAXBUF) | 393 cfi_read_qry(sc, CFI_QRY_MAXBUF) << 8); 394 else 395 sc->sc_maxbuf = 0; 396 397 /* Get erase regions. */ 398 sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS); 399 sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region), 400 M_TEMP, M_WAITOK | M_ZERO); 401 for (r = 0; r < sc->sc_regions; r++) { 402 blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) | 403 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8); 404 sc->sc_region[r].r_blocks = blocks + 1; 405 406 blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) | 407 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8); 408 sc->sc_region[r].r_blksz = (blksz == 0) ? 128 : 409 blksz * 256; 410 } 411 412 /* Reset the device to a default state. */ 413 cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS); 414 415 if (bootverbose) { 416 device_printf(dev, "["); 417 for (r = 0; r < sc->sc_regions; r++) { 418 printf("%ux%s%s", sc->sc_region[r].r_blocks, 419 cfi_fmtsize(sc->sc_region[r].r_blksz), 420 (r == sc->sc_regions - 1) ? "]\n" : ","); 421 } 422 } 423 424 if (sc->sc_cmdset == CFI_VEND_AMD_ECS || 425 sc->sc_cmdset == CFI_VEND_AMD_SCS) { 426 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_AUTO_SELECT); 427 sc->sc_manid = cfi_read(sc, 0); 428 sc->sc_devid = cfi_read(sc, 2); 429 device_printf(dev, "Manufacturer ID:%x Device ID:%x\n", 430 sc->sc_manid, sc->sc_devid); 431 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2); 432 } 433 434 u = device_get_unit(dev); 435 sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600, 436 "%s%u", cfi_driver_name, u); 437 sc->sc_nod->si_drv1 = sc; 438 439 cfi_add_sysctls(sc); 440 441 #ifdef CFI_SUPPORT_STRATAFLASH 442 /* 443 * Store the Intel factory PPR in the environment. In some 444 * cases it is the most unique ID on a board. 445 */ 446 if (cfi_intel_get_factory_pr(sc, &ppr) == 0) { 447 if (snprintf(name, sizeof(name), "%s.factory_ppr", 448 device_get_nameunit(dev)) < (sizeof(name) - 1) && 449 snprintf(value, sizeof(value), "0x%016jx", ppr) < 450 (sizeof(value) - 1)) 451 (void) kern_setenv(name, value); 452 } 453 #endif 454 455 device_add_child(dev, "cfid", -1); 456 bus_generic_attach(dev); 457 458 return (0); 459 } 460 461 static void 462 cfi_add_sysctls(struct cfi_softc *sc) 463 { 464 struct sysctl_ctx_list *ctx; 465 struct sysctl_oid_list *children; 466 467 ctx = device_get_sysctl_ctx(sc->sc_dev); 468 children = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev)); 469 470 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 471 "typical_erase_timout_count", 472 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_ERASE], 473 0, "Number of times the typical erase timeout was exceeded"); 474 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 475 "max_erase_timout_count", 476 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_ERASE], 0, 477 "Number of times the maximum erase timeout was exceeded"); 478 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 479 "typical_write_timout_count", 480 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_WRITE], 0, 481 "Number of times the typical write timeout was exceeded"); 482 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 483 "max_write_timout_count", 484 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_WRITE], 0, 485 "Number of times the maximum write timeout was exceeded"); 486 if (sc->sc_maxbuf > 0) { 487 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 488 "typical_bufwrite_timout_count", 489 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_BUFWRITE], 0, 490 "Number of times the typical buffered write timeout was " 491 "exceeded"); 492 SYSCTL_ADD_UINT(ctx, children, OID_AUTO, 493 "max_bufwrite_timout_count", 494 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_BUFWRITE], 0, 495 "Number of times the maximum buffered write timeout was " 496 "exceeded"); 497 } 498 } 499 500 int 501 cfi_detach(device_t dev) 502 { 503 struct cfi_softc *sc; 504 505 sc = device_get_softc(dev); 506 507 destroy_dev(sc->sc_nod); 508 free(sc->sc_region, M_TEMP); 509 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res); 510 return (0); 511 } 512 513 static bool 514 cfi_check_erase(struct cfi_softc *sc, u_int ofs, u_int sz) 515 { 516 bool result; 517 int i; 518 uint32_t val; 519 520 result = FALSE; 521 for (i = 0; i < sz; i += sc->sc_width) { 522 val = cfi_read(sc, ofs + i); 523 switch (sc->sc_width) { 524 case 1: 525 if (val != 0xff) 526 goto out; 527 continue; 528 case 2: 529 if (val != 0xffff) 530 goto out; 531 continue; 532 case 4: 533 if (val != 0xffffffff) 534 goto out; 535 continue; 536 } 537 } 538 result = TRUE; 539 540 out: 541 return (result); 542 } 543 544 static int 545 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, sbintime_t start, 546 enum cfi_wait_cmd cmd) 547 { 548 int done, error, tto_exceeded; 549 uint32_t st0 = 0, st = 0; 550 sbintime_t now; 551 552 done = 0; 553 error = 0; 554 tto_exceeded = 0; 555 while (!done && !error) { 556 /* 557 * Save time before we start so we always do one check 558 * after the timeout has expired. 559 */ 560 now = sbinuptime(); 561 562 switch (sc->sc_cmdset) { 563 case CFI_VEND_INTEL_ECS: 564 case CFI_VEND_INTEL_SCS: 565 st = cfi_read(sc, ofs); 566 done = (st & CFI_INTEL_STATUS_WSMS); 567 if (done) { 568 /* NB: bit 0 is reserved */ 569 st &= ~(CFI_INTEL_XSTATUS_RSVD | 570 CFI_INTEL_STATUS_WSMS | 571 CFI_INTEL_STATUS_RSVD); 572 if (st & CFI_INTEL_STATUS_DPS) 573 error = EPERM; 574 else if (st & CFI_INTEL_STATUS_PSLBS) 575 error = EIO; 576 else if (st & CFI_INTEL_STATUS_ECLBS) 577 error = ENXIO; 578 else if (st) 579 error = EACCES; 580 } 581 break; 582 case CFI_VEND_AMD_SCS: 583 case CFI_VEND_AMD_ECS: 584 st0 = cfi_read(sc, ofs); 585 st = cfi_read(sc, ofs); 586 done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0; 587 break; 588 } 589 590 if (tto_exceeded || 591 now > start + sc->sc_typical_timeouts[cmd]) { 592 if (!tto_exceeded) { 593 tto_exceeded = 1; 594 sc->sc_tto_counts[cmd]++; 595 #ifdef CFI_DEBUG_TIMEOUT 596 device_printf(sc->sc_dev, 597 "typical timeout exceeded (cmd %d)", cmd); 598 #endif 599 } 600 if (now > start + sc->sc_max_timeouts[cmd]) { 601 sc->sc_mto_counts[cmd]++; 602 #ifdef CFI_DEBUG_TIMEOUT 603 device_printf(sc->sc_dev, 604 "max timeout exceeded (cmd %d)", cmd); 605 #endif 606 } 607 } 608 } 609 if (!done && !error) 610 error = ETIMEDOUT; 611 if (error) 612 printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0); 613 return (error); 614 } 615 616 int 617 cfi_write_block(struct cfi_softc *sc) 618 { 619 union { 620 uint8_t *x8; 621 uint16_t *x16; 622 uint32_t *x32; 623 } ptr, cpyprt; 624 register_t intr; 625 int error, i, j, neederase = 0; 626 uint32_t st; 627 u_int wlen; 628 sbintime_t start; 629 u_int minsz; 630 uint32_t val; 631 632 /* Intel flash must be unlocked before modification */ 633 switch (sc->sc_cmdset) { 634 case CFI_VEND_INTEL_ECS: 635 case CFI_VEND_INTEL_SCS: 636 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS); 637 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_UB); 638 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY); 639 break; 640 } 641 642 /* Check if an erase is required. */ 643 for (i = 0; i < sc->sc_wrbufsz; i++) 644 if ((sc->sc_wrbuf[i] & sc->sc_wrbufcpy[i]) != sc->sc_wrbuf[i]) { 645 neederase = 1; 646 break; 647 } 648 649 if (neederase) { 650 intr = intr_disable(); 651 start = sbinuptime(); 652 /* Erase the block. */ 653 switch (sc->sc_cmdset) { 654 case CFI_VEND_INTEL_ECS: 655 case CFI_VEND_INTEL_SCS: 656 cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE); 657 cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM); 658 break; 659 case CFI_VEND_AMD_SCS: 660 case CFI_VEND_AMD_ECS: 661 /* find minimum sector size */ 662 minsz = sc->sc_region[0].r_blksz; 663 for (i = 1; i < sc->sc_regions; i++) { 664 if (sc->sc_region[i].r_blksz < minsz) 665 minsz = sc->sc_region[i].r_blksz; 666 } 667 cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START, 668 CFI_AMD_ERASE_SECTOR); 669 cfi_amd_write(sc, sc->sc_wrofs, 670 sc->sc_wrofs >> (ffs(minsz) - 1), 671 CFI_AMD_BLOCK_ERASE); 672 for (i = 0; i < CFI_AMD_MAXCHK; ++i) { 673 if (cfi_check_erase(sc, sc->sc_wrofs, 674 sc->sc_wrbufsz)) 675 break; 676 DELAY(10); 677 } 678 if (i == CFI_AMD_MAXCHK) { 679 printf("\nCFI Sector Erase time out error\n"); 680 return (ENODEV); 681 } 682 break; 683 default: 684 /* Better safe than sorry... */ 685 intr_restore(intr); 686 return (ENODEV); 687 } 688 intr_restore(intr); 689 error = cfi_wait_ready(sc, sc->sc_wrofs, start, 690 CFI_TIMEOUT_ERASE); 691 if (error) 692 goto out; 693 } else 694 error = 0; 695 696 /* Write the block using a multibyte write if supported. */ 697 ptr.x8 = sc->sc_wrbuf; 698 cpyprt.x8 = sc->sc_wrbufcpy; 699 if (sc->sc_maxbuf > sc->sc_width) { 700 switch (sc->sc_cmdset) { 701 case CFI_VEND_INTEL_ECS: 702 case CFI_VEND_INTEL_SCS: 703 for (i = 0; i < sc->sc_wrbufsz; i += wlen) { 704 wlen = MIN(sc->sc_maxbuf, sc->sc_wrbufsz - i); 705 706 intr = intr_disable(); 707 708 start = sbinuptime(); 709 do { 710 cfi_write(sc, sc->sc_wrofs + i, 711 CFI_BCS_BUF_PROG_SETUP); 712 if (sbinuptime() > start + sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE]) { 713 error = ETIMEDOUT; 714 goto out; 715 } 716 st = cfi_read(sc, sc->sc_wrofs + i); 717 } while (! (st & CFI_INTEL_STATUS_WSMS)); 718 719 cfi_write(sc, sc->sc_wrofs + i, 720 (wlen / sc->sc_width) - 1); 721 switch (sc->sc_width) { 722 case 1: 723 bus_space_write_region_1(sc->sc_tag, 724 sc->sc_handle, sc->sc_wrofs + i, 725 ptr.x8 + i, wlen); 726 break; 727 case 2: 728 bus_space_write_region_2(sc->sc_tag, 729 sc->sc_handle, sc->sc_wrofs + i, 730 ptr.x16 + i / 2, wlen / 2); 731 break; 732 case 4: 733 bus_space_write_region_4(sc->sc_tag, 734 sc->sc_handle, sc->sc_wrofs + i, 735 ptr.x32 + i / 4, wlen / 4); 736 break; 737 } 738 739 cfi_write(sc, sc->sc_wrofs + i, 740 CFI_BCS_CONFIRM); 741 742 intr_restore(intr); 743 744 error = cfi_wait_ready(sc, sc->sc_wrofs + i, 745 start, CFI_TIMEOUT_BUFWRITE); 746 if (error != 0) 747 goto out; 748 } 749 goto out; 750 default: 751 /* Fall through to single word case */ 752 break; 753 } 754 755 } 756 757 /* Write the block one byte/word at a time. */ 758 for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) { 759 760 /* Avoid writing unless we are actually changing bits */ 761 if (!neederase) { 762 switch (sc->sc_width) { 763 case 1: 764 if(*(ptr.x8 + i) == *(cpyprt.x8 + i)) 765 continue; 766 break; 767 case 2: 768 if(*(ptr.x16 + i / 2) == *(cpyprt.x16 + i / 2)) 769 continue; 770 break; 771 case 4: 772 if(*(ptr.x32 + i / 4) == *(cpyprt.x32 + i / 4)) 773 continue; 774 break; 775 } 776 } 777 778 /* 779 * Make sure the command to start a write and the 780 * actual write happens back-to-back without any 781 * excessive delays. 782 */ 783 intr = intr_disable(); 784 785 start = sbinuptime(); 786 switch (sc->sc_cmdset) { 787 case CFI_VEND_INTEL_ECS: 788 case CFI_VEND_INTEL_SCS: 789 cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM); 790 break; 791 case CFI_VEND_AMD_SCS: 792 case CFI_VEND_AMD_ECS: 793 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM); 794 break; 795 } 796 switch (sc->sc_width) { 797 case 1: 798 bus_space_write_1(sc->sc_tag, sc->sc_handle, 799 sc->sc_wrofs + i, *(ptr.x8 + i)); 800 break; 801 case 2: 802 bus_space_write_2(sc->sc_tag, sc->sc_handle, 803 sc->sc_wrofs + i, *(ptr.x16 + i / 2)); 804 break; 805 case 4: 806 bus_space_write_4(sc->sc_tag, sc->sc_handle, 807 sc->sc_wrofs + i, *(ptr.x32 + i / 4)); 808 break; 809 } 810 811 intr_restore(intr); 812 813 if (sc->sc_cmdset == CFI_VEND_AMD_ECS || 814 sc->sc_cmdset == CFI_VEND_AMD_SCS) { 815 for (j = 0; j < CFI_AMD_MAXCHK; ++j) { 816 switch (sc->sc_width) { 817 case 1: 818 val = *(ptr.x8 + i); 819 break; 820 case 2: 821 val = *(ptr.x16 + i / 2); 822 break; 823 case 4: 824 val = *(ptr.x32 + i / 4); 825 break; 826 } 827 828 if (cfi_read(sc, sc->sc_wrofs + i) == val) 829 break; 830 831 DELAY(10); 832 } 833 if (j == CFI_AMD_MAXCHK) { 834 printf("\nCFI Program Verify time out error\n"); 835 error = ENXIO; 836 goto out; 837 } 838 } else { 839 error = cfi_wait_ready(sc, sc->sc_wrofs, start, 840 CFI_TIMEOUT_WRITE); 841 if (error) 842 goto out; 843 } 844 } 845 846 /* error is 0. */ 847 848 out: 849 cfi_reset_default(sc); 850 851 /* Relock Intel flash */ 852 switch (sc->sc_cmdset) { 853 case CFI_VEND_INTEL_ECS: 854 case CFI_VEND_INTEL_SCS: 855 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS); 856 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LB); 857 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY); 858 break; 859 } 860 return (error); 861 } 862 863 #ifdef CFI_SUPPORT_STRATAFLASH 864 /* 865 * Intel StrataFlash Protection Register Support. 866 * 867 * The memory includes a 128-bit Protection Register that can be 868 * used for security. There are two 64-bit segments; one is programmed 869 * at the factory with a unique 64-bit number which is immutable. 870 * The other segment is left blank for User (OEM) programming. 871 * The User/OEM segment is One Time Programmable (OTP). It can also 872 * be locked to prevent any further writes by setting bit 0 of the 873 * Protection Lock Register (PLR). The PLR can written only once. 874 */ 875 876 static uint16_t 877 cfi_get16(struct cfi_softc *sc, int off) 878 { 879 uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1); 880 return v; 881 } 882 883 #ifdef CFI_ARMEDANDDANGEROUS 884 static void 885 cfi_put16(struct cfi_softc *sc, int off, uint16_t v) 886 { 887 bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v); 888 } 889 #endif 890 891 /* 892 * Read the factory-defined 64-bit segment of the PR. 893 */ 894 int 895 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id) 896 { 897 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 898 return EOPNOTSUPP; 899 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 900 901 cfi_write(sc, 0, CFI_INTEL_READ_ID); 902 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 | 903 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 | 904 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 | 905 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3))); 906 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 907 return 0; 908 } 909 910 /* 911 * Read the User/OEM 64-bit segment of the PR. 912 */ 913 int 914 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id) 915 { 916 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 917 return EOPNOTSUPP; 918 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 919 920 cfi_write(sc, 0, CFI_INTEL_READ_ID); 921 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 | 922 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 | 923 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 | 924 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7))); 925 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 926 return 0; 927 } 928 929 /* 930 * Write the User/OEM 64-bit segment of the PR. 931 * XXX should allow writing individual words/bytes 932 */ 933 int 934 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id) 935 { 936 #ifdef CFI_ARMEDANDDANGEROUS 937 register_t intr; 938 int i, error; 939 sbintime_t start; 940 #endif 941 942 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 943 return EOPNOTSUPP; 944 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 945 946 #ifdef CFI_ARMEDANDDANGEROUS 947 for (i = 7; i >= 4; i--, id >>= 16) { 948 intr = intr_disable(); 949 start = sbinuptime(); 950 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 951 cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff); 952 intr_restore(intr); 953 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start, 954 CFI_TIMEOUT_WRITE); 955 if (error) 956 break; 957 } 958 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 959 return error; 960 #else 961 device_printf(sc->sc_dev, "%s: OEM PR not set, " 962 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 963 return ENXIO; 964 #endif 965 } 966 967 /* 968 * Read the contents of the Protection Lock Register. 969 */ 970 int 971 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr) 972 { 973 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 974 return EOPNOTSUPP; 975 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 976 977 cfi_write(sc, 0, CFI_INTEL_READ_ID); 978 *plr = cfi_get16(sc, CFI_INTEL_PLR); 979 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 980 return 0; 981 } 982 983 /* 984 * Write the Protection Lock Register to lock down the 985 * user-settable segment of the Protection Register. 986 * NOTE: this operation is not reversible. 987 */ 988 int 989 cfi_intel_set_plr(struct cfi_softc *sc) 990 { 991 #ifdef CFI_ARMEDANDDANGEROUS 992 register_t intr; 993 int error; 994 sbintime_t start; 995 #endif 996 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS) 997 return EOPNOTSUPP; 998 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width)); 999 1000 #ifdef CFI_ARMEDANDDANGEROUS 1001 /* worthy of console msg */ 1002 device_printf(sc->sc_dev, "set PLR\n"); 1003 intr = intr_disable(); 1004 binuptime(&start); 1005 cfi_write(sc, 0, CFI_INTEL_PP_SETUP); 1006 cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD); 1007 intr_restore(intr); 1008 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start, 1009 CFI_TIMEOUT_WRITE); 1010 cfi_write(sc, 0, CFI_BCS_READ_ARRAY); 1011 return error; 1012 #else 1013 device_printf(sc->sc_dev, "%s: PLR not set, " 1014 "CFI_ARMEDANDDANGEROUS not configured\n", __func__); 1015 return ENXIO; 1016 #endif 1017 } 1018 #endif /* CFI_SUPPORT_STRATAFLASH */ 1019