xref: /freebsd/sys/dev/cfi/cfi_core.c (revision eda14cbc264d6969b02f2b1994cef11148e914f1)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2007, Juniper Networks, Inc.
5  * Copyright (c) 2012-2013, SRI International
6  * All rights reserved.
7  *
8  * Portions of this software were developed by SRI International and the
9  * University of Cambridge Computer Laboratory under DARPA/AFRL contract
10  * (FA8750-10-C-0237) ("CTSRD"), as part of the DARPA CRASH research
11  * programme.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the author nor the names of any co-contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
32  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
33  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include "opt_cfi.h"
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/bus.h>
46 #include <sys/conf.h>
47 #include <sys/endian.h>
48 #include <sys/kenv.h>
49 #include <sys/kernel.h>
50 #include <sys/malloc.h>
51 #include <sys/module.h>
52 #include <sys/rman.h>
53 #include <sys/sysctl.h>
54 
55 #include <machine/bus.h>
56 
57 #include <dev/cfi/cfi_reg.h>
58 #include <dev/cfi/cfi_var.h>
59 
60 static void cfi_add_sysctls(struct cfi_softc *);
61 
62 extern struct cdevsw cfi_cdevsw;
63 
64 char cfi_driver_name[] = "cfi";
65 devclass_t cfi_devclass;
66 devclass_t cfi_diskclass;
67 
68 uint32_t
69 cfi_read_raw(struct cfi_softc *sc, u_int ofs)
70 {
71 	uint32_t val;
72 
73 	ofs &= ~(sc->sc_width - 1);
74 	switch (sc->sc_width) {
75 	case 1:
76 		val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
77 		break;
78 	case 2:
79 		val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
80 		break;
81 	case 4:
82 		val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
83 		break;
84 	default:
85 		val = ~0;
86 		break;
87 	}
88 	return (val);
89 }
90 
91 uint32_t
92 cfi_read(struct cfi_softc *sc, u_int ofs)
93 {
94 	uint32_t val;
95 	uint16_t sval;
96 
97 	ofs &= ~(sc->sc_width - 1);
98 	switch (sc->sc_width) {
99 	case 1:
100 		val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
101 		break;
102 	case 2:
103 		sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
104 #ifdef CFI_HARDWAREBYTESWAP
105 		val = sval;
106 #else
107 		val = le16toh(sval);
108 #endif
109 		break;
110 	case 4:
111 		val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
112 #ifndef CFI_HARDWAREBYTESWAP
113 		val = le32toh(val);
114 #endif
115 		break;
116 	default:
117 		val = ~0;
118 		break;
119 	}
120 	return (val);
121 }
122 
123 static void
124 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val)
125 {
126 
127 	ofs &= ~(sc->sc_width - 1);
128 	switch (sc->sc_width) {
129 	case 1:
130 		bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val);
131 		break;
132 	case 2:
133 #ifdef CFI_HARDWAREBYTESWAP
134 		bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, val);
135 #else
136 		bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val));
137 
138 #endif
139 		break;
140 	case 4:
141 #ifdef CFI_HARDWAREBYTESWAP
142 		bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, val);
143 #else
144 		bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val));
145 #endif
146 		break;
147 	}
148 }
149 
150 /*
151  * This is same workaound as NetBSD sys/dev/nor/cfi.c cfi_reset_default()
152  */
153 static void
154 cfi_reset_default(struct cfi_softc *sc)
155 {
156 
157 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY2);
158 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
159 }
160 
161 uint8_t
162 cfi_read_qry(struct cfi_softc *sc, u_int ofs)
163 {
164 	uint8_t val;
165 
166 	cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA);
167 	val = cfi_read(sc, ofs * sc->sc_width);
168 	cfi_reset_default(sc);
169 	return (val);
170 }
171 
172 static void
173 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data)
174 {
175 
176 	cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK);
177 	cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK);
178 	cfi_write(sc, ofs + addr, data);
179 }
180 
181 static char *
182 cfi_fmtsize(uint32_t sz)
183 {
184 	static char buf[8];
185 	static const char *sfx[] = { "", "K", "M", "G" };
186 	int sfxidx;
187 
188 	sfxidx = 0;
189 	while (sfxidx < 3 && sz > 1023) {
190 		sz /= 1024;
191 		sfxidx++;
192 	}
193 
194 	sprintf(buf, "%u%sB", sz, sfx[sfxidx]);
195 	return (buf);
196 }
197 
198 int
199 cfi_probe(device_t dev)
200 {
201 	char desc[80];
202 	struct cfi_softc *sc;
203 	char *vend_str;
204 	int error;
205 	uint16_t iface, vend;
206 
207 	sc = device_get_softc(dev);
208 	sc->sc_dev = dev;
209 
210 	sc->sc_rid = 0;
211 	sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
212 	    RF_ACTIVE);
213 	if (sc->sc_res == NULL)
214 		return (ENXIO);
215 
216 	sc->sc_tag = rman_get_bustag(sc->sc_res);
217 	sc->sc_handle = rman_get_bushandle(sc->sc_res);
218 
219 	if (sc->sc_width == 0) {
220 		sc->sc_width = 1;
221 		while (sc->sc_width <= 4) {
222 			if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q')
223 				break;
224 			sc->sc_width <<= 1;
225 		}
226 	} else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') {
227 		error = ENXIO;
228 		goto out;
229 	}
230 	if (sc->sc_width > 4) {
231 		error = ENXIO;
232 		goto out;
233 	}
234 
235 	/* We got a Q. Check if we also have the R and the Y. */
236 	if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' ||
237 	    cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') {
238 		error = ENXIO;
239 		goto out;
240 	}
241 
242 	/* Get the vendor and command set. */
243 	vend = cfi_read_qry(sc, CFI_QRY_VEND) |
244 	    (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8);
245 
246 	sc->sc_cmdset = vend;
247 
248 	switch (vend) {
249 	case CFI_VEND_AMD_ECS:
250 	case CFI_VEND_AMD_SCS:
251 		vend_str = "AMD/Fujitsu";
252 		break;
253 	case CFI_VEND_INTEL_ECS:
254 		vend_str = "Intel/Sharp";
255 		break;
256 	case CFI_VEND_INTEL_SCS:
257 		vend_str = "Intel";
258 		break;
259 	case CFI_VEND_MITSUBISHI_ECS:
260 	case CFI_VEND_MITSUBISHI_SCS:
261 		vend_str = "Mitsubishi";
262 		break;
263 	default:
264 		vend_str = "Unknown vendor";
265 		break;
266 	}
267 
268 	/* Get the device size. */
269 	sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE);
270 
271 	/* Sanity-check the I/F */
272 	iface = cfi_read_qry(sc, CFI_QRY_IFACE) |
273 	    (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8);
274 
275 	/*
276 	 * Adding 1 to iface will give us a bit-wise "switch"
277 	 * that allows us to test for the interface width by
278 	 * testing a single bit.
279 	 */
280 	iface++;
281 
282 	error = (iface & sc->sc_width) ? 0 : EINVAL;
283 	if (error)
284 		goto out;
285 
286 	snprintf(desc, sizeof(desc), "%s - %s", vend_str,
287 	    cfi_fmtsize(sc->sc_size));
288 	device_set_desc_copy(dev, desc);
289 
290  out:
291 	bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
292 	return (error);
293 }
294 
295 int
296 cfi_attach(device_t dev)
297 {
298 	struct cfi_softc *sc;
299 	u_int blksz, blocks;
300 	u_int r, u;
301 	uint64_t mtoexp, ttoexp;
302 #ifdef CFI_SUPPORT_STRATAFLASH
303 	uint64_t ppr;
304 	char name[KENV_MNAMELEN], value[32];
305 #endif
306 
307 	sc = device_get_softc(dev);
308 	sc->sc_dev = dev;
309 
310 	sc->sc_rid = 0;
311 	sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
312 #ifndef ATSE_CFI_HACK
313 	    RF_ACTIVE);
314 #else
315 	    RF_ACTIVE | RF_SHAREABLE);
316 #endif
317 	if (sc->sc_res == NULL)
318 		return (ENXIO);
319 
320 	sc->sc_tag = rman_get_bustag(sc->sc_res);
321 	sc->sc_handle = rman_get_bushandle(sc->sc_res);
322 
323 	/* Get time-out values for erase, write, and buffer write. */
324 	ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_ERASE);
325 	mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_ERASE);
326 	if (ttoexp == 0) {
327 		device_printf(dev, "erase timeout == 0, using 2^16ms\n");
328 		ttoexp = 16;
329 	}
330 	if (ttoexp > 41) {
331 		device_printf(dev, "insane timeout: 2^%jdms\n", ttoexp);
332 		return (EINVAL);
333 	}
334 	if (mtoexp == 0) {
335 		device_printf(dev, "max erase timeout == 0, using 2^%jdms\n",
336 		    ttoexp + 4);
337 		mtoexp = 4;
338 	}
339 	if (ttoexp + mtoexp > 41) {
340 		device_printf(dev, "insane max erase timeout: 2^%jd\n",
341 		    ttoexp + mtoexp);
342 		return (EINVAL);
343 	}
344 	sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] = SBT_1MS * (1ULL << ttoexp);
345 	sc->sc_max_timeouts[CFI_TIMEOUT_ERASE] =
346 	    sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] * (1ULL << mtoexp);
347 
348 	ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_WRITE);
349 	mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_WRITE);
350 	if (ttoexp == 0) {
351 		device_printf(dev, "write timeout == 0, using 2^18ns\n");
352 		ttoexp = 18;
353 	}
354 	if (ttoexp > 51) {
355 		device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp);
356 		return (EINVAL);
357 	}
358 	if (mtoexp == 0) {
359 		device_printf(dev, "max write timeout == 0, using 2^%jdms\n",
360 		    ttoexp + 4);
361 		mtoexp = 4;
362 	}
363 	if (ttoexp + mtoexp > 51) {
364 		device_printf(dev, "insane max write timeout: 2^%jdus\n",
365 		    ttoexp + mtoexp);
366 		return (EINVAL);
367 	}
368 	sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] = SBT_1US * (1ULL << ttoexp);
369 	sc->sc_max_timeouts[CFI_TIMEOUT_WRITE] =
370 	    sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] * (1ULL << mtoexp);
371 
372 	ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE);
373 	mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE);
374 	/* Don't check for 0, it means not-supported. */
375 	if (ttoexp > 51) {
376 		device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp);
377 		return (EINVAL);
378 	}
379 	if (ttoexp + mtoexp > 51) {
380 		device_printf(dev, "insane max write timeout: 2^%jdus\n",
381 		    ttoexp + mtoexp);
382 		return (EINVAL);
383 	}
384 	sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] =
385 	    SBT_1US * (1ULL << cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE));
386 	sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE] =
387 	    sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] *
388 	    (1ULL << cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE));
389 
390 	/* Get the maximum size of a multibyte program */
391 	if (sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] != 0)
392 		sc->sc_maxbuf = 1 << (cfi_read_qry(sc, CFI_QRY_MAXBUF) |
393 		    cfi_read_qry(sc, CFI_QRY_MAXBUF) << 8);
394 	else
395 		sc->sc_maxbuf = 0;
396 
397 	/* Get erase regions. */
398 	sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS);
399 	sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region),
400 	    M_TEMP, M_WAITOK | M_ZERO);
401 	for (r = 0; r < sc->sc_regions; r++) {
402 		blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) |
403 		    (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8);
404 		sc->sc_region[r].r_blocks = blocks + 1;
405 
406 		blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) |
407 		    (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8);
408 		sc->sc_region[r].r_blksz = (blksz == 0) ? 128 :
409 		    blksz * 256;
410 	}
411 
412 	/* Reset the device to a default state. */
413 	cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS);
414 
415 	if (bootverbose) {
416 		device_printf(dev, "[");
417 		for (r = 0; r < sc->sc_regions; r++) {
418 			printf("%ux%s%s", sc->sc_region[r].r_blocks,
419 			    cfi_fmtsize(sc->sc_region[r].r_blksz),
420 			    (r == sc->sc_regions - 1) ? "]\n" : ",");
421 		}
422 	}
423 
424 	if (sc->sc_cmdset == CFI_VEND_AMD_ECS  ||
425 	    sc->sc_cmdset == CFI_VEND_AMD_SCS) {
426 		cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_AUTO_SELECT);
427 		sc->sc_manid = cfi_read(sc, 0);
428 		sc->sc_devid = cfi_read(sc, 2);
429 		device_printf(dev, "Manufacturer ID:%x Device ID:%x\n",
430 		    sc->sc_manid, sc->sc_devid);
431 		cfi_write(sc, 0, CFI_BCS_READ_ARRAY2);
432 	}
433 
434 	u = device_get_unit(dev);
435 	sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600,
436 	    "%s%u", cfi_driver_name, u);
437 	sc->sc_nod->si_drv1 = sc;
438 
439 	cfi_add_sysctls(sc);
440 
441 #ifdef CFI_SUPPORT_STRATAFLASH
442 	/*
443 	 * Store the Intel factory PPR in the environment.  In some
444 	 * cases it is the most unique ID on a board.
445 	 */
446 	if (cfi_intel_get_factory_pr(sc, &ppr) == 0) {
447 		if (snprintf(name, sizeof(name), "%s.factory_ppr",
448 		    device_get_nameunit(dev)) < (sizeof(name) - 1) &&
449 		    snprintf(value, sizeof(value), "0x%016jx", ppr) <
450 		    (sizeof(value) - 1))
451 			(void) kern_setenv(name, value);
452 	}
453 #endif
454 
455 	device_add_child(dev, "cfid", -1);
456 	bus_generic_attach(dev);
457 
458 	return (0);
459 }
460 
461 static void
462 cfi_add_sysctls(struct cfi_softc *sc)
463 {
464 	struct sysctl_ctx_list *ctx;
465 	struct sysctl_oid_list *children;
466 
467 	ctx = device_get_sysctl_ctx(sc->sc_dev);
468 	children = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
469 
470 	SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
471 	    "typical_erase_timout_count",
472 	    CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_ERASE],
473 	    0, "Number of times the typical erase timeout was exceeded");
474 	SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
475 	    "max_erase_timout_count",
476 	    CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_ERASE], 0,
477 	    "Number of times the maximum erase timeout was exceeded");
478 	SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
479 	    "typical_write_timout_count",
480 	    CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_WRITE], 0,
481 	    "Number of times the typical write timeout was exceeded");
482 	SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
483 	    "max_write_timout_count",
484 	    CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_WRITE], 0,
485 	    "Number of times the maximum write timeout was exceeded");
486 	if (sc->sc_maxbuf > 0) {
487 		SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
488 		    "typical_bufwrite_timout_count",
489 		    CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_BUFWRITE], 0,
490 		    "Number of times the typical buffered write timeout was "
491 		    "exceeded");
492 		SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
493 		    "max_bufwrite_timout_count",
494 		    CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_BUFWRITE], 0,
495 		    "Number of times the maximum buffered write timeout was "
496 		    "exceeded");
497 	}
498 }
499 
500 int
501 cfi_detach(device_t dev)
502 {
503 	struct cfi_softc *sc;
504 
505 	sc = device_get_softc(dev);
506 
507 	destroy_dev(sc->sc_nod);
508 	free(sc->sc_region, M_TEMP);
509 	bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
510 	return (0);
511 }
512 
513 static bool
514 cfi_check_erase(struct cfi_softc *sc, u_int ofs, u_int sz)
515 {
516 	bool result;
517 	int i;
518 	uint32_t val;
519 
520 	result = FALSE;
521 	for (i = 0; i < sz; i += sc->sc_width) {
522 		val = cfi_read(sc, ofs + i);
523 		switch (sc->sc_width) {
524 		case 1:
525 			if (val != 0xff)
526 				goto out;
527 			continue;
528 		case 2:
529 			if (val != 0xffff)
530 				goto out;
531 			continue;
532 		case 4:
533 			if (val != 0xffffffff)
534 				goto out;
535 			continue;
536 		}
537 	}
538 	result = TRUE;
539 
540 out:
541 	return (result);
542 }
543 
544 static int
545 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, sbintime_t start,
546     enum cfi_wait_cmd cmd)
547 {
548 	int done, error, tto_exceeded;
549 	uint32_t st0 = 0, st = 0;
550 	sbintime_t now;
551 
552 	done = 0;
553 	error = 0;
554 	tto_exceeded = 0;
555 	while (!done && !error) {
556 		/*
557 		 * Save time before we start so we always do one check
558 		 * after the timeout has expired.
559 		 */
560 		now = sbinuptime();
561 
562 		switch (sc->sc_cmdset) {
563 		case CFI_VEND_INTEL_ECS:
564 		case CFI_VEND_INTEL_SCS:
565 			st = cfi_read(sc, ofs);
566 			done = (st & CFI_INTEL_STATUS_WSMS);
567 			if (done) {
568 				/* NB: bit 0 is reserved */
569 				st &= ~(CFI_INTEL_XSTATUS_RSVD |
570 					CFI_INTEL_STATUS_WSMS |
571 					CFI_INTEL_STATUS_RSVD);
572 				if (st & CFI_INTEL_STATUS_DPS)
573 					error = EPERM;
574 				else if (st & CFI_INTEL_STATUS_PSLBS)
575 					error = EIO;
576 				else if (st & CFI_INTEL_STATUS_ECLBS)
577 					error = ENXIO;
578 				else if (st)
579 					error = EACCES;
580 			}
581 			break;
582 		case CFI_VEND_AMD_SCS:
583 		case CFI_VEND_AMD_ECS:
584 			st0 = cfi_read(sc, ofs);
585 			st = cfi_read(sc, ofs);
586 			done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0;
587 			break;
588 		}
589 
590 		if (tto_exceeded ||
591 		    now > start + sc->sc_typical_timeouts[cmd]) {
592 			if (!tto_exceeded) {
593 				tto_exceeded = 1;
594 				sc->sc_tto_counts[cmd]++;
595 #ifdef CFI_DEBUG_TIMEOUT
596 				device_printf(sc->sc_dev,
597 				    "typical timeout exceeded (cmd %d)", cmd);
598 #endif
599 			}
600 			if (now > start + sc->sc_max_timeouts[cmd]) {
601 				sc->sc_mto_counts[cmd]++;
602 #ifdef CFI_DEBUG_TIMEOUT
603 				device_printf(sc->sc_dev,
604 				    "max timeout exceeded (cmd %d)", cmd);
605 #endif
606 			}
607 		}
608 	}
609 	if (!done && !error)
610 		error = ETIMEDOUT;
611 	if (error)
612 		printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0);
613 	return (error);
614 }
615 
616 int
617 cfi_write_block(struct cfi_softc *sc)
618 {
619 	union {
620 		uint8_t		*x8;
621 		uint16_t	*x16;
622 		uint32_t	*x32;
623 	} ptr, cpyprt;
624 	register_t intr;
625 	int error, i, j, neederase = 0;
626 	uint32_t st;
627 	u_int wlen;
628 	sbintime_t start;
629 	u_int minsz;
630 	uint32_t val;
631 
632 	/* Intel flash must be unlocked before modification */
633 	switch (sc->sc_cmdset) {
634 	case CFI_VEND_INTEL_ECS:
635 	case CFI_VEND_INTEL_SCS:
636 		cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS);
637 		cfi_write(sc, sc->sc_wrofs, CFI_INTEL_UB);
638 		cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY);
639 		break;
640 	}
641 
642 	/* Check if an erase is required. */
643 	for (i = 0; i < sc->sc_wrbufsz; i++)
644 		if ((sc->sc_wrbuf[i] & sc->sc_wrbufcpy[i]) != sc->sc_wrbuf[i]) {
645 			neederase = 1;
646 			break;
647 		}
648 
649 	if (neederase) {
650 		intr = intr_disable();
651 		start = sbinuptime();
652 		/* Erase the block. */
653 		switch (sc->sc_cmdset) {
654 		case CFI_VEND_INTEL_ECS:
655 		case CFI_VEND_INTEL_SCS:
656 			cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE);
657 			cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM);
658 			break;
659 		case CFI_VEND_AMD_SCS:
660 		case CFI_VEND_AMD_ECS:
661 			/* find minimum sector size */
662 			minsz = sc->sc_region[0].r_blksz;
663 			for (i = 1; i < sc->sc_regions; i++) {
664 				if (sc->sc_region[i].r_blksz < minsz)
665 					minsz = sc->sc_region[i].r_blksz;
666 			}
667 			cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START,
668 			    CFI_AMD_ERASE_SECTOR);
669 			cfi_amd_write(sc, sc->sc_wrofs,
670 			    sc->sc_wrofs >> (ffs(minsz) - 1),
671 			    CFI_AMD_BLOCK_ERASE);
672 			for (i = 0; i < CFI_AMD_MAXCHK; ++i) {
673 				if (cfi_check_erase(sc, sc->sc_wrofs,
674 				    sc->sc_wrbufsz))
675 					break;
676 				DELAY(10);
677 			}
678 			if (i == CFI_AMD_MAXCHK) {
679 				printf("\nCFI Sector Erase time out error\n");
680 				return (ENODEV);
681 			}
682 			break;
683 		default:
684 			/* Better safe than sorry... */
685 			intr_restore(intr);
686 			return (ENODEV);
687 		}
688 		intr_restore(intr);
689 		error = cfi_wait_ready(sc, sc->sc_wrofs, start,
690 		    CFI_TIMEOUT_ERASE);
691 		if (error)
692 			goto out;
693 	} else
694 		error = 0;
695 
696 	/* Write the block using a multibyte write if supported. */
697 	ptr.x8 = sc->sc_wrbuf;
698 	cpyprt.x8 = sc->sc_wrbufcpy;
699 	if (sc->sc_maxbuf > sc->sc_width) {
700 		switch (sc->sc_cmdset) {
701 		case CFI_VEND_INTEL_ECS:
702 		case CFI_VEND_INTEL_SCS:
703 			for (i = 0; i < sc->sc_wrbufsz; i += wlen) {
704 				wlen = MIN(sc->sc_maxbuf, sc->sc_wrbufsz - i);
705 
706 				intr = intr_disable();
707 
708 				start = sbinuptime();
709 				do {
710 					cfi_write(sc, sc->sc_wrofs + i,
711 					    CFI_BCS_BUF_PROG_SETUP);
712 					if (sbinuptime() > start + sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE]) {
713 						error = ETIMEDOUT;
714 						goto out;
715 					}
716 					st = cfi_read(sc, sc->sc_wrofs + i);
717 				} while (! (st & CFI_INTEL_STATUS_WSMS));
718 
719 				cfi_write(sc, sc->sc_wrofs + i,
720 				    (wlen / sc->sc_width) - 1);
721 				switch (sc->sc_width) {
722 				case 1:
723 					bus_space_write_region_1(sc->sc_tag,
724 					    sc->sc_handle, sc->sc_wrofs + i,
725 					    ptr.x8 + i, wlen);
726 					break;
727 				case 2:
728 					bus_space_write_region_2(sc->sc_tag,
729 					    sc->sc_handle, sc->sc_wrofs + i,
730 					    ptr.x16 + i / 2, wlen / 2);
731 					break;
732 				case 4:
733 					bus_space_write_region_4(sc->sc_tag,
734 					    sc->sc_handle, sc->sc_wrofs + i,
735 					    ptr.x32 + i / 4, wlen / 4);
736 					break;
737 				}
738 
739 				cfi_write(sc, sc->sc_wrofs + i,
740 				    CFI_BCS_CONFIRM);
741 
742 				intr_restore(intr);
743 
744 				error = cfi_wait_ready(sc, sc->sc_wrofs + i,
745 				    start, CFI_TIMEOUT_BUFWRITE);
746 				if (error != 0)
747 					goto out;
748 			}
749 			goto out;
750 		default:
751 			/* Fall through to single word case */
752 			break;
753 		}
754 
755 	}
756 
757 	/* Write the block one byte/word at a time. */
758 	for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) {
759 
760 		/* Avoid writing unless we are actually changing bits */
761 		if (!neederase) {
762 			switch (sc->sc_width) {
763 			case 1:
764 				if(*(ptr.x8 + i) == *(cpyprt.x8 + i))
765 					continue;
766 				break;
767 			case 2:
768 				if(*(ptr.x16 + i / 2) == *(cpyprt.x16 + i / 2))
769 					continue;
770 				break;
771 			case 4:
772 				if(*(ptr.x32 + i / 4) == *(cpyprt.x32 + i / 4))
773 					continue;
774 				break;
775 			}
776 		}
777 
778 		/*
779 		 * Make sure the command to start a write and the
780 		 * actual write happens back-to-back without any
781 		 * excessive delays.
782 		 */
783 		intr = intr_disable();
784 
785 		start = sbinuptime();
786 		switch (sc->sc_cmdset) {
787 		case CFI_VEND_INTEL_ECS:
788 		case CFI_VEND_INTEL_SCS:
789 			cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM);
790 			break;
791 		case CFI_VEND_AMD_SCS:
792 		case CFI_VEND_AMD_ECS:
793 			cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM);
794 			break;
795 		}
796 		switch (sc->sc_width) {
797 		case 1:
798 			bus_space_write_1(sc->sc_tag, sc->sc_handle,
799 			    sc->sc_wrofs + i, *(ptr.x8 + i));
800 			break;
801 		case 2:
802 			bus_space_write_2(sc->sc_tag, sc->sc_handle,
803 			    sc->sc_wrofs + i, *(ptr.x16 + i / 2));
804 			break;
805 		case 4:
806 			bus_space_write_4(sc->sc_tag, sc->sc_handle,
807 			    sc->sc_wrofs + i, *(ptr.x32 + i / 4));
808 			break;
809 		}
810 
811 		intr_restore(intr);
812 
813 		if (sc->sc_cmdset == CFI_VEND_AMD_ECS  ||
814 		    sc->sc_cmdset == CFI_VEND_AMD_SCS) {
815 			for (j = 0; j < CFI_AMD_MAXCHK; ++j) {
816 				switch (sc->sc_width) {
817 				case 1:
818 					val = *(ptr.x8 + i);
819 					break;
820 				case 2:
821 					val = *(ptr.x16 + i / 2);
822 					break;
823 				case 4:
824 					val = *(ptr.x32 + i / 4);
825 					break;
826 				}
827 
828 				if (cfi_read(sc, sc->sc_wrofs + i) == val)
829 					break;
830 
831 				DELAY(10);
832 			}
833 			if (j == CFI_AMD_MAXCHK) {
834 				printf("\nCFI Program Verify time out error\n");
835 				error = ENXIO;
836 				goto out;
837 			}
838 		} else {
839 			error = cfi_wait_ready(sc, sc->sc_wrofs, start,
840 			   CFI_TIMEOUT_WRITE);
841 			if (error)
842 				goto out;
843 		}
844 	}
845 
846 	/* error is 0. */
847 
848  out:
849 	cfi_reset_default(sc);
850 
851 	/* Relock Intel flash */
852 	switch (sc->sc_cmdset) {
853 	case CFI_VEND_INTEL_ECS:
854 	case CFI_VEND_INTEL_SCS:
855 		cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS);
856 		cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LB);
857 		cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY);
858 		break;
859 	}
860 	return (error);
861 }
862 
863 #ifdef CFI_SUPPORT_STRATAFLASH
864 /*
865  * Intel StrataFlash Protection Register Support.
866  *
867  * The memory includes a 128-bit Protection Register that can be
868  * used for security.  There are two 64-bit segments; one is programmed
869  * at the factory with a unique 64-bit number which is immutable.
870  * The other segment is left blank for User (OEM) programming.
871  * The User/OEM segment is One Time Programmable (OTP).  It can also
872  * be locked to prevent any further writes by setting bit 0 of the
873  * Protection Lock Register (PLR).  The PLR can written only once.
874  */
875 
876 static uint16_t
877 cfi_get16(struct cfi_softc *sc, int off)
878 {
879 	uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1);
880 	return v;
881 }
882 
883 #ifdef CFI_ARMEDANDDANGEROUS
884 static void
885 cfi_put16(struct cfi_softc *sc, int off, uint16_t v)
886 {
887 	bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v);
888 }
889 #endif
890 
891 /*
892  * Read the factory-defined 64-bit segment of the PR.
893  */
894 int
895 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id)
896 {
897 	if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
898 		return EOPNOTSUPP;
899 	KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
900 
901 	cfi_write(sc, 0, CFI_INTEL_READ_ID);
902 	*id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 |
903 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 |
904 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 |
905 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3)));
906 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
907 	return 0;
908 }
909 
910 /*
911  * Read the User/OEM 64-bit segment of the PR.
912  */
913 int
914 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id)
915 {
916 	if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
917 		return EOPNOTSUPP;
918 	KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
919 
920 	cfi_write(sc, 0, CFI_INTEL_READ_ID);
921 	*id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 |
922 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 |
923 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 |
924 	      ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7)));
925 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
926 	return 0;
927 }
928 
929 /*
930  * Write the User/OEM 64-bit segment of the PR.
931  * XXX should allow writing individual words/bytes
932  */
933 int
934 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id)
935 {
936 #ifdef CFI_ARMEDANDDANGEROUS
937 	register_t intr;
938 	int i, error;
939 	sbintime_t start;
940 #endif
941 
942 	if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
943 		return EOPNOTSUPP;
944 	KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
945 
946 #ifdef CFI_ARMEDANDDANGEROUS
947 	for (i = 7; i >= 4; i--, id >>= 16) {
948 		intr = intr_disable();
949 		start = sbinuptime();
950 		cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
951 		cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff);
952 		intr_restore(intr);
953 		error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start,
954 		    CFI_TIMEOUT_WRITE);
955 		if (error)
956 			break;
957 	}
958 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
959 	return error;
960 #else
961 	device_printf(sc->sc_dev, "%s: OEM PR not set, "
962 	    "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
963 	return ENXIO;
964 #endif
965 }
966 
967 /*
968  * Read the contents of the Protection Lock Register.
969  */
970 int
971 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr)
972 {
973 	if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
974 		return EOPNOTSUPP;
975 	KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
976 
977 	cfi_write(sc, 0, CFI_INTEL_READ_ID);
978 	*plr = cfi_get16(sc, CFI_INTEL_PLR);
979 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
980 	return 0;
981 }
982 
983 /*
984  * Write the Protection Lock Register to lock down the
985  * user-settable segment of the Protection Register.
986  * NOTE: this operation is not reversible.
987  */
988 int
989 cfi_intel_set_plr(struct cfi_softc *sc)
990 {
991 #ifdef CFI_ARMEDANDDANGEROUS
992 	register_t intr;
993 	int error;
994 	sbintime_t start;
995 #endif
996 	if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
997 		return EOPNOTSUPP;
998 	KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
999 
1000 #ifdef CFI_ARMEDANDDANGEROUS
1001 	/* worthy of console msg */
1002 	device_printf(sc->sc_dev, "set PLR\n");
1003 	intr = intr_disable();
1004 	binuptime(&start);
1005 	cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
1006 	cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD);
1007 	intr_restore(intr);
1008 	error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start,
1009 	    CFI_TIMEOUT_WRITE);
1010 	cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
1011 	return error;
1012 #else
1013 	device_printf(sc->sc_dev, "%s: PLR not set, "
1014 	    "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
1015 	return ENXIO;
1016 #endif
1017 }
1018 #endif /* CFI_SUPPORT_STRATAFLASH */
1019