2 * Copyright (c) 2007, Juniper Networks, Inc.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the author nor the names of any co-contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
22 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
24 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
25 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
35 #include <sys/param.h>
36 #include <sys/systm.h>
39 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/malloc.h>
43 #include <sys/module.h>
45 #include <sys/sysctl.h>
47 #include <machine/bus.h>
49 #include <dev/cfi/cfi_reg.h>
50 #include <dev/cfi/cfi_var.h>
52 extern struct cdevsw cfi_cdevsw;
54 char cfi_driver_name[] = "cfi";
55 devclass_t cfi_devclass;
56 devclass_t cfi_diskclass;
59 cfi_read_raw(struct cfi_softc *sc, u_int ofs)
63 ofs &= ~(sc->sc_width - 1);
64 switch (sc->sc_width) {
66 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
69 val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
72 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
82 cfi_read(struct cfi_softc *sc, u_int ofs)
87 ofs &= ~(sc->sc_width - 1);
88 switch (sc->sc_width) {
90 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
93 sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
97 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
108 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val)
111 ofs &= ~(sc->sc_width - 1);
112 switch (sc->sc_width) {
114 bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val);
117 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val));
120 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val));
126 cfi_read_qry(struct cfi_softc *sc, u_int ofs)
130 cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA);
131 val = cfi_read(sc, ofs * sc->sc_width);
132 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
137 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data)
140 cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK);
141 cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK);
142 cfi_write(sc, ofs + addr, data);
146 cfi_fmtsize(uint32_t sz)
149 static const char *sfx[] = { "", "K", "M", "G" };
153 while (sfxidx < 3 && sz > 1023) {
158 sprintf(buf, "%u%sB", sz, sfx[sfxidx]);
163 cfi_probe(device_t dev)
166 struct cfi_softc *sc;
169 uint16_t iface, vend;
171 sc = device_get_softc(dev);
175 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
177 if (sc->sc_res == NULL)
180 sc->sc_tag = rman_get_bustag(sc->sc_res);
181 sc->sc_handle = rman_get_bushandle(sc->sc_res);
183 if (sc->sc_width == 0) {
185 while (sc->sc_width <= 4) {
186 if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q')
190 } else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') {
194 if (sc->sc_width > 4) {
199 /* We got a Q. Check if we also have the R and the Y. */
200 if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' ||
201 cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') {
206 /* Get the vendor and command set. */
207 vend = cfi_read_qry(sc, CFI_QRY_VEND) |
208 (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8);
210 sc->sc_cmdset = vend;
213 case CFI_VEND_AMD_ECS:
214 case CFI_VEND_AMD_SCS:
215 vend_str = "AMD/Fujitsu";
217 case CFI_VEND_INTEL_ECS:
218 vend_str = "Intel/Sharp";
220 case CFI_VEND_INTEL_SCS:
223 case CFI_VEND_MITSUBISHI_ECS:
224 case CFI_VEND_MITSUBISHI_SCS:
225 vend_str = "Mitsubishi";
228 vend_str = "Unknown vendor";
232 /* Get the device size. */
233 sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE);
235 /* Sanity-check the I/F */
236 iface = cfi_read_qry(sc, CFI_QRY_IFACE) |
237 (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8);
240 * Adding 1 to iface will give us a bit-wise "switch"
241 * that allows us to test for the interface width by
242 * testing a single bit.
246 error = (iface & sc->sc_width) ? 0 : EINVAL;
250 snprintf(desc, sizeof(desc), "%s - %s", vend_str,
251 cfi_fmtsize(sc->sc_size));
252 device_set_desc_copy(dev, desc);
255 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
260 cfi_attach(device_t dev)
262 struct cfi_softc *sc;
265 #ifdef CFI_SUPPORT_STRATAFLASH
267 char name[KENV_MNAMELEN], value[32];
270 sc = device_get_softc(dev);
274 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
276 if (sc->sc_res == NULL)
279 sc->sc_tag = rman_get_bustag(sc->sc_res);
280 sc->sc_handle = rman_get_bushandle(sc->sc_res);
282 /* Get time-out values for erase and write. */
283 sc->sc_write_timeout = 1 << cfi_read_qry(sc, CFI_QRY_TTO_WRITE);
284 sc->sc_erase_timeout = 1 << cfi_read_qry(sc, CFI_QRY_TTO_ERASE);
285 sc->sc_write_timeout *= 1 << cfi_read_qry(sc, CFI_QRY_MTO_WRITE);
286 sc->sc_erase_timeout *= 1 << cfi_read_qry(sc, CFI_QRY_MTO_ERASE);
288 /* Get erase regions. */
289 sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS);
290 sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region),
291 M_TEMP, M_WAITOK | M_ZERO);
292 for (r = 0; r < sc->sc_regions; r++) {
293 blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) |
294 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8);
295 sc->sc_region[r].r_blocks = blocks + 1;
297 blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) |
298 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8);
299 sc->sc_region[r].r_blksz = (blksz == 0) ? 128 :
303 /* Reset the device to a default state. */
304 cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS);
307 device_printf(dev, "[");
308 for (r = 0; r < sc->sc_regions; r++) {
309 printf("%ux%s%s", sc->sc_region[r].r_blocks,
310 cfi_fmtsize(sc->sc_region[r].r_blksz),
311 (r == sc->sc_regions - 1) ? "]\n" : ",");
315 u = device_get_unit(dev);
316 sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600,
317 "%s%u", cfi_driver_name, u);
318 sc->sc_nod->si_drv1 = sc;
320 #ifdef CFI_SUPPORT_STRATAFLASH
322 * Store the Intel factory PPR in the environment. In some
323 * cases it is the most unique ID on a board.
325 if (cfi_intel_get_factory_pr(sc, &ppr) == 0) {
326 if (snprintf(name, sizeof(name), "%s.factory_ppr",
327 device_get_nameunit(dev)) < (sizeof(name) - 1) &&
328 snprintf(value, sizeof(value), "0x%016jx", ppr) <
330 (void) setenv(name, value);
334 device_add_child(dev, "cfid", -1);
335 bus_generic_attach(dev);
341 cfi_detach(device_t dev)
343 struct cfi_softc *sc;
345 sc = device_get_softc(dev);
347 destroy_dev(sc->sc_nod);
348 free(sc->sc_region, M_TEMP);
349 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
354 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, u_int timeout)
357 uint32_t st0 = 0, st = 0;
362 while (!done && !error && timeout) {
366 switch (sc->sc_cmdset) {
367 case CFI_VEND_INTEL_ECS:
368 case CFI_VEND_INTEL_SCS:
369 st = cfi_read(sc, ofs);
370 done = (st & CFI_INTEL_STATUS_WSMS);
372 /* NB: bit 0 is reserved */
373 st &= ~(CFI_INTEL_XSTATUS_RSVD |
374 CFI_INTEL_STATUS_WSMS |
375 CFI_INTEL_STATUS_RSVD);
376 if (st & CFI_INTEL_STATUS_DPS)
378 else if (st & CFI_INTEL_STATUS_PSLBS)
380 else if (st & CFI_INTEL_STATUS_ECLBS)
386 case CFI_VEND_AMD_SCS:
387 case CFI_VEND_AMD_ECS:
388 st0 = cfi_read(sc, ofs);
389 st = cfi_read(sc, ofs);
390 done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0;
397 printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0);
402 cfi_write_block(struct cfi_softc *sc)
412 /* Erase the block. */
413 switch (sc->sc_cmdset) {
414 case CFI_VEND_INTEL_ECS:
415 case CFI_VEND_INTEL_SCS:
416 cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE);
417 cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM);
419 case CFI_VEND_AMD_SCS:
420 case CFI_VEND_AMD_ECS:
421 cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START,
422 CFI_AMD_ERASE_SECTOR);
423 cfi_amd_write(sc, sc->sc_wrofs, 0, CFI_AMD_BLOCK_ERASE);
426 /* Better safe than sorry... */
429 error = cfi_wait_ready(sc, sc->sc_wrofs, sc->sc_erase_timeout);
433 /* Write the block. */
434 ptr.x8 = sc->sc_wrbuf;
435 for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) {
438 * Make sure the command to start a write and the
439 * actual write happens back-to-back without any
442 intr = intr_disable();
444 switch (sc->sc_cmdset) {
445 case CFI_VEND_INTEL_ECS:
446 case CFI_VEND_INTEL_SCS:
447 cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM);
449 case CFI_VEND_AMD_SCS:
450 case CFI_VEND_AMD_ECS:
451 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM);
454 switch (sc->sc_width) {
456 bus_space_write_1(sc->sc_tag, sc->sc_handle,
457 sc->sc_wrofs + i, *(ptr.x8)++);
460 bus_space_write_2(sc->sc_tag, sc->sc_handle,
461 sc->sc_wrofs + i, *(ptr.x16)++);
464 bus_space_write_4(sc->sc_tag, sc->sc_handle,
465 sc->sc_wrofs + i, *(ptr.x32)++);
471 error = cfi_wait_ready(sc, sc->sc_wrofs, sc->sc_write_timeout);
479 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
483 #ifdef CFI_SUPPORT_STRATAFLASH
485 * Intel StrataFlash Protection Register Support.
487 * The memory includes a 128-bit Protection Register that can be
488 * used for security. There are two 64-bit segments; one is programmed
489 * at the factory with a unique 64-bit number which is immutable.
490 * The other segment is left blank for User (OEM) programming.
491 * The User/OEM segment is One Time Programmable (OTP). It can also
492 * be locked to prevent any further writes by setting bit 0 of the
493 * Protection Lock Register (PLR). The PLR can written only once.
497 cfi_get16(struct cfi_softc *sc, int off)
499 uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1);
503 #ifdef CFI_ARMEDANDDANGEROUS
505 cfi_put16(struct cfi_softc *sc, int off, uint16_t v)
507 bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v);
512 * Read the factory-defined 64-bit segment of the PR.
515 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id)
517 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
519 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
521 cfi_write(sc, 0, CFI_INTEL_READ_ID);
522 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 |
523 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 |
524 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 |
525 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3)));
526 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
531 * Read the User/OEM 64-bit segment of the PR.
534 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id)
536 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
538 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
540 cfi_write(sc, 0, CFI_INTEL_READ_ID);
541 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 |
542 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 |
543 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 |
544 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7)));
545 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
550 * Write the User/OEM 64-bit segment of the PR.
551 * XXX should allow writing individual words/bytes
554 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id)
556 #ifdef CFI_ARMEDANDDANGEROUS
561 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
563 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
565 #ifdef CFI_ARMEDANDDANGEROUS
566 for (i = 7; i >= 4; i--, id >>= 16) {
567 intr = intr_disable();
568 cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
569 cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff);
571 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS,
572 sc->sc_write_timeout);
576 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
579 device_printf(sc->sc_dev, "%s: OEM PR not set, "
580 "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
586 * Read the contents of the Protection Lock Register.
589 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr)
591 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
593 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
595 cfi_write(sc, 0, CFI_INTEL_READ_ID);
596 *plr = cfi_get16(sc, CFI_INTEL_PLR);
597 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
602 * Write the Protection Lock Register to lock down the
603 * user-settable segment of the Protection Register.
604 * NOTE: this operation is not reversible.
607 cfi_intel_set_plr(struct cfi_softc *sc)
609 #ifdef CFI_ARMEDANDDANGEROUS
613 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
615 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
617 #ifdef CFI_ARMEDANDDANGEROUS
618 /* worthy of console msg */
619 device_printf(sc->sc_dev, "set PLR\n");
620 intr = intr_disable();
621 cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
622 cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD);
624 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, sc->sc_write_timeout);
625 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
628 device_printf(sc->sc_dev, "%s: PLR not set, "
629 "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
633 #endif /* CFI_SUPPORT_STRATAFLASH */