2 * SPDX-License-Identifier: BSD-3-Clause
4 * Copyright (c) 2007, Juniper Networks, Inc.
5 * Copyright (c) 2012-2013, SRI International
8 * Portions of this software were developed by SRI International and the
9 * University of Cambridge Computer Laboratory under DARPA/AFRL contract
10 * (FA8750-10-C-0237) ("CTSRD"), as part of the DARPA CRASH research
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. Neither the name of the author nor the names of any co-contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
26 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
27 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
28 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
29 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
30 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
31 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
32 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
33 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
43 #include <sys/param.h>
44 #include <sys/systm.h>
47 #include <sys/endian.h>
49 #include <sys/kernel.h>
50 #include <sys/malloc.h>
51 #include <sys/module.h>
53 #include <sys/sysctl.h>
55 #include <machine/bus.h>
57 #include <dev/cfi/cfi_reg.h>
58 #include <dev/cfi/cfi_var.h>
60 static void cfi_add_sysctls(struct cfi_softc *);
62 extern struct cdevsw cfi_cdevsw;
64 char cfi_driver_name[] = "cfi";
67 cfi_read_raw(struct cfi_softc *sc, u_int ofs)
71 ofs &= ~(sc->sc_width - 1);
72 switch (sc->sc_width) {
74 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
77 val = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
80 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
90 cfi_read(struct cfi_softc *sc, u_int ofs)
95 ofs &= ~(sc->sc_width - 1);
96 switch (sc->sc_width) {
98 val = bus_space_read_1(sc->sc_tag, sc->sc_handle, ofs);
101 sval = bus_space_read_2(sc->sc_tag, sc->sc_handle, ofs);
102 #ifdef CFI_HARDWAREBYTESWAP
109 val = bus_space_read_4(sc->sc_tag, sc->sc_handle, ofs);
110 #ifndef CFI_HARDWAREBYTESWAP
122 cfi_write(struct cfi_softc *sc, u_int ofs, u_int val)
125 ofs &= ~(sc->sc_width - 1);
126 switch (sc->sc_width) {
128 bus_space_write_1(sc->sc_tag, sc->sc_handle, ofs, val);
131 #ifdef CFI_HARDWAREBYTESWAP
132 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, val);
134 bus_space_write_2(sc->sc_tag, sc->sc_handle, ofs, htole16(val));
139 #ifdef CFI_HARDWAREBYTESWAP
140 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, val);
142 bus_space_write_4(sc->sc_tag, sc->sc_handle, ofs, htole32(val));
149 * This is same workaound as NetBSD sys/dev/nor/cfi.c cfi_reset_default()
152 cfi_reset_default(struct cfi_softc *sc)
155 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2);
156 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
160 cfi_read_qry(struct cfi_softc *sc, u_int ofs)
164 cfi_write(sc, CFI_QRY_CMD_ADDR * sc->sc_width, CFI_QRY_CMD_DATA);
165 val = cfi_read(sc, ofs * sc->sc_width);
166 cfi_reset_default(sc);
171 cfi_amd_write(struct cfi_softc *sc, u_int ofs, u_int addr, u_int data)
174 cfi_write(sc, ofs + AMD_ADDR_START, CFI_AMD_UNLOCK);
175 cfi_write(sc, ofs + AMD_ADDR_ACK, CFI_AMD_UNLOCK_ACK);
176 cfi_write(sc, ofs + addr, data);
180 cfi_fmtsize(uint32_t sz)
183 static const char *sfx[] = { "", "K", "M", "G" };
187 while (sfxidx < 3 && sz > 1023) {
192 sprintf(buf, "%u%sB", sz, sfx[sfxidx]);
197 cfi_probe(device_t dev)
200 struct cfi_softc *sc;
203 uint16_t iface, vend;
205 sc = device_get_softc(dev);
209 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
211 if (sc->sc_res == NULL)
214 sc->sc_tag = rman_get_bustag(sc->sc_res);
215 sc->sc_handle = rman_get_bushandle(sc->sc_res);
217 if (sc->sc_width == 0) {
219 while (sc->sc_width <= 4) {
220 if (cfi_read_qry(sc, CFI_QRY_IDENT) == 'Q')
224 } else if (cfi_read_qry(sc, CFI_QRY_IDENT) != 'Q') {
228 if (sc->sc_width > 4) {
233 /* We got a Q. Check if we also have the R and the Y. */
234 if (cfi_read_qry(sc, CFI_QRY_IDENT + 1) != 'R' ||
235 cfi_read_qry(sc, CFI_QRY_IDENT + 2) != 'Y') {
240 /* Get the vendor and command set. */
241 vend = cfi_read_qry(sc, CFI_QRY_VEND) |
242 (cfi_read_qry(sc, CFI_QRY_VEND + 1) << 8);
244 sc->sc_cmdset = vend;
247 case CFI_VEND_AMD_ECS:
248 case CFI_VEND_AMD_SCS:
249 vend_str = "AMD/Fujitsu";
251 case CFI_VEND_INTEL_ECS:
252 vend_str = "Intel/Sharp";
254 case CFI_VEND_INTEL_SCS:
257 case CFI_VEND_MITSUBISHI_ECS:
258 case CFI_VEND_MITSUBISHI_SCS:
259 vend_str = "Mitsubishi";
262 vend_str = "Unknown vendor";
266 /* Get the device size. */
267 sc->sc_size = 1U << cfi_read_qry(sc, CFI_QRY_SIZE);
269 /* Sanity-check the I/F */
270 iface = cfi_read_qry(sc, CFI_QRY_IFACE) |
271 (cfi_read_qry(sc, CFI_QRY_IFACE + 1) << 8);
274 * Adding 1 to iface will give us a bit-wise "switch"
275 * that allows us to test for the interface width by
276 * testing a single bit.
280 error = (iface & sc->sc_width) ? 0 : EINVAL;
284 snprintf(desc, sizeof(desc), "%s - %s", vend_str,
285 cfi_fmtsize(sc->sc_size));
286 device_set_desc_copy(dev, desc);
289 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
294 cfi_attach(device_t dev)
296 struct cfi_softc *sc;
299 uint64_t mtoexp, ttoexp;
300 #ifdef CFI_SUPPORT_STRATAFLASH
302 char name[KENV_MNAMELEN], value[32];
305 sc = device_get_softc(dev);
309 sc->sc_res = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->sc_rid,
310 #ifndef ATSE_CFI_HACK
313 RF_ACTIVE | RF_SHAREABLE);
315 if (sc->sc_res == NULL)
318 sc->sc_tag = rman_get_bustag(sc->sc_res);
319 sc->sc_handle = rman_get_bushandle(sc->sc_res);
321 /* Get time-out values for erase, write, and buffer write. */
322 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_ERASE);
323 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_ERASE);
325 device_printf(dev, "erase timeout == 0, using 2^16ms\n");
329 device_printf(dev, "insane timeout: 2^%jdms\n", ttoexp);
333 device_printf(dev, "max erase timeout == 0, using 2^%jdms\n",
337 if (ttoexp + mtoexp > 41) {
338 device_printf(dev, "insane max erase timeout: 2^%jd\n",
342 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] = SBT_1MS * (1ULL << ttoexp);
343 sc->sc_max_timeouts[CFI_TIMEOUT_ERASE] =
344 sc->sc_typical_timeouts[CFI_TIMEOUT_ERASE] * (1ULL << mtoexp);
346 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_WRITE);
347 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_WRITE);
349 device_printf(dev, "write timeout == 0, using 2^18ns\n");
353 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp);
357 device_printf(dev, "max write timeout == 0, using 2^%jdms\n",
361 if (ttoexp + mtoexp > 51) {
362 device_printf(dev, "insane max write timeout: 2^%jdus\n",
366 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] = SBT_1US * (1ULL << ttoexp);
367 sc->sc_max_timeouts[CFI_TIMEOUT_WRITE] =
368 sc->sc_typical_timeouts[CFI_TIMEOUT_WRITE] * (1ULL << mtoexp);
370 ttoexp = cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE);
371 mtoexp = cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE);
372 /* Don't check for 0, it means not-supported. */
374 device_printf(dev, "insane write timeout: 2^%jdus\n", ttoexp);
377 if (ttoexp + mtoexp > 51) {
378 device_printf(dev, "insane max write timeout: 2^%jdus\n",
382 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] =
383 SBT_1US * (1ULL << cfi_read_qry(sc, CFI_QRY_TTO_BUFWRITE));
384 sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE] =
385 sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] *
386 (1ULL << cfi_read_qry(sc, CFI_QRY_MTO_BUFWRITE));
388 /* Get the maximum size of a multibyte program */
389 if (sc->sc_typical_timeouts[CFI_TIMEOUT_BUFWRITE] != 0)
390 sc->sc_maxbuf = 1 << (cfi_read_qry(sc, CFI_QRY_MAXBUF) |
391 cfi_read_qry(sc, CFI_QRY_MAXBUF) << 8);
395 /* Get erase regions. */
396 sc->sc_regions = cfi_read_qry(sc, CFI_QRY_NREGIONS);
397 sc->sc_region = malloc(sc->sc_regions * sizeof(struct cfi_region),
398 M_TEMP, M_WAITOK | M_ZERO);
399 for (r = 0; r < sc->sc_regions; r++) {
400 blocks = cfi_read_qry(sc, CFI_QRY_REGION(r)) |
401 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 1) << 8);
402 sc->sc_region[r].r_blocks = blocks + 1;
404 blksz = cfi_read_qry(sc, CFI_QRY_REGION(r) + 2) |
405 (cfi_read_qry(sc, CFI_QRY_REGION(r) + 3) << 8);
406 sc->sc_region[r].r_blksz = (blksz == 0) ? 128 :
410 /* Reset the device to a default state. */
411 cfi_write(sc, 0, CFI_BCS_CLEAR_STATUS);
414 device_printf(dev, "[");
415 for (r = 0; r < sc->sc_regions; r++) {
416 printf("%ux%s%s", sc->sc_region[r].r_blocks,
417 cfi_fmtsize(sc->sc_region[r].r_blksz),
418 (r == sc->sc_regions - 1) ? "]\n" : ",");
422 if (sc->sc_cmdset == CFI_VEND_AMD_ECS ||
423 sc->sc_cmdset == CFI_VEND_AMD_SCS) {
424 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_AUTO_SELECT);
425 sc->sc_manid = cfi_read(sc, 0);
426 sc->sc_devid = cfi_read(sc, 2);
427 device_printf(dev, "Manufacturer ID:%x Device ID:%x\n",
428 sc->sc_manid, sc->sc_devid);
429 cfi_write(sc, 0, CFI_BCS_READ_ARRAY2);
432 u = device_get_unit(dev);
433 sc->sc_nod = make_dev(&cfi_cdevsw, u, UID_ROOT, GID_WHEEL, 0600,
434 "%s%u", cfi_driver_name, u);
435 sc->sc_nod->si_drv1 = sc;
439 #ifdef CFI_SUPPORT_STRATAFLASH
441 * Store the Intel factory PPR in the environment. In some
442 * cases it is the most unique ID on a board.
444 if (cfi_intel_get_factory_pr(sc, &ppr) == 0) {
445 if (snprintf(name, sizeof(name), "%s.factory_ppr",
446 device_get_nameunit(dev)) < (sizeof(name) - 1) &&
447 snprintf(value, sizeof(value), "0x%016jx", ppr) <
449 (void) kern_setenv(name, value);
453 device_add_child(dev, "cfid", -1);
454 bus_generic_attach(dev);
460 cfi_add_sysctls(struct cfi_softc *sc)
462 struct sysctl_ctx_list *ctx;
463 struct sysctl_oid_list *children;
465 ctx = device_get_sysctl_ctx(sc->sc_dev);
466 children = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
468 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
469 "typical_erase_timout_count",
470 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_ERASE],
471 0, "Number of times the typical erase timeout was exceeded");
472 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
473 "max_erase_timout_count",
474 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_ERASE], 0,
475 "Number of times the maximum erase timeout was exceeded");
476 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
477 "typical_write_timout_count",
478 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_WRITE], 0,
479 "Number of times the typical write timeout was exceeded");
480 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
481 "max_write_timout_count",
482 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_WRITE], 0,
483 "Number of times the maximum write timeout was exceeded");
484 if (sc->sc_maxbuf > 0) {
485 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
486 "typical_bufwrite_timout_count",
487 CTLFLAG_RD, &sc->sc_tto_counts[CFI_TIMEOUT_BUFWRITE], 0,
488 "Number of times the typical buffered write timeout was "
490 SYSCTL_ADD_UINT(ctx, children, OID_AUTO,
491 "max_bufwrite_timout_count",
492 CTLFLAG_RD, &sc->sc_mto_counts[CFI_TIMEOUT_BUFWRITE], 0,
493 "Number of times the maximum buffered write timeout was "
499 cfi_detach(device_t dev)
501 struct cfi_softc *sc;
503 sc = device_get_softc(dev);
505 destroy_dev(sc->sc_nod);
506 free(sc->sc_region, M_TEMP);
507 bus_release_resource(dev, SYS_RES_MEMORY, sc->sc_rid, sc->sc_res);
512 cfi_check_erase(struct cfi_softc *sc, u_int ofs, u_int sz)
519 for (i = 0; i < sz; i += sc->sc_width) {
520 val = cfi_read(sc, ofs + i);
521 switch (sc->sc_width) {
531 if (val != 0xffffffff)
543 cfi_wait_ready(struct cfi_softc *sc, u_int ofs, sbintime_t start,
544 enum cfi_wait_cmd cmd)
546 int done, error, tto_exceeded;
547 uint32_t st0 = 0, st = 0;
553 while (!done && !error) {
555 * Save time before we start so we always do one check
556 * after the timeout has expired.
560 switch (sc->sc_cmdset) {
561 case CFI_VEND_INTEL_ECS:
562 case CFI_VEND_INTEL_SCS:
563 st = cfi_read(sc, ofs);
564 done = (st & CFI_INTEL_STATUS_WSMS);
566 /* NB: bit 0 is reserved */
567 st &= ~(CFI_INTEL_XSTATUS_RSVD |
568 CFI_INTEL_STATUS_WSMS |
569 CFI_INTEL_STATUS_RSVD);
570 if (st & CFI_INTEL_STATUS_DPS)
572 else if (st & CFI_INTEL_STATUS_PSLBS)
574 else if (st & CFI_INTEL_STATUS_ECLBS)
580 case CFI_VEND_AMD_SCS:
581 case CFI_VEND_AMD_ECS:
582 st0 = cfi_read(sc, ofs);
583 st = cfi_read(sc, ofs);
584 done = ((st & 0x40) == (st0 & 0x40)) ? 1 : 0;
589 now > start + sc->sc_typical_timeouts[cmd]) {
592 sc->sc_tto_counts[cmd]++;
593 #ifdef CFI_DEBUG_TIMEOUT
594 device_printf(sc->sc_dev,
595 "typical timeout exceeded (cmd %d)", cmd);
598 if (now > start + sc->sc_max_timeouts[cmd]) {
599 sc->sc_mto_counts[cmd]++;
600 #ifdef CFI_DEBUG_TIMEOUT
601 device_printf(sc->sc_dev,
602 "max timeout exceeded (cmd %d)", cmd);
610 printf("\nerror=%d (st 0x%x st0 0x%x)\n", error, st, st0);
615 cfi_write_block(struct cfi_softc *sc)
623 int error, i, j, neederase = 0;
630 /* Intel flash must be unlocked before modification */
631 switch (sc->sc_cmdset) {
632 case CFI_VEND_INTEL_ECS:
633 case CFI_VEND_INTEL_SCS:
634 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS);
635 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_UB);
636 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY);
640 /* Check if an erase is required. */
641 for (i = 0; i < sc->sc_wrbufsz; i++)
642 if ((sc->sc_wrbuf[i] & sc->sc_wrbufcpy[i]) != sc->sc_wrbuf[i]) {
648 intr = intr_disable();
649 start = sbinuptime();
650 /* Erase the block. */
651 switch (sc->sc_cmdset) {
652 case CFI_VEND_INTEL_ECS:
653 case CFI_VEND_INTEL_SCS:
654 cfi_write(sc, sc->sc_wrofs, CFI_BCS_BLOCK_ERASE);
655 cfi_write(sc, sc->sc_wrofs, CFI_BCS_CONFIRM);
657 case CFI_VEND_AMD_SCS:
658 case CFI_VEND_AMD_ECS:
659 /* find minimum sector size */
660 minsz = sc->sc_region[0].r_blksz;
661 for (i = 1; i < sc->sc_regions; i++) {
662 if (sc->sc_region[i].r_blksz < minsz)
663 minsz = sc->sc_region[i].r_blksz;
665 cfi_amd_write(sc, sc->sc_wrofs, AMD_ADDR_START,
666 CFI_AMD_ERASE_SECTOR);
667 cfi_amd_write(sc, sc->sc_wrofs,
668 sc->sc_wrofs >> (ffs(minsz) - 1),
669 CFI_AMD_BLOCK_ERASE);
670 for (i = 0; i < CFI_AMD_MAXCHK; ++i) {
671 if (cfi_check_erase(sc, sc->sc_wrofs,
676 if (i == CFI_AMD_MAXCHK) {
677 printf("\nCFI Sector Erase time out error\n");
682 /* Better safe than sorry... */
687 error = cfi_wait_ready(sc, sc->sc_wrofs, start,
694 /* Write the block using a multibyte write if supported. */
695 ptr.x8 = sc->sc_wrbuf;
696 cpyprt.x8 = sc->sc_wrbufcpy;
697 if (sc->sc_maxbuf > sc->sc_width) {
698 switch (sc->sc_cmdset) {
699 case CFI_VEND_INTEL_ECS:
700 case CFI_VEND_INTEL_SCS:
701 for (i = 0; i < sc->sc_wrbufsz; i += wlen) {
702 wlen = MIN(sc->sc_maxbuf, sc->sc_wrbufsz - i);
704 intr = intr_disable();
706 start = sbinuptime();
708 cfi_write(sc, sc->sc_wrofs + i,
709 CFI_BCS_BUF_PROG_SETUP);
710 if (sbinuptime() > start + sc->sc_max_timeouts[CFI_TIMEOUT_BUFWRITE]) {
714 st = cfi_read(sc, sc->sc_wrofs + i);
715 } while (! (st & CFI_INTEL_STATUS_WSMS));
717 cfi_write(sc, sc->sc_wrofs + i,
718 (wlen / sc->sc_width) - 1);
719 switch (sc->sc_width) {
721 bus_space_write_region_1(sc->sc_tag,
722 sc->sc_handle, sc->sc_wrofs + i,
726 bus_space_write_region_2(sc->sc_tag,
727 sc->sc_handle, sc->sc_wrofs + i,
728 ptr.x16 + i / 2, wlen / 2);
731 bus_space_write_region_4(sc->sc_tag,
732 sc->sc_handle, sc->sc_wrofs + i,
733 ptr.x32 + i / 4, wlen / 4);
737 cfi_write(sc, sc->sc_wrofs + i,
742 error = cfi_wait_ready(sc, sc->sc_wrofs + i,
743 start, CFI_TIMEOUT_BUFWRITE);
749 /* Fall through to single word case */
754 /* Write the block one byte/word at a time. */
755 for (i = 0; i < sc->sc_wrbufsz; i += sc->sc_width) {
756 /* Avoid writing unless we are actually changing bits */
758 switch (sc->sc_width) {
760 if(*(ptr.x8 + i) == *(cpyprt.x8 + i))
764 if(*(ptr.x16 + i / 2) == *(cpyprt.x16 + i / 2))
768 if(*(ptr.x32 + i / 4) == *(cpyprt.x32 + i / 4))
775 * Make sure the command to start a write and the
776 * actual write happens back-to-back without any
779 intr = intr_disable();
781 start = sbinuptime();
782 switch (sc->sc_cmdset) {
783 case CFI_VEND_INTEL_ECS:
784 case CFI_VEND_INTEL_SCS:
785 cfi_write(sc, sc->sc_wrofs + i, CFI_BCS_PROGRAM);
787 case CFI_VEND_AMD_SCS:
788 case CFI_VEND_AMD_ECS:
789 cfi_amd_write(sc, 0, AMD_ADDR_START, CFI_AMD_PROGRAM);
792 switch (sc->sc_width) {
794 bus_space_write_1(sc->sc_tag, sc->sc_handle,
795 sc->sc_wrofs + i, *(ptr.x8 + i));
798 bus_space_write_2(sc->sc_tag, sc->sc_handle,
799 sc->sc_wrofs + i, *(ptr.x16 + i / 2));
802 bus_space_write_4(sc->sc_tag, sc->sc_handle,
803 sc->sc_wrofs + i, *(ptr.x32 + i / 4));
809 if (sc->sc_cmdset == CFI_VEND_AMD_ECS ||
810 sc->sc_cmdset == CFI_VEND_AMD_SCS) {
811 for (j = 0; j < CFI_AMD_MAXCHK; ++j) {
812 switch (sc->sc_width) {
817 val = *(ptr.x16 + i / 2);
820 val = *(ptr.x32 + i / 4);
824 if (cfi_read(sc, sc->sc_wrofs + i) == val)
829 if (j == CFI_AMD_MAXCHK) {
830 printf("\nCFI Program Verify time out error\n");
835 error = cfi_wait_ready(sc, sc->sc_wrofs, start,
845 cfi_reset_default(sc);
847 /* Relock Intel flash */
848 switch (sc->sc_cmdset) {
849 case CFI_VEND_INTEL_ECS:
850 case CFI_VEND_INTEL_SCS:
851 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LBS);
852 cfi_write(sc, sc->sc_wrofs, CFI_INTEL_LB);
853 cfi_write(sc, sc->sc_wrofs, CFI_BCS_READ_ARRAY);
859 #ifdef CFI_SUPPORT_STRATAFLASH
861 * Intel StrataFlash Protection Register Support.
863 * The memory includes a 128-bit Protection Register that can be
864 * used for security. There are two 64-bit segments; one is programmed
865 * at the factory with a unique 64-bit number which is immutable.
866 * The other segment is left blank for User (OEM) programming.
867 * The User/OEM segment is One Time Programmable (OTP). It can also
868 * be locked to prevent any further writes by setting bit 0 of the
869 * Protection Lock Register (PLR). The PLR can written only once.
873 cfi_get16(struct cfi_softc *sc, int off)
875 uint16_t v = bus_space_read_2(sc->sc_tag, sc->sc_handle, off<<1);
879 #ifdef CFI_ARMEDANDDANGEROUS
881 cfi_put16(struct cfi_softc *sc, int off, uint16_t v)
883 bus_space_write_2(sc->sc_tag, sc->sc_handle, off<<1, v);
888 * Read the factory-defined 64-bit segment of the PR.
891 cfi_intel_get_factory_pr(struct cfi_softc *sc, uint64_t *id)
893 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
895 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
897 cfi_write(sc, 0, CFI_INTEL_READ_ID);
898 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(0)))<<48 |
899 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(1)))<<32 |
900 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(2)))<<16 |
901 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(3)));
902 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
907 * Read the User/OEM 64-bit segment of the PR.
910 cfi_intel_get_oem_pr(struct cfi_softc *sc, uint64_t *id)
912 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
914 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
916 cfi_write(sc, 0, CFI_INTEL_READ_ID);
917 *id = ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(4)))<<48 |
918 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(5)))<<32 |
919 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(6)))<<16 |
920 ((uint64_t)cfi_get16(sc, CFI_INTEL_PR(7)));
921 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
926 * Write the User/OEM 64-bit segment of the PR.
927 * XXX should allow writing individual words/bytes
930 cfi_intel_set_oem_pr(struct cfi_softc *sc, uint64_t id)
932 #ifdef CFI_ARMEDANDDANGEROUS
938 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
940 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
942 #ifdef CFI_ARMEDANDDANGEROUS
943 for (i = 7; i >= 4; i--, id >>= 16) {
944 intr = intr_disable();
945 start = sbinuptime();
946 cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
947 cfi_put16(sc, CFI_INTEL_PR(i), id&0xffff);
949 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start,
954 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
957 device_printf(sc->sc_dev, "%s: OEM PR not set, "
958 "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
964 * Read the contents of the Protection Lock Register.
967 cfi_intel_get_plr(struct cfi_softc *sc, uint32_t *plr)
969 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
971 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
973 cfi_write(sc, 0, CFI_INTEL_READ_ID);
974 *plr = cfi_get16(sc, CFI_INTEL_PLR);
975 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
980 * Write the Protection Lock Register to lock down the
981 * user-settable segment of the Protection Register.
982 * NOTE: this operation is not reversible.
985 cfi_intel_set_plr(struct cfi_softc *sc)
987 #ifdef CFI_ARMEDANDDANGEROUS
992 if (sc->sc_cmdset != CFI_VEND_INTEL_ECS)
994 KASSERT(sc->sc_width == 2, ("sc_width %d", sc->sc_width));
996 #ifdef CFI_ARMEDANDDANGEROUS
997 /* worthy of console msg */
998 device_printf(sc->sc_dev, "set PLR\n");
999 intr = intr_disable();
1001 cfi_write(sc, 0, CFI_INTEL_PP_SETUP);
1002 cfi_put16(sc, CFI_INTEL_PLR, 0xFFFD);
1004 error = cfi_wait_ready(sc, CFI_BCS_READ_STATUS, start,
1006 cfi_write(sc, 0, CFI_BCS_READ_ARRAY);
1009 device_printf(sc->sc_dev, "%s: PLR not set, "
1010 "CFI_ARMEDANDDANGEROUS not configured\n", __func__);
1014 #endif /* CFI_SUPPORT_STRATAFLASH */