2 * Copyright (c) 2012 Robert N. M. Watson
3 * Copyright (c) 2012 SRI International
6 * This software was developed by SRI International and the University of
7 * Cambridge Computer Laboratory under DARPA/AFRL contract (FA8750-10-C-0237)
8 * ("CTSRD"), as part of the DARPA CRASH research programme.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
35 #include <sys/param.h>
36 #include <sys/module.h>
37 #include <sys/kernel.h>
38 #include <sys/systm.h>
42 #include <sys/endian.h>
44 #include <sys/kthread.h>
46 #include <sys/malloc.h>
47 #include <sys/mutex.h>
49 #include <sys/taskqueue.h>
51 #include <machine/bus.h>
52 #include <machine/resource.h>
54 #include <geom/geom_disk.h>
56 #include <dev/isf/isf.h>
59 #define ISF_CMD_RA 0xFF /* Read Array mode */
60 #define ISF_CMD_RSR 0x70 /* Read Status Register mode */
61 #define ISF_CMD_RDI 0x90 /* Read Device ID/Config Reg mode */
62 #define ISF_CMD_RQ 0x98 /* Read Query mode */
63 #define ISF_CMD_CSR 0x50 /* Clear Status Register */
66 #define ISF_CMD_WPS 0x40 /* Word Program Setup */
67 #define ISF_CMD_BPS 0xE8 /* Buffered Program Setup */
68 #define ISF_CMD_BPC 0xD0 /* Buffered Program Confirm */
71 #define ISF_CMD_BES 0x20 /* Block Erase Setup */
72 #define ISF_CMD_BEC 0xD0 /* Block Erase Confirm */
74 /* Block Locking/Unlocking */
75 #define ISF_CMD_LBS 0x60 /* Lock Block Setup */
76 #define ISF_CMD_LB 0x01 /* Lock Block */
77 #define ISF_CMD_UB 0xD0 /* Unlock Block */
80 * Read Device Identifier registers.
82 * NOTE: ISF_RDIR_BLC is relative to the block base address.
84 #define ISF_REG_MC 0x00 /* Manufacture Code */
85 #define ISF_REG_ID 0x01 /* Device ID Code */
86 #define ISF_REG_BLC 0x02 /* Block Lock Configuration */
87 #define ISF_REG_RCR 0x05 /* Read Configuration Register */
90 * Protection Registers
92 #define ISF_REG_L0 0x80 /* Lock Register 0 */
93 #define ISF_REG_FPP 0x81 /* 64-bit Factory Protection Register */
94 #define ISF_REG_UPP 0x85 /* 64-bit User Protection Register */
95 #define ISF_REG_L1 0x89 /* Lock Register 1 */
96 #define ISF_REG_PP1 0x8A /* 128-bit Protection Register 1 */
97 #define ISF_REG_PP2 0x92 /* 128-bit Protection Register 2 */
98 #define ISF_REG_PP3 0x9A /* 128-bit Protection Register 3 */
99 #define ISF_REG_PP4 0xA2 /* 128-bit Protection Register 4 */
100 #define ISF_REG_PP5 0xAA /* 128-bit Protection Register 5 */
101 #define ISF_REG_PP6 0xB2 /* 128-bit Protection Register 6 */
102 #define ISF_REG_PP7 0xBA /* 128-bit Protection Register 7 */
103 #define ISF_REG_PP8 0xC2 /* 128-bit Protection Register 8 */
104 #define ISF_REG_PP9 0xCA /* 128-bit Protection Register 9 */
105 #define ISF_REG_PP10 0xD2 /* 128-bit Protection Register 10 */
106 #define ISF_REG_PP11 0xDA /* 128-bit Protection Register 11 */
107 #define ISF_REG_PP12 0xE2 /* 128-bit Protection Register 12 */
108 #define ISF_REG_PP13 0xEA /* 128-bit Protection Register 13 */
109 #define ISF_REG_PP14 0xF2 /* 128-bit Protection Register 14 */
110 #define ISF_REG_PP15 0xFA /* 128-bit Protection Register 15 */
111 #define ISF_REG_PP16 0x102 /* 128-bit Protection Register 16 */
113 #define ISF_SR_BWS (1 << 0) /* BEFP Status */
114 #define ISF_SR_BLS (1 << 1) /* Block-Locked Status */
115 #define ISF_SR_PSS (1 << 2) /* Program Suspend Status */
116 #define ISF_SR_VPPS (1 << 3) /* Vpp Status */
117 #define ISF_SR_PS (1 << 4) /* Program Status */
118 #define ISF_SR_ES (1 << 5) /* Erase Status */
119 #define ISF_SR_ESS (1 << 6) /* Erase Suspend Status */
120 #define ISF_SR_DWS (1 << 7) /* Device Write Status */
121 #define ISF_SR_FSC_MASK (ISF_SR_VPPS | ISF_SR_PS | ISF_SR_BLS)
123 #define ISF_BUFFER_PROGRAM
125 MALLOC_DEFINE(M_ISF, "isf_data", "Intel StrateFlash driver");
126 static int isf_debug = 0;
128 static struct isf_chips {
131 const char *chip_desc;
133 { 0x8817, 0x0800000, "64-Mbit Top Parameter" },
134 { 0x881A, 0x0800000, "64-Mbit Bottom Parameter" },
135 { 0x8818, 0x1000000, "128-Mbit Top Parameter" },
136 { 0x881B, 0x1000000, "128-Mbit Bottom Parameter" },
137 { 0x8919, 0x2000000, "256-Mbit Top Parameter" },
138 { 0x891C, 0x2000000, "256-Mbit Bottom Parameter" },
139 { 0x8961, 0x2000000, "512-Mbit package (half)" },
140 { 0x0000, 0x0000000, NULL }
143 static void isf_task(void *arg);
146 * Device driver for the Intel StrataFlash NOR flash device. This
147 * implementation is known to work with 256Mb instances of the device, but may
148 * also work with other 64/128/512Mb parts without much work. Multiple
149 * device instances should be used when multiple parts are in the same
150 * physical package, due to variable block size support in the StrataFlash
153 devclass_t isf_devclass;
156 isf_read_reg(struct isf_softc *sc, uint16_t reg)
160 device_printf(sc->isf_dev, "isf_read_reg(0x%02x)\n", reg);
161 return (le16toh(bus_read_2(sc->isf_res, reg * 2)));
165 isf_read_reg64(struct isf_softc *sc, uint16_t reg)
168 uint16_t *val16 = (uint16_t *)&val;
171 device_printf(sc->isf_dev, "isf_read_reg64(0x%02x)\n", reg);
172 val16[0] = bus_read_2(sc->isf_res, reg * 2);
173 val16[1] = bus_read_2(sc->isf_res, (reg+1) * 2);
174 val16[2] = bus_read_2(sc->isf_res, (reg+2) * 2);
175 val16[3] = bus_read_2(sc->isf_res, (reg+3) * 2);
177 return(le64toh(val));
181 isf_read_off(struct isf_softc *sc, off_t off)
184 KASSERT(off >= 0, ("%s: negative offset\n", __func__));
185 KASSERT(off < sc->isf_disk->d_mediasize,
186 ("%s: offset out side address space 0x%08jx \n", __func__,
190 device_printf(sc->isf_dev, "isf_read_off(0x%08jx)\n",
192 return (le16toh(bus_read_2(sc->isf_res, off)));
196 isf_write_cmd(struct isf_softc *sc, off_t off, uint16_t cmd)
200 device_printf(sc->isf_dev, "isf_write_cmd(0x%08jx, 0x%02x)\n",
202 bus_write_2(sc->isf_res, off, htole16(cmd));
206 isf_read_status(struct isf_softc *sc, off_t off)
209 isf_write_cmd(sc, off/2, ISF_CMD_RSR);
210 return isf_read_off(sc, off);
214 isf_clear_status(struct isf_softc *sc)
217 isf_write_cmd(sc, 0, ISF_CMD_CSR);
221 isf_full_status_check(struct isf_softc *sc, off_t off)
226 status = isf_read_status(sc, off);
227 if (status & ISF_SR_VPPS) {
228 device_printf(sc->isf_dev, "Vpp Range Error\n");
230 } else if (status & ISF_SR_PS) {
231 device_printf(sc->isf_dev, "Program Error\n");
233 } else if (status & ISF_SR_BLS) {
234 device_printf(sc->isf_dev, "Device Protect Error\n");
237 isf_clear_status(sc);
243 isf_full_erase_status_check(struct isf_softc *sc, off_t off)
248 status = isf_read_status(sc, off);
249 if (status & ISF_SR_VPPS) {
250 device_printf(sc->isf_dev, "Vpp Range Error\n");
252 } else if (status & (ISF_SR_PS|ISF_SR_ES)) {
253 device_printf(sc->isf_dev, "Command Sequence Error\n");
255 } else if (status & ISF_SR_ES) {
256 device_printf(sc->isf_dev, "Block Erase Error\n");
258 } else if (status & ISF_SR_BLS) {
259 device_printf(sc->isf_dev, "Block Locked Error\n");
262 isf_clear_status(sc);
268 isf_unlock_block(struct isf_softc *sc, off_t off)
271 isf_write_cmd(sc, off, ISF_CMD_LBS);
272 isf_write_cmd(sc, off, ISF_CMD_UB);
273 isf_write_cmd(sc, off, ISF_CMD_RA);
277 isf_lock_block(struct isf_softc *sc, off_t off)
280 isf_write_cmd(sc, off, ISF_CMD_LBS);
281 isf_write_cmd(sc, off, ISF_CMD_LB);
282 isf_write_cmd(sc, off, ISF_CMD_RA);
286 isf_read(struct isf_softc *sc, off_t off, void *data, size_t len)
289 KASSERT((uintptr_t)data % 2 == 0,
290 ("%s: unaligned data %p", __func__, data));
291 KASSERT((len <= ISF_SECTORSIZE) && (len % 2 == 0),
292 ("%s: invalid length %ju", __func__, len));
293 KASSERT(off % ISF_SECTORSIZE == 0,
294 ("%s: invalid offset %ju\n", __func__, off));
297 * It is not permitted to read blocks that are in the process of
298 * being erased, but we know they will be all 1's after the
299 * erase so just report that value if asked about a block that
302 if (sc->isf_bstate[off / ISF_ERASE_BLOCK] == BS_ERASING)
303 memset(data, 0xFF, len);
305 bus_read_region_2(sc->isf_res, off, (uint16_t *)data, len / 2);
309 isf_write(struct isf_softc *sc, off_t off, void *data, size_t len)
311 int cycles, error = 0;
316 KASSERT((uintptr_t)data % 2 == 0,
317 ("%s: unaligned data %p", __func__, data));
318 KASSERT((len <= ISF_SECTORSIZE) && (len % 2 == 0),
319 ("%s: invalid length %ju", __func__, len));
320 KASSERT(off % ISF_SECTORSIZE == 0,
321 ("%s: invalid offset %ju\n", __func__, off));
322 KASSERT(!sc->isf_erasing,
323 ("%s: trying to write while erasing\n", __func__));
324 KASSERT(sc->isf_bstate[off / ISF_ERASE_BLOCK] != BS_ERASING,
325 ("%s: block being erased at %ju\n", __func__, off));
327 isf_unlock_block(sc, off);
329 #ifdef ISF_BUFFER_PROGRAM
330 for (dp = data, coff = off; dp - (uint16_t *)data < len / 2;
331 dp += 32, coff += 64) {
332 isf_clear_status(sc);
333 isf_write_cmd(sc, coff, ISF_CMD_BPS);
335 while ( !(isf_read_off(sc, coff) & ISF_SR_DWS) ) {
337 device_printf(sc->isf_dev, "timeout waiting"
338 " for write to start at 0x08%jx\n",
342 isf_write_cmd(sc, coff, ISF_CMD_BPS);
345 /* When writing N blocks, send N-1 as the count */
346 isf_write_cmd(sc, coff, 31);
347 bus_write_region_2(sc->isf_res, coff, dp, 32);
349 isf_write_cmd(sc, coff, ISF_CMD_BPC);
351 status = isf_read_off(sc, coff);
353 while ( !(status & ISF_SR_DWS) ) {
355 device_printf(sc->isf_dev, "timeout waiting"
356 " for write to complete at 0x08%jx\n",
361 status = isf_read_off(sc, coff);
363 isf_full_status_check(sc, off);
365 isf_write_cmd(sc, coff, ISF_CMD_RA);
368 for (dp = data, coff = off; dp - (uint16_t *)data < len / 2;
370 isf_write_cmd(sc, coff, ISF_CMD_WPS);
371 bus_write_2(sc->isf_res, coff, *dp);
372 status = isf_read_off(sc, coff);
374 while ( !(status & ISF_SR_DWS) ) {
376 device_printf(sc->isf_dev, "timeout waiting"
377 " for write to complete at 0x08%jx\n",
382 status = isf_read_off(sc, coff);
386 isf_full_status_check(sc, off);
387 isf_write_cmd(sc, coff, ISF_CMD_RA);
390 isf_lock_block(sc, off);
396 isf_erase_at(struct isf_softc *sc, off_t off)
401 isf_unlock_block(sc, off);
402 isf_clear_status(sc);
404 isf_write_cmd(sc, off, ISF_CMD_BES);
405 isf_write_cmd(sc, off, ISF_CMD_BEC);
408 status = isf_read_off(sc, off);
409 while ( !(status & ISF_SR_DWS) ) {
411 ISF_SLEEP(sc, sc, hz);
414 device_printf(sc->isf_dev,
415 "Giving up on erase\n");
418 status = isf_read_off(sc, off);
421 isf_full_erase_status_check(sc, off);
423 isf_lock_block(sc, off);
425 isf_write_cmd(sc, off, ISF_CMD_RA);
429 isf_erase_range(struct isf_softc *sc, off_t blk_off, size_t size)
432 off_t ms = sc->isf_disk->d_mediasize;
434 KASSERT(blk_off % ISF_ERASE_BLOCK == 0,
435 ("%s: invalid offset %ju\n", __func__, blk_off));
439 for (off = blk_off; off < blk_off + size; off += ISF_ERASE_BLOCK) {
440 sc->isf_bstate[off / ISF_ERASE_BLOCK] = BS_ERASING;
443 * The first or last 128K is four blocks depending which
444 * part this is. For now, just assume both are and
447 if (off == 0 || ms - off == ISF_ERASE_BLOCK) {
448 isf_erase_at(sc, off);
449 isf_erase_at(sc, off + 0x08000);
450 isf_erase_at(sc, off + 0x10000);
451 isf_erase_at(sc, off + 0x18000);
453 isf_erase_at(sc, off);
455 sc->isf_bstate[off / ISF_ERASE_BLOCK] = BS_STEADY;
463 isf_disk_ioctl(struct disk *disk, u_long cmd, void *data, int fflag,
467 struct isf_softc *sc = disk->d_drv1;
468 struct isf_range *ir;
473 if (ir->ir_off % ISF_ERASE_BLOCK != 0 ||
474 ir->ir_off >= disk->d_mediasize ||
476 ir->ir_size % ISF_ERASE_BLOCK != 0 ||
477 ir->ir_off + ir->ir_size > disk->d_mediasize) {
482 if (sc->isf_erasing) {
488 isf_erase_range(sc, ir->ir_off, ir->ir_size);
500 isf_disk_strategy(struct bio *bp)
502 struct isf_softc *sc = bp->bio_disk->d_drv1;
505 * We advertise a block size and maximum I/O size up the stack; catch
506 * any attempts to not follow the rules.
508 KASSERT(bp->bio_bcount == ISF_SECTORSIZE,
509 ("%s: I/O size not %d", __func__, ISF_SECTORSIZE));
512 bioq_disksort(&sc->isf_bioq, bp);
520 struct isf_softc *sc = arg;
522 int ss = sc->isf_disk->d_sectorsize;
528 bp = bioq_first(&sc->isf_bioq);
533 ISF_SLEEP(sc, sc, 0);
535 } while (bp == NULL);
536 bioq_remove(&sc->isf_bioq, bp);
539 switch (bp->bio_cmd) {
541 isf_read(sc, bp->bio_pblkno * ss, bp->bio_data,
547 * In principle one could suspend the in-progress
548 * erase, process any pending writes to other
549 * blocks and then proceed, but that seems
550 * overly complex for the likely usage modes.
552 if (sc->isf_erasing) {
558 * Read in the block we want to write and check that
559 * we're only setting bits to 0. If an erase would
560 * be required return an I/O error.
562 isf_read(sc, bp->bio_pblkno * ss, sc->isf_rbuf,
564 for (i = 0; i < bp->bio_bcount / 2; i++)
565 if ((sc->isf_rbuf[i] &
566 ((uint16_t *)bp->bio_data)[i]) !=
567 ((uint16_t *)bp->bio_data)[i]) {
568 device_printf(sc->isf_dev, "write"
569 " requires erase at 0x%08jx\n",
570 bp->bio_pblkno * ss);
577 error = isf_write(sc, bp->bio_pblkno * ss,
578 bp->bio_data, bp->bio_bcount);
582 panic("%s: unsupported I/O operation %d", __func__,
588 biofinish(bp, NULL, error);
594 isf_dump_info(struct isf_softc *sc)
599 isf_write_cmd(sc, 0, ISF_CMD_RDI);
600 device_printf(sc->isf_dev, "manufacturer code: 0x%04x\n",
601 isf_read_reg(sc, ISF_REG_MC));
602 device_printf(sc->isf_dev, "device id code: 0x%04x\n",
603 isf_read_reg(sc, ISF_REG_ID));
604 device_printf(sc->isf_dev, "read config register: 0x%04x\n",
605 isf_read_reg(sc, ISF_REG_RCR));
607 device_printf(sc->isf_dev, "lock register 0: 0x%04x\n",
608 isf_read_reg(sc, ISF_REG_L0));
609 device_printf(sc->isf_dev, "lock register 1: 0x%04x\n",
610 isf_read_reg(sc, ISF_REG_L1));
612 device_printf(sc->isf_dev, "factory PPR: 0x%016jx\n",
613 (uintmax_t)isf_read_reg64(sc, ISF_REG_FPP));
614 device_printf(sc->isf_dev, "user PPR (64-bit): 0x%016jx\n",
615 (uintmax_t)isf_read_reg64(sc, ISF_REG_UPP));
617 for (reg = ISF_REG_PP1, i = 1; reg <= ISF_REG_PP16; reg += 8, i++) {
618 /* XXX: big-endian ordering of uint64_t's */
619 device_printf(sc->isf_dev,
620 "user PPR [%02d]: 0x%016jx%016jx\n", i,
621 (uintmax_t)isf_read_reg64(sc, reg+4),
622 (uintmax_t)isf_read_reg64(sc, reg));
625 isf_write_cmd(sc, 0, ISF_CMD_RA);
629 isf_disk_insert(struct isf_softc *sc, off_t mediasize)
635 sc->isf_bstate = malloc(sizeof(*sc->isf_bstate) *
636 (mediasize / ISF_ERASE_BLOCK), M_ISF, M_ZERO | M_WAITOK);
637 kproc_create(&isf_task, sc, &sc->isf_proc, 0, 0, "isf");
641 disk->d_name = "isf";
642 disk->d_unit = sc->isf_unit;
643 disk->d_strategy = isf_disk_strategy;
644 disk->d_ioctl = isf_disk_ioctl;
645 disk->d_sectorsize = ISF_SECTORSIZE;
646 disk->d_mediasize = mediasize;
647 disk->d_maxsize = ISF_SECTORSIZE;
653 disk_create(disk, DISK_VERSION);
654 device_printf(sc->isf_dev, "%juM flash device\n",
655 (uintmax_t)disk->d_mediasize / (1024 * 1024));
660 isf_disk_remove(struct isf_softc *sc)
665 KASSERT(sc->isf_disk != NULL, ("%s: isf_disk NULL", __func__));
669 ISF_SLEEP(sc, sc->isf_proc, 0);
672 * XXXRW: Is it OK to call disk_destroy() under the mutex, or should
673 * we be deferring that to the calling context once it is released?
679 free(sc->isf_bstate, M_ISF);
680 device_printf(sc->isf_dev, "flash device removed\n");
684 isf_attach(struct isf_softc *sc)
688 struct isf_chips *cp = chip_ids;
690 start = rman_get_start(sc->isf_res);
691 if (start % 2 != 0) {
692 device_printf(sc->isf_dev,
693 "Unsupported flash start alignment %lu\n",
698 isf_write_cmd(sc, 0, ISF_CMD_RDI);
699 id = isf_read_reg(sc, ISF_REG_ID);
700 while (cp->chip_id != id)
702 if (cp->chip_desc == NULL) {
703 device_printf(sc->isf_dev,
704 "Unsupported device ID 0x%04x\n", id);
707 isf_write_cmd(sc, 0, ISF_CMD_RA);
709 size = rman_get_size(sc->isf_res);
710 if (size != cp->chip_size) {
711 device_printf(sc->isf_dev,
712 "Unsupported flash size %lu\n", size);
716 bioq_init(&sc->isf_bioq);
719 isf_disk_insert(sc, size);
724 isf_detach(struct isf_softc *sc)
728 * Simulate a disk removal if one is present to deal with any pending
729 * or queued I/O. This will occur as a result of a device driver
730 * detach -- the Intel StrataFlash has no notion of removal itself.
732 * XXXRW: Is the locking here right?
736 bioq_flush(&sc->isf_bioq, NULL, ENXIO);
737 KASSERT(bioq_first(&sc->isf_bioq) == NULL,
738 ("%s: non-empty bioq", __func__));
740 ISF_LOCK_DESTROY(sc);