blob: 9cab10aa08d6effde820dfbaacf96bb40d36e49c [file] [log] [blame]
/*
* This file is part of the flashrom project.
*
* Copyright (C) 2007, 2008, 2009, 2010 Carl-Daniel Hailfinger
* Copyright (C) 2008 coresystems GmbH
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; version 2 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
/*
* Contains the common SPI chip driver functions
*/
#include <string.h>
#include "flash.h"
#include "flashchips.h"
#include "chipdrivers.h"
#include "programmer.h"
#include "spi.h"
void spi_prettyprint_status_register(struct flashchip *flash);
static int spi_rdid(unsigned char *readarr, int bytes)
{
const unsigned char cmd[JEDEC_RDID_OUTSIZE] = { JEDEC_RDID };
int ret;
int i;
ret = spi_send_command(sizeof(cmd), bytes, cmd, readarr);
if (ret)
return ret;
msg_cspew("RDID returned");
for (i = 0; i < bytes; i++)
msg_cspew(" 0x%02x", readarr[i]);
msg_cspew(". ");
return 0;
}
static int spi_rems(unsigned char *readarr)
{
unsigned char cmd[JEDEC_REMS_OUTSIZE] = { JEDEC_REMS, 0, 0, 0 };
uint32_t readaddr;
int ret;
ret = spi_send_command(sizeof(cmd), JEDEC_REMS_INSIZE, cmd, readarr);
if (ret == SPI_INVALID_ADDRESS) {
/* Find the lowest even address allowed for reads. */
readaddr = (spi_get_valid_read_addr() + 1) & ~1;
cmd[1] = (readaddr >> 16) & 0xff,
cmd[2] = (readaddr >> 8) & 0xff,
cmd[3] = (readaddr >> 0) & 0xff,
ret = spi_send_command(sizeof(cmd), JEDEC_REMS_INSIZE, cmd, readarr);
}
if (ret)
return ret;
msg_cspew("REMS returned %02x %02x. ", readarr[0], readarr[1]);
return 0;
}
static int spi_res(unsigned char *readarr, int bytes)
{
unsigned char cmd[JEDEC_RES_OUTSIZE] = { JEDEC_RES, 0, 0, 0 };
uint32_t readaddr;
int ret;
int i;
ret = spi_send_command(sizeof(cmd), bytes, cmd, readarr);
if (ret == SPI_INVALID_ADDRESS) {
/* Find the lowest even address allowed for reads. */
readaddr = (spi_get_valid_read_addr() + 1) & ~1;
cmd[1] = (readaddr >> 16) & 0xff,
cmd[2] = (readaddr >> 8) & 0xff,
cmd[3] = (readaddr >> 0) & 0xff,
ret = spi_send_command(sizeof(cmd), bytes, cmd, readarr);
}
if (ret)
return ret;
msg_cspew("RES returned");
for (i = 0; i < bytes; i++)
msg_cspew(" 0x%02x", readarr[i]);
msg_cspew(". ");
return 0;
}
int spi_write_enable(void)
{
const unsigned char cmd[JEDEC_WREN_OUTSIZE] = { JEDEC_WREN };
int result;
/* Send WREN (Write Enable) */
result = spi_send_command(sizeof(cmd), 0, cmd, NULL);
if (result)
msg_cerr("%s failed\n", __func__);
return result;
}
int spi_write_disable(void)
{
const unsigned char cmd[JEDEC_WRDI_OUTSIZE] = { JEDEC_WRDI };
/* Send WRDI (Write Disable) */
return spi_send_command(sizeof(cmd), 0, cmd, NULL);
}
static int probe_spi_rdid_generic(struct flashchip *flash, int bytes)
{
unsigned char readarr[4];
uint32_t id1;
uint32_t id2;
if (spi_rdid(readarr, bytes))
return 0;
if (!oddparity(readarr[0]))
msg_cdbg("RDID byte 0 parity violation. ");
/* Check if this is a continuation vendor ID.
* FIXME: Handle continuation device IDs.
*/
if (readarr[0] == 0x7f) {
if (!oddparity(readarr[1]))
msg_cdbg("RDID byte 1 parity violation. ");
id1 = (readarr[0] << 8) | readarr[1];
id2 = readarr[2];
if (bytes > 3) {
id2 <<= 8;
id2 |= readarr[3];
}
} else {
id1 = readarr[0];
id2 = (readarr[1] << 8) | readarr[2];
}
msg_cdbg("%s: id1 0x%02x, id2 0x%02x\n", __func__, id1, id2);
if (id1 == flash->manufacture_id && id2 == flash->model_id) {
/* Print the status register to tell the
* user about possible write protection.
*/
spi_prettyprint_status_register(flash);
return 1;
}
/* Test if this is a pure vendor match. */
if (id1 == flash->manufacture_id &&
GENERIC_DEVICE_ID == flash->model_id)
return 1;
/* Test if there is any vendor ID. */
if (GENERIC_MANUF_ID == flash->manufacture_id &&
id1 != 0xff)
return 1;
return 0;
}
int probe_spi_rdid(struct flashchip *flash)
{
return probe_spi_rdid_generic(flash, 3);
}
int probe_spi_rdid4(struct flashchip *flash)
{
/* Some SPI controllers do not support commands with writecnt=1 and
* readcnt=4.
*/
switch (spi_controller) {
#if CONFIG_INTERNAL == 1
#if defined(__i386__) || defined(__x86_64__)
case SPI_CONTROLLER_IT87XX:
case SPI_CONTROLLER_WBSIO:
msg_cinfo("4 byte RDID not supported on this SPI controller\n");
return 0;
break;
#endif
#endif
default:
return probe_spi_rdid_generic(flash, 4);
}
return 0;
}
int probe_spi_rems(struct flashchip *flash)
{
unsigned char readarr[JEDEC_REMS_INSIZE];
uint32_t id1, id2;
if (spi_rems(readarr))
return 0;
id1 = readarr[0];
id2 = readarr[1];
msg_cdbg("%s: id1 0x%x, id2 0x%x\n", __func__, id1, id2);
if (id1 == flash->manufacture_id && id2 == flash->model_id) {
/* Print the status register to tell the
* user about possible write protection.
*/
spi_prettyprint_status_register(flash);
return 1;
}
/* Test if this is a pure vendor match. */
if (id1 == flash->manufacture_id &&
GENERIC_DEVICE_ID == flash->model_id)
return 1;
/* Test if there is any vendor ID. */
if (GENERIC_MANUF_ID == flash->manufacture_id &&
id1 != 0xff)
return 1;
return 0;
}
int probe_spi_res1(struct flashchip *flash)
{
unsigned char readarr[3];
uint32_t id2;
const unsigned char allff[] = {0xff, 0xff, 0xff};
const unsigned char all00[] = {0x00, 0x00, 0x00};
/* We only want one-byte RES if RDID and REMS are unusable. */
/* Check if RDID is usable and does not return 0xff 0xff 0xff or
* 0x00 0x00 0x00. In that case, RES is pointless.
*/
if (!spi_rdid(readarr, 3) && memcmp(readarr, allff, 3) &&
memcmp(readarr, all00, 3)) {
msg_cdbg("Ignoring RES in favour of RDID.\n");
return 0;
}
/* Check if REMS is usable and does not return 0xff 0xff or
* 0x00 0x00. In that case, RES is pointless.
*/
if (!spi_rems(readarr) && memcmp(readarr, allff, JEDEC_REMS_INSIZE) &&
memcmp(readarr, all00, JEDEC_REMS_INSIZE)) {
msg_cdbg("Ignoring RES in favour of REMS.\n");
return 0;
}
if (spi_res(readarr, 1))
return 0;
id2 = readarr[0];
msg_cdbg("%s: id 0x%x\n", __func__, id2);
if (id2 != flash->model_id)
return 0;
/* Print the status register to tell the
* user about possible write protection.
*/
spi_prettyprint_status_register(flash);
return 1;
}
int probe_spi_res2(struct flashchip *flash)
{
unsigned char readarr[2];
uint32_t id1, id2;
if (spi_res(readarr, 2))
return 0;
id1 = readarr[0];
id2 = readarr[1];
msg_cdbg("%s: id1 0x%x, id2 0x%x\n", __func__, id1, id2);
if (id1 != flash->manufacture_id || id2 != flash->model_id)
return 0;
/* Print the status register to tell the
* user about possible write protection.
*/
spi_prettyprint_status_register(flash);
return 1;
}
uint8_t spi_read_status_register(void)
{
const unsigned char cmd[JEDEC_RDSR_OUTSIZE] = { JEDEC_RDSR };
/* FIXME: No workarounds for driver/hardware bugs in generic code. */
unsigned char readarr[2]; /* JEDEC_RDSR_INSIZE=1 but wbsio needs 2 */
int ret;
/* Read Status Register */
ret = spi_send_command(sizeof(cmd), sizeof(readarr), cmd, readarr);
if (ret)
msg_cerr("RDSR failed!\n");
return readarr[0];
}
/* Prettyprint the status register. Common definitions. */
static void spi_prettyprint_status_register_welwip(uint8_t status)
{
msg_cdbg("Chip status register: Write Enable Latch (WEL) is "
"%sset\n", (status & (1 << 1)) ? "" : "not ");
msg_cdbg("Chip status register: Write In Progress (WIP/BUSY) is "
"%sset\n", (status & (1 << 0)) ? "" : "not ");
}
/* Prettyprint the status register. Common definitions. */
static void spi_prettyprint_status_register_common(uint8_t status)
{
msg_cdbg("Chip status register: Bit 5 / Block Protect 3 (BP3) is "
"%sset\n", (status & (1 << 5)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 4 / Block Protect 2 (BP2) is "
"%sset\n", (status & (1 << 4)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 3 / Block Protect 1 (BP1) is "
"%sset\n", (status & (1 << 3)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 2 / Block Protect 0 (BP0) is "
"%sset\n", (status & (1 << 2)) ? "" : "not ");
spi_prettyprint_status_register_welwip(status);
}
/* Prettyprint the status register. Works for
* AMIC A25L series
*/
void spi_prettyprint_status_register_amic_a25l(uint8_t status)
{
msg_cdbg("Chip status register: Status Register Write Disable "
"(SRWD) is %sset\n", (status & (1 << 7)) ? "" : "not ");
spi_prettyprint_status_register_common(status);
}
/* Prettyprint the status register. Common definitions. */
static void spi_prettyprint_status_register_at25_srplepewpp(uint8_t status)
{
msg_cdbg("Chip status register: Sector Protection Register Lock (SRPL) "
"is %sset\n", (status & (1 << 7)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 6 "
"is %sset\n", (status & (1 << 6)) ? "" : "not ");
msg_cdbg("Chip status register: Erase/Program Error (EPE) "
"is %sset\n", (status & (1 << 5)) ? "" : "not ");
msg_cdbg("Chip status register: WP# pin (WPP) "
"is %sactive\n", (status & (1 << 4)) ? "not " : "");
}
int spi_prettyprint_status_register_at25df(struct flashchip *flash)
{
uint8_t status;
status = spi_read_status_register();
msg_cdbg("Chip status register is %02x\n", status);
spi_prettyprint_status_register_at25_srplepewpp(status);
msg_cdbg("Chip status register: Software Protection Status (SWP): ");
switch (status & (3 << 2)) {
case 0x0 << 2:
msg_cdbg("no sectors are protected\n");
break;
case 0x1 << 2:
msg_cdbg("some sectors are protected\n");
/* FIXME: Read individual Sector Protection Registers. */
break;
case 0x3 << 2:
msg_cdbg("all sectors are protected\n");
break;
default:
msg_cdbg("reserved for future use\n");
break;
}
spi_prettyprint_status_register_welwip(status);
return 0;
}
int spi_prettyprint_status_register_at25df_sec(struct flashchip *flash)
{
/* FIXME: We should check the security lockdown. */
msg_cdbg("Ignoring security lockdown (if present)\n");
msg_cdbg("Ignoring status register byte 2\n");
return spi_prettyprint_status_register_at25df(flash);
}
int spi_prettyprint_status_register_at25f(struct flashchip *flash)
{
uint8_t status;
status = spi_read_status_register();
msg_cdbg("Chip status register is %02x\n", status);
spi_prettyprint_status_register_at25_srplepewpp(status);
msg_cdbg("Chip status register: Bit 3 "
"is %sset\n", (status & (1 << 3)) ? "" : "not ");
msg_cdbg("Chip status register: Block Protect 0 (BP0) is "
"%sset, %s sectors are protected\n",
(status & (1 << 2)) ? "" : "not ",
(status & (1 << 2)) ? "all" : "no");
spi_prettyprint_status_register_welwip(status);
return 0;
}
int spi_prettyprint_status_register_at25fs010(struct flashchip *flash)
{
uint8_t status;
status = spi_read_status_register();
msg_cdbg("Chip status register is %02x\n", status);
msg_cdbg("Chip status register: Status Register Write Protect (WPEN) "
"is %sset\n", (status & (1 << 7)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 6 / Block Protect 4 (BP4) is "
"%sset\n", (status & (1 << 6)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 5 / Block Protect 3 (BP3) is "
"%sset\n", (status & (1 << 5)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 4 is "
"%sset\n", (status & (1 << 4)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 3 / Block Protect 1 (BP1) is "
"%sset\n", (status & (1 << 3)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 2 / Block Protect 0 (BP0) is "
"%sset\n", (status & (1 << 2)) ? "" : "not ");
/* FIXME: Pretty-print detailed sector protection status. */
spi_prettyprint_status_register_welwip(status);
return 0;
}
int spi_prettyprint_status_register_at25fs040(struct flashchip *flash)
{
uint8_t status;
status = spi_read_status_register();
msg_cdbg("Chip status register is %02x\n", status);
msg_cdbg("Chip status register: Status Register Write Protect (WPEN) "
"is %sset\n", (status & (1 << 7)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 6 / Block Protect 4 (BP4) is "
"%sset\n", (status & (1 << 6)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 5 / Block Protect 3 (BP3) is "
"%sset\n", (status & (1 << 5)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 4 / Block Protect 2 (BP2) is "
"%sset\n", (status & (1 << 4)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 3 / Block Protect 1 (BP1) is "
"%sset\n", (status & (1 << 3)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 2 / Block Protect 0 (BP0) is "
"%sset\n", (status & (1 << 2)) ? "" : "not ");
/* FIXME: Pretty-print detailed sector protection status. */
spi_prettyprint_status_register_welwip(status);
return 0;
}
/* Prettyprint the status register. Works for
* ST M25P series
* MX MX25L series
*/
void spi_prettyprint_status_register_st_m25p(uint8_t status)
{
msg_cdbg("Chip status register: Status Register Write Disable "
"(SRWD) is %sset\n", (status & (1 << 7)) ? "" : "not ");
msg_cdbg("Chip status register: Bit 6 is "
"%sset\n", (status & (1 << 6)) ? "" : "not ");
spi_prettyprint_status_register_common(status);
}
void spi_prettyprint_status_register_sst25(uint8_t status)
{
msg_cdbg("Chip status register: Block Protect Write Disable "
"(BPL) is %sset\n", (status & (1 << 7)) ? "" : "not ");
msg_cdbg("Chip status register: Auto Address Increment Programming "
"(AAI) is %sset\n", (status & (1 << 6)) ? "" : "not ");
spi_prettyprint_status_register_common(status);
}
/* Prettyprint the status register. Works for
* SST 25VF016
*/
void spi_prettyprint_status_register_sst25vf016(uint8_t status)
{
const char *bpt[] = {
"none",
"1F0000H-1FFFFFH",
"1E0000H-1FFFFFH",
"1C0000H-1FFFFFH",
"180000H-1FFFFFH",
"100000H-1FFFFFH",
"all", "all"
};
spi_prettyprint_status_register_sst25(status);
msg_cdbg("Resulting block protection : %s\n",
bpt[(status & 0x1c) >> 2]);
}
void spi_prettyprint_status_register_sst25vf040b(uint8_t status)
{
const char *bpt[] = {
"none",
"0x70000-0x7ffff",
"0x60000-0x7ffff",
"0x40000-0x7ffff",
"all blocks", "all blocks", "all blocks", "all blocks"
};
spi_prettyprint_status_register_sst25(status);
msg_cdbg("Resulting block protection : %s\n",
bpt[(status & 0x1c) >> 2]);
}
void spi_prettyprint_status_register(struct flashchip *flash)
{
uint8_t status;
status = spi_read_status_register();
msg_cdbg("Chip status register is %02x\n", status);
switch (flash->manufacture_id) {
case AMIC_ID:
if ((flash->model_id & 0xff00) == 0x2000)
spi_prettyprint_status_register_amic_a25l(status);
break;
case ST_ID:
if (((flash->model_id & 0xff00) == 0x2000) ||
((flash->model_id & 0xff00) == 0x2500))
spi_prettyprint_status_register_st_m25p(status);
break;
case MACRONIX_ID:
if ((flash->model_id & 0xff00) == 0x2000)
spi_prettyprint_status_register_st_m25p(status);
break;
case SST_ID:
switch (flash->model_id) {
case 0x2541:
spi_prettyprint_status_register_sst25vf016(status);
break;
case 0x8d:
case 0x258d:
spi_prettyprint_status_register_sst25vf040b(status);
break;
default:
spi_prettyprint_status_register_sst25(status);
break;
}
break;
}
}
int spi_chip_erase_60(struct flashchip *flash)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_CE_60_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_CE_60 },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution\n",
__func__);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 1-85 s, so wait in 1 s steps.
*/
/* FIXME: We assume spi_read_status_register will never fail. */
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(1000 * 1000);
if (check_erased_range(flash, 0, flash->total_size * 1024)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
int spi_chip_erase_c7(struct flashchip *flash)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_CE_C7_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_CE_C7 },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution\n", __func__);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 1-85 s, so wait in 1 s steps.
*/
/* FIXME: We assume spi_read_status_register will never fail. */
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(1000 * 1000);
if (check_erased_range(flash, 0, flash->total_size * 1024)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
int spi_block_erase_52(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BE_52_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_BE_52,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 100-4000 ms, so wait in 100 ms steps.
*/
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(100 * 1000);
if (check_erased_range(flash, addr, blocklen)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
/* Block size is usually
* 64k for Macronix
* 32k for SST
* 4-32k non-uniform for EON
*/
int spi_block_erase_d8(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BE_D8_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_BE_D8,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 100-4000 ms, so wait in 100 ms steps.
*/
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(100 * 1000);
if (check_erased_range(flash, addr, blocklen)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
/* Block size is usually
* 4k for PMC
*/
int spi_block_erase_d7(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BE_D7_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_BE_D7,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 100-4000 ms, so wait in 100 ms steps.
*/
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(100 * 1000);
if (check_erased_range(flash, addr, blocklen)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
/* Sector size is usually 4k, though Macronix eliteflash has 64k */
int spi_block_erase_20(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_SE_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_SE,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff)
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
return result;
}
/* Wait until the Write-In-Progress bit is cleared.
* This usually takes 15-800 ms, so wait in 10 ms steps.
*/
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(10 * 1000);
if (check_erased_range(flash, addr, blocklen)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
return 0;
}
int spi_block_erase_60(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
if ((addr != 0) || (blocklen != flash->total_size * 1024)) {
msg_cerr("%s called with incorrect arguments\n",
__func__);
return -1;
}
return spi_chip_erase_60(flash);
}
int spi_block_erase_c7(struct flashchip *flash, unsigned int addr, unsigned int blocklen)
{
if ((addr != 0) || (blocklen != flash->total_size * 1024)) {
msg_cerr("%s called with incorrect arguments\n",
__func__);
return -1;
}
return spi_chip_erase_c7(flash);
}
int spi_write_status_enable(void)
{
const unsigned char cmd[JEDEC_EWSR_OUTSIZE] = { JEDEC_EWSR };
int result;
/* Send EWSR (Enable Write Status Register). */
result = spi_send_command(sizeof(cmd), JEDEC_EWSR_INSIZE, cmd, NULL);
if (result)
msg_cerr("%s failed\n", __func__);
return result;
}
/*
* This is according the SST25VF016 datasheet, who knows it is more
* generic that this...
*/
static int spi_write_status_register_ewsr(struct flashchip *flash, int status)
{
int result;
struct spi_command cmds[] = {
{
/* WRSR requires either EWSR or WREN depending on chip type. */
.writecnt = JEDEC_EWSR_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_EWSR },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_WRSR_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WRSR, (unsigned char) status },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution\n",
__func__);
}
/* WRSR performs a self-timed erase before the changes take effect. */
programmer_delay(100 * 1000);
return result;
}
static int spi_write_status_register_wren(struct flashchip *flash, int status)
{
int result;
struct spi_command cmds[] = {
{
/* WRSR requires either EWSR or WREN depending on chip type. */
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_WRSR_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WRSR, (unsigned char) status },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution\n",
__func__);
}
/* WRSR performs a self-timed erase before the changes take effect. */
programmer_delay(100 * 1000);
return result;
}
static int spi_write_status_register(struct flashchip *flash, int status)
{
int ret = 1;
if (!(flash->feature_bits & (FEATURE_WRSR_WREN | FEATURE_WRSR_EWSR))) {
msg_cdbg("Missing status register write definition, assuming "
"EWSR is needed\n");
flash->feature_bits |= FEATURE_WRSR_EWSR;
}
if (flash->feature_bits & FEATURE_WRSR_WREN)
ret = spi_write_status_register_wren(flash, status);
if (ret && (flash->feature_bits & FEATURE_WRSR_EWSR))
ret = spi_write_status_register_ewsr(flash, status);
return ret;
}
int spi_byte_program(int addr, uint8_t databyte)
{
int result;
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BYTE_PROGRAM_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_BYTE_PROGRAM,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr & 0xff),
databyte
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
}
return result;
}
int spi_nbyte_program(int addr, uint8_t *bytes, int len)
{
int result;
/* FIXME: Switch to malloc based on len unless that kills speed. */
unsigned char cmd[JEDEC_BYTE_PROGRAM_OUTSIZE - 1 + 256] = {
JEDEC_BYTE_PROGRAM,
(addr >> 16) & 0xff,
(addr >> 8) & 0xff,
(addr >> 0) & 0xff,
};
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_BYTE_PROGRAM_OUTSIZE - 1 + len,
.writearr = cmd,
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
if (!len) {
msg_cerr("%s called for zero-length write\n", __func__);
return 1;
}
if (len > 256) {
msg_cerr("%s called for too long a write\n", __func__);
return 1;
}
memcpy(&cmd[4], bytes, len);
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during command execution at address 0x%x\n",
__func__, addr);
}
return result;
}
/* A generic brute-force block protection disable works like this:
* Write 0x00 to the status register. Check if any locks are still set (that
* part is chip specific). Repeat once.
*/
int spi_disable_blockprotect(struct flashchip *flash)
{
uint8_t status;
int result;
status = spi_read_status_register();
/* If block protection is disabled, stop here. */
if ((status & 0x3c) == 0)
return 0;
msg_cdbg("Some block protection in effect, disabling\n");
result = spi_write_status_register(flash, status & ~0x3c);
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
status = spi_read_status_register();
if ((status & 0x3c) != 0) {
msg_cerr("Block protection could not be disabled!\n");
return 1;
}
return 0;
}
int spi_disable_blockprotect_at25df(struct flashchip *flash)
{
uint8_t status;
int result;
status = spi_read_status_register();
/* If block protection is disabled, stop here. */
if ((status & (3 << 2)) == 0)
return 0;
msg_cdbg("Some block protection in effect, disabling\n");
if (status & (1 << 7)) {
msg_cdbg("Need to disable Sector Protection Register Lock\n");
if ((status & (1 << 4)) == 0) {
msg_cerr("WP# pin is active, disabling "
"write protection is impossible.\n");
return 1;
}
/* All bits except bit 7 (SPRL) are readonly. */
result = spi_write_status_register(flash, status & ~(1 << 7));
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
}
/* Global unprotect. Make sure to mask SPRL as well. */
result = spi_write_status_register(flash, status & ~0xbc);
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
status = spi_read_status_register();
if ((status & (3 << 2)) != 0) {
msg_cerr("Block protection could not be disabled!\n");
return 1;
}
return 0;
}
int spi_disable_blockprotect_at25df_sec(struct flashchip *flash)
{
/* FIXME: We should check the security lockdown. */
msg_cinfo("Ignoring security lockdown (if present)\n");
return spi_disable_blockprotect_at25df(flash);
}
int spi_disable_blockprotect_at25f(struct flashchip *flash)
{
/* spi_disable_blockprotect_at25df is not really the right way to do
* this, but the side effects of said function work here as well.
*/
return spi_disable_blockprotect_at25df(flash);
}
int spi_disable_blockprotect_at25fs010(struct flashchip *flash)
{
uint8_t status;
int result;
status = spi_read_status_register();
/* If block protection is disabled, stop here. */
if ((status & 0x6c) == 0)
return 0;
msg_cdbg("Some block protection in effect, disabling\n");
if (status & (1 << 7)) {
msg_cdbg("Need to disable Status Register Write Protect\n");
/* Clear bit 7 (WPEN). */
result = spi_write_status_register(flash, status & ~(1 << 7));
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
}
/* Global unprotect. Make sure to mask WPEN as well. */
result = spi_write_status_register(flash, status & ~0xec);
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
status = spi_read_status_register();
if ((status & 0x6c) != 0) {
msg_cerr("Block protection could not be disabled!\n");
return 1;
}
return 0;
}
int spi_disable_blockprotect_at25fs040(struct flashchip *flash)
{
uint8_t status;
int result;
status = spi_read_status_register();
/* If block protection is disabled, stop here. */
if ((status & 0x7c) == 0)
return 0;
msg_cdbg("Some block protection in effect, disabling\n");
if (status & (1 << 7)) {
msg_cdbg("Need to disable Status Register Write Protect\n");
/* Clear bit 7 (WPEN). */
result = spi_write_status_register(flash, status & ~(1 << 7));
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
}
/* Global unprotect. Make sure to mask WPEN as well. */
result = spi_write_status_register(flash, status & ~0xfc);
if (result) {
msg_cerr("spi_write_status_register failed\n");
return result;
}
status = spi_read_status_register();
if ((status & 0x7c) != 0) {
msg_cerr("Block protection could not be disabled!\n");
return 1;
}
return 0;
}
int spi_nbyte_read(int address, uint8_t *bytes, int len)
{
const unsigned char cmd[JEDEC_READ_OUTSIZE] = {
JEDEC_READ,
(address >> 16) & 0xff,
(address >> 8) & 0xff,
(address >> 0) & 0xff,
};
/* Send Read */
return spi_send_command(sizeof(cmd), len, cmd, bytes);
}
/*
* Read a part of the flash chip.
* FIXME: Use the chunk code from Michael Karcher instead.
* Each page is read separately in chunks with a maximum size of chunksize.
*/
int spi_read_chunked(struct flashchip *flash, uint8_t *buf, int start, int len, int chunksize)
{
int rc = 0;
int i, j, starthere, lenhere;
int page_size = flash->page_size;
int toread;
/* Warning: This loop has a very unusual condition and body.
* The loop needs to go through each page with at least one affected
* byte. The lowest page number is (start / page_size) since that
* division rounds down. The highest page number we want is the page
* where the last byte of the range lives. That last byte has the
* address (start + len - 1), thus the highest page number is
* (start + len - 1) / page_size. Since we want to include that last
* page as well, the loop condition uses <=.
*/
for (i = start / page_size; i <= (start + len - 1) / page_size; i++) {
/* Byte position of the first byte in the range in this page. */
/* starthere is an offset to the base address of the chip. */
starthere = max(start, i * page_size);
/* Length of bytes in the range in this page. */
lenhere = min(start + len, (i + 1) * page_size) - starthere;
for (j = 0; j < lenhere; j += chunksize) {
toread = min(chunksize, lenhere - j);
rc = spi_nbyte_read(starthere + j, buf + starthere - start + j, toread);
if (rc)
break;
}
if (rc)
break;
}
return rc;
}
/*
* Write a part of the flash chip.
* FIXME: Use the chunk code from Michael Karcher instead.
* Each page is written separately in chunks with a maximum size of chunksize.
*/
int spi_write_chunked(struct flashchip *flash, uint8_t *buf, int start, int len, int chunksize)
{
int rc = 0;
int i, j, starthere, lenhere;
/* FIXME: page_size is the wrong variable. We need max_writechunk_size
* in struct flashchip to do this properly. All chips using
* spi_chip_write_256 have page_size set to max_writechunk_size, so
* we're OK for now.
*/
int page_size = flash->page_size;
int towrite;
/* Warning: This loop has a very unusual condition and body.
* The loop needs to go through each page with at least one affected
* byte. The lowest page number is (start / page_size) since that
* division rounds down. The highest page number we want is the page
* where the last byte of the range lives. That last byte has the
* address (start + len - 1), thus the highest page number is
* (start + len - 1) / page_size. Since we want to include that last
* page as well, the loop condition uses <=.
*/
for (i = start / page_size; i <= (start + len - 1) / page_size; i++) {
/* Byte position of the first byte in the range in this page. */
/* starthere is an offset to the base address of the chip. */
starthere = max(start, i * page_size);
/* Length of bytes in the range in this page. */
lenhere = min(start + len, (i + 1) * page_size) - starthere;
for (j = 0; j < lenhere; j += chunksize) {
towrite = min(chunksize, lenhere - j);
rc = spi_nbyte_program(starthere + j, buf + starthere - start + j, towrite);
if (rc)
break;
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(10);
}
if (rc)
break;
}
return rc;
}
/*
* Program chip using byte programming. (SLOW!)
* This is for chips which can only handle one byte writes
* and for chips where memory mapped programming is impossible
* (e.g. due to size constraints in IT87* for over 512 kB)
*/
/* real chunksize is 1, logical chunksize is 1 */
int spi_chip_write_1_new(struct flashchip *flash, uint8_t *buf, int start, int len)
{
int i, result = 0;
for (i = start; i < start + len; i++) {
result = spi_byte_program(i, buf[i]);
if (result)
return 1;
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(10);
}
return 0;
}
int spi_chip_write_1(struct flashchip *flash, uint8_t *buf)
{
/* Erase first */
msg_cinfo("Erasing flash before programming... ");
if (erase_flash(flash)) {
msg_cerr("ERASE FAILED!\n");
return -1;
}
msg_cinfo("done.\n");
return spi_chip_write_1_new(flash, buf, 0, flash->total_size * 1024);
}
int spi_aai_write(struct flashchip *flash, uint8_t *buf, int start, int len)
{
uint32_t pos = start;
int result;
unsigned char cmd[JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE] = {
JEDEC_AAI_WORD_PROGRAM,
};
struct spi_command cmds[] = {
{
.writecnt = JEDEC_WREN_OUTSIZE,
.writearr = (const unsigned char[]){ JEDEC_WREN },
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = JEDEC_AAI_WORD_PROGRAM_OUTSIZE,
.writearr = (const unsigned char[]){
JEDEC_AAI_WORD_PROGRAM,
(start >> 16) & 0xff,
(start >> 8) & 0xff,
(start & 0xff),
buf[0],
buf[1]
},
.readcnt = 0,
.readarr = NULL,
}, {
.writecnt = 0,
.writearr = NULL,
.readcnt = 0,
.readarr = NULL,
}};
switch (spi_controller) {
#if CONFIG_INTERNAL == 1
#if defined(__i386__) || defined(__x86_64__)
case SPI_CONTROLLER_IT87XX:
case SPI_CONTROLLER_WBSIO:
msg_perr("%s: impossible with this SPI controller,"
" degrading to byte program\n", __func__);
return spi_chip_write_1_new(flash, buf, start, len);
#endif
#endif
default:
break;
}
/* The even start address and even length requirements can be either
* honored outside this function, or we can call spi_byte_program
* for the first and/or last byte and use AAI for the rest.
*/
/* The data sheet requires a start address with the low bit cleared. */
if (start % 2) {
msg_cerr("%s: start address not even! Please report a bug at "
"flashrom@flashrom.org\n", __func__);
return SPI_GENERIC_ERROR;
}
/* The data sheet requires total AAI write length to be even. */
if (len % 2) {
msg_cerr("%s: total write length not even! Please report a "
"bug at flashrom@flashrom.org\n", __func__);
return SPI_GENERIC_ERROR;
}
result = spi_send_multicommand(cmds);
if (result) {
msg_cerr("%s failed during start command execution\n",
__func__);
/* FIXME: Should we send WRDI here as well to make sure the chip
* is not in AAI mode?
*/
return result;
}
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(10);
/* We already wrote 2 bytes in the multicommand step. */
pos += 2;
while (pos < start + len) {
cmd[1] = buf[pos++];
cmd[2] = buf[pos++];
spi_send_command(JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, cmd, NULL);
while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
programmer_delay(10);
}
/* Use WRDI to exit AAI mode. */
spi_write_disable();
return 0;
}