From: Venkatesh Yadav Abbarapu venkatesh.abbarapu@amd.com
ISSI chips implements locking in (power-of-two multiple of) 64K blocks, not as a fraction of the chip's size. Bit 5 in the status register is not a top/bottom select bit, but instead a fourth value bit, allowing locking between 2^0 and 2^14 64K blocks (so up to 1GiB), either from top or bottom.
The top/bottom select is instead done via a bit in the function register, which is OTP, so once set to use bottom protect, one cannot use top. On top of that, reading the function register uses a opcode SPINOR_OP_RDFR (0x48) and writing to the function register uses the opcode SPINOR_OP_WRFR(0x42).
Here's an attempt at implementing a locking feature for ISSI flash memory devices. This implementation has been rigorously tested and proven to work on the chip used in our boards. Additionally, after examining data sheets for various other ISSI chips, it appears that they follow a similar behavior.
Used "bottom protect" to test the lock and unlock functionality on the Versal Tenzing board. Please note that the Block Protection table is specific to the IS25LP01G, which has a size of 128MB, a sector size of 64KB, and comprises 2048 sectors.
Signed-off-by: Venkatesh Yadav Abbarapu venkatesh.abbarapu@amd.com Signed-off-by: Tejas Bhumkar tejas.arvind.bhumkar@amd.com --- drivers/mtd/spi/sf_internal.h | 6 + drivers/mtd/spi/spi-nor-core.c | 340 +++++++++++++++++++++++++++++++++ include/linux/mtd/spi-nor.h | 7 + 3 files changed, 353 insertions(+)
diff --git a/drivers/mtd/spi/sf_internal.h b/drivers/mtd/spi/sf_internal.h index 2cbdea60b0..aaa8520838 100644 --- a/drivers/mtd/spi/sf_internal.h +++ b/drivers/mtd/spi/sf_internal.h @@ -71,6 +71,12 @@ struct flash_info { #define SPI_NOR_OCTAL_DTR_READ BIT(17) /* Flash supports Octal DTR Read */ #define SPI_NOR_OCTAL_DTR_PP BIT(18) /* Flash supports Octal DTR page program */ #define SPI_NOR_MULTI_DIE BIT(19) /* Flash has multi dies & need split reads*/ +#define SPI_NOR_HAS_BP3 BIT(20) /* Flash SR has block protect bits + * for lock/unlock purpose, few support + * BP0-BP2 while few support BP0-BP3. + * This flag identifies devices that + * support BP3 bit. + */ };
extern const struct flash_info spi_nor_ids[]; diff --git a/drivers/mtd/spi/spi-nor-core.c b/drivers/mtd/spi/spi-nor-core.c index 08f6fb66be..3bf1e5471b 100644 --- a/drivers/mtd/spi/spi-nor-core.c +++ b/drivers/mtd/spi/spi-nor-core.c @@ -4832,6 +4832,338 @@ static int mx_is_unlocked(struct spi_nor *nor, loff_t ofs, uint64_t len) return mx_check_lock_status(nor, ofs, len, sr, cr, false); } #endif /* CONFIG_SPI_FLASH_MACRONIX */ + +#if defined(CONFIG_SPI_FLASH_ISSI) +/** + * spi_nor_read_fr() - read function register + * @nor: pointer to a 'struct spi_nor'. + * + * ISSI devices have top/bottom area protection bits selection into function + * reg. The bits in FR are OTP. So once it's written, it cannot be changed. + * + * Return: Value in function register or negative if error. + */ +static int spi_nor_read_fr(struct spi_nor *nor) +{ + int ret; + u8 val; + + ret = nor->read_reg(nor, SPINOR_OP_RDFR, &val, 1); + if (ret < 0) { + dev_dbg(nor->dev, "error %d reading FR\n", ret); + return ret; + } + + return val; +} + +static void issi_get_locked_range(struct spi_nor *nor, u8 sr, loff_t *ofs, + uint64_t *len) +{ + struct mtd_info *mtd = &nor->mtd; + u8 mask = 0, fr = 0; + int pow, shift; + u32 sector_size; + + mask = SR_BP0 | SR_BP1 | SR_BP2 | SR_BP3_ISSI; + shift = ffs(mask) - 1; + sector_size = nor->sector_size; + + if (nor->flags & SNOR_F_HAS_PARALLEL) + sector_size >>= 1; + + if (!(sr & mask)) { + /* No protection */ + *ofs = 0; + *len = 0; + } else { + pow = ((sr & mask) >> shift) - 1; + *len = sector_size << pow; + if (*len > mtd->size) + *len = mtd->size; + /* ISSI device's have top/bottom select bit in function reg */ + fr = spi_nor_read_fr(nor); + if (fr & FR_TB) + *ofs = 0; + else + *ofs = mtd->size - *len; + } +} + +/** + * issi_check_lock_status_sr() - check the status register and return + * the region is locked or unlocked + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset of the flash + * @len: length to be locked + * @sr: status register + * @locked: locked:1 unlocked:0 value + * + * Return: 1 if the entire region is locked (if @locked is true) or unlocked (if + * @locked is false); 0 otherwise. + */ +static int issi_check_lock_status_sr(struct spi_nor *nor, loff_t ofs, u64 len, + u8 sr, bool locked) +{ + loff_t lock_offs; + u64 lock_len; + + if (!len) + return 1; + + issi_get_locked_range(nor, sr, &lock_offs, &lock_len); + if (locked) + /* Requested range is a sub-range of locked range */ + return (ofs + len <= lock_offs + lock_len) && (ofs >= lock_offs); + + /* Requested range does not overlap with locked range */ + return (ofs >= lock_offs + lock_len) || (ofs + len <= lock_offs); +} + +/** + * spi_nor_is_locked_sr() - check if the memory region is locked + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset of the flash + * @len: length to be locked + * @sr: status register + * + * Check if memory region is locked. + * + * Return: false if region is locked 0 otherwise. + */ +static int spi_nor_is_locked_sr(struct spi_nor *nor, loff_t ofs, uint64_t len, + u8 sr) +{ + return issi_check_lock_status_sr(nor, ofs, len, sr, true); +} + +/** + * spi_nor_is_unlocked_sr() - check if the memory region is unlocked + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset of the flash + * @len: length to be locked + * @sr: status register + * + * Check if memory region is unlocked. + * + * Return: false if region is locked 0 otherwise. + */ +static int spi_nor_is_unlocked_sr(struct spi_nor *nor, loff_t ofs, uint64_t len, + u8 sr) +{ + return issi_check_lock_status_sr(nor, ofs, len, sr, false); +} + +/** + * issi_is_unlocked() - check if the memory region is unlocked + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset of the flash + * @len: length to be locked + * + * Check if memory region is unlocked + * + * Return: false if region is locked 0 otherwise. + */ +static int issi_is_unlocked(struct spi_nor *nor, loff_t ofs, uint64_t len) +{ + int sr; + + sr = read_sr(nor); + if (sr < 0) + return sr; + + return issi_check_lock_status_sr(nor, ofs, len, sr, false); +} + +/** + * spi_nor_select_zone() - Select top area or bottom area to lock/unlock + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset from which to lock memory. + * @len: number of bytes to unlock. + * @sr: status register + * @tb: pointer to top/bottom bool used in caller function + * @op: zone selection is for lock/unlock operation. 1: lock 0:unlock + * + * Select the top area / bottom area pattern to protect memory blocks. + * + * Return: negative on errors, 0 on success. + */ +static int spi_nor_select_zone(struct spi_nor *nor, loff_t ofs, uint64_t len, + u8 sr, bool *tb, bool op) +{ + int retval = 1; + bool can_be_bottom = nor->flags & SNOR_F_HAS_SR_TB, can_be_top = true; + + if (op) { + /* Select for lock zone operation */ + + /* + * If nothing in our range is unlocked, we don't need + * to do anything. + */ + if (spi_nor_is_locked_sr(nor, ofs, len, sr)) + return 0; + + /* + * If anything below us is unlocked, we can't use 'bottom' + * protection. + */ + if (!spi_nor_is_locked_sr(nor, 0, ofs, sr)) + can_be_bottom = false; + + /* + * If anything above us is unlocked, we can't use 'top' + * protection. + */ + if (!spi_nor_is_locked_sr(nor, ofs + len, + nor->mtd.size - (ofs + len), sr)) + can_be_top = false; + } else { + /* Select unlock zone */ + + /* + * If nothing in our range is locked, we don't need to + * do anything. + */ + if (spi_nor_is_unlocked_sr(nor, ofs, len, sr)) + return 0; + + /* + * If anything below us is locked, we can't use 'top' + * protection + */ + if (!spi_nor_is_unlocked_sr(nor, 0, ofs, sr)) + can_be_top = false; + + /* + * If anything above us is locked, we can't use 'bottom' + * protection + */ + if (!spi_nor_is_unlocked_sr(nor, ofs + len, + nor->mtd.size - (ofs + len), sr)) + can_be_bottom = false; + } + + if (!can_be_bottom && !can_be_top) + return -EINVAL; + + /* Prefer top, if both are valid */ + *tb = can_be_top; + return retval; +} + +/** + * issi_flash_lock() - set BP[0123] write-protection. + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset from which to lock memory. + * @len: number of bytes to unlock. + * + * Lock a region of the flash.Implementation is based on stm_lock + * Supports the block protection bits BP{0,1,2,3} in status register + * + * Return: 0 on success, -errno otherwise. + */ +static int issi_flash_lock(struct spi_nor *nor, loff_t ofs, uint64_t len) +{ + u32 sector_size; + u16 n_sectors; + unsigned int bp_slots, bp_slots_needed; + int status_old, status_new, blk_prot, fr, shift; + loff_t lock_len; + u8 pow, ret; + bool use_top = false; + u8 mask = SR_BP0 | SR_BP1 | SR_BP2 | SR_BP3_ISSI; + + shift = ffs(mask) - 1; + + status_old = read_sr(nor); + /* if status reg is Write protected don't update bit protection */ + if (status_old & SR_SRWD) { + dev_err(nor->dev, + "SR is write protected, can't update BP bits...\n"); + return -EINVAL; + } + + fr = spi_nor_read_fr(nor); + log_debug("SPI Protection: %s\n", (fr & FR_TB) ? "bottom" : "top"); + + ret = spi_nor_select_zone(nor, ofs, len, status_old, &use_top, 1); + /* Older protected blocks include the new requested block's */ + if (ret <= 0) + return ret; + + /* lock_len: length of region that should end up locked */ + if (use_top) + lock_len = nor->mtd.size - ofs; + else + lock_len = ofs + len; + + sector_size = nor->sector_size; + n_sectors = (nor->size) / sector_size; + + bp_slots = (1 << hweight8(mask)) - 2; + bp_slots_needed = ilog2(n_sectors); + + if (bp_slots_needed > bp_slots) + sector_size <<= (bp_slots_needed - bp_slots); + + pow = ilog2(lock_len) - ilog2(sector_size) + 1; + blk_prot = pow << shift; + status_new = status_old | blk_prot; + if (status_old == status_new) + return 0; + + return write_sr_and_check(nor, status_new, mask); +} + +/** + * issi_flash_unlock() - clear BP[0123] write-protection. + * @nor: pointer to a 'struct spi_nor'. + * @ofs: offset from which to unlock memory. + * @len: number of bytes to unlock. + * + * Bits [2345] of the Status Register are BP[0123]. + * ISSI chips use a different block protection scheme than other chips. + * Just disable the write-protect unilaterally. + * + * Return: 0 on success, -errno otherwise. + */ +static int issi_flash_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len) +{ + int ret, val; + u8 mask = SR_BP0 | SR_BP1 | SR_BP2 | SR_BP3_ISSI; + + val = read_sr(nor); + if (val < 0) + return val; + + if (!(val & mask)) + return 0; + + write_enable(nor); + + write_sr(nor, val & ~mask); + + ret = spi_nor_wait_till_ready(nor); + if (ret) + return ret; + + ret = write_disable(nor); + if (ret) + return ret; + + ret = read_sr(nor); + if (ret > 0 && !(ret & mask)) { + dev_info(nor->dev, "ISSI block protect bits cleared SR: 0x%x\n", + ret); + ret = 0; + } else { + dev_err(nor->dev, "ISSI block protect bits not cleared\n"); + ret = -EINVAL; + } + return ret; +} +#endif /* CONFIG_SPI_FLASH_ISSI */ #endif /* CONFIG_SPI_FLASH_LOCK */
#ifdef CONFIG_SPI_FLASH_SOFT_RESET @@ -5059,6 +5391,14 @@ int spi_nor_scan(struct spi_nor *nor) } #endif
+#if defined(CONFIG_SPI_FLASH_ISSI) + if (JEDEC_MFR(info) == SNOR_MFR_ISSI) { + nor->flash_lock = issi_flash_lock; + nor->flash_unlock = issi_flash_unlock; + nor->flash_is_unlocked = issi_is_unlocked; + } +#endif + #ifdef CONFIG_SPI_FLASH_SST /* * sst26 series block protection implementation differs from other diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h index 8ca874068a..9a560d94a2 100644 --- a/include/linux/mtd/spi-nor.h +++ b/include/linux/mtd/spi-nor.h @@ -77,6 +77,8 @@ #define SPINOR_OP_WREAR 0xc5 /* Write Extended Address Register */ #define SPINOR_OP_SRSTEN 0x66 /* Software Reset Enable */ #define SPINOR_OP_SRST 0x99 /* Software Reset */ +#define SPINOR_OP_RDFR 0x48 /* Read Function register */ +#define SPINOR_OP_WRFR 0x42 /* Write Function register 1 byte */
/* 4-byte address opcodes - used on Spansion and some Macronix flashes. */ #define SPINOR_OP_READ_4B 0x13 /* Read data bytes (low frequency) */ @@ -169,6 +171,7 @@ #define SR_BP2 BIT(4) /* Block protect 2 */ #define SR_BP3 BIT(6) /* Block protect 3 */ #define SR_BP3_MX BIT(5) /* Block protect 3 (Macronix) */ +#define SR_BP3_ISSI BIT(5) /* Block protect 3 (ISSI) */ #define SR_TB BIT(5) /* Top/Bottom protect */ #define SR_SRWD BIT(7) /* SR write protect */
@@ -192,6 +195,9 @@ #define FSR_P_ERR BIT(4) /* Program operation status */ #define FSR_PT_ERR BIT(1) /* Protection error bit */
+/* Function register bit */ +#define FR_TB BIT(1) /*ISSI: Top/Bottom protect */ + /* Configuration Register bits. */ #define CR_QUAD_EN_SPAN BIT(1) /* Spansion Quad I/O */ #define CR_TB_MX BIT(3) /* Macronix Top/Bottom protect */ @@ -322,6 +328,7 @@ enum spi_nor_option_flags { SNOR_F_IO_MODE_EN_VOLATILE = BIT(8), SNOR_F_HAS_STACKED = BIT(9), SNOR_F_HAS_PARALLEL = BIT(10), + SNOR_F_HAS_BP3 = BIT(11), };
struct spi_nor;