swp.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * SPI NOR Software Write Protection logic.
  4 *
  5 * Copyright (C) 2005, Intec Automation Inc.
  6 * Copyright (C) 2014, Freescale Semiconductor, Inc.
  7 */
  8#include <linux/math64.h>
  9#include <linux/mtd/mtd.h>
 10#include <linux/mtd/spi-nor.h>
 11
 12#include "core.h"
 13
 14static u8 spi_nor_get_sr_bp_mask(struct spi_nor *nor)
 15{
 16	u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
 17
 18	if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6)
 19		return mask | SR_BP3_BIT6;
 20
 21	if (nor->flags & SNOR_F_HAS_4BIT_BP)
 22		return mask | SR_BP3;
 23
 24	return mask;
 25}
 26
 27static u8 spi_nor_get_sr_tb_mask(struct spi_nor *nor)
 28{
 29	if (nor->flags & SNOR_F_HAS_SR_TB_BIT6)
 30		return SR_TB_BIT6;
 31	else
 32		return SR_TB_BIT5;
 33}
 34
 35static u64 spi_nor_get_min_prot_length_sr(struct spi_nor *nor)
 36{
 37	unsigned int bp_slots, bp_slots_needed;
 38	/*
 39	 * sector_size will eventually be replaced with the max erase size of
 40	 * the flash. For now, we need to have that ugly default.
 41	 */
 42	unsigned int sector_size = nor->info->sector_size ?: SPI_NOR_DEFAULT_SECTOR_SIZE;
 43	u64 n_sectors = div_u64(nor->params->size, sector_size);
 44	u8 mask = spi_nor_get_sr_bp_mask(nor);
 45
 46	/* Reserved one for "protect none" and one for "protect all". */
 47	bp_slots = (1 << hweight8(mask)) - 2;
 48	bp_slots_needed = ilog2(n_sectors);
 49
 50	if (bp_slots_needed > bp_slots)
 51		return sector_size << (bp_slots_needed - bp_slots);
 52	else
 53		return sector_size;
 54}
 55
 56static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs,
 57					u64 *len)
 58{
 59	u64 min_prot_len;
 60	u8 mask = spi_nor_get_sr_bp_mask(nor);
 61	u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
 62	u8 bp, val = sr & mask;
 63
 64	if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3_BIT6)
 65		val = (val & ~SR_BP3_BIT6) | SR_BP3;
 66
 67	bp = val >> SR_BP_SHIFT;
 68
 69	if (!bp) {
 70		/* No protection */
 71		*ofs = 0;
 72		*len = 0;
 73		return;
 74	}
 75
 76	min_prot_len = spi_nor_get_min_prot_length_sr(nor);
 77	*len = min_prot_len << (bp - 1);
 78
 79	if (*len > nor->params->size)
 80		*len = nor->params->size;
 81
 82	if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask)
 83		*ofs = 0;
 84	else
 85		*ofs = nor->params->size - *len;
 86}
 87
 88/*
 89 * Return true if the entire region is locked (if @locked is true) or unlocked
 90 * (if @locked is false); false otherwise.
 91 */
 92static bool spi_nor_check_lock_status_sr(struct spi_nor *nor, loff_t ofs,
 93					 u64 len, u8 sr, bool locked)
 94{
 95	loff_t lock_offs, lock_offs_max, offs_max;
 96	u64 lock_len;
 97
 98	if (!len)
 99		return true;
100
101	spi_nor_get_locked_range_sr(nor, sr, &lock_offs, &lock_len);
102
103	lock_offs_max = lock_offs + lock_len;
104	offs_max = ofs + len;
105
106	if (locked)
107		/* Requested range is a sub-range of locked range */
108		return (offs_max <= lock_offs_max) && (ofs >= lock_offs);
109	else
110		/* Requested range does not overlap with locked range */
111		return (ofs >= lock_offs_max) || (offs_max <= lock_offs);
112}
113
114static bool spi_nor_is_locked_sr(struct spi_nor *nor, loff_t ofs, u64 len, u8 sr)
115{
116	return spi_nor_check_lock_status_sr(nor, ofs, len, sr, true);
117}
118
119static bool spi_nor_is_unlocked_sr(struct spi_nor *nor, loff_t ofs, u64 len,
120				   u8 sr)
121{
122	return spi_nor_check_lock_status_sr(nor, ofs, len, sr, false);
123}
124
125/*
126 * Lock a region of the flash. Compatible with ST Micro and similar flash.
127 * Supports the block protection bits BP{0,1,2}/BP{0,1,2,3} in the status
128 * register
129 * (SR). Does not support these features found in newer SR bitfields:
130 *   - SEC: sector/block protect - only handle SEC=0 (block protect)
131 *   - CMP: complement protect - only support CMP=0 (range is not complemented)
132 *
133 * Support for the following is provided conditionally for some flash:
134 *   - TB: top/bottom protect
135 *
136 * Sample table portion for 8MB flash (Winbond w25q64fw):
137 *
138 *   SEC  |  TB   |  BP2  |  BP1  |  BP0  |  Prot Length  | Protected Portion
139 *  --------------------------------------------------------------------------
140 *    X   |   X   |   0   |   0   |   0   |  NONE         | NONE
141 *    0   |   0   |   0   |   0   |   1   |  128 KB       | Upper 1/64
142 *    0   |   0   |   0   |   1   |   0   |  256 KB       | Upper 1/32
143 *    0   |   0   |   0   |   1   |   1   |  512 KB       | Upper 1/16
144 *    0   |   0   |   1   |   0   |   0   |  1 MB         | Upper 1/8
145 *    0   |   0   |   1   |   0   |   1   |  2 MB         | Upper 1/4
146 *    0   |   0   |   1   |   1   |   0   |  4 MB         | Upper 1/2
147 *    X   |   X   |   1   |   1   |   1   |  8 MB         | ALL
148 *  ------|-------|-------|-------|-------|---------------|-------------------
149 *    0   |   1   |   0   |   0   |   1   |  128 KB       | Lower 1/64
150 *    0   |   1   |   0   |   1   |   0   |  256 KB       | Lower 1/32
151 *    0   |   1   |   0   |   1   |   1   |  512 KB       | Lower 1/16
152 *    0   |   1   |   1   |   0   |   0   |  1 MB         | Lower 1/8
153 *    0   |   1   |   1   |   0   |   1   |  2 MB         | Lower 1/4
154 *    0   |   1   |   1   |   1   |   0   |  4 MB         | Lower 1/2
155 *
156 * Returns negative on errors, 0 on success.
157 */
158static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
159{
160	u64 min_prot_len;
161	int ret, status_old, status_new;
162	u8 mask = spi_nor_get_sr_bp_mask(nor);
163	u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
164	u8 pow, val;
165	loff_t lock_len;
166	bool can_be_top = true, can_be_bottom = nor->flags & SNOR_F_HAS_SR_TB;
167	bool use_top;
168
169	ret = spi_nor_read_sr(nor, nor->bouncebuf);
170	if (ret)
171		return ret;
172
173	status_old = nor->bouncebuf[0];
174
175	/* If nothing in our range is unlocked, we don't need to do anything */
176	if (spi_nor_is_locked_sr(nor, ofs, len, status_old))
177		return 0;
178
179	/* If anything below us is unlocked, we can't use 'bottom' protection */
180	if (!spi_nor_is_locked_sr(nor, 0, ofs, status_old))
181		can_be_bottom = false;
182
183	/* If anything above us is unlocked, we can't use 'top' protection */
184	if (!spi_nor_is_locked_sr(nor, ofs + len, nor->params->size - (ofs + len),
185				  status_old))
186		can_be_top = false;
187
188	if (!can_be_bottom && !can_be_top)
189		return -EINVAL;
190
191	/* Prefer top, if both are valid */
192	use_top = can_be_top;
193
194	/* lock_len: length of region that should end up locked */
195	if (use_top)
196		lock_len = nor->params->size - ofs;
197	else
198		lock_len = ofs + len;
199
200	if (lock_len == nor->params->size) {
201		val = mask;
202	} else {
203		min_prot_len = spi_nor_get_min_prot_length_sr(nor);
204		pow = ilog2(lock_len) - ilog2(min_prot_len) + 1;
205		val = pow << SR_BP_SHIFT;
206
207		if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3)
208			val = (val & ~SR_BP3) | SR_BP3_BIT6;
209
210		if (val & ~mask)
211			return -EINVAL;
212
213		/* Don't "lock" with no region! */
214		if (!(val & mask))
215			return -EINVAL;
216	}
217
218	status_new = (status_old & ~mask & ~tb_mask) | val;
219
220	/*
221	 * Disallow further writes if WP# pin is neither left floating nor
222	 * wrongly tied to GND (that includes internal pull-downs).
223	 * WP# pin hard strapped to GND can be a valid use case.
224	 */
225	if (!(nor->flags & SNOR_F_NO_WP))
226		status_new |= SR_SRWD;
227
228	if (!use_top)
229		status_new |= tb_mask;
230
231	/* Don't bother if they're the same */
232	if (status_new == status_old)
233		return 0;
234
235	/* Only modify protection if it will not unlock other areas */
236	if ((status_new & mask) < (status_old & mask))
237		return -EINVAL;
238
239	return spi_nor_write_sr_and_check(nor, status_new);
240}
241
242/*
243 * Unlock a region of the flash. See spi_nor_sr_lock() for more info
244 *
245 * Returns negative on errors, 0 on success.
246 */
247static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
248{
249	u64 min_prot_len;
250	int ret, status_old, status_new;
251	u8 mask = spi_nor_get_sr_bp_mask(nor);
252	u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
253	u8 pow, val;
254	loff_t lock_len;
255	bool can_be_top = true, can_be_bottom = nor->flags & SNOR_F_HAS_SR_TB;
256	bool use_top;
257
258	ret = spi_nor_read_sr(nor, nor->bouncebuf);
259	if (ret)
260		return ret;
261
262	status_old = nor->bouncebuf[0];
263
264	/* If nothing in our range is locked, we don't need to do anything */
265	if (spi_nor_is_unlocked_sr(nor, ofs, len, status_old))
266		return 0;
267
268	/* If anything below us is locked, we can't use 'top' protection */
269	if (!spi_nor_is_unlocked_sr(nor, 0, ofs, status_old))
270		can_be_top = false;
271
272	/* If anything above us is locked, we can't use 'bottom' protection */
273	if (!spi_nor_is_unlocked_sr(nor, ofs + len, nor->params->size - (ofs + len),
274				    status_old))
275		can_be_bottom = false;
276
277	if (!can_be_bottom && !can_be_top)
278		return -EINVAL;
279
280	/* Prefer top, if both are valid */
281	use_top = can_be_top;
282
283	/* lock_len: length of region that should remain locked */
284	if (use_top)
285		lock_len = nor->params->size - (ofs + len);
286	else
287		lock_len = ofs;
288
289	if (lock_len == 0) {
290		val = 0; /* fully unlocked */
291	} else {
292		min_prot_len = spi_nor_get_min_prot_length_sr(nor);
293		pow = ilog2(lock_len) - ilog2(min_prot_len) + 1;
294		val = pow << SR_BP_SHIFT;
295
296		if (nor->flags & SNOR_F_HAS_SR_BP3_BIT6 && val & SR_BP3)
297			val = (val & ~SR_BP3) | SR_BP3_BIT6;
298
299		/* Some power-of-two sizes are not supported */
300		if (val & ~mask)
301			return -EINVAL;
302	}
303
304	status_new = (status_old & ~mask & ~tb_mask) | val;
305
306	/* Don't protect status register if we're fully unlocked */
307	if (lock_len == 0)
308		status_new &= ~SR_SRWD;
309
310	if (!use_top)
311		status_new |= tb_mask;
312
313	/* Don't bother if they're the same */
314	if (status_new == status_old)
315		return 0;
316
317	/* Only modify protection if it will not lock other areas */
318	if ((status_new & mask) > (status_old & mask))
319		return -EINVAL;
320
321	return spi_nor_write_sr_and_check(nor, status_new);
322}
323
324/*
325 * Check if a region of the flash is (completely) locked. See spi_nor_sr_lock()
326 * for more info.
327 *
328 * Returns 1 if entire region is locked, 0 if any portion is unlocked, and
329 * negative on errors.
330 */
331static int spi_nor_sr_is_locked(struct spi_nor *nor, loff_t ofs, u64 len)
332{
333	int ret;
334
335	ret = spi_nor_read_sr(nor, nor->bouncebuf);
336	if (ret)
337		return ret;
338
339	return spi_nor_is_locked_sr(nor, ofs, len, nor->bouncebuf[0]);
340}
341
342static const struct spi_nor_locking_ops spi_nor_sr_locking_ops = {
343	.lock = spi_nor_sr_lock,
344	.unlock = spi_nor_sr_unlock,
345	.is_locked = spi_nor_sr_is_locked,
346};
347
348void spi_nor_init_default_locking_ops(struct spi_nor *nor)
349{
350	nor->params->locking_ops = &spi_nor_sr_locking_ops;
351}
352
353static int spi_nor_lock(struct mtd_info *mtd, loff_t ofs, u64 len)
354{
355	struct spi_nor *nor = mtd_to_spi_nor(mtd);
356	int ret;
357
358	ret = spi_nor_prep_and_lock(nor);
359	if (ret)
360		return ret;
361
362	ret = nor->params->locking_ops->lock(nor, ofs, len);
363
364	spi_nor_unlock_and_unprep(nor);
365	return ret;
366}
367
368static int spi_nor_unlock(struct mtd_info *mtd, loff_t ofs, u64 len)
369{
370	struct spi_nor *nor = mtd_to_spi_nor(mtd);
371	int ret;
372
373	ret = spi_nor_prep_and_lock(nor);
374	if (ret)
375		return ret;
376
377	ret = nor->params->locking_ops->unlock(nor, ofs, len);
378
379	spi_nor_unlock_and_unprep(nor);
380	return ret;
381}
382
383static int spi_nor_is_locked(struct mtd_info *mtd, loff_t ofs, u64 len)
384{
385	struct spi_nor *nor = mtd_to_spi_nor(mtd);
386	int ret;
387
388	ret = spi_nor_prep_and_lock(nor);
389	if (ret)
390		return ret;
391
392	ret = nor->params->locking_ops->is_locked(nor, ofs, len);
393
394	spi_nor_unlock_and_unprep(nor);
395	return ret;
396}
397
398/**
399 * spi_nor_try_unlock_all() - Tries to unlock the entire flash memory array.
400 * @nor:	pointer to a 'struct spi_nor'.
401 *
402 * Some SPI NOR flashes are write protected by default after a power-on reset
403 * cycle, in order to avoid inadvertent writes during power-up. Backward
404 * compatibility imposes to unlock the entire flash memory array at power-up
405 * by default.
406 *
407 * Unprotecting the entire flash array will fail for boards which are hardware
408 * write-protected. Thus any errors are ignored.
409 */
410void spi_nor_try_unlock_all(struct spi_nor *nor)
411{
412	int ret;
413
414	if (!(nor->flags & SNOR_F_HAS_LOCK))
415		return;
416
417	dev_dbg(nor->dev, "Unprotecting entire flash array\n");
418
419	ret = spi_nor_unlock(&nor->mtd, 0, nor->params->size);
420	if (ret)
421		dev_dbg(nor->dev, "Failed to unlock the entire flash memory array\n");
422}
423
424void spi_nor_set_mtd_locking_ops(struct spi_nor *nor)
425{
426	struct mtd_info *mtd = &nor->mtd;
427
428	if (!nor->params->locking_ops)
429		return;
430
431	mtd->_lock = spi_nor_lock;
432	mtd->_unlock = spi_nor_unlock;
433	mtd->_is_locked = spi_nor_is_locked;
434}