1 /*
2 * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
3 *
4 * SPDX-License-Identifier: Apache-2.0
5 */
6 #include <stddef.h>
7
8 #include <bootloader_flash_priv.h>
9 #include <esp_log.h>
10 #include <esp_flash_encrypt.h>
11 #include "sdkconfig.h"
12 #include "soc/soc_caps.h"
13 #include "hal/efuse_ll.h"
14 #include "hal/efuse_hal.h"
15
16 #if CONFIG_IDF_TARGET_ESP32
17 # include "soc/spi_struct.h"
18 # include "soc/spi_reg.h"
19 /* SPI flash controller */
20 # define SPIFLASH SPI1
21 #else
22 # include "soc/spi_mem_struct.h"
23 # include "soc/spi_mem_reg.h"
24 /* SPI flash controller */
25 # define SPIFLASH SPIMEM1
26 #endif
27
28 // This dependency will be removed in the future. IDF-5025
29 #include "esp_flash.h"
30
31 #include "esp_rom_spiflash.h"
32
33 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
34 #define ENCRYPTION_IS_VIRTUAL (!efuse_hal_flash_encryption_enabled())
35 #else
36 #define ENCRYPTION_IS_VIRTUAL 0
37 #endif
38
39 #define BYTESHIFT(VAR, IDX) (((VAR) >> ((IDX) * 8)) & 0xFF)
40 #define ISSI_ID 0x9D
41 #define MXIC_ID 0xC2
42 #define GD_Q_ID_HIGH 0xC8
43 #define GD_Q_ID_MID 0x40
44 #define GD_Q_ID_LOW 0x16
45
46 #define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
47 #define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2 BIT1 // QE position when you write 8 bits(for SR2) at one time.
48 #define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE BIT9 // QE position when you write 16 bits at one time.
49
50 #ifndef BOOTLOADER_BUILD
51 /* Normal app version maps to spi_flash_mmap.h operations...
52 */
53 static const char *TAG = "bootloader_mmap";
54
55 static spi_flash_mmap_handle_t map;
56
bootloader_mmap_get_free_pages(void)57 uint32_t bootloader_mmap_get_free_pages(void)
58 {
59 return spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
60 }
61
bootloader_mmap(uint32_t src_addr,uint32_t size)62 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
63 {
64 if (map) {
65 ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
66 return NULL; /* existing mapping in use... */
67 }
68 const void *result = NULL;
69 uint32_t src_page = src_addr & ~(SPI_FLASH_MMU_PAGE_SIZE - 1);
70 size += (src_addr - src_page);
71 esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
72 if (err != ESP_OK) {
73 ESP_EARLY_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
74 return NULL;
75 }
76 return (void *)((intptr_t)result + (src_addr - src_page));
77 }
78
bootloader_munmap(const void * mapping)79 void bootloader_munmap(const void *mapping)
80 {
81 if (mapping && map) {
82 spi_flash_munmap(map);
83 }
84 map = 0;
85 }
86
bootloader_flash_read(size_t src,void * dest,size_t size,bool allow_decrypt)87 esp_err_t bootloader_flash_read(size_t src, void *dest, size_t size, bool allow_decrypt)
88 {
89 if (allow_decrypt && esp_flash_encryption_enabled()) {
90 return esp_flash_read_encrypted(NULL, src, dest, size);
91 } else {
92 return esp_flash_read(NULL, dest, src, size);
93 }
94 }
95
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)96 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
97 {
98 if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
99 return esp_flash_write_encrypted(NULL, dest_addr, src, size);
100 } else {
101 return esp_flash_write(NULL, src, dest_addr, size);
102 }
103 }
104
bootloader_flash_erase_sector(size_t sector)105 esp_err_t bootloader_flash_erase_sector(size_t sector)
106 {
107 // Will de-dependency IDF-5025
108 return esp_flash_erase_region(NULL, sector * SPI_FLASH_SEC_SIZE, SPI_FLASH_SEC_SIZE);
109 }
110
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)111 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
112 {
113 // Will de-dependency IDF-5025
114 return esp_flash_erase_region(NULL, start_addr, size);
115 }
116
117 #else //BOOTLOADER_BUILD
118 /* Bootloader version, uses ROM functions only */
119 #if CONFIG_IDF_TARGET_ESP32
120 #include "esp32/rom/cache.h"
121 #endif
122 #include "esp_rom_spiflash.h"
123 #include "esp_rom_sys.h"
124 #include "hal/mmu_hal.h"
125 #include "hal/mmu_ll.h"
126 #include "hal/cache_hal.h"
127 static const char *TAG = "bootloader_flash";
128
129 #if CONFIG_IDF_TARGET_ESP32
130 /* Use first 50 blocks in MMU for bootloader_mmap,
131 50th block for bootloader_flash_read
132 */
133 #define MMU_BLOCK0_VADDR SOC_DROM_LOW
134 #define MMAP_MMU_SIZE (0x320000)
135 #define MMU_BLOCK50_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE)
136 #define FLASH_READ_VADDR MMU_BLOCK50_VADDR
137
138 #else // !CONFIG_IDF_TARGET_ESP32
139
140 /* Use first 63 blocks in MMU for bootloader_mmap,
141 63th block for bootloader_flash_read
142 */
143 #define MMU_BLOCK0_VADDR SOC_DROM_LOW
144 #define MMAP_MMU_SIZE (DRAM0_CACHE_ADDRESS_HIGH - DRAM0_CACHE_ADDRESS_LOW) // This mmu size means that the mmu size to be mapped
145 #define MMU_BLOCK63_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE - SPI_FLASH_MMU_PAGE_SIZE)
146 #define FLASH_READ_VADDR MMU_BLOCK63_VADDR
147 #endif
148
149 #define MMU_FREE_PAGES (MMAP_MMU_SIZE / CONFIG_MMU_PAGE_SIZE)
150
151 static bool mapped;
152
153 // Current bootloader mapping (ab)used for bootloader_read()
154 static uint32_t current_read_mapping = UINT32_MAX;
155
bootloader_mmap_get_free_pages(void)156 uint32_t bootloader_mmap_get_free_pages(void)
157 {
158 /**
159 * Allow mapping up to 50 of the 51 available MMU blocks (last one used for reads)
160 * Since, bootloader_mmap function below assumes it to be 0x320000 (50 pages), we can safely do this.
161 */
162 return MMU_FREE_PAGES;
163 }
164
bootloader_mmap(uint32_t src_paddr,uint32_t size)165 const void *bootloader_mmap(uint32_t src_paddr, uint32_t size)
166 {
167 if (mapped) {
168 ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
169 return NULL; /* can't map twice */
170 }
171 if (size > MMAP_MMU_SIZE) {
172 ESP_EARLY_LOGE(TAG, "bootloader_mmap excess size %x", size);
173 return NULL;
174 }
175
176 uint32_t src_paddr_aligned = src_paddr & MMU_FLASH_MASK;
177 //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
178 uint32_t size_after_paddr_aligned = (src_paddr - src_paddr_aligned) + size;
179 /**
180 * @note 1
181 * Will add here a check to make sure the vaddr is on read-only and executable buses, since we use others for psram
182 * Now simply check if it's valid vaddr, didn't check if it's readable, writable or executable.
183 * TODO: IDF-4710
184 */
185 if (mmu_ll_check_valid_ext_vaddr_region(0, MMU_BLOCK0_VADDR, size_after_paddr_aligned, MMU_VADDR_DATA | MMU_VADDR_INSTRUCTION) == 0) {
186 ESP_EARLY_LOGE(TAG, "vaddr not valid");
187 return NULL;
188 }
189
190 //-------------stop cache to do the MMU mapping--------------
191 #if CONFIG_IDF_TARGET_ESP32
192 Cache_Read_Disable(0);
193 Cache_Flush(0);
194 #else
195 cache_hal_disable(CACHE_TYPE_ALL);
196 #endif
197
198 //---------------Do mapping------------------------
199 ESP_EARLY_LOGD(TAG, "rodata starts from paddr=0x%08x, size=0x%x, will be mapped to vaddr=0x%08x", src_paddr, size, MMU_BLOCK0_VADDR);
200 #if CONFIG_IDF_TARGET_ESP32
201 uint32_t count = GET_REQUIRED_MMU_PAGES(size, src_paddr);
202 int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_paddr_aligned, 64, count);
203 ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, count * SPI_FLASH_MMU_PAGE_SIZE);
204 if (e != 0) {
205 ESP_EARLY_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
206 Cache_Read_Enable(0);
207 return NULL;
208 }
209 #else
210 /**
211 * This hal won't return error, it assumes the inputs are valid. The related check should be done in `bootloader_mmap()`.
212 * See above comments (note 1) about IDF-4710
213 */
214 uint32_t actual_mapped_len = 0;
215 mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_BLOCK0_VADDR, src_paddr_aligned, size_after_paddr_aligned, &actual_mapped_len);
216 ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, actual_mapped_len);
217 #endif
218
219 /**
220 * If after mapping, your code stucks, it possibly means that some of the buses are not enabled, check `cache_ll_l1_enable_bus()`
221 * For now, keep this unchanged.
222 */
223
224 //-------------enable cache--------------
225 #if CONFIG_IDF_TARGET_ESP32
226 Cache_Read_Enable(0);
227 #else
228 cache_hal_enable(CACHE_TYPE_ALL);
229 #endif
230
231 mapped = true;
232
233 return (void *)(MMU_BLOCK0_VADDR + (src_paddr - src_paddr_aligned));
234 }
235
bootloader_munmap(const void * mapping)236 void bootloader_munmap(const void *mapping)
237 {
238 if (mapped) {
239 #if CONFIG_IDF_TARGET_ESP32
240 /* Full MMU reset */
241 Cache_Read_Disable(0);
242 Cache_Flush(0);
243 mmu_init(0);
244 #else
245 cache_hal_disable(CACHE_TYPE_ALL);
246 mmu_hal_unmap_all();
247 #endif
248 mapped = false;
249 current_read_mapping = UINT32_MAX;
250 }
251 }
252
spi_to_esp_err(esp_rom_spiflash_result_t r)253 static esp_err_t spi_to_esp_err(esp_rom_spiflash_result_t r)
254 {
255 switch (r) {
256 case ESP_ROM_SPIFLASH_RESULT_OK:
257 return ESP_OK;
258 case ESP_ROM_SPIFLASH_RESULT_ERR:
259 return ESP_ERR_FLASH_OP_FAIL;
260 case ESP_ROM_SPIFLASH_RESULT_TIMEOUT:
261 return ESP_ERR_FLASH_OP_TIMEOUT;
262 default:
263 return ESP_FAIL;
264 }
265 }
266
bootloader_flash_read_no_decrypt(size_t src_addr,void * dest,size_t size)267 static esp_err_t bootloader_flash_read_no_decrypt(size_t src_addr, void *dest, size_t size)
268 {
269 #if CONFIG_IDF_TARGET_ESP32
270 Cache_Read_Disable(0);
271 Cache_Flush(0);
272 #else
273 cache_hal_disable(CACHE_TYPE_ALL);
274 #endif
275
276 esp_rom_spiflash_result_t r = esp_rom_spiflash_read(src_addr, dest, size);
277
278 #if CONFIG_IDF_TARGET_ESP32
279 Cache_Read_Enable(0);
280 #else
281 cache_hal_enable(CACHE_TYPE_ALL);
282 #endif
283
284 return spi_to_esp_err(r);
285 }
286
bootloader_flash_read_allow_decrypt(size_t src_addr,void * dest,size_t size)287 static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest, size_t size)
288 {
289 uint32_t *dest_words = (uint32_t *)dest;
290
291 for (size_t word = 0; word < size / 4; word++) {
292 uint32_t word_src = src_addr + word * 4; /* Read this offset from flash */
293 uint32_t map_at = word_src & MMU_FLASH_MASK; /* Map this 64KB block from flash */
294 uint32_t *map_ptr;
295
296 /* Move the 64KB mmu mapping window to fit map_at */
297 if (map_at != current_read_mapping) {
298
299 //----------Stop cache for mapping----------------
300 #if CONFIG_IDF_TARGET_ESP32
301 Cache_Read_Disable(0);
302 Cache_Flush(0);
303 #else
304 cache_hal_disable(CACHE_TYPE_ALL);
305 #endif
306
307 //---------------Do mapping------------------------
308 ESP_EARLY_LOGD(TAG, "mmu set block paddr=0x%08x (was 0x%08x)", map_at, current_read_mapping);
309 #if CONFIG_IDF_TARGET_ESP32
310 //Should never fail if we only map a SPI_FLASH_MMU_PAGE_SIZE to the vaddr starting from FLASH_READ_VADDR
311 int e = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
312 assert(e == 0);
313 #else
314 uint32_t actual_mapped_len = 0;
315 mmu_hal_map_region(0, MMU_TARGET_FLASH0, FLASH_READ_VADDR, map_at, SPI_FLASH_MMU_PAGE_SIZE - 1, &actual_mapped_len);
316 #endif
317 current_read_mapping = map_at;
318
319 //-------------enable cache-------------------------
320 #if CONFIG_IDF_TARGET_ESP32
321 Cache_Read_Enable(0);
322 #else
323 cache_hal_enable(CACHE_TYPE_ALL);
324 #endif
325 }
326 map_ptr = (uint32_t *)(FLASH_READ_VADDR + (word_src - map_at));
327 dest_words[word] = *map_ptr;
328 }
329 return ESP_OK;
330 }
331
bootloader_flash_read(size_t src_addr,void * dest,size_t size,bool allow_decrypt)332 esp_err_t bootloader_flash_read(size_t src_addr, void *dest, size_t size, bool allow_decrypt)
333 {
334 if (src_addr & 3) {
335 ESP_EARLY_LOGE(TAG, "bootloader_flash_read src_addr 0x%x not 4-byte aligned", src_addr);
336 return ESP_FAIL;
337 }
338 if (size & 3) {
339 ESP_EARLY_LOGE(TAG, "bootloader_flash_read size 0x%x not 4-byte aligned", size);
340 return ESP_FAIL;
341 }
342 if ((intptr_t)dest & 3) {
343 ESP_EARLY_LOGE(TAG, "bootloader_flash_read dest 0x%x not 4-byte aligned", (intptr_t)dest);
344 return ESP_FAIL;
345 }
346
347 if (allow_decrypt) {
348 return bootloader_flash_read_allow_decrypt(src_addr, dest, size);
349 } else {
350 return bootloader_flash_read_no_decrypt(src_addr, dest, size);
351 }
352 }
353
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)354 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
355 {
356 esp_err_t err;
357 size_t alignment = write_encrypted ? 32 : 4;
358 if ((dest_addr % alignment) != 0) {
359 ESP_EARLY_LOGE(TAG, "bootloader_flash_write dest_addr 0x%x not %d-byte aligned", dest_addr, alignment);
360 return ESP_FAIL;
361 }
362 if ((size % alignment) != 0) {
363 ESP_EARLY_LOGE(TAG, "bootloader_flash_write size 0x%x not %d-byte aligned", size, alignment);
364 return ESP_FAIL;
365 }
366 if (((intptr_t)src % 4) != 0) {
367 ESP_EARLY_LOGE(TAG, "bootloader_flash_write src 0x%x not 4 byte aligned", (intptr_t)src);
368 return ESP_FAIL;
369 }
370
371 err = bootloader_flash_unlock();
372 if (err != ESP_OK) {
373 return err;
374 }
375
376 if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
377 return spi_to_esp_err(esp_rom_spiflash_write_encrypted(dest_addr, src, size));
378 } else {
379 return spi_to_esp_err(esp_rom_spiflash_write(dest_addr, src, size));
380 }
381 }
382
bootloader_flash_erase_sector(size_t sector)383 esp_err_t bootloader_flash_erase_sector(size_t sector)
384 {
385 return spi_to_esp_err(esp_rom_spiflash_erase_sector(sector));
386 }
387
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)388 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
389 {
390 if (start_addr % FLASH_SECTOR_SIZE != 0) {
391 return ESP_ERR_INVALID_ARG;
392 }
393 if (size % FLASH_SECTOR_SIZE != 0) {
394 return ESP_ERR_INVALID_SIZE;
395 }
396 size_t start = start_addr / FLASH_SECTOR_SIZE;
397 size_t end = start + size / FLASH_SECTOR_SIZE;
398 const size_t sectors_per_block = FLASH_BLOCK_SIZE / FLASH_SECTOR_SIZE;
399
400 esp_rom_spiflash_result_t rc = ESP_ROM_SPIFLASH_RESULT_OK;
401 for (size_t sector = start; sector != end && rc == ESP_ROM_SPIFLASH_RESULT_OK; ) {
402 if (sector % sectors_per_block == 0 && end - sector >= sectors_per_block) {
403 rc = esp_rom_spiflash_erase_block(sector / sectors_per_block);
404 sector += sectors_per_block;
405 } else {
406 rc = esp_rom_spiflash_erase_sector(sector);
407 ++sector;
408 }
409 }
410 return spi_to_esp_err(rc);
411 }
412
413 #endif // BOOTLOADER_BUILD
414
415
is_issi_chip(const esp_rom_spiflash_chip_t * chip)416 FORCE_INLINE_ATTR bool is_issi_chip(const esp_rom_spiflash_chip_t* chip)
417 {
418 return BYTESHIFT(chip->device_id, 2) == ISSI_ID;
419 }
420
421 // For GD25Q32, GD25Q64, GD25Q127C, GD25Q128, which use single command to read/write different SR.
is_gd_q_chip(const esp_rom_spiflash_chip_t * chip)422 FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
423 {
424 return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
425 }
426
is_mxic_chip(const esp_rom_spiflash_chip_t * chip)427 FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
428 {
429 return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
430 }
431
bootloader_flash_unlock(void)432 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
433 {
434 // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
435 // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
436 uint16_t status = 0; // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
437 uint16_t new_status = 0;
438 uint8_t status_sr2 = 0; // status_sr2 for SR2.
439 uint8_t new_status_sr2 = 0;
440 uint8_t sr1_bit_num = 0;
441 esp_err_t err = ESP_OK;
442
443 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
444 if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
445 // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
446 // If any code here needs to be modified, check both chips.
447 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
448
449 /* Clear all bits in the mask.
450 (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
451 */
452 sr1_bit_num = 8;
453 new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
454 } else if (is_gd_q_chip(&g_rom_flashchip)) {
455 /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
456 Use 01H to write SR1 and 31H to write SR2.
457 */
458 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
459 sr1_bit_num = 8;
460 new_status = 0;
461
462 status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
463 new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
464 } else {
465 /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
466 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
467
468 /* Clear all bits except QE, if it is set.
469 (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
470 */
471 sr1_bit_num = 16;
472 new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
473 }
474
475 // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
476 bool status_written = false;
477 // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
478 if (status != new_status) {
479 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
480 bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
481 bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
482 status_written = true;
483 }
484
485 if (status_sr2 != new_status_sr2) {
486 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
487 bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
488 bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
489 status_written = true;
490 }
491
492 if (status_written) {
493 //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
494 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
495 bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
496 }
497
498 return err;
499 }
500
bootloader_flash_execute_command_common(uint8_t command,uint32_t addr_len,uint32_t address,uint8_t dummy_len,uint8_t mosi_len,uint32_t mosi_data,uint8_t miso_len)501 IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
502 uint8_t command,
503 uint32_t addr_len, uint32_t address,
504 uint8_t dummy_len,
505 uint8_t mosi_len, uint32_t mosi_data,
506 uint8_t miso_len)
507 {
508 assert(mosi_len <= 32);
509 assert(miso_len <= 32);
510 uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
511 uint32_t old_user_reg = SPIFLASH.user.val;
512 uint32_t old_user1_reg = SPIFLASH.user1.val;
513 #if CONFIG_IDF_TARGET_ESP32
514 SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
515 #else
516 SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
517 #endif
518 //command phase
519 SPIFLASH.user.usr_command = 1;
520 SPIFLASH.user2.usr_command_bitlen = 7;
521 SPIFLASH.user2.usr_command_value = command;
522 //addr phase
523 SPIFLASH.user.usr_addr = addr_len > 0;
524 SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
525 #if CONFIG_IDF_TARGET_ESP32
526 SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
527 #else
528 SPIFLASH.addr = address;
529 #endif
530 //dummy phase
531 uint32_t total_dummy = dummy_len;
532 if (miso_len > 0) {
533 total_dummy += g_rom_spiflash_dummy_len_plus[1];
534 }
535 SPIFLASH.user.usr_dummy = total_dummy > 0;
536 SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
537 //output data
538 SPIFLASH.user.usr_mosi = mosi_len > 0;
539 #if CONFIG_IDF_TARGET_ESP32
540 SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
541 #else
542 SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
543 #endif
544 SPIFLASH.data_buf[0] = mosi_data;
545 //input data
546 SPIFLASH.user.usr_miso = miso_len > 0;
547 #if CONFIG_IDF_TARGET_ESP32
548 SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
549 #else
550 SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
551 #endif
552
553 SPIFLASH.cmd.usr = 1;
554 while (SPIFLASH.cmd.usr != 0) {
555 }
556 SPIFLASH.ctrl.val = old_ctrl_reg;
557 SPIFLASH.user.val = old_user_reg;
558 SPIFLASH.user1.val = old_user1_reg;
559
560 uint32_t ret = SPIFLASH.data_buf[0];
561 if (miso_len < 32) {
562 //set unused bits to 0
563 ret &= ~(UINT32_MAX << miso_len);
564 }
565 return ret;
566 }
567
bootloader_execute_flash_command(uint8_t command,uint32_t mosi_data,uint8_t mosi_len,uint8_t miso_len)568 uint32_t IRAM_ATTR bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
569 {
570 const uint8_t addr_len = 0;
571 const uint8_t address = 0;
572 const uint8_t dummy_len = 0;
573
574 return bootloader_flash_execute_command_common(command, addr_len, address,
575 dummy_len, mosi_len, mosi_data, miso_len);
576 }
577
578 // cmd(0x5A) + 24bit address + 8 cycles dummy
bootloader_flash_read_sfdp(uint32_t sfdp_addr,unsigned int miso_byte_num)579 uint32_t IRAM_ATTR bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num)
580 {
581 assert(miso_byte_num <= 4);
582 const uint8_t command = CMD_RDSFDP;
583 const uint8_t addr_len = 24;
584 const uint8_t dummy_len = 8;
585 const uint8_t mosi_len = 0;
586 const uint32_t mosi_data = 0;
587 const uint8_t miso_len = miso_byte_num * 8;
588
589 return bootloader_flash_execute_command_common(command, addr_len, sfdp_addr,
590 dummy_len, mosi_len, mosi_data, miso_len);
591 }
592
bootloader_enable_wp(void)593 void bootloader_enable_wp(void)
594 {
595 bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0); /* Exit OTP mode */
596 }
597
bootloader_read_flash_id(void)598 uint32_t IRAM_ATTR bootloader_read_flash_id(void)
599 {
600 uint32_t id = bootloader_execute_flash_command(CMD_RDID, 0, 0, 24);
601 id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
602 return id;
603 }
604
bootloader_spi_flash_reset(void)605 void bootloader_spi_flash_reset(void)
606 {
607 bootloader_execute_flash_command(CMD_RESETEN, 0, 0, 0);
608 bootloader_execute_flash_command(CMD_RESET, 0, 0, 0);
609 }
610
611 /*******************************************************************************
612 * XMC startup flow
613 ******************************************************************************/
614
615 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
616 #define XMC_VENDOR_ID 0x20
617
618 #if BOOTLOADER_BUILD
619 #define BOOTLOADER_FLASH_LOG(level, ...) ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
620 #else
621 static DRAM_ATTR char bootloader_flash_tag[] = "bootloader_flash";
622 #define BOOTLOADER_FLASH_LOG(level, ...) ESP_DRAM_LOG##level(bootloader_flash_tag, ##__VA_ARGS__)
623 #endif
624
625 #if XMC_SUPPORT
626 //strictly check the model
is_xmc_chip_strict(uint32_t rdid)627 static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
628 {
629 uint32_t vendor_id = BYTESHIFT(rdid, 2);
630 uint32_t mfid = BYTESHIFT(rdid, 1);
631 uint32_t cpid = BYTESHIFT(rdid, 0);
632
633 if (vendor_id != XMC_VENDOR_ID) {
634 return false;
635 }
636
637 bool matched = false;
638 if (mfid == 0x40) {
639 if (cpid >= 0x13 && cpid <= 0x20) {
640 matched = true;
641 }
642 } else if (mfid == 0x41) {
643 if (cpid >= 0x17 && cpid <= 0x20) {
644 matched = true;
645 }
646 } else if (mfid == 0x50) {
647 if (cpid >= 0x15 && cpid <= 0x16) {
648 matched = true;
649 }
650 }
651 return matched;
652 }
653
bootloader_flash_xmc_startup(void)654 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
655 {
656 // If the RDID value is a valid XMC one, may skip the flow
657 const bool fast_check = true;
658 if (fast_check && is_xmc_chip_strict(g_rom_flashchip.device_id)) {
659 BOOTLOADER_FLASH_LOG(D, "XMC chip detected by RDID (%08X), skip.", g_rom_flashchip.device_id);
660 return ESP_OK;
661 }
662
663 // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
664 const int sfdp_mfid_addr = 0x10;
665 uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
666 if (mf_id != XMC_VENDOR_ID) {
667 BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
668 return ESP_OK;
669 }
670
671 BOOTLOADER_FLASH_LOG(I, "XM25QHxxC startup flow");
672 // Enter DPD
673 bootloader_execute_flash_command(0xB9, 0, 0, 0);
674 // Enter UDPD
675 bootloader_execute_flash_command(0x79, 0, 0, 0);
676 // Exit UDPD
677 bootloader_execute_flash_command(0xFF, 0, 0, 0);
678 // Delay tXUDPD
679 esp_rom_delay_us(2000);
680 // Release Power-down
681 bootloader_execute_flash_command(0xAB, 0, 0, 0);
682 esp_rom_delay_us(20);
683 // Read flash ID and check again
684 g_rom_flashchip.device_id = bootloader_read_flash_id();
685 if (!is_xmc_chip_strict(g_rom_flashchip.device_id)) {
686 BOOTLOADER_FLASH_LOG(E, "XMC flash startup fail");
687 return ESP_FAIL;
688 }
689
690 return ESP_OK;
691 }
692
693 #else
694 //only compare the vendor id
is_xmc_chip(uint32_t rdid)695 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
696 {
697 uint32_t vendor_id = (rdid >> 16) & 0xFF;
698 return (vendor_id == XMC_VENDOR_ID);
699 }
700
bootloader_flash_xmc_startup(void)701 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
702 {
703 if (is_xmc_chip(g_rom_flashchip.device_id)) {
704 BOOTLOADER_FLASH_LOG(E, "XMC chip detected (%08X) while support disabled.", g_rom_flashchip.device_id);
705 return ESP_FAIL;
706 }
707 return ESP_OK;
708 }
709
710 #endif //XMC_SUPPORT
711
bootloader_mspi_reset(void)712 FORCE_INLINE_ATTR void bootloader_mspi_reset(void)
713 {
714 #if CONFIG_IDF_TARGET_ESP32
715 SPI1.slave.sync_reset = 0;
716 SPI0.slave.sync_reset = 0;
717 SPI1.slave.sync_reset = 1;
718 SPI0.slave.sync_reset = 1;
719 SPI1.slave.sync_reset = 0;
720 SPI0.slave.sync_reset = 0;
721 #else
722 SPIMEM1.ctrl2.sync_reset = 0;
723 SPIMEM0.ctrl2.sync_reset = 0;
724 SPIMEM1.ctrl2.sync_reset = 1;
725 SPIMEM0.ctrl2.sync_reset = 1;
726 SPIMEM1.ctrl2.sync_reset = 0;
727 SPIMEM0.ctrl2.sync_reset = 0;
728 #endif
729 }
730
bootloader_flash_reset_chip(void)731 esp_err_t IRAM_ATTR bootloader_flash_reset_chip(void)
732 {
733 bootloader_mspi_reset();
734 // Seems that sync_reset cannot make host totally idle.'
735 // Sending an extra(useless) command to make the host idle in order to send reset command.
736 bootloader_execute_flash_command(0x05, 0, 0, 0);
737 #if CONFIG_IDF_TARGET_ESP32
738 if (SPI1.ext2.st != 0)
739 #else
740 if (!spimem_flash_ll_host_idle(&SPIMEM1))
741 #endif
742 {
743 return ESP_FAIL;
744 }
745 bootloader_execute_flash_command(0x66, 0, 0, 0);
746 bootloader_execute_flash_command(0x99, 0, 0, 0);
747
748 return ESP_OK;
749 }
750
bootloader_flash_is_octal_mode_enabled(void)751 bool IRAM_ATTR bootloader_flash_is_octal_mode_enabled(void)
752 {
753 #if SOC_SPI_MEM_SUPPORT_OPI_MODE
754 return efuse_ll_get_flash_type();
755 #else
756 return false;
757 #endif
758 }
759
