1 /*
2 * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
3 *
4 * SPDX-License-Identifier: Apache-2.0
5 */
6 #include <stddef.h>
7
8 #include <bootloader_flash_priv.h>
9 #include <esp_log.h>
10 #include <esp_flash_encrypt.h>
11 #include "sdkconfig.h"
12 #include "soc/soc_caps.h"
13 #include "hal/efuse_ll.h"
14 #include "hal/efuse_hal.h"
15
16 #if CONFIG_IDF_TARGET_ESP32
17 # include "soc/spi_struct.h"
18 # include "soc/spi_reg.h"
19 /* SPI flash controller */
20 # define SPIFLASH SPI1
21 #else
22 # include "soc/spi_mem_struct.h"
23 # include "soc/spi_mem_reg.h"
24 /* SPI flash controller */
25 # define SPIFLASH SPIMEM1
26 #endif
27
28 // This dependency will be removed in the future. IDF-5025
29 #include "esp_flash.h"
30
31 #include "esp_rom_spiflash.h"
32
33 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
34 #define ENCRYPTION_IS_VIRTUAL (!efuse_hal_flash_encryption_enabled())
35 #else
36 #define ENCRYPTION_IS_VIRTUAL 0
37 #endif
38
39 #define BYTESHIFT(VAR, IDX) (((VAR) >> ((IDX) * 8)) & 0xFF)
40 #define ISSI_ID 0x9D
41 #define MXIC_ID 0xC2
42 #define GD_Q_ID_HIGH 0xC8
43 #define GD_Q_ID_MID 0x40
44 #define GD_Q_ID_LOW 0x16
45
46 #define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
47 #define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2 BIT1 // QE position when you write 8 bits(for SR2) at one time.
48 #define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE BIT9 // QE position when you write 16 bits at one time.
49
50 #ifndef BOOTLOADER_BUILD
51 /* Normal app version maps to spi_flash_mmap.h operations...
52 */
53 static const char *TAG = "bootloader_mmap";
54
55 static spi_flash_mmap_handle_t map;
56
bootloader_mmap_get_free_pages(void)57 uint32_t bootloader_mmap_get_free_pages(void)
58 {
59 return spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
60 }
61
bootloader_mmap(uint32_t src_addr,uint32_t size)62 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
63 {
64 if (map) {
65 ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
66 return NULL; /* existing mapping in use... */
67 }
68 const void *result = NULL;
69 uint32_t src_page = src_addr & ~(SPI_FLASH_MMU_PAGE_SIZE - 1);
70 size += (src_addr - src_page);
71 esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
72 if (err != ESP_OK) {
73 ESP_EARLY_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
74 return NULL;
75 }
76 return (void *)((intptr_t)result + (src_addr - src_page));
77 }
78
bootloader_munmap(const void * mapping)79 void bootloader_munmap(const void *mapping)
80 {
81 if (mapping && map) {
82 spi_flash_munmap(map);
83 }
84 map = 0;
85 }
86
bootloader_flash_read(size_t src,void * dest,size_t size,bool allow_decrypt)87 esp_err_t bootloader_flash_read(size_t src, void *dest, size_t size, bool allow_decrypt)
88 {
89 if (allow_decrypt && esp_flash_encryption_enabled()) {
90 return esp_flash_read_encrypted(NULL, src, dest, size);
91 } else {
92 return esp_flash_read(NULL, dest, src, size);
93 }
94 }
95
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)96 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
97 {
98 if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
99 return esp_flash_write_encrypted(NULL, dest_addr, src, size);
100 } else {
101 return esp_flash_write(NULL, src, dest_addr, size);
102 }
103 }
104
bootloader_flash_erase_sector(size_t sector)105 esp_err_t bootloader_flash_erase_sector(size_t sector)
106 {
107 // Will de-dependency IDF-5025
108 return esp_flash_erase_region(NULL, sector * SPI_FLASH_SEC_SIZE, SPI_FLASH_SEC_SIZE);
109 }
110
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)111 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
112 {
113 // Will de-dependency IDF-5025
114 return esp_flash_erase_region(NULL, start_addr, size);
115 }
116
117 #else //BOOTLOADER_BUILD
118 /* Bootloader version, uses ROM functions only */
119 #if CONFIG_IDF_TARGET_ESP32
120 #include "esp32/rom/cache.h"
121 #endif
122 #include "esp_rom_spiflash.h"
123 #include "esp_rom_sys.h"
124 #include "hal/mmu_hal.h"
125 #include "hal/mmu_ll.h"
126 #include "hal/cache_hal.h"
127 #if CONFIG_IDF_TARGET_ESP32S3
128 #include "esp32s3/rom/opi_flash.h"
129 #endif
130 static const char *TAG = "bootloader_flash";
131
132 #if CONFIG_IDF_TARGET_ESP32
133 /* Use first 50 blocks in MMU for bootloader_mmap,
134 50th block for bootloader_flash_read
135 */
136 #define MMU_BLOCK0_VADDR SOC_DROM_LOW
137 #define MMAP_MMU_SIZE (0x320000)
138 #define MMU_BLOCK50_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE)
139 #define FLASH_READ_VADDR MMU_BLOCK50_VADDR
140
141 #else // !CONFIG_IDF_TARGET_ESP32
142
143 /* Use first 63 blocks in MMU for bootloader_mmap,
144 63th block for bootloader_flash_read
145 */
146 #define MMU_BLOCK0_VADDR SOC_DROM_LOW
147 #define MMAP_MMU_SIZE (DRAM0_CACHE_ADDRESS_HIGH - DRAM0_CACHE_ADDRESS_LOW) // This mmu size means that the mmu size to be mapped
148 #define MMU_BLOCK63_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE - SPI_FLASH_MMU_PAGE_SIZE)
149 #define FLASH_READ_VADDR MMU_BLOCK63_VADDR
150 #endif
151
152 #define MMU_FREE_PAGES (MMAP_MMU_SIZE / CONFIG_MMU_PAGE_SIZE)
153
154 static bool mapped;
155
156 // Current bootloader mapping (ab)used for bootloader_read()
157 static uint32_t current_read_mapping = UINT32_MAX;
158
bootloader_mmap_get_free_pages(void)159 uint32_t bootloader_mmap_get_free_pages(void)
160 {
161 /**
162 * Allow mapping up to 50 of the 51 available MMU blocks (last one used for reads)
163 * Since, bootloader_mmap function below assumes it to be 0x320000 (50 pages), we can safely do this.
164 */
165 return MMU_FREE_PAGES;
166 }
167
bootloader_mmap(uint32_t src_paddr,uint32_t size)168 const void *bootloader_mmap(uint32_t src_paddr, uint32_t size)
169 {
170 if (mapped) {
171 ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
172 return NULL; /* can't map twice */
173 }
174 if (size > MMAP_MMU_SIZE) {
175 ESP_EARLY_LOGE(TAG, "bootloader_mmap excess size %x", size);
176 return NULL;
177 }
178
179 uint32_t src_paddr_aligned = src_paddr & MMU_FLASH_MASK;
180 //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
181 uint32_t size_after_paddr_aligned = (src_paddr - src_paddr_aligned) + size;
182 /**
183 * @note 1
184 * Will add here a check to make sure the vaddr is on read-only and executable buses, since we use others for psram
185 * Now simply check if it's valid vaddr, didn't check if it's readable, writable or executable.
186 * TODO: IDF-4710
187 */
188 if (mmu_ll_check_valid_ext_vaddr_region(0, MMU_BLOCK0_VADDR, size_after_paddr_aligned, MMU_VADDR_DATA | MMU_VADDR_INSTRUCTION) == 0) {
189 ESP_EARLY_LOGE(TAG, "vaddr not valid");
190 return NULL;
191 }
192
193 //-------------stop cache to do the MMU mapping--------------
194 #if CONFIG_IDF_TARGET_ESP32
195 Cache_Read_Disable(0);
196 Cache_Flush(0);
197 #else
198 cache_hal_disable(CACHE_TYPE_ALL);
199 #endif
200
201 //---------------Do mapping------------------------
202 ESP_EARLY_LOGD(TAG, "rodata starts from paddr=0x%08x, size=0x%x, will be mapped to vaddr=0x%08x", src_paddr, size, MMU_BLOCK0_VADDR);
203 #if CONFIG_IDF_TARGET_ESP32
204 uint32_t count = GET_REQUIRED_MMU_PAGES(size, src_paddr);
205 int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_paddr_aligned, 64, count);
206 ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, count * SPI_FLASH_MMU_PAGE_SIZE);
207 if (e != 0) {
208 ESP_EARLY_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
209 Cache_Read_Enable(0);
210 return NULL;
211 }
212 #else
213 /**
214 * This hal won't return error, it assumes the inputs are valid. The related check should be done in `bootloader_mmap()`.
215 * See above comments (note 1) about IDF-4710
216 */
217 uint32_t actual_mapped_len = 0;
218 mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_BLOCK0_VADDR, src_paddr_aligned, size_after_paddr_aligned, &actual_mapped_len);
219 ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, actual_mapped_len);
220 #endif
221
222 /**
223 * If after mapping, your code stucks, it possibly means that some of the buses are not enabled, check `cache_ll_l1_enable_bus()`
224 * For now, keep this unchanged.
225 */
226
227 //-------------enable cache--------------
228 #if CONFIG_IDF_TARGET_ESP32
229 Cache_Read_Enable(0);
230 #else
231 cache_hal_enable(CACHE_TYPE_ALL);
232 #endif
233
234 mapped = true;
235
236 return (void *)(MMU_BLOCK0_VADDR + (src_paddr - src_paddr_aligned));
237 }
238
bootloader_munmap(const void * mapping)239 void bootloader_munmap(const void *mapping)
240 {
241 if (mapped) {
242 #if CONFIG_IDF_TARGET_ESP32
243 /* Full MMU reset */
244 Cache_Read_Disable(0);
245 Cache_Flush(0);
246 mmu_init(0);
247 #else
248 cache_hal_disable(CACHE_TYPE_ALL);
249 mmu_hal_unmap_all();
250 #endif
251 mapped = false;
252 current_read_mapping = UINT32_MAX;
253 }
254 }
255
spi_to_esp_err(esp_rom_spiflash_result_t r)256 static esp_err_t spi_to_esp_err(esp_rom_spiflash_result_t r)
257 {
258 switch (r) {
259 case ESP_ROM_SPIFLASH_RESULT_OK:
260 return ESP_OK;
261 case ESP_ROM_SPIFLASH_RESULT_ERR:
262 return ESP_ERR_FLASH_OP_FAIL;
263 case ESP_ROM_SPIFLASH_RESULT_TIMEOUT:
264 return ESP_ERR_FLASH_OP_TIMEOUT;
265 default:
266 return ESP_FAIL;
267 }
268 }
269
bootloader_flash_read_no_decrypt(size_t src_addr,void * dest,size_t size)270 static esp_err_t bootloader_flash_read_no_decrypt(size_t src_addr, void *dest, size_t size)
271 {
272 #if CONFIG_IDF_TARGET_ESP32
273 Cache_Read_Disable(0);
274 Cache_Flush(0);
275 #else
276 cache_hal_disable(CACHE_TYPE_ALL);
277 #endif
278
279 esp_rom_spiflash_result_t r = esp_rom_spiflash_read(src_addr, dest, size);
280
281 #if CONFIG_IDF_TARGET_ESP32
282 Cache_Read_Enable(0);
283 #else
284 cache_hal_enable(CACHE_TYPE_ALL);
285 #endif
286
287 return spi_to_esp_err(r);
288 }
289
bootloader_flash_read_allow_decrypt(size_t src_addr,void * dest,size_t size)290 static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest, size_t size)
291 {
292 uint32_t *dest_words = (uint32_t *)dest;
293
294 for (size_t word = 0; word < size / 4; word++) {
295 uint32_t word_src = src_addr + word * 4; /* Read this offset from flash */
296 uint32_t map_at = word_src & MMU_FLASH_MASK; /* Map this 64KB block from flash */
297 uint32_t *map_ptr;
298
299 /* Move the 64KB mmu mapping window to fit map_at */
300 if (map_at != current_read_mapping) {
301
302 //----------Stop cache for mapping----------------
303 #if CONFIG_IDF_TARGET_ESP32
304 Cache_Read_Disable(0);
305 Cache_Flush(0);
306 #else
307 cache_hal_disable(CACHE_TYPE_ALL);
308 #endif
309
310 //---------------Do mapping------------------------
311 ESP_EARLY_LOGD(TAG, "mmu set block paddr=0x%08x (was 0x%08x)", map_at, current_read_mapping);
312 #if CONFIG_IDF_TARGET_ESP32
313 //Should never fail if we only map a SPI_FLASH_MMU_PAGE_SIZE to the vaddr starting from FLASH_READ_VADDR
314 int e = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
315 if (e != 0) {
316 ESP_EARLY_LOGE(TAG, "cache_flash_mmu_set failed: error=%d\n", e);
317 Cache_Read_Enable(0);
318 return ESP_FAIL;
319 }
320 #else
321 uint32_t actual_mapped_len = 0;
322 mmu_hal_map_region(0, MMU_TARGET_FLASH0, FLASH_READ_VADDR, map_at, SPI_FLASH_MMU_PAGE_SIZE - 1, &actual_mapped_len);
323 #endif
324 current_read_mapping = map_at;
325
326 //-------------enable cache-------------------------
327 #if CONFIG_IDF_TARGET_ESP32
328 Cache_Read_Enable(0);
329 #else
330 cache_hal_enable(CACHE_TYPE_ALL);
331 #endif
332 }
333 map_ptr = (uint32_t *)(FLASH_READ_VADDR + (word_src - map_at));
334 dest_words[word] = *map_ptr;
335 }
336 return ESP_OK;
337 }
338
bootloader_flash_read(size_t src_addr,void * dest,size_t size,bool allow_decrypt)339 esp_err_t bootloader_flash_read(size_t src_addr, void *dest, size_t size, bool allow_decrypt)
340 {
341 if (src_addr & 3) {
342 ESP_EARLY_LOGE(TAG, "bootloader_flash_read src_addr 0x%x not 4-byte aligned", src_addr);
343 return ESP_FAIL;
344 }
345 if (size & 3) {
346 ESP_EARLY_LOGE(TAG, "bootloader_flash_read size 0x%x not 4-byte aligned", size);
347 return ESP_FAIL;
348 }
349 if ((intptr_t)dest & 3) {
350 ESP_EARLY_LOGE(TAG, "bootloader_flash_read dest 0x%x not 4-byte aligned", (intptr_t)dest);
351 return ESP_FAIL;
352 }
353
354 if (allow_decrypt) {
355 return bootloader_flash_read_allow_decrypt(src_addr, dest, size);
356 } else {
357 return bootloader_flash_read_no_decrypt(src_addr, dest, size);
358 }
359 }
360
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)361 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
362 {
363 esp_err_t err;
364 size_t alignment = write_encrypted ? 32 : 4;
365 if ((dest_addr % alignment) != 0) {
366 ESP_EARLY_LOGE(TAG, "bootloader_flash_write dest_addr 0x%x not %d-byte aligned", dest_addr, alignment);
367 return ESP_FAIL;
368 }
369 if ((size % alignment) != 0) {
370 ESP_EARLY_LOGE(TAG, "bootloader_flash_write size 0x%x not %d-byte aligned", size, alignment);
371 return ESP_FAIL;
372 }
373 if (((intptr_t)src % 4) != 0) {
374 ESP_EARLY_LOGE(TAG, "bootloader_flash_write src 0x%x not 4 byte aligned", (intptr_t)src);
375 return ESP_FAIL;
376 }
377
378 err = bootloader_flash_unlock();
379 if (err != ESP_OK) {
380 return err;
381 }
382
383 if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
384 return spi_to_esp_err(esp_rom_spiflash_write_encrypted(dest_addr, src, size));
385 } else {
386 return spi_to_esp_err(esp_rom_spiflash_write(dest_addr, src, size));
387 }
388 }
389
bootloader_flash_erase_sector(size_t sector)390 esp_err_t bootloader_flash_erase_sector(size_t sector)
391 {
392 return spi_to_esp_err(esp_rom_spiflash_erase_sector(sector));
393 }
394
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)395 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
396 {
397 if (start_addr % FLASH_SECTOR_SIZE != 0) {
398 return ESP_ERR_INVALID_ARG;
399 }
400 if (size % FLASH_SECTOR_SIZE != 0) {
401 return ESP_ERR_INVALID_SIZE;
402 }
403 size_t start = start_addr / FLASH_SECTOR_SIZE;
404 size_t end = start + size / FLASH_SECTOR_SIZE;
405 const size_t sectors_per_block = FLASH_BLOCK_SIZE / FLASH_SECTOR_SIZE;
406
407 esp_rom_spiflash_result_t rc = ESP_ROM_SPIFLASH_RESULT_OK;
408 for (size_t sector = start; sector != end && rc == ESP_ROM_SPIFLASH_RESULT_OK; ) {
409 if (sector % sectors_per_block == 0 && end - sector >= sectors_per_block) {
410 rc = esp_rom_spiflash_erase_block(sector / sectors_per_block);
411 sector += sectors_per_block;
412 } else {
413 rc = esp_rom_spiflash_erase_sector(sector);
414 ++sector;
415 }
416 }
417 return spi_to_esp_err(rc);
418 }
419
420 #if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)421 void bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)
422 {
423 esp_rom_opiflash_spi0rd_t cache_rd = {};
424 switch (flash_mode) {
425 case ESP_ROM_SPIFLASH_FASTRD_MODE:
426 cache_rd.addr_bit_len = 32;
427 cache_rd.dummy_bit_len = 8;
428 cache_rd.cmd = CMD_FASTRD_4B;
429 cache_rd.cmd_bit_len = 8;
430 break;
431 case ESP_ROM_SPIFLASH_SLOWRD_MODE:
432 cache_rd.addr_bit_len = 32;
433 cache_rd.dummy_bit_len = 0;
434 cache_rd.cmd = CMD_SLOWRD_4B;
435 cache_rd.cmd_bit_len = 8;
436 break;
437 default:
438 assert(false);
439 break;
440 }
441 cache_hal_disable(CACHE_TYPE_ALL);
442 esp_rom_opiflash_cache_mode_config(flash_mode, &cache_rd);
443 cache_hal_enable(CACHE_TYPE_ALL);
444 }
445 #endif
446
447 #endif // BOOTLOADER_BUILD
448
449
is_issi_chip(const esp_rom_spiflash_chip_t * chip)450 FORCE_INLINE_ATTR bool is_issi_chip(const esp_rom_spiflash_chip_t* chip)
451 {
452 return BYTESHIFT(chip->device_id, 2) == ISSI_ID;
453 }
454
455 // For GD25Q32, GD25Q64, GD25Q127C, GD25Q128, which use single command to read/write different SR.
is_gd_q_chip(const esp_rom_spiflash_chip_t * chip)456 FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
457 {
458 return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
459 }
460
is_mxic_chip(const esp_rom_spiflash_chip_t * chip)461 FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
462 {
463 return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
464 }
465
bootloader_flash_unlock(void)466 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
467 {
468 // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
469 // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
470 uint16_t status = 0; // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
471 uint16_t new_status = 0;
472 uint8_t status_sr2 = 0; // status_sr2 for SR2.
473 uint8_t new_status_sr2 = 0;
474 uint8_t sr1_bit_num = 0;
475 esp_err_t err = ESP_OK;
476
477 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
478 if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
479 // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
480 // If any code here needs to be modified, check both chips.
481 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
482
483 /* Clear all bits in the mask.
484 (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
485 */
486 sr1_bit_num = 8;
487 new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
488 } else if (is_gd_q_chip(&g_rom_flashchip)) {
489 /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
490 Use 01H to write SR1 and 31H to write SR2.
491 */
492 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
493 sr1_bit_num = 8;
494 new_status = 0;
495
496 status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
497 new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
498 } else {
499 /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
500 status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
501
502 /* Clear all bits except QE, if it is set.
503 (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
504 */
505 sr1_bit_num = 16;
506 new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
507 }
508
509 // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
510 bool status_written = false;
511 // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
512 if (status != new_status) {
513 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
514 bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
515 bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
516 status_written = true;
517 }
518
519 if (status_sr2 != new_status_sr2) {
520 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
521 bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
522 bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
523 status_written = true;
524 }
525
526 if (status_written) {
527 //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
528 esp_rom_spiflash_wait_idle(&g_rom_flashchip);
529 bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
530 }
531
532 return err;
533 }
534
bootloader_flash_execute_command_common(uint8_t command,uint32_t addr_len,uint32_t address,uint8_t dummy_len,uint8_t mosi_len,uint32_t mosi_data,uint8_t miso_len)535 IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
536 uint8_t command,
537 uint32_t addr_len, uint32_t address,
538 uint8_t dummy_len,
539 uint8_t mosi_len, uint32_t mosi_data,
540 uint8_t miso_len)
541 {
542 assert(mosi_len <= 32);
543 assert(miso_len <= 32);
544 uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
545 uint32_t old_user_reg = SPIFLASH.user.val;
546 uint32_t old_user1_reg = SPIFLASH.user1.val;
547 #if CONFIG_IDF_TARGET_ESP32
548 SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
549 #else
550 SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
551 #endif
552 //command phase
553 SPIFLASH.user.usr_command = 1;
554 SPIFLASH.user2.usr_command_bitlen = 7;
555 SPIFLASH.user2.usr_command_value = command;
556 //addr phase
557 SPIFLASH.user.usr_addr = addr_len > 0;
558 SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
559 #if CONFIG_IDF_TARGET_ESP32
560 SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
561 #else
562 SPIFLASH.addr = address;
563 #endif
564 //dummy phase
565 uint32_t total_dummy = dummy_len;
566 if (miso_len > 0) {
567 total_dummy += g_rom_spiflash_dummy_len_plus[1];
568 }
569 SPIFLASH.user.usr_dummy = total_dummy > 0;
570 SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
571 //output data
572 SPIFLASH.user.usr_mosi = mosi_len > 0;
573 #if CONFIG_IDF_TARGET_ESP32
574 SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
575 #else
576 SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
577 #endif
578 SPIFLASH.data_buf[0] = mosi_data;
579 //input data
580 SPIFLASH.user.usr_miso = miso_len > 0;
581 #if CONFIG_IDF_TARGET_ESP32
582 SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
583 #else
584 SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
585 #endif
586
587 SPIFLASH.cmd.usr = 1;
588 while (SPIFLASH.cmd.usr != 0) {
589 }
590 SPIFLASH.ctrl.val = old_ctrl_reg;
591 SPIFLASH.user.val = old_user_reg;
592 SPIFLASH.user1.val = old_user1_reg;
593
594 uint32_t ret = SPIFLASH.data_buf[0];
595 if (miso_len < 32) {
596 //set unused bits to 0
597 ret &= ~(UINT32_MAX << miso_len);
598 }
599 return ret;
600 }
601
bootloader_execute_flash_command(uint8_t command,uint32_t mosi_data,uint8_t mosi_len,uint8_t miso_len)602 uint32_t IRAM_ATTR bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
603 {
604 const uint8_t addr_len = 0;
605 const uint8_t address = 0;
606 const uint8_t dummy_len = 0;
607
608 return bootloader_flash_execute_command_common(command, addr_len, address,
609 dummy_len, mosi_len, mosi_data, miso_len);
610 }
611
612 // cmd(0x5A) + 24bit address + 8 cycles dummy
bootloader_flash_read_sfdp(uint32_t sfdp_addr,unsigned int miso_byte_num)613 uint32_t IRAM_ATTR bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num)
614 {
615 assert(miso_byte_num <= 4);
616 const uint8_t command = CMD_RDSFDP;
617 const uint8_t addr_len = 24;
618 const uint8_t dummy_len = 8;
619 const uint8_t mosi_len = 0;
620 const uint32_t mosi_data = 0;
621 const uint8_t miso_len = miso_byte_num * 8;
622
623 return bootloader_flash_execute_command_common(command, addr_len, sfdp_addr,
624 dummy_len, mosi_len, mosi_data, miso_len);
625 }
626
bootloader_enable_wp(void)627 void bootloader_enable_wp(void)
628 {
629 bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0); /* Exit OTP mode */
630 }
631
bootloader_read_flash_id(void)632 uint32_t IRAM_ATTR bootloader_read_flash_id(void)
633 {
634 uint32_t id = bootloader_execute_flash_command(CMD_RDID, 0, 0, 24);
635 id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
636 return id;
637 }
638
bootloader_spi_flash_reset(void)639 void bootloader_spi_flash_reset(void)
640 {
641 bootloader_execute_flash_command(CMD_RESETEN, 0, 0, 0);
642 bootloader_execute_flash_command(CMD_RESET, 0, 0, 0);
643 }
644
645 /*******************************************************************************
646 * XMC startup flow
647 ******************************************************************************/
648
649 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
650 #define XMC_VENDOR_ID_1 0x20
651
652 #if BOOTLOADER_BUILD
653 #define BOOTLOADER_FLASH_LOG(level, ...) ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
654 #else
655 static DRAM_ATTR char bootloader_flash_tag[] = "bootloader_flash";
656 #define BOOTLOADER_FLASH_LOG(level, ...) ESP_DRAM_LOG##level(bootloader_flash_tag, ##__VA_ARGS__)
657 #endif
658
659 #if XMC_SUPPORT
660 //strictly check the model
is_xmc_chip_strict(uint32_t rdid)661 static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
662 {
663 uint32_t vendor_id = BYTESHIFT(rdid, 2);
664 uint32_t mfid = BYTESHIFT(rdid, 1);
665 uint32_t cpid = BYTESHIFT(rdid, 0);
666
667 if (vendor_id != XMC_VENDOR_ID_1) {
668 return false;
669 }
670
671 bool matched = false;
672 if (mfid == 0x40) {
673 if (cpid >= 0x13 && cpid <= 0x20) {
674 matched = true;
675 }
676 } else if (mfid == 0x41) {
677 if (cpid >= 0x17 && cpid <= 0x20) {
678 matched = true;
679 }
680 } else if (mfid == 0x50) {
681 if (cpid >= 0x15 && cpid <= 0x16) {
682 matched = true;
683 }
684 }
685 return matched;
686 }
687
bootloader_flash_xmc_startup(void)688 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
689 {
690 // If the RDID value is a valid XMC one, may skip the flow
691 const bool fast_check = true;
692 if (fast_check && is_xmc_chip_strict(g_rom_flashchip.device_id)) {
693 BOOTLOADER_FLASH_LOG(D, "XMC chip detected by RDID (%08X), skip.", g_rom_flashchip.device_id);
694 return ESP_OK;
695 }
696
697 // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
698 const int sfdp_mfid_addr = 0x10;
699 uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
700 if (mf_id != XMC_VENDOR_ID_1) {
701 BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
702 return ESP_OK;
703 }
704
705 BOOTLOADER_FLASH_LOG(I, "XM25QHxxC startup flow");
706 // Enter DPD
707 bootloader_execute_flash_command(0xB9, 0, 0, 0);
708 // Enter UDPD
709 bootloader_execute_flash_command(0x79, 0, 0, 0);
710 // Exit UDPD
711 bootloader_execute_flash_command(0xFF, 0, 0, 0);
712 // Delay tXUDPD
713 esp_rom_delay_us(2000);
714 // Release Power-down
715 bootloader_execute_flash_command(0xAB, 0, 0, 0);
716 esp_rom_delay_us(20);
717 // Read flash ID and check again
718 g_rom_flashchip.device_id = bootloader_read_flash_id();
719 if (!is_xmc_chip_strict(g_rom_flashchip.device_id)) {
720 BOOTLOADER_FLASH_LOG(E, "XMC flash startup fail");
721 return ESP_FAIL;
722 }
723
724 return ESP_OK;
725 }
726
727 #else
728 //only compare the vendor id
is_xmc_chip(uint32_t rdid)729 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
730 {
731 uint32_t vendor_id = (rdid >> 16) & 0xFF;
732 return (vendor_id == XMC_VENDOR_ID_1);
733 }
734
bootloader_flash_xmc_startup(void)735 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
736 {
737 if (is_xmc_chip(g_rom_flashchip.device_id)) {
738 BOOTLOADER_FLASH_LOG(E, "XMC chip detected (%08X) while support disabled.", g_rom_flashchip.device_id);
739 return ESP_FAIL;
740 }
741 return ESP_OK;
742 }
743
744 #endif //XMC_SUPPORT
745
bootloader_mspi_reset(void)746 FORCE_INLINE_ATTR void bootloader_mspi_reset(void)
747 {
748 #if CONFIG_IDF_TARGET_ESP32
749 SPI1.slave.sync_reset = 0;
750 SPI0.slave.sync_reset = 0;
751 SPI1.slave.sync_reset = 1;
752 SPI0.slave.sync_reset = 1;
753 SPI1.slave.sync_reset = 0;
754 SPI0.slave.sync_reset = 0;
755 #else
756 SPIMEM1.ctrl2.sync_reset = 0;
757 SPIMEM0.ctrl2.sync_reset = 0;
758 SPIMEM1.ctrl2.sync_reset = 1;
759 SPIMEM0.ctrl2.sync_reset = 1;
760 SPIMEM1.ctrl2.sync_reset = 0;
761 SPIMEM0.ctrl2.sync_reset = 0;
762 #endif
763 }
764
bootloader_flash_reset_chip(void)765 esp_err_t IRAM_ATTR bootloader_flash_reset_chip(void)
766 {
767 bootloader_mspi_reset();
768 // Seems that sync_reset cannot make host totally idle.'
769 // Sending an extra(useless) command to make the host idle in order to send reset command.
770 bootloader_execute_flash_command(0x05, 0, 0, 0);
771 #if CONFIG_IDF_TARGET_ESP32
772 if (SPI1.ext2.st != 0)
773 #else
774 if (!spimem_flash_ll_host_idle(&SPIMEM1))
775 #endif
776 {
777 return ESP_FAIL;
778 }
779 bootloader_execute_flash_command(0x66, 0, 0, 0);
780 bootloader_execute_flash_command(0x99, 0, 0, 0);
781
782 return ESP_OK;
783 }
784
bootloader_flash_is_octal_mode_enabled(void)785 bool IRAM_ATTR bootloader_flash_is_octal_mode_enabled(void)
786 {
787 #if SOC_SPI_MEM_SUPPORT_OPI_MODE
788 return efuse_ll_get_flash_type();
789 #else
790 return false;
791 #endif
792 }
793
bootloader_flash_get_spi_mode(void)794 esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void)
795 {
796 esp_rom_spiflash_read_mode_t spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
797 #if CONFIG_IDF_TARGET_ESP32
798 uint32_t spi_ctrl = REG_READ(SPI_CTRL_REG(0));
799 if (spi_ctrl & SPI_FREAD_QIO) {
800 spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
801 } else if (spi_ctrl & SPI_FREAD_QUAD) {
802 spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
803 } else if (spi_ctrl & SPI_FREAD_DIO) {
804 spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
805 } else if (spi_ctrl & SPI_FREAD_DUAL) {
806 spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
807 } else if (spi_ctrl & SPI_FASTRD_MODE) {
808 spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
809 } else {
810 spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
811 }
812 #else
813 uint32_t spi_ctrl = REG_READ(SPI_MEM_CTRL_REG(0));
814 if (spi_ctrl & SPI_MEM_FREAD_QIO) {
815 spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
816 } else if (spi_ctrl & SPI_MEM_FREAD_QUAD) {
817 spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
818 } else if (spi_ctrl & SPI_MEM_FREAD_DIO) {
819 spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
820 } else if (spi_ctrl & SPI_MEM_FREAD_DUAL) {
821 spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
822 } else if (spi_ctrl & SPI_MEM_FASTRD_MODE) {
823 spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
824 } else {
825 spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
826 }
827 #endif
828 return spi_mode;
829 }
830
