1 /*
2  * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
3  *
4  * SPDX-License-Identifier: Apache-2.0
5  */
6 #include <stddef.h>
7 
8 #include <bootloader_flash_priv.h>
9 #include <esp_log.h>
10 #include <esp_flash_encrypt.h>
11 #include "sdkconfig.h"
12 #include "soc/soc_caps.h"
13 #include "hal/efuse_ll.h"
14 #include "hal/efuse_hal.h"
15 
16 #if CONFIG_IDF_TARGET_ESP32
17 #   include "soc/spi_struct.h"
18 #   include "soc/spi_reg.h"
19     /* SPI flash controller */
20 #   define SPIFLASH SPI1
21 #else
22 #   include "soc/spi_mem_struct.h"
23 #   include "soc/spi_mem_reg.h"
24     /* SPI flash controller */
25 #   define SPIFLASH SPIMEM1
26 #endif
27 
28 // This dependency will be removed in the future.  IDF-5025
29 #include "esp_flash.h"
30 
31 #include "esp_rom_spiflash.h"
32 
33 #ifdef CONFIG_EFUSE_VIRTUAL_KEEP_IN_FLASH
34 #define ENCRYPTION_IS_VIRTUAL (!efuse_hal_flash_encryption_enabled())
35 #else
36 #define ENCRYPTION_IS_VIRTUAL 0
37 #endif
38 
39 #define BYTESHIFT(VAR, IDX)    (((VAR) >> ((IDX) * 8)) & 0xFF)
40 #define ISSI_ID                0x9D
41 #define MXIC_ID                0xC2
42 #define GD_Q_ID_HIGH           0xC8
43 #define GD_Q_ID_MID            0x40
44 #define GD_Q_ID_LOW            0x16
45 
46 #define ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI    (BIT7 | BIT5 | BIT4 | BIT3 | BIT2)
47 #define ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2        BIT1   // QE position when you write 8 bits(for SR2) at one time.
48 #define ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE     BIT9   // QE position when you write 16 bits at one time.
49 
50 #ifndef BOOTLOADER_BUILD
51 /* Normal app version maps to spi_flash_mmap.h operations...
52  */
53 static const char *TAG = "bootloader_mmap";
54 
55 static spi_flash_mmap_handle_t map;
56 
bootloader_mmap_get_free_pages(void)57 uint32_t bootloader_mmap_get_free_pages(void)
58 {
59     return spi_flash_mmap_get_free_pages(SPI_FLASH_MMAP_DATA);
60 }
61 
bootloader_mmap(uint32_t src_addr,uint32_t size)62 const void *bootloader_mmap(uint32_t src_addr, uint32_t size)
63 {
64     if (map) {
65         ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
66         return NULL; /* existing mapping in use... */
67     }
68     const void *result = NULL;
69     uint32_t src_page = src_addr & ~(SPI_FLASH_MMU_PAGE_SIZE - 1);
70     size += (src_addr - src_page);
71     esp_err_t err = spi_flash_mmap(src_page, size, SPI_FLASH_MMAP_DATA, &result, &map);
72     if (err != ESP_OK) {
73         ESP_EARLY_LOGE(TAG, "spi_flash_mmap failed: 0x%x", err);
74         return NULL;
75     }
76     return (void *)((intptr_t)result + (src_addr - src_page));
77 }
78 
bootloader_munmap(const void * mapping)79 void bootloader_munmap(const void *mapping)
80 {
81     if (mapping && map) {
82         spi_flash_munmap(map);
83     }
84     map = 0;
85 }
86 
bootloader_flash_read(size_t src,void * dest,size_t size,bool allow_decrypt)87 esp_err_t bootloader_flash_read(size_t src, void *dest, size_t size, bool allow_decrypt)
88 {
89     if (allow_decrypt && esp_flash_encryption_enabled()) {
90         return esp_flash_read_encrypted(NULL, src, dest, size);
91     } else {
92         return esp_flash_read(NULL, dest, src, size);
93     }
94 }
95 
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)96 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
97 {
98     if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
99         return esp_flash_write_encrypted(NULL, dest_addr, src, size);
100     } else {
101         return esp_flash_write(NULL, src, dest_addr, size);
102     }
103 }
104 
bootloader_flash_erase_sector(size_t sector)105 esp_err_t bootloader_flash_erase_sector(size_t sector)
106 {
107     // Will de-dependency IDF-5025
108     return esp_flash_erase_region(NULL, sector * SPI_FLASH_SEC_SIZE, SPI_FLASH_SEC_SIZE);
109 }
110 
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)111 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
112 {
113     // Will de-dependency IDF-5025
114     return esp_flash_erase_region(NULL, start_addr, size);
115 }
116 
117 #else //BOOTLOADER_BUILD
118 /* Bootloader version, uses ROM functions only */
119 #if CONFIG_IDF_TARGET_ESP32
120 #include "esp32/rom/cache.h"
121 #endif
122 #include "esp_rom_spiflash.h"
123 #include "esp_rom_sys.h"
124 #include "hal/mmu_hal.h"
125 #include "hal/mmu_ll.h"
126 #include "hal/cache_hal.h"
127 #if CONFIG_IDF_TARGET_ESP32S3
128 #include "esp32s3/rom/opi_flash.h"
129 #endif
130 static const char *TAG = "bootloader_flash";
131 
132 #if CONFIG_IDF_TARGET_ESP32
133 /* Use first 50 blocks in MMU for bootloader_mmap,
134    50th block for bootloader_flash_read
135 */
136 #define MMU_BLOCK0_VADDR  SOC_DROM_LOW
137 #define MMAP_MMU_SIZE     (0x320000)
138 #define MMU_BLOCK50_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE)
139 #define FLASH_READ_VADDR  MMU_BLOCK50_VADDR
140 
141 #else // !CONFIG_IDF_TARGET_ESP32
142 
143 /* Use first 63 blocks in MMU for bootloader_mmap,
144    63th block for bootloader_flash_read
145 */
146 #define MMU_BLOCK0_VADDR  SOC_DROM_LOW
147 #define MMAP_MMU_SIZE     (DRAM0_CACHE_ADDRESS_HIGH - DRAM0_CACHE_ADDRESS_LOW) // This mmu size means that the mmu size to be mapped
148 #define MMU_BLOCK63_VADDR (MMU_BLOCK0_VADDR + MMAP_MMU_SIZE - SPI_FLASH_MMU_PAGE_SIZE)
149 #define FLASH_READ_VADDR MMU_BLOCK63_VADDR
150 #endif
151 
152 #define MMU_FREE_PAGES    (MMAP_MMU_SIZE / CONFIG_MMU_PAGE_SIZE)
153 
154 static bool mapped;
155 
156 // Current bootloader mapping (ab)used for bootloader_read()
157 static uint32_t current_read_mapping = UINT32_MAX;
158 
bootloader_mmap_get_free_pages(void)159 uint32_t bootloader_mmap_get_free_pages(void)
160 {
161     /**
162      * Allow mapping up to 50 of the 51 available MMU blocks (last one used for reads)
163      * Since, bootloader_mmap function below assumes it to be 0x320000 (50 pages), we can safely do this.
164      */
165     return MMU_FREE_PAGES;
166 }
167 
bootloader_mmap(uint32_t src_paddr,uint32_t size)168 const void *bootloader_mmap(uint32_t src_paddr, uint32_t size)
169 {
170     if (mapped) {
171         ESP_EARLY_LOGE(TAG, "tried to bootloader_mmap twice");
172         return NULL; /* can't map twice */
173     }
174     if (size > MMAP_MMU_SIZE) {
175         ESP_EARLY_LOGE(TAG, "bootloader_mmap excess size %x", size);
176         return NULL;
177     }
178 
179     uint32_t src_paddr_aligned = src_paddr & MMU_FLASH_MASK;
180     //The addr is aligned, so we add the mask off length to the size, to make sure the corresponding buses are enabled.
181     uint32_t size_after_paddr_aligned = (src_paddr - src_paddr_aligned) + size;
182     /**
183      * @note 1
184      * Will add here a check to make sure the vaddr is on read-only and executable buses, since we use others for psram
185      * Now simply check if it's valid vaddr, didn't check if it's readable, writable or executable.
186      * TODO: IDF-4710
187      */
188     if (mmu_ll_check_valid_ext_vaddr_region(0, MMU_BLOCK0_VADDR, size_after_paddr_aligned, MMU_VADDR_DATA | MMU_VADDR_INSTRUCTION) == 0) {
189         ESP_EARLY_LOGE(TAG, "vaddr not valid");
190         return NULL;
191     }
192 
193     //-------------stop cache to do the MMU mapping--------------
194 #if CONFIG_IDF_TARGET_ESP32
195     Cache_Read_Disable(0);
196     Cache_Flush(0);
197 #else
198     cache_hal_disable(CACHE_TYPE_ALL);
199 #endif
200 
201     //---------------Do mapping------------------------
202     ESP_EARLY_LOGD(TAG, "rodata starts from paddr=0x%08x, size=0x%x, will be mapped to vaddr=0x%08x", src_paddr, size, MMU_BLOCK0_VADDR);
203 #if CONFIG_IDF_TARGET_ESP32
204     uint32_t count = GET_REQUIRED_MMU_PAGES(size, src_paddr);
205     int e = cache_flash_mmu_set(0, 0, MMU_BLOCK0_VADDR, src_paddr_aligned, 64, count);
206     ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, count * SPI_FLASH_MMU_PAGE_SIZE);
207     if (e != 0) {
208         ESP_EARLY_LOGE(TAG, "cache_flash_mmu_set failed: %d\n", e);
209         Cache_Read_Enable(0);
210         return NULL;
211     }
212 #else
213     /**
214      * This hal won't return error, it assumes the inputs are valid. The related check should be done in `bootloader_mmap()`.
215      * See above comments (note 1) about IDF-4710
216      */
217     uint32_t actual_mapped_len = 0;
218     mmu_hal_map_region(0, MMU_TARGET_FLASH0, MMU_BLOCK0_VADDR, src_paddr_aligned, size_after_paddr_aligned, &actual_mapped_len);
219     ESP_EARLY_LOGV(TAG, "after mapping, starting from paddr=0x%08x and vaddr=0x%08x, 0x%x bytes are mapped", src_paddr_aligned, MMU_BLOCK0_VADDR, actual_mapped_len);
220 #endif
221 
222     /**
223      * If after mapping, your code stucks, it possibly means that some of the buses are not enabled, check `cache_ll_l1_enable_bus()`
224      * For now, keep this unchanged.
225      */
226 
227     //-------------enable cache--------------
228 #if CONFIG_IDF_TARGET_ESP32
229     Cache_Read_Enable(0);
230 #else
231     cache_hal_enable(CACHE_TYPE_ALL);
232 #endif
233 
234     mapped = true;
235 
236     return (void *)(MMU_BLOCK0_VADDR + (src_paddr - src_paddr_aligned));
237 }
238 
bootloader_munmap(const void * mapping)239 void bootloader_munmap(const void *mapping)
240 {
241     if (mapped)  {
242 #if CONFIG_IDF_TARGET_ESP32
243         /* Full MMU reset */
244         Cache_Read_Disable(0);
245         Cache_Flush(0);
246         mmu_init(0);
247 #else
248         cache_hal_disable(CACHE_TYPE_ALL);
249         mmu_hal_unmap_all();
250 #endif
251         mapped = false;
252         current_read_mapping = UINT32_MAX;
253     }
254 }
255 
spi_to_esp_err(esp_rom_spiflash_result_t r)256 static esp_err_t spi_to_esp_err(esp_rom_spiflash_result_t r)
257 {
258     switch (r) {
259     case ESP_ROM_SPIFLASH_RESULT_OK:
260         return ESP_OK;
261     case ESP_ROM_SPIFLASH_RESULT_ERR:
262         return ESP_ERR_FLASH_OP_FAIL;
263     case ESP_ROM_SPIFLASH_RESULT_TIMEOUT:
264         return ESP_ERR_FLASH_OP_TIMEOUT;
265     default:
266         return ESP_FAIL;
267     }
268 }
269 
bootloader_flash_read_no_decrypt(size_t src_addr,void * dest,size_t size)270 static esp_err_t bootloader_flash_read_no_decrypt(size_t src_addr, void *dest, size_t size)
271 {
272 #if CONFIG_IDF_TARGET_ESP32
273     Cache_Read_Disable(0);
274     Cache_Flush(0);
275 #else
276     cache_hal_disable(CACHE_TYPE_ALL);
277 #endif
278 
279     esp_rom_spiflash_result_t r = esp_rom_spiflash_read(src_addr, dest, size);
280 
281 #if CONFIG_IDF_TARGET_ESP32
282     Cache_Read_Enable(0);
283 #else
284     cache_hal_enable(CACHE_TYPE_ALL);
285 #endif
286 
287     return spi_to_esp_err(r);
288 }
289 
bootloader_flash_read_allow_decrypt(size_t src_addr,void * dest,size_t size)290 static esp_err_t bootloader_flash_read_allow_decrypt(size_t src_addr, void *dest, size_t size)
291 {
292     uint32_t *dest_words = (uint32_t *)dest;
293 
294     for (size_t word = 0; word < size / 4; word++) {
295         uint32_t word_src = src_addr + word * 4;  /* Read this offset from flash */
296         uint32_t map_at = word_src & MMU_FLASH_MASK; /* Map this 64KB block from flash */
297         uint32_t *map_ptr;
298 
299         /* Move the 64KB mmu mapping window to fit map_at */
300         if (map_at != current_read_mapping) {
301 
302             //----------Stop cache for mapping----------------
303 #if CONFIG_IDF_TARGET_ESP32
304             Cache_Read_Disable(0);
305             Cache_Flush(0);
306 #else
307             cache_hal_disable(CACHE_TYPE_ALL);
308 #endif
309 
310             //---------------Do mapping------------------------
311             ESP_EARLY_LOGD(TAG, "mmu set block paddr=0x%08x (was 0x%08x)", map_at, current_read_mapping);
312 #if CONFIG_IDF_TARGET_ESP32
313             //Should never fail if we only map a SPI_FLASH_MMU_PAGE_SIZE to the vaddr starting from FLASH_READ_VADDR
314             int e = cache_flash_mmu_set(0, 0, FLASH_READ_VADDR, map_at, 64, 1);
315             if (e != 0) {
316                 ESP_EARLY_LOGE(TAG, "cache_flash_mmu_set failed: error=%d\n", e);
317                 Cache_Read_Enable(0);
318                 return ESP_FAIL;
319             }
320 #else
321             uint32_t actual_mapped_len = 0;
322             mmu_hal_map_region(0, MMU_TARGET_FLASH0, FLASH_READ_VADDR, map_at, SPI_FLASH_MMU_PAGE_SIZE - 1, &actual_mapped_len);
323 #endif
324             current_read_mapping = map_at;
325 
326             //-------------enable cache-------------------------
327 #if CONFIG_IDF_TARGET_ESP32
328             Cache_Read_Enable(0);
329 #else
330             cache_hal_enable(CACHE_TYPE_ALL);
331 #endif
332         }
333         map_ptr = (uint32_t *)(FLASH_READ_VADDR + (word_src - map_at));
334         dest_words[word] = *map_ptr;
335     }
336     return ESP_OK;
337 }
338 
bootloader_flash_read(size_t src_addr,void * dest,size_t size,bool allow_decrypt)339 esp_err_t bootloader_flash_read(size_t src_addr, void *dest, size_t size, bool allow_decrypt)
340 {
341     if (src_addr & 3) {
342         ESP_EARLY_LOGE(TAG, "bootloader_flash_read src_addr 0x%x not 4-byte aligned", src_addr);
343         return ESP_FAIL;
344     }
345     if (size & 3) {
346         ESP_EARLY_LOGE(TAG, "bootloader_flash_read size 0x%x not 4-byte aligned", size);
347         return ESP_FAIL;
348     }
349     if ((intptr_t)dest & 3) {
350         ESP_EARLY_LOGE(TAG, "bootloader_flash_read dest 0x%x not 4-byte aligned", (intptr_t)dest);
351         return ESP_FAIL;
352     }
353 
354     if (allow_decrypt) {
355         return bootloader_flash_read_allow_decrypt(src_addr, dest, size);
356     } else {
357         return bootloader_flash_read_no_decrypt(src_addr, dest, size);
358     }
359 }
360 
bootloader_flash_write(size_t dest_addr,void * src,size_t size,bool write_encrypted)361 esp_err_t bootloader_flash_write(size_t dest_addr, void *src, size_t size, bool write_encrypted)
362 {
363     esp_err_t err;
364     size_t alignment = write_encrypted ? 32 : 4;
365     if ((dest_addr % alignment) != 0) {
366         ESP_EARLY_LOGE(TAG, "bootloader_flash_write dest_addr 0x%x not %d-byte aligned", dest_addr, alignment);
367         return ESP_FAIL;
368     }
369     if ((size % alignment) != 0) {
370         ESP_EARLY_LOGE(TAG, "bootloader_flash_write size 0x%x not %d-byte aligned", size, alignment);
371         return ESP_FAIL;
372     }
373     if (((intptr_t)src % 4) != 0) {
374         ESP_EARLY_LOGE(TAG, "bootloader_flash_write src 0x%x not 4 byte aligned", (intptr_t)src);
375         return ESP_FAIL;
376     }
377 
378     err = bootloader_flash_unlock();
379     if (err != ESP_OK) {
380         return err;
381     }
382 
383     if (write_encrypted && !ENCRYPTION_IS_VIRTUAL) {
384         return spi_to_esp_err(esp_rom_spiflash_write_encrypted(dest_addr, src, size));
385     } else {
386         return spi_to_esp_err(esp_rom_spiflash_write(dest_addr, src, size));
387     }
388 }
389 
bootloader_flash_erase_sector(size_t sector)390 esp_err_t bootloader_flash_erase_sector(size_t sector)
391 {
392     return spi_to_esp_err(esp_rom_spiflash_erase_sector(sector));
393 }
394 
bootloader_flash_erase_range(uint32_t start_addr,uint32_t size)395 esp_err_t bootloader_flash_erase_range(uint32_t start_addr, uint32_t size)
396 {
397     if (start_addr % FLASH_SECTOR_SIZE != 0) {
398         return ESP_ERR_INVALID_ARG;
399     }
400     if (size % FLASH_SECTOR_SIZE != 0) {
401         return ESP_ERR_INVALID_SIZE;
402     }
403     size_t start = start_addr / FLASH_SECTOR_SIZE;
404     size_t end = start + size / FLASH_SECTOR_SIZE;
405     const size_t sectors_per_block = FLASH_BLOCK_SIZE / FLASH_SECTOR_SIZE;
406 
407     esp_rom_spiflash_result_t rc = ESP_ROM_SPIFLASH_RESULT_OK;
408     for (size_t sector = start; sector != end && rc == ESP_ROM_SPIFLASH_RESULT_OK; ) {
409         if (sector % sectors_per_block == 0 && end - sector >= sectors_per_block) {
410             rc = esp_rom_spiflash_erase_block(sector / sectors_per_block);
411             sector += sectors_per_block;
412         } else {
413             rc = esp_rom_spiflash_erase_sector(sector);
414             ++sector;
415         }
416     }
417     return spi_to_esp_err(rc);
418 }
419 
420 #if CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_OCTAL_FLASH
bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)421 void bootloader_flash_32bits_address_map_enable(esp_rom_spiflash_read_mode_t flash_mode)
422 {
423     esp_rom_opiflash_spi0rd_t cache_rd = {};
424     switch (flash_mode) {
425     case ESP_ROM_SPIFLASH_FASTRD_MODE:
426         cache_rd.addr_bit_len = 32;
427         cache_rd.dummy_bit_len = 8;
428         cache_rd.cmd = CMD_FASTRD_4B;
429         cache_rd.cmd_bit_len = 8;
430         break;
431      case ESP_ROM_SPIFLASH_SLOWRD_MODE:
432         cache_rd.addr_bit_len = 32;
433         cache_rd.dummy_bit_len = 0;
434         cache_rd.cmd = CMD_SLOWRD_4B;
435         cache_rd.cmd_bit_len = 8;
436         break;
437     default:
438         assert(false);
439         break;
440     }
441     cache_hal_disable(CACHE_TYPE_ALL);
442     esp_rom_opiflash_cache_mode_config(flash_mode, &cache_rd);
443     cache_hal_enable(CACHE_TYPE_ALL);
444 }
445 #endif
446 
447 #endif // BOOTLOADER_BUILD
448 
449 
is_issi_chip(const esp_rom_spiflash_chip_t * chip)450 FORCE_INLINE_ATTR bool is_issi_chip(const esp_rom_spiflash_chip_t* chip)
451 {
452     return BYTESHIFT(chip->device_id, 2) == ISSI_ID;
453 }
454 
455 // For GD25Q32, GD25Q64, GD25Q127C, GD25Q128, which use single command to read/write different SR.
is_gd_q_chip(const esp_rom_spiflash_chip_t * chip)456 FORCE_INLINE_ATTR bool is_gd_q_chip(const esp_rom_spiflash_chip_t* chip)
457 {
458     return BYTESHIFT(chip->device_id, 2) == GD_Q_ID_HIGH && BYTESHIFT(chip->device_id, 1) == GD_Q_ID_MID && BYTESHIFT(chip->device_id, 0) >= GD_Q_ID_LOW;
459 }
460 
is_mxic_chip(const esp_rom_spiflash_chip_t * chip)461 FORCE_INLINE_ATTR bool is_mxic_chip(const esp_rom_spiflash_chip_t* chip)
462 {
463     return BYTESHIFT(chip->device_id, 2) == MXIC_ID;
464 }
465 
bootloader_flash_unlock(void)466 esp_err_t IRAM_ATTR __attribute__((weak)) bootloader_flash_unlock(void)
467 {
468     // At the beginning status == new_status == status_sr2 == new_status_sr2 == 0.
469     // If the register doesn't need to be updated, keep them the same (0), so that no command will be actually sent.
470     uint16_t status = 0;    // status for SR1 or SR1+SR2 if writing SR with 01H + 2Bytes.
471     uint16_t new_status = 0;
472     uint8_t status_sr2 = 0;    // status_sr2 for SR2.
473     uint8_t new_status_sr2 = 0;
474     uint8_t sr1_bit_num = 0;
475     esp_err_t err = ESP_OK;
476 
477     esp_rom_spiflash_wait_idle(&g_rom_flashchip);
478     if (is_issi_chip(&g_rom_flashchip) || is_mxic_chip(&g_rom_flashchip)) {
479         // Currently ISSI & MXIC share the same command and register layout, which is different from the default model.
480         // If any code here needs to be modified, check both chips.
481         status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
482 
483         /* Clear all bits in the mask.
484         (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
485         */
486         sr1_bit_num = 8;
487         new_status = status & (~ESP_BOOTLOADER_SPIFLASH_BP_MASK_ISSI);
488     } else if (is_gd_q_chip(&g_rom_flashchip)) {
489         /* The GD chips behaviour is to clear all bits in SR1 and clear bits in SR2 except QE bit.
490            Use 01H to write SR1 and 31H to write SR2.
491         */
492         status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8);
493         sr1_bit_num = 8;
494         new_status = 0;
495 
496         status_sr2 = bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8);
497         new_status_sr2 = status_sr2 & ESP_BOOTLOADER_SPIFLASH_QE_GD_SR2;
498     } else {
499         /* For common behaviour, like XMC chips, Use 01H+2Bytes to write both SR1 and SR2*/
500         status = bootloader_execute_flash_command(CMD_RDSR, 0, 0, 8) | (bootloader_execute_flash_command(CMD_RDSR2, 0, 0, 8) << 8);
501 
502         /* Clear all bits except QE, if it is set.
503         (This is different from ROM esp_rom_spiflash_unlock, which keeps all bits as-is.)
504         */
505         sr1_bit_num = 16;
506         new_status = status & ESP_BOOTLOADER_SPIFLASH_QE_SR1_2BYTE;
507     }
508 
509     // When SR is written, set to true to indicate that WRDI need to be sent to ensure the protection is ON before return.
510     bool status_written = false;
511     // Skip if nothing needs to be changed. Meaningless writing to SR increases the risk during write and wastes time.
512     if (status != new_status) {
513         esp_rom_spiflash_wait_idle(&g_rom_flashchip);
514         bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
515         bootloader_execute_flash_command(CMD_WRSR, new_status, sr1_bit_num, 0);
516         status_written = true;
517     }
518 
519     if (status_sr2 != new_status_sr2) {
520         esp_rom_spiflash_wait_idle(&g_rom_flashchip);
521         bootloader_execute_flash_command(CMD_WREN, 0, 0, 0);
522         bootloader_execute_flash_command(CMD_WRSR2, new_status_sr2, 8, 0);
523         status_written = true;
524     }
525 
526     if (status_written) {
527         //Call esp_rom_spiflash_wait_idle to make sure previous WRSR is completed.
528         esp_rom_spiflash_wait_idle(&g_rom_flashchip);
529         bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);
530     }
531 
532     return err;
533 }
534 
bootloader_flash_execute_command_common(uint8_t command,uint32_t addr_len,uint32_t address,uint8_t dummy_len,uint8_t mosi_len,uint32_t mosi_data,uint8_t miso_len)535 IRAM_ATTR uint32_t bootloader_flash_execute_command_common(
536     uint8_t command,
537     uint32_t addr_len, uint32_t address,
538     uint8_t dummy_len,
539     uint8_t mosi_len, uint32_t mosi_data,
540     uint8_t miso_len)
541 {
542     assert(mosi_len <= 32);
543     assert(miso_len <= 32);
544     uint32_t old_ctrl_reg = SPIFLASH.ctrl.val;
545     uint32_t old_user_reg = SPIFLASH.user.val;
546     uint32_t old_user1_reg = SPIFLASH.user1.val;
547 #if CONFIG_IDF_TARGET_ESP32
548     SPIFLASH.ctrl.val = SPI_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
549 #else
550     SPIFLASH.ctrl.val = SPI_MEM_WP_REG_M; // keep WP high while idle, otherwise leave DIO mode
551 #endif
552     //command phase
553     SPIFLASH.user.usr_command = 1;
554     SPIFLASH.user2.usr_command_bitlen = 7;
555     SPIFLASH.user2.usr_command_value = command;
556     //addr phase
557     SPIFLASH.user.usr_addr = addr_len > 0;
558     SPIFLASH.user1.usr_addr_bitlen = addr_len - 1;
559 #if CONFIG_IDF_TARGET_ESP32
560     SPIFLASH.addr = (addr_len > 0)? (address << (32-addr_len)) : 0;
561 #else
562     SPIFLASH.addr = address;
563 #endif
564     //dummy phase
565     uint32_t total_dummy = dummy_len;
566     if (miso_len > 0) {
567         total_dummy += g_rom_spiflash_dummy_len_plus[1];
568     }
569     SPIFLASH.user.usr_dummy = total_dummy > 0;
570     SPIFLASH.user1.usr_dummy_cyclelen = total_dummy - 1;
571     //output data
572     SPIFLASH.user.usr_mosi = mosi_len > 0;
573 #if CONFIG_IDF_TARGET_ESP32
574     SPIFLASH.mosi_dlen.usr_mosi_dbitlen = mosi_len ? (mosi_len - 1) : 0;
575 #else
576     SPIFLASH.mosi_dlen.usr_mosi_bit_len = mosi_len ? (mosi_len - 1) : 0;
577 #endif
578     SPIFLASH.data_buf[0] = mosi_data;
579     //input data
580     SPIFLASH.user.usr_miso = miso_len > 0;
581 #if CONFIG_IDF_TARGET_ESP32
582     SPIFLASH.miso_dlen.usr_miso_dbitlen = miso_len ? (miso_len - 1) : 0;
583 #else
584     SPIFLASH.miso_dlen.usr_miso_bit_len = miso_len ? (miso_len - 1) : 0;
585 #endif
586 
587     SPIFLASH.cmd.usr = 1;
588     while (SPIFLASH.cmd.usr != 0) {
589     }
590     SPIFLASH.ctrl.val = old_ctrl_reg;
591     SPIFLASH.user.val = old_user_reg;
592     SPIFLASH.user1.val = old_user1_reg;
593 
594     uint32_t ret = SPIFLASH.data_buf[0];
595     if (miso_len < 32) {
596         //set unused bits to 0
597         ret &= ~(UINT32_MAX << miso_len);
598     }
599     return ret;
600 }
601 
bootloader_execute_flash_command(uint8_t command,uint32_t mosi_data,uint8_t mosi_len,uint8_t miso_len)602 uint32_t IRAM_ATTR bootloader_execute_flash_command(uint8_t command, uint32_t mosi_data, uint8_t mosi_len, uint8_t miso_len)
603 {
604     const uint8_t addr_len = 0;
605     const uint8_t address = 0;
606     const uint8_t dummy_len = 0;
607 
608     return bootloader_flash_execute_command_common(command, addr_len, address,
609             dummy_len, mosi_len, mosi_data, miso_len);
610 }
611 
612 // cmd(0x5A) + 24bit address + 8 cycles dummy
bootloader_flash_read_sfdp(uint32_t sfdp_addr,unsigned int miso_byte_num)613 uint32_t IRAM_ATTR bootloader_flash_read_sfdp(uint32_t sfdp_addr, unsigned int miso_byte_num)
614 {
615     assert(miso_byte_num <= 4);
616     const uint8_t command = CMD_RDSFDP;
617     const uint8_t addr_len = 24;
618     const uint8_t dummy_len = 8;
619     const uint8_t mosi_len = 0;
620     const uint32_t mosi_data = 0;
621     const uint8_t miso_len = miso_byte_num * 8;
622 
623     return bootloader_flash_execute_command_common(command, addr_len, sfdp_addr,
624             dummy_len, mosi_len, mosi_data, miso_len);
625 }
626 
bootloader_enable_wp(void)627 void bootloader_enable_wp(void)
628 {
629     bootloader_execute_flash_command(CMD_WRDI, 0, 0, 0);   /* Exit OTP mode */
630 }
631 
bootloader_read_flash_id(void)632 uint32_t IRAM_ATTR bootloader_read_flash_id(void)
633 {
634     uint32_t id = bootloader_execute_flash_command(CMD_RDID, 0, 0, 24);
635     id = ((id & 0xff) << 16) | ((id >> 16) & 0xff) | (id & 0xff00);
636     return id;
637 }
638 
bootloader_spi_flash_reset(void)639 void bootloader_spi_flash_reset(void)
640 {
641     bootloader_execute_flash_command(CMD_RESETEN, 0, 0, 0);
642     bootloader_execute_flash_command(CMD_RESET, 0, 0, 0);
643 }
644 
645 /*******************************************************************************
646  * XMC startup flow
647  ******************************************************************************/
648 
649 #define XMC_SUPPORT CONFIG_BOOTLOADER_FLASH_XMC_SUPPORT
650 #define XMC_VENDOR_ID_1 0x20
651 
652 #if BOOTLOADER_BUILD
653 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_EARLY_LOG##level(TAG, ##__VA_ARGS__)
654 #else
655 static DRAM_ATTR char bootloader_flash_tag[] = "bootloader_flash";
656 #define BOOTLOADER_FLASH_LOG(level, ...)    ESP_DRAM_LOG##level(bootloader_flash_tag, ##__VA_ARGS__)
657 #endif
658 
659 #if XMC_SUPPORT
660 //strictly check the model
is_xmc_chip_strict(uint32_t rdid)661 static IRAM_ATTR bool is_xmc_chip_strict(uint32_t rdid)
662 {
663     uint32_t vendor_id = BYTESHIFT(rdid, 2);
664     uint32_t mfid = BYTESHIFT(rdid, 1);
665     uint32_t cpid = BYTESHIFT(rdid, 0);
666 
667     if (vendor_id != XMC_VENDOR_ID_1) {
668         return false;
669     }
670 
671     bool matched = false;
672     if (mfid == 0x40) {
673         if (cpid >= 0x13 && cpid <= 0x20) {
674             matched = true;
675         }
676     } else if (mfid == 0x41) {
677         if (cpid >= 0x17 && cpid <= 0x20) {
678             matched = true;
679         }
680     } else if (mfid == 0x50) {
681         if (cpid >= 0x15 && cpid <= 0x16) {
682             matched =  true;
683         }
684     }
685     return matched;
686 }
687 
bootloader_flash_xmc_startup(void)688 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
689 {
690     // If the RDID value is a valid XMC one, may skip the flow
691     const bool fast_check = true;
692     if (fast_check && is_xmc_chip_strict(g_rom_flashchip.device_id)) {
693         BOOTLOADER_FLASH_LOG(D, "XMC chip detected by RDID (%08X), skip.", g_rom_flashchip.device_id);
694         return ESP_OK;
695     }
696 
697     // Check the Manufacturer ID in SFDP registers (JEDEC standard). If not XMC chip, no need to run the flow
698     const int sfdp_mfid_addr = 0x10;
699     uint8_t mf_id = (bootloader_flash_read_sfdp(sfdp_mfid_addr, 1) & 0xff);
700     if (mf_id != XMC_VENDOR_ID_1) {
701         BOOTLOADER_FLASH_LOG(D, "non-XMC chip detected by SFDP Read (%02X), skip.", mf_id);
702         return ESP_OK;
703     }
704 
705     BOOTLOADER_FLASH_LOG(I, "XM25QHxxC startup flow");
706     // Enter DPD
707     bootloader_execute_flash_command(0xB9, 0, 0, 0);
708     // Enter UDPD
709     bootloader_execute_flash_command(0x79, 0, 0, 0);
710     // Exit UDPD
711     bootloader_execute_flash_command(0xFF, 0, 0, 0);
712     // Delay tXUDPD
713     esp_rom_delay_us(2000);
714     // Release Power-down
715     bootloader_execute_flash_command(0xAB, 0, 0, 0);
716     esp_rom_delay_us(20);
717     // Read flash ID and check again
718     g_rom_flashchip.device_id = bootloader_read_flash_id();
719     if (!is_xmc_chip_strict(g_rom_flashchip.device_id)) {
720         BOOTLOADER_FLASH_LOG(E, "XMC flash startup fail");
721         return ESP_FAIL;
722     }
723 
724     return ESP_OK;
725 }
726 
727 #else
728 //only compare the vendor id
is_xmc_chip(uint32_t rdid)729 static IRAM_ATTR bool is_xmc_chip(uint32_t rdid)
730 {
731     uint32_t vendor_id = (rdid >> 16) & 0xFF;
732     return (vendor_id == XMC_VENDOR_ID_1);
733 }
734 
bootloader_flash_xmc_startup(void)735 esp_err_t IRAM_ATTR bootloader_flash_xmc_startup(void)
736 {
737     if (is_xmc_chip(g_rom_flashchip.device_id)) {
738         BOOTLOADER_FLASH_LOG(E, "XMC chip detected (%08X) while support disabled.", g_rom_flashchip.device_id);
739         return ESP_FAIL;
740     }
741     return ESP_OK;
742 }
743 
744 #endif //XMC_SUPPORT
745 
bootloader_mspi_reset(void)746 FORCE_INLINE_ATTR void bootloader_mspi_reset(void)
747 {
748 #if CONFIG_IDF_TARGET_ESP32
749     SPI1.slave.sync_reset = 0;
750     SPI0.slave.sync_reset = 0;
751     SPI1.slave.sync_reset = 1;
752     SPI0.slave.sync_reset = 1;
753     SPI1.slave.sync_reset = 0;
754     SPI0.slave.sync_reset = 0;
755 #else
756     SPIMEM1.ctrl2.sync_reset = 0;
757     SPIMEM0.ctrl2.sync_reset = 0;
758     SPIMEM1.ctrl2.sync_reset = 1;
759     SPIMEM0.ctrl2.sync_reset = 1;
760     SPIMEM1.ctrl2.sync_reset = 0;
761     SPIMEM0.ctrl2.sync_reset = 0;
762 #endif
763 }
764 
bootloader_flash_reset_chip(void)765 esp_err_t IRAM_ATTR bootloader_flash_reset_chip(void)
766 {
767     bootloader_mspi_reset();
768     // Seems that sync_reset cannot make host totally idle.'
769     // Sending an extra(useless) command to make the host idle in order to send reset command.
770     bootloader_execute_flash_command(0x05, 0, 0, 0);
771 #if CONFIG_IDF_TARGET_ESP32
772     if (SPI1.ext2.st != 0)
773 #else
774     if (!spimem_flash_ll_host_idle(&SPIMEM1))
775 #endif
776     {
777         return ESP_FAIL;
778     }
779     bootloader_execute_flash_command(0x66, 0, 0, 0);
780     bootloader_execute_flash_command(0x99, 0, 0, 0);
781 
782     return ESP_OK;
783 }
784 
bootloader_flash_is_octal_mode_enabled(void)785 bool IRAM_ATTR bootloader_flash_is_octal_mode_enabled(void)
786 {
787 #if SOC_SPI_MEM_SUPPORT_OPI_MODE
788     return efuse_ll_get_flash_type();
789 #else
790     return false;
791 #endif
792 }
793 
bootloader_flash_get_spi_mode(void)794 esp_rom_spiflash_read_mode_t bootloader_flash_get_spi_mode(void)
795 {
796     esp_rom_spiflash_read_mode_t spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
797 #if CONFIG_IDF_TARGET_ESP32
798     uint32_t spi_ctrl = REG_READ(SPI_CTRL_REG(0));
799     if (spi_ctrl & SPI_FREAD_QIO) {
800         spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
801     } else if (spi_ctrl & SPI_FREAD_QUAD) {
802         spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
803     } else if (spi_ctrl & SPI_FREAD_DIO) {
804         spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
805     } else if (spi_ctrl & SPI_FREAD_DUAL) {
806         spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
807     } else if (spi_ctrl & SPI_FASTRD_MODE) {
808         spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
809     } else {
810         spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
811     }
812 #else
813     uint32_t spi_ctrl = REG_READ(SPI_MEM_CTRL_REG(0));
814     if (spi_ctrl & SPI_MEM_FREAD_QIO) {
815         spi_mode = ESP_ROM_SPIFLASH_QIO_MODE;
816     } else if (spi_ctrl & SPI_MEM_FREAD_QUAD) {
817         spi_mode = ESP_ROM_SPIFLASH_QOUT_MODE;
818     } else if (spi_ctrl & SPI_MEM_FREAD_DIO) {
819         spi_mode = ESP_ROM_SPIFLASH_DIO_MODE;
820     } else if (spi_ctrl & SPI_MEM_FREAD_DUAL) {
821         spi_mode = ESP_ROM_SPIFLASH_DOUT_MODE;
822     } else if (spi_ctrl & SPI_MEM_FASTRD_MODE) {
823         spi_mode = ESP_ROM_SPIFLASH_FASTRD_MODE;
824     } else {
825         spi_mode = ESP_ROM_SPIFLASH_SLOWRD_MODE;
826     }
827 #endif
828     return spi_mode;
829 }
830