xref: /openbmc/u-boot/drivers/mtd/cfi_flash.c (revision fabbeb33)
1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * (C) Copyright 2002-2004
4  * Brad Kemp, Seranoa Networks, Brad.Kemp@seranoa.com
5  *
6  * Copyright (C) 2003 Arabella Software Ltd.
7  * Yuli Barcohen <yuli@arabellasw.com>
8  *
9  * Copyright (C) 2004
10  * Ed Okerson
11  *
12  * Copyright (C) 2006
13  * Tolunay Orkun <listmember@orkun.us>
14  */
15 
16 /* The DEBUG define must be before common to enable debugging */
17 /* #define DEBUG	*/
18 
19 #include <common.h>
20 #include <console.h>
21 #include <dm.h>
22 #include <errno.h>
23 #include <fdt_support.h>
24 #include <asm/processor.h>
25 #include <asm/io.h>
26 #include <asm/byteorder.h>
27 #include <asm/unaligned.h>
28 #include <environment.h>
29 #include <mtd/cfi_flash.h>
30 #include <watchdog.h>
31 
32 /*
33  * This file implements a Common Flash Interface (CFI) driver for
34  * U-Boot.
35  *
36  * The width of the port and the width of the chips are determined at
37  * initialization.  These widths are used to calculate the address for
38  * access CFI data structures.
39  *
40  * References
41  * JEDEC Standard JESD68 - Common Flash Interface (CFI)
42  * JEDEC Standard JEP137-A Common Flash Interface (CFI) ID Codes
43  * Intel Application Note 646 Common Flash Interface (CFI) and Command Sets
44  * Intel 290667-008 3 Volt Intel StrataFlash Memory datasheet
45  * AMD CFI Specification, Release 2.0 December 1, 2001
46  * AMD/Spansion Application Note: Migration from Single-byte to Three-byte
47  *   Device IDs, Publication Number 25538 Revision A, November 8, 2001
48  *
49  * Define CONFIG_SYS_WRITE_SWAPPED_DATA, if you have to swap the Bytes between
50  * reading and writing ... (yes there is such a Hardware).
51  */
52 
53 DECLARE_GLOBAL_DATA_PTR;
54 
55 static uint flash_offset_cfi[2] = { FLASH_OFFSET_CFI, FLASH_OFFSET_CFI_ALT };
56 #ifdef CONFIG_FLASH_CFI_MTD
57 static uint flash_verbose = 1;
58 #else
59 #define flash_verbose 1
60 #endif
61 
62 flash_info_t flash_info[CFI_MAX_FLASH_BANKS];	/* FLASH chips info */
63 
64 /*
65  * Check if chip width is defined. If not, start detecting with 8bit.
66  */
67 #ifndef CONFIG_SYS_FLASH_CFI_WIDTH
68 #define CONFIG_SYS_FLASH_CFI_WIDTH	FLASH_CFI_8BIT
69 #endif
70 
71 #ifdef CONFIG_CFI_FLASH_USE_WEAK_ACCESSORS
72 #define __maybe_weak __weak
73 #else
74 #define __maybe_weak static
75 #endif
76 
77 /*
78  * 0xffff is an undefined value for the configuration register. When
79  * this value is returned, the configuration register shall not be
80  * written at all (default mode).
81  */
82 static u16 cfi_flash_config_reg(int i)
83 {
84 #ifdef CONFIG_SYS_CFI_FLASH_CONFIG_REGS
85 	return ((u16 [])CONFIG_SYS_CFI_FLASH_CONFIG_REGS)[i];
86 #else
87 	return 0xffff;
88 #endif
89 }
90 
91 #if defined(CONFIG_SYS_MAX_FLASH_BANKS_DETECT)
92 int cfi_flash_num_flash_banks = CONFIG_SYS_MAX_FLASH_BANKS_DETECT;
93 #else
94 int cfi_flash_num_flash_banks;
95 #endif
96 
97 #ifdef CONFIG_CFI_FLASH /* for driver model */
98 static void cfi_flash_init_dm(void)
99 {
100 	struct udevice *dev;
101 
102 	cfi_flash_num_flash_banks = 0;
103 	/*
104 	 * The uclass_first_device() will probe the first device and
105 	 * uclass_next_device() will probe the rest if they exist. So
106 	 * that cfi_flash_probe() will get called assigning the base
107 	 * addresses that are available.
108 	 */
109 	for (uclass_first_device(UCLASS_MTD, &dev);
110 	     dev;
111 	     uclass_next_device(&dev)) {
112 	}
113 }
114 
115 phys_addr_t cfi_flash_bank_addr(int i)
116 {
117 	return flash_info[i].base;
118 }
119 #else
120 __weak phys_addr_t cfi_flash_bank_addr(int i)
121 {
122 	return ((phys_addr_t [])CONFIG_SYS_FLASH_BANKS_LIST)[i];
123 }
124 #endif
125 
126 __weak unsigned long cfi_flash_bank_size(int i)
127 {
128 #ifdef CONFIG_SYS_FLASH_BANKS_SIZES
129 	return ((unsigned long [])CONFIG_SYS_FLASH_BANKS_SIZES)[i];
130 #else
131 	return 0;
132 #endif
133 }
134 
135 __maybe_weak void flash_write8(u8 value, void *addr)
136 {
137 	__raw_writeb(value, addr);
138 }
139 
140 __maybe_weak void flash_write16(u16 value, void *addr)
141 {
142 	__raw_writew(value, addr);
143 }
144 
145 __maybe_weak void flash_write32(u32 value, void *addr)
146 {
147 	__raw_writel(value, addr);
148 }
149 
150 __maybe_weak void flash_write64(u64 value, void *addr)
151 {
152 	/* No architectures currently implement __raw_writeq() */
153 	*(volatile u64 *)addr = value;
154 }
155 
156 __maybe_weak u8 flash_read8(void *addr)
157 {
158 	return __raw_readb(addr);
159 }
160 
161 __maybe_weak u16 flash_read16(void *addr)
162 {
163 	return __raw_readw(addr);
164 }
165 
166 __maybe_weak u32 flash_read32(void *addr)
167 {
168 	return __raw_readl(addr);
169 }
170 
171 __maybe_weak u64 flash_read64(void *addr)
172 {
173 	/* No architectures currently implement __raw_readq() */
174 	return *(volatile u64 *)addr;
175 }
176 
177 /*-----------------------------------------------------------------------
178  */
179 #if defined(CONFIG_ENV_IS_IN_FLASH) || defined(CONFIG_ENV_ADDR_REDUND) || \
180 	(CONFIG_SYS_MONITOR_BASE >= CONFIG_SYS_FLASH_BASE)
181 static flash_info_t *flash_get_info(ulong base)
182 {
183 	int i;
184 	flash_info_t *info;
185 
186 	for (i = 0; i < CONFIG_SYS_MAX_FLASH_BANKS; i++) {
187 		info = &flash_info[i];
188 		if (info->size && info->start[0] <= base &&
189 		    base <= info->start[0] + info->size - 1)
190 			return info;
191 	}
192 
193 	return NULL;
194 }
195 #endif
196 
197 unsigned long flash_sector_size(flash_info_t *info, flash_sect_t sect)
198 {
199 	if (sect != (info->sector_count - 1))
200 		return info->start[sect + 1] - info->start[sect];
201 	else
202 		return info->start[0] + info->size - info->start[sect];
203 }
204 
205 /*-----------------------------------------------------------------------
206  * create an address based on the offset and the port width
207  */
208 static inline void *
209 flash_map(flash_info_t *info, flash_sect_t sect, uint offset)
210 {
211 	unsigned int byte_offset = offset * info->portwidth;
212 
213 	return (void *)(info->start[sect] + byte_offset);
214 }
215 
216 static inline void flash_unmap(flash_info_t *info, flash_sect_t sect,
217 			       unsigned int offset, void *addr)
218 {
219 }
220 
221 /*-----------------------------------------------------------------------
222  * make a proper sized command based on the port and chip widths
223  */
224 static void flash_make_cmd(flash_info_t *info, u32 cmd, void *cmdbuf)
225 {
226 	int i;
227 	int cword_offset;
228 	int cp_offset;
229 #if defined(__LITTLE_ENDIAN) || defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
230 	u32 cmd_le = cpu_to_le32(cmd);
231 #endif
232 	uchar val;
233 	uchar *cp = (uchar *) cmdbuf;
234 
235 	for (i = info->portwidth; i > 0; i--) {
236 		cword_offset = (info->portwidth - i) % info->chipwidth;
237 #if defined(__LITTLE_ENDIAN) || defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
238 		cp_offset = info->portwidth - i;
239 		val = *((uchar *)&cmd_le + cword_offset);
240 #else
241 		cp_offset = i - 1;
242 		val = *((uchar *)&cmd + sizeof(u32) - cword_offset - 1);
243 #endif
244 		cp[cp_offset] = (cword_offset >= sizeof(u32)) ? 0x00 : val;
245 	}
246 }
247 
248 #ifdef DEBUG
249 /*-----------------------------------------------------------------------
250  * Debug support
251  */
252 static void print_longlong(char *str, unsigned long long data)
253 {
254 	int i;
255 	char *cp;
256 
257 	cp = (char *)&data;
258 	for (i = 0; i < 8; i++)
259 		sprintf(&str[i * 2], "%2.2x", *cp++);
260 }
261 
262 static void flash_printqry(struct cfi_qry *qry)
263 {
264 	u8 *p = (u8 *)qry;
265 	int x, y;
266 
267 	for (x = 0; x < sizeof(struct cfi_qry); x += 16) {
268 		debug("%02x : ", x);
269 		for (y = 0; y < 16; y++)
270 			debug("%2.2x ", p[x + y]);
271 		debug(" ");
272 		for (y = 0; y < 16; y++) {
273 			unsigned char c = p[x + y];
274 
275 			if (c >= 0x20 && c <= 0x7e)
276 				debug("%c", c);
277 			else
278 				debug(".");
279 		}
280 		debug("\n");
281 	}
282 }
283 #endif
284 
285 /*-----------------------------------------------------------------------
286  * read a character at a port width address
287  */
288 static inline uchar flash_read_uchar(flash_info_t *info, uint offset)
289 {
290 	uchar *cp;
291 	uchar retval;
292 
293 	cp = flash_map(info, 0, offset);
294 #if defined(__LITTLE_ENDIAN) || defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
295 	retval = flash_read8(cp);
296 #else
297 	retval = flash_read8(cp + info->portwidth - 1);
298 #endif
299 	flash_unmap(info, 0, offset, cp);
300 	return retval;
301 }
302 
303 /*-----------------------------------------------------------------------
304  * read a word at a port width address, assume 16bit bus
305  */
306 static inline ushort flash_read_word(flash_info_t *info, uint offset)
307 {
308 	ushort *addr, retval;
309 
310 	addr = flash_map(info, 0, offset);
311 	retval = flash_read16(addr);
312 	flash_unmap(info, 0, offset, addr);
313 	return retval;
314 }
315 
316 /*-----------------------------------------------------------------------
317  * read a long word by picking the least significant byte of each maximum
318  * port size word. Swap for ppc format.
319  */
320 static ulong flash_read_long (flash_info_t *info, flash_sect_t sect,
321 			      uint offset)
322 {
323 	uchar *addr;
324 	ulong retval;
325 
326 #ifdef DEBUG
327 	int x;
328 #endif
329 	addr = flash_map(info, sect, offset);
330 
331 #ifdef DEBUG
332 	debug("long addr is at %p info->portwidth = %d\n", addr,
333 	      info->portwidth);
334 	for (x = 0; x < 4 * info->portwidth; x++)
335 		debug("addr[%x] = 0x%x\n", x, flash_read8(addr + x));
336 #endif
337 #if defined(__LITTLE_ENDIAN) || defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
338 	retval = ((flash_read8(addr) << 16) |
339 		  (flash_read8(addr + info->portwidth) << 24) |
340 		  (flash_read8(addr + 2 * info->portwidth)) |
341 		  (flash_read8(addr + 3 * info->portwidth) << 8));
342 #else
343 	retval = ((flash_read8(addr + 2 * info->portwidth - 1) << 24) |
344 		  (flash_read8(addr + info->portwidth - 1) << 16) |
345 		  (flash_read8(addr + 4 * info->portwidth - 1) << 8) |
346 		  (flash_read8(addr + 3 * info->portwidth - 1)));
347 #endif
348 	flash_unmap(info, sect, offset, addr);
349 
350 	return retval;
351 }
352 
353 /*
354  * Write a proper sized command to the correct address
355  */
356 static void flash_write_cmd(flash_info_t *info, flash_sect_t sect,
357 			    uint offset, u32 cmd)
358 {
359 	void *addr;
360 	cfiword_t cword;
361 
362 	addr = flash_map(info, sect, offset);
363 	flash_make_cmd(info, cmd, &cword);
364 	switch (info->portwidth) {
365 	case FLASH_CFI_8BIT:
366 		debug("fwc addr %p cmd %x %x 8bit x %d bit\n", addr, cmd,
367 		      cword.w8, info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
368 		flash_write8(cword.w8, addr);
369 		break;
370 	case FLASH_CFI_16BIT:
371 		debug("fwc addr %p cmd %x %4.4x 16bit x %d bit\n", addr,
372 		      cmd, cword.w16,
373 		      info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
374 		flash_write16(cword.w16, addr);
375 		break;
376 	case FLASH_CFI_32BIT:
377 		debug("fwc addr %p cmd %x %8.8x 32bit x %d bit\n", addr,
378 		      cmd, cword.w32,
379 		      info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
380 		flash_write32(cword.w32, addr);
381 		break;
382 	case FLASH_CFI_64BIT:
383 #ifdef DEBUG
384 		{
385 			char str[20];
386 
387 			print_longlong(str, cword.w64);
388 
389 			debug("fwrite addr %p cmd %x %s 64 bit x %d bit\n",
390 			      addr, cmd, str,
391 			      info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
392 		}
393 #endif
394 		flash_write64(cword.w64, addr);
395 		break;
396 	}
397 
398 	/* Ensure all the instructions are fully finished */
399 	sync();
400 
401 	flash_unmap(info, sect, offset, addr);
402 }
403 
404 static void flash_unlock_seq(flash_info_t *info, flash_sect_t sect)
405 {
406 	flash_write_cmd(info, sect, info->addr_unlock1, AMD_CMD_UNLOCK_START);
407 	flash_write_cmd(info, sect, info->addr_unlock2, AMD_CMD_UNLOCK_ACK);
408 }
409 
410 /*-----------------------------------------------------------------------
411  */
412 static int flash_isequal(flash_info_t *info, flash_sect_t sect, uint offset,
413 			 uchar cmd)
414 {
415 	void *addr;
416 	cfiword_t cword;
417 	int retval;
418 
419 	addr = flash_map(info, sect, offset);
420 	flash_make_cmd(info, cmd, &cword);
421 
422 	debug("is= cmd %x(%c) addr %p ", cmd, cmd, addr);
423 	switch (info->portwidth) {
424 	case FLASH_CFI_8BIT:
425 		debug("is= %x %x\n", flash_read8(addr), cword.w8);
426 		retval = (flash_read8(addr) == cword.w8);
427 		break;
428 	case FLASH_CFI_16BIT:
429 		debug("is= %4.4x %4.4x\n", flash_read16(addr), cword.w16);
430 		retval = (flash_read16(addr) == cword.w16);
431 		break;
432 	case FLASH_CFI_32BIT:
433 		debug("is= %8.8x %8.8x\n", flash_read32(addr), cword.w32);
434 		retval = (flash_read32(addr) == cword.w32);
435 		break;
436 	case FLASH_CFI_64BIT:
437 #ifdef DEBUG
438 		{
439 			char str1[20];
440 			char str2[20];
441 
442 			print_longlong(str1, flash_read64(addr));
443 			print_longlong(str2, cword.w64);
444 			debug("is= %s %s\n", str1, str2);
445 		}
446 #endif
447 		retval = (flash_read64(addr) == cword.w64);
448 		break;
449 	default:
450 		retval = 0;
451 		break;
452 	}
453 	flash_unmap(info, sect, offset, addr);
454 
455 	return retval;
456 }
457 
458 /*-----------------------------------------------------------------------
459  */
460 static int flash_isset(flash_info_t *info, flash_sect_t sect, uint offset,
461 		       uchar cmd)
462 {
463 	void *addr;
464 	cfiword_t cword;
465 	int retval;
466 
467 	addr = flash_map(info, sect, offset);
468 	flash_make_cmd(info, cmd, &cword);
469 	switch (info->portwidth) {
470 	case FLASH_CFI_8BIT:
471 		retval = ((flash_read8(addr) & cword.w8) == cword.w8);
472 		break;
473 	case FLASH_CFI_16BIT:
474 		retval = ((flash_read16(addr) & cword.w16) == cword.w16);
475 		break;
476 	case FLASH_CFI_32BIT:
477 		retval = ((flash_read32(addr) & cword.w32) == cword.w32);
478 		break;
479 	case FLASH_CFI_64BIT:
480 		retval = ((flash_read64(addr) & cword.w64) == cword.w64);
481 		break;
482 	default:
483 		retval = 0;
484 		break;
485 	}
486 	flash_unmap(info, sect, offset, addr);
487 
488 	return retval;
489 }
490 
491 /*-----------------------------------------------------------------------
492  */
493 static int flash_toggle(flash_info_t *info, flash_sect_t sect, uint offset,
494 			uchar cmd)
495 {
496 	u8 *addr;
497 	cfiword_t cword;
498 	int retval;
499 
500 	addr = flash_map(info, sect, offset);
501 	flash_make_cmd(info, cmd, &cword);
502 	switch (info->portwidth) {
503 	case FLASH_CFI_8BIT:
504 		retval = flash_read8(addr) != flash_read8(addr);
505 		break;
506 	case FLASH_CFI_16BIT:
507 		retval = flash_read16(addr) != flash_read16(addr);
508 		break;
509 	case FLASH_CFI_32BIT:
510 		retval = flash_read32(addr) != flash_read32(addr);
511 		break;
512 	case FLASH_CFI_64BIT:
513 		retval = ((flash_read32(addr) != flash_read32(addr)) ||
514 			   (flash_read32(addr + 4) != flash_read32(addr + 4)));
515 		break;
516 	default:
517 		retval = 0;
518 		break;
519 	}
520 	flash_unmap(info, sect, offset, addr);
521 
522 	return retval;
523 }
524 
525 /*
526  * flash_is_busy - check to see if the flash is busy
527  *
528  * This routine checks the status of the chip and returns true if the
529  * chip is busy.
530  */
531 static int flash_is_busy(flash_info_t *info, flash_sect_t sect)
532 {
533 	int retval;
534 
535 	switch (info->vendor) {
536 	case CFI_CMDSET_INTEL_PROG_REGIONS:
537 	case CFI_CMDSET_INTEL_STANDARD:
538 	case CFI_CMDSET_INTEL_EXTENDED:
539 		retval = !flash_isset(info, sect, 0, FLASH_STATUS_DONE);
540 		break;
541 	case CFI_CMDSET_AMD_STANDARD:
542 	case CFI_CMDSET_AMD_EXTENDED:
543 #ifdef CONFIG_FLASH_CFI_LEGACY
544 	case CFI_CMDSET_AMD_LEGACY:
545 #endif
546 		if (info->sr_supported) {
547 			flash_write_cmd(info, sect, info->addr_unlock1,
548 					FLASH_CMD_READ_STATUS);
549 			retval = !flash_isset(info, sect, 0,
550 					      FLASH_STATUS_DONE);
551 		} else {
552 			retval = flash_toggle(info, sect, 0,
553 					      AMD_STATUS_TOGGLE);
554 		}
555 
556 		break;
557 	default:
558 		retval = 0;
559 	}
560 	debug("%s: %d\n", __func__, retval);
561 	return retval;
562 }
563 
564 /*-----------------------------------------------------------------------
565  *  wait for XSR.7 to be set. Time out with an error if it does not.
566  *  This routine does not set the flash to read-array mode.
567  */
568 static int flash_status_check(flash_info_t *info, flash_sect_t sector,
569 			      ulong tout, char *prompt)
570 {
571 	ulong start;
572 
573 #if CONFIG_SYS_HZ != 1000
574 	/* Avoid overflow for large HZ */
575 	if ((ulong)CONFIG_SYS_HZ > 100000)
576 		tout *= (ulong)CONFIG_SYS_HZ / 1000;
577 	else
578 		tout = DIV_ROUND_UP(tout * (ulong)CONFIG_SYS_HZ, 1000);
579 #endif
580 
581 	/* Wait for command completion */
582 #ifdef CONFIG_SYS_LOW_RES_TIMER
583 	reset_timer();
584 #endif
585 	start = get_timer(0);
586 	WATCHDOG_RESET();
587 	while (flash_is_busy(info, sector)) {
588 		if (get_timer(start) > tout) {
589 			printf("Flash %s timeout at address %lx data %lx\n",
590 			       prompt, info->start[sector],
591 			       flash_read_long(info, sector, 0));
592 			flash_write_cmd(info, sector, 0, info->cmd_reset);
593 			udelay(1);
594 			return ERR_TIMEOUT;
595 		}
596 		udelay(1);		/* also triggers watchdog */
597 	}
598 	return ERR_OK;
599 }
600 
601 /*-----------------------------------------------------------------------
602  * Wait for XSR.7 to be set, if it times out print an error, otherwise
603  * do a full status check.
604  *
605  * This routine sets the flash to read-array mode.
606  */
607 static int flash_full_status_check(flash_info_t *info, flash_sect_t sector,
608 				   ulong tout, char *prompt)
609 {
610 	int retcode;
611 
612 	retcode = flash_status_check(info, sector, tout, prompt);
613 	switch (info->vendor) {
614 	case CFI_CMDSET_INTEL_PROG_REGIONS:
615 	case CFI_CMDSET_INTEL_EXTENDED:
616 	case CFI_CMDSET_INTEL_STANDARD:
617 		if (retcode == ERR_OK &&
618 		    !flash_isset(info, sector, 0, FLASH_STATUS_DONE)) {
619 			retcode = ERR_INVAL;
620 			printf("Flash %s error at address %lx\n", prompt,
621 			       info->start[sector]);
622 			if (flash_isset(info, sector, 0, FLASH_STATUS_ECLBS |
623 					 FLASH_STATUS_PSLBS)) {
624 				puts("Command Sequence Error.\n");
625 			} else if (flash_isset(info, sector, 0,
626 						FLASH_STATUS_ECLBS)) {
627 				puts("Block Erase Error.\n");
628 				retcode = ERR_NOT_ERASED;
629 			} else if (flash_isset(info, sector, 0,
630 						FLASH_STATUS_PSLBS)) {
631 				puts("Locking Error\n");
632 			}
633 			if (flash_isset(info, sector, 0, FLASH_STATUS_DPS)) {
634 				puts("Block locked.\n");
635 				retcode = ERR_PROTECTED;
636 			}
637 			if (flash_isset(info, sector, 0, FLASH_STATUS_VPENS))
638 				puts("Vpp Low Error.\n");
639 		}
640 		flash_write_cmd(info, sector, 0, info->cmd_reset);
641 		udelay(1);
642 		break;
643 	default:
644 		break;
645 	}
646 	return retcode;
647 }
648 
649 static int use_flash_status_poll(flash_info_t *info)
650 {
651 #ifdef CONFIG_SYS_CFI_FLASH_STATUS_POLL
652 	if (info->vendor == CFI_CMDSET_AMD_EXTENDED ||
653 	    info->vendor == CFI_CMDSET_AMD_STANDARD)
654 		return 1;
655 #endif
656 	return 0;
657 }
658 
659 static int flash_status_poll(flash_info_t *info, void *src, void *dst,
660 			     ulong tout, char *prompt)
661 {
662 #ifdef CONFIG_SYS_CFI_FLASH_STATUS_POLL
663 	ulong start;
664 	int ready;
665 
666 #if CONFIG_SYS_HZ != 1000
667 	/* Avoid overflow for large HZ */
668 	if ((ulong)CONFIG_SYS_HZ > 100000)
669 		tout *= (ulong)CONFIG_SYS_HZ / 1000;
670 	else
671 		tout = DIV_ROUND_UP(tout * (ulong)CONFIG_SYS_HZ, 1000);
672 #endif
673 
674 	/* Wait for command completion */
675 #ifdef CONFIG_SYS_LOW_RES_TIMER
676 	reset_timer();
677 #endif
678 	start = get_timer(0);
679 	WATCHDOG_RESET();
680 	while (1) {
681 		switch (info->portwidth) {
682 		case FLASH_CFI_8BIT:
683 			ready = flash_read8(dst) == flash_read8(src);
684 			break;
685 		case FLASH_CFI_16BIT:
686 			ready = flash_read16(dst) == flash_read16(src);
687 			break;
688 		case FLASH_CFI_32BIT:
689 			ready = flash_read32(dst) == flash_read32(src);
690 			break;
691 		case FLASH_CFI_64BIT:
692 			ready = flash_read64(dst) == flash_read64(src);
693 			break;
694 		default:
695 			ready = 0;
696 			break;
697 		}
698 		if (ready)
699 			break;
700 		if (get_timer(start) > tout) {
701 			printf("Flash %s timeout at address %lx data %lx\n",
702 			       prompt, (ulong)dst, (ulong)flash_read8(dst));
703 			return ERR_TIMEOUT;
704 		}
705 		udelay(1);		/* also triggers watchdog */
706 	}
707 #endif /* CONFIG_SYS_CFI_FLASH_STATUS_POLL */
708 	return ERR_OK;
709 }
710 
711 /*-----------------------------------------------------------------------
712  */
713 static void flash_add_byte(flash_info_t *info, cfiword_t *cword, uchar c)
714 {
715 #if defined(__LITTLE_ENDIAN) && !defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
716 	unsigned short	w;
717 	unsigned int	l;
718 	unsigned long long ll;
719 #endif
720 
721 	switch (info->portwidth) {
722 	case FLASH_CFI_8BIT:
723 		cword->w8 = c;
724 		break;
725 	case FLASH_CFI_16BIT:
726 #if defined(__LITTLE_ENDIAN) && !defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
727 		w = c;
728 		w <<= 8;
729 		cword->w16 = (cword->w16 >> 8) | w;
730 #else
731 		cword->w16 = (cword->w16 << 8) | c;
732 #endif
733 		break;
734 	case FLASH_CFI_32BIT:
735 #if defined(__LITTLE_ENDIAN) && !defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
736 		l = c;
737 		l <<= 24;
738 		cword->w32 = (cword->w32 >> 8) | l;
739 #else
740 		cword->w32 = (cword->w32 << 8) | c;
741 #endif
742 		break;
743 	case FLASH_CFI_64BIT:
744 #if defined(__LITTLE_ENDIAN) && !defined(CONFIG_SYS_WRITE_SWAPPED_DATA)
745 		ll = c;
746 		ll <<= 56;
747 		cword->w64 = (cword->w64 >> 8) | ll;
748 #else
749 		cword->w64 = (cword->w64 << 8) | c;
750 #endif
751 		break;
752 	}
753 }
754 
755 /*
756  * Loop through the sector table starting from the previously found sector.
757  * Searches forwards or backwards, dependent on the passed address.
758  */
759 static flash_sect_t find_sector(flash_info_t *info, ulong addr)
760 {
761 	static flash_sect_t saved_sector; /* previously found sector */
762 	static flash_info_t *saved_info; /* previously used flash bank */
763 	flash_sect_t sector = saved_sector;
764 
765 	if (info != saved_info || sector >= info->sector_count)
766 		sector = 0;
767 
768 	while ((sector < info->sector_count - 1) &&
769 	       (info->start[sector] < addr))
770 		sector++;
771 	while ((info->start[sector] > addr) && (sector > 0))
772 		/*
773 		 * also decrements the sector in case of an overshot
774 		 * in the first loop
775 		 */
776 		sector--;
777 
778 	saved_sector = sector;
779 	saved_info = info;
780 	return sector;
781 }
782 
783 /*-----------------------------------------------------------------------
784  */
785 static int flash_write_cfiword(flash_info_t *info, ulong dest, cfiword_t cword)
786 {
787 	void *dstaddr = (void *)dest;
788 	int flag;
789 	flash_sect_t sect = 0;
790 	char sect_found = 0;
791 
792 	/* Check if Flash is (sufficiently) erased */
793 	switch (info->portwidth) {
794 	case FLASH_CFI_8BIT:
795 		flag = ((flash_read8(dstaddr) & cword.w8) == cword.w8);
796 		break;
797 	case FLASH_CFI_16BIT:
798 		flag = ((flash_read16(dstaddr) & cword.w16) == cword.w16);
799 		break;
800 	case FLASH_CFI_32BIT:
801 		flag = ((flash_read32(dstaddr) & cword.w32) == cword.w32);
802 		break;
803 	case FLASH_CFI_64BIT:
804 		flag = ((flash_read64(dstaddr) & cword.w64) == cword.w64);
805 		break;
806 	default:
807 		flag = 0;
808 		break;
809 	}
810 	if (!flag)
811 		return ERR_NOT_ERASED;
812 
813 	/* Disable interrupts which might cause a timeout here */
814 	flag = disable_interrupts();
815 
816 	switch (info->vendor) {
817 	case CFI_CMDSET_INTEL_PROG_REGIONS:
818 	case CFI_CMDSET_INTEL_EXTENDED:
819 	case CFI_CMDSET_INTEL_STANDARD:
820 		flash_write_cmd(info, 0, 0, FLASH_CMD_CLEAR_STATUS);
821 		flash_write_cmd(info, 0, 0, FLASH_CMD_WRITE);
822 		break;
823 	case CFI_CMDSET_AMD_EXTENDED:
824 	case CFI_CMDSET_AMD_STANDARD:
825 		sect = find_sector(info, dest);
826 		flash_unlock_seq(info, sect);
827 		flash_write_cmd(info, sect, info->addr_unlock1, AMD_CMD_WRITE);
828 		sect_found = 1;
829 		break;
830 #ifdef CONFIG_FLASH_CFI_LEGACY
831 	case CFI_CMDSET_AMD_LEGACY:
832 		sect = find_sector(info, dest);
833 		flash_unlock_seq(info, 0);
834 		flash_write_cmd(info, 0, info->addr_unlock1, AMD_CMD_WRITE);
835 		sect_found = 1;
836 		break;
837 #endif
838 	}
839 
840 	switch (info->portwidth) {
841 	case FLASH_CFI_8BIT:
842 		flash_write8(cword.w8, dstaddr);
843 		break;
844 	case FLASH_CFI_16BIT:
845 		flash_write16(cword.w16, dstaddr);
846 		break;
847 	case FLASH_CFI_32BIT:
848 		flash_write32(cword.w32, dstaddr);
849 		break;
850 	case FLASH_CFI_64BIT:
851 		flash_write64(cword.w64, dstaddr);
852 		break;
853 	}
854 
855 	/* re-enable interrupts if necessary */
856 	if (flag)
857 		enable_interrupts();
858 
859 	if (!sect_found)
860 		sect = find_sector(info, dest);
861 
862 	if (use_flash_status_poll(info))
863 		return flash_status_poll(info, &cword, dstaddr,
864 					 info->write_tout, "write");
865 	else
866 		return flash_full_status_check(info, sect,
867 					       info->write_tout, "write");
868 }
869 
870 #ifdef CONFIG_SYS_FLASH_USE_BUFFER_WRITE
871 
872 static int flash_write_cfibuffer(flash_info_t *info, ulong dest, uchar *cp,
873 				 int len)
874 {
875 	flash_sect_t sector;
876 	int cnt;
877 	int retcode;
878 	u8 *src = cp;
879 	u8 *dst = (u8 *)dest;
880 	u8 *dst2 = dst;
881 	int flag = 1;
882 	uint offset = 0;
883 	unsigned int shift;
884 	uchar write_cmd;
885 
886 	switch (info->portwidth) {
887 	case FLASH_CFI_8BIT:
888 		shift = 0;
889 		break;
890 	case FLASH_CFI_16BIT:
891 		shift = 1;
892 		break;
893 	case FLASH_CFI_32BIT:
894 		shift = 2;
895 		break;
896 	case FLASH_CFI_64BIT:
897 		shift = 3;
898 		break;
899 	default:
900 		retcode = ERR_INVAL;
901 		goto out_unmap;
902 	}
903 
904 	cnt = len >> shift;
905 
906 	while ((cnt-- > 0) && (flag == 1)) {
907 		switch (info->portwidth) {
908 		case FLASH_CFI_8BIT:
909 			flag = ((flash_read8(dst2) & flash_read8(src)) ==
910 				flash_read8(src));
911 			src += 1, dst2 += 1;
912 			break;
913 		case FLASH_CFI_16BIT:
914 			flag = ((flash_read16(dst2) & flash_read16(src)) ==
915 				flash_read16(src));
916 			src += 2, dst2 += 2;
917 			break;
918 		case FLASH_CFI_32BIT:
919 			flag = ((flash_read32(dst2) & flash_read32(src)) ==
920 				flash_read32(src));
921 			src += 4, dst2 += 4;
922 			break;
923 		case FLASH_CFI_64BIT:
924 			flag = ((flash_read64(dst2) & flash_read64(src)) ==
925 				flash_read64(src));
926 			src += 8, dst2 += 8;
927 			break;
928 		}
929 	}
930 	if (!flag) {
931 		retcode = ERR_NOT_ERASED;
932 		goto out_unmap;
933 	}
934 
935 	src = cp;
936 	sector = find_sector(info, dest);
937 
938 	switch (info->vendor) {
939 	case CFI_CMDSET_INTEL_PROG_REGIONS:
940 	case CFI_CMDSET_INTEL_STANDARD:
941 	case CFI_CMDSET_INTEL_EXTENDED:
942 		write_cmd = (info->vendor == CFI_CMDSET_INTEL_PROG_REGIONS) ?
943 			    FLASH_CMD_WRITE_BUFFER_PROG :
944 			    FLASH_CMD_WRITE_TO_BUFFER;
945 		flash_write_cmd(info, sector, 0, FLASH_CMD_CLEAR_STATUS);
946 		flash_write_cmd(info, sector, 0, FLASH_CMD_READ_STATUS);
947 		flash_write_cmd(info, sector, 0, write_cmd);
948 		retcode = flash_status_check(info, sector,
949 					     info->buffer_write_tout,
950 					     "write to buffer");
951 		if (retcode == ERR_OK) {
952 			/* reduce the number of loops by the width of
953 			 * the port
954 			 */
955 			cnt = len >> shift;
956 			flash_write_cmd(info, sector, 0, cnt - 1);
957 			while (cnt-- > 0) {
958 				switch (info->portwidth) {
959 				case FLASH_CFI_8BIT:
960 					flash_write8(flash_read8(src), dst);
961 					src += 1, dst += 1;
962 					break;
963 				case FLASH_CFI_16BIT:
964 					flash_write16(flash_read16(src), dst);
965 					src += 2, dst += 2;
966 					break;
967 				case FLASH_CFI_32BIT:
968 					flash_write32(flash_read32(src), dst);
969 					src += 4, dst += 4;
970 					break;
971 				case FLASH_CFI_64BIT:
972 					flash_write64(flash_read64(src), dst);
973 					src += 8, dst += 8;
974 					break;
975 				default:
976 					retcode = ERR_INVAL;
977 					goto out_unmap;
978 				}
979 			}
980 			flash_write_cmd(info, sector, 0,
981 					FLASH_CMD_WRITE_BUFFER_CONFIRM);
982 			retcode = flash_full_status_check(
983 				info, sector, info->buffer_write_tout,
984 				"buffer write");
985 		}
986 
987 		break;
988 
989 	case CFI_CMDSET_AMD_STANDARD:
990 	case CFI_CMDSET_AMD_EXTENDED:
991 		flash_unlock_seq(info, sector);
992 
993 #ifdef CONFIG_FLASH_SPANSION_S29WS_N
994 		offset = ((unsigned long)dst - info->start[sector]) >> shift;
995 #endif
996 		flash_write_cmd(info, sector, offset, AMD_CMD_WRITE_TO_BUFFER);
997 		cnt = len >> shift;
998 		flash_write_cmd(info, sector, offset, cnt - 1);
999 
1000 		switch (info->portwidth) {
1001 		case FLASH_CFI_8BIT:
1002 			while (cnt-- > 0) {
1003 				flash_write8(flash_read8(src), dst);
1004 				src += 1, dst += 1;
1005 			}
1006 			break;
1007 		case FLASH_CFI_16BIT:
1008 			while (cnt-- > 0) {
1009 				flash_write16(flash_read16(src), dst);
1010 				src += 2, dst += 2;
1011 			}
1012 			break;
1013 		case FLASH_CFI_32BIT:
1014 			while (cnt-- > 0) {
1015 				flash_write32(flash_read32(src), dst);
1016 				src += 4, dst += 4;
1017 			}
1018 			break;
1019 		case FLASH_CFI_64BIT:
1020 			while (cnt-- > 0) {
1021 				flash_write64(flash_read64(src), dst);
1022 				src += 8, dst += 8;
1023 			}
1024 			break;
1025 		default:
1026 			retcode = ERR_INVAL;
1027 			goto out_unmap;
1028 		}
1029 
1030 		flash_write_cmd(info, sector, 0, AMD_CMD_WRITE_BUFFER_CONFIRM);
1031 		if (use_flash_status_poll(info))
1032 			retcode = flash_status_poll(info, src - (1 << shift),
1033 						    dst - (1 << shift),
1034 						    info->buffer_write_tout,
1035 						    "buffer write");
1036 		else
1037 			retcode = flash_full_status_check(info, sector,
1038 							  info->buffer_write_tout,
1039 							  "buffer write");
1040 		break;
1041 
1042 	default:
1043 		debug("Unknown Command Set\n");
1044 		retcode = ERR_INVAL;
1045 		break;
1046 	}
1047 
1048 out_unmap:
1049 	return retcode;
1050 }
1051 #endif /* CONFIG_SYS_FLASH_USE_BUFFER_WRITE */
1052 
1053 /*-----------------------------------------------------------------------
1054  */
1055 int flash_erase(flash_info_t *info, int s_first, int s_last)
1056 {
1057 	int rcode = 0;
1058 	int prot;
1059 	flash_sect_t sect;
1060 	int st;
1061 
1062 	if (info->flash_id != FLASH_MAN_CFI) {
1063 		puts("Can't erase unknown flash type - aborted\n");
1064 		return 1;
1065 	}
1066 	if (s_first < 0 || s_first > s_last) {
1067 		puts("- no sectors to erase\n");
1068 		return 1;
1069 	}
1070 
1071 	prot = 0;
1072 	for (sect = s_first; sect <= s_last; ++sect)
1073 		if (info->protect[sect])
1074 			prot++;
1075 	if (prot) {
1076 		printf("- Warning: %d protected sectors will not be erased!\n",
1077 		       prot);
1078 	} else if (flash_verbose) {
1079 		putc('\n');
1080 	}
1081 
1082 	for (sect = s_first; sect <= s_last; sect++) {
1083 		if (ctrlc()) {
1084 			printf("\n");
1085 			return 1;
1086 		}
1087 
1088 		if (info->protect[sect] == 0) { /* not protected */
1089 #ifdef CONFIG_SYS_FLASH_CHECK_BLANK_BEFORE_ERASE
1090 			int k;
1091 			int size;
1092 			int erased;
1093 			u32 *flash;
1094 
1095 			/*
1096 			 * Check if whole sector is erased
1097 			 */
1098 			size = flash_sector_size(info, sect);
1099 			erased = 1;
1100 			flash = (u32 *)info->start[sect];
1101 			/* divide by 4 for longword access */
1102 			size = size >> 2;
1103 			for (k = 0; k < size; k++) {
1104 				if (flash_read32(flash++) != 0xffffffff) {
1105 					erased = 0;
1106 					break;
1107 				}
1108 			}
1109 			if (erased) {
1110 				if (flash_verbose)
1111 					putc(',');
1112 				continue;
1113 			}
1114 #endif
1115 			switch (info->vendor) {
1116 			case CFI_CMDSET_INTEL_PROG_REGIONS:
1117 			case CFI_CMDSET_INTEL_STANDARD:
1118 			case CFI_CMDSET_INTEL_EXTENDED:
1119 				flash_write_cmd(info, sect, 0,
1120 						FLASH_CMD_CLEAR_STATUS);
1121 				flash_write_cmd(info, sect, 0,
1122 						FLASH_CMD_BLOCK_ERASE);
1123 				flash_write_cmd(info, sect, 0,
1124 						FLASH_CMD_ERASE_CONFIRM);
1125 				break;
1126 			case CFI_CMDSET_AMD_STANDARD:
1127 			case CFI_CMDSET_AMD_EXTENDED:
1128 				flash_unlock_seq(info, sect);
1129 				flash_write_cmd(info, sect,
1130 						info->addr_unlock1,
1131 						AMD_CMD_ERASE_START);
1132 				flash_unlock_seq(info, sect);
1133 				flash_write_cmd(info, sect, 0,
1134 						info->cmd_erase_sector);
1135 				break;
1136 #ifdef CONFIG_FLASH_CFI_LEGACY
1137 			case CFI_CMDSET_AMD_LEGACY:
1138 				flash_unlock_seq(info, 0);
1139 				flash_write_cmd(info, 0, info->addr_unlock1,
1140 						AMD_CMD_ERASE_START);
1141 				flash_unlock_seq(info, 0);
1142 				flash_write_cmd(info, sect, 0,
1143 						AMD_CMD_ERASE_SECTOR);
1144 				break;
1145 #endif
1146 			default:
1147 				debug("Unknown flash vendor %d\n",
1148 				      info->vendor);
1149 				break;
1150 			}
1151 
1152 			if (use_flash_status_poll(info)) {
1153 				cfiword_t cword;
1154 				void *dest;
1155 
1156 				cword.w64 = 0xffffffffffffffffULL;
1157 				dest = flash_map(info, sect, 0);
1158 				st = flash_status_poll(info, &cword, dest,
1159 						       info->erase_blk_tout,
1160 						       "erase");
1161 				flash_unmap(info, sect, 0, dest);
1162 			} else {
1163 				st = flash_full_status_check(info, sect,
1164 							     info->erase_blk_tout,
1165 							     "erase");
1166 			}
1167 
1168 			if (st)
1169 				rcode = 1;
1170 			else if (flash_verbose)
1171 				putc('.');
1172 		}
1173 	}
1174 
1175 	if (flash_verbose)
1176 		puts(" done\n");
1177 
1178 	return rcode;
1179 }
1180 
1181 #ifdef CONFIG_SYS_FLASH_EMPTY_INFO
1182 static int sector_erased(flash_info_t *info, int i)
1183 {
1184 	int k;
1185 	int size;
1186 	u32 *flash;
1187 
1188 	/*
1189 	 * Check if whole sector is erased
1190 	 */
1191 	size = flash_sector_size(info, i);
1192 	flash = (u32 *)info->start[i];
1193 	/* divide by 4 for longword access */
1194 	size = size >> 2;
1195 
1196 	for (k = 0; k < size; k++) {
1197 		if (flash_read32(flash++) != 0xffffffff)
1198 			return 0;	/* not erased */
1199 	}
1200 
1201 	return 1;			/* erased */
1202 }
1203 #endif /* CONFIG_SYS_FLASH_EMPTY_INFO */
1204 
1205 void flash_print_info(flash_info_t *info)
1206 {
1207 	int i;
1208 
1209 	if (info->flash_id != FLASH_MAN_CFI) {
1210 		puts("missing or unknown FLASH type\n");
1211 		return;
1212 	}
1213 
1214 	printf("%s flash (%d x %d)",
1215 	       info->name,
1216 	       (info->portwidth << 3), (info->chipwidth << 3));
1217 	if (info->size < 1024 * 1024)
1218 		printf("  Size: %ld kB in %d Sectors\n",
1219 		       info->size >> 10, info->sector_count);
1220 	else
1221 		printf("  Size: %ld MB in %d Sectors\n",
1222 		       info->size >> 20, info->sector_count);
1223 	printf("  ");
1224 	switch (info->vendor) {
1225 	case CFI_CMDSET_INTEL_PROG_REGIONS:
1226 		printf("Intel Prog Regions");
1227 		break;
1228 	case CFI_CMDSET_INTEL_STANDARD:
1229 		printf("Intel Standard");
1230 		break;
1231 	case CFI_CMDSET_INTEL_EXTENDED:
1232 		printf("Intel Extended");
1233 		break;
1234 	case CFI_CMDSET_AMD_STANDARD:
1235 		printf("AMD Standard");
1236 		break;
1237 	case CFI_CMDSET_AMD_EXTENDED:
1238 		printf("AMD Extended");
1239 		break;
1240 #ifdef CONFIG_FLASH_CFI_LEGACY
1241 	case CFI_CMDSET_AMD_LEGACY:
1242 		printf("AMD Legacy");
1243 		break;
1244 #endif
1245 	default:
1246 		printf("Unknown (%d)", info->vendor);
1247 		break;
1248 	}
1249 	printf(" command set, Manufacturer ID: 0x%02X, Device ID: 0x",
1250 	       info->manufacturer_id);
1251 	printf(info->chipwidth == FLASH_CFI_16BIT ? "%04X" : "%02X",
1252 	       info->device_id);
1253 	if ((info->device_id & 0xff) == 0x7E) {
1254 		printf(info->chipwidth == FLASH_CFI_16BIT ? "%04X" : "%02X",
1255 		       info->device_id2);
1256 	}
1257 	if (info->vendor == CFI_CMDSET_AMD_STANDARD && info->legacy_unlock)
1258 		printf("\n  Advanced Sector Protection (PPB) enabled");
1259 	printf("\n  Erase timeout: %ld ms, write timeout: %ld ms\n",
1260 	       info->erase_blk_tout, info->write_tout);
1261 	if (info->buffer_size > 1) {
1262 		printf("  Buffer write timeout: %ld ms, ",
1263 		       info->buffer_write_tout);
1264 		printf("buffer size: %d bytes\n", info->buffer_size);
1265 	}
1266 
1267 	puts("\n  Sector Start Addresses:");
1268 	for (i = 0; i < info->sector_count; ++i) {
1269 		if (ctrlc())
1270 			break;
1271 		if ((i % 5) == 0)
1272 			putc('\n');
1273 #ifdef CONFIG_SYS_FLASH_EMPTY_INFO
1274 		/* print empty and read-only info */
1275 		printf("  %08lX %c %s ",
1276 		       info->start[i],
1277 		       sector_erased(info, i) ? 'E' : ' ',
1278 		       info->protect[i] ? "RO" : "  ");
1279 #else	/* ! CONFIG_SYS_FLASH_EMPTY_INFO */
1280 		printf("  %08lX   %s ",
1281 		       info->start[i],
1282 		       info->protect[i] ? "RO" : "  ");
1283 #endif
1284 	}
1285 	putc('\n');
1286 }
1287 
1288 /*-----------------------------------------------------------------------
1289  * This is used in a few places in write_buf() to show programming
1290  * progress.  Making it a function is nasty because it needs to do side
1291  * effect updates to digit and dots.  Repeated code is nasty too, so
1292  * we define it once here.
1293  */
1294 #ifdef CONFIG_FLASH_SHOW_PROGRESS
1295 #define FLASH_SHOW_PROGRESS(scale, dots, digit, dots_sub) \
1296 	if (flash_verbose) { \
1297 		dots -= dots_sub; \
1298 		if (scale > 0 && dots <= 0) { \
1299 			if ((digit % 5) == 0) \
1300 				printf("%d", digit / 5); \
1301 			else \
1302 				putc('.'); \
1303 			digit--; \
1304 			dots += scale; \
1305 		} \
1306 	}
1307 #else
1308 #define FLASH_SHOW_PROGRESS(scale, dots, digit, dots_sub)
1309 #endif
1310 
1311 /*-----------------------------------------------------------------------
1312  * Copy memory to flash, returns:
1313  * 0 - OK
1314  * 1 - write timeout
1315  * 2 - Flash not erased
1316  */
1317 int write_buff(flash_info_t *info, uchar *src, ulong addr, ulong cnt)
1318 {
1319 	ulong wp;
1320 	uchar *p;
1321 	int aln;
1322 	cfiword_t cword;
1323 	int i, rc;
1324 #ifdef CONFIG_SYS_FLASH_USE_BUFFER_WRITE
1325 	int buffered_size;
1326 #endif
1327 #ifdef CONFIG_FLASH_SHOW_PROGRESS
1328 	int digit = CONFIG_FLASH_SHOW_PROGRESS;
1329 	int scale = 0;
1330 	int dots  = 0;
1331 
1332 	/*
1333 	 * Suppress if there are fewer than CONFIG_FLASH_SHOW_PROGRESS writes.
1334 	 */
1335 	if (cnt >= CONFIG_FLASH_SHOW_PROGRESS) {
1336 		scale = (int)((cnt + CONFIG_FLASH_SHOW_PROGRESS - 1) /
1337 			CONFIG_FLASH_SHOW_PROGRESS);
1338 	}
1339 #endif
1340 
1341 	/* get lower aligned address */
1342 	wp = (addr & ~(info->portwidth - 1));
1343 
1344 	/* handle unaligned start */
1345 	aln = addr - wp;
1346 	if (aln != 0) {
1347 		cword.w32 = 0;
1348 		p = (uchar *)wp;
1349 		for (i = 0; i < aln; ++i)
1350 			flash_add_byte(info, &cword, flash_read8(p + i));
1351 
1352 		for (; (i < info->portwidth) && (cnt > 0); i++) {
1353 			flash_add_byte(info, &cword, *src++);
1354 			cnt--;
1355 		}
1356 		for (; (cnt == 0) && (i < info->portwidth); ++i)
1357 			flash_add_byte(info, &cword, flash_read8(p + i));
1358 
1359 		rc = flash_write_cfiword(info, wp, cword);
1360 		if (rc != 0)
1361 			return rc;
1362 
1363 		wp += i;
1364 		FLASH_SHOW_PROGRESS(scale, dots, digit, i);
1365 	}
1366 
1367 	/* handle the aligned part */
1368 #ifdef CONFIG_SYS_FLASH_USE_BUFFER_WRITE
1369 	buffered_size = (info->portwidth / info->chipwidth);
1370 	buffered_size *= info->buffer_size;
1371 	while (cnt >= info->portwidth) {
1372 		/* prohibit buffer write when buffer_size is 1 */
1373 		if (info->buffer_size == 1) {
1374 			cword.w32 = 0;
1375 			for (i = 0; i < info->portwidth; i++)
1376 				flash_add_byte(info, &cword, *src++);
1377 			rc = flash_write_cfiword(info, wp, cword);
1378 			if (rc != 0)
1379 				return rc;
1380 			wp += info->portwidth;
1381 			cnt -= info->portwidth;
1382 			continue;
1383 		}
1384 
1385 		/* write buffer until next buffered_size aligned boundary */
1386 		i = buffered_size - (wp % buffered_size);
1387 		if (i > cnt)
1388 			i = cnt;
1389 		rc = flash_write_cfibuffer(info, wp, src, i);
1390 		if (rc != ERR_OK)
1391 			return rc;
1392 		i -= i & (info->portwidth - 1);
1393 		wp += i;
1394 		src += i;
1395 		cnt -= i;
1396 		FLASH_SHOW_PROGRESS(scale, dots, digit, i);
1397 		/* Only check every once in a while */
1398 		if ((cnt & 0xFFFF) < buffered_size && ctrlc())
1399 			return ERR_ABORTED;
1400 	}
1401 #else
1402 	while (cnt >= info->portwidth) {
1403 		cword.w32 = 0;
1404 		for (i = 0; i < info->portwidth; i++)
1405 			flash_add_byte(info, &cword, *src++);
1406 		rc = flash_write_cfiword(info, wp, cword);
1407 		if (rc != 0)
1408 			return rc;
1409 		wp += info->portwidth;
1410 		cnt -= info->portwidth;
1411 		FLASH_SHOW_PROGRESS(scale, dots, digit, info->portwidth);
1412 		/* Only check every once in a while */
1413 		if ((cnt & 0xFFFF) < info->portwidth && ctrlc())
1414 			return ERR_ABORTED;
1415 	}
1416 #endif /* CONFIG_SYS_FLASH_USE_BUFFER_WRITE */
1417 
1418 	if (cnt == 0)
1419 		return (0);
1420 
1421 	/*
1422 	 * handle unaligned tail bytes
1423 	 */
1424 	cword.w32 = 0;
1425 	p = (uchar *)wp;
1426 	for (i = 0; (i < info->portwidth) && (cnt > 0); ++i) {
1427 		flash_add_byte(info, &cword, *src++);
1428 		--cnt;
1429 	}
1430 	for (; i < info->portwidth; ++i)
1431 		flash_add_byte(info, &cword, flash_read8(p + i));
1432 
1433 	return flash_write_cfiword(info, wp, cword);
1434 }
1435 
1436 static inline int manufact_match(flash_info_t *info, u32 manu)
1437 {
1438 	return info->manufacturer_id == ((manu & FLASH_VENDMASK) >> 16);
1439 }
1440 
1441 /*-----------------------------------------------------------------------
1442  */
1443 #ifdef CONFIG_SYS_FLASH_PROTECTION
1444 
1445 static int cfi_protect_bugfix(flash_info_t *info, long sector, int prot)
1446 {
1447 	if (manufact_match(info, INTEL_MANUFACT) &&
1448 	    info->device_id == NUMONYX_256MBIT) {
1449 		/*
1450 		 * see errata called
1451 		 * "Numonyx Axcell P33/P30 Specification Update" :)
1452 		 */
1453 		flash_write_cmd(info, sector, 0, FLASH_CMD_READ_ID);
1454 		if (!flash_isequal(info, sector, FLASH_OFFSET_PROTECT,
1455 				   prot)) {
1456 			/*
1457 			 * cmd must come before FLASH_CMD_PROTECT + 20us
1458 			 * Disable interrupts which might cause a timeout here.
1459 			 */
1460 			int flag = disable_interrupts();
1461 			unsigned short cmd;
1462 
1463 			if (prot)
1464 				cmd = FLASH_CMD_PROTECT_SET;
1465 			else
1466 				cmd = FLASH_CMD_PROTECT_CLEAR;
1467 
1468 			flash_write_cmd(info, sector, 0, FLASH_CMD_PROTECT);
1469 			flash_write_cmd(info, sector, 0, cmd);
1470 			/* re-enable interrupts if necessary */
1471 			if (flag)
1472 				enable_interrupts();
1473 		}
1474 		return 1;
1475 	}
1476 	return 0;
1477 }
1478 
1479 int flash_real_protect(flash_info_t *info, long sector, int prot)
1480 {
1481 	int retcode = 0;
1482 
1483 	switch (info->vendor) {
1484 	case CFI_CMDSET_INTEL_PROG_REGIONS:
1485 	case CFI_CMDSET_INTEL_STANDARD:
1486 	case CFI_CMDSET_INTEL_EXTENDED:
1487 		if (!cfi_protect_bugfix(info, sector, prot)) {
1488 			flash_write_cmd(info, sector, 0,
1489 					FLASH_CMD_CLEAR_STATUS);
1490 			flash_write_cmd(info, sector, 0,
1491 					FLASH_CMD_PROTECT);
1492 			if (prot)
1493 				flash_write_cmd(info, sector, 0,
1494 						FLASH_CMD_PROTECT_SET);
1495 			else
1496 				flash_write_cmd(info, sector, 0,
1497 						FLASH_CMD_PROTECT_CLEAR);
1498 		}
1499 		break;
1500 	case CFI_CMDSET_AMD_EXTENDED:
1501 	case CFI_CMDSET_AMD_STANDARD:
1502 		/* U-Boot only checks the first byte */
1503 		if (manufact_match(info, ATM_MANUFACT)) {
1504 			if (prot) {
1505 				flash_unlock_seq(info, 0);
1506 				flash_write_cmd(info, 0,
1507 						info->addr_unlock1,
1508 						ATM_CMD_SOFTLOCK_START);
1509 				flash_unlock_seq(info, 0);
1510 				flash_write_cmd(info, sector, 0,
1511 						ATM_CMD_LOCK_SECT);
1512 			} else {
1513 				flash_write_cmd(info, 0,
1514 						info->addr_unlock1,
1515 						AMD_CMD_UNLOCK_START);
1516 				if (info->device_id == ATM_ID_BV6416)
1517 					flash_write_cmd(info, sector,
1518 							0, ATM_CMD_UNLOCK_SECT);
1519 			}
1520 		}
1521 		if (info->legacy_unlock) {
1522 			int flag = disable_interrupts();
1523 			int lock_flag;
1524 
1525 			flash_unlock_seq(info, 0);
1526 			flash_write_cmd(info, 0, info->addr_unlock1,
1527 					AMD_CMD_SET_PPB_ENTRY);
1528 			lock_flag = flash_isset(info, sector, 0, 0x01);
1529 			if (prot) {
1530 				if (lock_flag) {
1531 					flash_write_cmd(info, sector, 0,
1532 							AMD_CMD_PPB_LOCK_BC1);
1533 					flash_write_cmd(info, sector, 0,
1534 							AMD_CMD_PPB_LOCK_BC2);
1535 				}
1536 				debug("sector %ld %slocked\n", sector,
1537 				      lock_flag ? "" : "already ");
1538 			} else {
1539 				if (!lock_flag) {
1540 					debug("unlock %ld\n", sector);
1541 					flash_write_cmd(info, 0, 0,
1542 							AMD_CMD_PPB_UNLOCK_BC1);
1543 					flash_write_cmd(info, 0, 0,
1544 							AMD_CMD_PPB_UNLOCK_BC2);
1545 				}
1546 				debug("sector %ld %sunlocked\n", sector,
1547 				      !lock_flag ? "" : "already ");
1548 			}
1549 			if (flag)
1550 				enable_interrupts();
1551 
1552 			if (flash_status_check(info, sector,
1553 					       info->erase_blk_tout,
1554 					       prot ? "protect" : "unprotect"))
1555 				printf("status check error\n");
1556 
1557 			flash_write_cmd(info, 0, 0,
1558 					AMD_CMD_SET_PPB_EXIT_BC1);
1559 			flash_write_cmd(info, 0, 0,
1560 					AMD_CMD_SET_PPB_EXIT_BC2);
1561 		}
1562 		break;
1563 #ifdef CONFIG_FLASH_CFI_LEGACY
1564 	case CFI_CMDSET_AMD_LEGACY:
1565 		flash_write_cmd(info, sector, 0, FLASH_CMD_CLEAR_STATUS);
1566 		flash_write_cmd(info, sector, 0, FLASH_CMD_PROTECT);
1567 		if (prot)
1568 			flash_write_cmd(info, sector, 0,
1569 					FLASH_CMD_PROTECT_SET);
1570 		else
1571 			flash_write_cmd(info, sector, 0,
1572 					FLASH_CMD_PROTECT_CLEAR);
1573 #endif
1574 	};
1575 
1576 	/*
1577 	 * Flash needs to be in status register read mode for
1578 	 * flash_full_status_check() to work correctly
1579 	 */
1580 	flash_write_cmd(info, sector, 0, FLASH_CMD_READ_STATUS);
1581 	retcode = flash_full_status_check(info, sector, info->erase_blk_tout,
1582 					  prot ? "protect" : "unprotect");
1583 	if (retcode == 0) {
1584 		info->protect[sector] = prot;
1585 
1586 		/*
1587 		 * On some of Intel's flash chips (marked via legacy_unlock)
1588 		 * unprotect unprotects all locking.
1589 		 */
1590 		if (prot == 0 && info->legacy_unlock) {
1591 			flash_sect_t i;
1592 
1593 			for (i = 0; i < info->sector_count; i++) {
1594 				if (info->protect[i])
1595 					flash_real_protect(info, i, 1);
1596 			}
1597 		}
1598 	}
1599 	return retcode;
1600 }
1601 
1602 /*-----------------------------------------------------------------------
1603  * flash_read_user_serial - read the OneTimeProgramming cells
1604  */
1605 void flash_read_user_serial(flash_info_t *info, void *buffer, int offset,
1606 			    int len)
1607 {
1608 	uchar *src;
1609 	uchar *dst;
1610 
1611 	dst = buffer;
1612 	src = flash_map(info, 0, FLASH_OFFSET_USER_PROTECTION);
1613 	flash_write_cmd(info, 0, 0, FLASH_CMD_READ_ID);
1614 	memcpy(dst, src + offset, len);
1615 	flash_write_cmd(info, 0, 0, info->cmd_reset);
1616 	udelay(1);
1617 	flash_unmap(info, 0, FLASH_OFFSET_USER_PROTECTION, src);
1618 }
1619 
1620 /*
1621  * flash_read_factory_serial - read the device Id from the protection area
1622  */
1623 void flash_read_factory_serial(flash_info_t *info, void *buffer, int offset,
1624 			       int len)
1625 {
1626 	uchar *src;
1627 
1628 	src = flash_map(info, 0, FLASH_OFFSET_INTEL_PROTECTION);
1629 	flash_write_cmd(info, 0, 0, FLASH_CMD_READ_ID);
1630 	memcpy(buffer, src + offset, len);
1631 	flash_write_cmd(info, 0, 0, info->cmd_reset);
1632 	udelay(1);
1633 	flash_unmap(info, 0, FLASH_OFFSET_INTEL_PROTECTION, src);
1634 }
1635 
1636 #endif /* CONFIG_SYS_FLASH_PROTECTION */
1637 
1638 /*-----------------------------------------------------------------------
1639  * Reverse the order of the erase regions in the CFI QRY structure.
1640  * This is needed for chips that are either a) correctly detected as
1641  * top-boot, or b) buggy.
1642  */
1643 static void cfi_reverse_geometry(struct cfi_qry *qry)
1644 {
1645 	unsigned int i, j;
1646 	u32 tmp;
1647 
1648 	for (i = 0, j = qry->num_erase_regions - 1; i < j; i++, j--) {
1649 		tmp = get_unaligned(&qry->erase_region_info[i]);
1650 		put_unaligned(get_unaligned(&qry->erase_region_info[j]),
1651 			      &qry->erase_region_info[i]);
1652 		put_unaligned(tmp, &qry->erase_region_info[j]);
1653 	}
1654 }
1655 
1656 /*-----------------------------------------------------------------------
1657  * read jedec ids from device and set corresponding fields in info struct
1658  *
1659  * Note: assume cfi->vendor, cfi->portwidth and cfi->chipwidth are correct
1660  *
1661  */
1662 static void cmdset_intel_read_jedec_ids(flash_info_t *info)
1663 {
1664 	flash_write_cmd(info, 0, 0, FLASH_CMD_RESET);
1665 	udelay(1);
1666 	flash_write_cmd(info, 0, 0, FLASH_CMD_READ_ID);
1667 	udelay(1000); /* some flash are slow to respond */
1668 	info->manufacturer_id = flash_read_uchar(info,
1669 						 FLASH_OFFSET_MANUFACTURER_ID);
1670 	info->device_id = (info->chipwidth == FLASH_CFI_16BIT) ?
1671 			flash_read_word(info, FLASH_OFFSET_DEVICE_ID) :
1672 			flash_read_uchar(info, FLASH_OFFSET_DEVICE_ID);
1673 	flash_write_cmd(info, 0, 0, FLASH_CMD_RESET);
1674 }
1675 
1676 static int cmdset_intel_init(flash_info_t *info, struct cfi_qry *qry)
1677 {
1678 	info->cmd_reset = FLASH_CMD_RESET;
1679 
1680 	cmdset_intel_read_jedec_ids(info);
1681 	flash_write_cmd(info, 0, info->cfi_offset, FLASH_CMD_CFI);
1682 
1683 #ifdef CONFIG_SYS_FLASH_PROTECTION
1684 	/* read legacy lock/unlock bit from intel flash */
1685 	if (info->ext_addr) {
1686 		info->legacy_unlock =
1687 			flash_read_uchar(info, info->ext_addr + 5) & 0x08;
1688 	}
1689 #endif
1690 
1691 	return 0;
1692 }
1693 
1694 static void cmdset_amd_read_jedec_ids(flash_info_t *info)
1695 {
1696 	ushort bank_id = 0;
1697 	uchar  manu_id;
1698 	uchar  feature;
1699 
1700 	flash_write_cmd(info, 0, 0, AMD_CMD_RESET);
1701 	flash_unlock_seq(info, 0);
1702 	flash_write_cmd(info, 0, info->addr_unlock1, FLASH_CMD_READ_ID);
1703 	udelay(1000); /* some flash are slow to respond */
1704 
1705 	manu_id = flash_read_uchar(info, FLASH_OFFSET_MANUFACTURER_ID);
1706 	/* JEDEC JEP106Z specifies ID codes up to bank 7 */
1707 	while (manu_id == FLASH_CONTINUATION_CODE && bank_id < 0x800) {
1708 		bank_id += 0x100;
1709 		manu_id = flash_read_uchar(info,
1710 					   bank_id | FLASH_OFFSET_MANUFACTURER_ID);
1711 	}
1712 	info->manufacturer_id = manu_id;
1713 
1714 	debug("info->ext_addr = 0x%x, cfi_version = 0x%x\n",
1715 	      info->ext_addr, info->cfi_version);
1716 	if (info->ext_addr && info->cfi_version >= 0x3134) {
1717 		/* read software feature (at 0x53) */
1718 		feature = flash_read_uchar(info, info->ext_addr + 0x13);
1719 		debug("feature = 0x%x\n", feature);
1720 		info->sr_supported = feature & 0x1;
1721 	}
1722 
1723 	switch (info->chipwidth) {
1724 	case FLASH_CFI_8BIT:
1725 		info->device_id = flash_read_uchar(info,
1726 						   FLASH_OFFSET_DEVICE_ID);
1727 		if (info->device_id == 0x7E) {
1728 			/* AMD 3-byte (expanded) device ids */
1729 			info->device_id2 = flash_read_uchar(info,
1730 							    FLASH_OFFSET_DEVICE_ID2);
1731 			info->device_id2 <<= 8;
1732 			info->device_id2 |= flash_read_uchar(info,
1733 						FLASH_OFFSET_DEVICE_ID3);
1734 		}
1735 		break;
1736 	case FLASH_CFI_16BIT:
1737 		info->device_id = flash_read_word(info,
1738 						  FLASH_OFFSET_DEVICE_ID);
1739 		if ((info->device_id & 0xff) == 0x7E) {
1740 			/* AMD 3-byte (expanded) device ids */
1741 			info->device_id2 = flash_read_uchar(info,
1742 							    FLASH_OFFSET_DEVICE_ID2);
1743 			info->device_id2 <<= 8;
1744 			info->device_id2 |= flash_read_uchar(info,
1745 						FLASH_OFFSET_DEVICE_ID3);
1746 		}
1747 		break;
1748 	default:
1749 		break;
1750 	}
1751 	flash_write_cmd(info, 0, 0, AMD_CMD_RESET);
1752 	udelay(1);
1753 }
1754 
1755 static int cmdset_amd_init(flash_info_t *info, struct cfi_qry *qry)
1756 {
1757 	info->cmd_reset = AMD_CMD_RESET;
1758 	info->cmd_erase_sector = AMD_CMD_ERASE_SECTOR;
1759 
1760 	cmdset_amd_read_jedec_ids(info);
1761 	flash_write_cmd(info, 0, info->cfi_offset, FLASH_CMD_CFI);
1762 
1763 #ifdef CONFIG_SYS_FLASH_PROTECTION
1764 	if (info->ext_addr) {
1765 		/* read sector protect/unprotect scheme (at 0x49) */
1766 		if (flash_read_uchar(info, info->ext_addr + 9) == 0x8)
1767 			info->legacy_unlock = 1;
1768 	}
1769 #endif
1770 
1771 	return 0;
1772 }
1773 
1774 #ifdef CONFIG_FLASH_CFI_LEGACY
1775 static void flash_read_jedec_ids(flash_info_t *info)
1776 {
1777 	info->manufacturer_id = 0;
1778 	info->device_id       = 0;
1779 	info->device_id2      = 0;
1780 
1781 	switch (info->vendor) {
1782 	case CFI_CMDSET_INTEL_PROG_REGIONS:
1783 	case CFI_CMDSET_INTEL_STANDARD:
1784 	case CFI_CMDSET_INTEL_EXTENDED:
1785 		cmdset_intel_read_jedec_ids(info);
1786 		break;
1787 	case CFI_CMDSET_AMD_STANDARD:
1788 	case CFI_CMDSET_AMD_EXTENDED:
1789 		cmdset_amd_read_jedec_ids(info);
1790 		break;
1791 	default:
1792 		break;
1793 	}
1794 }
1795 
1796 /*-----------------------------------------------------------------------
1797  * Call board code to request info about non-CFI flash.
1798  * board_flash_get_legacy needs to fill in at least:
1799  * info->portwidth, info->chipwidth and info->interface for Jedec probing.
1800  */
1801 static int flash_detect_legacy(phys_addr_t base, int banknum)
1802 {
1803 	flash_info_t *info = &flash_info[banknum];
1804 
1805 	if (board_flash_get_legacy(base, banknum, info)) {
1806 		/* board code may have filled info completely. If not, we
1807 		 * use JEDEC ID probing.
1808 		 */
1809 		if (!info->vendor) {
1810 			int modes[] = {
1811 				CFI_CMDSET_AMD_STANDARD,
1812 				CFI_CMDSET_INTEL_STANDARD
1813 			};
1814 			int i;
1815 
1816 			for (i = 0; i < ARRAY_SIZE(modes); i++) {
1817 				info->vendor = modes[i];
1818 				info->start[0] =
1819 					(ulong)map_physmem(base,
1820 							   info->portwidth,
1821 							   MAP_NOCACHE);
1822 				if (info->portwidth == FLASH_CFI_8BIT &&
1823 				    info->interface == FLASH_CFI_X8X16) {
1824 					info->addr_unlock1 = 0x2AAA;
1825 					info->addr_unlock2 = 0x5555;
1826 				} else {
1827 					info->addr_unlock1 = 0x5555;
1828 					info->addr_unlock2 = 0x2AAA;
1829 				}
1830 				flash_read_jedec_ids(info);
1831 				debug("JEDEC PROBE: ID %x %x %x\n",
1832 				      info->manufacturer_id,
1833 				      info->device_id,
1834 				      info->device_id2);
1835 				if (jedec_flash_match(info, info->start[0]))
1836 					break;
1837 
1838 				unmap_physmem((void *)info->start[0],
1839 					      info->portwidth);
1840 			}
1841 		}
1842 
1843 		switch (info->vendor) {
1844 		case CFI_CMDSET_INTEL_PROG_REGIONS:
1845 		case CFI_CMDSET_INTEL_STANDARD:
1846 		case CFI_CMDSET_INTEL_EXTENDED:
1847 			info->cmd_reset = FLASH_CMD_RESET;
1848 			break;
1849 		case CFI_CMDSET_AMD_STANDARD:
1850 		case CFI_CMDSET_AMD_EXTENDED:
1851 		case CFI_CMDSET_AMD_LEGACY:
1852 			info->cmd_reset = AMD_CMD_RESET;
1853 			break;
1854 		}
1855 		info->flash_id = FLASH_MAN_CFI;
1856 		return 1;
1857 	}
1858 	return 0; /* use CFI */
1859 }
1860 #else
1861 static inline int flash_detect_legacy(phys_addr_t base, int banknum)
1862 {
1863 	return 0; /* use CFI */
1864 }
1865 #endif
1866 
1867 /*-----------------------------------------------------------------------
1868  * detect if flash is compatible with the Common Flash Interface (CFI)
1869  * http://www.jedec.org/download/search/jesd68.pdf
1870  */
1871 static void flash_read_cfi(flash_info_t *info, void *buf, unsigned int start,
1872 			   size_t len)
1873 {
1874 	u8 *p = buf;
1875 	unsigned int i;
1876 
1877 	for (i = 0; i < len; i++)
1878 		p[i] = flash_read_uchar(info, start + i);
1879 }
1880 
1881 static void __flash_cmd_reset(flash_info_t *info)
1882 {
1883 	/*
1884 	 * We do not yet know what kind of commandset to use, so we issue
1885 	 * the reset command in both Intel and AMD variants, in the hope
1886 	 * that AMD flash roms ignore the Intel command.
1887 	 */
1888 	flash_write_cmd(info, 0, 0, AMD_CMD_RESET);
1889 	udelay(1);
1890 	flash_write_cmd(info, 0, 0, FLASH_CMD_RESET);
1891 }
1892 
1893 void flash_cmd_reset(flash_info_t *info)
1894 	__attribute__((weak, alias("__flash_cmd_reset")));
1895 
1896 static int __flash_detect_cfi(flash_info_t *info, struct cfi_qry *qry)
1897 {
1898 	int cfi_offset;
1899 
1900 	/* Issue FLASH reset command */
1901 	flash_cmd_reset(info);
1902 
1903 	for (cfi_offset = 0; cfi_offset < ARRAY_SIZE(flash_offset_cfi);
1904 	     cfi_offset++) {
1905 		flash_write_cmd(info, 0, flash_offset_cfi[cfi_offset],
1906 				FLASH_CMD_CFI);
1907 		if (flash_isequal(info, 0, FLASH_OFFSET_CFI_RESP, 'Q') &&
1908 		    flash_isequal(info, 0, FLASH_OFFSET_CFI_RESP + 1, 'R') &&
1909 		    flash_isequal(info, 0, FLASH_OFFSET_CFI_RESP + 2, 'Y')) {
1910 			flash_read_cfi(info, qry, FLASH_OFFSET_CFI_RESP,
1911 				       sizeof(struct cfi_qry));
1912 			info->interface	= le16_to_cpu(qry->interface_desc);
1913 
1914 			info->cfi_offset = flash_offset_cfi[cfi_offset];
1915 			debug("device interface is %d\n",
1916 			      info->interface);
1917 			debug("found port %d chip %d ",
1918 			      info->portwidth, info->chipwidth);
1919 			debug("port %d bits chip %d bits\n",
1920 			      info->portwidth << CFI_FLASH_SHIFT_WIDTH,
1921 			      info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
1922 
1923 			/* calculate command offsets as in the Linux driver */
1924 			info->addr_unlock1 = 0x555;
1925 			info->addr_unlock2 = 0x2aa;
1926 
1927 			/*
1928 			 * modify the unlock address if we are
1929 			 * in compatibility mode
1930 			 */
1931 			if (/* x8/x16 in x8 mode */
1932 			    (info->chipwidth == FLASH_CFI_BY8 &&
1933 				info->interface == FLASH_CFI_X8X16) ||
1934 			    /* x16/x32 in x16 mode */
1935 			    (info->chipwidth == FLASH_CFI_BY16 &&
1936 				info->interface == FLASH_CFI_X16X32)) {
1937 				info->addr_unlock1 = 0xaaa;
1938 				info->addr_unlock2 = 0x555;
1939 			}
1940 
1941 			info->name = "CFI conformant";
1942 			return 1;
1943 		}
1944 	}
1945 
1946 	return 0;
1947 }
1948 
1949 static int flash_detect_cfi(flash_info_t *info, struct cfi_qry *qry)
1950 {
1951 	debug("flash detect cfi\n");
1952 
1953 	for (info->portwidth = CONFIG_SYS_FLASH_CFI_WIDTH;
1954 	     info->portwidth <= FLASH_CFI_64BIT; info->portwidth <<= 1) {
1955 		for (info->chipwidth = FLASH_CFI_BY8;
1956 		     info->chipwidth <= info->portwidth;
1957 		     info->chipwidth <<= 1)
1958 			if (__flash_detect_cfi(info, qry))
1959 				return 1;
1960 	}
1961 	debug("not found\n");
1962 	return 0;
1963 }
1964 
1965 /*
1966  * Manufacturer-specific quirks. Add workarounds for geometry
1967  * reversal, etc. here.
1968  */
1969 static void flash_fixup_amd(flash_info_t *info, struct cfi_qry *qry)
1970 {
1971 	/* check if flash geometry needs reversal */
1972 	if (qry->num_erase_regions > 1) {
1973 		/* reverse geometry if top boot part */
1974 		if (info->cfi_version < 0x3131) {
1975 			/* CFI < 1.1, try to guess from device id */
1976 			if ((info->device_id & 0x80) != 0)
1977 				cfi_reverse_geometry(qry);
1978 		} else if (flash_read_uchar(info, info->ext_addr + 0xf) == 3) {
1979 			/* CFI >= 1.1, deduct from top/bottom flag */
1980 			/* note: ext_addr is valid since cfi_version > 0 */
1981 			cfi_reverse_geometry(qry);
1982 		}
1983 	}
1984 }
1985 
1986 static void flash_fixup_atmel(flash_info_t *info, struct cfi_qry *qry)
1987 {
1988 	int reverse_geometry = 0;
1989 
1990 	/* Check the "top boot" bit in the PRI */
1991 	if (info->ext_addr && !(flash_read_uchar(info, info->ext_addr + 6) & 1))
1992 		reverse_geometry = 1;
1993 
1994 	/* AT49BV6416(T) list the erase regions in the wrong order.
1995 	 * However, the device ID is identical with the non-broken
1996 	 * AT49BV642D they differ in the high byte.
1997 	 */
1998 	if (info->device_id == 0xd6 || info->device_id == 0xd2)
1999 		reverse_geometry = !reverse_geometry;
2000 
2001 	if (reverse_geometry)
2002 		cfi_reverse_geometry(qry);
2003 }
2004 
2005 static void flash_fixup_stm(flash_info_t *info, struct cfi_qry *qry)
2006 {
2007 	/* check if flash geometry needs reversal */
2008 	if (qry->num_erase_regions > 1) {
2009 		/* reverse geometry if top boot part */
2010 		if (info->cfi_version < 0x3131) {
2011 			/* CFI < 1.1, guess by device id */
2012 			if (info->device_id == 0x22CA || /* M29W320DT */
2013 			    info->device_id == 0x2256 || /* M29W320ET */
2014 			    info->device_id == 0x22D7) { /* M29W800DT */
2015 				cfi_reverse_geometry(qry);
2016 			}
2017 		} else if (flash_read_uchar(info, info->ext_addr + 0xf) == 3) {
2018 			/* CFI >= 1.1, deduct from top/bottom flag */
2019 			/* note: ext_addr is valid since cfi_version > 0 */
2020 			cfi_reverse_geometry(qry);
2021 		}
2022 	}
2023 }
2024 
2025 static void flash_fixup_sst(flash_info_t *info, struct cfi_qry *qry)
2026 {
2027 	/*
2028 	 * SST, for many recent nor parallel flashes, says they are
2029 	 * CFI-conformant. This is not true, since qry struct.
2030 	 * reports a std. AMD command set (0x0002), while SST allows to
2031 	 * erase two different sector sizes for the same memory.
2032 	 * 64KB sector (SST call it block)  needs 0x30 to be erased.
2033 	 * 4KB  sector (SST call it sector) needs 0x50 to be erased.
2034 	 * Since CFI query detect the 4KB number of sectors, users expects
2035 	 * a sector granularity of 4KB, and it is here set.
2036 	 */
2037 	if (info->device_id == 0x5D23 || /* SST39VF3201B */
2038 	    info->device_id == 0x5C23) { /* SST39VF3202B */
2039 		/* set sector granularity to 4KB */
2040 		info->cmd_erase_sector = 0x50;
2041 	}
2042 }
2043 
2044 static void flash_fixup_num(flash_info_t *info, struct cfi_qry *qry)
2045 {
2046 	/*
2047 	 * The M29EW devices seem to report the CFI information wrong
2048 	 * when it's in 8 bit mode.
2049 	 * There's an app note from Numonyx on this issue.
2050 	 * So adjust the buffer size for M29EW while operating in 8-bit mode
2051 	 */
2052 	if (qry->max_buf_write_size > 0x8 &&
2053 	    info->device_id == 0x7E &&
2054 	    (info->device_id2 == 0x2201 ||
2055 	     info->device_id2 == 0x2301 ||
2056 	     info->device_id2 == 0x2801 ||
2057 	     info->device_id2 == 0x4801)) {
2058 		debug("Adjusted buffer size on Numonyx flash");
2059 		debug(" M29EW family in 8 bit mode\n");
2060 		qry->max_buf_write_size = 0x8;
2061 	}
2062 }
2063 
2064 /*
2065  * The following code cannot be run from FLASH!
2066  *
2067  */
2068 ulong flash_get_size(phys_addr_t base, int banknum)
2069 {
2070 	flash_info_t *info = &flash_info[banknum];
2071 	int i, j;
2072 	flash_sect_t sect_cnt;
2073 	phys_addr_t sector;
2074 	unsigned long tmp;
2075 	int size_ratio;
2076 	uchar num_erase_regions;
2077 	int erase_region_size;
2078 	int erase_region_count;
2079 	struct cfi_qry qry;
2080 	unsigned long max_size;
2081 
2082 	memset(&qry, 0, sizeof(qry));
2083 
2084 	info->ext_addr = 0;
2085 	info->cfi_version = 0;
2086 #ifdef CONFIG_SYS_FLASH_PROTECTION
2087 	info->legacy_unlock = 0;
2088 #endif
2089 
2090 	info->start[0] = (ulong)map_physmem(base, info->portwidth, MAP_NOCACHE);
2091 
2092 	if (flash_detect_cfi(info, &qry)) {
2093 		info->vendor = le16_to_cpu(get_unaligned(&qry.p_id));
2094 		info->ext_addr = le16_to_cpu(get_unaligned(&qry.p_adr));
2095 		num_erase_regions = qry.num_erase_regions;
2096 
2097 		if (info->ext_addr) {
2098 			info->cfi_version = (ushort)flash_read_uchar(info,
2099 						info->ext_addr + 3) << 8;
2100 			info->cfi_version |= (ushort)flash_read_uchar(info,
2101 						info->ext_addr + 4);
2102 		}
2103 
2104 #ifdef DEBUG
2105 		flash_printqry(&qry);
2106 #endif
2107 
2108 		switch (info->vendor) {
2109 		case CFI_CMDSET_INTEL_PROG_REGIONS:
2110 		case CFI_CMDSET_INTEL_STANDARD:
2111 		case CFI_CMDSET_INTEL_EXTENDED:
2112 			cmdset_intel_init(info, &qry);
2113 			break;
2114 		case CFI_CMDSET_AMD_STANDARD:
2115 		case CFI_CMDSET_AMD_EXTENDED:
2116 			cmdset_amd_init(info, &qry);
2117 			break;
2118 		default:
2119 			printf("CFI: Unknown command set 0x%x\n",
2120 			       info->vendor);
2121 			/*
2122 			 * Unfortunately, this means we don't know how
2123 			 * to get the chip back to Read mode. Might
2124 			 * as well try an Intel-style reset...
2125 			 */
2126 			flash_write_cmd(info, 0, 0, FLASH_CMD_RESET);
2127 			return 0;
2128 		}
2129 
2130 		/* Do manufacturer-specific fixups */
2131 		switch (info->manufacturer_id) {
2132 		case 0x0001: /* AMD */
2133 		case 0x0037: /* AMIC */
2134 			flash_fixup_amd(info, &qry);
2135 			break;
2136 		case 0x001f:
2137 			flash_fixup_atmel(info, &qry);
2138 			break;
2139 		case 0x0020:
2140 			flash_fixup_stm(info, &qry);
2141 			break;
2142 		case 0x00bf: /* SST */
2143 			flash_fixup_sst(info, &qry);
2144 			break;
2145 		case 0x0089: /* Numonyx */
2146 			flash_fixup_num(info, &qry);
2147 			break;
2148 		}
2149 
2150 		debug("manufacturer is %d\n", info->vendor);
2151 		debug("manufacturer id is 0x%x\n", info->manufacturer_id);
2152 		debug("device id is 0x%x\n", info->device_id);
2153 		debug("device id2 is 0x%x\n", info->device_id2);
2154 		debug("cfi version is 0x%04x\n", info->cfi_version);
2155 
2156 		size_ratio = info->portwidth / info->chipwidth;
2157 		/* if the chip is x8/x16 reduce the ratio by half */
2158 		if (info->interface == FLASH_CFI_X8X16 &&
2159 		    info->chipwidth == FLASH_CFI_BY8) {
2160 			size_ratio >>= 1;
2161 		}
2162 		debug("size_ratio %d port %d bits chip %d bits\n",
2163 		      size_ratio, info->portwidth << CFI_FLASH_SHIFT_WIDTH,
2164 		      info->chipwidth << CFI_FLASH_SHIFT_WIDTH);
2165 		info->size = 1 << qry.dev_size;
2166 		/* multiply the size by the number of chips */
2167 		info->size *= size_ratio;
2168 		max_size = cfi_flash_bank_size(banknum);
2169 		if (max_size && info->size > max_size) {
2170 			debug("[truncated from %ldMiB]", info->size >> 20);
2171 			info->size = max_size;
2172 		}
2173 		debug("found %d erase regions\n", num_erase_regions);
2174 		sect_cnt = 0;
2175 		sector = base;
2176 		for (i = 0; i < num_erase_regions; i++) {
2177 			if (i > NUM_ERASE_REGIONS) {
2178 				printf("%d erase regions found, only %d used\n",
2179 				       num_erase_regions, NUM_ERASE_REGIONS);
2180 				break;
2181 			}
2182 
2183 			tmp = le32_to_cpu(get_unaligned(
2184 						&qry.erase_region_info[i]));
2185 			debug("erase region %u: 0x%08lx\n", i, tmp);
2186 
2187 			erase_region_count = (tmp & 0xffff) + 1;
2188 			tmp >>= 16;
2189 			erase_region_size =
2190 				(tmp & 0xffff) ? ((tmp & 0xffff) * 256) : 128;
2191 			debug("erase_region_count = %d ", erase_region_count);
2192 			debug("erase_region_size = %d\n", erase_region_size);
2193 			for (j = 0; j < erase_region_count; j++) {
2194 				if (sector - base >= info->size)
2195 					break;
2196 				if (sect_cnt >= CONFIG_SYS_MAX_FLASH_SECT) {
2197 					printf("ERROR: too many flash sectors\n");
2198 					break;
2199 				}
2200 				info->start[sect_cnt] =
2201 					(ulong)map_physmem(sector,
2202 							   info->portwidth,
2203 							   MAP_NOCACHE);
2204 				sector += (erase_region_size * size_ratio);
2205 
2206 				/*
2207 				 * Only read protection status from
2208 				 * supported devices (intel...)
2209 				 */
2210 				switch (info->vendor) {
2211 				case CFI_CMDSET_INTEL_PROG_REGIONS:
2212 				case CFI_CMDSET_INTEL_EXTENDED:
2213 				case CFI_CMDSET_INTEL_STANDARD:
2214 					/*
2215 					 * Set flash to read-id mode. Otherwise
2216 					 * reading protected status is not
2217 					 * guaranteed.
2218 					 */
2219 					flash_write_cmd(info, sect_cnt, 0,
2220 							FLASH_CMD_READ_ID);
2221 					info->protect[sect_cnt] =
2222 						flash_isset(info, sect_cnt,
2223 							    FLASH_OFFSET_PROTECT,
2224 							    FLASH_STATUS_PROTECT);
2225 					flash_write_cmd(info, sect_cnt, 0,
2226 							FLASH_CMD_RESET);
2227 					break;
2228 				case CFI_CMDSET_AMD_EXTENDED:
2229 				case CFI_CMDSET_AMD_STANDARD:
2230 					if (!info->legacy_unlock) {
2231 						/* default: not protected */
2232 						info->protect[sect_cnt] = 0;
2233 						break;
2234 					}
2235 
2236 					/* Read protection (PPB) from sector */
2237 					flash_write_cmd(info, 0, 0,
2238 							info->cmd_reset);
2239 					flash_unlock_seq(info, 0);
2240 					flash_write_cmd(info, 0,
2241 							info->addr_unlock1,
2242 							FLASH_CMD_READ_ID);
2243 					info->protect[sect_cnt] =
2244 						flash_isset(
2245 							info, sect_cnt,
2246 							FLASH_OFFSET_PROTECT,
2247 							FLASH_STATUS_PROTECT);
2248 					break;
2249 				default:
2250 					/* default: not protected */
2251 					info->protect[sect_cnt] = 0;
2252 				}
2253 
2254 				sect_cnt++;
2255 			}
2256 		}
2257 
2258 		info->sector_count = sect_cnt;
2259 		info->buffer_size = 1 << le16_to_cpu(qry.max_buf_write_size);
2260 		tmp = 1 << qry.block_erase_timeout_typ;
2261 		info->erase_blk_tout = tmp *
2262 			(1 << qry.block_erase_timeout_max);
2263 		tmp = (1 << qry.buf_write_timeout_typ) *
2264 			(1 << qry.buf_write_timeout_max);
2265 
2266 		/* round up when converting to ms */
2267 		info->buffer_write_tout = (tmp + 999) / 1000;
2268 		tmp = (1 << qry.word_write_timeout_typ) *
2269 			(1 << qry.word_write_timeout_max);
2270 		/* round up when converting to ms */
2271 		info->write_tout = (tmp + 999) / 1000;
2272 		info->flash_id = FLASH_MAN_CFI;
2273 		if (info->interface == FLASH_CFI_X8X16 &&
2274 		    info->chipwidth == FLASH_CFI_BY8) {
2275 			/* XXX - Need to test on x8/x16 in parallel. */
2276 			info->portwidth >>= 1;
2277 		}
2278 
2279 		flash_write_cmd(info, 0, 0, info->cmd_reset);
2280 	}
2281 
2282 	return (info->size);
2283 }
2284 
2285 #ifdef CONFIG_FLASH_CFI_MTD
2286 void flash_set_verbose(uint v)
2287 {
2288 	flash_verbose = v;
2289 }
2290 #endif
2291 
2292 static void cfi_flash_set_config_reg(u32 base, u16 val)
2293 {
2294 #ifdef CONFIG_SYS_CFI_FLASH_CONFIG_REGS
2295 	/*
2296 	 * Only set this config register if really defined
2297 	 * to a valid value (0xffff is invalid)
2298 	 */
2299 	if (val == 0xffff)
2300 		return;
2301 
2302 	/*
2303 	 * Set configuration register. Data is "encrypted" in the 16 lower
2304 	 * address bits.
2305 	 */
2306 	flash_write16(FLASH_CMD_SETUP, (void *)(base + (val << 1)));
2307 	flash_write16(FLASH_CMD_SET_CR_CONFIRM, (void *)(base + (val << 1)));
2308 
2309 	/*
2310 	 * Finally issue reset-command to bring device back to
2311 	 * read-array mode
2312 	 */
2313 	flash_write16(FLASH_CMD_RESET, (void *)base);
2314 #endif
2315 }
2316 
2317 /*-----------------------------------------------------------------------
2318  */
2319 
2320 static void flash_protect_default(void)
2321 {
2322 #if defined(CONFIG_SYS_FLASH_AUTOPROTECT_LIST)
2323 	int i;
2324 	struct apl_s {
2325 		ulong start;
2326 		ulong size;
2327 	} apl[] = CONFIG_SYS_FLASH_AUTOPROTECT_LIST;
2328 #endif
2329 
2330 	/* Monitor protection ON by default */
2331 #if (CONFIG_SYS_MONITOR_BASE >= CONFIG_SYS_FLASH_BASE) && \
2332 	(!defined(CONFIG_MONITOR_IS_IN_RAM))
2333 	flash_protect(FLAG_PROTECT_SET,
2334 		      CONFIG_SYS_MONITOR_BASE,
2335 		      CONFIG_SYS_MONITOR_BASE + monitor_flash_len  - 1,
2336 		      flash_get_info(CONFIG_SYS_MONITOR_BASE));
2337 #endif
2338 
2339 	/* Environment protection ON by default */
2340 #ifdef CONFIG_ENV_IS_IN_FLASH
2341 	flash_protect(FLAG_PROTECT_SET,
2342 		      CONFIG_ENV_ADDR,
2343 		      CONFIG_ENV_ADDR + CONFIG_ENV_SECT_SIZE - 1,
2344 		      flash_get_info(CONFIG_ENV_ADDR));
2345 #endif
2346 
2347 	/* Redundant environment protection ON by default */
2348 #ifdef CONFIG_ENV_ADDR_REDUND
2349 	flash_protect(FLAG_PROTECT_SET,
2350 		      CONFIG_ENV_ADDR_REDUND,
2351 		      CONFIG_ENV_ADDR_REDUND + CONFIG_ENV_SECT_SIZE - 1,
2352 		      flash_get_info(CONFIG_ENV_ADDR_REDUND));
2353 #endif
2354 
2355 #if defined(CONFIG_SYS_FLASH_AUTOPROTECT_LIST)
2356 	for (i = 0; i < ARRAY_SIZE(apl); i++) {
2357 		debug("autoprotecting from %08lx to %08lx\n",
2358 		      apl[i].start, apl[i].start + apl[i].size - 1);
2359 		flash_protect(FLAG_PROTECT_SET,
2360 			      apl[i].start,
2361 			      apl[i].start + apl[i].size - 1,
2362 			      flash_get_info(apl[i].start));
2363 	}
2364 #endif
2365 }
2366 
2367 unsigned long flash_init(void)
2368 {
2369 	unsigned long size = 0;
2370 	int i;
2371 
2372 #ifdef CONFIG_SYS_FLASH_PROTECTION
2373 	/* read environment from EEPROM */
2374 	char s[64];
2375 
2376 	env_get_f("unlock", s, sizeof(s));
2377 #endif
2378 
2379 #ifdef CONFIG_CFI_FLASH /* for driver model */
2380 	cfi_flash_init_dm();
2381 #endif
2382 
2383 	/* Init: no FLASHes known */
2384 	for (i = 0; i < CONFIG_SYS_MAX_FLASH_BANKS; ++i) {
2385 		flash_info[i].flash_id = FLASH_UNKNOWN;
2386 
2387 		/* Optionally write flash configuration register */
2388 		cfi_flash_set_config_reg(cfi_flash_bank_addr(i),
2389 					 cfi_flash_config_reg(i));
2390 
2391 		if (!flash_detect_legacy(cfi_flash_bank_addr(i), i))
2392 			flash_get_size(cfi_flash_bank_addr(i), i);
2393 		size += flash_info[i].size;
2394 		if (flash_info[i].flash_id == FLASH_UNKNOWN) {
2395 #ifndef CONFIG_SYS_FLASH_QUIET_TEST
2396 			printf("## Unknown flash on Bank %d ", i + 1);
2397 			printf("- Size = 0x%08lx = %ld MB\n",
2398 			       flash_info[i].size,
2399 			       flash_info[i].size >> 20);
2400 #endif /* CONFIG_SYS_FLASH_QUIET_TEST */
2401 		}
2402 #ifdef CONFIG_SYS_FLASH_PROTECTION
2403 		else if (strcmp(s, "yes") == 0) {
2404 			/*
2405 			 * Only the U-Boot image and it's environment
2406 			 * is protected, all other sectors are
2407 			 * unprotected (unlocked) if flash hardware
2408 			 * protection is used (CONFIG_SYS_FLASH_PROTECTION)
2409 			 * and the environment variable "unlock" is
2410 			 * set to "yes".
2411 			 */
2412 			if (flash_info[i].legacy_unlock) {
2413 				int k;
2414 
2415 				/*
2416 				 * Disable legacy_unlock temporarily,
2417 				 * since flash_real_protect would
2418 				 * relock all other sectors again
2419 				 * otherwise.
2420 				 */
2421 				flash_info[i].legacy_unlock = 0;
2422 
2423 				/*
2424 				 * Legacy unlocking (e.g. Intel J3) ->
2425 				 * unlock only one sector. This will
2426 				 * unlock all sectors.
2427 				 */
2428 				flash_real_protect(&flash_info[i], 0, 0);
2429 
2430 				flash_info[i].legacy_unlock = 1;
2431 
2432 				/*
2433 				 * Manually mark other sectors as
2434 				 * unlocked (unprotected)
2435 				 */
2436 				for (k = 1; k < flash_info[i].sector_count; k++)
2437 					flash_info[i].protect[k] = 0;
2438 			} else {
2439 				/*
2440 				 * No legancy unlocking -> unlock all sectors
2441 				 */
2442 				flash_protect(FLAG_PROTECT_CLEAR,
2443 					      flash_info[i].start[0],
2444 					      flash_info[i].start[0]
2445 					      + flash_info[i].size - 1,
2446 					      &flash_info[i]);
2447 			}
2448 		}
2449 #endif /* CONFIG_SYS_FLASH_PROTECTION */
2450 	}
2451 
2452 	flash_protect_default();
2453 #ifdef CONFIG_FLASH_CFI_MTD
2454 	cfi_mtd_init();
2455 #endif
2456 
2457 	return (size);
2458 }
2459 
2460 #ifdef CONFIG_CFI_FLASH /* for driver model */
2461 static int cfi_flash_probe(struct udevice *dev)
2462 {
2463 	const fdt32_t *cell;
2464 	int addrc, sizec;
2465 	int len, idx;
2466 
2467 	addrc = dev_read_addr_cells(dev);
2468 	sizec = dev_read_size_cells(dev);
2469 
2470 	/* decode regs; there may be multiple reg tuples. */
2471 	cell = dev_read_prop(dev, "reg", &len);
2472 	if (!cell)
2473 		return -ENOENT;
2474 	idx = 0;
2475 	len /= sizeof(fdt32_t);
2476 	while (idx < len) {
2477 		phys_addr_t addr;
2478 
2479 		addr = dev_translate_address(dev, cell + idx);
2480 
2481 		flash_info[cfi_flash_num_flash_banks].dev = dev;
2482 		flash_info[cfi_flash_num_flash_banks].base = addr;
2483 		cfi_flash_num_flash_banks++;
2484 
2485 		idx += addrc + sizec;
2486 	}
2487 	gd->bd->bi_flashstart = flash_info[0].base;
2488 
2489 	return 0;
2490 }
2491 
2492 static const struct udevice_id cfi_flash_ids[] = {
2493 	{ .compatible = "cfi-flash" },
2494 	{ .compatible = "jedec-flash" },
2495 	{}
2496 };
2497 
2498 U_BOOT_DRIVER(cfi_flash) = {
2499 	.name	= "cfi_flash",
2500 	.id	= UCLASS_MTD,
2501 	.of_match = cfi_flash_ids,
2502 	.probe = cfi_flash_probe,
2503 };
2504 #endif /* CONFIG_CFI_FLASH */
2505