February 2011 - flashrom - mail.coreboot.org

[PATCH] Bus Pirate buffer management revamp
by Carl-Daniel Hailfinger June 8, 2012

June 8, 2012

Use separate functions for managing the Bus Pirate command/data buffer. Open-coding the buffer management was the first step, now the goal is to make it readable. This is the buffer management part of "Re: [flashrom] [PATCH] Make Bus Pirate init more robust, speed up flashing" The buffer management of the Bus Pirate driver has been revamped to use grow-only buffers with a reasonable initial default size so realloc() will not have to be called in normal operation. A side effect is the ability to switch to a static buffer without major hassle. Handle OOM gracefully. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-buspirate_buffermanagement/flash.h =================================================================== --- flashrom-buspirate_buffermanagement/flash.h (Revision 1184) +++ flashrom-buspirate_buffermanagement/flash.h (Arbeitskopie) @@ -35,6 +35,9 @@ #define ERROR_PTR ((void*)-1) +/* Error codes */ +#define OOM_ERROR -100 + typedef unsigned long chipaddr; int register_shutdown(void (*function) (void *data), void *data); Index: flashrom-buspirate_buffermanagement/buspirate_spi.c =================================================================== --- flashrom-buspirate_buffermanagement/buspirate_spi.c (Revision 1184) +++ flashrom-buspirate_buffermanagement/buspirate_spi.c (Arbeitskopie) @@ -46,6 +46,55 @@ #define sp_flush_incoming(...) 0 #endif +static unsigned char *bp_commbuf = NULL; +static int bp_commbufsize = 0; + +static int buspirate_commbuf_resize(int bufsize) +{ + unsigned char *tmpbuf; + + /* Never shrink. realloc() calls are expensive. */ + if (bufsize <= bp_commbufsize) + return 0; + + tmpbuf = realloc(bp_commbuf, bufsize); + if (!tmpbuf) { + /* This is debatable. Do we really want to free the existing + * buffer or do we want to keep it around, especially if memory + * is already tight? + */ + free(bp_commbuf); + bp_commbuf = NULL; + bp_commbufsize = 0; + msg_perr("Out of memory!\n"); + return OOM_ERROR; + } + + bp_commbuf = tmpbuf; + bp_commbufsize = bufsize; + return 0; +} + +static int buspirate_commbuf_init(int bufsize) +{ + bp_commbuf = malloc(bufsize); + if (!bp_commbuf) { + bp_commbufsize = 0; + msg_perr("Out of memory!\n"); + return OOM_ERROR; + } + + bp_commbufsize = bufsize; + return 0; +} + +static void buspirate_commbuf_shutdown(void) +{ + free(bp_commbuf); + bp_commbuf = NULL; + bp_commbufsize = 0; +} + static int buspirate_sendrecv(unsigned char *buf, unsigned int writecnt, unsigned int readcnt) { int i, ret = 0; @@ -231,6 +280,10 @@ return 1; } + /* Sensible default buffer size. */ + if (buspirate_commbuf_init(16 + 3)) + return OOM_ERROR; + buses_supported = CHIP_BUSTYPE_SPI; spi_controller = SPI_CONTROLLER_BUSPIRATE; @@ -267,6 +320,9 @@ ret = serialport_shutdown(); if (ret) return ret; + + buspirate_commbuf_shutdown(); + msg_pdbg("Bus Pirate shutdown completed.\n"); return 0; @@ -275,55 +331,51 @@ int buspirate_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { - static unsigned char *buf = NULL; int i = 0, ret = 0; if (writecnt > 16 || readcnt > 16 || (readcnt + writecnt) > 16) return SPI_INVALID_LENGTH; /* 3 bytes extra for CS#, len, CS#. */ - buf = realloc(buf, writecnt + readcnt + 3); - if (!buf) { - msg_perr("Out of memory!\n"); - exit(1); // -1 - } + if (buspirate_commbuf_resize(writecnt + readcnt + 3)) + return OOM_ERROR; /* Assert CS# */ - buf[i++] = 0x02; + bp_commbuf[i++] = 0x02; - buf[i++] = 0x10 | (writecnt + readcnt - 1); - memcpy(buf + i, writearr, writecnt); + bp_commbuf[i++] = 0x10 | (writecnt + readcnt - 1); + memcpy(bp_commbuf + i, writearr, writecnt); i += writecnt; - memset(buf + i, 0, readcnt); + memset(bp_commbuf + i, 0, readcnt); i += readcnt; /* De-assert CS# */ - buf[i++] = 0x03; + bp_commbuf[i++] = 0x03; - ret = buspirate_sendrecv(buf, i, i); + ret = buspirate_sendrecv(bp_commbuf, i, i); if (ret) { msg_perr("Bus Pirate communication error!\n"); return SPI_GENERIC_ERROR; } - if (buf[0] != 0x01) { + if (bp_commbuf[0] != 0x01) { msg_perr("Protocol error while lowering CS#!\n"); return SPI_GENERIC_ERROR; } - if (buf[1] != 0x01) { + if (bp_commbuf[1] != 0x01) { msg_perr("Protocol error while reading/writing SPI!\n"); return SPI_GENERIC_ERROR; } - if (buf[i - 1] != 0x01) { + if (bp_commbuf[i - 1] != 0x01) { msg_perr("Protocol error while raising CS#!\n"); return SPI_GENERIC_ERROR; } /* Skip CS#, length, writearr. */ - memcpy(readarr, buf + 2 + writecnt, readcnt); + memcpy(readarr, bp_commbuf + 2 + writecnt, readcnt); return ret; } -- http://www.hailfinger.org/

2 5

[PATCH] Add Winbond SuperI/O detection
by Carl-Daniel Hailfinger May 6, 2012

May 6, 2012

Add Winbond Super I/O detection and hook it up to the generic Super I/O detection framework. Incomplete and untested, but at least it shouldn't break anything. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-winbond_superio_detect/flash.h =================================================================== --- flashrom-winbond_superio_detect/flash.h (Revision 1064) +++ flashrom-winbond_superio_detect/flash.h (Arbeitskopie) @@ -350,6 +350,7 @@ /* board_enable.c */ void w836xx_ext_enter(uint16_t port); void w836xx_ext_leave(uint16_t port); +struct superio probe_superio_winbond(void); uint8_t sio_read(uint16_t port, uint8_t reg); void sio_write(uint16_t port, uint8_t reg, uint8_t data); void sio_mask(uint16_t port, uint8_t reg, uint8_t data, uint8_t mask); @@ -388,7 +389,8 @@ }; extern struct superio superio; #define SUPERIO_VENDOR_NONE 0x0 -#define SUPERIO_VENDOR_ITE 0x1 +#define SUPERIO_VENDOR_WINBOND 0x1 +#define SUPERIO_VENDOR_ITE 0x2 struct pci_dev *pci_dev_find_filter(struct pci_filter filter); struct pci_dev *pci_dev_find_vendorclass(uint16_t vendor, uint16_t class); struct pci_dev *pci_dev_find(uint16_t vendor, uint16_t device); Index: flashrom-winbond_superio_detect/internal.c =================================================================== --- flashrom-winbond_superio_detect/internal.c (Revision 1064) +++ flashrom-winbond_superio_detect/internal.c (Arbeitskopie) @@ -104,12 +104,14 @@ void probe_superio(void) { - superio = probe_superio_ite(); + superio = probe_superio_winbond(); #if 0 - /* Winbond Super I/O code is not yet available. */ + /* ITE probe causes SMSC LPC47N217 to power off the serial UART. */ if (superio.vendor == SUPERIO_VENDOR_NONE) - superio = probe_superio_winbond(); + superio = probe_superio_smsc(); #endif + if (superio.vendor == SUPERIO_VENDOR_NONE) + superio = probe_superio_ite(); } #endif Index: flashrom-winbond_superio_detect/board_enable.c =================================================================== --- flashrom-winbond_superio_detect/board_enable.c (Revision 1064) +++ flashrom-winbond_superio_detect/board_enable.c (Arbeitskopie) @@ -229,22 +229,59 @@ address, but takes no effort to make sure the chip is really a Winbond Super I/O */ -static const struct winbond_chip * winbond_superio_detect(uint16_t base) +uint8_t probe_id_winbond(uint16_t port) { uint8_t chipid; + + w836xx_ext_enter(port); + chipid = sio_read(port, 0x20); + w836xx_ext_leave(port); + + return chipid; +} + +#define WINBOND_SUPERIO_PORT1 0x2e +#define WINBOND_SUPERIO_PORT2 0x4e + +struct superio probe_superio_winbond(void) +{ + struct superio ret = {}; + uint16_t winbond_ports[] = {WINBOND_SUPERIO_PORT1, WINBOND_SUPERIO_PORT2, 0}; + uint16_t *i = winbond_ports; + + ret.vendor = SUPERIO_VENDOR_WINBOND; + for (; *i; i++) { + ret.port = *i; + ret.model = probe_id_winbond(ret.port); + switch (ret.model) { + case WINBOND_W83627HF_ID: + case WINBOND_W83627EHF_ID: + case WINBOND_W83627THF_ID: + msg_pinfo("Found Winbond Super I/O, id %02hx\n", + ret.model); + return ret; + } + } + + /* No good ID found. */ + ret.vendor = SUPERIO_VENDOR_NONE; + ret.port = 0; + ret.model = 0; + return ret; +} + +static const struct winbond_chip *winbond_superio_chipdef(void) +{ const struct winbond_chip * chip = NULL; int i; - w836xx_ext_enter(base); - chipid = sio_read(base, 0x20); for (i = 0; i < ARRAY_SIZE(winbond_chips); i++) - if (winbond_chips[i].device_id == chipid) + if (winbond_chips[i].device_id == superio.model) { chip = &winbond_chips[i]; break; } - w836xx_ext_leave(base); return chip; } @@ -259,7 +296,7 @@ int port = pin / 10; int bit = pin % 10; - chip = winbond_superio_detect(base); + chip = winbond_superio_chipdef(); if (!chip) { msg_perr("\nERROR: No supported Winbond Super I/O found\n"); return -1; -- http://www.hailfinger.org/

2 7

[PATCH] W83697xx superio flash enable
by David Borg May 5, 2012

May 5, 2012

Adds a function to enable the flash interface on w83697xx superio's. Still needs to be hooked up to the superio detection framework though. Signed-off-by: David Borg <borg.db(a)gmail.com>

2 1

ASUS OPLX-M results (no flash device found)
by Ville Skyttä Feb. 17, 2012

Feb. 17, 2012

Hello, I tried out flashrom on a ASUS OPLX-M motherboard, and it didn't find a flash device. I found some info by googling (that I cannot verify) that the OPLX-M would be an OEM (or something) version of the ASUS MEL-M; I suppose this particular board originally came with a Fujitsu/Siemens PC. http://support.asus.com/download/download.aspx?modelname=MEL-M&SLanguage=en…

3 4

Re: [flashrom] Trial of ARIMA:HDAMA Motherboard
by Carl-Daniel Hailfinger Feb. 9, 2012

Feb. 9, 2012

Hi Mike, On 23.02.2010 05:45, Spangler, Mike T wrote: > I can probe with a continuity tester, but would need to know specific > pin locations to try. Do you have any generic info on doing this? Yes (well, I'd have to write up something), but the solution mentioned by Michael is way easier, so I'll wait until Michael has diagnosed the GPIO settings from the flashrom run on factory BIOS. Regards, Carl-Daniel -- "I do consider assignment statements and pointer variables to be among computer science's most valuable treasures." -- Donald E. Knuth

2 1

[PATCH] dummy programmer: blacklist SPI commands
by Carl-Daniel Hailfinger Feb. 8, 2012

Feb. 8, 2012

Add optional SPI command blacklisting to the flash chip emulator in the dummy programmer. Usage: flashrom -p dummy:spi_blacklist=hexstring If hexstring is 0302, flashrom will blacklist command 0x03 (READ) and command 0x02 (WRITE). The hexstring can have up to 521 bytes (256 commands) length, and must not start with 0x. TODO: Should 0x at the beginning of hexstring be tolerated? Very useful for testing corner cases if you don't own a locked down Intel chipset and want to simulate such a thing. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-emulate_spi_flashchip_command_blacklist/dummyflasher.c =================================================================== --- flashrom-emulate_spi_flashchip_command_blacklist/dummyflasher.c (Revision 1224) +++ flashrom-emulate_spi_flashchip_command_blacklist/dummyflasher.c (Arbeitskopie) @@ -19,6 +19,7 @@ #include <string.h> #include <stdlib.h> +#include <stdio.h> #include <ctype.h> #include "flash.h" #include "chipdrivers.h" @@ -56,6 +57,8 @@ static int emu_jedec_be_d8_size = 0; static int emu_jedec_ce_60_size = 0; static int emu_jedec_ce_c7_size = 0; +unsigned char spi_blacklist[256]; +int spi_blacklist_size = 0; #endif #endif @@ -71,6 +74,7 @@ { char *bustext = NULL; char *tmp = NULL; + int i; #if EMULATE_CHIP struct stat image_stat; #endif @@ -116,6 +120,31 @@ } } + tmp = extract_programmer_param("spi_blacklist"); + if (tmp) { + i = strlen(tmp); + if (i % 2) { + msg_perr("Invalid SPI command blacklist\n"); + free(tmp); + return 1; + } + tolower_string(tmp); + if (strspn(tmp, "0123456789abcdef") != i) { + msg_perr("Invalid SPI command blacklist\n"); + free(tmp); + return 1; + } + spi_blacklist_size = i / 2; + for (i = 0; i < spi_blacklist_size; i++) { + sscanf(tmp, "%2hhx", &spi_blacklist[i]); + } + msg_pdbg("SPI blacklist is "); + for (i = 0; i < spi_blacklist_size; i++) + msg_pdbg("%02x ", spi_blacklist[i]); + msg_pdbg(", size %i\n", spi_blacklist_size); + } + free(tmp); + #if EMULATE_CHIP tmp = extract_programmer_param("emulate"); if (!tmp) { @@ -285,7 +314,7 @@ static int emulate_spi_chip_response(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { - int offs; + int offs, i; static int aai_offs; static int aai_active = 0; @@ -293,7 +322,16 @@ msg_perr("No command sent to the chip!\n"); return 1; } - /* TODO: Implement command blacklists here. */ + for (i = 0; i < spi_blacklist_size; i++) { + if (writearr[0] == spi_blacklist[i]) { + msg_perr("Refusing blacklisted SPI command 0x%02x\n", + spi_blacklist[i]); + /* FIXME: Do we want a separate return code for + * command unavailable? + */ + return 1; + } + } switch (writearr[0]) { case JEDEC_RES: if (emu_chip != EMULATE_ST_M25P10_RES) -- http://www.hailfinger.org/

3 7

AMD SB7xx/SB8xx w/IMC: enable specs
by Joshua Roys Jan. 3, 2012

Jan. 3, 2012

Hello all, The specific board this is for is the Supermicro H8DGT. Attached is only the specification, which is not guaranteed to be correct. Use with care. Also, after using this, you may want to turn off and unplug the computer for a few minutes to restore the correct operational state. The AMD SB700/710/750 Register Reference Guide (#43009) was used as a reference. Thanks, Josh

2 2

[PATCH] Implement unknown Dediprog commands
by Carl-Daniel Hailfinger Dec. 20, 2011

Dec. 20, 2011

Secret knowledge is cool, but public knowledge is better. Implement all Dediprog commands found in USB traces, even if their purpose is not yet known. Annotate unknown commands with info about the call sequence they are embedded in and the firmware version of the log. Add a new shutdown command for firmware 5.x. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-dediprog_unknown_commands/dediprog.c =================================================================== --- flashrom-dediprog_unknown_commands/dediprog.c (Revision 1232) +++ flashrom-dediprog_unknown_commands/dediprog.c (Arbeitskopie) @@ -27,6 +27,7 @@ #define DEFAULT_TIMEOUT 3000 static usb_dev_handle *dediprog_handle; +static int dediprog_firmwareversion; #if 0 /* Might be useful for other pieces of code as well. */ @@ -228,6 +229,7 @@ fw[1], fw[2]); return 1; } + dediprog_firmwareversion = fw[0]; return 0; } @@ -253,6 +255,32 @@ return 0; } +#if 0 +/* Something. + * Present in eng_detect_blink.log with firmware 3.1.8 + * Always preceded by Command Receive Device String + */ +static int dediprog_command_b(void) +{ + int ret; + char buf[0x3]; + + memset(buf, 0, sizeof(buf)); + ret = usb_control_msg(dediprog_handle, 0xc3, 0x7, 0x0, 0xef00, buf, 0x3, DEFAULT_TIMEOUT); + if (ret < 0) { + msg_perr("Command B failed (%s)!\n", usb_strerror()); + return 1; + } + if ((ret != 0x3) || (buf[0] != 0xff) || (buf[1] != 0xff) || + (buf[2] != 0xff)) { + msg_perr("Unexpected response to Command B!\n"); + return 1; + } + + return 0; +} +#endif + /* Command C is only sent after dediprog_check_devicestring, but not after every * invocation of dediprog_check_devicestring. It is only sent after the first * dediprog_command_a(); dediprog_check_devicestring() sequence in each session. @@ -264,7 +292,7 @@ ret = usb_control_msg(dediprog_handle, 0x42, 0x4, 0x0, 0x0, NULL, 0x0, DEFAULT_TIMEOUT); if (ret != 0x0) { - msg_perr("Unexpected response to Command C!\n"); + msg_perr("Command C failed (%s)!\n", usb_strerror()); return 1; } return 0; @@ -274,6 +302,7 @@ /* Very strange. Seems to be a programmer keepalive or somesuch. * Wait unsuccessfully for timeout ms to read one byte. * Is usually called after setting voltage to 0. + * Present in all logs with Firmware 2.1.1 and 3.1.8 */ static int dediprog_command_f(int timeout) { @@ -282,14 +311,90 @@ memset(buf, 0, sizeof(buf)); ret = usb_control_msg(dediprog_handle, 0xc2, 0x11, 0xff, 0xff, buf, 0x1, timeout); + /* This check is most probably wrong. Command F always causes a timeout + * in the logs, so we should check for timeout instead of checking for + * success. + */ + if (ret != 0x1) { + msg_perr("Command F failed (%s)!\n", usb_strerror()); + return 1; + } + return 0; +} + +/* Start/stop blinking? + * Present in eng_detect_blink.log with firmware 3.1.8 + * Preceded by Command J + */ +static int dediprog_command_g(void) +{ + int ret; + + ret = usb_control_msg(dediprog_handle, 0x42, 0x07, 0x09, 0x03, NULL, 0x0, DEFAULT_TIMEOUT); if (ret != 0x0) { - msg_perr("Unexpected response to Command F!\n"); + msg_perr("Command G failed (%s)!\n", usb_strerror()); return 1; } return 0; } + +/* Something. + * Present in all logs with firmware 5.1.5 + * Always preceded by Command Receive Device String + * Always followed by Command Set SPI Voltage nonzero + */ +static int dediprog_command_h(void) +{ + int ret; + + ret = usb_control_msg(dediprog_handle, 0x42, 0x07, 0x09, 0x05, NULL, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Command H failed (%s)!\n", usb_strerror()); + return 1; + } + return 0; +} #endif +/* Shutdown for firmware 5.x? + * Present in all logs with firmware 5.1.5 + * Often preceded by a SPI operation (Command Read SPI Bulk or Receive SPI) + * Always followed by Command Set SPI Voltage 0x0000 + */ +static int dediprog_command_i(void) +{ + int ret; + + ret = usb_control_msg(dediprog_handle, 0x42, 0x07, 0x09, 0x06, NULL, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Command I failed (%s)!\n", usb_strerror()); + return 1; + } + return 0; +} + +#if 0 +/* Start/stop blinking? + * Present in all logs with firmware 5.1.5 + * Always preceded by Command Receive Device String on 5.1.5 + * Always followed by Command Set SPI Voltage nonzero on 5.1.5 + * Present in eng_detect_blink.log with firmware 3.1.8 + * Preceded by Command B in eng_detect_blink.log + * Followed by Command G in eng_detect_blink.log + */ +static int dediprog_command_j(void) +{ + int ret; + + ret = usb_control_msg(dediprog_handle, 0x42, 0x07, 0x09, 0x07, NULL, 0x0, DEFAULT_TIMEOUT); + if (ret != 0x0) { + msg_perr("Command J failed (%s)!\n", usb_strerror()); + return 1; + } + return 0; +} +#endif + static int parse_voltage(char *voltage) { char *tmp = NULL; @@ -445,9 +550,11 @@ /* URB 136 is just URB 9. */ /* URB 137 is just URB 11. */ - /* Command I is probably Start Bulk Read. Data is u16 blockcount, u16 blocksize. */ - /* Command J is probably Start Bulk Write. Data is u16 blockcount, u16 blocksize. */ - /* Bulk transfer sizes for Command I/J are always 512 bytes, rest is filled with 0xff. */ + /* Command Start Bulk Read. Data is u16 blockcount, u16 blocksize. */ + /* Command Start Bulk Write. Data is u16 blockcount, u16 blocksize. */ + /* Bulk transfer sizes for Command Start Bulk Read/Write are always + * 512 bytes, rest is filled with 0xff. + */ return 0; } @@ -457,6 +564,10 @@ { msg_pspew("%s\n", __func__); + /* Shutdown on firmware 5.x */ + if (dediprog_firmwareversion == 5) + if (dediprog_command_i()) + return 1; /* URB 28. Command Set SPI Voltage to 0. */ if (dediprog_set_spi_voltage(0x0)) return 1; -- http://www.hailfinger.org/

2 2

[PATCH] Fintek SPI driver, based off it87spi
by Sean Nelson Oct. 22, 2011

Oct. 22, 2011

I've been extremely busy with preparing for the US Air Force, which I leave for Basic on November 2nd. But... Fintek SPI Flashrom Driver: * based off of it87spi.c * untested * should be good for F71882 and F71889 Signed-off-by: Sean Nelson <audiohacked(a)gmail.com>

2 3

Success report flashrom v0.9.1-r946 on motherboard ASUS M4A89GTD PRO
by Christian Kropfreiter Oct. 20, 2011

Oct. 20, 2011

2 2