flashrom November 2010

flashrom@flashrom.org

58 participants
146 discussions

[commit] r1236 - trunk
by repository service 24 Nov '10

24 Nov '10

Author: hailfinger Date: Thu Nov 25 00:37:22 2010 New Revision: 1236 URL: http://flashrom.org/trac/flashrom/changeset/1236 Log: Dump all VIA SPI registers like for ICH7. Handle BBAR on VIA. Handle SPI lockdown on VIA. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Rudolf Marek <r.marek(a)assembler.cz> Modified: trunk/ichspi.c Modified: trunk/ichspi.c ============================================================================== --- trunk/ichspi.c Tue Nov 23 22:28:16 2010 (r1235) +++ trunk/ichspi.c Thu Nov 25 00:37:22 2010 (r1236) @@ -407,24 +407,36 @@ */ void ich_set_bbar(uint32_t minaddr) { +#define BBAR_MASK 0x00ffff00 + minaddr &= BBAR_MASK; switch (spi_controller) { case SPI_CONTROLLER_ICH7: - mmio_writel(minaddr, ich_spibar + 0x50); + case SPI_CONTROLLER_VIA: + ichspi_bbar = mmio_readl(ich_spibar + 0x50) & ~BBAR_MASK; + if (ichspi_bbar) + msg_pdbg("Reserved bits in BBAR not zero: 0x%04x", + ichspi_bbar); + ichspi_bbar |= minaddr; + mmio_writel(ichspi_bbar, ich_spibar + 0x50); ichspi_bbar = mmio_readl(ich_spibar + 0x50); /* We don't have any option except complaining. */ if (ichspi_bbar != minaddr) msg_perr("Setting BBAR failed!\n"); break; case SPI_CONTROLLER_ICH9: - mmio_writel(minaddr, ich_spibar + 0xA0); + ichspi_bbar = mmio_readl(ich_spibar + 0xA0) & ~BBAR_MASK; + if (ichspi_bbar) + msg_pdbg("Reserved bits in BBAR not zero: 0x%04x", + ichspi_bbar); + ichspi_bbar |= minaddr; + mmio_writel(ichspi_bbar, ich_spibar + 0xA0); ichspi_bbar = mmio_readl(ich_spibar + 0xA0); /* We don't have any option except complaining. */ if (ichspi_bbar != minaddr) msg_perr("Setting BBAR failed!\n"); break; default: - /* Not sure if BBAR actually exists on VIA. */ - msg_pdbg("Setting BBAR is not implemented for VIA yet.\n"); + msg_perr("Unknown chipset for BBAR setting!\n"); break; } } @@ -833,6 +845,7 @@ (writearr[2] << 8) | (writearr[3] << 0); switch (spi_controller) { case SPI_CONTROLLER_ICH7: + case SPI_CONTROLLER_VIA: case SPI_CONTROLLER_ICH9: if (addr < ichspi_bbar) { msg_perr("%s: Address 0x%06x below allowed " @@ -1116,17 +1129,46 @@ int via_init_spi(struct pci_dev *dev) { uint32_t mmio_base; + int i; mmio_base = (pci_read_long(dev, 0xbc)) << 8; msg_pdbg("MMIO base at = 0x%x\n", mmio_base); ich_spibar = physmap("VT8237S MMIO registers", mmio_base, 0x70); - msg_pdbg("0x6c: 0x%04x (CLOCK/DEBUG)\n", - mmio_readw(ich_spibar + 0x6c)); - /* Not sure if it speaks all these bus protocols. */ buses_supported = CHIP_BUSTYPE_LPC | CHIP_BUSTYPE_FWH | CHIP_BUSTYPE_SPI; spi_controller = SPI_CONTROLLER_VIA; + + msg_pdbg("0x00: 0x%04x (SPIS)\n", mmio_readw(ich_spibar + 0)); + msg_pdbg("0x02: 0x%04x (SPIC)\n", mmio_readw(ich_spibar + 2)); + msg_pdbg("0x04: 0x%08x (SPIA)\n", mmio_readl(ich_spibar + 4)); + for (i = 0; i < 2; i++) { + int offs; + offs = 8 + (i * 8); + msg_pdbg("0x%02x: 0x%08x (SPID%d)\n", offs, + mmio_readl(ich_spibar + offs), i); + msg_pdbg("0x%02x: 0x%08x (SPID%d+4)\n", offs + 4, + mmio_readl(ich_spibar + offs + 4), i); + } + ichspi_bbar = mmio_readl(ich_spibar + 0x50); + msg_pdbg("0x50: 0x%08x (BBAR)\n", ichspi_bbar); + msg_pdbg("0x54: 0x%04x (PREOP)\n", mmio_readw(ich_spibar + 0x54)); + msg_pdbg("0x56: 0x%04x (OPTYPE)\n", mmio_readw(ich_spibar + 0x56)); + msg_pdbg("0x58: 0x%08x (OPMENU)\n", mmio_readl(ich_spibar + 0x58)); + msg_pdbg("0x5c: 0x%08x (OPMENU+4)\n", mmio_readl(ich_spibar + 0x5c)); + for (i = 0; i < 3; i++) { + int offs; + offs = 0x60 + (i * 4); + msg_pdbg("0x%02x: 0x%08x (PBR%d)\n", offs, + mmio_readl(ich_spibar + offs), i); + } + msg_pdbg("0x6c: 0x%04x (CLOCK/DEBUG)\n", + mmio_readw(ich_spibar + 0x6c)); + if (mmio_readw(ich_spibar) & (1 << 15)) { + msg_pinfo("WARNING: SPI Configuration Lockdown activated.\n"); + ichspi_lock = 1; + } + ich_init_opcodes(); return 0;

1 0

Re: [flashrom] Mysterious MAC-Address Changes after BIOS-Upgrade with flashrom
by Peter Daum 24 Nov '10

24 Nov '10

--- David Hendricks <dhendrix(a)google.com> schrieb am Mi, 24.11.2010: > The "00:19:66:97:d7:e2" you're seeing can be encoded in numerous ways and > probably omits the ':' character. It may also be in a compressed portion > of the image. ... actually, I already know the position, where the bios stores the MAC address. Unfortunately, it does not work to just change the address in the bios image and write the changed image back: - In the image file that is provided by the vendor, these bytes just contain ff:ff:ff:ff:ff:ff (without ":") - When I flash the bios using the AMI tool, reboot and then compare the actual bios contents with the file, those bytes have been overwritten with the machine's MAC address (+ many other changes) - When I flash the same image using flashroom, the MAC address is sometimes unchanged, sometimes changed to 00:19:66:97:d7:e2; in any case, the corresponding position in the bios also contains the MAC address again. - My attempts to change the MAC address on file and then flash it always ended with "00:19:66:97:d7:e2", no matter which address I used - When I take a complete bios image from another machine and flash it, the machine gets the MAC address from the machine the bios image originally came from

1 0

Mysterious MAC-Address Changes after BIOS-Upgrade with flashrom
by Peter Daum 24 Nov '10

24 Nov '10

Hi, I have a whole bunch of machines with identical main boards (ASRock G43Twins FullHD, AMI BIOS) and am trying to upgrade the firmware using flashrom. At first sight everything looks fine (see the protocol attached below). Unfortunately, after some tests, I noted a pretty mysterious phenomenon: In many cases, after the next reboot the machines network interfaces have a different MAC-address -even worse, they all have _the same_ MAC address (00:19:66:97:d7:e2). I tried it in many variations, but could not really detect any system - even under identical circumstances this problem seems occurs very often, but not always. If I restore the original ROM contents (after I noticed the problem, I always saved the original firmware) the machines always get their original MAC address back (but of course also the buggy bios that I am trying to upgrade). The ROM contents of the machines do contain their MAC addresses at a certain offset but in the vendor supplied BIOS image that I flash has all bits set to 1 in this and several other (obviously data) areas, the mysterious "default" MAC address "00:19:66:97:d7:e2" does not occur in this file. When I flash the file under DOS using afudos.exe ("AMI firmware update utility 4.14"), the machines will keep their original MAC address.(As I just noticed, that program also has an option to explicitly set the MAC address). Does anybody have an idea, what is going on here? (As I said, the phenomenon does not even seem to be deterministic). Maybe even an idea, how to do the upgrade using flashrom? (The machines are integrated in some Linux-based management system, so using flashrom I could do the upgrade automatic; except for the problem with the duplicated MAC addresses everything seems to work just fine after flashing the BIOS with flashrom). Regards, Peter - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - flashrom v0.9.2-r1141 on Linux 2.6.32-5-686 (i686), built with libpci 3.1.7, GCC 4.4.5 20100728 (prerelease), little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. No coreboot table found. Found chipset "Intel ICH10", enabling flash write... OK. This chipset supports the following protocols: FWH,SPI. Found chip "Macronix MX25L8005" (1024 KB, SPI) at physical address 0xfff00000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Erasing flash before programming... Erasing flash chip... spi_block_erase_20 failed during command execution at address 0x0 spi_block_erase_52 failed during command execution at address 0x0 SUCCESS. done. Programming flash... done. COMPLETE. Verifying flash... VERIFIED.

2 1

RFC: Unit testing framework
by David Hendricks 23 Nov '10

23 Nov '10

Hi, Once upon a time, testing flashrom was simple: Read, erase, write, verify, done. Over the past few months, we've introduced some very important features to Flashrom. Unfortunately, testing is no longer quite so simple. Partial writes require that we test various patterns (and we do with a newly introduced torture script), and we do that to some extend with the torture test that we recently checked in. Embedded controllers introduce a whole other world of pain. Long story short, a better testing strategy is needed. To get the ball rolling, I have a work-in-progress patch for the Chromium.org branch of Flashrom right now to introduce a unit testing framework and would appreciate thoughts / comments: http://codereview.chromium.org/5136001 . You can download the unified diff from there (as to avoid duplication here). It's written in shell script (tested on dash and bash) since I felt that's the lowest common denominator and the lowest barrier-to-entry for folks wanting to add/modify the tests. Feel free to post comments in this thread, since the code review will be closed once the code is checked in. The idea is simple: One master script does generic setup, backs up the firmware image, runs unit tests, and unconditionally restores the firmware image at the end. The user sets a few (hopefully no more than two or three) environment variables and runs the master script, specifying desired unit tests as arguments on the command line. Each unit test should be independent, and should have its own documentation in case it needs special environment variables or something. Due to the variety of tests which may be performed, it's up to the user to decide which tests to run on their hardware. If you're curious to try the patch, here is a simple invocation that will test partial writes for an x86 BIOS chip: ./do_tests.sh partial_writes_x86_bios.sh I've attached some sample console output for a test run that does partial writes for x86 BIOS chip and some write protection commands. In this example, I had to pass in some env variables and specify multiple tests as arguments. The invocation: FLASHROM="../flashrom" FLASHROM_PARAM="-p internal:bus=spi" sh do_tests.sh partial_writes_x86_bios.sh chip_size.sh wp-toggle.sh wp-range.sh If I were to test some EC stuff, I'd need to add additional parameters since my EC test script requires a special layout file and an secondary EC firmware image: LAYOUT_FILE=/tmp/ec_layout.txt ALT_EC_IMAGE=/tmp/alt_ec_image.bin FLASHROM="../flashrom" FLASHROM_PARAM="-p internal:bus=lpc" ./do_tests.sh partial_writes_ec.sh -- David Hendricks (dhendrix) Systems Software Engineer, Google Inc.

3 5

[PATCH] Faster Dediprog writes
by Carl-Daniel Hailfinger 23 Nov '10

23 Nov '10

Implementing bulk write for max speed on the Dediprog will require some traces of the SPI bus. Add chunked write ability to the Dediprog SF100 driver. The chunk size is guessed, you can try to raise it up to 256, but please check that write works without corruption. The chunk size may also depend on the firmware version. 12 should be a safe bet, and if everything else fails, reduce the chunk size to 1 (old behaviour). Please note that the write speedup only applies to chips which have SPI page write (i.e. chips using spi_chip_write_256). Tests appreciated. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-dediprog_write_chunked/dediprog.c =================================================================== --- flashrom-dediprog_write_chunked/dediprog.c (Revision 1234) +++ flashrom-dediprog_write_chunked/dediprog.c (Arbeitskopie) @@ -238,6 +238,12 @@ return 0; } +int dediprog_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + /* No idea about the real limit. Maybe 12, maybe more, maybe less. */ + return spi_write_chunked(flash, buf, start, len, 12); +} + int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { Index: flashrom-dediprog_write_chunked/spi.c =================================================================== --- flashrom-dediprog_write_chunked/spi.c (Revision 1234) +++ flashrom-dediprog_write_chunked/spi.c (Arbeitskopie) @@ -124,7 +124,7 @@ .command = dediprog_spi_send_command, .multicommand = default_spi_send_multicommand, .read = dediprog_spi_read, - .write_256 = spi_chip_write_1, + .write_256 = dediprog_spi_write_256, }, #endif Index: flashrom-dediprog_write_chunked/programmer.h =================================================================== --- flashrom-dediprog_write_chunked/programmer.h (Revision 1234) +++ flashrom-dediprog_write_chunked/programmer.h (Arbeitskopie) @@ -472,6 +472,7 @@ int dediprog_shutdown(void); int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr); int dediprog_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +int dediprog_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len); /* flashrom.c */ struct decode_sizes { -- http://www.hailfinger.org/

4 5

[commit] r1235 - trunk
by repository service 23 Nov '10

23 Nov '10

Author: hailfinger Date: Tue Nov 23 22:28:16 2010 New Revision: 1235 URL: http://flashrom.org/trac/flashrom/changeset/1235 Log: Add chunked write ability to the Dediprog SF100 driver. Please note that the write speedup only applies to chips which have SPI page write (i.e. chips using spi_chip_write_256). This is a quick fix for write speed until I get around to implementing full bulk SPI write support. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Richard A. Smith <richard(a)laptop.org> Acked-by: Mathias Krause <mathias.krause(a)secunet.com> Modified: trunk/dediprog.c trunk/programmer.h trunk/spi.c Modified: trunk/dediprog.c ============================================================================== --- trunk/dediprog.c Tue Nov 16 22:25:29 2010 (r1234) +++ trunk/dediprog.c Tue Nov 23 22:28:16 2010 (r1235) @@ -238,6 +238,12 @@ return 0; } +int dediprog_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + /* No idea about the real limit. Maybe 12, maybe more, maybe less. */ + return spi_write_chunked(flash, buf, start, len, 12); +} + int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr) { @@ -245,7 +251,7 @@ msg_pspew("%s, writecnt=%i, readcnt=%i\n", __func__, writecnt, readcnt); /* Paranoid, but I don't want to be blamed if anything explodes. */ - if (writecnt > 5) { + if (writecnt > 16) { msg_perr("Untested writecnt=%i, aborting.\n", writecnt); return 1; } Modified: trunk/programmer.h ============================================================================== --- trunk/programmer.h Tue Nov 16 22:25:29 2010 (r1234) +++ trunk/programmer.h Tue Nov 23 22:28:16 2010 (r1235) @@ -472,6 +472,7 @@ int dediprog_shutdown(void); int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr); int dediprog_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +int dediprog_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len); /* flashrom.c */ struct decode_sizes { Modified: trunk/spi.c ============================================================================== --- trunk/spi.c Tue Nov 16 22:25:29 2010 (r1234) +++ trunk/spi.c Tue Nov 23 22:28:16 2010 (r1235) @@ -124,7 +124,7 @@ .command = dediprog_spi_send_command, .multicommand = default_spi_send_multicommand, .read = dediprog_spi_read, - .write_256 = spi_chip_write_1, + .write_256 = dediprog_spi_write_256, }, #endif

1 0

Radix for layout ranges
by David Hendricks 23 Nov '10

23 Nov '10

Hi, I just noticed (read: hit an issue) that ranges specified in layout files are always assumed to be hex. From layout.c: rom_entries[romimages].start = strtol(tstr1, (char **)NULL, 16); rom_entries[romimages].end = strtol(tstr2, (char **)NULL, 16); Is there a specific reason base 16 is used? Should we just leave it at "0" and let strtol decide, depending on the prefix (0x for hex, dec otherwise)? The reason I bring this up is because I am working with testing scripts that generate ranges on the fly. It's an extra step to convert values to hex (printf %x $value?) and I want to reduce dependency on external programs / maximize portability. If this sounds reasonable, the patch attached simply changes the radix used by strtol to "0" do dec is chosen if there is no prefix and hex is chosen if the number is prefixed with 0x. Signed-off-by: David Hendricks <dhedndrix(a)google.com> -- David Hendricks (dhendrix) Systems Software Engineer, Google Inc.

3 3

Shuttle xpc sg31
by Salve Håkedal 23 Nov '10

23 Nov '10

Hi I installed flashrom today from flashrom-0.9.2.tar.bz2 on Debian Lenny. Can I ask if this seems OK? Do you think it will be safe to flash my bios? # flashrom -V flashrom v0.9.2-r1001 on Linux 2.6.26-2-686 (i686), built with libpci 3.0.0, GCC 4.3.2 flashrom is free software, get the source code at http://www.flashrom.org Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "Shuttle Inc" DMI string system-product-name: "SG31" DMI string system-version: "V10" DMI string baseboard-manufacturer: "Shuttle Inc" DMI string baseboard-product-name: "FG31" DMI string baseboard-version: "V10" DMI string chassis-type: "Desktop" Found ITE Super I/O, id 8718 Found chipset "Intel ICH7/ICH7R", enabling flash write... 0xfff80000/0xffb80000 FWH IDSEL: 0x0 0xfff00000/0xffb00000 FWH IDSEL: 0x0 0xffe80000/0xffa80000 FWH IDSEL: 0x1 0xffe00000/0xffa00000 FWH IDSEL: 0x1 0xffd80000/0xff980000 FWH IDSEL: 0x2 0xffd00000/0xff900000 FWH IDSEL: 0x2 0xffc80000/0xff880000 FWH IDSEL: 0x3 0xffc00000/0xff800000 FWH IDSEL: 0x3 0xff700000/0xff300000 FWH IDSEL: 0x4 0xff600000/0xff200000 FWH IDSEL: 0x5 0xff500000/0xff100000 FWH IDSEL: 0x6 0xff400000/0xff000000 FWH IDSEL: 0x7 0xfff80000/0xffb80000 FWH decode enabled 0xfff00000/0xffb00000 FWH decode enabled 0xffe80000/0xffa80000 FWH decode disabled 0xffe00000/0xffa00000 FWH decode disabled 0xffd80000/0xff980000 FWH decode disabled 0xffd00000/0xff900000 FWH decode disabled 0xffc80000/0xff880000 FWH decode disabled 0xffc00000/0xff800000 FWH decode disabled 0xff700000/0xff300000 FWH decode disabled 0xff600000/0xff200000 FWH decode disabled 0xff500000/0xff100000 FWH decode disabled 0xff400000/0xff000000 FWH decode disabled Maximum FWH chip size: 0x100000 bytes BIOS Lock Enable: disabled, BIOS Write Enable: enabled, BIOS_CNTL is 0x1 Root Complex Register Block address = 0xfed1c000 GCS = 0x40c64: BIOS Interface Lock-Down: disabled, BOOT BIOS Straps: 0x3 (LPC) Top Swap : not enabled OK. This chipset supports the following protocols: FWH. No IT87* serial flash segment enabled. Calibrating delay loop... 2306M loops per second, 10 myus = 10 us, 100 myus = 100 us, 1000 myus = 991 us, 10000 myus = 9938 us, OK. Probing for AMD Am29F010A/B, 128 KB: skipped. Probing for AMD Am29F002(N)BB, 256 KB: skipped. Probing for AMD Am29F002(N)BT, 256 KB: skipped. Probing for AMD Am29F016D, 2048 KB: skipped. Probing for AMD Am29F040B, 512 KB: skipped. Probing for AMD Am29F080B, 1024 KB: skipped. Probing for AMD Am29LV040B, 512 KB: skipped. Probing for AMD Am29LV081B, 1024 KB: skipped. Probing for ASD AE49F2008, 256 KB: skipped. Probing for Atmel AT25DF021, 256 KB: skipped. Probing for Atmel AT25DF041A, 512 KB: skipped. Probing for Atmel AT25DF081, 1024 KB: skipped. Probing for Atmel AT25DF161, 2048 KB: skipped. Probing for Atmel AT25DF321, 4096 KB: skipped. Probing for Atmel AT25DF321A, 4096 KB: skipped. Probing for Atmel AT25DF641, 8192 KB: skipped. Probing for Atmel AT25F512B, 64 KB: skipped. Probing for Atmel AT25FS010, 128 KB: skipped. Probing for Atmel AT25FS040, 512 KB: skipped. Probing for Atmel AT26DF041, 512 KB: skipped. Probing for Atmel AT26DF081A, 1024 KB: skipped. Probing for Atmel AT26DF161, 2048 KB: skipped. Probing for Atmel AT26DF161A, 2048 KB: skipped. Probing for Atmel AT26F004, 512 KB: skipped. Probing for Atmel AT29C512, 64 KB: skipped. Probing for Atmel AT29C010A, 128 KB: skipped. Probing for Atmel AT29C020, 256 KB: skipped. Probing for Atmel AT29C040A, 512 KB: skipped. Probing for Atmel AT45CS1282, 16896 KB: skipped. Probing for Atmel AT45DB011D, 128 KB: skipped. Probing for Atmel AT45DB021D, 256 KB: skipped. Probing for Atmel AT45DB041D, 512 KB: skipped. Probing for Atmel AT45DB081D, 1024 KB: skipped. Probing for Atmel AT45DB161D, 2048 KB: skipped. Probing for Atmel AT45DB321C, 4224 KB: skipped. Probing for Atmel AT45DB321D, 4096 KB: skipped. Probing for Atmel AT45DB642D, 8192 KB: skipped. Probing for Atmel AT49BV512, 64 KB: skipped. Probing for Atmel AT49F002(N), 256 KB: skipped. Probing for Atmel AT49F002(N)T, 256 KB: skipped. Probing for AMIC A25L40PT, 512 KB: skipped. Probing for AMIC A25L40PU, 512 KB: skipped. Probing for AMIC A29002B, 256 KB: skipped. Probing for AMIC A29002T, 256 KB: skipped. Probing for AMIC A29040B, 512 KB: skipped. Probing for AMIC A49LF040A, 512 KB: skipped. Probing for EMST F49B002UA, 256 KB: skipped. Probing for Eon EN25B05, 64 KB: skipped. Probing for Eon EN25B05T, 64 KB: skipped. Probing for Eon EN25B10, 128 KB: skipped. Probing for Eon EN25B10T, 128 KB: skipped. Probing for Eon EN25B20, 256 KB: skipped. Probing for Eon EN25B20T, 256 KB: skipped. Probing for Eon EN25B40, 512 KB: skipped. Probing for Eon EN25B40T, 512 KB: skipped. Probing for Eon EN25B80, 1024 KB: skipped. Probing for Eon EN25B80T, 1024 KB: skipped. Probing for Eon EN25B16, 2048 KB: skipped. Probing for Eon EN25B16T, 2048 KB: skipped. Probing for Eon EN25B32, 4096 KB: skipped. Probing for Eon EN25B32T, 4096 KB: skipped. Probing for Eon EN25B64, 8192 KB: skipped. Probing for Eon EN25B64T, 8192 KB: skipped. Probing for Eon EN25D16, 2048 KB: skipped. Probing for Eon EN25F05, 64 KB: skipped. Probing for Eon EN25F10, 128 KB: skipped. Probing for Eon EN25F20, 256 KB: skipped. Probing for Eon EN25F40, 512 KB: skipped. Probing for Eon EN25F80, 1024 KB: skipped. Probing for Eon EN25F16, 2048 KB: skipped. Probing for Eon EN25F32, 4096 KB: skipped. Probing for Eon EN29F010, 128 KB: skipped. Probing for EON EN29F002(A)(N)B, 256 KB: skipped. Probing for EON EN29F002(A)(N)T, 256 KB: skipped. Probing for Fujitsu MBM29F004BC, 512 KB: skipped. Probing for Fujitsu MBM29F004TC, 512 KB: skipped. Probing for Fujitsu MBM29F400BC, 512 KB: skipped. Probing for Fujitsu MBM29F400TC, 512 KB: skipped. Probing for Intel 28F001BX-B, 128 KB: skipped. Probing for Intel 28F001BX-T, 128 KB: skipped. Probing for Intel 28F004S5, 512 KB: skipped. Probing for Intel 28F004BV/BE-B, 512 KB: skipped. Probing for Intel 28F004BV/BE-T, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-B, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-T, 512 KB: skipped. Probing for Intel 82802AB, 512 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Intel 82802AC, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Macronix MX25L512, 64 KB: skipped. Probing for Macronix MX25L1005, 128 KB: skipped. Probing for Macronix MX25L2005, 256 KB: skipped. Probing for Macronix MX25L4005, 512 KB: skipped. Probing for Macronix MX25L8005, 1024 KB: skipped. Probing for Macronix MX25L1605, 2048 KB: skipped. Probing for Macronix MX25L1635D, 2048 KB: skipped. Probing for Macronix MX25L3205, 4096 KB: skipped. Probing for Macronix MX25L3235D, 4096 KB: skipped. Probing for Macronix MX25L6405, 8192 KB: skipped. Probing for Macronix MX25L12805, 16384 KB: skipped. Probing for Macronix MX29F001B, 128 KB: skipped. Probing for Macronix MX29F001T, 128 KB: skipped. Probing for Macronix MX29F002B, 256 KB: skipped. Probing for Macronix MX29F002T, 256 KB: skipped. Probing for Macronix MX29LV040, 512 KB: skipped. Probing for Numonyx M25PE10, 128 KB: skipped. Probing for Numonyx M25PE20, 256 KB: skipped. Probing for Numonyx M25PE40, 512 KB: skipped. Probing for Numonyx M25PE80, 1024 KB: skipped. Probing for Numonyx M25PE16, 2048 KB: skipped. Probing for PMC Pm25LV010, 128 KB: skipped. Probing for PMC Pm25LV016B, 2048 KB: skipped. Probing for PMC Pm25LV020, 256 KB: skipped. Probing for PMC Pm25LV040, 512 KB: skipped. Probing for PMC Pm25LV080B, 1024 KB: skipped. Probing for PMC Pm25LV512, 64 KB: skipped. Probing for PMC Pm29F002T, 256 KB: skipped. Probing for PMC Pm29F002B, 256 KB: skipped. Probing for PMC Pm39LV010, 128 KB: skipped. Probing for PMC Pm39LV020, 256 KB: skipped. Probing for PMC Pm39LV040, 512 KB: skipped. Probing for PMC Pm49FL002, 256 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for PMC Pm49FL004, 512 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for Sanyo LF25FW203A, 2048 KB: skipped. Probing for Sharp LHF00L04, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for Spansion S25FL008A, 1024 KB: skipped. Probing for Spansion S25FL016A, 2048 KB: skipped. Probing for SST SST25VF016B, 2048 KB: skipped. Probing for SST SST25VF032B, 4096 KB: skipped. Probing for SST SST25VF040.REMS, 512 KB: skipped. Probing for SST SST25VF040B, 512 KB: skipped. Probing for SST SST25VF040B.REMS, 512 KB: skipped. Probing for SST SST25VF080B, 1024 KB: skipped. Probing for SST SST28SF040A, 512 KB: skipped. Probing for SST SST29EE010, 128 KB: skipped. Probing for SST SST29LE010, 128 KB: skipped. Probing for SST SST29EE020A, 256 KB: skipped. Probing for SST SST29LE020, 256 KB: skipped. Probing for SST SST39SF512, 64 KB: skipped. Probing for SST SST39SF010A, 128 KB: skipped. Probing for SST SST39SF020A, 256 KB: skipped. Probing for SST SST39SF040, 512 KB: skipped. Probing for SST SST39VF512, 64 KB: skipped. Probing for SST SST39VF010, 128 KB: skipped. Probing for SST SST39VF020, 256 KB: skipped. Probing for SST SST39VF040, 512 KB: skipped. Probing for SST SST39VF080, 1024 KB: skipped. Probing for SST SST49LF002A/B, 256 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for SST SST49LF003A/B, 384 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for SST SST49LF004A/B, 512 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for SST SST49LF004C, 512 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF008A, 1024 KB: probe_jedec_common: id1 0xbf, id2 0x5a Found chip "SST SST49LF008A" (1024 KB, FWH) at physical address 0xfff00000. Lock status for 0x000000 (size 0x010000) is 01, write locked Lock status for 0x010000 (size 0x010000) is 01, write locked Lock status for 0x020000 (size 0x010000) is 01, write locked Lock status for 0x030000 (size 0x010000) is 01, write locked Lock status for 0x040000 (size 0x010000) is 01, write locked Lock status for 0x050000 (size 0x010000) is 01, write locked Lock status for 0x060000 (size 0x010000) is 01, write locked Lock status for 0x070000 (size 0x010000) is 01, write locked Lock status for 0x080000 (size 0x010000) is 01, write locked Lock status for 0x090000 (size 0x010000) is 01, write locked Lock status for 0x0a0000 (size 0x010000) is 01, write locked Lock status for 0x0b0000 (size 0x010000) is 01, write locked Lock status for 0x0c0000 (size 0x010000) is 01, write locked Lock status for 0x0d0000 (size 0x010000) is 01, write locked Lock status for 0x0e0000 (size 0x010000) is 01, write locked Lock status for 0x0f0000 (size 0x010000) is 01, write locked Probing for SST SST49LF008C, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF016C, 2048 KB: Chip size 2048 kB is bigger than supported size 1024 kB of chipset/board/programmer for FWH interface, probe/read/erase/write may fail. probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF020, 256 KB: skipped. Probing for SST SST49LF020A, 256 KB: skipped. Probing for SST SST49LF040, 512 KB: skipped. Probing for SST SST49LF040B, 512 KB: skipped. Probing for SST SST49LF080A, 1024 KB: skipped. Probing for SST SST49LF160C, 2048 KB: skipped. Probing for ST M25P05-A, 64 KB: skipped. Probing for ST M25P05.RES, 64 KB: skipped. Probing for ST M25P10-A, 128 KB: skipped. Probing for ST M25P10.RES, 128 KB: skipped. Probing for ST M25P20, 256 KB: skipped. Probing for ST M25P40, 512 KB: skipped. Probing for ST M25P40-old, 512 KB: skipped. Probing for ST M25P80, 1024 KB: skipped. Probing for ST M25P16, 2048 KB: skipped. Probing for ST M25P32, 4096 KB: skipped. Probing for ST M25P64, 8192 KB: skipped. Probing for ST M25P128, 16384 KB: skipped. Probing for ST M29F002B, 256 KB: skipped. Probing for ST M29F002T/NT, 256 KB: skipped. Probing for ST M29F040B, 512 KB: skipped. Probing for ST M29F400BT, 512 KB: skipped. Probing for ST M29W010B, 128 KB: skipped. Probing for ST M29W040B, 512 KB: skipped. Probing for ST M29W512B, 64 KB: skipped. Probing for ST M50FLW040A, 512 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW016, 2048 KB: Chip size 2048 kB is bigger than supported size 1024 kB of chipset/board/programmer for FWH interface, probe/read/erase/write may fail. probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW040, 512 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW080, 1024 KB: probe_82802ab: id1 0x49, id2 0x4d, id1 is normal flash content, id2 is normal flash content Probing for ST M50LPW116, 2048 KB: skipped. Probing for SyncMOS S29C31004T, 512 KB: skipped. Probing for SyncMOS S29C51001T, 128 KB: skipped. Probing for SyncMOS S29C51002T, 256 KB: skipped. Probing for SyncMOS S29C51004T, 512 KB: skipped. Probing for TI TMS29F002RB, 256 KB: skipped. Probing for TI TMS29F002RT, 256 KB: skipped. Probing for Winbond W25Q80, 1024 KB: skipped. Probing for Winbond W25Q16, 2048 KB: skipped. Probing for Winbond W25Q32, 4096 KB: skipped. Probing for Winbond W25x10, 128 KB: skipped. Probing for Winbond W25x20, 256 KB: skipped. Probing for Winbond W25x40, 512 KB: skipped. Probing for Winbond W25x80, 1024 KB: skipped. Probing for Winbond W25x16, 2048 KB: skipped. Probing for Winbond W25x32, 4096 KB: skipped. Probing for Winbond W25x64, 8192 KB: skipped. Probing for Winbond W29C011, 128 KB: skipped. Probing for Winbond W29C020C, 256 KB: skipped. Probing for Winbond W29C040P, 512 KB: skipped. Probing for Winbond W29EE011, 128 KB: skipped. Probing for Winbond W39V040A, 512 KB: skipped. Probing for Winbond W39V040B, 512 KB: skipped. Probing for Winbond W39V040C, 512 KB: skipped. Probing for Winbond W39V040FA, 512 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for Winbond W39V080A, 1024 KB: skipped. Probing for Winbond W49F002U, 256 KB: skipped. Probing for Winbond W49V002A, 256 KB: skipped. Probing for Winbond W49V002FA, 256 KB: probe_jedec_common: id1 0xbf, id2 0x5a Probing for Winbond W39V080FA, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xbf, id2 0x5a Probing for Winbond W39V080FA (dual mode), 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xbf, id2 0x5a Probing for Atmel unknown Atmel SPI chip, 0 KB: skipped. Probing for EON unknown EON SPI chip, 0 KB: skipped. Probing for Macronix unknown Macronix SPI chip, 0 KB: skipped. Probing for PMC unknown PMC SPI chip, 0 KB: skipped. Probing for SST unknown SST SPI chip, 0 KB: skipped. Probing for ST unknown ST SPI chip, 0 KB: skipped. Probing for Sanyo unknown Sanyo SPI chip, 0 KB: skipped. Probing for Generic unknown SPI chip (RDID), 0 KB: skipped. Probing for Generic unknown SPI chip (REMS), 0 KB: skipped. === This flash part has status UNTESTED for operations: ERASE The test status of this chip may have been updated in the latest development version of flashrom. If you are running the latest development version, please email a report to flashrom(a)flashrom.org if any of the above operations work correctly for you with this flash part. Please include the flashrom output with the additional -V option for all operations you tested (-V, -Vr, -Vw, -VE), and mention which mainboard or programmer you tested. Thanks for your help! === No operations were specified.

1 0

[PATCH] Merge the EC drivers from the chromium tree
by Carl-Daniel Hailfinger 22 Nov '10

22 Nov '10

The following patch was obtained from a locally modified http://git.chromium.org/git/flashrom with git diff 20636ae6fc4ac1e61b3a89ddc5f6e059034d8660 and then removing all hunks unrelated to ECs and by cleaning up the Nuvoton code to use proper flashrom interfaces. On top of this I forward ported the code to current flashrom svn HEAD. No signoff because this patch is an amalgamation of ITE code, Nuvoton code, Google code, and my code. The git history has the individual signoffs except for my changes. This needs to be split into code specific to each EC family, and then one patch for each EC needs to be submitted with proper signoff. The IT85 code is mostly ready, and might even work. It _will_ break all boards which use IT87 flash translation. Once that is fixed (a few lines in internal.c), the IT85 code might even be mergeable. The WPCE775x code is not ready yet, and it is not even hooked up. That said, I believe that this patch may be interesting for people who want EC support in mainline flashrom and who are willing to review the code. Index: flashrom-ec_it87_wpce775x/wpce775x.c =================================================================== --- flashrom-ec_it87_wpce775x/wpce775x.c (Revision 0) +++ flashrom-ec_it87_wpce775x/wpce775x.c (Revision 0) @@ -0,0 +1,689 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2010 Google, Inc. + * Copyright (C) 2010 Carl-Daniel Hailfinger + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * Neither the name of Nuvoton Technology Corporation. or the names of + * contributors or licensors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * This software is provided "AS IS," without a warranty of any kind. + * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, + * INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A + * PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY EXCLUDED. + * NUVOTON TECHNOLOGY CORPORATION. ("NUVOTON") AND ITS LICENSORS SHALL NOT BE LIABLE + * FOR ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING + * OR DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES. IN NO EVENT WILL + * SUN OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE, PROFIT OR DATA, + * OR FOR DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL OR + * PUNITIVE DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF + * LIABILITY, ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE, + * EVEN IF SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + * + * This is an UNOFFICIAL patch for the Nuvoton WPCE775x/NPCE781x. It was tested + * for a specific hardware and firmware configuration and should be considered + * unreliable. Please see the following URL for Nuvoton's authoritative, + * officially supported flash update utility: + * http://sourceforge.net/projects/nuvflashupdate/ + */ + +#include <assert.h> +#include <string.h> +#include <sys/time.h> +#include <time.h> +#include <unistd.h> +#include "flash.h" +#include "chipdrivers.h" +#include "flashchips.h" +#include "programmer.h" +#include "spi.h" + +/** + * Definition of WPCE775X WCB (Write Command Buffer), as known as Shared Access + * Window 2. + * + * The document name is "WPCE775X Software User Guide Revision 1.2". + * + * Assume the host is little endian. + */ +__attribute__((packed)) +struct wpce775x_wcb { + /* Byte 0: semaphore byte */ + unsigned char exe:1; /* Bit0-RW- set by host. means wcb is ready to execute. + should be cleared by host after RDY=1. */ + unsigned char resv0_41:4; + unsigned char pcp:1; /* Bit5-RO- set by EPCE775x. means preparation operations for + flash update process is complete. */ + unsigned char err:1; /* Bit6-RO- set by EPCE775x. means an error occurs. */ + unsigned char rdy:1; /* Bit7-RO- set by EPCE775x. means operation is completed. */ + + /* Byte 1-2: reserved */ + unsigned char byte1; + unsigned char byte2; + + /* Byte 3: command code */ + unsigned char code; + + /* Byte 4-15: command field */ + unsigned char field[12]; +}; + +/* The physical address of WCB -- Shared Access Window 2. */ +static chipaddr wcb_physical_address; + +/* The virtual address of WCB -- Shared Access Window 2. */ +static volatile struct wpce775x_wcb *volatile wcb; + +/* count of entering flash update mode */ +static int in_flash_update_mode; + +/* Indicate the flash chip attached to the WPCE7xxx chip. + * This variable should be set in probe_wpce775x(). + * 0 means we haven't or cannot detect the chip type. */ +struct flashchip *scan = 0; + +/* SuperI/O related definitions and functions. */ +/* Strapping options */ +#define NUVOTON_SIO_PORT1 0x2e /* No pull-down resistor */ +#define NUVOTON_SIO_PORT2 0x164e /* Pull-down resistor on BADDR0 */ +/* Note: There's another funky state that we won't worry about right now */ + +/* SuperI/O Config */ +#define NUVOTON_SIOCFG_LDN 0x07 /* LDN Bank Selector */ +#define NUVOTON_SIOCFG_SID 0x20 /* SuperI/O ID */ +#define NUVOTON_SIOCFG_SRID 0x27 /* SuperI/O Revision ID */ +#define NUVOTON_LDN_SHM 0x0f /* LDN of SHM module */ + +/* WPCE775x shared memory config registers (LDN 0x0f) */ +#define WPCE775X_SHM_BASE_MSB 0x60 +#define WPCE775X_SHM_BASE_LSB 0x61 +#define WPCE775X_SHM_CFG 0xf0 +#define WPCE775X_SHM_CFG_BIOS_FWH_EN (1 << 3) +#define WPCE775X_SHM_CFG_FLASH_ACC_EN (1 << 2) +#define WPCE775X_SHM_CFG_BIOS_EXT_EN (1 << 1) +#define WPCE775X_SHM_CFG_BIOS_LPC_EN (1 << 0) +#define WPCE775X_WIN_CFG 0xf1 /* window config */ +#define WPCE775X_WIN_CFG_SHWIN_ACC (1 << 6) + +/* Shared access window 2 bar address registers */ +#define WPCE775X_SHAW2BA_0 0xf8 +#define WPCE775X_SHAW2BA_1 0xf9 +#define WPCE775X_SHAW2BA_2 0xfa +#define WPCE775X_SHAW2BA_3 0xfb + +/** probe for super i/o index + * @returns 0 to indicate success, <0 to indicate error + */ +static int nuvoton_get_sio_index(uint16_t *port) +{ + uint16_t ports[] = { NUVOTON_SIO_PORT2, + NUVOTON_SIO_PORT1, + }; + int i; + static uint16_t port_internal, port_found = 0; + + if (port_found) { + *port = port_internal; + return 0; + } + + get_io_perms(); + + for (i = 0; i < ARRAY_SIZE(ports); i++) { + uint8_t sid = sio_read(ports[i], NUVOTON_SIOCFG_SID); + + if (sid == 0xfc) { /* Family ID */ + port_internal = ports[i]; + port_found = 1; + break; + } + } + + if (!port_found) { + msg_cdbg("\nfailed to obtain super i/o index"); + return -1; + } + + msg_cdbg("\nsuper i/o index = 0x%04x\n", port_internal); + *port = port_internal; + return 0; +} + +/** Call superio to get pre-configured WCB address. + * Read LDN 0x0f (SHM) idx:f8-fb (little-endian). + */ +static int get_shaw2ba(chipaddr *shaw2ba, uint8_t *comm_fwh) +{ + uint16_t idx; + uint8_t org_ldn; + uint8_t win_cfg; + uint8_t shm_cfg; + int ret = 0; + + if (nuvoton_get_sio_index(&idx) < 0) + return -1; + + org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); + sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); + + /* + * To obtain shared access window 2 base address, we must OR the base + * address bytes, where SHAW2BA_0 is least significant and SHAW2BA_3 + * most significant. + */ + *shaw2ba = sio_read(idx, WPCE775X_SHAW2BA_0) | + (sio_read(idx, WPCE775X_SHAW2BA_1) << 8) | + (sio_read(idx, WPCE775X_SHAW2BA_2) << 16) | + (sio_read(idx, WPCE775X_SHAW2BA_3) << 24); + + /* + * If SHWIN_ACC is cleared, then we're using LPC memory access + * and SHAW2BA_3-0 indicate bits 31-0. If SHWIN_ACC is set, then + * bits 7-4 of SHAW2BA_3 are ignored and bits 31-28 are indicated + * by the idsel nibble. (See table 25 "supported host address ranges" + * for more details) + */ + win_cfg = sio_read(idx, WPCE775X_WIN_CFG); + if (win_cfg & WPCE775X_WIN_CFG_SHWIN_ACC) { + /* Make sure shared BIOS memory is enabled */ + shm_cfg = sio_read(idx, WPCE775X_SHM_CFG); + if (!(shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) { + msg_cdbg("Shared BIOS memory is diabled.\n"); + msg_cdbg("Please check SHM_CFG:BIOS_FWH_EN.\n"); + ret = -1; + goto out; + } + /* FIXME: Check that this is a FWH capable chipset. */ + *comm_fwh = 1; + /* Check if bit 24-27 are set. Intel ICH will never issue any + * LPC firmware memory (FWH) cycles with them cleared. + * FWH cycles only have 28 address bits. + */ + if ((*shaw2ba & (0xf << 24)) != 0xf << 24) { + msg_cerr("WPCE775X shadow window 2 is outside the " + "region addressable with FWH!\n"); + ret = -1; + goto out; + } + /* FWH cycles are only issued for memory mapped to the top + * 16 MB of the 4 GB address space. We could set only the top + * 4 bits since those are ignored by the WPCE775X and we checked + * bits 24-27 to be 0xf above, but setting the top 8 bits makes + * the 16 MB constraint more clear. + */ + *shaw2ba |= 0xff << 24; + } else { + *comm_fwh = 0; + } + +out: + sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); + return ret; +} + +/* Call superio to get pre-configured fwh_id. + * Read LDN 0x0f (SHM) idx:f0. + */ +static int get_fwh_id(uint8_t *fwh_id) +{ + uint16_t idx; + uint8_t org_ldn; + + if (nuvoton_get_sio_index(&idx) < 0) + return -1; + + org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); + sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); + /* Upper 4 bits of WPCE775X_SHM_CFG store the FWH ID. */ + *fwh_id = sio_read(idx, WPCE775X_SHM_CFG) >> 4; + sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); + + return 0; +} + +/** helper function to make sure the exe bit is 0 (no one is using EC). + * @return 1 for error; 0 for success. + */ +static int assert_ec_is_free(void) +{ + if (wcb->exe) + msg_perr("ASSERT(wcb->exe==0), entering busy loop.\n"); + while(wcb->exe); + return 0; +} + +/** Trigger EXE bit, and block until operation completes. + * @return 1 for error; and 0 for success. + */ +static int blocked_exec(void) +{ + struct timeval begin, now; + int timeout; /* not zero if timeout occurs */ + int err; + + assert(wcb->rdy==0); + + /* raise EXE bit, and wait for operation complete or error occur. */ + wcb->exe = 1; + + timeout = 0; + gettimeofday(&begin, NULL); + while(wcb->rdy==0 && wcb->err==0) { + gettimeofday(&now, NULL); + /* According to Nuvoton's suggestion, few seconds is enough for + * longest flash operation, which is erase. + * Cutted from W25X16 datasheet, for max operation time + * Byte program tBP1 50us + * Page program tPP 3ms + * Sector Erase (4KB) tSE 200ms + * Block Erase (64KB) tBE 1s + * Chip Erase tCE 20s + * Since WPCE775x doesn't support chip erase, + * 3 secs is long enough for block erase. + */ + if ((now.tv_sec - begin.tv_sec) >= 4) { + timeout += 1; + break; + } + } + + /* keep ERR bit before clearing EXE bit. */ + err = wcb->err; + + /* Clear EXE bit, and wait for RDY back to 0. */ + wcb->exe = 0; + gettimeofday(&begin, NULL); + while(wcb->rdy) { + gettimeofday(&now, NULL); + /* 1 sec should be long enough for clearing rdy bit. */ + if (((now.tv_sec - begin.tv_sec)*1000*1000 + + (now.tv_usec - begin.tv_usec)) >= 1000*1000) { + timeout += 1; + break; + } + } + + if (err || timeout) { + msg_cdbg("err=%d timeout=%d\n", err, timeout); + return 1; + } + return 0; +} + +/** Initialize the EC parameters. + * @return 1 for error; 0 for success. + */ +static int InitFlash(unsigned char srp) +{ + assert_ec_is_free(); + + /* Byte 3: command code: Init Flash */ + wcb->code = 0x5A; + + /* Byte 4: opcode for Read Device Id */ + wcb->field[0] = JEDEC_RDID; + + /* Byte 5: opcode for Write Status Enable + JEDEC_EWSR defines 0x50, but W25Q16 + accepts JEDEC_WREN to enable write status */ + wcb->field[1] = JEDEC_WREN; + + /* Byte 6: opcode for Write Enable */ + wcb->field[2] = JEDEC_WREN; + + /* Byte 7: opcode for Read Status Register */ + wcb->field[3] = JEDEC_RDSR; + + /* Byte 8: opcode for Write Status Register */ + wcb->field[4] = JEDEC_WRSR; + + /* Byte 9: opcode for Flash Program */ + wcb->field[5] = JEDEC_BYTE_PROGRAM; + + /* Byte A: opcode for Sector or Block Erase. 0xD8: Block Erase (64KB), 0x20: Sector Erase (4KB) */ + /* TODO: dhendrix: We may need a more sophisticated routine to determine the proper values on a chip-by-chip basis in the future. */ + wcb->field[6] = JEDEC_SE; + + /* Byte B: status busy mask */ + wcb->field[7] = 0x01; + + /* Byte C: Status Register Value */ + wcb->field[8] = srp; /* SRP (Status Register Protect), {TB, BP2, BP1, BP0} = {1, 0, 1, 1} */ + + /* Byte D: Program Unit Size */ + wcb->field[9] = 0x01; + + /* Byte E: Page Size, 2^X bytes */ + wcb->field[10] = 0x08; + + /* Byte F: Read Device ID Type. 0x47 -- send 3 dummy addresses before read ID from flash */ + wcb->field[11] = 0x00; + + if (blocked_exec()) + return 1; + return 0; +} + +/** Read flash vendor/device IDs through EC. + * @param readarr 4-byte buffer for JEDEC_RDID response. + * @return 1 for error; 0 for success. + */ +static int ReadId(unsigned char *readarr) +{ + assert_ec_is_free(); + + wcb->code = 0xC0; /* Byte 3: command code: Read ID */ + if (blocked_exec()) + return 1; + + readarr[0] = wcb->field[0]; + readarr[1] = wcb->field[1]; + readarr[2] = wcb->field[2]; + readarr[3] = wcb->field[3]; + + return 0; +} + +/** probe if WPCE775x is present. + * @return 1 for error; 0 for success + */ +int wpce775x_init(void) +{ + uint16_t sio_port; + uint8_t srid; + uint8_t fwh_id; + uint8_t comm_fwh = 0; + + /* detect if wpce775x exists */ + if (nuvoton_get_sio_index(&sio_port) < 0) { + msg_cdbg("No Nuvoton chip is found.\n"); + /* No chip found is not an error. */ + return 0; + } + srid = sio_read(sio_port, NUVOTON_SIOCFG_SRID); + if ((srid & 0xE0) == 0xA0) { + msg_pdbg("Found EC: WPCE775x (Vendor:0x%02x,ID:0x%02x,Rev:0x%02x) on sio_port:0x%x.\n", + sio_read(sio_port, NUVOTON_SIOCFG_SID), + srid >> 5, srid & 0x1f, sio_port); + + } else { + msg_pdbg("Found EC: Nuvoton (Vendor:0x%02x,ID:0x%02x,Rev:0x%02x) on sio_port:0x%x.\n", + sio_read(sio_port, NUVOTON_SIOCFG_SID), + srid >> 5, srid & 0x1f, sio_port); + } + + /* get the address of Shadow Window 2. */ + if (get_shaw2ba(&wcb_physical_address, &comm_fwh) < 0) { + msg_cdbg("Cannot get the address of Shadow Window 2"); + return 1; + } + msg_cdbg("Get the address of WCB(SHA WIN2) at 0x%08x\n", + (uint32_t)wcb_physical_address); + + /* If we use FWH for Shadow Window 2, we have to set FWH IDSEL in the + * chipset before we try to access Shadow Window 2. + */ + if (comm_fwh) { + if (get_fwh_id(&fwh_id) < 0) { + msg_cdbg("Cannot get fwh_id value.\n"); + return 1; + } + msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); + + /* TODO: set fwh_idsel of chipset. + * Currently, we employ "-p internal:fwh_idsel=0x0000223e". + */ + } + + wcb = (struct wpce775x_wcb *)physmap("WPCE775X WCB", + wcb_physical_address, + getpagesize() /* min page size */); + msg_cdbg("mapped wcb address: %p for physical addr: 0x%08lx\n", wcb, wcb_physical_address); + if (!wcb) { + msg_perr("FATAL! Cannot map memory area for wcb physical address.\n"); + return 1; + } + memset((void*)wcb, 0, sizeof(*wcb)); + + /* Initialize the parameters of EC SHM component */ + if (InitFlash(0x00)) + return 1; + + if (buses_supported & CHIP_BUSTYPE_SPI) + msg_pdbg("Overriding chipset SPI with WPCE775x SPI.\n"); + spi_controller = SPI_CONTROLLER_WPCE775XX; + buses_supported |= CHIP_BUSTYPE_SPI; + return 0; +} + +/** Tell EC to "enter flash update" mode. */ +static int EnterFlashUpdate(void) +{ + if (in_flash_update_mode) { + /* already in update mode */ + in_flash_update_mode++; + return 0; + } + + wcb->code = 0x10; /* Enter Flash Update */ + wcb->field[0] = 0x55; /* required pattern by EC */ + wcb->field[1] = 0xAA; /* required pattern by EC */ + wcb->field[2] = 0xCD; /* required pattern by EC */ + wcb->field[3] = 0xBE; /* required pattern by EC */ + if (blocked_exec()) { + return 1; + } else { + in_flash_update_mode++; + return 0; + } +} + +/** Tell EC to "exit flash update" mode. + * Without calling this function, the EC stays in busy-loop and will not + * response further request from host, which means system will halt. + */ +static int ExitFlashUpdate(unsigned char exit_code) +{ + if (in_flash_update_mode <= 0) { + msg_cdbg("Not in flash update mode yet.\n"); + return 1; + } + + if (in_flash_update_mode >= 2) { + in_flash_update_mode--; + return 0; + } + + wcb->code = exit_code; /* Exit Flash Update */ + if (blocked_exec()) { + return 1; + } else { + in_flash_update_mode--; + return 0; + } +} + +/* + * Note: The EC firmware this patch has been tested with uses the following + * codes to indicate flash update status: + * 0x20 is used for EC F/W no change, but BIOS changed (in Share mode) + * 0x21 is used for EC F/W changed. Goto EC F/W, wait system reboot. + * 0x22 is used for EC F/W changed, Goto EC Watchdog reset. */ +static int ExitFlashUpdateFirmwareNoChange(void) { + return ExitFlashUpdate(0x20); +} + +static int ExitFlashUpdateFirmwareChanged(void) { + return ExitFlashUpdate(0x21); +} + +static int wpce775x_set_write_window(unsigned int base, unsigned int size) +{ + assert_ec_is_free(); + + /* Set Write Window on flash chip (optional). + * You may limit the window to partial flash for experimental. */ + wcb->code = 0xC5; /* Set Write Window */ + wcb->field[0] = base & 0xff; /* window base: little-endian */ + wcb->field[1] = (base >> 8) & 0xff; + wcb->field[2] = (base >> 16) & 0xff; + wcb->field[3] = (base >> 24) & 0xff; + wcb->field[4] = size & 0xff; /* window length: little-endian */ + wcb->field[5] = (size >> 8) & 0xff; + wcb->field[6] = (size >> 16) & 0xff; + wcb->field[7] = (size >> 24) & 0xff; + if (blocked_exec()) + return 1; + return 0; +} + +static int handle_erase_wpce775x(unsigned int blockaddr) +{ + /* FIXME: A 2 MByte window is too small. */ + if (wpce775x_set_write_window(0x0, 0x200000)) + return 1; + + assert_ec_is_free(); + + if (EnterFlashUpdate()) + return 1; + + wcb->code = 0x80; /* Sector/block erase */ + /* WARNING: assume the block address for EC is always little-endian. */ + wcb->field[0] = blockaddr & 0xff; + wcb->field[1] = (blockaddr >> 8) & 0xff; + wcb->field[2] = (blockaddr >> 16) & 0xff; + wcb->field[3] = (blockaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; + + if (ExitFlashUpdateFirmwareChanged()) + return 1; + + return 0; + +error_exit: + ExitFlashUpdateFirmwareChanged(); + return 1; +} + +/** + * Page write helper + */ +static int write_wpce775x_entry(unsigned long writeaddr, unsigned long writelen, const unsigned char *buf) +{ + if (writelen > 8) { + msg_perr("WTF did you call %s with writelen=%li\n", __func__, writelen); + return 1; + } + + /* FIXME: assert_ec_is_free() missing? */ + if (EnterFlashUpdate()) + return 1; + + /* wpce775x provides a 8-byte program buffer. */ + wcb->code = 0xA0; /* Set Address */ + wcb->field[0] = writeaddr & 0xff; + wcb->field[1] = (writeaddr >> 8) & 0xff; + wcb->field[2] = (writeaddr >> 16) & 0xff; + wcb->field[3] = (writeaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; + + /* 8 is maximum buffer size */ + wcb->code = 0xB0 | writelen; + int i; + for (i = 0; i < writelen; i++) { + wcb->field[i] = buf[i]; + } + if (blocked_exec()) + goto error_exit; + + if (ExitFlashUpdateFirmwareChanged()) return 1; + return 0; + +error_exit: + ExitFlashUpdateFirmwareChanged(); + return 1; +} + +static int wpce775x_wrsr(const unsigned char status) { + /* InitFlash (with particular status value), and EnterFlashUpdate() then + * ExitFlashUpdate() immediately. Thus, the flash status register will + * be updated. */ + if (InitFlash(status)) + return -1; + if (EnterFlashUpdate()) return 1; + ExitFlashUpdateFirmwareNoChange(); + + return 0; +} + +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr) +{ + unsigned char ids[4]; + unsigned int addr = 0; + + /* Ugly hack. Not my fault. -- Carl-Daniel */ + switch(writearr[0]) { + case JEDEC_RDID: + /* We always read 4 ID bytes. Return only the wanted parts. */ + if (ReadId(ids)) + return 1; + memcpy(readarr, ids, min(readcnt, 4)); + break; + case JEDEC_BYTE_PROGRAM: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (write_wpce775x_entry(addr, writecnt - 4, writearr + 4)) + return 1; + break; + case JEDEC_SE: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (handle_erase_wpce775x(addr)) + return 1; + break; + case JEDEC_WRSR: + if (wpce775x_wrsr(writearr[1])) + return 1; + break; + case JEDEC_WREN: + case JEDEC_RDSR: + default: + msg_perr("You are truly screwed. This command is not " + "implemented (yet)\n"); + return 1; + } + return 0; +} + +/* FIXME: This command is not implemented. We have to use read_memmapped, but + * the mapping window is too small for reasonably sized chips. + */ +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + if (flash->total_size * 1024 > 2 * 1024 * 1024) { + msg_perr("Chip is too big for reading on wpce775x.\n"); + return 1; + } + return read_memmapped(flash, buf, start, len); +} + +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + return spi_write_chunked(flash, buf, start, len, 8); +} Index: flashrom-ec_it87_wpce775x/Makefile =================================================================== --- flashrom-ec_it87_wpce775x/Makefile (Revision 1234) +++ flashrom-ec_it87_wpce775x/Makefile (Arbeitskopie) @@ -174,7 +174,7 @@ FEATURE_CFLAGS += -D'CONFIG_INTERNAL=1' PROGRAMMER_OBJS += processor_enable.o chipset_enable.o board_enable.o cbtable.o dmi.o internal.o # FIXME: The PROGRAMMER_OBJS below should only be included on x86. -PROGRAMMER_OBJS += it87spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o +PROGRAMMER_OBJS += it87spi.o it85spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o wpce775x.o NEED_PCI := yes endif Index: flashrom-ec_it87_wpce775x/internal.c =================================================================== --- flashrom-ec_it87_wpce775x/internal.c (Revision 1234) +++ flashrom-ec_it87_wpce775x/internal.c (Arbeitskopie) @@ -104,6 +104,7 @@ void probe_superio(void) { superio = probe_superio_ite(); + superio = probe_superio_ite85xx(); #if 0 /* Winbond Super I/O code is not yet available. */ if (superio.vendor == SUPERIO_VENDOR_NONE) @@ -234,6 +235,7 @@ * IT87* Parallel write enable. */ init_superio_ite(); + it85xx_probe_spi_flash(NULL); #endif board_flash_enable(lb_vendor, lb_part); @@ -268,6 +270,10 @@ { release_io_perms(); +#if defined(__i386__) || defined(__x86_64__) + it85xx_shutdown(); +#endif + return 0; } #endif Index: flashrom-ec_it87_wpce775x/it85spi.c =================================================================== --- flashrom-ec_it87_wpce775x/it85spi.c (Revision 0) +++ flashrom-ec_it87_wpce775x/it85spi.c (Revision 0) @@ -0,0 +1,403 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger + * Copyright (C) 2008 Ronald Hoogenboom <ronald(a)zonnet.nl> + * Copyright (C) 2008 coresystems GmbH + * Copyright (C) 2010 Google Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +/* + * Contains the ITE IT85* SPI specific routines + */ + +#if defined(__i386__) || defined(__x86_64__) + +#include <string.h> +#include <stdio.h> +#include <stdlib.h> +#include "flash.h" +#include "chipdrivers.h" +#include "spi.h" +#include "programmer.h" + +#define MAX_TIMEOUT 100000 +#define MAX_TRY 5 + +/* Constans for I/O ports */ +#define ITE_SUPERIO_PORT1 0x2e +#define ITE_SUPERIO_PORT2 0x4e + +/* Legacy I/O */ +#define LEGACY_KBC_PORT_DATA 0x60 +#define LEGACY_KBC_PORT_CMD 0x64 + +/* Constants for Logical Device registers */ +#define LDNSEL 0x07 +#define CHIP_ID_BYTE1_REG 0x20 +#define CHIP_ID_BYTE2_REG 0x21 +#define CHIP_CHIP_VER_REG 0x22 + +/* These are standard Super I/O 16-bit base address registers */ +#define SHM_IO_BAD0 0x60 /* big-endian, this is high bits */ +#define SHM_IO_BAD1 0x61 + +/* 8042 keyboard controller uses an input buffer and an output buffer to + * communicate with host CPU. Both buffers are 1-byte depth. That means the + * IBF is set to 1 when host CPU sends a command to input buffer (standing on + * the EC side). IBF is cleared to 0 once the command is read by EC. */ +#define KB_IBF (1 << 1) /* Input Buffer Full */ +#define KB_OBF (1 << 0) /* Output Buffer Full */ + +/* IT8502 supports two access modes: + * LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode) + * LPC_IO: through I/O port (so called indirect memory) + */ +#undef LPC_MEMORY +#define LPC_IO + +#ifdef LPC_IO +/* macro to fill in indirect-access registers. */ +#define INDIRECT_A0(base, value) OUTB(value, (base) + 0) /* little-endian */ +#define INDIRECT_A1(base, value) OUTB(value, (base) + 1) +#define INDIRECT_A2(base, value) OUTB(value, (base) + 2) +#define INDIRECT_A3(base, value) OUTB(value, (base) + 3) +#define INDIRECT_READ(base) INB((base) + 4) +#define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4) +#endif /* LPC_IO */ + +#ifdef LPC_IO +unsigned int shm_io_base; +#endif +unsigned char *ce_high, *ce_low; +static int it85xx_scratch_rom_reenter = 0; + +uint16_t probe_id_ite85(uint16_t port) +{ + uint16_t id; + + id = sio_read(port, CHIP_ID_BYTE1_REG) << 8 | + sio_read(port, CHIP_ID_BYTE2_REG); + + return id; +} + +struct superio probe_superio_ite85xx(void) +{ + struct superio ret = {}; + uint16_t ite_ports[] = {ITE_SUPERIO_PORT1, ITE_SUPERIO_PORT2, 0}; + uint16_t *i = ite_ports; + + ret.vendor = SUPERIO_VENDOR_ITE; + for (; *i; i++) { + ret.port = *i; + ret.model = probe_id_ite85(ret.port); + switch (ret.model >> 8) { + case 0x85: + msg_pdbg("Found EC: ITE85xx (Vendor:0x%02x,ID:0x%02x," + "Rev:0x%02x) on sio_port:0x%x.\n", + ret.model >> 8, ret.model & 0xff, + sio_read(ret.port, CHIP_CHIP_VER_REG), + ret.port); + return ret; + } + } + + /* No good ID found. */ + ret.vendor = SUPERIO_VENDOR_NONE; + ret.port = 0; + ret.model = 0; + return ret; +} + +/* This function will poll the keyboard status register until either + * an expected value shows up, or + * timeout reaches. + * + * Returns: 0 -- the expected value has shown. + * 1 -- timeout reached. + */ +static int wait_for( + const unsigned int mask, + const unsigned int expected_value, + const int timeout, /* in usec */ + const char* error_message, + const char* function_name, + const int lineno +) { + int time_passed; + + for (time_passed = 0;; ++time_passed) { + if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value) + return 0; + if (time_passed >= timeout) + break; + programmer_delay(1); + } + if (error_message) + msg_perr("%s():%d %s", function_name, lineno, error_message); + return 1; +} + +/* IT8502 employs a scratch ram when flash is being updated. Call the following + * two functions before/after flash erase/program. */ +void it85xx_enter_scratch_rom() +{ + int ret; + int tries; + + msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__); + if (it85xx_scratch_rom_reenter > 0) return; + + /* FIXME: this a workaround for the bug that SMBus signal would + * interfere the EC firmware update. Should be removed if + * we find out the root cause. */ + ret = system("stop powerd >&2"); + if (ret) { + msg_perr("Cannot stop powerd.\n"); + } + + for (tries = 0; tries < MAX_TRY; ++tries) { + /* Wait until IBF (input buffer) is not full. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at waiting for IBF==0.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Copy EC firmware to SRAM. */ + OUTB(0xb4, LEGACY_KBC_PORT_CMD); + + /* Confirm EC has taken away the command. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at taking command.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Waiting for OBF (output buffer) has data. + * Note sometimes the replied command might be stolen by kernel + * ISR so that it is okay as long as the command is 0xFA. */ + if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0)) + msg_pdbg("%s():%d * timeout at waiting for OBF.\n", + __FUNCTION__, __LINE__); + if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) { + break; + } else { + msg_perr("%s():%d * not run on SRAM ret=%d\n", + __FUNCTION__, __LINE__, ret); + continue; + } + } + + if (tries < MAX_TRY) { + /* EC already runs on SRAM */ + it85xx_scratch_rom_reenter++; + msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__); + } else { + msg_perr("%s():%d * Max try reached.\n", + __FUNCTION__, __LINE__); + } +} + +void it85xx_exit_scratch_rom() +{ + int ret; + int tries; + + msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__); + if (it85xx_scratch_rom_reenter <= 0) return; + + for (tries = 0; tries < MAX_TRY; ++tries) { + /* Wait until IBF (input buffer) is not full. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at waiting for IBF==0.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Exit SRAM. Run on flash. */ + OUTB(0xFE, LEGACY_KBC_PORT_CMD); + + /* Confirm EC has taken away the command. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at taking command.\n", + __FUNCTION__, __LINE__)) { + /* We cannot ensure if EC has exited update mode. + * If EC is in normal mode already, a further 0xFE + * command will reboot system. So, exit loop here. */ + tries = MAX_TRY; + break; + } + + break; + } + + if (tries < MAX_TRY) { + it85xx_scratch_rom_reenter = 0; + msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__); + } else { + msg_perr("%s():%d * Max try reached.\n", + __FUNCTION__, __LINE__); + } + + /* FIXME: this a workaround for the bug that SMBus signal would + * interfere the EC firmware update. Should be removed if + * we find out the root cause. */ + ret = system("start powerd >&2"); + if (ret) { + msg_perr("Cannot start powerd again.\n"); + } +} + +int it85xx_spi_common_init(void) +{ + chipaddr base; + + msg_pdbg("%s():%d superio.vendor=0x%02x\n", __func__, __LINE__, + superio.vendor); + if (superio.vendor != SUPERIO_VENDOR_ITE) + return 1; + +#ifdef LPC_IO + /* Get LPCPNP of SHM. That's big-endian */ + sio_write(superio.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */ + shm_io_base = (sio_read(superio.port, SHM_IO_BAD0) << 8) + + sio_read(superio.port, SHM_IO_BAD1); + msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__, + shm_io_base); + + /* These pointers are not used directly. They will be send to EC's + * register for indirect access. */ + base = 0xFFFFF000; + ce_high = ((unsigned char*)base) + 0xE00; /* 0xFFFFFE00 */ + ce_low = ((unsigned char*)base) + 0xD00; /* 0xFFFFFD00 */ + + /* pre-set indirect-access registers since in most of cases they are + * 0xFFFFxx00. */ + INDIRECT_A0(shm_io_base, base & 0xFF); + INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF); + INDIRECT_A3(shm_io_base, (base >> 24)); +#endif +#ifdef LPC_MEMORY + base = (chipaddr)programmer_map_flash_region("flash base", 0xFFFFF000, + 0x1000); + msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__, + (unsigned int)base); + ce_high = (unsigned char*)(base + 0xE00); /* 0xFFFFFE00 */ + ce_low = (unsigned char*)(base + 0xD00); /* 0xFFFFFD00 */ +#endif + + /* Set this as spi controller. */ + spi_controller = SPI_CONTROLLER_IT85XX; + + return 0; +} + +/* Called by programmer_entry .init */ +int it85xx_spi_init(void) +{ + int ret; + + get_io_perms(); + /* Probe for the Super I/O chip and fill global struct superio. */ + probe_superio(); + ret = it85xx_spi_common_init(); + if (!ret) { + buses_supported = CHIP_BUSTYPE_SPI; + } else { + buses_supported = CHIP_BUSTYPE_NONE; + } + return ret; +} + +/* Called by internal_init() */ +int it85xx_probe_spi_flash(const char *name) +{ + int ret; + + if (!(buses_supported & CHIP_BUSTYPE_FWH)) { + msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__); + return 1; + } + ret = it85xx_spi_common_init(); + msg_pdbg("FWH: %s():%d ret=%d\n", __func__, __LINE__, ret); + if (!ret) { + msg_pdbg("%s():%d buses_supported=0x%x\n", __func__, __LINE__, + buses_supported); + if (buses_supported & CHIP_BUSTYPE_FWH) + msg_pdbg("Overriding chipset SPI with IT85 FWH|SPI.\n"); + buses_supported |= CHIP_BUSTYPE_FWH | CHIP_BUSTYPE_SPI; + } + return ret; +} + +int it85xx_shutdown(void) +{ + msg_pdbg("%s():%d\n", __func__, __LINE__); + it85xx_exit_scratch_rom(); + return 0; +} + +/* According to ITE 8502 document, the procedure to follow mode is following: + * 1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high) + * 2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI + * with data) + * 3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get + * data from MISO) + */ +int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr) +{ + int i; + + it85xx_enter_scratch_rom(); + /* exit scratch rom ONLY when programmer shuts down. Otherwise, the + * temporary flash state may halt EC. */ + +#ifdef LPC_IO + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); + INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_low) >> 8) & 0xff); +#endif +#ifdef LPC_MEMORY + *ce_high = 0; +#endif + for (i = 0; i < writecnt; ++i) { +#ifdef LPC_IO + INDIRECT_WRITE(shm_io_base, writearr[i]); +#endif +#ifdef LPC_MEMORY + *ce_low = writearr[i]; +#endif + } + for (i = 0; i < readcnt; ++i) { +#ifdef LPC_IO + readarr[i] = INDIRECT_READ(shm_io_base); +#endif +#ifdef LPC_MEMORY + readarr[i] = *ce_low; +#endif + } +#ifdef LPC_IO + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); + INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ +#endif +#ifdef LPC_MEMORY + *ce_high = 0; +#endif + + return 0; +} + +#endif Index: flashrom-ec_it87_wpce775x/spi.c =================================================================== --- flashrom-ec_it87_wpce775x/spi.c (Revision 1234) +++ flashrom-ec_it87_wpce775x/spi.c (Arbeitskopie) @@ -55,6 +55,13 @@ .write_256 = ich_spi_write_256, }, + { /* SPI_CONTROLLER_IT85XX */ + .command = it85xx_spi_send_command, + .multicommand = default_spi_send_multicommand, + .read = ich_spi_read, + .write_256 = ich_spi_write_256, + }, + { /* SPI_CONTROLLER_IT87XX */ .command = it8716f_spi_send_command, .multicommand = default_spi_send_multicommand, @@ -89,6 +96,13 @@ .read = bitbang_spi_read, .write_256 = bitbang_spi_write_256, }, + + { /* SPI_CONTROLLER_WPCE775XX */ + .command = wpce775x_spi_send_command, + .multicommand = default_spi_send_multicommand, + .read = wpce775x_spi_read, + .write_256 = wpce775x_spi_write_256, + }, #endif #endif Index: flashrom-ec_it87_wpce775x/programmer.h =================================================================== --- flashrom-ec_it87_wpce775x/programmer.h (Revision 1234) +++ flashrom-ec_it87_wpce775x/programmer.h (Arbeitskopie) @@ -497,11 +497,13 @@ #if defined(__i386__) || defined(__x86_64__) SPI_CONTROLLER_ICH7, SPI_CONTROLLER_ICH9, + SPI_CONTROLLER_IT85XX, SPI_CONTROLLER_IT87XX, SPI_CONTROLLER_SB600, SPI_CONTROLLER_VIA, SPI_CONTROLLER_WBSIO, SPI_CONTROLLER_MCP6X_BITBANG, + SPI_CONTROLLER_WPCE775XX, #endif #endif #if CONFIG_FT2232_SPI == 1 @@ -554,6 +556,14 @@ int ich_spi_send_multicommand(struct spi_command *cmds); #endif +/* it85spi.c */ +struct superio probe_superio_ite85xx(void); +int it85xx_spi_init(void); +int it85xx_shutdown(void); +int it85xx_probe_spi_flash(const char *name); +int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr); + /* it87spi.c */ void enter_conf_mode_ite(uint16_t port); void exit_conf_mode_ite(uint16_t port); @@ -582,6 +592,14 @@ int wbsio_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); #endif +/* wpce775x.c */ +#if CONFIG_INTERNAL == 1 +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr); +#endif + /* serprog.c */ int serprog_init(void); int serprog_shutdown(void); -- http://www.hailfinger.org/

1 0

serprog SPI support
by Tim Schmidt 22 Nov '10

22 Nov '10

Hi, I'm looking for an Arduino firmware that supports writing to SPI flash devices from Flashrom. 'carldani' in #flashrom thought you might be able to help. Even if the code isn't quite working yet, I'm willing to take a look at it and see if I can help. --tim

2 1

← Newer
1
...
5
6
7
8
9
10
11
...
15
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom November 2010