flashrom May 2012

flashrom@flashrom.org

42 participants
127 discussions

Re: [flashrom] [PATCH] dummyflasher.c: add support for SFDP by adding a new emulator chip: MX25L6436
by Carl-Daniel Hailfinger 07 May '12

07 May '12

Am 23.02.2012 02:26 schrieb Stefan Tauner: > The chip features a complete 1.0 SFDP JEDEC flash parameter table and also a > vendor-specific extension table (defining voltages, lock bits etc). > NB: the MX25L6436 uses the same RDID as the MX25L6405. > > Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> with the changes below. > On Mon, 20 Feb 2012 19:49:38 +0100 Carl-Daniel Hailfinger wrote: > >> Am 20.02.2012 17:07 schrieb Stefan Tauner: >>> TODO: >>> - how should the SFDP data be supplied/selected by the user? >>> - option A (suggested one): add a default table with a legit complete table >> Good idea. >> >>> and a programmer option to use a binary file instead. >> I think having the file+builtin combination is overkill. Builtin should >> be sufficient, unless you plan to focus more on making flashrom a >> verification tool for flash vendors. > some of them would need it. *cough* ;) Right. I'd leave that as a possible future option, not something we should change in the patch right now. >>> […] >>> + case JEDEC_SFDP: >>> + if (emu_chip != EMULATE_WINBOND_W25Q64CV) >>> + break; >>> + offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; >>> + /* >>> + * FIXME: There is one dummy byte (i.e. 8 clock cycles) to be >>> + * transferred after the address. Since we can not observe the >>> + * clock, we would need to check for appropriate writecnt and/or >>> + * readcnt and recalculate the parameters below. >>> + */ >>> + /* FIXME: this could be more sophisticated. */ >>> + memcpy(readarr, sfdp_table + offs, >>> + min(sizeof(sfdp_table) - offs, readcnt)); >> That memcpy will segfault if offs>sizeof(sfdp_table). Suggestion: >> Replace the whole case statement with this (some 80 col reformatting may >> be needed): >> >> case JEDEC_SFDP: >> int toread; >> if (emu_chip != EMULATE_WINBOND_W25Q64CV) >> break; >> if (writecnt < 4) >> break; >> offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; >> /* The response is shifted if more than 4 bytes are written. */ >> offs += writecnt - 4; > first of all... this breaks the implementation atm, because it uses > a writecnt of 5 to include the dummy byte > > secondly i am not sure i understand your intention about the > shifting. i guess the following: flashrom cant cope with concurrent > write and read bytes... so you are specifying that if we write more > bytes than needed we miss the bytes read in the beginning.. which > seems fair enough. > > therefor i have changed 4 to 5 in the writecnt-related lines.. Not what I meant. The big issue with SFDP and FAST READ and other commands is that the dummy byte after command+address can be either a written or read byte (the chip does not care). Our emulation should be able to handle both. This means a writecnt of 4 is completely legal, but in that case we have to set the copy destination to &readarr[1] instead of &readarr[0]. My logic tried to address that, but it was not completely correct. I have annotated your patch with my suggested changes at the end of this mail. They seem to work in my tests. > you are trying to support wrapping around for continous reads here > (at least for the first wrap around afaics) while the specs say that > this is not allowed at all (whatever that actually means...). so i > would rather just read up to the boundary and reply 0xFF after that. > makes that patch simpler too :) We have a differing opinion about how to interpret the spec, but I'm happy with your interpretation, especially if it simplifies the code. >>> @@ -657,6 +730,7 @@ static int dummy_spi_send_command(struct flashctx *flash, unsigned int writecnt, >>> case EMULATE_ST_M25P10_RES: >>> case EMULATE_SST_SST25VF040_REMS: >>> case EMULATE_SST_SST25VF032B: >>> + case EMULATE_WINBOND_W25Q64CV: >>> if (emulate_spi_chip_response(writecnt, readcnt, writearr, >>> readarr)) { >>> msg_pdbg("Invalid command sent to flash chip!\n"); > beside that i have also changed the emulated chip to the macronix chip, > because it features a second table (that we might want to parse if it is > used by other vendors too... one can at least hope :) > it helps testing another execution path too... Good. > diff --git a/dummyflasher.c b/dummyflasher.c > index afe0518..794a2f6 100644 > --- a/dummyflasher.c > +++ b/dummyflasher.c > @@ -629,7 +681,33 @@ static int emulate_spi_chip_response(unsigned int writecnt, > /* emu_jedec_ce_c7_size is emu_chip_size. */ > memset(flashchip_contents, 0xff, emu_jedec_ce_c7_size); > break; > - default: > + case JEDEC_SFDP: { > + unsigned int toread; > + if (emu_chip != EMULATE_MACRONIX_MX25L6436) > + break; > + if (writecnt < 5) Replace with if (writecnt < 4) > + break; > + offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; Insert + /* SFDP expects one dummy byte after the address. */ + if (writecnt < 5) { + /* The dummy byte was not written, make sure it is read + * instead. Shifting and shortening the read array does + * achieve the goal. + */ + readarr += 5 - writecnt; + readcnt -= 5 - writecnt; + writecnt = 5; + } > + /* The response is shifted if more than 4 bytes are written. */ > + offs += writecnt - 5; > + /* The SFDP spec suggests wraparound is allowed as long as it > + * does not happen in a single continuous read. */ > + if (offs >= sizeof(sfdp_table)) { > + msg_pdbg("Wrapping the start address around the SFDP " > + "table boundary (using 0x%x instead of 0x%x)." > + "\n", > + (unsigned int)(offs % sizeof(sfdp_table)), > + offs); > + offs %= sizeof(sfdp_table); > + } > + toread = min(sizeof(sfdp_table) - offs, readcnt); > + memcpy(readarr, sfdp_table + offs, toread); > + if (toread < readcnt) > + msg_pdbg("Crossing the SFDP table boundary in a single " > + "continuous chunk produces undefined results " > + "after that point.\n"); > + break; > + } default: > /* No special response. */ > break; > } Regards, Carl-Daniel -- http://www.hailfinger.org/

2 3

[commit] r1534 - trunk
by repository service 07 May '12

07 May '12

Author: stefanct Date: Tue May 8 00:12:16 2012 New Revision: 1534 URL: http://flashrom.org/trac/flashrom/changeset/1534 Log: dummyflasher.c: add support for SFDP by adding a new emulator chip: MX25L6436 The chip features a complete 1.0 SFDP JEDEC flash parameter table and also a vendor-specific extension table (defining voltages, lock bits etc). NB: the MX25L6436 uses the same RDID as the MX25L6405. Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Modified: trunk/dummyflasher.c trunk/flashrom.8 Modified: trunk/dummyflasher.c ============================================================================== --- trunk/dummyflasher.c Mon May 7 00:48:01 2012 (r1533) +++ trunk/dummyflasher.c Tue May 8 00:12:16 2012 (r1534) @@ -46,6 +46,7 @@ EMULATE_ST_M25P10_RES, EMULATE_SST_SST25VF040_REMS, EMULATE_SST_SST25VF032B, + EMULATE_MACRONIX_MX25L6436, }; static enum emu_chip emu_chip = EMULATE_NONE; static char *emu_persistent_image = NULL; @@ -63,6 +64,33 @@ int spi_blacklist_size = 0; int spi_ignorelist_size = 0; static uint8_t emu_status = 0; + +/* A legit complete SFDP table based on the MX25L6436E (rev. 1.8) datasheet. */ +static const uint8_t const sfdp_table[] = { + 0x53, 0x46, 0x44, 0x50, // @0x00: SFDP signature + 0x00, 0x01, 0x01, 0xFF, // @0x04: revision 1.0, 2 headers + 0x00, 0x00, 0x01, 0x09, // @0x08: JEDEC SFDP header rev. 1.0, 9 DW long + 0x1C, 0x00, 0x00, 0xFF, // @0x0C: PTP0 = 0x1C (instead of 0x30) + 0xC2, 0x00, 0x01, 0x04, // @0x10: Macronix header rev. 1.0, 4 DW long + 0x48, 0x00, 0x00, 0xFF, // @0x14: PTP1 = 0x48 (instead of 0x60) + 0xFF, 0xFF, 0xFF, 0xFF, // @0x18: hole. + 0xE5, 0x20, 0xC9, 0xFF, // @0x1C: SFDP parameter table start + 0xFF, 0xFF, 0xFF, 0x03, // @0x20 + 0x00, 0xFF, 0x08, 0x6B, // @0x24 + 0x08, 0x3B, 0x00, 0xFF, // @0x28 + 0xEE, 0xFF, 0xFF, 0xFF, // @0x2C + 0xFF, 0xFF, 0x00, 0x00, // @0x30 + 0xFF, 0xFF, 0x00, 0xFF, // @0x34 + 0x0C, 0x20, 0x0F, 0x52, // @0x38 + 0x10, 0xD8, 0x00, 0xFF, // @0x3C: SFDP parameter table end + 0xFF, 0xFF, 0xFF, 0xFF, // @0x40: hole. + 0xFF, 0xFF, 0xFF, 0xFF, // @0x44: hole. + 0x00, 0x36, 0x00, 0x27, // @0x48: Macronix parameter table start + 0xF4, 0x4F, 0xFF, 0xFF, // @0x4C + 0xD9, 0xC8, 0xFF, 0xFF, // @0x50 + 0xFF, 0xFF, 0xFF, 0xFF, // @0x54: Macronix parameter table end +}; + #endif #endif @@ -301,6 +329,19 @@ msg_pdbg("Emulating SST SST25VF032B SPI flash chip (RDID, AAI " "write)\n"); } + if (!strcmp(tmp, "MX25L6436")) { + emu_chip = EMULATE_MACRONIX_MX25L6436; + emu_chip_size = 8 * 1024 * 1024; + emu_max_byteprogram_size = 256; + emu_max_aai_size = 0; + emu_jedec_se_size = 4 * 1024; + emu_jedec_be_52_size = 32 * 1024; + emu_jedec_be_d8_size = 64 * 1024; + emu_jedec_ce_60_size = emu_chip_size; + emu_jedec_ce_c7_size = emu_chip_size; + msg_pdbg("Emulating Macronix MX25L6436 SPI flash chip (RDID, " + "SFDP)\n"); + } #endif if (emu_chip == EMULATE_NONE) { msg_perr("Invalid chip specified for emulation: %s\n", tmp); @@ -449,7 +490,7 @@ const unsigned char *writearr, unsigned char *readarr) { - unsigned int offs, i; + unsigned int offs, i, toread; static int unsigned aai_offs; if (writecnt == 0) { @@ -503,20 +544,30 @@ readarr[1] = 0x44; break; case JEDEC_RDID: - if (emu_chip != EMULATE_SST_SST25VF032B) + switch (emu_chip) { + case EMULATE_SST_SST25VF032B: + if (readcnt > 0) + readarr[0] = 0xbf; + if (readcnt > 1) + readarr[1] = 0x25; + if (readcnt > 2) + readarr[2] = 0x4a; break; - /* Respond with SST_SST25VF032B. */ - if (readcnt > 0) - readarr[0] = 0xbf; - if (readcnt > 1) - readarr[1] = 0x25; - if (readcnt > 2) - readarr[2] = 0x4a; + case EMULATE_MACRONIX_MX25L6436: + if (readcnt > 0) + readarr[0] = 0xc2; + if (readcnt > 1) + readarr[1] = 0x20; + if (readcnt > 2) + readarr[2] = 0x17; + break; + default: /* ignore */ + break; + } break; - case JEDEC_RDSR: { + case JEDEC_RDSR: memset(readarr, emu_status, readcnt); break; - } /* FIXME: this should be chip-specific. */ case JEDEC_EWSR: case JEDEC_WREN: @@ -673,6 +724,41 @@ /* emu_jedec_ce_c7_size is emu_chip_size. */ memset(flashchip_contents, 0xff, emu_jedec_ce_c7_size); break; + case JEDEC_SFDP: + if (emu_chip != EMULATE_MACRONIX_MX25L6436) + break; + if (writecnt < 4) + break; + offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + + /* SFDP expects one dummy byte after the address. */ + if (writecnt == 4) { + /* The dummy byte was not written, make sure it is read instead. + * Shifting and shortening the read array does achieve this goal. + */ + readarr++; + readcnt--; + } else { + /* The response is shifted if more than 5 bytes are written, because SFDP data is + * already shifted out by the chip while those superfluous bytes are written. */ + offs += writecnt - 5; + } + + /* The SFDP spec implies that the start address of an SFDP read may be truncated to fit in the + * SFDP table address space, i.e. the start address may be wrapped around at SFDP table size. + * This is a reasonable implementation choice in hardware because it saves a few gates. */ + if (offs >= sizeof(sfdp_table)) { + msg_pdbg("Wrapping the start address around the SFDP table boundary (using 0x%x " + "instead of 0x%x).\n", (unsigned int)(offs % sizeof(sfdp_table)), offs); + offs %= sizeof(sfdp_table); + } + toread = min(sizeof(sfdp_table) - offs, readcnt); + memcpy(readarr, sfdp_table + offs, toread); + if (toread < readcnt) + msg_pdbg("Crossing the SFDP table boundary in a single " + "continuous chunk produces undefined results " + "after that point.\n"); + break; default: /* No special response. */ break; @@ -703,6 +789,7 @@ case EMULATE_ST_M25P10_RES: case EMULATE_SST_SST25VF040_REMS: case EMULATE_SST_SST25VF032B: + case EMULATE_MACRONIX_MX25L6436: if (emulate_spi_chip_response(writecnt, readcnt, writearr, readarr)) { msg_pdbg("Invalid command sent to flash chip!\n"); Modified: trunk/flashrom.8 ============================================================================== --- trunk/flashrom.8 Mon May 7 00:48:01 2012 (r1533) +++ trunk/flashrom.8 Tue May 8 00:12:16 2012 (r1534) @@ -435,6 +435,8 @@ .sp .RB "* SST " SST25VF032B " SPI flash chip (RDID, AAI write)" .sp +.RB "* Macronix " MX25L6436 " SPI flash chip (RDID, SFDP)" +.sp Example: .B "flashrom -p dummy:emulate=SST25VF040.REMS" .TP

1 0

Using flashrom with EliteGroup ECS GF8200A motherboard
by Denilson Figueiredo de Sá 06 May '12

06 May '12

Today I updated the BIOS of my EliteGroup ECS GF8200A motherboard. The vendor tool did not work on FreeDOS for me, and I don't have Windows, so I had to try updating it from Linux. This motherboard was not officially supported by flashrom, and the -V output is attached. Then I tried updating the ROM, running: flashrom 78NAA512.ROM (but, before that, I did a backup of the old firmware) However, at the verification stage, it failed. The error message is also attached. (sorry, but I didn't run it with -V) Following help from carldani and twice11, I tried flashing again the new firmware. This time it worked and gave me no errors. The output is also attached. I know there is very little information in the attached files, but I still hope they can be helpful for the project. Thank you, carldani and twice11 for helping me on IRC, and thank you for this project! -- Denilson Figueiredo de Sá Rio de Janeiro - Brasil

1 0

Re: [flashrom] Winbond W39V040A seems working
by Stefan Tauner 06 May '12

06 May '12

On Sun, 6 May 2012 16:39:18 -0700 Svetoslav Trochev <svetoslav.trochev(a)gmail.com> wrote: > >> I scavenged a FWH chip 82802AB from ABIT SE6 board. I am not 100% > >> sure, but I believe this board worked just fine before I replaced it > >> long time ago. Never the less I made backup copy of the BIOS: ABIT SE6 > >> - Award 6.00PG - ABIT SoftMenu II.bin > >> If Stefan don't have better copy I will be happy to "donate" mine. > > > > you cant just exchange any remotely similar firmware binary with > > another one (well... you can but the machine wont boot). > > > I'm sorry. Looks like I cause more confusion here. My goal was to > notify everyone that I have good BIOS copy for Abit SE6 board. Because > Abit is out of business and someone could run into similar problem I > believe it was important for me speak up. Stefan, could you please > check your backup copy of Abit's FTP and if you don't have BIOS dump > for SE6 board I can send you mine BIOS dump. ic. i have SE6 backups, thanks for the offer. -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

1 0

Re: [flashrom] Winbond W39V040A seems working
by Stefan Tauner 06 May '12

06 May '12

On Sat, 28 Apr 2012 08:00:02 -0700 Svetoslav Trochev <svetoslav.trochev(a)gmail.com> wrote: > Hi > > > Abit has been bankrupt for quite some time and they eventually shut > > down their FTP server. I have backed it up, but apparently the > > directories for the NF7 are empty, sorry. :/ > > Excuse me for interrupting the thread with unrelated info, but because > István problem and Abit shutting down their FTP I thing my info could > be useful to someone in the future. > > I scavenged a FWH chip 82802AB from ABIT SE6 board. I am not 100% > sure, but I believe this board worked just fine before I replaced it > long time ago. Never the less I made backup copy of the BIOS: ABIT SE6 > - Award 6.00PG - ABIT SoftMenu II.bin > If Stefan don't have better copy I will be happy to "donate" mine. you cant just exchange any remotely similar firmware binary with another one (well... you can but the machine wont boot). -- Kind regards/Mit freundlichen Grüßen, Stefan Tauner

2 1

[PATCH] Add Winbond SuperI/O detection
by Carl-Daniel Hailfinger 06 May '12

06 May '12

Add Winbond Super I/O detection and hook it up to the generic Super I/O detection framework. Incomplete and untested, but at least it shouldn't break anything. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-winbond_superio_detect/flash.h =================================================================== --- flashrom-winbond_superio_detect/flash.h (Revision 1064) +++ flashrom-winbond_superio_detect/flash.h (Arbeitskopie) @@ -350,6 +350,7 @@ /* board_enable.c */ void w836xx_ext_enter(uint16_t port); void w836xx_ext_leave(uint16_t port); +struct superio probe_superio_winbond(void); uint8_t sio_read(uint16_t port, uint8_t reg); void sio_write(uint16_t port, uint8_t reg, uint8_t data); void sio_mask(uint16_t port, uint8_t reg, uint8_t data, uint8_t mask); @@ -388,7 +389,8 @@ }; extern struct superio superio; #define SUPERIO_VENDOR_NONE 0x0 -#define SUPERIO_VENDOR_ITE 0x1 +#define SUPERIO_VENDOR_WINBOND 0x1 +#define SUPERIO_VENDOR_ITE 0x2 struct pci_dev *pci_dev_find_filter(struct pci_filter filter); struct pci_dev *pci_dev_find_vendorclass(uint16_t vendor, uint16_t class); struct pci_dev *pci_dev_find(uint16_t vendor, uint16_t device); Index: flashrom-winbond_superio_detect/internal.c =================================================================== --- flashrom-winbond_superio_detect/internal.c (Revision 1064) +++ flashrom-winbond_superio_detect/internal.c (Arbeitskopie) @@ -104,12 +104,14 @@ void probe_superio(void) { - superio = probe_superio_ite(); + superio = probe_superio_winbond(); #if 0 - /* Winbond Super I/O code is not yet available. */ + /* ITE probe causes SMSC LPC47N217 to power off the serial UART. */ if (superio.vendor == SUPERIO_VENDOR_NONE) - superio = probe_superio_winbond(); + superio = probe_superio_smsc(); #endif + if (superio.vendor == SUPERIO_VENDOR_NONE) + superio = probe_superio_ite(); } #endif Index: flashrom-winbond_superio_detect/board_enable.c =================================================================== --- flashrom-winbond_superio_detect/board_enable.c (Revision 1064) +++ flashrom-winbond_superio_detect/board_enable.c (Arbeitskopie) @@ -229,22 +229,59 @@ address, but takes no effort to make sure the chip is really a Winbond Super I/O */ -static const struct winbond_chip * winbond_superio_detect(uint16_t base) +uint8_t probe_id_winbond(uint16_t port) { uint8_t chipid; + + w836xx_ext_enter(port); + chipid = sio_read(port, 0x20); + w836xx_ext_leave(port); + + return chipid; +} + +#define WINBOND_SUPERIO_PORT1 0x2e +#define WINBOND_SUPERIO_PORT2 0x4e + +struct superio probe_superio_winbond(void) +{ + struct superio ret = {}; + uint16_t winbond_ports[] = {WINBOND_SUPERIO_PORT1, WINBOND_SUPERIO_PORT2, 0}; + uint16_t *i = winbond_ports; + + ret.vendor = SUPERIO_VENDOR_WINBOND; + for (; *i; i++) { + ret.port = *i; + ret.model = probe_id_winbond(ret.port); + switch (ret.model) { + case WINBOND_W83627HF_ID: + case WINBOND_W83627EHF_ID: + case WINBOND_W83627THF_ID: + msg_pinfo("Found Winbond Super I/O, id %02hx\n", + ret.model); + return ret; + } + } + + /* No good ID found. */ + ret.vendor = SUPERIO_VENDOR_NONE; + ret.port = 0; + ret.model = 0; + return ret; +} + +static const struct winbond_chip *winbond_superio_chipdef(void) +{ const struct winbond_chip * chip = NULL; int i; - w836xx_ext_enter(base); - chipid = sio_read(base, 0x20); for (i = 0; i < ARRAY_SIZE(winbond_chips); i++) - if (winbond_chips[i].device_id == chipid) + if (winbond_chips[i].device_id == superio.model) { chip = &winbond_chips[i]; break; } - w836xx_ext_leave(base); return chip; } @@ -259,7 +296,7 @@ int port = pin / 10; int bit = pin % 10; - chip = winbond_superio_detect(base); + chip = winbond_superio_chipdef(); if (!chip) { msg_perr("\nERROR: No supported Winbond Super I/O found\n"); return -1; -- http://www.hailfinger.org/

2 7

[commit] r1533 - trunk
by repository service 06 May '12

06 May '12

Author: hailfinger Date: Mon May 7 00:48:01 2012 New Revision: 1533 URL: http://flashrom.org/trac/flashrom/changeset/1533 Log: Add Winbond W836xx SuperI/O detection. Add ITE IT8707F/IT8710F detection. Note that we autodetect those chips, but we don't handle their flash translation features automatically yet. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-by: Michael Karcher <flashrom(a)mkarcher.dialup.fu-berlin.de> Modified: trunk/board_enable.c trunk/internal.c trunk/programmer.h Modified: trunk/board_enable.c ============================================================================== --- trunk/board_enable.c Sun May 6 19:03:40 2012 (r1532) +++ trunk/board_enable.c Mon May 7 00:48:01 2012 (r1533) @@ -67,6 +67,17 @@ OUTB(tmp | (data & mask), port + 1); } +/* Winbond W83697 documentation indicates that the index register has to be written for each access. */ +void sio_mask_alzheimer(uint16_t port, uint8_t reg, uint8_t data, uint8_t mask) +{ + uint8_t tmp; + + OUTB(reg, port); + tmp = INB(port + 1) & ~mask; + OUTB(reg, port); + OUTB(tmp | (data & mask), port + 1); +} + /* Not used yet. */ #if 0 static int enable_flash_decode_superio(void) @@ -163,6 +174,7 @@ WINBOND_W83627HF_ID = 0x52, WINBOND_W83627EHF_ID = 0x88, WINBOND_W83627THF_ID = 0x82, + WINBOND_W83697HF_ID = 0x60, }; static const struct winbond_mux w83627hf_port2_mux[8] = { @@ -227,28 +239,154 @@ {WINBOND_W83627THF_ID, ARRAY_SIZE(w83627thf), w83627thf}, }; -/* - * Detects which Winbond Super I/O is responding at the given base address, - * but takes no effort to make sure the chip is really a Winbond Super I/O. +#define WINBOND_SUPERIO_PORT1 0x2e +#define WINBOND_SUPERIO_PORT2 0x4e + +/* We don't really care about the hardware monitor, but it offers better (more specific) device ID info than + * the simple device ID in the normal configuration registers. + * Note: This function expects to be called while the Super I/O is in config mode. */ -static const struct winbond_chip *winbond_superio_detect(uint16_t base) +static uint8_t w836xx_deviceid_hwmon(uint16_t sio_port) { - uint8_t chipid; - const struct winbond_chip *chip = NULL; - int i; + uint16_t hwmport; + uint16_t hwm_vendorid; + uint8_t hwm_deviceid; + + sio_write(sio_port, 0x07, 0x0b); /* Select LDN 0xb (HWM). */ + if ((sio_read(sio_port, 0x30) & (1 << 0)) != (1 << 0)) { + msg_pinfo("W836xx hardware monitor disabled or does not exist.\n"); + return 0; + } + /* Get HWM base address (stored in LDN 0xb, index 0x60/0x61). */ + hwmport = sio_read(sio_port, 0x60) << 8; + hwmport |= sio_read(sio_port, 0x61); + /* HWM address register = HWM base address + 5. */ + hwmport += 5; + msg_pdbg2("W836xx Hardware Monitor at port %04x\n", hwmport); + /* FIXME: This busy check should happen before each HWM access. */ + if (INB(hwmport) & 0x80) { + msg_pinfo("W836xx hardware monitor busy, ignoring it.\n"); + return 0; + } + /* Set HBACS=1. */ + sio_mask_alzheimer(hwmport, 0x4e, 0x80, 0x80); + /* Read upper byte of vendor ID. */ + hwm_vendorid = sio_read(hwmport, 0x4f) << 8; + /* Set HBACS=0. */ + sio_mask_alzheimer(hwmport, 0x4e, 0x00, 0x80); + /* Read lower byte of vendor ID. */ + hwm_vendorid |= sio_read(hwmport, 0x4f); + if (hwm_vendorid != 0x5ca3) { + msg_pinfo("W836xx hardware monitor vendor ID weirdness: expected 0x5ca3, got %04x\n", + hwm_vendorid); + return 0; + } + /* Set Bank=0. */ + sio_mask_alzheimer(hwmport, 0x4e, 0x00, 0x07); + /* Read "chip" ID. We call this one the device ID. */ + hwm_deviceid = sio_read(hwmport, 0x58); + return hwm_deviceid; +} - w836xx_ext_enter(base); - chipid = sio_read(base, 0x20); +void probe_superio_winbond(void) +{ + struct superio s = {}; + uint16_t winbond_ports[] = {WINBOND_SUPERIO_PORT1, WINBOND_SUPERIO_PORT2, 0}; + uint16_t *i = winbond_ports; + uint8_t model; + uint8_t tmp; - for (i = 0; i < ARRAY_SIZE(winbond_chips); i++) { - if (winbond_chips[i].device_id == chipid) { - chip = &winbond_chips[i]; + s.vendor = SUPERIO_VENDOR_WINBOND; + for (; *i; i++) { + s.port = *i; + /* If we're already in Super I/O config more, the W836xx enter sequence won't hurt. */ + w836xx_ext_enter(s.port); + model = sio_read(s.port, 0x20); + /* No response, no point leaving the config mode. */ + if (model == 0xff) + continue; + /* Try to leave config mode. If the ID register is still readable, it's not a Winbond chip. */ + w836xx_ext_leave(s.port); + if (model == sio_read(s.port, 0x20)) { + msg_pdbg("W836xx enter config mode worked or we were already in config mode. W836xx " + "leave config mode had no effect.\n"); + if (model == 0x87) { + /* ITE IT8707F and IT8710F are special: They need the W837xx enter sequence, + * but they want the ITE exit sequence. Handle them here. + */ + tmp = sio_read(s.port, 0x21); + switch (tmp) { + case 0x07: + case 0x10: + s.vendor = SUPERIO_VENDOR_ITE; + s.model = (0x87 << 8) | tmp ; + msg_pdbg("Found ITE Super I/O, ID 0x%04hx on port " + "0x%x\n", s.model, s.port); + register_superio(s); + /* Exit ITE config mode. */ + exit_conf_mode_ite(s.port); + /* Restore vendor for next loop iteration. */ + s.vendor = SUPERIO_VENDOR_WINBOND; + continue; + } + } + msg_pinfo("Active config mode, unknown reg 0x20 ID: %02x.\n", model); + msg_pinfo("Please send the output of \"flashrom -V\" to \n" + "flashrom(a)flashrom.org with W836xx: your board name: flashrom -V\n" + "as the subject to help us finish support for your Super I/O. Thanks.\n"); + continue; + } + /* The Super I/O reacts to W836xx enter and exit config mode, it's probably Winbond. */ + w836xx_ext_enter(s.port); + s.model = sio_read(s.port, 0x20); + switch (s.model) { + case WINBOND_W83627HF_ID: + case WINBOND_W83627EHF_ID: + case WINBOND_W83627THF_ID: + msg_pdbg("Found Winbond Super I/O, id %02hx\n", s.model); + register_superio(s); + break; + case WINBOND_W83697HF_ID: + /* This code is extremely paranoid. */ + tmp = sio_read(s.port, 0x26) & 0x40; + if (((tmp == 0x00) && (s.port != WINBOND_SUPERIO_PORT1)) || + ((tmp == 0x40) && (s.port != WINBOND_SUPERIO_PORT2))) { + msg_pdbg("Winbond Super I/O probe weirdness: Port mismatch for ID " + "%02x at port %04x\n", s.model, s.port); + break; + } + tmp = w836xx_deviceid_hwmon(s.port); + /* FIXME: This might be too paranoid... */ + if (!tmp) { + msg_pdbg("Probably not a Winbond Super I/O\n"); + break; + } + if (tmp != s.model) { + msg_pinfo("W83 series hardware monitor device ID weirdness: expected %02x, " + "got %02x\n", WINBOND_W83697HF_ID, tmp); + break; + } + msg_pinfo("Found Winbond Super I/O, id %02hx\n", s.model); + register_superio(s); break; } + w836xx_ext_leave(s.port); } + return; +} - w836xx_ext_leave(base); - return chip; +static const struct winbond_chip *winbond_superio_chipdef(void) +{ + int i, j; + + for (i = 0; i < superio_count; i++) { + if (superios[i].vendor != SUPERIO_VENDOR_WINBOND) + continue; + for (j = 0; j < ARRAY_SIZE(winbond_chips); j++) + if (winbond_chips[j].device_id == superios[i].model) + return &winbond_chips[j]; + } + return NULL; } /* @@ -264,7 +402,7 @@ int port = pin / 10; int bit = pin % 10; - chip = winbond_superio_detect(base); + chip = winbond_superio_chipdef(); if (!chip) { msg_perr("\nERROR: No supported Winbond Super I/O found\n"); return -1; Modified: trunk/internal.c ============================================================================== --- trunk/internal.c Sun May 6 19:03:40 2012 (r1532) +++ trunk/internal.c Mon May 7 00:48:01 2012 (r1533) @@ -101,12 +101,14 @@ #if defined(__i386__) || defined(__x86_64__) void probe_superio(void) { + probe_superio_winbond(); + /* ITE probe causes SMSC LPC47N217 to power off the serial UART. + * Always probe for SMSC first, and if a SMSC Super I/O is detected + * at a given I/O port, do _not_ probe that port with the ITE probe. + * This means SMSC probing must be done before ITE probing. + */ + //probe_superio_smsc(); probe_superio_ite(); -#if 0 - /* Winbond Super I/O code is not yet available. */ - if (superio.vendor == SUPERIO_VENDOR_NONE) - superio = probe_superio_winbond(); -#endif } int superio_count = 0; Modified: trunk/programmer.h ============================================================================== --- trunk/programmer.h Sun May 6 19:03:40 2012 (r1532) +++ trunk/programmer.h Mon May 7 00:48:01 2012 (r1533) @@ -246,6 +246,7 @@ /* board_enable.c */ void w836xx_ext_enter(uint16_t port); void w836xx_ext_leave(uint16_t port); +void probe_superio_winbond(void); int it8705f_write_enable(uint8_t port); uint8_t sio_read(uint16_t port, uint8_t reg); void sio_write(uint16_t port, uint8_t reg, uint8_t data); @@ -290,6 +291,7 @@ extern int superio_count; #define SUPERIO_VENDOR_NONE 0x0 #define SUPERIO_VENDOR_ITE 0x1 +#define SUPERIO_VENDOR_WINBOND 0x2 #endif #if NEED_PCI == 1 struct pci_dev *pci_dev_find_filter(struct pci_filter filter);

1 0

Re: [flashrom] [PATCH 1/2] W83697xx superio flash enable
by Carl-Daniel Hailfinger 06 May '12

06 May '12

Am 28.04.2012 01:30 schrieb Stefan Tauner: > From: David Borg <borg.db(a)gmail.com> > > Adds a function to enable the flash interface on w83697xx superio's. > Still needs to be hooked up to the superio detection framework though. > > Signed-off-by: David Borg <borg.db(a)gmail.com> > Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> committed in r1529. Regards, Carl-Daniel -- http://www.hailfinger.org/

1 0

Re: [flashrom] [PATCH] dummyflasher: Add a status register to SPI chips.
by Carl-Daniel Hailfinger 06 May '12

06 May '12

Am 15.02.2012 02:13 schrieb Stefan Tauner: > TODO: man page Yes, that would be nice. > Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> even without the man page. It's a helpful feature, and maybe someone else has time to write a man page entry for it. If you want to write the man page entry, more power to you! Regards, Carl-Daniel -- http://www.hailfinger.org/

2 1

[commit] r1532 - trunk
by repository service 06 May '12

06 May '12

Author: stefanct Date: Sun May 6 19:03:40 2012 New Revision: 1532 URL: http://flashrom.org/trac/flashrom/changeset/1532 Log: dummyflasher: Add a status register to SPI chips. Signed-off-by: Stefan Tauner <stefan.tauner(a)student.tuwien.ac.at> Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Modified: trunk/dummyflasher.c trunk/flashrom.8 trunk/it87spi.c trunk/spi.h trunk/spi25.c Modified: trunk/dummyflasher.c ============================================================================== --- trunk/dummyflasher.c Sun May 6 17:11:26 2012 (r1531) +++ trunk/dummyflasher.c Sun May 6 19:03:40 2012 (r1532) @@ -21,6 +21,7 @@ #include <stdlib.h> #include <stdio.h> #include <ctype.h> +#include <errno.h> #include "flash.h" #include "chipdrivers.h" #include "programmer.h" @@ -61,6 +62,7 @@ unsigned char spi_ignorelist[256]; int spi_blacklist_size = 0; int spi_ignorelist_size = 0; +static uint8_t emu_status = 0; #endif #endif @@ -133,6 +135,9 @@ char *bustext = NULL; char *tmp = NULL; int i; +#if EMULATE_SPI_CHIP + char *status = NULL; +#endif #if EMULATE_CHIP struct stat image_stat; #endif @@ -309,6 +314,23 @@ return 1; } +#ifdef EMULATE_SPI_CHIP + status = extract_programmer_param("spi_status"); + if (status) { + char *endptr; + errno = 0; + emu_status = strtoul(status, &endptr, 0); + free(status); + if (errno != 0 || status == endptr) { + msg_perr("Error: initial status register specified, " + "but the value could not be converted.\n"); + return 1; + } + msg_pdbg("Initial status register is set to 0x%02x.\n", + emu_status); + } +#endif + msg_pdbg("Filling fake flash chip with 0xff, size %i\n", emu_chip_size); memset(flashchip_contents, 0xff, emu_chip_size); @@ -429,7 +451,6 @@ { unsigned int offs, i; static int unsigned aai_offs; - static int aai_active = 0; if (writecnt == 0) { msg_perr("No command sent to the chip!\n"); @@ -453,6 +474,17 @@ return 0; } } + + if (emu_max_aai_size && (emu_status & SPI_SR_AAI)) { + if (writearr[0] != JEDEC_AAI_WORD_PROGRAM && + writearr[0] != JEDEC_WRDI && + writearr[0] != JEDEC_RDSR) { + msg_perr("Forbidden opcode (0x%02x) attempted during " + "AAI sequence!\n", writearr[0]); + return 0; + } + } + switch (writearr[0]) { case JEDEC_RES: if (emu_chip != EMULATE_ST_M25P10_RES) @@ -481,10 +513,23 @@ if (readcnt > 2) readarr[2] = 0x4a; break; - case JEDEC_RDSR: - memset(readarr, 0, readcnt); - if (aai_active) - memset(readarr, 1 << 6, readcnt); + case JEDEC_RDSR: { + memset(readarr, emu_status, readcnt); + break; + } + /* FIXME: this should be chip-specific. */ + case JEDEC_EWSR: + case JEDEC_WREN: + emu_status |= SPI_SR_WEL; + break; + case JEDEC_WRSR: + if (!(emu_status & SPI_SR_WEL)) { + msg_perr("WRSR attempted, but WEL is 0!\n"); + break; + } + /* FIXME: add some reasonable simulation of the busy flag */ + emu_status = writearr[1] & ~SPI_SR_WIP; + msg_pdbg2("WRSR wrote 0x%02x.\n", emu_status); break; case JEDEC_READ: offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; @@ -510,7 +555,7 @@ case JEDEC_AAI_WORD_PROGRAM: if (!emu_max_aai_size) break; - if (!aai_active) { + if (!(emu_status & SPI_SR_AAI)) { if (writecnt < JEDEC_AAI_WORD_PROGRAM_OUTSIZE) { msg_perr("Initial AAI WORD PROGRAM size too " "short!\n"); @@ -521,7 +566,7 @@ "long!\n"); return 1; } - aai_active = 1; + emu_status |= SPI_SR_AAI; aai_offs = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; /* Truncate to emu_chip_size. */ @@ -544,9 +589,8 @@ } break; case JEDEC_WRDI: - if (!emu_max_aai_size) - break; - aai_active = 0; + if (emu_max_aai_size) + emu_status &= ~SPI_SR_AAI; break; case JEDEC_SE: if (!emu_jedec_se_size) @@ -633,6 +677,8 @@ /* No special response. */ break; } + if (writearr[0] != JEDEC_WREN && writearr[0] != JEDEC_EWSR) + emu_status &= ~SPI_SR_WEL; return 0; } #endif Modified: trunk/flashrom.8 ============================================================================== --- trunk/flashrom.8 Sun May 6 17:11:26 2012 (r1531) +++ trunk/flashrom.8 Sun May 6 19:03:40 2012 (r1532) @@ -495,6 +495,15 @@ command 0x03 (READ) and command 0x02 (WRITE). commandlist may be up to 512 characters (256 commands) long. Implementation note: flashrom won't detect an error during command execution. +.sp +.TP +.B SPI status register +.sp +You can specify the initial content of the chip's status register with the +.sp +.B " flashrom -p dummy:spi_status=content" +.sp +syntax where content is an 8-bit hexadecimal value. .SS .BR "nic3com" , " nicrealtek" , " nicsmc1211" , " nicnatsemi" , " nicintel\ " , " nicintel_spi" , " gfxnvidia" , " ogp_spi" , " drkaiser" , " satasii\ Modified: trunk/it87spi.c ============================================================================== --- trunk/it87spi.c Sun May 6 17:11:26 2012 (r1531) +++ trunk/it87spi.c Sun May 6 19:03:40 2012 (r1532) @@ -335,7 +335,7 @@ /* Wait until the Write-In-Progress bit is cleared. * This usually takes 1-10 ms, so wait in 1 ms steps. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(1000); return 0; } Modified: trunk/spi.h ============================================================================== --- trunk/spi.h Sun May 6 17:11:26 2012 (r1531) +++ trunk/spi.h Sun May 6 19:03:40 2012 (r1532) @@ -95,7 +95,11 @@ #define JEDEC_RDSR 0x05 #define JEDEC_RDSR_OUTSIZE 0x01 #define JEDEC_RDSR_INSIZE 0x01 -#define JEDEC_RDSR_BIT_WIP (0x01 << 0) + +/* Status Register Bits */ +#define SPI_SR_WIP (0x01 << 0) +#define SPI_SR_WEL (0x01 << 1) +#define SPI_SR_AAI (0x01 << 6) /* Write Status Enable */ #define JEDEC_EWSR 0x50 Modified: trunk/spi25.c ============================================================================== --- trunk/spi25.c Sun May 6 17:11:26 2012 (r1531) +++ trunk/spi25.c Sun May 6 19:03:40 2012 (r1532) @@ -479,7 +479,7 @@ * This usually takes 1-85 s, so wait in 1 s steps. */ /* FIXME: We assume spi_read_status_register will never fail. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(1000 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -515,7 +515,7 @@ * This usually takes 1-85 s, so wait in 1 s steps. */ /* FIXME: We assume spi_read_status_register will never fail. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(1000 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -557,7 +557,7 @@ /* Wait until the Write-In-Progress bit is cleared. * This usually takes 100-4000 ms, so wait in 100 ms steps. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(100 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -604,7 +604,7 @@ /* Wait until the Write-In-Progress bit is cleared. * This usually takes 100-4000 ms, so wait in 100 ms steps. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(100 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -649,7 +649,7 @@ /* Wait until the Write-In-Progress bit is cleared. * This usually takes 100-4000 ms, so wait in 100 ms steps. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(100 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -692,7 +692,7 @@ /* Wait until the Write-In-Progress bit is cleared. * This usually takes 15-800 ms, so wait in 10 ms steps. */ - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10 * 1000); /* FIXME: Check the status register for errors. */ return 0; @@ -805,7 +805,7 @@ * 100 ms, then wait in 10 ms steps until a total of 5 s have elapsed. */ programmer_delay(100 * 1000); - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) { + while (spi_read_status_register(flash) & SPI_SR_WIP) { if (++i > 490) { msg_cerr("Error: WIP bit after WRSR never cleared\n"); return TIMEOUT_ERROR; @@ -1035,7 +1035,7 @@ rc = spi_nbyte_program(flash, starthere + j, buf + starthere - start + j, towrite); if (rc) break; - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); } if (rc) @@ -1062,7 +1062,7 @@ result = spi_byte_program(flash, i, buf[i - start]); if (result) return 1; - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); } @@ -1157,7 +1157,7 @@ */ return result; } - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); /* We already wrote 2 bytes in the multicommand step. */ @@ -1169,7 +1169,7 @@ cmd[2] = buf[pos++ - start]; spi_send_command(flash, JEDEC_AAI_WORD_PROGRAM_CONT_OUTSIZE, 0, cmd, NULL); - while (spi_read_status_register(flash) & JEDEC_RDSR_BIT_WIP) + while (spi_read_status_register(flash) & SPI_SR_WIP) programmer_delay(10); }

1 0

← Newer
1
...
7
8
9
10
11
12
13
Older →

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom May 2012