- flashrom - mail.coreboot.org

[PATCH] Merge the EC drivers from the chromium tree
by Carl-Daniel Hailfinger 22 Nov '10

22 Nov '10

The following patch was obtained from a locally modified http://git.chromium.org/git/flashrom with git diff 20636ae6fc4ac1e61b3a89ddc5f6e059034d8660 and then removing all hunks unrelated to ECs and by cleaning up the Nuvoton code to use proper flashrom interfaces. On top of this I forward ported the code to current flashrom svn HEAD. No signoff because this patch is an amalgamation of ITE code, Nuvoton code, Google code, and my code. The git history has the individual signoffs except for my changes. This needs to be split into code specific to each EC family, and then one patch for each EC needs to be submitted with proper signoff. The IT85 code is mostly ready, and might even work. It _will_ break all boards which use IT87 flash translation. Once that is fixed (a few lines in internal.c), the IT85 code might even be mergeable. The WPCE775x code is not ready yet, and it is not even hooked up. That said, I believe that this patch may be interesting for people who want EC support in mainline flashrom and who are willing to review the code. Index: flashrom-ec_it87_wpce775x/wpce775x.c =================================================================== --- flashrom-ec_it87_wpce775x/wpce775x.c (Revision 0) +++ flashrom-ec_it87_wpce775x/wpce775x.c (Revision 0) @@ -0,0 +1,689 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2010 Google, Inc. + * Copyright (C) 2010 Carl-Daniel Hailfinger + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * Neither the name of Nuvoton Technology Corporation. or the names of + * contributors or licensors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * This software is provided "AS IS," without a warranty of any kind. + * ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, + * INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A + * PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY EXCLUDED. + * NUVOTON TECHNOLOGY CORPORATION. ("NUVOTON") AND ITS LICENSORS SHALL NOT BE LIABLE + * FOR ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING + * OR DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES. IN NO EVENT WILL + * SUN OR ITS LICENSORS BE LIABLE FOR ANY LOST REVENUE, PROFIT OR DATA, + * OR FOR DIRECT, INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL OR + * PUNITIVE DAMAGES, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF + * LIABILITY, ARISING OUT OF THE USE OF OR INABILITY TO USE THIS SOFTWARE, + * EVEN IF SUN HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + * + * This is an UNOFFICIAL patch for the Nuvoton WPCE775x/NPCE781x. It was tested + * for a specific hardware and firmware configuration and should be considered + * unreliable. Please see the following URL for Nuvoton's authoritative, + * officially supported flash update utility: + * http://sourceforge.net/projects/nuvflashupdate/ + */ + +#include <assert.h> +#include <string.h> +#include <sys/time.h> +#include <time.h> +#include <unistd.h> +#include "flash.h" +#include "chipdrivers.h" +#include "flashchips.h" +#include "programmer.h" +#include "spi.h" + +/** + * Definition of WPCE775X WCB (Write Command Buffer), as known as Shared Access + * Window 2. + * + * The document name is "WPCE775X Software User Guide Revision 1.2". + * + * Assume the host is little endian. + */ +__attribute__((packed)) +struct wpce775x_wcb { + /* Byte 0: semaphore byte */ + unsigned char exe:1; /* Bit0-RW- set by host. means wcb is ready to execute. + should be cleared by host after RDY=1. */ + unsigned char resv0_41:4; + unsigned char pcp:1; /* Bit5-RO- set by EPCE775x. means preparation operations for + flash update process is complete. */ + unsigned char err:1; /* Bit6-RO- set by EPCE775x. means an error occurs. */ + unsigned char rdy:1; /* Bit7-RO- set by EPCE775x. means operation is completed. */ + + /* Byte 1-2: reserved */ + unsigned char byte1; + unsigned char byte2; + + /* Byte 3: command code */ + unsigned char code; + + /* Byte 4-15: command field */ + unsigned char field[12]; +}; + +/* The physical address of WCB -- Shared Access Window 2. */ +static chipaddr wcb_physical_address; + +/* The virtual address of WCB -- Shared Access Window 2. */ +static volatile struct wpce775x_wcb *volatile wcb; + +/* count of entering flash update mode */ +static int in_flash_update_mode; + +/* Indicate the flash chip attached to the WPCE7xxx chip. + * This variable should be set in probe_wpce775x(). + * 0 means we haven't or cannot detect the chip type. */ +struct flashchip *scan = 0; + +/* SuperI/O related definitions and functions. */ +/* Strapping options */ +#define NUVOTON_SIO_PORT1 0x2e /* No pull-down resistor */ +#define NUVOTON_SIO_PORT2 0x164e /* Pull-down resistor on BADDR0 */ +/* Note: There's another funky state that we won't worry about right now */ + +/* SuperI/O Config */ +#define NUVOTON_SIOCFG_LDN 0x07 /* LDN Bank Selector */ +#define NUVOTON_SIOCFG_SID 0x20 /* SuperI/O ID */ +#define NUVOTON_SIOCFG_SRID 0x27 /* SuperI/O Revision ID */ +#define NUVOTON_LDN_SHM 0x0f /* LDN of SHM module */ + +/* WPCE775x shared memory config registers (LDN 0x0f) */ +#define WPCE775X_SHM_BASE_MSB 0x60 +#define WPCE775X_SHM_BASE_LSB 0x61 +#define WPCE775X_SHM_CFG 0xf0 +#define WPCE775X_SHM_CFG_BIOS_FWH_EN (1 << 3) +#define WPCE775X_SHM_CFG_FLASH_ACC_EN (1 << 2) +#define WPCE775X_SHM_CFG_BIOS_EXT_EN (1 << 1) +#define WPCE775X_SHM_CFG_BIOS_LPC_EN (1 << 0) +#define WPCE775X_WIN_CFG 0xf1 /* window config */ +#define WPCE775X_WIN_CFG_SHWIN_ACC (1 << 6) + +/* Shared access window 2 bar address registers */ +#define WPCE775X_SHAW2BA_0 0xf8 +#define WPCE775X_SHAW2BA_1 0xf9 +#define WPCE775X_SHAW2BA_2 0xfa +#define WPCE775X_SHAW2BA_3 0xfb + +/** probe for super i/o index + * @returns 0 to indicate success, <0 to indicate error + */ +static int nuvoton_get_sio_index(uint16_t *port) +{ + uint16_t ports[] = { NUVOTON_SIO_PORT2, + NUVOTON_SIO_PORT1, + }; + int i; + static uint16_t port_internal, port_found = 0; + + if (port_found) { + *port = port_internal; + return 0; + } + + get_io_perms(); + + for (i = 0; i < ARRAY_SIZE(ports); i++) { + uint8_t sid = sio_read(ports[i], NUVOTON_SIOCFG_SID); + + if (sid == 0xfc) { /* Family ID */ + port_internal = ports[i]; + port_found = 1; + break; + } + } + + if (!port_found) { + msg_cdbg("\nfailed to obtain super i/o index"); + return -1; + } + + msg_cdbg("\nsuper i/o index = 0x%04x\n", port_internal); + *port = port_internal; + return 0; +} + +/** Call superio to get pre-configured WCB address. + * Read LDN 0x0f (SHM) idx:f8-fb (little-endian). + */ +static int get_shaw2ba(chipaddr *shaw2ba, uint8_t *comm_fwh) +{ + uint16_t idx; + uint8_t org_ldn; + uint8_t win_cfg; + uint8_t shm_cfg; + int ret = 0; + + if (nuvoton_get_sio_index(&idx) < 0) + return -1; + + org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); + sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); + + /* + * To obtain shared access window 2 base address, we must OR the base + * address bytes, where SHAW2BA_0 is least significant and SHAW2BA_3 + * most significant. + */ + *shaw2ba = sio_read(idx, WPCE775X_SHAW2BA_0) | + (sio_read(idx, WPCE775X_SHAW2BA_1) << 8) | + (sio_read(idx, WPCE775X_SHAW2BA_2) << 16) | + (sio_read(idx, WPCE775X_SHAW2BA_3) << 24); + + /* + * If SHWIN_ACC is cleared, then we're using LPC memory access + * and SHAW2BA_3-0 indicate bits 31-0. If SHWIN_ACC is set, then + * bits 7-4 of SHAW2BA_3 are ignored and bits 31-28 are indicated + * by the idsel nibble. (See table 25 "supported host address ranges" + * for more details) + */ + win_cfg = sio_read(idx, WPCE775X_WIN_CFG); + if (win_cfg & WPCE775X_WIN_CFG_SHWIN_ACC) { + /* Make sure shared BIOS memory is enabled */ + shm_cfg = sio_read(idx, WPCE775X_SHM_CFG); + if (!(shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) { + msg_cdbg("Shared BIOS memory is diabled.\n"); + msg_cdbg("Please check SHM_CFG:BIOS_FWH_EN.\n"); + ret = -1; + goto out; + } + /* FIXME: Check that this is a FWH capable chipset. */ + *comm_fwh = 1; + /* Check if bit 24-27 are set. Intel ICH will never issue any + * LPC firmware memory (FWH) cycles with them cleared. + * FWH cycles only have 28 address bits. + */ + if ((*shaw2ba & (0xf << 24)) != 0xf << 24) { + msg_cerr("WPCE775X shadow window 2 is outside the " + "region addressable with FWH!\n"); + ret = -1; + goto out; + } + /* FWH cycles are only issued for memory mapped to the top + * 16 MB of the 4 GB address space. We could set only the top + * 4 bits since those are ignored by the WPCE775X and we checked + * bits 24-27 to be 0xf above, but setting the top 8 bits makes + * the 16 MB constraint more clear. + */ + *shaw2ba |= 0xff << 24; + } else { + *comm_fwh = 0; + } + +out: + sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); + return ret; +} + +/* Call superio to get pre-configured fwh_id. + * Read LDN 0x0f (SHM) idx:f0. + */ +static int get_fwh_id(uint8_t *fwh_id) +{ + uint16_t idx; + uint8_t org_ldn; + + if (nuvoton_get_sio_index(&idx) < 0) + return -1; + + org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); + sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); + /* Upper 4 bits of WPCE775X_SHM_CFG store the FWH ID. */ + *fwh_id = sio_read(idx, WPCE775X_SHM_CFG) >> 4; + sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); + + return 0; +} + +/** helper function to make sure the exe bit is 0 (no one is using EC). + * @return 1 for error; 0 for success. + */ +static int assert_ec_is_free(void) +{ + if (wcb->exe) + msg_perr("ASSERT(wcb->exe==0), entering busy loop.\n"); + while(wcb->exe); + return 0; +} + +/** Trigger EXE bit, and block until operation completes. + * @return 1 for error; and 0 for success. + */ +static int blocked_exec(void) +{ + struct timeval begin, now; + int timeout; /* not zero if timeout occurs */ + int err; + + assert(wcb->rdy==0); + + /* raise EXE bit, and wait for operation complete or error occur. */ + wcb->exe = 1; + + timeout = 0; + gettimeofday(&begin, NULL); + while(wcb->rdy==0 && wcb->err==0) { + gettimeofday(&now, NULL); + /* According to Nuvoton's suggestion, few seconds is enough for + * longest flash operation, which is erase. + * Cutted from W25X16 datasheet, for max operation time + * Byte program tBP1 50us + * Page program tPP 3ms + * Sector Erase (4KB) tSE 200ms + * Block Erase (64KB) tBE 1s + * Chip Erase tCE 20s + * Since WPCE775x doesn't support chip erase, + * 3 secs is long enough for block erase. + */ + if ((now.tv_sec - begin.tv_sec) >= 4) { + timeout += 1; + break; + } + } + + /* keep ERR bit before clearing EXE bit. */ + err = wcb->err; + + /* Clear EXE bit, and wait for RDY back to 0. */ + wcb->exe = 0; + gettimeofday(&begin, NULL); + while(wcb->rdy) { + gettimeofday(&now, NULL); + /* 1 sec should be long enough for clearing rdy bit. */ + if (((now.tv_sec - begin.tv_sec)*1000*1000 + + (now.tv_usec - begin.tv_usec)) >= 1000*1000) { + timeout += 1; + break; + } + } + + if (err || timeout) { + msg_cdbg("err=%d timeout=%d\n", err, timeout); + return 1; + } + return 0; +} + +/** Initialize the EC parameters. + * @return 1 for error; 0 for success. + */ +static int InitFlash(unsigned char srp) +{ + assert_ec_is_free(); + + /* Byte 3: command code: Init Flash */ + wcb->code = 0x5A; + + /* Byte 4: opcode for Read Device Id */ + wcb->field[0] = JEDEC_RDID; + + /* Byte 5: opcode for Write Status Enable + JEDEC_EWSR defines 0x50, but W25Q16 + accepts JEDEC_WREN to enable write status */ + wcb->field[1] = JEDEC_WREN; + + /* Byte 6: opcode for Write Enable */ + wcb->field[2] = JEDEC_WREN; + + /* Byte 7: opcode for Read Status Register */ + wcb->field[3] = JEDEC_RDSR; + + /* Byte 8: opcode for Write Status Register */ + wcb->field[4] = JEDEC_WRSR; + + /* Byte 9: opcode for Flash Program */ + wcb->field[5] = JEDEC_BYTE_PROGRAM; + + /* Byte A: opcode for Sector or Block Erase. 0xD8: Block Erase (64KB), 0x20: Sector Erase (4KB) */ + /* TODO: dhendrix: We may need a more sophisticated routine to determine the proper values on a chip-by-chip basis in the future. */ + wcb->field[6] = JEDEC_SE; + + /* Byte B: status busy mask */ + wcb->field[7] = 0x01; + + /* Byte C: Status Register Value */ + wcb->field[8] = srp; /* SRP (Status Register Protect), {TB, BP2, BP1, BP0} = {1, 0, 1, 1} */ + + /* Byte D: Program Unit Size */ + wcb->field[9] = 0x01; + + /* Byte E: Page Size, 2^X bytes */ + wcb->field[10] = 0x08; + + /* Byte F: Read Device ID Type. 0x47 -- send 3 dummy addresses before read ID from flash */ + wcb->field[11] = 0x00; + + if (blocked_exec()) + return 1; + return 0; +} + +/** Read flash vendor/device IDs through EC. + * @param readarr 4-byte buffer for JEDEC_RDID response. + * @return 1 for error; 0 for success. + */ +static int ReadId(unsigned char *readarr) +{ + assert_ec_is_free(); + + wcb->code = 0xC0; /* Byte 3: command code: Read ID */ + if (blocked_exec()) + return 1; + + readarr[0] = wcb->field[0]; + readarr[1] = wcb->field[1]; + readarr[2] = wcb->field[2]; + readarr[3] = wcb->field[3]; + + return 0; +} + +/** probe if WPCE775x is present. + * @return 1 for error; 0 for success + */ +int wpce775x_init(void) +{ + uint16_t sio_port; + uint8_t srid; + uint8_t fwh_id; + uint8_t comm_fwh = 0; + + /* detect if wpce775x exists */ + if (nuvoton_get_sio_index(&sio_port) < 0) { + msg_cdbg("No Nuvoton chip is found.\n"); + /* No chip found is not an error. */ + return 0; + } + srid = sio_read(sio_port, NUVOTON_SIOCFG_SRID); + if ((srid & 0xE0) == 0xA0) { + msg_pdbg("Found EC: WPCE775x (Vendor:0x%02x,ID:0x%02x,Rev:0x%02x) on sio_port:0x%x.\n", + sio_read(sio_port, NUVOTON_SIOCFG_SID), + srid >> 5, srid & 0x1f, sio_port); + + } else { + msg_pdbg("Found EC: Nuvoton (Vendor:0x%02x,ID:0x%02x,Rev:0x%02x) on sio_port:0x%x.\n", + sio_read(sio_port, NUVOTON_SIOCFG_SID), + srid >> 5, srid & 0x1f, sio_port); + } + + /* get the address of Shadow Window 2. */ + if (get_shaw2ba(&wcb_physical_address, &comm_fwh) < 0) { + msg_cdbg("Cannot get the address of Shadow Window 2"); + return 1; + } + msg_cdbg("Get the address of WCB(SHA WIN2) at 0x%08x\n", + (uint32_t)wcb_physical_address); + + /* If we use FWH for Shadow Window 2, we have to set FWH IDSEL in the + * chipset before we try to access Shadow Window 2. + */ + if (comm_fwh) { + if (get_fwh_id(&fwh_id) < 0) { + msg_cdbg("Cannot get fwh_id value.\n"); + return 1; + } + msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); + + /* TODO: set fwh_idsel of chipset. + * Currently, we employ "-p internal:fwh_idsel=0x0000223e". + */ + } + + wcb = (struct wpce775x_wcb *)physmap("WPCE775X WCB", + wcb_physical_address, + getpagesize() /* min page size */); + msg_cdbg("mapped wcb address: %p for physical addr: 0x%08lx\n", wcb, wcb_physical_address); + if (!wcb) { + msg_perr("FATAL! Cannot map memory area for wcb physical address.\n"); + return 1; + } + memset((void*)wcb, 0, sizeof(*wcb)); + + /* Initialize the parameters of EC SHM component */ + if (InitFlash(0x00)) + return 1; + + if (buses_supported & CHIP_BUSTYPE_SPI) + msg_pdbg("Overriding chipset SPI with WPCE775x SPI.\n"); + spi_controller = SPI_CONTROLLER_WPCE775XX; + buses_supported |= CHIP_BUSTYPE_SPI; + return 0; +} + +/** Tell EC to "enter flash update" mode. */ +static int EnterFlashUpdate(void) +{ + if (in_flash_update_mode) { + /* already in update mode */ + in_flash_update_mode++; + return 0; + } + + wcb->code = 0x10; /* Enter Flash Update */ + wcb->field[0] = 0x55; /* required pattern by EC */ + wcb->field[1] = 0xAA; /* required pattern by EC */ + wcb->field[2] = 0xCD; /* required pattern by EC */ + wcb->field[3] = 0xBE; /* required pattern by EC */ + if (blocked_exec()) { + return 1; + } else { + in_flash_update_mode++; + return 0; + } +} + +/** Tell EC to "exit flash update" mode. + * Without calling this function, the EC stays in busy-loop and will not + * response further request from host, which means system will halt. + */ +static int ExitFlashUpdate(unsigned char exit_code) +{ + if (in_flash_update_mode <= 0) { + msg_cdbg("Not in flash update mode yet.\n"); + return 1; + } + + if (in_flash_update_mode >= 2) { + in_flash_update_mode--; + return 0; + } + + wcb->code = exit_code; /* Exit Flash Update */ + if (blocked_exec()) { + return 1; + } else { + in_flash_update_mode--; + return 0; + } +} + +/* + * Note: The EC firmware this patch has been tested with uses the following + * codes to indicate flash update status: + * 0x20 is used for EC F/W no change, but BIOS changed (in Share mode) + * 0x21 is used for EC F/W changed. Goto EC F/W, wait system reboot. + * 0x22 is used for EC F/W changed, Goto EC Watchdog reset. */ +static int ExitFlashUpdateFirmwareNoChange(void) { + return ExitFlashUpdate(0x20); +} + +static int ExitFlashUpdateFirmwareChanged(void) { + return ExitFlashUpdate(0x21); +} + +static int wpce775x_set_write_window(unsigned int base, unsigned int size) +{ + assert_ec_is_free(); + + /* Set Write Window on flash chip (optional). + * You may limit the window to partial flash for experimental. */ + wcb->code = 0xC5; /* Set Write Window */ + wcb->field[0] = base & 0xff; /* window base: little-endian */ + wcb->field[1] = (base >> 8) & 0xff; + wcb->field[2] = (base >> 16) & 0xff; + wcb->field[3] = (base >> 24) & 0xff; + wcb->field[4] = size & 0xff; /* window length: little-endian */ + wcb->field[5] = (size >> 8) & 0xff; + wcb->field[6] = (size >> 16) & 0xff; + wcb->field[7] = (size >> 24) & 0xff; + if (blocked_exec()) + return 1; + return 0; +} + +static int handle_erase_wpce775x(unsigned int blockaddr) +{ + /* FIXME: A 2 MByte window is too small. */ + if (wpce775x_set_write_window(0x0, 0x200000)) + return 1; + + assert_ec_is_free(); + + if (EnterFlashUpdate()) + return 1; + + wcb->code = 0x80; /* Sector/block erase */ + /* WARNING: assume the block address for EC is always little-endian. */ + wcb->field[0] = blockaddr & 0xff; + wcb->field[1] = (blockaddr >> 8) & 0xff; + wcb->field[2] = (blockaddr >> 16) & 0xff; + wcb->field[3] = (blockaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; + + if (ExitFlashUpdateFirmwareChanged()) + return 1; + + return 0; + +error_exit: + ExitFlashUpdateFirmwareChanged(); + return 1; +} + +/** + * Page write helper + */ +static int write_wpce775x_entry(unsigned long writeaddr, unsigned long writelen, const unsigned char *buf) +{ + if (writelen > 8) { + msg_perr("WTF did you call %s with writelen=%li\n", __func__, writelen); + return 1; + } + + /* FIXME: assert_ec_is_free() missing? */ + if (EnterFlashUpdate()) + return 1; + + /* wpce775x provides a 8-byte program buffer. */ + wcb->code = 0xA0; /* Set Address */ + wcb->field[0] = writeaddr & 0xff; + wcb->field[1] = (writeaddr >> 8) & 0xff; + wcb->field[2] = (writeaddr >> 16) & 0xff; + wcb->field[3] = (writeaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; + + /* 8 is maximum buffer size */ + wcb->code = 0xB0 | writelen; + int i; + for (i = 0; i < writelen; i++) { + wcb->field[i] = buf[i]; + } + if (blocked_exec()) + goto error_exit; + + if (ExitFlashUpdateFirmwareChanged()) return 1; + return 0; + +error_exit: + ExitFlashUpdateFirmwareChanged(); + return 1; +} + +static int wpce775x_wrsr(const unsigned char status) { + /* InitFlash (with particular status value), and EnterFlashUpdate() then + * ExitFlashUpdate() immediately. Thus, the flash status register will + * be updated. */ + if (InitFlash(status)) + return -1; + if (EnterFlashUpdate()) return 1; + ExitFlashUpdateFirmwareNoChange(); + + return 0; +} + +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr) +{ + unsigned char ids[4]; + unsigned int addr = 0; + + /* Ugly hack. Not my fault. -- Carl-Daniel */ + switch(writearr[0]) { + case JEDEC_RDID: + /* We always read 4 ID bytes. Return only the wanted parts. */ + if (ReadId(ids)) + return 1; + memcpy(readarr, ids, min(readcnt, 4)); + break; + case JEDEC_BYTE_PROGRAM: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (write_wpce775x_entry(addr, writecnt - 4, writearr + 4)) + return 1; + break; + case JEDEC_SE: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (handle_erase_wpce775x(addr)) + return 1; + break; + case JEDEC_WRSR: + if (wpce775x_wrsr(writearr[1])) + return 1; + break; + case JEDEC_WREN: + case JEDEC_RDSR: + default: + msg_perr("You are truly screwed. This command is not " + "implemented (yet)\n"); + return 1; + } + return 0; +} + +/* FIXME: This command is not implemented. We have to use read_memmapped, but + * the mapping window is too small for reasonably sized chips. + */ +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + if (flash->total_size * 1024 > 2 * 1024 * 1024) { + msg_perr("Chip is too big for reading on wpce775x.\n"); + return 1; + } + return read_memmapped(flash, buf, start, len); +} + +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + return spi_write_chunked(flash, buf, start, len, 8); +} Index: flashrom-ec_it87_wpce775x/Makefile =================================================================== --- flashrom-ec_it87_wpce775x/Makefile (Revision 1234) +++ flashrom-ec_it87_wpce775x/Makefile (Arbeitskopie) @@ -174,7 +174,7 @@ FEATURE_CFLAGS += -D'CONFIG_INTERNAL=1' PROGRAMMER_OBJS += processor_enable.o chipset_enable.o board_enable.o cbtable.o dmi.o internal.o # FIXME: The PROGRAMMER_OBJS below should only be included on x86. -PROGRAMMER_OBJS += it87spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o +PROGRAMMER_OBJS += it87spi.o it85spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o wpce775x.o NEED_PCI := yes endif Index: flashrom-ec_it87_wpce775x/internal.c =================================================================== --- flashrom-ec_it87_wpce775x/internal.c (Revision 1234) +++ flashrom-ec_it87_wpce775x/internal.c (Arbeitskopie) @@ -104,6 +104,7 @@ void probe_superio(void) { superio = probe_superio_ite(); + superio = probe_superio_ite85xx(); #if 0 /* Winbond Super I/O code is not yet available. */ if (superio.vendor == SUPERIO_VENDOR_NONE) @@ -234,6 +235,7 @@ * IT87* Parallel write enable. */ init_superio_ite(); + it85xx_probe_spi_flash(NULL); #endif board_flash_enable(lb_vendor, lb_part); @@ -268,6 +270,10 @@ { release_io_perms(); +#if defined(__i386__) || defined(__x86_64__) + it85xx_shutdown(); +#endif + return 0; } #endif Index: flashrom-ec_it87_wpce775x/it85spi.c =================================================================== --- flashrom-ec_it87_wpce775x/it85spi.c (Revision 0) +++ flashrom-ec_it87_wpce775x/it85spi.c (Revision 0) @@ -0,0 +1,403 @@ +/* + * This file is part of the flashrom project. + * + * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger + * Copyright (C) 2008 Ronald Hoogenboom <ronald(a)zonnet.nl> + * Copyright (C) 2008 coresystems GmbH + * Copyright (C) 2010 Google Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA + */ + +/* + * Contains the ITE IT85* SPI specific routines + */ + +#if defined(__i386__) || defined(__x86_64__) + +#include <string.h> +#include <stdio.h> +#include <stdlib.h> +#include "flash.h" +#include "chipdrivers.h" +#include "spi.h" +#include "programmer.h" + +#define MAX_TIMEOUT 100000 +#define MAX_TRY 5 + +/* Constans for I/O ports */ +#define ITE_SUPERIO_PORT1 0x2e +#define ITE_SUPERIO_PORT2 0x4e + +/* Legacy I/O */ +#define LEGACY_KBC_PORT_DATA 0x60 +#define LEGACY_KBC_PORT_CMD 0x64 + +/* Constants for Logical Device registers */ +#define LDNSEL 0x07 +#define CHIP_ID_BYTE1_REG 0x20 +#define CHIP_ID_BYTE2_REG 0x21 +#define CHIP_CHIP_VER_REG 0x22 + +/* These are standard Super I/O 16-bit base address registers */ +#define SHM_IO_BAD0 0x60 /* big-endian, this is high bits */ +#define SHM_IO_BAD1 0x61 + +/* 8042 keyboard controller uses an input buffer and an output buffer to + * communicate with host CPU. Both buffers are 1-byte depth. That means the + * IBF is set to 1 when host CPU sends a command to input buffer (standing on + * the EC side). IBF is cleared to 0 once the command is read by EC. */ +#define KB_IBF (1 << 1) /* Input Buffer Full */ +#define KB_OBF (1 << 0) /* Output Buffer Full */ + +/* IT8502 supports two access modes: + * LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode) + * LPC_IO: through I/O port (so called indirect memory) + */ +#undef LPC_MEMORY +#define LPC_IO + +#ifdef LPC_IO +/* macro to fill in indirect-access registers. */ +#define INDIRECT_A0(base, value) OUTB(value, (base) + 0) /* little-endian */ +#define INDIRECT_A1(base, value) OUTB(value, (base) + 1) +#define INDIRECT_A2(base, value) OUTB(value, (base) + 2) +#define INDIRECT_A3(base, value) OUTB(value, (base) + 3) +#define INDIRECT_READ(base) INB((base) + 4) +#define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4) +#endif /* LPC_IO */ + +#ifdef LPC_IO +unsigned int shm_io_base; +#endif +unsigned char *ce_high, *ce_low; +static int it85xx_scratch_rom_reenter = 0; + +uint16_t probe_id_ite85(uint16_t port) +{ + uint16_t id; + + id = sio_read(port, CHIP_ID_BYTE1_REG) << 8 | + sio_read(port, CHIP_ID_BYTE2_REG); + + return id; +} + +struct superio probe_superio_ite85xx(void) +{ + struct superio ret = {}; + uint16_t ite_ports[] = {ITE_SUPERIO_PORT1, ITE_SUPERIO_PORT2, 0}; + uint16_t *i = ite_ports; + + ret.vendor = SUPERIO_VENDOR_ITE; + for (; *i; i++) { + ret.port = *i; + ret.model = probe_id_ite85(ret.port); + switch (ret.model >> 8) { + case 0x85: + msg_pdbg("Found EC: ITE85xx (Vendor:0x%02x,ID:0x%02x," + "Rev:0x%02x) on sio_port:0x%x.\n", + ret.model >> 8, ret.model & 0xff, + sio_read(ret.port, CHIP_CHIP_VER_REG), + ret.port); + return ret; + } + } + + /* No good ID found. */ + ret.vendor = SUPERIO_VENDOR_NONE; + ret.port = 0; + ret.model = 0; + return ret; +} + +/* This function will poll the keyboard status register until either + * an expected value shows up, or + * timeout reaches. + * + * Returns: 0 -- the expected value has shown. + * 1 -- timeout reached. + */ +static int wait_for( + const unsigned int mask, + const unsigned int expected_value, + const int timeout, /* in usec */ + const char* error_message, + const char* function_name, + const int lineno +) { + int time_passed; + + for (time_passed = 0;; ++time_passed) { + if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value) + return 0; + if (time_passed >= timeout) + break; + programmer_delay(1); + } + if (error_message) + msg_perr("%s():%d %s", function_name, lineno, error_message); + return 1; +} + +/* IT8502 employs a scratch ram when flash is being updated. Call the following + * two functions before/after flash erase/program. */ +void it85xx_enter_scratch_rom() +{ + int ret; + int tries; + + msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__); + if (it85xx_scratch_rom_reenter > 0) return; + + /* FIXME: this a workaround for the bug that SMBus signal would + * interfere the EC firmware update. Should be removed if + * we find out the root cause. */ + ret = system("stop powerd >&2"); + if (ret) { + msg_perr("Cannot stop powerd.\n"); + } + + for (tries = 0; tries < MAX_TRY; ++tries) { + /* Wait until IBF (input buffer) is not full. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at waiting for IBF==0.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Copy EC firmware to SRAM. */ + OUTB(0xb4, LEGACY_KBC_PORT_CMD); + + /* Confirm EC has taken away the command. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at taking command.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Waiting for OBF (output buffer) has data. + * Note sometimes the replied command might be stolen by kernel + * ISR so that it is okay as long as the command is 0xFA. */ + if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0)) + msg_pdbg("%s():%d * timeout at waiting for OBF.\n", + __FUNCTION__, __LINE__); + if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) { + break; + } else { + msg_perr("%s():%d * not run on SRAM ret=%d\n", + __FUNCTION__, __LINE__, ret); + continue; + } + } + + if (tries < MAX_TRY) { + /* EC already runs on SRAM */ + it85xx_scratch_rom_reenter++; + msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__); + } else { + msg_perr("%s():%d * Max try reached.\n", + __FUNCTION__, __LINE__); + } +} + +void it85xx_exit_scratch_rom() +{ + int ret; + int tries; + + msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__); + if (it85xx_scratch_rom_reenter <= 0) return; + + for (tries = 0; tries < MAX_TRY; ++tries) { + /* Wait until IBF (input buffer) is not full. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at waiting for IBF==0.\n", + __FUNCTION__, __LINE__)) + continue; + + /* Exit SRAM. Run on flash. */ + OUTB(0xFE, LEGACY_KBC_PORT_CMD); + + /* Confirm EC has taken away the command. */ + if (wait_for(KB_IBF, 0, MAX_TIMEOUT, + "* timeout at taking command.\n", + __FUNCTION__, __LINE__)) { + /* We cannot ensure if EC has exited update mode. + * If EC is in normal mode already, a further 0xFE + * command will reboot system. So, exit loop here. */ + tries = MAX_TRY; + break; + } + + break; + } + + if (tries < MAX_TRY) { + it85xx_scratch_rom_reenter = 0; + msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__); + } else { + msg_perr("%s():%d * Max try reached.\n", + __FUNCTION__, __LINE__); + } + + /* FIXME: this a workaround for the bug that SMBus signal would + * interfere the EC firmware update. Should be removed if + * we find out the root cause. */ + ret = system("start powerd >&2"); + if (ret) { + msg_perr("Cannot start powerd again.\n"); + } +} + +int it85xx_spi_common_init(void) +{ + chipaddr base; + + msg_pdbg("%s():%d superio.vendor=0x%02x\n", __func__, __LINE__, + superio.vendor); + if (superio.vendor != SUPERIO_VENDOR_ITE) + return 1; + +#ifdef LPC_IO + /* Get LPCPNP of SHM. That's big-endian */ + sio_write(superio.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */ + shm_io_base = (sio_read(superio.port, SHM_IO_BAD0) << 8) + + sio_read(superio.port, SHM_IO_BAD1); + msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__, + shm_io_base); + + /* These pointers are not used directly. They will be send to EC's + * register for indirect access. */ + base = 0xFFFFF000; + ce_high = ((unsigned char*)base) + 0xE00; /* 0xFFFFFE00 */ + ce_low = ((unsigned char*)base) + 0xD00; /* 0xFFFFFD00 */ + + /* pre-set indirect-access registers since in most of cases they are + * 0xFFFFxx00. */ + INDIRECT_A0(shm_io_base, base & 0xFF); + INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF); + INDIRECT_A3(shm_io_base, (base >> 24)); +#endif +#ifdef LPC_MEMORY + base = (chipaddr)programmer_map_flash_region("flash base", 0xFFFFF000, + 0x1000); + msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__, + (unsigned int)base); + ce_high = (unsigned char*)(base + 0xE00); /* 0xFFFFFE00 */ + ce_low = (unsigned char*)(base + 0xD00); /* 0xFFFFFD00 */ +#endif + + /* Set this as spi controller. */ + spi_controller = SPI_CONTROLLER_IT85XX; + + return 0; +} + +/* Called by programmer_entry .init */ +int it85xx_spi_init(void) +{ + int ret; + + get_io_perms(); + /* Probe for the Super I/O chip and fill global struct superio. */ + probe_superio(); + ret = it85xx_spi_common_init(); + if (!ret) { + buses_supported = CHIP_BUSTYPE_SPI; + } else { + buses_supported = CHIP_BUSTYPE_NONE; + } + return ret; +} + +/* Called by internal_init() */ +int it85xx_probe_spi_flash(const char *name) +{ + int ret; + + if (!(buses_supported & CHIP_BUSTYPE_FWH)) { + msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__); + return 1; + } + ret = it85xx_spi_common_init(); + msg_pdbg("FWH: %s():%d ret=%d\n", __func__, __LINE__, ret); + if (!ret) { + msg_pdbg("%s():%d buses_supported=0x%x\n", __func__, __LINE__, + buses_supported); + if (buses_supported & CHIP_BUSTYPE_FWH) + msg_pdbg("Overriding chipset SPI with IT85 FWH|SPI.\n"); + buses_supported |= CHIP_BUSTYPE_FWH | CHIP_BUSTYPE_SPI; + } + return ret; +} + +int it85xx_shutdown(void) +{ + msg_pdbg("%s():%d\n", __func__, __LINE__); + it85xx_exit_scratch_rom(); + return 0; +} + +/* According to ITE 8502 document, the procedure to follow mode is following: + * 1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high) + * 2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI + * with data) + * 3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get + * data from MISO) + */ +int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr) +{ + int i; + + it85xx_enter_scratch_rom(); + /* exit scratch rom ONLY when programmer shuts down. Otherwise, the + * temporary flash state may halt EC. */ + +#ifdef LPC_IO + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); + INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_low) >> 8) & 0xff); +#endif +#ifdef LPC_MEMORY + *ce_high = 0; +#endif + for (i = 0; i < writecnt; ++i) { +#ifdef LPC_IO + INDIRECT_WRITE(shm_io_base, writearr[i]); +#endif +#ifdef LPC_MEMORY + *ce_low = writearr[i]; +#endif + } + for (i = 0; i < readcnt; ++i) { +#ifdef LPC_IO + readarr[i] = INDIRECT_READ(shm_io_base); +#endif +#ifdef LPC_MEMORY + readarr[i] = *ce_low; +#endif + } +#ifdef LPC_IO + INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); + INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ +#endif +#ifdef LPC_MEMORY + *ce_high = 0; +#endif + + return 0; +} + +#endif Index: flashrom-ec_it87_wpce775x/spi.c =================================================================== --- flashrom-ec_it87_wpce775x/spi.c (Revision 1234) +++ flashrom-ec_it87_wpce775x/spi.c (Arbeitskopie) @@ -55,6 +55,13 @@ .write_256 = ich_spi_write_256, }, + { /* SPI_CONTROLLER_IT85XX */ + .command = it85xx_spi_send_command, + .multicommand = default_spi_send_multicommand, + .read = ich_spi_read, + .write_256 = ich_spi_write_256, + }, + { /* SPI_CONTROLLER_IT87XX */ .command = it8716f_spi_send_command, .multicommand = default_spi_send_multicommand, @@ -89,6 +96,13 @@ .read = bitbang_spi_read, .write_256 = bitbang_spi_write_256, }, + + { /* SPI_CONTROLLER_WPCE775XX */ + .command = wpce775x_spi_send_command, + .multicommand = default_spi_send_multicommand, + .read = wpce775x_spi_read, + .write_256 = wpce775x_spi_write_256, + }, #endif #endif Index: flashrom-ec_it87_wpce775x/programmer.h =================================================================== --- flashrom-ec_it87_wpce775x/programmer.h (Revision 1234) +++ flashrom-ec_it87_wpce775x/programmer.h (Arbeitskopie) @@ -497,11 +497,13 @@ #if defined(__i386__) || defined(__x86_64__) SPI_CONTROLLER_ICH7, SPI_CONTROLLER_ICH9, + SPI_CONTROLLER_IT85XX, SPI_CONTROLLER_IT87XX, SPI_CONTROLLER_SB600, SPI_CONTROLLER_VIA, SPI_CONTROLLER_WBSIO, SPI_CONTROLLER_MCP6X_BITBANG, + SPI_CONTROLLER_WPCE775XX, #endif #endif #if CONFIG_FT2232_SPI == 1 @@ -554,6 +556,14 @@ int ich_spi_send_multicommand(struct spi_command *cmds); #endif +/* it85spi.c */ +struct superio probe_superio_ite85xx(void); +int it85xx_spi_init(void); +int it85xx_shutdown(void); +int it85xx_probe_spi_flash(const char *name); +int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr); + /* it87spi.c */ void enter_conf_mode_ite(uint16_t port); void exit_conf_mode_ite(uint16_t port); @@ -582,6 +592,14 @@ int wbsio_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); #endif +/* wpce775x.c */ +#if CONFIG_INTERNAL == 1 +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr); +#endif + /* serprog.c */ int serprog_init(void); int serprog_shutdown(void); -- http://www.hailfinger.org/

1 0

serprog SPI support
by Tim Schmidt 22 Nov '10

22 Nov '10

Hi, I'm looking for an Arduino firmware that supports writing to SPI flash devices from Flashrom. 'carldani' in #flashrom thought you might be able to help. Even if the code isn't quite working yet, I'm willing to take a look at it and see if I can help. --tim

2 1

[PATCH] Convert WPCE775X interface to flashrom style
by Carl-Daniel Hailfinger 22 Nov '10

22 Nov '10

This patch applies against the top of the flashrom-chromium tree. Compile tested only, I'd be surprised if stuff like write works. Probe and read may work, though. Convert WPCE775X interface to flashrom style. The current code had a fake flashchips.c entry for all chips behind a WPCE775X which is changed on the fly to the real chip data. This means that all relevant logic was duplicated, and the interface was not portable to the current upstream partial write infrastructure. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> diff --git a/flashchips.c b/flashchips.c index 8e95dd1..f7930a9 100644 --- a/flashchips.c +++ b/flashchips.c @@ -7745,22 +7745,5 @@ struct flashchip flashchips[] = { .write = NULL, }, - { - .vendor = "Nuvoton", - .name = "WPCE775x", - .bustype = CHIP_BUSTYPE_FWH, - .manufacture_id = GENERIC_MANUF_ID, - .model_id = GENERIC_DEVICE_ID, - .total_size = 2048, - .page_size = 256, - .tested = TEST_OK_PREW, - .probe = probe_wpce775x, - .probe_timing = TIMING_ZERO, - /* .block_erasers is generated according to detected flashchip. */ - .write = write_wpce775x, - .read = read_memmapped, - .wp = &wp_wpce775x, - }, - { NULL } }; diff --git a/programmer.h b/programmer.h index bbe24f9..40fe656 100644 --- a/programmer.h +++ b/programmer.h @@ -478,6 +478,7 @@ enum spi_controller { SPI_CONTROLLER_VIA, SPI_CONTROLLER_WBSIO, SPI_CONTROLLER_MCP6X_BITBANG, + SPI_CONTROLLER_WPCE775XX, #endif #endif #if CONFIG_FT2232_SPI == 1 @@ -563,6 +564,14 @@ int wbsio_spi_send_command(unsigned int writecnt, unsigned int readcnt, int wbsio_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); #endif +/* wpce775x.c */ +#if CONFIG_INTERNAL == 1 +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len); +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr); +#endif + /* serprog.c */ int serprog_init(void); int serprog_shutdown(void); diff --git a/spi.c b/spi.c index 9768bce..91cf615 100644 --- a/spi.c +++ b/spi.c @@ -95,6 +95,13 @@ const struct spi_programmer spi_programmer[] = { .read = bitbang_spi_read, .write_256 = bitbang_spi_write_256, }, + + { /* SPI_CONTROLLER_WPCE775XX */ + .command = wpce775x_spi_send_command, + .multicommand = default_spi_send_multicommand, + .read = wpce775x_spi_read, + .write_256 = wpce775x_spi_write_256, + }, #endif #endif diff --git a/wpce775x.c b/wpce775x.c index a659893..fe9c35a 100644 --- a/wpce775x.c +++ b/wpce775x.c @@ -2,6 +2,7 @@ * This file is part of the flashrom project. * * Copyright (C) 2010 Google, Inc. + * Copyright (C) 2010 Carl-Daniel Hailfinger * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -164,12 +165,13 @@ static int nuvoton_get_sio_index(uint16_t *port) /** Call superio to get pre-configured WCB address. * Read LDN 0x0f (SHM) idx:f8-fb (little-endian). */ -static int get_shaw2ba(chipaddr *shaw2ba) +static int get_shaw2ba(chipaddr *shaw2ba, uint8_t *comm_fwh) { uint16_t idx; uint8_t org_ldn; uint8_t win_cfg; uint8_t shm_cfg; + int ret = 0; if (nuvoton_get_sio_index(&idx) < 0) return -1; @@ -196,27 +198,40 @@ static int get_shaw2ba(chipaddr *shaw2ba) */ win_cfg = sio_read(idx, WPCE775X_WIN_CFG); if (win_cfg & WPCE775X_WIN_CFG_SHWIN_ACC) { - uint8_t idsel; - /* Make sure shared BIOS memory is enabled */ shm_cfg = sio_read(idx, WPCE775X_SHM_CFG); - if ((shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) - idsel = 0xf; - else { + if (!(shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) { msg_cdbg("Shared BIOS memory is diabled.\n"); msg_cdbg("Please check SHM_CFG:BIOS_FWH_EN.\n"); - goto error; + ret = -1; + goto out; } - - *shaw2ba &= 0x0fffffff; - *shaw2ba |= idsel << 28; + /* FIXME: Check that this is a FWH capable chipset. */ + *comm_fwh = 1; + /* Check if bit 24-27 are set. Intel ICH will never issue any + * LPC firmware memory (FWH) cycles with them cleared. + * FWH cycles only have 28 address bits. + */ + if ((*shaw2ba & (0xf << 24)) != 0xf << 24) { + msg_cerr("WPCE775X shadow window 2 is outside the " + "region addressable with FWH!\n"); + ret = -1; + goto out; + } + /* FWH cycles are only issued for memory mapped to the top + * 16 MB of the 4 GB address space. We could set only the top + * 4 bits since those are ignored by the WPCE775X and we checked + * bits 24-27 to be 0xf above, but setting the top 8 bits makes + * the 16 MB constraint more clear. + */ + *shaw2ba |= 0xff << 24; + } else { + *comm_fwh = 0; } - - sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); - return 0; -error: + +out: sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); - return -1; + return ret; } /* Call superio to get pre-configured fwh_id. @@ -232,7 +247,8 @@ static int get_fwh_id(uint8_t *fwh_id) org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); - *fwh_id = sio_read(idx, WPCE775X_SHM_CFG); + /* Upper 4 bits of WPCE775X_SHM_CFG store the FWH ID. */ + *fwh_id = sio_read(idx, WPCE775X_SHM_CFG) >> 4; sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); return 0; @@ -322,8 +338,8 @@ static int InitFlash(unsigned char srp) /* Byte 5: opcode for Write Status Enable JEDEC_EWSR defines 0x50, but W25Q16 - accepts 0x06 to enable write status */ - wcb->field[1] = 0x06; + accepts JEDEC_WREN to enable write status */ + wcb->field[1] = JEDEC_WREN; /* Byte 6: opcode for Write Enable */ wcb->field[2] = JEDEC_WREN; @@ -362,11 +378,10 @@ static int InitFlash(unsigned char srp) } /** Read flash vendor/device IDs through EC. - * @param id0, id1, id2, id3 Pointers to store detected IDs. NULL will be ignored. + * @param readarr 4-byte buffer for JEDEC_RDID response. * @return 1 for error; 0 for success. */ -static int ReadId(unsigned char* id0, unsigned char* id1, - unsigned char* id2, unsigned char* id3) +static int ReadId(unsigned char *readarr) { assert_ec_is_free(); @@ -374,42 +389,28 @@ static int ReadId(unsigned char* id0, unsigned char* id1, if (blocked_exec()) return 1; - msg_cdbg("id0: 0x%2x, id1: 0x%2x, id2: 0x%2x, id3: 0x%2x\n", - wcb->field[0], wcb->field[1], wcb->field[2], wcb->field[3]); - if (id0) { - *id0 = wcb->field[0]; - } - if (id1) { - *id1 = wcb->field[1]; - } - if (id2) { - *id2 = wcb->field[2]; - } - if (id3) { - *id3 = wcb->field[3]; - } + readarr[0] = wcb->field[0]; + readarr[1] = wcb->field[1]; + readarr[2] = wcb->field[2]; + readarr[3] = wcb->field[3]; return 0; } /** probe if WPCE775x is present. - * @return 0 for error; 1 for success + * @return 1 for error; 0 for success */ -int probe_wpce775x(struct flashchip *flash) +int wpce775x_init(void) { - unsigned char ids[4]; - unsigned long base; uint16_t sio_port; uint8_t srid; uint8_t fwh_id; - uint32_t size; - chipaddr original_memory; - uint32_t original_size; - int i; + uint8_t comm_fwh = 0; /* detect if wpce775x exists */ if (nuvoton_get_sio_index(&sio_port) < 0) { msg_cdbg("No Nuvoton chip is found.\n"); + /* No chip found is not an error. */ return 0; } srid = sio_read(sio_port, NUVOTON_SIOCFG_SRID); @@ -425,101 +426,51 @@ int probe_wpce775x(struct flashchip *flash) } /* get the address of Shadow Window 2. */ - if (get_shaw2ba(&wcb_physical_address) < 0) { + if (get_shaw2ba(&wcb_physical_address, &comm_fwh) < 0) { msg_cdbg("Cannot get the address of Shadow Window 2"); - return 0; + return 1; } msg_cdbg("Get the address of WCB(SHA WIN2) at 0x%08x\n", (uint32_t)wcb_physical_address); - wcb = (struct wpce775x_wcb *) - programmer_map_flash_region("WPCE775X WCB", + + /* If we use FWH for Shadow Window 2, we have to set FWH IDSEL in the + * chipset before we try to access Shadow Window 2. + */ + if (comm_fwh) { + if (get_fwh_id(&fwh_id) < 0) { + msg_cdbg("Cannot get fwh_id value.\n"); + return 1; + } + msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); + + /* TODO: set fwh_idsel of chipset. + * Currently, we employ "-p internal:fwh_idsel=0x0000223e". + */ + } + + wcb = (struct wpce775x_wcb *)physmap("WPCE775X WCB", wcb_physical_address, getpagesize() /* min page size */); msg_cdbg("mapped wcb address: %p for physical addr: 0x%08lx\n", wcb, wcb_physical_address); if (!wcb) { msg_perr("FATAL! Cannot map memory area for wcb physical address.\n"); - return 0; + return 1; } memset((void*)wcb, 0, sizeof(*wcb)); - if (get_fwh_id(&fwh_id) < 0) { - msg_cdbg("Cannot get fwh_id value.\n"); - return 0; - } - msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); - - /* TODO: set fwh_idsel of chipset. - Currently, we employ "-p internal:fwh_idsel=0x0000223e". */ - /* Initialize the parameters of EC SHM component */ if (InitFlash(0x00)) - return 0; - - /* Query the flash vendor/device ID */ - if (ReadId(&ids[0], &ids[1], &ids[2], &ids[3])) - return 0; - - /* In current design, flash->virtual_memory is mapped before calling flash->probe(). - * So that we have to update flash->virtual_memory after we know real flash size. - * Unmap allocated memory before allocate new memory. */ - original_size = flash->total_size * 1024; /* original flash size */ - original_memory = flash->virtual_memory; - - for (scan = &flashchips[0]; scan && scan->name; scan++) { - if (!(scan->bustype & CHIP_BUSTYPE_SPI)) { - msg_cdbg("WPCE775x: %s bustype supports no SPI: %s\n", - scan->name, flashbuses_to_text(scan->bustype)); - continue; - } - if ((scan->manufacture_id != GENERIC_MANUF_ID) && - (scan->manufacture_id != ids[0])) { - msg_cdbg("WPCE775x: %s manufacture_id does not match: 0x%02x\n", - scan->name, scan->manufacture_id); - continue; - } - if ((scan->model_id != GENERIC_DEVICE_ID) && - (scan->model_id != ((ids[1]<<8)|ids[2]))) { - msg_cdbg("WPCE775x: %s model_id does not match: 0x%02x\n", - scan->name, scan->model_id); - continue; - } - - msg_cdbg("WPCE775x: found the flashchip %s.\n", scan->name); - - /* Copy neccesary information */ - flash->total_size = scan->total_size; - flash->page_size = scan->page_size; - memcpy(flash->block_erasers, scan->block_erasers, - sizeof(scan->block_erasers)); - /* .block_erase is pointed to EC-specific way. */ - for (i = 0; i < NUM_ERASEFUNCTIONS; ++i) - flash->block_erasers[i].block_erase = erase_wpce775x; - break; - } - if (!scan || !scan->name) { - msg_cdbg("WPCE775x: cannot recognize the flashchip.\n"); - scan = 0; /* since scan is a global variable, reset pointer - * to indicate nothing was detected */ - return 0; - } - - /* Unmap allocated memory before allocate new memory. */ - programmer_unmap_flash_region((void*)original_memory, original_size); - - /* In current design, flash->virtual_memory is mapped before calling flash->probe(). - * So that we have to update flash->virtual_memory after we know real flash size. - * Map new virtual address here. */ - size = flash->total_size * 1024; /* new flash size */ - base = 0xffffffff - size + 1; - flash->virtual_memory = (chipaddr)programmer_map_flash_region("flash chip", base, size); - msg_cdbg("Remap memory to 0x%08lx from base: 0x%08lx size=0x%08lx\n", - flash->virtual_memory, base, (long unsigned int)size); + return 1; - return 1; + if (buses_supported & CHIP_BUSTYPE_SPI) + msg_pdbg("Overriding chipset SPI with WPCE775x SPI.\n"); + spi_controller = SPI_CONTROLLER_WPCE775XX; + buses_supported |= CHIP_BUSTYPE_SPI; + return 0; } /** Tell EC to "enter flash update" mode. */ -int EnterFlashUpdate(void) +static int EnterFlashUpdate(void) { if (in_flash_update_mode) { /* already in update mode */ @@ -544,7 +495,7 @@ int EnterFlashUpdate(void) * Without calling this function, the EC stays in busy-loop and will not * response further request from host, which means system will halt. */ -int ExitFlashUpdate(unsigned char exit_code) +static int ExitFlashUpdate(unsigned char exit_code) { if (in_flash_update_mode <= 0) { msg_cdbg("Not in flash update mode yet.\n"); @@ -571,62 +522,56 @@ int ExitFlashUpdate(unsigned char exit_code) * 0x20 is used for EC F/W no change, but BIOS changed (in Share mode) * 0x21 is used for EC F/W changed. Goto EC F/W, wait system reboot. * 0x22 is used for EC F/W changed, Goto EC Watchdog reset. */ -int ExitFlashUpdateFirmwareNoChange(void) { +static int ExitFlashUpdateFirmwareNoChange(void) { return ExitFlashUpdate(0x20); } -int ExitFlashUpdateFirmwareChanged(void) { +static int ExitFlashUpdateFirmwareChanged(void) { return ExitFlashUpdate(0x21); } -int erase_wpce775x(struct flashchip *flash, unsigned int blockaddr, unsigned int blocklen) +static int wpce775x_set_write_window(unsigned int base, unsigned int size) { assert_ec_is_free(); /* Set Write Window on flash chip (optional). * You may limit the window to partial flash for experimental. */ wcb->code = 0xC5; /* Set Write Window */ - wcb->field[0] = 0x00; /* window base: little-endian */ - wcb->field[1] = 0x00; - wcb->field[2] = 0x00; - wcb->field[3] = 0x00; - wcb->field[4] = 0x00; /* window length: little-endian */ - wcb->field[5] = 0x00; - wcb->field[6] = 0x20; - wcb->field[7] = 0x00; + wcb->field[0] = base & 0xff; /* window base: little-endian */ + wcb->field[1] = (base >> 8) & 0xff; + wcb->field[2] = (base >> 16) & 0xff; + wcb->field[3] = (base >> 24) & 0xff; + wcb->field[4] = size & 0xff; /* window length: little-endian */ + wcb->field[5] = (size >> 8) & 0xff; + wcb->field[6] = (size >> 16) & 0xff; + wcb->field[7] = (size >> 24) & 0xff; if (blocked_exec()) return 1; + return 0; +} - /* TODO: here assume block sizes are identical. The right way is to traverse - * block_erasers[] and find out the corresponding block size. */ - unsigned int block_size = flash->block_erasers[0].eraseblocks[0].size; - unsigned int current; - - msg_cdbg("Erasing ... 0x%08x 0x%08x\n", blockaddr, blocklen); +static int handle_erase_wpce775x(unsigned int blockaddr) +{ + /* FIXME: A 2 MByte window is too small. */ + if (wpce775x_set_write_window(0x0, 0x200000)) + return 1; - if (EnterFlashUpdate()) return 1; + assert_ec_is_free(); - for (current = 0; - current < blocklen; - current += block_size) { - wcb->code = 0x80; /* Sector/block erase */ - - /* WARNING: assume the block address for EC is lalways little-endian. */ - unsigned int addr = blockaddr + current; - wcb->field[0] = addr & 0xff; - wcb->field[1] = (addr >> 8) & 0xff; - wcb->field[2] = (addr >> 16) & 0xff; - wcb->field[3] = (addr >> 24) & 0xff; - if (blocked_exec()) - goto error_exit; - } + if (EnterFlashUpdate()) + return 1; - if (ExitFlashUpdateFirmwareChanged()) return 1; + wcb->code = 0x80; /* Sector/block erase */ + /* WARNING: assume the block address for EC is always little-endian. */ + wcb->field[0] = blockaddr & 0xff; + wcb->field[1] = (blockaddr >> 8) & 0xff; + wcb->field[2] = (blockaddr >> 16) & 0xff; + wcb->field[3] = (blockaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; - if (check_erased_range(flash, blockaddr, blocklen)) { - msg_perr("ERASE FAILED!\n"); + if (ExitFlashUpdateFirmwareChanged()) return 1; - } return 0; @@ -635,55 +580,37 @@ error_exit: return 1; } -/** Callback function for do_romentries(). - * @flash - point to flash info - * @buf - the address of buffer - * @addr - the start offset in buffer - * @len - length to write (start from @addr) +/** + * Page write helper */ -int write_wpce775x_entry(struct flashchip *flash, uint8_t *buf, - const chipaddr addr, size_t len) +static int write_wpce775x_entry(unsigned long writeaddr, unsigned long writelen, const unsigned char *buf) { - chipaddr current; - unsigned int block_size = flash->block_erasers[0].eraseblocks[0].size; - unsigned int bytes_until_next_block; - unsigned int written = 0; + if (writelen > 8) { + msg_perr("WTF did you call %s with writelen=%li\n", __func__, writelen); + return 1; + } - msg_cdbg("Writing ... 0x%08lx 0x%08lx\n", (long unsigned int)addr, - (long unsigned int)len); + /* FIXME: assert_ec_is_free() missing? */ + if (EnterFlashUpdate()) + return 1; - if (EnterFlashUpdate()) return 1; - for (current = addr; - current < addr + len; - current += written/* maximum program buffer */) { - /* erase sector before write it. */ - if ((current & (block_size-1))==0) { - if (erase_wpce775x(flash, current, block_size)) - goto error_exit; - } + /* wpce775x provides a 8-byte program buffer. */ + wcb->code = 0xA0; /* Set Address */ + wcb->field[0] = writeaddr & 0xff; + wcb->field[1] = (writeaddr >> 8) & 0xff; + wcb->field[2] = (writeaddr >> 16) & 0xff; + wcb->field[3] = (writeaddr >> 24) & 0xff; + if (blocked_exec()) + goto error_exit; - /* wpce775x provides a 8-byte program buffer. */ - wcb->code = 0xA0; /* Set Address */ - wcb->field[0] = current & 0xff; - wcb->field[1] = (current >> 8) & 0xff; - wcb->field[2] = (current >> 16) & 0xff; - wcb->field[3] = (current >> 24) & 0xff; - if (blocked_exec()) - goto error_exit; - - bytes_until_next_block = block_size - (current % block_size); - if (bytes_until_next_block > 0 && bytes_until_next_block < 8) - written = bytes_until_next_block; - else - written = 8; /* maximum buffer size */ - wcb->code = 0xB0 | written; - int i; - for (i = 0; i < written; i++) { - wcb->field[i] = buf[current + i]; - } - if (blocked_exec()) - goto error_exit; + /* 8 is maximum buffer size */ + wcb->code = 0xB0 | writelen; + int i; + for (i = 0; i < writelen; i++) { + wcb->field[i] = buf[i]; } + if (blocked_exec()) + goto error_exit; if (ExitFlashUpdateFirmwareChanged()) return 1; return 0; @@ -693,40 +620,11 @@ error_exit: return 1; } -/** Write data to flash (layout supported). - * In some cases, EC and BIOS share a physical flash chip. So it is dangerous - * to erase whole flash chip when you only wanna update BIOS image. - * By calling do_romentries(), we won't erase/program those blocks/sectors - * not specified by -i parameter. - */ -int write_wpce775x(struct flashchip *flash, uint8_t * buf) -{ - return do_romentries(buf, flash, write_wpce775x_entry); -} - -int set_range_wpce775x(struct flashchip *flash, unsigned int start, unsigned int len) { - struct w25q_status status; - - if (w25_range_to_status(scan, start, len, &status)) return -1; - - /* Since WPCE775x doesn't support reading status register, we have to - * set SRP0 to 1 when writing status register. */ - status.srp0 = 1; - - msg_cdbg("Going to set: 0x%02x\n", *((unsigned char*)&status)); - msg_cdbg("status.busy: %x\n", status.busy); - msg_cdbg("status.wel: %x\n", status.wel); - msg_cdbg("status.bp0: %x\n", status.bp0); - msg_cdbg("status.bp1: %x\n", status.bp1); - msg_cdbg("status.bp2: %x\n", status.bp2); - msg_cdbg("status.tb: %x\n", status.tb); - msg_cdbg("status.sec: %x\n", status.sec); - msg_cdbg("status.srp0: %x\n", status.srp0); - +static int wpce775x_wrsr(const unsigned char status) { /* InitFlash (with particular status value), and EnterFlashUpdate() then * ExitFlashUpdate() immediately. Thus, the flash status register will * be updated. */ - if (InitFlash(*(unsigned char*)&status)) + if (InitFlash(status)) return -1; if (EnterFlashUpdate()) return 1; ExitFlashUpdateFirmwareNoChange(); @@ -734,14 +632,59 @@ int set_range_wpce775x(struct flashchip *flash, unsigned int start, unsigned int return 0; } -static int enable_wpce775x(struct flashchip *flash) +int wpce775x_spi_send_command(unsigned int writecnt, unsigned int readcnt, + const unsigned char *writearr, unsigned char *readarr) { - msg_cdbg("WPCE775x always sets SRP0 in set_range_wpce775x()\n"); - return 0; + unsigned char ids[4]; + unsigned int addr = 0; + + /* Ugly hack. Not my fault. -- Carl-Daniel */ + switch(writearr[0]) { + case JEDEC_RDID: + /* We always read 4 ID bytes. Return only the wanted parts. */ + if (ReadId(ids)) + return 1; + memcpy(readarr, ids, min(readcnt, 4)); + break; + case JEDEC_BYTE_PROGRAM: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (write_wpce775x_entry(addr, writecnt - 4, writearr + 4)) + return 1; + break; + case JEDEC_SE: + /* FIXME: Precedence! */ + addr = writearr[1] << 16 | writearr[2] << 8 | writearr[3]; + if (handle_erase_wpce775x(addr)) + return 1; + break; + case JEDEC_WRSR: + if (wpce775x_wrsr(writearr[1])) + return 1; + break; + case JEDEC_WREN: + case JEDEC_RDSR: + default: + msg_perr("You are truly screwed. This command is not " + "implemented (yet)\n"); + return 1; + } + return 0; } +/* FIXME: This command is not implemented. We have to use read_memmapped, but + * the mapping window is too small for reasonably sized chips. + */ +int wpce775x_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + if (flash->total_size * 1024 > 2 * 1024 * 1024) { + msg_perr("Chip is too big for reading on wpce775x.\n"); + return 1; + } + return read_memmapped(flash, buf, start, len); +} -struct wp wp_wpce775x = { - .set_range = set_range_wpce775x, - .enable = enable_wpce775x, -}; +int wpce775x_spi_write_256(struct flashchip *flash, uint8_t *buf, int start, int len) +{ + return spi_write_chunked(flash, buf, start, len, 8); +} -- http://www.hailfinger.org/

1 0

Success report: Tyan S2466 (Tiger MPX)
by Uwe Hermann 22 Nov '10

22 Nov '10

I successfully tested write/erase on Tyan S2466 (Tiger MPX). http://www.tyan.com/archive/products/html/tigermpx.html Logs attached. Uwe. -- http://hermann-uwe.de | http://sigrok.org http://randomprojects.org | http://unmaintained-free-software.org

1 0

the missing attachment
by Xhuman 21 Nov '10

21 Nov '10

goddamnit- forgot to 'save' the pasted output. *i think* in caso, tenga esta.

1 0

another hot-swapped winbond dip8
by Xhuman 21 Nov '10

21 Nov '10

latest (as of 11.20.10) svn/git checkout of flashrom. success with 3 different dip8 bios(es?) w/ same MoBo (i guess as long as bios dip p/o were the same, it would work??.) here's the terminal output, in case it is of help- side note, i applied the latest(?) nvidia chipset patch to the svn source and got an error during the make/install command- applied patch via quilt gui, and the error was for the module for which the patch was made - ie. it just didn't build the 'nvidiaXXy.o' -just popped the patch (and a glass pirate eye fell out) and did a make distclean (what ever happened to Mr. Proper?) and everything built fine. again, amidst my 'i've been up for two days trying to recover my Fuckdo$e 7 box psychotic ramblings', thanks for your work. if my email seems hard to follow, that's because it is. it must suck to be on the receiving end of my corrospodence (sp) . i read too much burroughs and artaud during my younger days- my writing abilities are pretty much fucked-for-a-while at this point. as far as testing, if you want/need/etc, i will include output from flashrom commands as i try them on other (people's) boards. (i help out the relatives across the street with computer *repair*. many people (unknowingly) have sacrificed $100's worth of machines in the name of my education, and i am a bold, and hell of a curious motherfucker. especially when it comes to flashing chipsets (i have a decent pile of linksys hope!ess!y bricked routers from my jtag study course, and i'm ready to add some motherboards to the trophy pile. i love flashing chips, bios, and children- especially when it's really 'iffy' and the likelyhood is high that i'll have to make up a diagnostic lie as to why customer's comps are now parts and paperweights)

1 0

(yes, it is in all caps) THANK YOU!! (repeat adementia)
by Xhuman 20 Nov '10

20 Nov '10

yes, thank you jesus for you, your whole family, and every seed of your loins! i am writing this before setting my *initial* bios settings because i am sofa king happy that your program worked!! i swear, i'd donate a kidney or two to you about right now!! i actually hot-swapped two AMI bios (8pin dip) and flashed them. my first board i screwed the bios by playing around with a bios edit prog, the second, i bought last week since it had 8pin dip bios, figured i could use it to reflash the bad one, and have an extra board. but, my phenom ii x4 (965 black ed-) runs at 140w, and the new mobo kept shutting down stating (the obvious) that my cpu was running over ~125 watts, so i couldn't use it to flash the old bios, but i hadn't noticed that my linux box had an 8pin dip bios also, until i was playing around with a lpt 25 pin header (for jtag), so i updated the 'you're over 125w' bios as well as flashed the original bios mistake/lesson i had. so all from linux desktop! quite nice! i'll send attachments of my mobo/chipset info for you with this, but i didn't run the commands with -V nor did i save the output. i tend to read the instructions after the fact..(why i ended up with the bios problem in the first place) so again, thanks, and EXCELLENT work!!!!!!!!!!

1 0

Support for Nvidia chips
by Joe Pea 20 Nov '10

20 Nov '10

I tried flashrom and it said there's no support for my chip :( This is the output of flashrom -V: flashrom v0.9.2-r1001 on Linux 2.6.35-ARCH (x86_64), built with libpci 3.1.7, GCC 4.5.0 20100520 (prerelease) flashrom is free software, get the source code at http://www.flashrom.org Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "BIOSTAR Group" DMI string system-product-name: "N61PB-M2S" DMI string system-version: " " DMI string baseboard-manufacturer: "BIOSTAR Group" DMI string baseboard-product-name: "N61PB-M2S" DMI string baseboard-version: " " DMI string chassis-type: "Desktop" Found ITE Super I/O, id 8716 Found chipset "NVIDIA MCP61", enabling flash write... This chipset is not really supported yet. Guesswork... ISA/LPC bridge reg 0x8a contents: 0x40, bit 6 is 1, bit 5 is 0 Guessed flash bus type is SPI Found SMBus device 10de:03eb at 00:01:1 SPI BAR is at 0xfec80000, after clearing low bits BAR is at 0xfec80000 SPI control is 0x000a, enable=0, idle=0 Please send the output of "flashrom -V" to flashrom(a)flashrom.org to help us finish support for your chipset. Thanks. SPI on this chipset is not supported yet. OK. This chipset supports the following protocols: None. No IT87* serial flash segment enabled. Calibrating delay loop... 1454M loops per second, 10 myus = 10 us, 100 myus = 102 us, 1000 myus = 1010 us, 10000 myus = 10017 us, OK. Probing for AMD Am29F010A/B, 128 KB: skipped. Probing for AMD Am29F002(N)BB, 256 KB: skipped. Probing for AMD Am29F002(N)BT, 256 KB: skipped. Probing for AMD Am29F016D, 2048 KB: skipped. Probing for AMD Am29F040B, 512 KB: skipped. Probing for AMD Am29F080B, 1024 KB: skipped. Probing for AMD Am29LV040B, 512 KB: skipped. Probing for AMD Am29LV081B, 1024 KB: skipped. Probing for ASD AE49F2008, 256 KB: skipped. Probing for Atmel AT25DF021, 256 KB: skipped. Probing for Atmel AT25DF041A, 512 KB: skipped. Probing for Atmel AT25DF081, 1024 KB: skipped. Probing for Atmel AT25DF161, 2048 KB: skipped. Probing for Atmel AT25DF321, 4096 KB: skipped. Probing for Atmel AT25DF321A, 4096 KB: skipped. Probing for Atmel AT25DF641, 8192 KB: skipped. Probing for Atmel AT25F512B, 64 KB: skipped. Probing for Atmel AT25FS010, 128 KB: skipped. Probing for Atmel AT25FS040, 512 KB: skipped. Probing for Atmel AT26DF041, 512 KB: skipped. Probing for Atmel AT26DF081A, 1024 KB: skipped. Probing for Atmel AT26DF161, 2048 KB: skipped. Probing for Atmel AT26DF161A, 2048 KB: skipped. Probing for Atmel AT26F004, 512 KB: skipped. Probing for Atmel AT29C512, 64 KB: skipped. Probing for Atmel AT29C010A, 128 KB: skipped. Probing for Atmel AT29C020, 256 KB: skipped. Probing for Atmel AT29C040A, 512 KB: skipped. Probing for Atmel AT45CS1282, 16896 KB: skipped. Probing for Atmel AT45DB011D, 128 KB: skipped. Probing for Atmel AT45DB021D, 256 KB: skipped. Probing for Atmel AT45DB041D, 512 KB: skipped. Probing for Atmel AT45DB081D, 1024 KB: skipped. Probing for Atmel AT45DB161D, 2048 KB: skipped. Probing for Atmel AT45DB321C, 4224 KB: skipped. Probing for Atmel AT45DB321D, 4096 KB: skipped. Probing for Atmel AT45DB642D, 8192 KB: skipped. Probing for Atmel AT49BV512, 64 KB: skipped. Probing for Atmel AT49F002(N), 256 KB: skipped. Probing for Atmel AT49F002(N)T, 256 KB: skipped. Probing for AMIC A25L40PT, 512 KB: skipped. Probing for AMIC A25L40PU, 512 KB: skipped. Probing for AMIC A29002B, 256 KB: skipped. Probing for AMIC A29002T, 256 KB: skipped. Probing for AMIC A29040B, 512 KB: skipped. Probing for AMIC A49LF040A, 512 KB: skipped. Probing for EMST F49B002UA, 256 KB: skipped. Probing for Eon EN25B05, 64 KB: skipped. Probing for Eon EN25B05T, 64 KB: skipped. Probing for Eon EN25B10, 128 KB: skipped. Probing for Eon EN25B10T, 128 KB: skipped. Probing for Eon EN25B20, 256 KB: skipped. Probing for Eon EN25B20T, 256 KB: skipped. Probing for Eon EN25B40, 512 KB: skipped. Probing for Eon EN25B40T, 512 KB: skipped. Probing for Eon EN25B80, 1024 KB: skipped. Probing for Eon EN25B80T, 1024 KB: skipped. Probing for Eon EN25B16, 2048 KB: skipped. Probing for Eon EN25B16T, 2048 KB: skipped. Probing for Eon EN25B32, 4096 KB: skipped. Probing for Eon EN25B32T, 4096 KB: skipped. Probing for Eon EN25B64, 8192 KB: skipped. Probing for Eon EN25B64T, 8192 KB: skipped. Probing for Eon EN25D16, 2048 KB: skipped. Probing for Eon EN25F05, 64 KB: skipped. Probing for Eon EN25F10, 128 KB: skipped. Probing for Eon EN25F20, 256 KB: skipped. Probing for Eon EN25F40, 512 KB: skipped. Probing for Eon EN25F80, 1024 KB: skipped. Probing for Eon EN25F16, 2048 KB: skipped. Probing for Eon EN25F32, 4096 KB: skipped. Probing for Eon EN29F010, 128 KB: skipped. Probing for EON EN29F002(A)(N)B, 256 KB: skipped. Probing for EON EN29F002(A)(N)T, 256 KB: skipped. Probing for Fujitsu MBM29F004BC, 512 KB: skipped. Probing for Fujitsu MBM29F004TC, 512 KB: skipped. Probing for Fujitsu MBM29F400BC, 512 KB: skipped. Probing for Fujitsu MBM29F400TC, 512 KB: skipped. Probing for Intel 28F001BX-B, 128 KB: skipped. Probing for Intel 28F001BX-T, 128 KB: skipped. Probing for Intel 28F004S5, 512 KB: skipped. Probing for Intel 28F004BV/BE-B, 512 KB: skipped. Probing for Intel 28F004BV/BE-T, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-B, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-T, 512 KB: skipped. Probing for Intel 82802AB, 512 KB: skipped. Probing for Intel 82802AC, 1024 KB: skipped. Probing for Macronix MX25L512, 64 KB: skipped. Probing for Macronix MX25L1005, 128 KB: skipped. Probing for Macronix MX25L2005, 256 KB: skipped. Probing for Macronix MX25L4005, 512 KB: skipped. Probing for Macronix MX25L8005, 1024 KB: skipped. Probing for Macronix MX25L1605, 2048 KB: skipped. Probing for Macronix MX25L1635D, 2048 KB: skipped. Probing for Macronix MX25L3205, 4096 KB: skipped. Probing for Macronix MX25L3235D, 4096 KB: skipped. Probing for Macronix MX25L6405, 8192 KB: skipped. Probing for Macronix MX25L12805, 16384 KB: skipped. Probing for Macronix MX29F001B, 128 KB: skipped. Probing for Macronix MX29F001T, 128 KB: skipped. Probing for Macronix MX29F002B, 256 KB: skipped. Probing for Macronix MX29F002T, 256 KB: skipped. Probing for Macronix MX29LV040, 512 KB: skipped. Probing for Numonyx M25PE10, 128 KB: skipped. Probing for Numonyx M25PE20, 256 KB: skipped. Probing for Numonyx M25PE40, 512 KB: skipped. Probing for Numonyx M25PE80, 1024 KB: skipped. Probing for Numonyx M25PE16, 2048 KB: skipped. Probing for PMC Pm25LV010, 128 KB: skipped. Probing for PMC Pm25LV016B, 2048 KB: skipped. Probing for PMC Pm25LV020, 256 KB: skipped. Probing for PMC Pm25LV040, 512 KB: skipped. Probing for PMC Pm25LV080B, 1024 KB: skipped. Probing for PMC Pm25LV512, 64 KB: skipped. Probing for PMC Pm29F002T, 256 KB: skipped. Probing for PMC Pm29F002B, 256 KB: skipped. Probing for PMC Pm39LV010, 128 KB: skipped. Probing for PMC Pm39LV020, 256 KB: skipped. Probing for PMC Pm39LV040, 512 KB: skipped. Probing for PMC Pm49FL002, 256 KB: skipped. Probing for PMC Pm49FL004, 512 KB: skipped. Probing for Sanyo LF25FW203A, 2048 KB: skipped. Probing for Sharp LHF00L04, 1024 KB: skipped. Probing for Spansion S25FL008A, 1024 KB: skipped. Probing for Spansion S25FL016A, 2048 KB: skipped. Probing for SST SST25VF016B, 2048 KB: skipped. Probing for SST SST25VF032B, 4096 KB: skipped. Probing for SST SST25VF040.REMS, 512 KB: skipped. Probing for SST SST25VF040B, 512 KB: skipped. Probing for SST SST25VF040B.REMS, 512 KB: skipped. Probing for SST SST25VF080B, 1024 KB: skipped. Probing for SST SST28SF040A, 512 KB: skipped. Probing for SST SST29EE010, 128 KB: skipped. Probing for SST SST29LE010, 128 KB: skipped. Probing for SST SST29EE020A, 256 KB: skipped. Probing for SST SST29LE020, 256 KB: skipped. Probing for SST SST39SF512, 64 KB: skipped. Probing for SST SST39SF010A, 128 KB: skipped. Probing for SST SST39SF020A, 256 KB: skipped. Probing for SST SST39SF040, 512 KB: skipped. Probing for SST SST39VF512, 64 KB: skipped. Probing for SST SST39VF010, 128 KB: skipped. Probing for SST SST39VF020, 256 KB: skipped. Probing for SST SST39VF040, 512 KB: skipped. Probing for SST SST39VF080, 1024 KB: skipped. Probing for SST SST49LF002A/B, 256 KB: skipped. Probing for SST SST49LF003A/B, 384 KB: skipped. Probing for SST SST49LF004A/B, 512 KB: skipped. Probing for SST SST49LF004C, 512 KB: skipped. Probing for SST SST49LF008A, 1024 KB: skipped. Probing for SST SST49LF008C, 1024 KB: skipped. Probing for SST SST49LF016C, 2048 KB: skipped. Probing for SST SST49LF020, 256 KB: skipped. Probing for SST SST49LF020A, 256 KB: skipped. Probing for SST SST49LF040, 512 KB: skipped. Probing for SST SST49LF040B, 512 KB: skipped. Probing for SST SST49LF080A, 1024 KB: skipped. Probing for SST SST49LF160C, 2048 KB: skipped. Probing for ST M25P05-A, 64 KB: skipped. Probing for ST M25P05.RES, 64 KB: skipped. Probing for ST M25P10-A, 128 KB: skipped. Probing for ST M25P10.RES, 128 KB: skipped. Probing for ST M25P20, 256 KB: skipped. Probing for ST M25P40, 512 KB: skipped. Probing for ST M25P40-old, 512 KB: skipped. Probing for ST M25P80, 1024 KB: skipped. Probing for ST M25P16, 2048 KB: skipped. Probing for ST M25P32, 4096 KB: skipped. Probing for ST M25P64, 8192 KB: skipped. Probing for ST M25P128, 16384 KB: skipped. Probing for ST M29F002B, 256 KB: skipped. Probing for ST M29F002T/NT, 256 KB: skipped. Probing for ST M29F040B, 512 KB: skipped. Probing for ST M29F400BT, 512 KB: skipped. Probing for ST M29W010B, 128 KB: skipped. Probing for ST M29W040B, 512 KB: skipped. Probing for ST M29W512B, 64 KB: skipped. Probing for ST M50FLW040A, 512 KB: skipped. Probing for ST M50FLW040B, 512 KB: skipped. Probing for ST M50FLW080A, 1024 KB: skipped. Probing for ST M50FLW080B, 1024 KB: skipped. Probing for ST M50FW002, 256 KB: skipped. Probing for ST M50FW016, 2048 KB: skipped. Probing for ST M50FW040, 512 KB: skipped. Probing for ST M50FW080, 1024 KB: skipped. Probing for ST M50LPW116, 2048 KB: skipped. Probing for SyncMOS S29C31004T, 512 KB: skipped. Probing for SyncMOS S29C51001T, 128 KB: skipped. Probing for SyncMOS S29C51002T, 256 KB: skipped. Probing for SyncMOS S29C51004T, 512 KB: skipped. Probing for TI TMS29F002RB, 256 KB: skipped. Probing for TI TMS29F002RT, 256 KB: skipped. Probing for Winbond W25Q80, 1024 KB: skipped. Probing for Winbond W25Q16, 2048 KB: skipped. Probing for Winbond W25Q32, 4096 KB: skipped. Probing for Winbond W25x10, 128 KB: skipped. Probing for Winbond W25x20, 256 KB: skipped. Probing for Winbond W25x40, 512 KB: skipped. Probing for Winbond W25x80, 1024 KB: skipped. Probing for Winbond W25x16, 2048 KB: skipped. Probing for Winbond W25x32, 4096 KB: skipped. Probing for Winbond W25x64, 8192 KB: skipped. Probing for Winbond W29C011, 128 KB: skipped. Probing for Winbond W29C020C, 256 KB: skipped. Probing for Winbond W29C040P, 512 KB: skipped. Probing for Winbond W29EE011, 128 KB: skipped. Probing for Winbond W39V040A, 512 KB: skipped. Probing for Winbond W39V040B, 512 KB: skipped. Probing for Winbond W39V040C, 512 KB: skipped. Probing for Winbond W39V040FA, 512 KB: skipped. Probing for Winbond W39V080A, 1024 KB: skipped. Probing for Winbond W49F002U, 256 KB: skipped. Probing for Winbond W49V002A, 256 KB: skipped. Probing for Winbond W49V002FA, 256 KB: skipped. Probing for Winbond W39V080FA, 1024 KB: skipped. Probing for Winbond W39V080FA (dual mode), 512 KB: skipped. Probing for Atmel unknown Atmel SPI chip, 0 KB: skipped. Probing for EON unknown EON SPI chip, 0 KB: skipped. Probing for Macronix unknown Macronix SPI chip, 0 KB: skipped. Probing for PMC unknown PMC SPI chip, 0 KB: skipped. Probing for SST unknown SST SPI chip, 0 KB: skipped. Probing for ST unknown ST SPI chip, 0 KB: skipped. Probing for Sanyo unknown Sanyo SPI chip, 0 KB: skipped. Probing for Generic unknown SPI chip (RDID), 0 KB: skipped. Probing for Generic unknown SPI chip (REMS), 0 KB: skipped. No EEPROM/flash device found. Note: flashrom can never write if the flash chip isn't found automatically. Can we get it working? -= Joe Pea =-

2 1

Breaking the assumption that filesize == romsize
by Richard Smith 18 Nov '10

18 Nov '10

Current flashrom forces that the loaded filesize must equal the romsize. If you are using an external programmer then this may not be true. How deeply wired is this assumption? I'd like to bypass those checks it if the -p option is used. -- Richard A. Smith

4 5

[PATCH 0/5] ft2232_spi: OpenMoko DebugBoard support
by Alex Badea 18 Nov '10

18 Nov '10

Hi, This patch series adds support for the OpenMoko DebugBoard V2+, which is based on the FT2232D. A few fixes were required to make it work. Any feedback is greatly appreciated, this is my first contribution to flashrom. Thanks. Alex Badea (5): ft2232_spi: don't hardcode USB VID ft2232_spi: add support for the OpenMoko DebugBoard V2+ ft2232_spi: allow CLOCK_X5 to be set at runtime ft2232_spi: retry short reads ft2232_spi: flag OpenMoko DebugBoard as tested ft2232_spi.c | 67 ++++++++++++++++++++++++++++++++++++++-------------------- 1 files changed, 44 insertions(+), 23 deletions(-)

3 16

[PATCH] Fix IDSEL handling in WPCE775X
by Carl-Daniel Hailfinger 17 Nov '10

17 Nov '10

Fix IDSEL handling in WPCE775X. - Clean up the code - Check that SHM window 2 is reachable if FWH communication is used - IDSEL is 4 bits, use a mask to extract it correctly - IDSEL setup needs to happen before SHM window 2 is accessed if FWH communication is used Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> diff --git a/wpce775x.c b/wpce775x.c index a659893..1407977 100644 --- a/wpce775x.c +++ b/wpce775x.c @@ -164,12 +164,13 @@ static int nuvoton_get_sio_index(uint16_t *port) /** Call superio to get pre-configured WCB address. * Read LDN 0x0f (SHM) idx:f8-fb (little-endian). */ -static int get_shaw2ba(chipaddr *shaw2ba) +static int get_shaw2ba(chipaddr *shaw2ba, uint8_t *comm_fwh) { uint16_t idx; uint8_t org_ldn; uint8_t win_cfg; uint8_t shm_cfg; + int ret = 0; if (nuvoton_get_sio_index(&idx) < 0) return -1; @@ -196,27 +197,40 @@ static int get_shaw2ba(chipaddr *shaw2ba) */ win_cfg = sio_read(idx, WPCE775X_WIN_CFG); if (win_cfg & WPCE775X_WIN_CFG_SHWIN_ACC) { - uint8_t idsel; - /* Make sure shared BIOS memory is enabled */ shm_cfg = sio_read(idx, WPCE775X_SHM_CFG); - if ((shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) - idsel = 0xf; - else { + if (!(shm_cfg & WPCE775X_SHM_CFG_BIOS_FWH_EN)) { msg_cdbg("Shared BIOS memory is diabled.\n"); msg_cdbg("Please check SHM_CFG:BIOS_FWH_EN.\n"); - goto error; + ret = -1; + goto out; } - - *shaw2ba &= 0x0fffffff; - *shaw2ba |= idsel << 28; + /* FIXME: Check that this is a FWH capable chipset. */ + comm_fwh = 1; + /* Check if bit 24-27 are set. Intel ICH will never issue any + * LPC firmware memory (FWH) cycles with them cleared. + * FWH cycles only have 28 address bits. + */ + if (*shaw2ba & (0xf << 24) != 0xf << 24) { + msg_cerr("WPCE775X shadow window 2 is outside the " + "region addressable with FWH!\n"); + ret = -1; + goto out; + } + /* FWH cycles are only issued for memory mapped to the top + * 16 MB of the 4 GB address space. We could set only the top + * 4 bits since those are ignored by the WPCE775X and we checked + * bits 24-27 to be 0xf above, but setting the top 8 bits makes + * the 16 MB constraint more clear. + */ + *shaw2ba |= 0xff << 24; + } else { + *comm_fwh = 0; } - - sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); - return 0; -error: + +out: sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); - return -1; + return ret; } /* Call superio to get pre-configured fwh_id. @@ -232,7 +246,8 @@ static int get_fwh_id(uint8_t *fwh_id) org_ldn = sio_read(idx, NUVOTON_SIOCFG_LDN); sio_write(idx, NUVOTON_SIOCFG_LDN, NUVOTON_LDN_SHM); - *fwh_id = sio_read(idx, WPCE775X_SHM_CFG); + /* Upper 4 bits of WPCE775X_SHM_CFG store the FWH ID. */ + *fwh_id = sio_read(idx, WPCE775X_SHM_CFG) >> 4; sio_write(idx, NUVOTON_SIOCFG_LDN, org_ldn); return 0; @@ -402,6 +417,7 @@ int probe_wpce775x(struct flashchip *flash) uint16_t sio_port; uint8_t srid; uint8_t fwh_id; + uint8_t comm_fwh = 0; uint32_t size; chipaddr original_memory; uint32_t original_size; @@ -425,14 +441,29 @@ int probe_wpce775x(struct flashchip *flash) } /* get the address of Shadow Window 2. */ - if (get_shaw2ba(&wcb_physical_address) < 0) { + if (get_shaw2ba(&wcb_physical_address, &comm_fwh) < 0) { msg_cdbg("Cannot get the address of Shadow Window 2"); return 0; } msg_cdbg("Get the address of WCB(SHA WIN2) at 0x%08x\n", (uint32_t)wcb_physical_address); - wcb = (struct wpce775x_wcb *) - programmer_map_flash_region("WPCE775X WCB", + + /* If we use FWH for Shadow Window 2, we have to set FWH IDSEL in the + * chipset before we try to access Shadow Window 2. + */ + if (comm_fwh) { + if (get_fwh_id(&fwh_id) < 0) { + msg_cdbg("Cannot get fwh_id value.\n"); + return 0; + } + msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); + + /* TODO: set fwh_idsel of chipset. + * Currently, we employ "-p internal:fwh_idsel=0x0000223e". + */ + } + + wcb = (struct wpce775x_wcb *)physmap("WPCE775X WCB", wcb_physical_address, getpagesize() /* min page size */); msg_cdbg("mapped wcb address: %p for physical addr: 0x%08lx\n", wcb, wcb_physical_address); @@ -442,15 +473,6 @@ int probe_wpce775x(struct flashchip *flash) } memset((void*)wcb, 0, sizeof(*wcb)); - if (get_fwh_id(&fwh_id) < 0) { - msg_cdbg("Cannot get fwh_id value.\n"); - return 0; - } - msg_cdbg("get fwh_id: 0x%02x\n", fwh_id); - - /* TODO: set fwh_idsel of chipset. - Currently, we employ "-p internal:fwh_idsel=0x0000223e". */ - /* Initialize the parameters of EC SHM component */ if (InitFlash(0x00)) return 0; -- http://www.hailfinger.org/

1 2

[commit] r1234 - trunk
by repository service 16 Nov '10

16 Nov '10

Author: hailfinger Date: Tue Nov 16 22:25:29 2010 New Revision: 1234 URL: http://flashrom.org/trac/flashrom/changeset/1234 Log: Support bulk read on Dediprog SF100. Should result in native speed for plain read and erase. Should result in a measurable speedup for writes due to a fast verify. Packet size is 512 bytes. Depending on your USB hardware and the Dediprog firmware version, this may not work at all. That said, it worked on the hardware we tested. Add lots of error checking where it was missing before. Thanks to Richard A. Smith, Mathias Krause and David Hendricks for testing multiple iterations of this patch. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-By: Richard A. Smith <richard(a)laptop.org> Acked-By: Mathias Krause <mathias.krause(a)secunet.com> Modified: trunk/dediprog.c Modified: trunk/dediprog.c ============================================================================== --- trunk/dediprog.c Tue Nov 16 18:21:58 2010 (r1233) +++ trunk/dediprog.c Tue Nov 16 22:25:29 2010 (r1234) @@ -27,6 +27,7 @@ #define DEFAULT_TIMEOUT 3000 static usb_dev_handle *dediprog_handle; +static int dediprog_endpoint; #if 0 /* Might be useful for other pieces of code as well. */ @@ -148,11 +149,93 @@ } #endif +/* Bulk read interface, will read multiple 512 byte chunks aligned to 512 bytes. + * @start start address + * @len length + * @return 0 on success, 1 on failure + */ +static int dediprog_spi_bulk_read(struct flashchip *flash, uint8_t *buf, + int start, int len) +{ + int ret; + int i; + /* chunksize must be 512, other sizes will NOT work at all. */ + const int chunksize = 0x200; + const int count = len / chunksize; + const char count_and_chunk[] = {count & 0xff, + (count >> 8) & 0xff, + chunksize & 0xff, + (chunksize >> 8) & 0xff}; + + if ((start % chunksize) || (len % chunksize)) { + msg_perr("%s: Unaligned start=%i, len=%i! Please report a bug " + "at flashrom(a)flashrom.org\n", __func__, start, len); + return 1; + } + + /* No idea if the hardware can handle empty reads, so chicken out. */ + if (!len) + return 0; + /* Command Read SPI Bulk. No idea which read command is used on the + * SPI side. + */ + ret = usb_control_msg(dediprog_handle, 0x42, 0x20, start % 0x10000, + start / 0x10000, (char *)count_and_chunk, + sizeof(count_and_chunk), DEFAULT_TIMEOUT); + if (ret != sizeof(count_and_chunk)) { + msg_perr("Command Read SPI Bulk failed, %i %s!\n", ret, + usb_strerror()); + return 1; + } + + for (i = 0; i < count; i++) { + ret = usb_bulk_read(dediprog_handle, 0x80 | dediprog_endpoint, + (char *)buf + i * chunksize, chunksize, + DEFAULT_TIMEOUT); + if (ret != chunksize) { + msg_perr("SPI bulk read %i failed, expected %i, got %i " + "%s!\n", i, chunksize, ret, usb_strerror()); + return 1; + } + } + + return 0; +} + int dediprog_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len) { - msg_pspew("%s, start=0x%x, len=0x%x\n", __func__, start, len); - /* Chosen read length is 16 bytes for now. */ - return spi_read_chunked(flash, buf, start, len, 16); + int ret; + /* chunksize must be 512, other sizes will NOT work at all. */ + const int chunksize = 0x200; + int residue = start % chunksize ? chunksize - start % chunksize : 0; + int bulklen; + + if (residue) { + msg_pdbg("Slow read for partial block from 0x%x, length 0x%x\n", + start, residue); + ret = spi_read_chunked(flash, buf, start, residue, 16); + if (ret) + return ret; + } + + /* Round down. */ + bulklen = (len - residue) / chunksize * chunksize; + ret = dediprog_spi_bulk_read(flash, buf + residue, start + residue, + bulklen); + if (ret) + return ret; + + len -= residue + bulklen; + if (len) { + msg_pdbg("Slow read for partial block from 0x%x, length 0x%x\n", + start, len); + ret = spi_read_chunked(flash, buf + residue + bulklen, + start + residue + bulklen, len, 16); + if (ret) + return ret; + } + + return 0; } int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, @@ -345,6 +428,7 @@ struct usb_device *dev; char *voltage; int millivolt = 3500; + int ret; msg_pspew("%s\n", __func__); @@ -371,8 +455,23 @@ dev->descriptor.idVendor, dev->descriptor.idProduct); dediprog_handle = usb_open(dev); - usb_set_configuration(dediprog_handle, 1); - usb_claim_interface(dediprog_handle, 0); + ret = usb_set_configuration(dediprog_handle, 1); + if (ret < 0) { + msg_perr("Could not set USB device configuration: %i %s\n", + ret, usb_strerror()); + if (usb_close(dediprog_handle)) + msg_perr("Could not close USB device!\n"); + return 1; + } + ret = usb_claim_interface(dediprog_handle, 0); + if (ret < 0) { + msg_perr("Could not claim USB device interface %i: %i %s\n", + 0, ret, usb_strerror()); + if (usb_close(dediprog_handle)) + msg_perr("Could not close USB device!\n"); + return 1; + } + dediprog_endpoint = 2; /* URB 6. Command A. */ if (dediprog_command_a()) return 1; @@ -461,8 +560,12 @@ if (dediprog_set_spi_voltage(0x0)) return 1; + if (usb_release_interface(dediprog_handle, 0)) { + msg_perr("Could not release USB interface!\n"); + return 1; + } if (usb_close(dediprog_handle)) { - msg_perr("Couldn't close USB device!\n"); + msg_perr("Could not close USB device!\n"); return 1; } return 0;

1 0

[PATCH] Support Dediprog SF100 bulk read
by Carl-Daniel Hailfinger 16 Nov '10

16 Nov '10

Support Dediprog SF100 bulk read. Packet size is 512 bytes. Depending on your USB hardware and the Dediprog firmware version, this may not work at all. Untested, experimental, may hang/crash the programmer. Read tests of random images are appreciated. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-dediprog_read_bulk/dediprog.c =================================================================== --- flashrom-dediprog_read_bulk/dediprog.c (Revision 1225) +++ flashrom-dediprog_read_bulk/dediprog.c (Arbeitskopie) @@ -26,6 +26,7 @@ #define DEFAULT_TIMEOUT 3000 static usb_dev_handle *dediprog_handle; +static int dediprog_endpoint; #if 0 /* Might be useful for other pieces of code as well. */ @@ -148,9 +149,36 @@ int dediprog_spi_read(struct flashchip *flash, uint8_t *buf, int start, int len) { + int ret; + int i; + int chunksize = 0x200; /* 512 */ + int count = flash->total_size * 1024 / chunksize; + /* Guessed. */ + const char count_and_chunk[] = {(count >> 8) & 0xff, + count & 0xff, + (chunksize >> 8) & 0xff, + chunksize & 0xff}; + msg_pspew("%s, start=0x%x, len=0x%x\n", __func__, start, len); - /* Chosen read length is 16 bytes for now. */ - return spi_read_chunked(flash, buf, start, len, 16); + if ((len != flash->total_size * 1024) || (start != 0)) { + msg_perr("Only a full chip read is supported for now. Wanted " + "start=%i, length=%i\n.", start, len); + return 1; + } + + /* Command Read SPI Bulk. No idea which read command is used on the SPI side. */ + usb_control_msg(dediprog_handle, 0x42, 0x20, 0x0000, 0x0000, (char *)count_and_chunk, 0x0004, DEFAULT_TIMEOUT); + + for (i = 0; i < count; i++) { + ret = usb_bulk_read(dediprog_handle, dediprog_endpoint, (char *)buf + i * chunksize, chunksize, DEFAULT_TIMEOUT); + if (ret != chunksize) { + msg_perr("SPI bulk read failed, expected %i, got %i %s!\n", + chunksize, ret, usb_strerror()); + return 1; + } + } + + return 0; } int dediprog_spi_send_command(unsigned int writecnt, unsigned int readcnt, @@ -301,6 +329,7 @@ dediprog_handle = usb_open(dev); usb_set_configuration(dediprog_handle, 1); usb_claim_interface(dediprog_handle, 0); + dediprog_endpoint = 2; /* URB 6. Command A. */ if (dediprog_command_a()) return 1; -- http://www.hailfinger.org/

4 14

[PATCH] Use large reads for verify
by Carl-Daniel Hailfinger 16 Nov '10

16 Nov '10

verify_range() and check_erased_range() check each page separately. While that may have seemed like a good idea back when the code was introduced, it has no benefits for any of the chips where we support write because all of them handle cross-page reads nicely. The only class of chips where this change could be a problem is chips with non power of two sector sizes which have gaps in the address space. We could simply require their read functions to provide gap-free results and leave it at that. This patch should speed up verify on Dediprog by a factor of ~100. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Index: flashrom-verify_not_chunked/flashrom.c =================================================================== --- flashrom-verify_not_chunked/flashrom.c (Revision 1232) +++ flashrom-verify_not_chunked/flashrom.c (Arbeitskopie) @@ -726,9 +726,8 @@ */ int verify_range(struct flashchip *flash, uint8_t *cmpbuf, int start, int len, char *message) { - int i, j, starthere, lenhere, ret = 0; - int page_size = flash->page_size; - uint8_t *readbuf = malloc(page_size); + int i, ret = 0; + uint8_t *readbuf = malloc(len); int failcount = 0; if (!len) @@ -753,37 +752,21 @@ if (!message) message = "VERIFY"; - /* Warning: This loop has a very unusual condition and body. - * The loop needs to go through each page with at least one affected - * byte. The lowest page number is (start / page_size) since that - * division rounds down. The highest page number we want is the page - * where the last byte of the range lives. That last byte has the - * address (start + len - 1), thus the highest page number is - * (start + len - 1) / page_size. Since we want to include that last - * page as well, the loop condition uses <=. - */ - for (i = start / page_size; i <= (start + len - 1) / page_size; i++) { - /* Byte position of the first byte in the range in this page. */ - starthere = max(start, i * page_size); - /* Length of bytes in the range in this page. */ - lenhere = min(start + len, (i + 1) * page_size) - starthere; - ret = flash->read(flash, readbuf, starthere, lenhere); - if (ret) { - msg_gerr("Verification impossible because read failed " - "at 0x%x (len 0x%x)\n", starthere, lenhere); - break; + ret = flash->read(flash, readbuf, start, len); + if (ret) { + msg_gerr("Verification impossible because read failed " + "at 0x%x (len 0x%x)\n", start, len); + } + + for (i = 0; i < len; i++) { + if (cmpbuf[i] != readbuf[i]) { + /* Only print the first failure. */ + if (!failcount++) + msg_cerr("%s FAILED at 0x%08x! " + "Expected=0x%02x, Read=0x%02x,", + message, start + i, cmpbuf[i], + readbuf[i]); } - for (j = 0; j < lenhere; j++) { - if (cmpbuf[starthere - start + j] != readbuf[j]) { - /* Only print the first failure. */ - if (!failcount++) - msg_cerr("%s FAILED at 0x%08x! " - "Expected=0x%02x, Read=0x%02x,", - message, starthere + j, - cmpbuf[starthere - start + j], - readbuf[j]); - } - } } if (failcount) { msg_cerr(" failed byte count from 0x%08x-0x%08x: 0x%x\n", -- http://www.hailfinger.org/

3 4

[commit] r1233 - trunk
by repository service 16 Nov '10

16 Nov '10

Author: hailfinger Date: Tue Nov 16 18:21:58 2010 New Revision: 1233 URL: http://flashrom.org/trac/flashrom/changeset/1233 Log: Read the to-be-verified area in one go. verify_range() and check_erased_range() check each page separately. While that may have seemed like a good idea back when the code was introduced, it has no benefits for any of the chips where we support write because all of them handle cross-page reads nicely. The only class of chips where this change could be a problem is chips with non power of two sector sizes which have gaps in the address space. We simply require their read functions to provide gap-free results and leave it at that. Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006(a)gmx.net> Acked-By: Michael Karcher <flashrom(a)mkarcher.dialup.fu-berlin.de> Modified: trunk/flashrom.c Modified: trunk/flashrom.c ============================================================================== --- trunk/flashrom.c Wed Nov 10 16:25:18 2010 (r1232) +++ trunk/flashrom.c Tue Nov 16 18:21:58 2010 (r1233) @@ -726,9 +726,8 @@ */ int verify_range(struct flashchip *flash, uint8_t *cmpbuf, int start, int len, char *message) { - int i, j, starthere, lenhere, ret = 0; - int page_size = flash->page_size; - uint8_t *readbuf = malloc(page_size); + int i, ret = 0; + uint8_t *readbuf = malloc(len); int failcount = 0; if (!len) @@ -753,36 +752,21 @@ if (!message) message = "VERIFY"; - /* Warning: This loop has a very unusual condition and body. - * The loop needs to go through each page with at least one affected - * byte. The lowest page number is (start / page_size) since that - * division rounds down. The highest page number we want is the page - * where the last byte of the range lives. That last byte has the - * address (start + len - 1), thus the highest page number is - * (start + len - 1) / page_size. Since we want to include that last - * page as well, the loop condition uses <=. - */ - for (i = start / page_size; i <= (start + len - 1) / page_size; i++) { - /* Byte position of the first byte in the range in this page. */ - starthere = max(start, i * page_size); - /* Length of bytes in the range in this page. */ - lenhere = min(start + len, (i + 1) * page_size) - starthere; - ret = flash->read(flash, readbuf, starthere, lenhere); - if (ret) { - msg_gerr("Verification impossible because read failed " - "at 0x%x (len 0x%x)\n", starthere, lenhere); - break; - } - for (j = 0; j < lenhere; j++) { - if (cmpbuf[starthere - start + j] != readbuf[j]) { - /* Only print the first failure. */ - if (!failcount++) - msg_cerr("%s FAILED at 0x%08x! " - "Expected=0x%02x, Read=0x%02x,", - message, starthere + j, - cmpbuf[starthere - start + j], - readbuf[j]); - } + ret = flash->read(flash, readbuf, start, len); + if (ret) { + msg_gerr("Verification impossible because read failed " + "at 0x%x (len 0x%x)\n", start, len); + return ret; + } + + for (i = 0; i < len; i++) { + if (cmpbuf[i] != readbuf[i]) { + /* Only print the first failure. */ + if (!failcount++) + msg_cerr("%s FAILED at 0x%08x! " + "Expected=0x%02x, Read=0x%02x,", + message, start + i, cmpbuf[i], + readbuf[i]); } } if (failcount) {

1 0

Board enable needed: Gigabyte 6IEM
by Степанов Константин 16 Nov '10

16 Nov '10

11/02/2001-6IEM-6A69RG0HC-00 http://paste.flashrom.org/view.php?id=222 http://paste.flashrom.org/view.php?id=221 http://paste.flashrom.org/view.php?id=223

1 0

Ibex Peak hangs
by John 16 Nov '10

16 Nov '10

Here is my lspci: http://flashrom.pastebin.com/4zVD3z7S When attempting to read, the chipset is not detected. After editing chipset_enable.c, changing the "3b00" in '{0x8086, 0x3b02, NT, "Intel", "3400 Desktop", enable_flash_ich10}' to "3b02", the following is output, followed immediately by a hard freeze: http://flashrom.pastebin.com/jNBdZ4YC "sudo ./flashrom -VV -c SST25VF016B" output: http://flashrom.pastebin.com/UA4vBm52 After applying this patch: http://patchwork.coreboot.org/patch/1532/ the output of "sudo ./flashrom -VV -c SST25VF016B" is: http://flashrom.pastebin.com/rCEgShPk And the output of "sudo ./flashrom -VV" was another freeze and output identical to: http://flashrom.pastebin.com/jNBdZ4YC Carldani said to mention that "flashrom hangs the machine on RES/REMS probe after you add an ich10 chipset enable for PCI ID 8086:3b02". -- http://www.fastmail.fm - mmm... Fastmail...

2 3

[PATCH] build: detect availability of TYPE_x232H in libftdi
by Alex Badea 15 Nov '10

15 Nov '10

Makefile: test-compile a small program to check whether ftdi.h defines TYPE_4232H; define CONFIG_LIBFTDI_HS=1 if so. ft2232_spi: omit checking for 2232H or 4232H chip types if libftdi is too old to report them. In that case, assume the chip supports the disable-divide-by-5 command, which was the previous behaviour before chip type-checking was introduced. Signed-off-by: Alex Badea <vamposdecampos(a)gmail.com> --- Apologies for the late reply. Test-built with libftdi-dev 0.17-1 (ubuntu lucid) and 0.13-2 (debian lenny). I added the .featuretest2.c cruft because for some reason .featuretest.c contained the utsname program at the time gcc ran. I lack the necessary make-Fu to figure out why. Cheers, Alex Makefile | 9 ++++++++- ft2232_spi.c | 2 ++ 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/Makefile b/Makefile index 3215992..82aaad1 100644 --- a/Makefile +++ b/Makefile @@ -225,6 +225,7 @@ ifeq ($(CONFIG_FT2232_SPI), yes) FTDILIBS := $(shell pkg-config --libs libftdi 2>/dev/null || printf "%s" "-lftdi -lusb") # This is a totally ugly hack. FEATURE_CFLAGS += $(shell LC_ALL=C grep -q "FTDISUPPORT := yes" .features && printf "%s" "-D'CONFIG_FT2232_SPI=1'") +FEATURE_CFLAGS += $(shell LC_ALL=C grep -q "FTDIHSSUPPORT := yes" .features && printf "%s" "-D'CONFIG_LIBFTDI_HS=1'") FEATURE_LIBS += $(shell LC_ALL=C grep -q "FTDISUPPORT := yes" .features && printf "%s" "$(FTDILIBS)") PROGRAMMER_OBJS += ft2232_spi.o endif @@ -401,6 +402,12 @@ features: compiler @$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) .featuretest.c -o .featuretest$(EXEC_SUFFIX) $(FTDILIBS) $(LIBS) >/dev/null 2>&1 && \ ( echo "found."; echo "FTDISUPPORT := yes" >> .features.tmp ) || \ ( echo "not found."; echo "FTDISUPPORT := no" >> .features.tmp ) + @printf "Checking for FTDI high-speed chip support... " + @$(shell ( echo "#include <ftdi.h>"; \ + echo "int type = TYPE_4232H;"; ) > .featuretest2.c ) + @$(CC) $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) .featuretest2.c -c -o .featuretest$(EXEC_SUFFIX) >/dev/null 2>&1 && \ + ( echo "found."; echo "FTDIHSSUPPORT := yes" >> .features.tmp ) || \ + ( echo "not found."; echo "FTDIHSSUPPORT := no" >> .features.tmp ) @printf "Checking for utsname support... " @$(shell ( echo "#include <sys/utsname.h>"; \ echo "struct utsname osinfo;"; \ @@ -410,7 +417,7 @@ features: compiler ( echo "found."; echo "UTSNAME := yes" >> .features.tmp ) || \ ( echo "not found."; echo "UTSNAME := no" >> .features.tmp ) @$(DIFF) -q .features.tmp .features >/dev/null 2>&1 && rm .features.tmp || mv .features.tmp .features - @rm -f .featuretest.c .featuretest$(EXEC_SUFFIX) + @rm -f .featuretest.c .featuretest2.c .featuretest$(EXEC_SUFFIX) else features: compiler @echo "FEATURES := yes" > .features.tmp diff --git a/ft2232_spi.c b/ft2232_spi.c index 7373624..dad116f 100644 --- a/ft2232_spi.c +++ b/ft2232_spi.c @@ -196,11 +196,13 @@ int ft2232_spi_init(void) exit(-1); // TODO } +#if CONFIG_LIBFTDI_HS if (ftdic->type != TYPE_2232H && ftdic->type != TYPE_4232H) { msg_pdbg("FTDI chip type %d is not high-speed\n", ftdic->type); clock_5x = 0; } +#endif if (ftdi_set_interface(ftdic, ft2232_interface) < 0) { msg_perr("Unable to select interface: %s\n", -- 1.7.0.4

1 0

P4V800D-X need BIOS modification for PCI-E
by Tomasz Czapiewski 14 Nov '10

14 Nov '10

Hi, I've been told at Phoronix forums few months ago that you can help solve my problem as you really do miracles with BIOS. The problem is that I have Asus P4V800D-X mainboard from few years which has Via PT880Ultra chipset. The mainboard is for Intel Pentium4 with socket 478 and DDR1 and has two graphic slots (AGP x8 and PCI-E 1.0). OT: The MP spec tells it could not handle both cards but I use both Radeons R3xx (AGP RV350 - 9600 and PCI-E RV370 - x300 in multiseat) just fine althrough before doing kernel mode settings on Linux I can see BIOS POST only on one of them but that's not the case... Back to topic... Some time ago I've get PCI-E 2.0 Radeon HD4670 which I wanted to use as a replace for PCI-E 1.0 Radeon X300 and I've saw it runs without problems on different MB but with the same chipset (Asrock 775Dual-VSTA - only PCI-E without AGP, P4/DualCore socket 775, both DDR1 and DDR2) after BIOS upgrade served by Asrock. I've found that the card I've get does couply PCI-E 1.0 power requirements specs so it really should be possible to use it on PCI-E 1.0 MBs. When I put this card in PCI-E slot of my MB BIOS and even Linux after BOOT does not see that anything is put in PCI-E slot (lspci, lshw, etc... does not show anything related to this card). I know that CoreBoot site does not list any of MBs that contain such chipset so I'm still stuck with proprietary BIOS from my MB vendor. As I've said before Asrock did release BIOS updates for it's MB with fixes for Radeon HD2xxx and HD3xxx cards (althrough some people reported that after this BIOS update Radeon HD4670 works, too) but Asus did forget about P4V800D-X users long time ago and haven't released and wont release such fixes. I know it will be very hard but could you look at Asrock 775Dual-VSTA BIOS changes (last BIOSes contain only fixes for Radeon HD3xxx cards) and somekind use it for fix my Asus P4V800D-X BIOS to support such cards? I don't even imagine how would you do this but anyway I've get here to ask for help as you're the only people who could do something like this. Thanks in advance. Asus P4V800D-X spec: http://motherboardland.blogspot.com/2006/01/asus-p4v800d-x-motherboard.html Asus P4V800D-X user guide: ftp://ftp.asus.com.tw/pub/ASUS/mb/sock478/p4v800d-x/e2221_P4V800D-X.pdf Asus P4V800D-X BIOS: http://dlcdnet.asus.com/pub/ASUS/mb/sock478/p4v800d-x/P4V8D704.zip Asrock 775Dual-VSTA spec: http://www.asrock.com/mb/overview.asp?Model=775Dual-vsta Asrock 775Dual-VSTA user guide: http://europe.asrock.com/manual/775Dual-VSTA.pdf Asrock 775Dual-VSTA BIOSes with changelogs: http://www.asrock.com/mb/download.asp?Model=775Dual-VSTA&o=BIOS Btw. I don't have EEPROM/BIOS programmer/flasher and my MB has only one BIOS so if you would do that BIOS modifications will flashing it will be a lot more risky than flashing any other official BIOSes? I don't mind if after flashing for any reason I could get not video or sth that would just not break Linux boot from SATA HDD so I could SSH to my machine and flash original BIOS or any other not so hard to use fallback. I don't want to change MB for the next few years because of financial reasons as I have some hardware/peripherals which use could be problematic on never MBs like these two graphic cards, PCI analog TV card, some RS232 connected hardware, a lot of DDR1 RAM, etc. With Regards, Tom

1 0

Re: [flashrom] Your flash chip is in an unknown state
by Michael Karcher 14 Nov '10

14 Nov '10

Am Sonntag, den 14.11.2010, 10:40 +0000 schrieb Matthew Chapman: > I just downloaded flashrom so I thought I had the latest version. How > do I get the latest version? There probably are no pre-compiled packages for your distribution, but you can get the source of the (not yet officially announced, but frozen) version 0.9.3 (internal revision code 1204) from http://qa.coreboot.org/snapshots/flashrom-0.9.3-r1204.tar.bz2 Read the "installation from source" section in http://flashrom.org/Downloads Regards, Michael Karcher

1 0

Your flash chip is in an unknown state
by Matthew Chapman 14 Nov '10

14 Nov '10

Hi, I inherited an old PC and decided to try out linux. I've installed the latest version of Ubuntu and all updates. The BIOS on the machine is old so I decided to try and update it using flashrom. However, it said erase failed and to contact you. I should have probably started something easier on my first attempt to use Linux... I did a backup of the current image. Here's the output: daddy@daddy-System-Name:~/Desktop/flashrom-0.9.2$ sudo flashrom -w 1018.004 flashrom v0.9.2-r1028 on Linux 2.6.35-22-generic (i686), built with libpci 3.0.0, GCC 4.4.4, little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OK. No coreboot table found. Found chipset "VIA VT8233A", enabling flash write... OK. This chipset supports the following protocols: Non-SPI. Found chip "SST SST49LF020" (256 KB, LPC) at physical address 0xfffc0000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... Erasing flash chip... ERASE FAILED at 0x00000000! Expected=0xff, Read=0x00, failed byte count from 0x00000000-0x00000fff: 0xb04 ERASE FAILED! ERASE FAILED at 0x00000000! Expected=0xff, Read=0x00, failed byte count from 0x00000000-0x00003fff: 0x3ad6 ERASE FAILED! FAILED! ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at irc.freenode.net (channel #flashrom) or mail flashrom(a)flashrom.org! I think my machine is an ASUS A7V333 Help! Thanks, Matt

2 1

Success: C2SEA
by purpleposeidon 14 Nov '10

14 Nov '10

Output logs are attached. It says there are two chips, but I think it's actually just one. Reading the .rom off the second chip, and comparing the md5 hash with what I wrote to the first chip, gave the same thing. IDENTIFYING INFO ID from BIOS setup: C2SEA000 Newegg says I bought a "MB SUPERMICRO|MBD-C2SEA-O 775 G45 R". (I don't recommend it. And it doesn't recommend itself either; check out that interesting version number...) Motherboard product page: http://www.supermicro.com/products/motherboard/Core2Duo/G45/C2SEA.cfm DMI strings: system-manufacturer: "Supermicro" system-product-name: "C2SEA" system-version: "1234567890" baseboard-manufacturer: "Supermicro" baseboard-product-name: "C2SEA" baseboard-version: "1234567890" chassis-type: "Desktop" Let me know if there is any other info needed.

1 0

Support for ASUS M2N-VM SE
by Sven Meier 13 Nov '10

13 Nov '10

Hi, I'm just tinkering with my ASUS M2N-VM SE. The PCIe slot seems to be broken, so I'll probably have to replace it. Nevertheless, flashrom writes you'd be interested in the output of "flashrom -V", so here it goes. Best regards Sven sven@hal:~$ sudo flashrom -V flashrom v0.9.2-r1028 on Linux 2.6.35-23-generic (x86_64), built with libpci 3.0.0, GCC 4.4.4, little endian flashrom is free software, get the source code at http://www.flashrom.org Calibrating delay loop... OS timer resolution is 2 usecs, 669M loops per second, 10 myus = 12 us, 100 myus = 102 us, 1000 myus = 1000 us, 10000 myus = 10012 us, 8 myus = 10 us, OK. Initializing internal programmer No coreboot table found. DMI string system-manufacturer: "System manufacturer" DMI string system-product-name: "System Product Name" DMI string system-version: "System Version" DMI string baseboard-manufacturer: "ASUSTeK Computer INC." DMI string baseboard-product-name: "M2N-VM SE" DMI string baseboard-version: "1.XX" DMI string chassis-type: "Desktop" Found chipset "NVIDIA MCP61", enabling flash write... chipset PCI ID is 10de:03e0, This chipset is not really supported yet. Guesswork... ISA/LPC bridge reg 0x8a contents: 0x00, bit 6 is 0, bit 5 is 0 Guessed flash bus type is LPC Found SMBus device 10de:03eb at 00:01:1 SPI BAR is at 0x00000000, after clearing low bits BAR is at 0x00000000 MCP SPI is not used. Please send the output of "flashrom -V" to flashrom(a)flashrom.org to help us finish support for your chipset. Thanks. OK. This chipset supports the following protocols: LPC. Probing for AMD Am29F010A/B, 128 KB: skipped. Probing for AMD Am29F002(N)BB, 256 KB: skipped. Probing for AMD Am29F002(N)BT, 256 KB: skipped. Probing for AMD Am29F016D, 2048 KB: skipped. Probing for AMD Am29F040B, 512 KB: skipped. Probing for AMD Am29F080B, 1024 KB: skipped. Probing for AMD Am29LV040B, 512 KB: skipped. Probing for AMD Am29LV081B, 1024 KB: skipped. Probing for ASD AE49F2008, 256 KB: skipped. Probing for Atmel AT25DF021, 256 KB: skipped. Probing for Atmel AT25DF041A, 512 KB: skipped. Probing for Atmel AT25DF081, 1024 KB: skipped. Probing for Atmel AT25DF161, 2048 KB: skipped. Probing for Atmel AT25DF321, 4096 KB: skipped. Probing for Atmel AT25DF321A, 4096 KB: skipped. Probing for Atmel AT25DF641, 8192 KB: skipped. Probing for Atmel AT25F512B, 64 KB: skipped. Probing for Atmel AT25FS010, 128 KB: skipped. Probing for Atmel AT25FS040, 512 KB: skipped. Probing for Atmel AT26DF041, 512 KB: skipped. Probing for Atmel AT26DF081A, 1024 KB: skipped. Probing for Atmel AT26DF161, 2048 KB: skipped. Probing for Atmel AT26DF161A, 2048 KB: skipped. Probing for Atmel AT26F004, 512 KB: skipped. Probing for Atmel AT29C512, 64 KB: skipped. Probing for Atmel AT29C010A, 128 KB: skipped. Probing for Atmel AT29C020, 256 KB: skipped. Probing for Atmel AT29C040A, 512 KB: skipped. Probing for Atmel AT45CS1282, 16896 KB: skipped. Probing for Atmel AT45DB011D, 128 KB: skipped. Probing for Atmel AT45DB021D, 256 KB: skipped. Probing for Atmel AT45DB041D, 512 KB: skipped. Probing for Atmel AT45DB081D, 1024 KB: skipped. Probing for Atmel AT45DB161D, 2048 KB: skipped. Probing for Atmel AT45DB321C, 4224 KB: skipped. Probing for Atmel AT45DB321D, 4096 KB: skipped. Probing for Atmel AT45DB642D, 8192 KB: skipped. Probing for Atmel AT49BV512, 64 KB: skipped. Probing for Atmel AT49F002(N), 256 KB: skipped. Probing for Atmel AT49F002(N)T, 256 KB: skipped. Probing for AMIC A25L40PT, 512 KB: skipped. Probing for AMIC A25L40PU, 512 KB: skipped. Probing for AMIC A29002B, 256 KB: skipped. Probing for AMIC A29002T, 256 KB: skipped. Probing for AMIC A29040B, 512 KB: skipped. Probing for AMIC A49LF040A, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for EMST F49B002UA, 256 KB: skipped. Probing for Eon EN25B05, 64 KB: skipped. Probing for Eon EN25B05T, 64 KB: skipped. Probing for Eon EN25B10, 128 KB: skipped. Probing for Eon EN25B10T, 128 KB: skipped. Probing for Eon EN25B20, 256 KB: skipped. Probing for Eon EN25B20T, 256 KB: skipped. Probing for Eon EN25B40, 512 KB: skipped. Probing for Eon EN25B40T, 512 KB: skipped. Probing for Eon EN25B80, 1024 KB: skipped. Probing for Eon EN25B80T, 1024 KB: skipped. Probing for Eon EN25B16, 2048 KB: skipped. Probing for Eon EN25B16T, 2048 KB: skipped. Probing for Eon EN25B32, 4096 KB: skipped. Probing for Eon EN25B32T, 4096 KB: skipped. Probing for Eon EN25B64, 8192 KB: skipped. Probing for Eon EN25B64T, 8192 KB: skipped. Probing for Eon EN25D16, 2048 KB: skipped. Probing for Eon EN25F05, 64 KB: skipped. Probing for Eon EN25F10, 128 KB: skipped. Probing for Eon EN25F20, 256 KB: skipped. Probing for Eon EN25F40, 512 KB: skipped. Probing for Eon EN25F80, 1024 KB: skipped. Probing for Eon EN25F16, 2048 KB: skipped. Probing for Eon EN25F32, 4096 KB: skipped. Probing for Eon EN29F010, 128 KB: skipped. Probing for EON EN29F002(A)(N)B, 256 KB: skipped. Probing for EON EN29F002(A)(N)T, 256 KB: skipped. Probing for Fujitsu MBM29F004BC, 512 KB: skipped. Probing for Fujitsu MBM29F004TC, 512 KB: skipped. Probing for Fujitsu MBM29F400BC, 512 KB: skipped. Probing for Fujitsu MBM29F400TC, 512 KB: skipped. Probing for Intel 28F001BX-B, 128 KB: skipped. Probing for Intel 28F001BX-T, 128 KB: skipped. Probing for Intel 28F004S5, 512 KB: skipped. Probing for Intel 28F004BV/BE-B, 512 KB: skipped. Probing for Intel 28F004BV/BE-T, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-B, 512 KB: skipped. Probing for Intel 28F400BV/CV/CE-T, 512 KB: skipped. Probing for Intel 82802AB, 512 KB: skipped. Probing for Intel 82802AC, 1024 KB: skipped. Probing for Macronix MX25L512, 64 KB: skipped. Probing for Macronix MX25L1005, 128 KB: skipped. Probing for Macronix MX25L2005, 256 KB: skipped. Probing for Macronix MX25L4005, 512 KB: skipped. Probing for Macronix MX25L8005, 1024 KB: skipped. Probing for Macronix MX25L1605, 2048 KB: skipped. Probing for Macronix MX25L1635D, 2048 KB: skipped. Probing for Macronix MX25L3205, 4096 KB: skipped. Probing for Macronix MX25L3235D, 4096 KB: skipped. Probing for Macronix MX25L6405, 8192 KB: skipped. Probing for Macronix MX25L12805, 16384 KB: skipped. Probing for Macronix MX29F001B, 128 KB: skipped. Probing for Macronix MX29F001T, 128 KB: skipped. Probing for Macronix MX29F002B, 256 KB: skipped. Probing for Macronix MX29F002T, 256 KB: skipped. Probing for Macronix MX29LV040, 512 KB: skipped. Probing for Numonyx M25PE10, 128 KB: skipped. Probing for Numonyx M25PE20, 256 KB: skipped. Probing for Numonyx M25PE40, 512 KB: skipped. Probing for Numonyx M25PE80, 1024 KB: skipped. Probing for Numonyx M25PE16, 2048 KB: skipped. Probing for PMC Pm25LV010, 128 KB: skipped. Probing for PMC Pm25LV016B, 2048 KB: skipped. Probing for PMC Pm25LV020, 256 KB: skipped. Probing for PMC Pm25LV040, 512 KB: skipped. Probing for PMC Pm25LV080B, 1024 KB: skipped. Probing for PMC Pm25LV512, 64 KB: skipped. Probing for PMC Pm29F002T, 256 KB: skipped. Probing for PMC Pm29F002B, 256 KB: skipped. Probing for PMC Pm39LV010, 128 KB: skipped. Probing for PMC Pm39LV020, 256 KB: skipped. Probing for PMC Pm39LV040, 512 KB: skipped. Probing for PMC Pm49FL002, 256 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for PMC Pm49FL004, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Found chip "PMC Pm49FL004" (512 KB, LPC,FWH) at physical address 0xfff80000. Probing for Sanyo LF25FW203A, 2048 KB: skipped. Probing for Sharp LHF00L04, 1024 KB: skipped. Probing for Spansion S25FL008A, 1024 KB: skipped. Probing for Spansion S25FL016A, 2048 KB: skipped. Probing for SST SST25VF016B, 2048 KB: skipped. Probing for SST SST25VF032B, 4096 KB: skipped. Probing for SST SST25VF040.REMS, 512 KB: skipped. Probing for SST SST25VF040B, 512 KB: skipped. Probing for SST SST25VF040B.REMS, 512 KB: skipped. Probing for SST SST25VF080B, 1024 KB: skipped. Probing for SST SST28SF040A, 512 KB: skipped. Probing for SST SST29EE010, 128 KB: skipped. Probing for SST SST29LE010, 128 KB: skipped. Probing for SST SST29EE020A, 256 KB: skipped. Probing for SST SST29LE020, 256 KB: skipped. Probing for SST SST39SF512, 64 KB: skipped. Probing for SST SST39SF010A, 128 KB: skipped. Probing for SST SST39SF020A, 256 KB: skipped. Probing for SST SST39SF040, 512 KB: skipped. Probing for SST SST39VF512, 64 KB: skipped. Probing for SST SST39VF010, 128 KB: skipped. Probing for SST SST39VF020, 256 KB: skipped. Probing for SST SST39VF040, 512 KB: skipped. Probing for SST SST39VF080, 1024 KB: skipped. Probing for SST SST49LF002A/B, 256 KB: skipped. Probing for SST SST49LF003A/B, 384 KB: skipped. Probing for SST SST49LF004A/B, 512 KB: skipped. Probing for SST SST49LF004C, 512 KB: skipped. Probing for SST SST49LF008A, 1024 KB: skipped. Probing for SST SST49LF008C, 1024 KB: skipped. Probing for SST SST49LF016C, 2048 KB: skipped. Probing for SST SST49LF020, 256 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF020A, 256 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF040, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF040B, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for SST SST49LF080A, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SST SST49LF160C, 2048 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M25P05-A, 64 KB: skipped. Probing for ST M25P05.RES, 64 KB: skipped. Probing for ST M25P10-A, 128 KB: skipped. Probing for ST M25P10.RES, 128 KB: skipped. Probing for ST M25P20, 256 KB: skipped. Probing for ST M25P40, 512 KB: skipped. Probing for ST M25P40-old, 512 KB: skipped. Probing for ST M25P80, 1024 KB: skipped. Probing for ST M25P16, 2048 KB: skipped. Probing for ST M25P32, 4096 KB: skipped. Probing for ST M25P64, 8192 KB: skipped. Probing for ST M25P128, 16384 KB: skipped. Probing for ST M29F002B, 256 KB: skipped. Probing for ST M29F002T/NT, 256 KB: skipped. Probing for ST M29F040B, 512 KB: skipped. Probing for ST M29F400BT, 512 KB: skipped. Probing for ST M29W010B, 128 KB: skipped. Probing for ST M29W040B, 512 KB: skipped. Probing for ST M29W512B, 64 KB: skipped. Probing for ST M50FLW040A, 512 KB: probe_82802ab: id1 0x21, id2 0xf8, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW040B, 512 KB: probe_82802ab: id1 0x21, id2 0xf8, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080A, 1024 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FLW080B, 1024 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for ST M50FW002, 256 KB: skipped. Probing for ST M50FW016, 2048 KB: skipped. Probing for ST M50FW040, 512 KB: skipped. Probing for ST M50FW080, 1024 KB: skipped. Probing for ST M50LPW116, 2048 KB: probe_82802ab: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for SyncMOS S29C31004T, 512 KB: skipped. Probing for SyncMOS S29C51001T, 128 KB: skipped. Probing for SyncMOS S29C51002T, 256 KB: skipped. Probing for SyncMOS S29C51004T, 512 KB: skipped. Probing for TI TMS29F002RB, 256 KB: skipped. Probing for TI TMS29F002RT, 256 KB: skipped. Probing for Winbond W25Q80, 1024 KB: skipped. Probing for Winbond W25Q16, 2048 KB: skipped. Probing for Winbond W25Q32, 4096 KB: skipped. Probing for Winbond W25x10, 128 KB: skipped. Probing for Winbond W25x20, 256 KB: skipped. Probing for Winbond W25x40, 512 KB: skipped. Probing for Winbond W25x80, 1024 KB: skipped. Probing for Winbond W25x16, 2048 KB: skipped. Probing for Winbond W25x32, 4096 KB: skipped. Probing for Winbond W25x64, 8192 KB: skipped. Probing for Winbond W29C011, 128 KB: skipped. Probing for Winbond W29C020C, 256 KB: skipped. Probing for Winbond W29C040P, 512 KB: skipped. Probing for Winbond W29EE011, 128 KB: skipped. Probing for Winbond W39V040A, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040B, 512 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040C, 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W39V040FA, 512 KB: skipped. Probing for Winbond W39V080A, 1024 KB: probe_jedec_common: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content Probing for Winbond W49F002U, 256 KB: skipped. Probing for Winbond W49V002A, 256 KB: probe_jedec_common: id1 0x9d, id2 0x6e Probing for Winbond W49V002FA, 256 KB: skipped. Probing for Winbond W39V080FA, 1024 KB: skipped. Probing for Winbond W39V080FA (dual mode), 512 KB: skipped. Probing for Atmel unknown Atmel SPI chip, 0 KB: skipped. Probing for EON unknown EON SPI chip, 0 KB: skipped. Probing for Macronix unknown Macronix SPI chip, 0 KB: skipped. Probing for PMC unknown PMC SPI chip, 0 KB: skipped. Probing for SST unknown SST SPI chip, 0 KB: skipped. Probing for ST unknown ST SPI chip, 0 KB: skipped. Probing for Sanyo unknown Sanyo SPI chip, 0 KB: skipped. Probing for Generic unknown SPI chip (RDID), 0 KB: skipped. Probing for Generic unknown SPI chip (REMS), 0 KB: skipped. No operations were specified.

1 0

flash fails
by Rudolf Andringa 13 Nov '10

13 Nov '10

flashrom -w A7032VMS.500 flashrom v0.9.1-r710 No coreboot table found. Found chipset "VIA VT8237", enabling flash write... OK. This chipset supports the following protocols: Non-SPI. Calibrating delay loop... OK. Found chip "SST SST49LF004A/B" (512 KB, FWH) at physical address 0xfff80000. Flash image seems to be a legacy BIOS. Disabling checks. Writing flash chip... ERASE FAILED at 0x00000008! Expected=0xff, Read=0x54, failed byte count from 0x00000000-0x0000ffff: 0xfebf ERASE FAILED! ERASE FAILED! ERASE FAILED! ERASE FAILED! FAILED! Your flash chip is in an unknown state. Get help on IRC at irc.freenode.net channel #flashrom or mail flashrom(a)flashrom.org ------------------------------------------------------------ DO NOT REBOOT OR POWEROFF!

2 1

"flashrom -V" output
by vince robinson 11 Nov '10

11 Nov '10

mboard asus M2N-MX SE processor AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ : 2109.62MHz

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

flashrom