Erasing on Asus M2N68-VM

[Michael Karcher]

Hello developers,

this is from Code found in the BIOS.

Enable bitbanging SPI interface:
 - ISA brigde (10de:0548, at 00:01.0) needs 8A.6 set and 8A.5 cleared
 - SMBus controller (10de:0542, at 00:01.1, so same chip) contains base
address of something at register 0x74 (DWORD). Bitbanging register is at
0x530 inside that block. The base address has been seen as 0xfec80000 on
one board.

To select the BIOS ROM:
  - Set bit 0 in the bitbang register
  - Wait for bit 8 to be set (this is the *only* word access to the
bitbang register, everything els is bytewise)
  - Clear bit 1 in the bitbang register

To deselect the BIOS ROM:
  - Set bit 1 in the bitbang register
  - Clear bit 0 in the bitbang register

To do SPI transfers:
  - bit 2 is clock (read/write)
  - bit 3 is MOSI (to flash)
  - bit 4 is MISO (from flash)

That's basically everything. No warranty that this doesn't interfere
with anything ACPI-like while the system is running, of course.

Regards,
  Michael Karcher

[Michael Karcher]

Am Freitag, den 04.12.2009, 01:00 +0100 schrieb Michael Karcher:

some speculations, as guessing is cool:
> To select the BIOS ROM:
> Set bit 0 in the bitbang register

wild guess: This disables an chipset-internal SPI interface used for a
read-only mapping of the flash rom to the processor address space. But
it does not abort a transaction if it is running.
> Wait for bit 8 to be set (this is the *only* word access to the
>
> bitbang register, everything els is bytewise)

wild guess: This bit indicates that the chipset-internal SPI is idle.
> Clear bit 1 in the bitbang register

wild guess: This bit enables bit-bang access to the SPI interface.

Regards,
  Michael Karcher

[PATCH] MCP67 SPI detection/debugging

[Carl-Daniel Hailfinger]

First attempt at shedding some light on the MCP67 SPI situation.
Huge thanks to Michael Karcher for reverse engineering the chipset and
writing a spec. Due to this, we were able to use the chinese wall
technique for 100% clean room reverse engineering.

This patch doesn't touch any of the new registers, it only reads them.
Assuming that read has no side effects, this patch is a no-op and safe.

We need "flashrom -V" output from MCP67 boards with SPI flash and from
boards with LPC flash. Note: That output is only helpful if it is
created with patched flashrom and if is from the first run of flashrom
after a cold boot (reset or Ctrl-Alt-Del is not sufficient). I hope to
see a pattern based on which we can detect which flash type is present
on the board.

Alex, we need this output (as described above) from your Asus M2N68-VM
board.

I'd like to merge this ASAP and then ping everyone who had this chipset
to get flashrom -V output.

Signed-off-by: Carl-Daniel Hailfinger

Index: flashrom-mcp67_spi_detect/chipset_enable.c
===================================================================
--- flashrom-mcp67_spi_detect/chipset_enable.c	(Revision 792)
+++ flashrom-mcp67_spi_detect/chipset_enable.c	(Arbeitskopie)
@@ -1020,6 +1020,76 @@
    return 0;
 }

+/**
+ * The MCP67 code is guesswork based on cleanroom reverse engineering.
+ * Due to that, it only reads info and doesn't change any settings.
+ * It is assumed that LPC chips need the MCP55 code and SPI chips need the
+ * code provided in this function. Until we know for sure, call
+ * enable_flash_mcp55 from this function.
+ */
+static int enable_flash_mcp67(struct pci_dev *dev, const char *name)
+{
+	int result = 0;
+	uint8_t byte;
+	uint16_t status;
+	uint32_t gpiobaraddr;
+	void *gpiobar;
+	struct pci_dev *smbusdev;
+
+	/* dev is the ISA bridge. No idea what the stuff below does. */
+	byte = pci_read_byte(dev, 0x8a);
+	printf_debug("ISA bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5"
+		     " is %i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
+	/* Disable the write code for now until we have more info. */
+#if 0
+	byte |= (1 << 6);
+	byte &= ~(1 << 5);
+	pci_write_byte(dev, 0x8a, byte);
+#endif
+
+	/* Look for the SMBus device. Should we look for the SMBus PCI class? */
+	smbusdev = pci_dev_find(0x10de, 0x0542);
+	if (!smbusdev) {
+		fprintf(stderr, "ERROR: SMBus device not found. Aborting.\n");
+		exit(1);
+	}
+
+	/* Locate the BAR where the GPIOs live. */
+	gpiobaraddr = pci_read_long(smbusdev, 0x74);
+	printf_debug("GPIO BAR is at 0x%08x, ", gpiobaraddr);
+	/* We hope this has native alignment. We know the GPIOs are at offset
+	 * 0x530, so we expect a size of at least 0x800. Clear the lower bits.
+	 * It is entirely possible that the BAR is 64k big and the low bits are
+	 * reserved for an entirely different purpose.
+	 */
+	gpiobaraddr &= ~0x7ff;
+	printf_debug("after clearing low bits BAR is at 0x%08x\n", gpiobaraddr);
+
+	/* Accessing a NULL pointer BAR is evil. Don't do it. */
+	if (gpiobaraddr) {
+		/* Map the BAR. We access bytewise and wordwise at 0x530. */
+		gpiobar = physmap("MCP67 GPIO", gpiobaraddr, 0x534);
+/* Guessed. If this is correct, migrate to a separate MCP67 SPI driver. */
+#define MCP67_SPI_CS		(1 << 1)
+#define MCP67_SPI_SCK		(1 << 2)
+#define MCP67_SPI_MOSI		(1 << 3)
+#define MCP67_SPI_MISO		(1 << 4)
+#define MCP67_SPI_ENABLE	(1 << 0)
+#define MCP67_SPI_IDLE		(1 << 8)
+		status = mmio_readw(gpiobar + 0x530);
+		printf_debug("SPI control is 0x%04x, enable=%i, idle=%i\n",
+			     status, status & 0x1, (status >> 8) & 0x1);
+		printf("Please send the output of "flashrom -V" to "
+		       "[e-mail] to help us improve MCP67 chipset"
+		       " support. Thanks.\n");
+	}
+
+	/* Not sure if this is still correct. No docs as usual. */
+	result = enable_flash_mcp55(dev, name);
+
+	return result;
+}
+
 static int enable_flash_ht1000(struct pci_dev *dev, const char *name)
 {
    uint8_t byte;
@@ -1157,7 +1227,7 @@
    {0x10de, 0x0365, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0366, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0367, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* Pro */
-	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp55},
+	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp67},
    {0x1039, 0x0496, NT, "SiS", "85C496+497",	enable_flash_sis85c496},
    {0x1039, 0x0406, NT, "SiS", "501/5101/5501",	enable_flash_sis501},
    {0x1039, 0x5511, NT, "SiS", "5511",		enable_flash_sis5511},

[PATCH] MCP67 SPI detection/debugging

[Alessandro Polverini]

Carl-Daniel Hailfinger wrote:
> First attempt at shedding some light on the MCP67 SPI situation.
> Huge thanks to Michael Karcher for reverse engineering the chipset and
> writing a spec. Due to this, we were able to use the chinese wall
> technique for 100% clean room reverse engineering.
>
> This patch doesn't touch any of the new registers, it only reads them.
> Assuming that read has no side effects, this patch is a no-op and safe.
>
> We need "flashrom -V" output from MCP67 boards with SPI flash and from
> boards with LPC flash. Note: That output is only helpful if it is
> created with patched flashrom and if is from the first run of flashrom
> after a cold boot (reset or Ctrl-Alt-Del is not sufficient). I hope to
> see a pattern based on which we can detect which flash type is present
> on the board.
>
> Alex, we need this output (as described above) from your Asus M2N68-VM
> board.
>
> I'd like to merge this ASAP and then ping everyone who had this chipset
> to get flashrom -V output.

Hello Carl,
I got latest sources from trunk, applied the provided patch, cold-booted 
and saved the output of flashrom -V (attached).

I hope this helps,
Alex
> Signed-off-by: Carl-Daniel Hailfinger
> Index: flashrom-mcp67_spi_detect/chipset_enable.c
>
> --- flashrom-mcp67_spi_detect/chipset_enable.c	(Revision 792)
> +++ flashrom-mcp67_spi_detect/chipset_enable.c	(Arbeitskopie)
> @@ -1020,6 +1020,76 @@
>    return 0;
>  }
>
> +/**
> The MCP67 code is guesswork based on cleanroom reverse engineering.
> Due to that, it only reads info and doesn't change any settings.
> It is assumed that LPC chips need the MCP55 code and SPI chips need the
> code provided in this function. Until we know for sure, call
> enable_flash_mcp55 from this function.
> */
>
> +static int enable_flash_mcp67(struct pci_dev *dev, const char *name)
> +{
> int result = 0;
> uint8_t byte;
> uint16_t status;
> uint32_t gpiobaraddr;
> void *gpiobar;
> struct pci_dev *smbusdev;
> /* dev is the ISA bridge. No idea what the stuff below does. */
> byte = pci_read_byte(dev, 0x8a);
> printf_debug("ISA bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5"
>      " is %i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
> /* Disable the write code for now until we have more info. */
>
> +#if 0
> byte |= (1 << 6);
> byte &= ~(1 << 5);
> pci_write_byte(dev, 0x8a, byte);
>
> +#endif
> /* Look for the SMBus device. Should we look for the SMBus PCI class? */
> smbusdev = pci_dev_find(0x10de, 0x0542);
> if (!smbusdev) {
> fprintf(stderr, "ERROR: SMBus device not found. Aborting.\n");
> exit(1);
> }
> /* Locate the BAR where the GPIOs live. */
> gpiobaraddr = pci_read_long(smbusdev, 0x74);
> printf_debug("GPIO BAR is at 0x%08x, ", gpiobaraddr);
> /* We hope this has native alignment. We know the GPIOs are at offset
> * 0x530, so we expect a size of at least 0x800. Clear the lower bits.
> * It is entirely possible that the BAR is 64k big and the low bits are
> * reserved for an entirely different purpose.
> */
> gpiobaraddr &= ~0x7ff;
> printf_debug("after clearing low bits BAR is at 0x%08x\n", gpiobaraddr);
> /* Accessing a NULL pointer BAR is evil. Don't do it. */
> if (gpiobaraddr) {
> /* Map the BAR. We access bytewise and wordwise at 0x530. */
> gpiobar = physmap("MCP67 GPIO", gpiobaraddr, 0x534);
>
> +/* Guessed. If this is correct, migrate to a separate MCP67 SPI driver. */
> +#define MCP67_SPI_CS		(1 << 1)
> +#define MCP67_SPI_SCK		(1 << 2)
> +#define MCP67_SPI_MOSI		(1 << 3)
> +#define MCP67_SPI_MISO		(1 << 4)
> +#define MCP67_SPI_ENABLE	(1 << 0)
> +#define MCP67_SPI_IDLE		(1 << 8)
> status = mmio_readw(gpiobar + 0x530);
> printf_debug("SPI control is 0x%04x, enable=%i, idle=%i\n",
> 	     status, status & 0x1, (status >> 8) & 0x1);
> printf("Please send the output of \"flashrom -V\" to "
>        "[e-mail] to help us improve MCP67 chipset"
>        " support. Thanks.\n");
> }
> /* Not sure if this is still correct. No docs as usual. */
> result = enable_flash_mcp55(dev, name);
> return result;
>
> +}
>
> static int enable_flash_ht1000(struct pci_dev *dev, const char *name)
>  {
>    uint8_t byte;
> @@ -1157,7 +1227,7 @@
>    {0x10de, 0x0365, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
>    {0x10de, 0x0366, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
>    {0x10de, 0x0367, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* Pro */
> {0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp55},
> {0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp67},
> {0x1039, 0x0496, NT, "SiS", "85C496+497",	enable_flash_sis85c496},
> {0x1039, 0x0406, NT, "SiS", "501/5101/5501",	enable_flash_sis501},
> {0x1039, 0x5511, NT, "SiS", "5511",		enable_flash_sis5511},

flashrom v0.9.1-r791
No coreboot table found.
Found chipset "NVIDIA MCP67", enabling flash write... ISA bridge reg 0x8a contents: 0x40, bit 6 is 1, bit 5 is 0
GPIO BAR is at 0xfec80000, after clearing low bits BAR is at 0xfec80000
SPI control is 0xc01a, enable=0, idle=0
Please send the output of "flashrom -V" to [e-mail] to help us improve MCP67 chipset support. Thanks.
OK.
This chipset supports the following protocols: Non-SPI.
Calibrating delay loop... 628M loops per second, 100 myus = 196 us. OK.
Probing for AMD Am29F010A/B, 128 KB: probe_29f040b: id1 0x50, id2 0x00
Probing for AMD Am29F002(N)BB, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for AMD Am29F002(N)BT, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for AMD Am29F016D, 2048 KB: probe_29f040b: id1 0x41, id2 0x53
Probing for AMD Am29F040B, 512 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for AMD Am29F080B, 1024 KB: probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for AMD Am29LV040B, 512 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for AMD Am29LV081B, 1024 KB: probe_29f040b: id1 0x41, id2 0x53
Probing for ASD AE49F2008, 256 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT25DF021, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF041A, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF081, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF161, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF321, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF321A, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25DF641, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25F512B, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25FS010, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT25FS040, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT26DF041, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT26DF081A, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT26DF161, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT26DF161A, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT26F004, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT29C512, 64 KB: probe_jedec: id1 0x50, id2 0xfb, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT29C010A, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT29C020, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT29C040A, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT45CS1282, 16896 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB011D, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB021D, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB041D, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB081D, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB161D, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB321C, 4224 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB321D, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT45DB642D, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Atmel AT49BV512, 64 KB: probe_jedec: id1 0x50, id2 0xfb, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT49F002(N), 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Atmel AT49F002(N)T, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for AMIC A25L40P, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for AMIC A29002B, 256 KB: probe_29f002: id1 0x4f, id2 0x81
Probing for AMIC A29002T, 256 KB: probe_29f002: id1 0x4f, id2 0x81
Probing for AMIC A29040B, 512 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for AMIC A49LF040A, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for EMST F49B002UA, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Eon EN25B05, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B10, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B20, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B40, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B80, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B32, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25B64, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25D16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F05, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F10, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F20, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F40, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F80, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Eon EN25F32, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for EON EN29F002(A)(N)B, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for EON EN29F002(A)(N)T, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Fujitsu MBM29F004BC, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Fujitsu MBM29F004TC, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Fujitsu MBM29F400BC, 512 KB: probe_m29f400bt: id1 0xff, id2 0xff
Probing for Fujitsu MBM29F400TC, 512 KB: probe_m29f400bt: id1 0xff, id2 0xff
Probing for Intel 28F001BX-B, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Intel 28F001BX-T, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Intel 82802AB, 512 KB: probe_82802ab: id1 0xff, id2 0xff
Probing for Intel 82802AC, 1024 KB: probe_82802ab: id1 0x41, id2 0x53
Probing for Macronix MX25L512, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L1005, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L2005, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L4005, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L8005, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L1605, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L1635D, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L3205, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L3235D, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L6405, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX25L12805, 16384 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix MX29F001B, 128 KB: probe_29f002: id1 0x50, id2 0x00
Probing for Macronix MX29F001T, 128 KB: probe_29f002: id1 0x50, id2 0x00
Probing for Macronix MX29F002B, 256 KB: probe_29f002: id1 0x4f, id2 0x81
Probing for Macronix MX29F002T, 256 KB: probe_29f002: id1 0x4f, id2 0x81
Probing for Macronix MX29LV040, 512 KB: probe_29f002: id1 0xff, id2 0xff
Probing for Numonyx M25PE10, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Numonyx M25PE20, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Numonyx M25PE40, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Numonyx M25PE80, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Numonyx M25PE16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV010, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV016B, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV020, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV040, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV080B, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm25LV512, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC Pm29F0002T, 256 KB: probe_29f040b: id1 0x4f, id2 0x81
Probing for PMC Pm29F0002B, 256 KB: probe_29f040b: id1 0x4f, id2 0x81
Probing for PMC Pm39LV010, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for PMC Pm49FL002, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for PMC Pm49FL004, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Sanyo LF25FW203A, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Sharp LHF00L04, 1024 KB: probe_lhf00l04: id1 0x41, id2 0x53
Probing for Spansion S25FL016A, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF016B, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF032B, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF040B, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF040.REMS, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF040B.REMS, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST25VF080B, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST SST28SF040A, 512 KB: probe_28sf040: id1 0xff, id2 0xff
Probing for SST SST29EE010, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST29LE010, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST29EE020A, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST29LE020, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39SF010A, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39SF020A, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39SF040, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39VF512, 64 KB: probe_jedec: id1 0x50, id2 0xfb, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39VF010, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39VF020, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39VF040, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST39VF080, 1024 KB: probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF002A/B, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF003A/B, 384 KB: probe_jedec: id1 0x00, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF004A/B, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF004C, 512 KB: probe_49lfxxxc: id1 0xff, id2 0xff
Probing for SST SST49LF008A, 1024 KB: probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF008C, 1024 KB: probe_49lfxxxc: id1 0x41, id2 0x53
Probing for SST SST49LF016C, 2048 KB: probe_49lfxxxc: id1 0x41, id2 0x53
Probing for SST SST49LF020, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF020A, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF040, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF040B, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF080A, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SST SST49LF160C, 2048 KB: probe_49lfxxxc: id1 0x41, id2 0x53
Probing for ST M25P05-A, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P05.RES, 64 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P10-A, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P10.RES, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P20, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P40, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P40-old, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P80, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P32, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P64, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M25P128, 16384 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST M29F002B, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for ST M29F002T/NT, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for ST M29F040B, 512 KB: probe_29f040b: id1 0xff, id2 0xff
Probing for ST M29F400BT, 512 KB: probe_m29f400bt: id1 0xff, id2 0xff
Probing for ST M29W010B, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M29W040B, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M50FLW040A, 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M50FLW040B, 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M50FLW080A, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M50FLW080B, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for ST M50FW002, 256 KB: probe_49lfxxxc: id1 0x4f, id2 0x81
Probing for ST M50FW016, 2048 KB: probe_82802ab: id1 0x41, id2 0x53
Probing for ST M50FW040, 512 KB: probe_82802ab: id1 0xff, id2 0xff
Probing for ST M50FW080, 1024 KB: probe_82802ab: id1 0x41, id2 0x53
Probing for ST M50LPW116, 2048 KB: probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SyncMOS S29C31004T, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SyncMOS S29C51001T, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for SyncMOS S29C51002T, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for SyncMOS S29C51004T, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for TI TMS29F002RB, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for TI TMS29F002RT, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W25x10, 128 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x20, 256 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x40, 512 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x80, 1024 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x16, 2048 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x32, 4096 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W25x64, 8192 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Winbond W29C011, 128 KB: probe_jedec: id1 0x50, id2 0x00, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W29C020C, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W29C040P, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W29EE011, 128 KB: Probing disabled for Winbond W29EE011 because the probing sequence puts the AMIC A49LF040A in a funky state. Use 'flashrom -c W29EE011' if you have a board with this chip.
Probing for Winbond W39V040A, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V040B, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V040C, 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V040FA, 512 KB: probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V080A, 1024 KB: probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W49F002U, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W49V002A, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W49V002FA, 256 KB: probe_jedec: id1 0x4f, id2 0x81, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V080FA, 1024 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0x41, id2 0x53, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Winbond W39V080FA (dual mode), 512 KB: Chip lacks correct probe timing information, using default 10mS/40uS. probe_jedec: id1 0xff, id2 0xff, id1 parity violation, id1 is normal flash content, id2 is normal flash content
Probing for Atmel unknown Atmel SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for EON unknown EON SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Macronix unknown Macronix SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for PMC unknown PMC SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for SST unknown SST SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for ST unknown ST SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Sanyo unknown Sanyo SPI chip, 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Generic unknown SPI chip (RDID), 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
Probing for Generic unknown SPI chip (REMS), 0 KB: skipped. Host bus type Non-SPI and chip bus type SPI are incompatible.
No EEPROM/flash device found.
If you know which flash chip you have, and if this version of flashrom
supports a similar flash chip, you can try to force read your chip. Run:
flashrom -f -r -c similar_supported_flash_chip filename

Note: flashrom can never write when the flash chip isn't found automatically.

[PATCH] MCP67 SPI detection/debugging

[Carl-Daniel Hailfinger]

On 04.12.2009 17:48, Alessandro Polverini wrote:
> I got latest sources from trunk, applied the provided patch,
> cold-booted and saved the output of flashrom -V (attached).
>
> flashrom v0.9.1-r791
> No coreboot table found.
> Found chipset "NVIDIA MCP67", enabling flash write... ISA bridge reg 0x8a contents: 0x40, bit 6 is 1, bit 5 is 0

Interesting. Apparently these bits are already set exactly the way we
would have set them according to the spec. Maybe we can use this to
differentiate between LPC/SPI flash.
> GPIO BAR is at 0xfec80000, after clearing low bits BAR is at 0xfec80000

Good.
> SPI control is 0xc01a, enable=0, idle=0

As expected.
> I hope this helps,

Yes, it helps a lot. Thank you!

Now we just have to find people who can run this patch on MCP67 with LPC
flash (or can at least send full lspci for such boards). If ISA bridge
reg 0x8a differs there, we can investigate further. If you or someone
else have a machine with similar chipset which can be rebooted a few
times, it would be very interesting to mess with the ISA bridge regs
(may cause a crash, should automatically recover after a full poweroff).

Regards,
Carl-Daniel

[PATCH] MCP67 SPI detection/debugging

[Carl-Daniel Hailfinger]

Here's a new iteration of the patch.
Alex, it would be great if you could supply the output (as described
below) from your Asus M2N68-VM board. Feel free to wait until this patch
is merged, though.

I'd like to merge this ASAP and then ping everyone who had post-MCP55
Nvidia chipset boards to get flashrom -V output.

-----------------
Add SPI mode diagnostics for all post-MCP55 (nForce 5) chipsets from Nvidia.

Huge thanks to Michael Karcher for reverse engineering the MCP67 chipset
and writing a spec. Due to this, we were able to use the chinese wall
technique for 100% clean room reverse engineering.

This patch doesn't touch any of the new registers, it only reads them.
Assuming that read has no side effects, this patch is a no-op and safe.

We need "flashrom -V" output from all post-MCP55 (nForce 5) chipset
boards. Please indicate if your board uses SPI flash or LPC flash (if
you know it). Note: That output is only helpful if it is created with
patched flashrom and if is from the first run of flashrom after a cold
boot (reset or Ctrl-Alt-Del is not sufficient). There is a pattern based
on which we can probably detect which flash type is present on the board.

Thanks to Alessandro Polverini for testing an earlier iteration of this
patch.

Note: The MCP67 should work. I guessed that the other recent Nvidia
chipsets would work in a similar way, and created a simplified
do-nothing catchall chipset enable function which dumps some info and
instructs the user to send more info.

Signed-off-by: Carl-Daniel Hailfinger

Index: flashrom-mcp67_spi_detect/chipset_enable.c
===================================================================
--- flashrom-mcp67_spi_detect/chipset_enable.c	(Revision 886)
+++ flashrom-mcp67_spi_detect/chipset_enable.c	(Arbeitskopie)
@@ -1054,6 +1054,118 @@
    return 0;
 }

+/**
+ * The MCP67 code is guesswork based on cleanroom reverse engineering.
+ * Due to that, it only reads info and doesn't change any settings.
+ * It is assumed that LPC chips need the MCP55 code and SPI chips need the
+ * code provided in this function. Until we know for sure, call
+ * enable_flash_mcp55 from this function.
+ */
+static int enable_flash_mcp67(struct pci_dev *dev, const char *name)
+{
+	int result = 0;
+	uint8_t byte;
+	uint16_t status;
+	uint32_t gpiobaraddr;
+	void *gpiobar;
+	struct pci_dev *smbusdev;
+
+	/* dev is the ISA bridge. No idea what the stuff below does. */
+	byte = pci_read_byte(dev, 0x8a);
+	msg_pdbg("ISA bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5 is "
+		 "%i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
+	msg_pdbg("Guessed flash bus type is %s\n", ((byte >> 5) & 0x3) == 0x2 ?
+		 "SPI" : "unknown, probably LPC");
+	/* Disable the write code for now until we have more info. */
+#if 0
+	byte |= (1 << 6);
+	byte &= ~(1 << 5);
+	pci_write_byte(dev, 0x8a, byte);
+#endif
+
+	/* Look for the SMBus device (SMBus PCI class) */
+	smbusdev = pci_dev_find_vendorclass(0x10de, 0x0c05);
+	if (!smbusdev) {
+		msg_perr("ERROR: SMBus device not found. Aborting.\n");
+		exit(1);
+	}
+	msg_pdbg("Found SMBus device %04x:%04x at %02x:%02x:%01x\n",
+		smbusdev->vendor_id, smbusdev->device_id,
+		smbusdev->bus, smbusdev->dev, smbusdev->func);
+
+	/* Locate the BAR where the GPIOs live. */
+	gpiobaraddr = pci_read_long(smbusdev, 0x74);
+	msg_pdbg("GPIO BAR is at 0x%08x, ", gpiobaraddr);
+	/* We hope this has native alignment. We know the GPIOs are at offset
+	 * 0x530, so we expect a size of at least 0x800. Clear the lower bits.
+	 * It is entirely possible that the BAR is 64k big and the low bits are
+	 * reserved for an entirely different purpose.
+	 */
+	gpiobaraddr &= ~0x7ff;
+	msg_pdbg("after clearing low bits BAR is at 0x%08x\n", gpiobaraddr);
+
+	/* Accessing a NULL pointer BAR is evil. Don't do it. */
+	if (gpiobaraddr) {
+		/* Map the BAR. We access bytewise and wordwise at 0x530. */
+		gpiobar = physmap("MCP67 GPIO", gpiobaraddr, 0x534);
+/* Guessed. If this is correct, migrate to a separate MCP67 SPI driver. */
+#define MCP67_SPI_CS		(1 << 1)
+#define MCP67_SPI_SCK		(1 << 2)
+#define MCP67_SPI_MOSI		(1 << 3)
+#define MCP67_SPI_MISO		(1 << 4)
+#define MCP67_SPI_ENABLE	(1 << 0)
+#define MCP67_SPI_IDLE		(1 << 8)
+		status = mmio_readw(gpiobar + 0x530);
+		msg_pdbg("SPI control is 0x%04x, enable=%i, idle=%i\n",
+			 status, status & 0x1, (status >> 8) & 0x1);
+	}
+	msg_pinfo("Please send the output of "flashrom -V" to "
+		  "[e-mail] to help us finish support for your "
+		  "chipset. Thanks.\n");
+
+	/* Not sure if this is still correct. No docs as usual. */
+	result = enable_flash_mcp55(dev, name);
+
+	return result;
+}
+
+/* This is a shot in the dark. Even if the code is totally bogus for some
+ * chipsets, users will at least start to send in reports.
+ */
+static int enable_flash_mcp7x(struct pci_dev *dev, const char *name)
+{
+	uint8_t byte;
+	uint32_t gpiobaraddr;
+	struct pci_dev *smbusdev;
+
+	msg_pinfo("This chipset is not really supported yet. Guesswork...\n");
+
+	/* dev is the ISA bridge. No idea what the stuff below does. */
+	byte = pci_read_byte(dev, 0x8a);
+	msg_pdbg("ISA/LPC bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5 "
+		 "is %i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
+
+	/* Look for the SMBus device (SMBus PCI class) */
+	smbusdev = pci_dev_find_vendorclass(0x10de, 0x0c05);
+	if (!smbusdev) {
+		msg_perr("ERROR: SMBus device not found. Aborting.\n");
+		exit(1);
+	}
+	msg_pdbg("Found SMBus device %04x:%04x at %02x:%02x:%01x\n",
+		smbusdev->vendor_id, smbusdev->device_id,
+		smbusdev->bus, smbusdev->dev, smbusdev->func);
+
+	/* Locate the BAR where the GPIOs live. */
+	gpiobaraddr = pci_read_long(smbusdev, 0x74);
+	msg_pdbg("GPIO BAR is at 0x%08x, ", gpiobaraddr);
+
+	msg_pinfo("Please send the output of "flashrom -V" to "
+		  "[e-mail] to help us finish support for your "
+		  "chipset. Thanks.\n");
+
+	return 0;
+}
+
 static int enable_flash_ht1000(struct pci_dev *dev, const char *name)
 {
    uint8_t byte;
@@ -1193,7 +1305,22 @@
    {0x10de, 0x0365, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0366, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0367, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* Pro */
-	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp55},
+	{0x10de, 0x03e0, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e1, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e2, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e3, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x0440, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0441, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0442, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0443, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp67},
+	{0x10de, 0x075c, NT, "NVIDIA", "MCP78S",	enable_flash_mcp7x},
+	{0x10de, 0x075d, NT, "NVIDIA", "MCP78S",	enable_flash_mcp7x},
+	{0x10de, 0x07d7, NT, "NVIDIA", "MCP73",		enable_flash_mcp7x},
+	{0x10de, 0x0aac, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aad, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aae, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aaf, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
    {0x1039, 0x0496, NT, "SiS", "85C496+497",	enable_flash_sis85c496},
    {0x1039, 0x0406, NT, "SiS", "501/5101/5501",	enable_flash_sis501},
    {0x1039, 0x5511, NT, "SiS", "5511",		enable_flash_sis5511},

[PATCH] MCP67 SPI detection/debugging

[Andrew Morgan]

Carl-Daniel Hailfinger wrote:
> We need "flashrom -V" output from all post-MCP55 (nForce 5) chipset
> boards. Please indicate if your board uses SPI flash or LPC flash (if
> you know it). Note: That output is only helpful if it is created with
> patched flashrom and if is from the first run of flashrom after a cold
> boot (reset or Ctrl-Alt-Del is not sufficient). There is a pattern based
> on which we can probably detect which flash type is present on the board.

I've patched, compiled and run flashrom -V on my Acer Aspire Revo R3600, 
nVidia MCP79 chipset.
Powered off and even unplugged from the mains before testing.
Out of curiosity I ran it twice, the only difference was the 
'Calibrating delay loop...' line.

Attached is the output of 'flashrom -V' the first run after booting. 
Board has a W25X80AVAIZ SPI flash chip.

[PATCH] MCP67 SPI detection/debugging

[Michael Karcher]

Am Montag, den 01.02.2010, 03:31 +0100 schrieb Carl-Daniel Hailfinger:
> +/**
> The MCP67 code is guesswork based on cleanroom reverse engineering.
> Due to that, it only reads info and doesn't change any settings.
> It is assumed that LPC chips need the MCP55 code and SPI chips need the
> code provided in this function. Until we know for sure, call
> enable_flash_mcp55 from this function.
> */

We don't know whether we can switch the chip between SPI and LPC mode
(does it support LPC at all?), and running correct initialization for
SPI might make LPC inaccessible.
[...]
> msg_pdbg("ISA bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5 is "
>  "%i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
> msg_pdbg("Guessed flash bus type is %s\n", ((byte >> 5) & 0x3) == 0x2 ?
>  "SPI" : "unknown, probably LPC");
> /* Disable the write code for now until we have more info. */

Looks fine.
> /* Locate the BAR where the GPIOs live. */

Maybe GPIO should be changed to something else, as the standard GPIOs
are I/O mapped. Make that "where the SPI interface lives"
> gpiobaraddr = pci_read_long(smbusdev, 0x74);
> msg_pdbg("GPIO BAR is at 0x%08x, ", gpiobaraddr);
> /* We hope this has native alignment. We know the GPIOs are at offset
> * 0x530, so we expect a size of at least 0x800. Clear the lower bits.
> * It is entirely possible that the BAR is 64k big and the low bits are
> * reserved for an entirely different purpose.
> */
> gpiobaraddr &= ~0x7ff;
> msg_pdbg("after clearing low bits BAR is at 0x%08x\n", gpiobaraddr);
> /* Accessing a NULL pointer BAR is evil. Don't do it. */
> if (gpiobaraddr) {
> /* Map the BAR. We access bytewise and wordwise at 0x530. */
> gpiobar = physmap("MCP67 GPIO", gpiobaraddr, 0x534);

We might need gpiobaraddr + 0x10 later. Some BIOSses access it, too. Go
directly for 0x544.
> +/* Guessed. If this is correct, migrate to a separate MCP67 SPI driver. */
> +#define MCP67_SPI_CS		(1 << 1)
> +#define MCP67_SPI_SCK		(1 << 2)
> +#define MCP67_SPI_MOSI		(1 << 3)
> +#define MCP67_SPI_MISO		(1 << 4)
> +#define MCP67_SPI_ENABLE	(1 << 0)
> +#define MCP67_SPI_IDLE		(1 << 8)
> status = mmio_readw(gpiobar + 0x530);
> msg_pdbg("SPI control is 0x%04x, enable=%i, idle=%i\n",
> 	 status, status & 0x1, (status >> 8) & 0x1);
> }

Add error handling here [else msg_perr("bad base address of memory
mapped interface")]
> +/* This is a shot in the dark. Even if the code is totally bogus for some
> chipsets, users will at least start to send in reports.
> */

Mostly a ripoff of the mcp67 function, bit without any writing. OK.

Acked-By: Michael Karcher

[PATCH] MCP67 SPI detection/debugging

[Carl-Daniel Hailfinger]

On 03.02.2010 18:32, Michael Karcher wrote:
> Am Montag, den 01.02.2010, 03:31 +0100 schrieb Carl-Daniel Hailfinger:
> > +/**
> > The MCP67 code is guesswork based on cleanroom reverse engineering.
> > Due to that, it only reads info and doesn't change any settings.
> > It is assumed that LPC chips need the MCP55 code and SPI chips need the
> > code provided in this function. Until we know for sure, call
> > enable_flash_mcp55 from this function.
> > */
>
> We don't know whether we can switch the chip between SPI and LPC mode
> (does it support LPC at all?), and running correct initialization for
> SPI might make LPC inaccessible.

AFAIK at least one MCP67 machine used LPC flash and the MCP55 enable
worked for it.
I have added comments about possible LPC/SPI mutual exclusion to the
function. Right now we only support LPC anyway, and all SPI information
is dumped before touching LPC in any way.
> > /* Locate the BAR where the GPIOs live. */
>
> Maybe GPIO should be changed to something else, as the standard GPIOs
> are I/O mapped. Make that "where the SPI interface lives"

Done.
> > /* Map the BAR. We access bytewise and wordwise at 0x530. */
> > gpiobar = physmap("MCP67 GPIO", gpiobaraddr, 0x534);
>
> We might need gpiobaraddr + 0x10 later. Some BIOSses access it, too. Go
> directly for 0x544.

Done.
> Add error handling here [else msg_perr("bad base address of memory
> mapped interface")]

msg_pdbg since it may be zero on pure LPC boards, but yes.
> > +/* This is a shot in the dark. Even if the code is totally bogus for some
> > chipsets, users will at least start to send in reports.
> > */
>
> Mostly a ripoff of the mcp67 function, bit without any writing. OK.

Yes, once we get reports from that function, we can maybe refactor them
a bit and have the mcp67 function call the generic one.
> Acked-By: Michael Karcher

Thanks! Here's the new version.

Add SPI mode diagnostics for all post-MCP55 (nForce 5) chipsets from Nvidia.

Huge thanks to Michael Karcher for reverse engineering the MCP67 chipset
and writing a spec. Due to this, we were able to use the chinese wall
technique for 100% clean room reverse engineering.

This patch doesn't touch any of the new registers, it only reads them.
Assuming that read has no side effects, this patch is a no-op and safe.

We need "flashrom -V" output from all post-MCP55 (nForce 5) chipset
boards. Please indicate if your board uses SPI flash or LPC flash (if
you know it). Note: That output is only helpful if it is created with
patched flashrom and if is from the first run of flashrom after a cold
boot (reset or Ctrl-Alt-Del is not sufficient). There is a pattern based
on which we can probably detect which flash type is present on the board.

Thanks to Alessandro Polverini for testing earlier iterations of this
patch.

Note: The MCP67 should work. I guessed that the other recent Nvidia
chipsets would work in a similar way, and created a simplified
do-nothing catchall chipset enable function which dumps some info and
instructs the user to send more info.

Signed-off-by: Carl-Daniel Hailfinger

Index: flashrom-mcp67_spi_detect/chipset_enable.c
===================================================================
--- flashrom-mcp67_spi_detect/chipset_enable.c	(Revision 899)
+++ flashrom-mcp67_spi_detect/chipset_enable.c	(Arbeitskopie)
@@ -1054,6 +1054,127 @@
    return 0;
 }

+/**
+ * The MCP67 code is guesswork based on cleanroom reverse engineering.
+ * Due to that, it only reads info and doesn't change any settings.
+ * It is assumed that LPC chips need the MCP55 code and SPI chips need the
+ * code provided in this function. Until we know for sure, call
+ * enable_flash_mcp55 from this function. Warning: enable_flash_mcp55
+ * might make SPI flash inaccessible. The same caveat applies to SPI init
+ * for LPC flash.
+ */
+static int enable_flash_mcp67(struct pci_dev *dev, const char *name)
+{
+	int result = 0;
+	uint8_t byte;
+	uint16_t status;
+	uint32_t mcp_spibaraddr;
+	void *mcp_spibar;
+	struct pci_dev *smbusdev;
+
+	/* dev is the ISA bridge. No idea what the stuff below does. */
+	byte = pci_read_byte(dev, 0x8a);
+	msg_pdbg("ISA bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5 is "
+		 "%i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
+	msg_pdbg("Guessed flash bus type is %s\n", ((byte >> 5) & 0x3) == 0x2 ?
+		 "SPI" : "unknown, probably LPC");
+	/* Disable the write code for now until we have more info. */
+#if 0
+	byte |= (1 << 6);
+	byte &= ~(1 << 5);
+	pci_write_byte(dev, 0x8a, byte);
+#endif
+
+	/* Look for the SMBus device (SMBus PCI class) */
+	smbusdev = pci_dev_find_vendorclass(0x10de, 0x0c05);
+	if (!smbusdev) {
+		msg_perr("ERROR: SMBus device not found. Aborting.\n");
+		exit(1);
+	}
+	msg_pdbg("Found SMBus device %04x:%04x at %02x:%02x:%01x\n",
+		smbusdev->vendor_id, smbusdev->device_id,
+		smbusdev->bus, smbusdev->dev, smbusdev->func);
+
+	/* Locate the BAR where the SPI interface lives. */
+	mcp_spibaraddr = pci_read_long(smbusdev, 0x74);
+	msg_pdbg("SPI BAR is at 0x%08x, ", mcp_spibaraddr);
+	/* We hope this has native alignment. We know the SPI interface (well,
+	 * a set of GPIOs that is connected to SPI flash) is at offset 0x530,
+	 * so we expect a size of at least 0x800. Clear the lower bits.
+	 * It is entirely possible that the BAR is 64k big and the low bits are
+	 * reserved for an entirely different purpose.
+	 */
+	mcp_spibaraddr &= ~0x7ff;
+	msg_pdbg("after clearing low bits BAR is at 0x%08x\n", mcp_spibaraddr);
+
+	/* Accessing a NULL pointer BAR is evil. Don't do it. */
+	if (mcp_spibaraddr) {
+		/* Map the BAR. Bytewise/wordwise access at 0x530 and 0x540. */
+		mcp_spibar = physmap("MCP67 SPI", mcp_spibaraddr, 0x544);
+
+/* Guessed. If this is correct, migrate to a separate MCP67 SPI driver. */
+#define MCP67_SPI_CS		(1 << 1)
+#define MCP67_SPI_SCK		(1 << 2)
+#define MCP67_SPI_MOSI		(1 << 3)
+#define MCP67_SPI_MISO		(1 << 4)
+#define MCP67_SPI_ENABLE	(1 << 0)
+#define MCP67_SPI_IDLE		(1 << 8)
+
+		status = mmio_readw(mcp_spibar + 0x530);
+		msg_pdbg("SPI control is 0x%04x, enable=%i, idle=%i\n",
+			 status, status & 0x1, (status >> 8) & 0x1);
+		/* FIXME: Remove the physunmap once the SPI driver exists. */
+		physunmap(mcp_spibar, 0x544);
+	} else {
+		msg_pdbg("Strange. MCP67 SPI BAR is invalid.\n");
+	}
+	msg_pinfo("Please send the output of "flashrom -V" to "
+		  "[e-mail] to help us finish support for your "
+		  "chipset. Thanks.\n");
+
+	/* Not sure if this is still correct. No docs as usual. */
+	result = enable_flash_mcp55(dev, name);
+
+	return result;
+}
+
+/* This is a shot in the dark. Even if the code is totally bogus for some
+ * chipsets, users will at least start to send in reports.
+ */
+static int enable_flash_mcp7x(struct pci_dev *dev, const char *name)
+{
+	uint8_t byte;
+	uint32_t mcp_spibaraddr;
+	struct pci_dev *smbusdev;
+
+	msg_pinfo("This chipset is not really supported yet. Guesswork...\n");
+
+	/* dev is the ISA bridge. No idea what the stuff below does. */
+	byte = pci_read_byte(dev, 0x8a);
+	msg_pdbg("ISA/LPC bridge reg 0x8a contents: 0x%02x, bit 6 is %i, bit 5 "
+		 "is %i\n", byte, (byte >> 6) & 0x1, (byte >> 5) & 0x1);
+
+	/* Look for the SMBus device (SMBus PCI class) */
+	smbusdev = pci_dev_find_vendorclass(0x10de, 0x0c05);
+	if (!smbusdev) {
+		msg_perr("ERROR: SMBus device not found. Aborting.\n");
+		exit(1);
+	}
+	msg_pdbg("Found SMBus device %04x:%04x at %02x:%02x:%01x\n",
+		smbusdev->vendor_id, smbusdev->device_id,
+		smbusdev->bus, smbusdev->dev, smbusdev->func);
+
+	/* Locate the BAR where the SPI interface lives. */
+	mcp_spibaraddr = pci_read_long(smbusdev, 0x74);
+	msg_pdbg("SPI BAR is at 0x%08x, ", mcp_spibaraddr);
+
+	msg_pinfo("Please send the output of "flashrom -V" to "
+		  "[e-mail] to help us finish support for your "
+		  "chipset. Thanks.\n");
+
+	return 0;
+}
+
 static int enable_flash_ht1000(struct pci_dev *dev, const char *name)
 {
    uint8_t byte;
@@ -1193,7 +1314,22 @@
    {0x10de, 0x0365, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0366, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* LPC */
    {0x10de, 0x0367, OK, "NVIDIA", "MCP55",		enable_flash_mcp55}, /* Pro */
-	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp55},
+	{0x10de, 0x03e0, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e1, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e2, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x03e3, NT, "NVIDIA", "MCP61",		enable_flash_mcp7x},
+	{0x10de, 0x0440, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0441, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0442, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0443, NT, "NVIDIA", "MCP65",		enable_flash_mcp7x},
+	{0x10de, 0x0548, OK, "NVIDIA", "MCP67",		enable_flash_mcp67},
+	{0x10de, 0x075c, NT, "NVIDIA", "MCP78S",	enable_flash_mcp7x},
+	{0x10de, 0x075d, NT, "NVIDIA", "MCP78S",	enable_flash_mcp7x},
+	{0x10de, 0x07d7, NT, "NVIDIA", "MCP73",		enable_flash_mcp7x},
+	{0x10de, 0x0aac, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aad, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aae, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
+	{0x10de, 0x0aaf, NT, "NVIDIA", "MCP79",		enable_flash_mcp7x},
    {0x1039, 0x0496, NT, "SiS", "85C496+497",	enable_flash_sis85c496},
    {0x1039, 0x0406, NT, "SiS", "501/5101/5501",	enable_flash_sis501},
    {0x1039, 0x5511, NT, "SiS", "5511",		enable_flash_sis5511},

[PATCH] MCP67 SPI detection/debugging

[Michael Karcher]

Am Samstag, den 13.02.2010, 18:21 +0100 schrieb Carl-Daniel Hailfinger:
> Thanks! Here's the new version.

Looks good to me.

Acked-by: Michael Karcher

[PATCH] MCP67 SPI detection/debugging

[Carl-Daniel Hailfinger]

On 13.02.2010 23:32, Michael Karcher wrote:
> Am Samstag, den 13.02.2010, 18:21 +0100 schrieb Carl-Daniel Hailfinger:
> > Thanks! Here's the new version.
>
> Looks good to me.
>
> Acked-by: Michael Karcher

Thanks, committed in r902.

Regards,
Carl-Daniel