1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2
3 #define __SIMPLE_DEVICE__
4
5 /* This file is derived from the flashrom project. */
6
7 #include <string.h>
8 #include <bootstate.h>
9 #include <commonlib/helpers.h>
10 #include <delay.h>
11 #include <device/mmio.h>
12 #include <device/pci_ops.h>
13 #include <console/console.h>
14 #include <device/device.h>
15 #include <device/pci.h>
16 #include <spi_flash.h>
17 #include <spi-generic.h>
18 #include <timer.h>
19 #include <types.h>
20
21 #include "spi.h"
22
23 #define HSFC_FCYCLE_OFF 1 /* 1-2: FLASH Cycle */
24 #define HSFC_FCYCLE (0x3 << HSFC_FCYCLE_OFF)
25 #define HSFC_FDBC_OFF 8 /* 8-13: Flash Data Byte Count */
26 #define HSFC_FDBC (0x3f << HSFC_FDBC_OFF)
27
28 static int spi_is_multichip(void);
29
30 static void spi_set_smm_only_flashing(bool enable);
31
32 struct ich7_spi_regs {
33 uint16_t spis;
34 uint16_t spic;
35 uint32_t spia;
36 uint64_t spid[8];
37 uint64_t _pad;
38 uint32_t bbar;
39 uint16_t preop;
40 uint16_t optype;
41 uint8_t opmenu[8];
42 uint32_t pbr[3];
43 } __packed;
44
45 struct ich9_spi_regs {
46 uint32_t bfpr;
47 uint16_t hsfs;
48 uint16_t hsfc;
49 uint32_t faddr;
50 uint32_t _reserved0;
51 uint32_t fdata[16];
52 uint32_t frap;
53 uint32_t freg[5];
54 uint32_t _reserved1[3];
55 uint32_t pr[5];
56 uint32_t _reserved2[2];
57 uint8_t ssfs;
58 uint8_t ssfc[3];
59 uint16_t preop;
60 uint16_t optype;
61 uint8_t opmenu[8];
62 uint32_t bbar;
63 uint8_t _reserved3[12];
64 uint32_t fdoc;
65 uint32_t fdod;
66 uint8_t _reserved4[8];
67 uint32_t afc;
68 uint32_t lvscc;
69 uint32_t uvscc;
70 uint8_t _reserved5[4];
71 uint32_t fpb;
72 uint8_t _reserved6[28];
73 uint32_t srdl;
74 uint32_t srdc;
75 uint32_t srd;
76 } __packed;
77
78 struct ich_spi_controller {
79 int locked;
80 uint32_t flmap0;
81 uint32_t flcomp;
82 uint32_t hsfs;
83
84 union {
85 struct ich9_spi_regs *ich9_spi;
86 struct ich7_spi_regs *ich7_spi;
87 };
88 uint8_t *opmenu;
89 int menubytes;
90 uint16_t *preop;
91 uint16_t *optype;
92 uint32_t *addr;
93 uint8_t *data;
94 unsigned int databytes;
95 uint8_t *status;
96 uint8_t *control; /* Unaligned on ICH9 */
97 uint32_t *bbar;
98 uint32_t *fpr;
99 uint8_t fpr_max;
100 };
101
102 static struct ich_spi_controller cntlr;
103
104 enum {
105 SPIS_SCIP = 0x0001,
106 SPIS_GRANT = 0x0002,
107 SPIS_CDS = 0x0004,
108 SPIS_FCERR = 0x0008,
109 SSFS_AEL = 0x0010,
110 SPIS_LOCK = 0x8000,
111 SPIS_RESERVED_MASK = 0x7ff0,
112 SSFS_RESERVED_MASK = 0x7fe2
113 };
114
115 enum {
116 SPIC_SCGO = 0x000002,
117 SPIC_ACS = 0x000004,
118 SPIC_SPOP = 0x000008,
119 SPIC_DBC = 0x003f00,
120 SPIC_DS = 0x004000,
121 SPIC_SME = 0x008000,
122 SSFC_SCF_MASK = 0x070000,
123 SSFC_RESERVED = 0xf80000
124 };
125
126 enum {
127 HSFS_FDONE = 0x0001,
128 HSFS_FCERR = 0x0002,
129 HSFS_AEL = 0x0004,
130 HSFS_BERASE_MASK = 0x0018,
131 HSFS_BERASE_SHIFT = 3,
132 HSFS_SCIP = 0x0020,
133 HSFS_FDOPSS = 0x2000,
134 HSFS_FDV = 0x4000,
135 HSFS_FLOCKDN = 0x8000
136 };
137
138 enum {
139 HSFC_FGO = 0x0001,
140 HSFC_FCYCLE_MASK = 0x0006,
141 HSFC_FCYCLE_SHIFT = 1,
142 HSFC_FDBC_MASK = 0x3f00,
143 HSFC_FDBC_SHIFT = 8,
144 HSFC_FSMIE = 0x8000
145 };
146
147 enum {
148 SPI_OPCODE_TYPE_READ_NO_ADDRESS = 0,
149 SPI_OPCODE_TYPE_WRITE_NO_ADDRESS = 1,
150 SPI_OPCODE_TYPE_READ_WITH_ADDRESS = 2,
151 SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS = 3
152 };
153
154 #if CONFIG(DEBUG_SPI_FLASH)
155
readb_(const void * addr)156 static u8 readb_(const void *addr)
157 {
158 u8 v = read8(addr);
159
160 printk(BIOS_DEBUG, "read %2.2x from %4.4lx\n",
161 v, ((uintptr_t)addr & 0xffff) - 0xf020);
162 return v;
163 }
164
readw_(const void * addr)165 static u16 readw_(const void *addr)
166 {
167 u16 v = read16(addr);
168
169 printk(BIOS_DEBUG, "read %4.4x from %4.4lx\n",
170 v, ((uintptr_t)addr & 0xffff) - 0xf020);
171 return v;
172 }
173
readl_(const void * addr)174 static u32 readl_(const void *addr)
175 {
176 u32 v = read32(addr);
177
178 printk(BIOS_DEBUG, "read %8.8x from %4.4lx\n",
179 v, ((uintptr_t)addr & 0xffff) - 0xf020);
180 return v;
181 }
182
writeb_(u8 b,void * addr)183 static void writeb_(u8 b, void *addr)
184 {
185 write8(addr, b);
186 printk(BIOS_DEBUG, "wrote %2.2x to %4.4lx\n",
187 b, ((uintptr_t)addr & 0xffff) - 0xf020);
188 }
189
writew_(u16 b,void * addr)190 static void writew_(u16 b, void *addr)
191 {
192 write16(addr, b);
193 printk(BIOS_DEBUG, "wrote %4.4x to %4.4lx\n",
194 b, ((uintptr_t)addr & 0xffff) - 0xf020);
195 }
196
writel_(u32 b,void * addr)197 static void writel_(u32 b, void *addr)
198 {
199 write32(addr, b);
200 printk(BIOS_DEBUG, "wrote %8.8x to %4.4lx\n",
201 b, ((uintptr_t)addr & 0xffff) - 0xf020);
202 }
203
204 #else /* CONFIG_DEBUG_SPI_FLASH ^^^ enabled vvv NOT enabled */
205
206 #define readb_(a) read8(a)
207 #define readw_(a) read16(a)
208 #define readl_(a) read32(a)
209 #define writeb_(val, addr) write8(addr, val)
210 #define writew_(val, addr) write16(addr, val)
211 #define writel_(val, addr) write32(addr, val)
212
213 #endif /* CONFIG_DEBUG_SPI_FLASH ^^^ NOT enabled */
214
write_reg(const void * value,void * dest,uint32_t size)215 static void write_reg(const void *value, void *dest, uint32_t size)
216 {
217 const uint8_t *bvalue = value;
218 uint8_t *bdest = dest;
219
220 while (size >= 4) {
221 writel_(*(const uint32_t *)bvalue, bdest);
222 bdest += 4; bvalue += 4; size -= 4;
223 }
224 while (size) {
225 writeb_(*bvalue, bdest);
226 bdest++; bvalue++; size--;
227 }
228 }
229
read_reg(const void * src,void * value,uint32_t size)230 static void read_reg(const void *src, void *value, uint32_t size)
231 {
232 const uint8_t *bsrc = src;
233 uint8_t *bvalue = value;
234
235 while (size >= 4) {
236 *(uint32_t *)bvalue = readl_(bsrc);
237 bsrc += 4; bvalue += 4; size -= 4;
238 }
239 while (size) {
240 *bvalue = readb_(bsrc);
241 bsrc++; bvalue++; size--;
242 }
243 }
244
ich_set_bbar(uint32_t minaddr)245 static void ich_set_bbar(uint32_t minaddr)
246 {
247 const uint32_t bbar_mask = 0x00ffff00;
248 uint32_t ichspi_bbar;
249
250 minaddr &= bbar_mask;
251 ichspi_bbar = readl_(cntlr.bbar) & ~bbar_mask;
252 ichspi_bbar |= minaddr;
253 writel_(ichspi_bbar, cntlr.bbar);
254 }
255
256 #if CONFIG(SOUTHBRIDGE_INTEL_I82801GX)
257 #define MENU_BYTES member_size(struct ich7_spi_regs, opmenu)
258 #else
259 #define MENU_BYTES member_size(struct ich9_spi_regs, opmenu)
260 #endif
261
262 #define RCBA 0xf0
263 #define SBASE 0x54
264
get_spi_bar(pci_devfn_t dev)265 static void *get_spi_bar(pci_devfn_t dev)
266 {
267 uintptr_t rcba; /* Root Complex Register Block */
268 uintptr_t sbase;
269
270 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX)) {
271 rcba = pci_read_config32(dev, RCBA);
272 return (void *)((rcba & 0xffffc000) + 0x3020);
273 }
274 if (CONFIG(SOUTHBRIDGE_INTEL_COMMON_SPI_SILVERMONT)) {
275 sbase = pci_read_config32(dev, SBASE);
276 sbase &= ~0x1ff;
277 return (void *)sbase;
278 }
279 if (CONFIG(SOUTHBRIDGE_INTEL_COMMON_SPI_ICH9)) {
280 rcba = pci_read_config32(dev, RCBA);
281 return (void *)((rcba & 0xffffc000) + 0x3800);
282 }
283 }
284
spi_init(void)285 void spi_init(void)
286 {
287 struct ich9_spi_regs *ich9_spi;
288 struct ich7_spi_regs *ich7_spi;
289 uint16_t hsfs;
290
291 pci_devfn_t dev = PCI_DEV(0, 31, 0);
292
293 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX)) {
294 ich7_spi = get_spi_bar(dev);
295 cntlr.ich7_spi = ich7_spi;
296 cntlr.opmenu = ich7_spi->opmenu;
297 cntlr.menubytes = sizeof(ich7_spi->opmenu);
298 cntlr.optype = &ich7_spi->optype;
299 cntlr.addr = &ich7_spi->spia;
300 cntlr.data = (uint8_t *)ich7_spi->spid;
301 cntlr.databytes = sizeof(ich7_spi->spid);
302 cntlr.status = (uint8_t *)&ich7_spi->spis;
303 cntlr.control = (uint8_t *)&ich7_spi->spic;
304 cntlr.bbar = &ich7_spi->bbar;
305 cntlr.preop = &ich7_spi->preop;
306 cntlr.fpr = &ich7_spi->pbr[0];
307 cntlr.fpr_max = 3;
308 } else {
309 ich9_spi = get_spi_bar(dev);
310 cntlr.ich9_spi = ich9_spi;
311 hsfs = readw_(&ich9_spi->hsfs);
312 cntlr.hsfs = hsfs;
313 cntlr.opmenu = ich9_spi->opmenu;
314 cntlr.menubytes = sizeof(ich9_spi->opmenu);
315 cntlr.optype = &ich9_spi->optype;
316 cntlr.addr = &ich9_spi->faddr;
317 cntlr.data = (uint8_t *)ich9_spi->fdata;
318 cntlr.databytes = sizeof(ich9_spi->fdata);
319 cntlr.status = &ich9_spi->ssfs;
320 cntlr.control = ich9_spi->ssfc;
321 cntlr.bbar = &ich9_spi->bbar;
322 cntlr.preop = &ich9_spi->preop;
323 cntlr.fpr = &ich9_spi->pr[0];
324 cntlr.fpr_max = 5;
325
326 if (cntlr.hsfs & HSFS_FDV) {
327 writel_(4, &ich9_spi->fdoc);
328 cntlr.flmap0 = readl_(&ich9_spi->fdod);
329 writel_(0x1000, &ich9_spi->fdoc);
330 cntlr.flcomp = readl_(&ich9_spi->fdod);
331 }
332 }
333
334 ich_set_bbar(0);
335
336 /* Disable the BIOS write protect so write commands are allowed. */
337 spi_set_smm_only_flashing(false);
338 }
339
spi_locked(void)340 static int spi_locked(void)
341 {
342 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX)) {
343 return !!(readw_(&cntlr.ich7_spi->spis) & HSFS_FLOCKDN);
344 } else {
345 return !!(readw_(&cntlr.ich9_spi->hsfs) & HSFS_FLOCKDN);
346 }
347 }
348
spi_init_cb(void * unused)349 static void spi_init_cb(void *unused)
350 {
351 spi_init();
352 }
353
354 BOOT_STATE_INIT_ENTRY(BS_DEV_INIT, BS_ON_ENTRY, spi_init_cb, NULL);
355
356 typedef struct spi_transaction {
357 const uint8_t *out;
358 uint32_t bytesout;
359 uint8_t *in;
360 uint32_t bytesin;
361 uint8_t type;
362 uint8_t opcode;
363 uint32_t offset;
364 } spi_transaction;
365
spi_use_out(spi_transaction * trans,unsigned int bytes)366 static inline void spi_use_out(spi_transaction *trans, unsigned int bytes)
367 {
368 trans->out += bytes;
369 trans->bytesout -= bytes;
370 }
371
spi_use_in(spi_transaction * trans,unsigned int bytes)372 static inline void spi_use_in(spi_transaction *trans, unsigned int bytes)
373 {
374 trans->in += bytes;
375 trans->bytesin -= bytes;
376 }
377
spi_setup_type(spi_transaction * trans)378 static void spi_setup_type(spi_transaction *trans)
379 {
380 trans->type = 0xFF;
381
382 /* Try to guess spi type from read/write sizes. */
383 if (trans->bytesin == 0) {
384 if (trans->bytesout > 4)
385 /*
386 * If bytesin = 0 and bytesout > 4, we presume this is
387 * a write data operation, which is accompanied by an
388 * address.
389 */
390 trans->type = SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS;
391 else
392 trans->type = SPI_OPCODE_TYPE_WRITE_NO_ADDRESS;
393 return;
394 }
395
396 if (trans->bytesout == 1) { /* and bytesin is > 0 */
397 trans->type = SPI_OPCODE_TYPE_READ_NO_ADDRESS;
398 return;
399 }
400
401 if (trans->bytesout == 4) { /* and bytesin is > 0 */
402 trans->type = SPI_OPCODE_TYPE_READ_WITH_ADDRESS;
403 }
404
405 /* Fast read command is called with 5 bytes instead of 4 */
406 if (trans->out[0] == SPI_OPCODE_FAST_READ && trans->bytesout == 5) {
407 trans->type = SPI_OPCODE_TYPE_READ_WITH_ADDRESS;
408 --trans->bytesout;
409 }
410 }
411
spi_setup_opcode(spi_transaction * trans)412 static int spi_setup_opcode(spi_transaction *trans)
413 {
414 uint16_t optypes;
415 uint8_t opmenu[MENU_BYTES];
416
417 trans->opcode = trans->out[0];
418 spi_use_out(trans, 1);
419 if (!spi_locked()) {
420 /* The lock is off, so just use index 0. */
421 writeb_(trans->opcode, cntlr.opmenu);
422 optypes = readw_(cntlr.optype);
423 optypes = (optypes & 0xfffc) | (trans->type & 0x3);
424 writew_(optypes, cntlr.optype);
425 return 0;
426 }
427
428 /* The lock is on. See if what we need is on the menu. */
429 uint8_t optype;
430 uint16_t opcode_index;
431
432 /* Write Enable is handled as atomic prefix */
433 if (trans->opcode == SPI_OPCODE_WREN)
434 return 0;
435
436 read_reg(cntlr.opmenu, opmenu, sizeof(opmenu));
437 for (opcode_index = 0; opcode_index < ARRAY_SIZE(opmenu); opcode_index++) {
438 if (opmenu[opcode_index] == trans->opcode)
439 break;
440 }
441
442 if (opcode_index == ARRAY_SIZE(opmenu)) {
443 printk(BIOS_DEBUG, "ICH SPI: Opcode %x not found\n",
444 trans->opcode);
445 return -1;
446 }
447
448 optypes = readw_(cntlr.optype);
449 optype = (optypes >> (opcode_index * 2)) & 0x3;
450 if (trans->type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS &&
451 optype == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS &&
452 trans->bytesout >= 3) {
453 /* We guessed wrong earlier. Fix it up. */
454 trans->type = optype;
455 }
456 if (optype != trans->type) {
457 printk(BIOS_DEBUG, "ICH SPI: Transaction doesn't fit type %d\n",
458 optype);
459 return -1;
460 }
461 return opcode_index;
462 }
463
spi_setup_offset(spi_transaction * trans)464 static int spi_setup_offset(spi_transaction *trans)
465 {
466 /* Separate the SPI address and data. */
467 switch (trans->type) {
468 case SPI_OPCODE_TYPE_READ_NO_ADDRESS:
469 case SPI_OPCODE_TYPE_WRITE_NO_ADDRESS:
470 return 0;
471 case SPI_OPCODE_TYPE_READ_WITH_ADDRESS:
472 case SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS:
473 trans->offset = ((uint32_t)trans->out[0] << 16) |
474 ((uint32_t)trans->out[1] << 8) |
475 ((uint32_t)trans->out[2] << 0);
476 spi_use_out(trans, 3);
477 return 1;
478 default:
479 printk(BIOS_DEBUG, "Unrecognized SPI transaction type %#x\n", trans->type);
480 return -1;
481 }
482 }
483
484 /*
485 * Wait for up to 6s til status register bit(s) turn 1 (in case wait_til_set
486 * below is True) or 0. In case the wait was for the bit(s) to set - write
487 * those bits back, which would cause resetting them.
488 *
489 * Return the last read status value on success or -1 on failure.
490 */
ich_status_poll(u16 bitmask,int wait_til_set)491 static int ich_status_poll(u16 bitmask, int wait_til_set)
492 {
493 int timeout = 600000; /* This will result in 6 seconds */
494 u16 status = 0;
495
496 while (timeout--) {
497 status = readw_(cntlr.status);
498 if (wait_til_set ^ ((status & bitmask) == 0)) {
499 if (wait_til_set)
500 writew_((status & bitmask), cntlr.status);
501 return status;
502 }
503 udelay(10);
504 }
505
506 printk(BIOS_DEBUG, "ICH SPI: SCIP timeout, read %x, bitmask %x\n",
507 status, bitmask);
508 return -1;
509 }
510
spi_is_multichip(void)511 static int spi_is_multichip(void)
512 {
513 if (!(cntlr.hsfs & HSFS_FDV))
514 return 0;
515 return !!((cntlr.flmap0 >> 8) & 3);
516 }
517
spi_ctrlr_xfer(const struct spi_slave * slave,const void * dout,size_t bytesout,void * din,size_t bytesin)518 static int spi_ctrlr_xfer(const struct spi_slave *slave, const void *dout,
519 size_t bytesout, void *din, size_t bytesin)
520 {
521 uint16_t control;
522 int16_t opcode_index;
523 int with_address;
524 int status;
525
526 spi_transaction trans = {
527 dout, bytesout,
528 din, bytesin,
529 0xff, 0xff, 0
530 };
531
532 /* There has to always at least be an opcode. */
533 if (!bytesout || !dout) {
534 printk(BIOS_DEBUG, "ICH SPI: No opcode for transfer\n");
535 return -1;
536 }
537 /* Make sure if we read something we have a place to put it. */
538 if (bytesin != 0 && !din) {
539 printk(BIOS_DEBUG, "ICH SPI: Read but no target buffer\n");
540 return -1;
541 }
542
543 if (ich_status_poll(SPIS_SCIP, 0) == -1)
544 return -1;
545
546 writew_(SPIS_CDS | SPIS_FCERR, cntlr.status);
547
548 spi_setup_type(&trans);
549 if ((opcode_index = spi_setup_opcode(&trans)) < 0)
550 return -1;
551 if ((with_address = spi_setup_offset(&trans)) < 0)
552 return -1;
553
554 if (trans.opcode == SPI_OPCODE_WREN) {
555 /*
556 * Treat Write Enable as Atomic Pre-Op if possible
557 * in order to prevent the Management Engine from
558 * issuing a transaction between WREN and DATA.
559 */
560 if (!spi_locked())
561 writew_(trans.opcode, cntlr.preop);
562 return 0;
563 }
564
565 /* Preset control fields */
566 control = SPIC_SCGO | ((opcode_index & 0x07) << 4);
567
568 /* Issue atomic preop cycle if needed */
569 if (readw_(cntlr.preop))
570 control |= SPIC_ACS;
571
572 if (!trans.bytesout && !trans.bytesin) {
573 /* SPI addresses are 24 bit only */
574 if (with_address)
575 writel_(trans.offset & 0x00FFFFFF, cntlr.addr);
576
577 /*
578 * This is a 'no data' command (like Write Enable), its
579 * bitesout size was 1, decremented to zero while executing
580 * spi_setup_opcode() above. Tell the chip to send the
581 * command.
582 *
583 * On ICH9 the control register is not natually aligned.
584 * Write the high byte first to prevent triggering a transfer
585 * when writing two bytes on the bus using outw instruction.
586 */
587 writeb_(control >> 8, &cntlr.control[1]);
588 writeb_(control, &cntlr.control[0]);
589
590 /* wait for the result */
591 status = ich_status_poll(SPIS_CDS | SPIS_FCERR, 1);
592 if (status == -1)
593 return -1;
594
595 if (status & SPIS_FCERR) {
596 printk(BIOS_DEBUG, "ICH SPI: Command transaction error\n");
597 return -1;
598 }
599
600 goto spi_xfer_exit;
601 }
602
603 /*
604 * Check if this is a write command attempting to transfer more bytes
605 * than the controller can handle. Iterations for writes are not
606 * supported here because each SPI write command needs to be preceded
607 * and followed by other SPI commands, and this sequence is controlled
608 * by the SPI chip driver.
609 */
610 if (trans.bytesout > cntlr.databytes) {
611 printk(BIOS_DEBUG, "ICH SPI: Too much to write. Does your SPI chip driver use"
612 " spi_crop_chunk()?\n");
613 return -1;
614 }
615
616 /*
617 * Read or write up to databytes bytes at a time until everything has
618 * been sent.
619 */
620 while (trans.bytesout || trans.bytesin) {
621 uint32_t data_length;
622
623 /* SPI addresses are 24 bit only */
624 writel_(trans.offset & 0x00FFFFFF, cntlr.addr);
625
626 if (trans.bytesout)
627 data_length = MIN(trans.bytesout, cntlr.databytes);
628 else
629 data_length = MIN(trans.bytesin, cntlr.databytes);
630
631 /* Program data into FDATA0 to N */
632 if (trans.bytesout) {
633 write_reg(trans.out, cntlr.data, data_length);
634 spi_use_out(&trans, data_length);
635 if (with_address)
636 trans.offset += data_length;
637 }
638
639 /* Add proper control fields' values */
640 control &= ~((cntlr.databytes - 1) << 8);
641 control |= SPIC_DS;
642 control |= (data_length - 1) << 8;
643
644 /*
645 * On ICH9 the control register is not natually aligned.
646 * Write the high byte first to prevent triggering a transfer
647 * when writing two bytes on the bus using outw instruction.
648 */
649 writeb_(control >> 8, &cntlr.control[1]);
650 writeb_(control, &cntlr.control[0]);
651
652 /* Wait for Cycle Done Status or Flash Cycle Error. */
653 status = ich_status_poll(SPIS_CDS | SPIS_FCERR, 1);
654 if (status == -1)
655 return -1;
656
657 if (status & SPIS_FCERR) {
658 printk(BIOS_DEBUG, "ICH SPI: Data transaction error\n");
659 return -1;
660 }
661
662 if (trans.bytesin) {
663 read_reg(cntlr.data, trans.in, data_length);
664 spi_use_in(&trans, data_length);
665 if (with_address)
666 trans.offset += data_length;
667 }
668 }
669
670 spi_xfer_exit:
671 /* Clear atomic preop now that xfer is done */
672 writew_(0, cntlr.preop);
673
674 return 0;
675 }
676
677 /* Sets FLA in FADDR to (addr & 0x01FFFFFF) without touching other bits. */
ich_hwseq_set_addr(uint32_t addr)678 static void ich_hwseq_set_addr(uint32_t addr)
679 {
680 uint32_t addr_old = readl_(&cntlr.ich9_spi->faddr) & ~0x01FFFFFF;
681
682 writel_((addr & 0x01FFFFFF) | addr_old, &cntlr.ich9_spi->faddr);
683 }
684
685 /* Polls for Cycle Done Status, Flash Cycle Error or timeout in 8 us intervals.
686 Resets all error flags in HSFS.
687 Returns 0 if the cycle completes successfully without errors within
688 timeout us, 1 on errors. */
ich_hwseq_wait_for_cycle_complete(unsigned int timeout,unsigned int len)689 static int ich_hwseq_wait_for_cycle_complete(unsigned int timeout,
690 unsigned int len)
691 {
692 uint16_t hsfs;
693 uint32_t addr;
694
695 timeout /= 8; /* scale timeout duration to counter */
696 while ((((hsfs = readw_(&cntlr.ich9_spi->hsfs)) &
697 (HSFS_FDONE | HSFS_FCERR)) == 0) &&
698 --timeout) {
699 udelay(8);
700 }
701 writew_(readw_(&cntlr.ich9_spi->hsfs), &cntlr.ich9_spi->hsfs);
702
703 if (!timeout) {
704 uint16_t hsfc;
705 addr = readl_(&cntlr.ich9_spi->faddr) & 0x01FFFFFF;
706 hsfc = readw_(&cntlr.ich9_spi->hsfc);
707 printk(BIOS_ERR, "Transaction timeout between offset 0x%08x and "
708 "0x%08x (= 0x%08x + %d) HSFC=%x HSFS=%x!\n",
709 addr, addr + len - 1, addr, len - 1,
710 hsfc, hsfs);
711 return 1;
712 }
713
714 if (hsfs & HSFS_FCERR) {
715 uint16_t hsfc;
716 addr = readl_(&cntlr.ich9_spi->faddr) & 0x01FFFFFF;
717 hsfc = readw_(&cntlr.ich9_spi->hsfc);
718 printk(BIOS_ERR, "Transaction error between offset 0x%08x and "
719 "0x%08x (= 0x%08x + %d) HSFC=%x HSFS=%x!\n",
720 addr, addr + len - 1, addr, len - 1,
721 hsfc, hsfs);
722 return 1;
723 }
724 return 0;
725 }
726
ich_hwseq_erase(const struct spi_flash * flash,u32 offset,size_t len)727 static int ich_hwseq_erase(const struct spi_flash *flash, u32 offset,
728 size_t len)
729 {
730 u32 start, end, erase_size;
731 int ret;
732 uint16_t hsfc;
733 unsigned int timeout = 1000 * USECS_PER_MSEC; /* 1 second timeout */
734
735 erase_size = flash->sector_size;
736 if (offset % erase_size || len % erase_size) {
737 printk(BIOS_ERR, "SF: Erase offset/length not multiple of erase size\n");
738 return -1;
739 }
740
741 ret = spi_claim_bus(&flash->spi);
742 if (ret) {
743 printk(BIOS_ERR, "SF: Unable to claim SPI bus\n");
744 return ret;
745 }
746
747 start = offset;
748 end = start + len;
749
750 while (offset < end) {
751 /* make sure FDONE, FCERR, AEL are cleared by writing 1 to them */
752 writew_(readw_(&cntlr.ich9_spi->hsfs), &cntlr.ich9_spi->hsfs);
753
754 ich_hwseq_set_addr(offset);
755
756 offset += erase_size;
757
758 hsfc = readw_(&cntlr.ich9_spi->hsfc);
759 hsfc &= ~HSFC_FCYCLE; /* clear operation */
760 hsfc |= (0x3 << HSFC_FCYCLE_OFF); /* set erase operation */
761 hsfc |= HSFC_FGO; /* start */
762 writew_(hsfc, &cntlr.ich9_spi->hsfc);
763 if (ich_hwseq_wait_for_cycle_complete(timeout, len)) {
764 printk(BIOS_ERR, "SF: Erase failed at %x\n", offset - erase_size);
765 ret = -1;
766 goto out;
767 }
768 }
769
770 printk(BIOS_DEBUG, "SF: Successfully erased %zu bytes @ %#x\n", len, start);
771
772 out:
773 spi_release_bus(&flash->spi);
774 return ret;
775 }
776
ich_read_data(uint8_t * data,int len)777 static void ich_read_data(uint8_t *data, int len)
778 {
779 int i;
780 uint32_t temp32 = 0;
781
782 for (i = 0; i < len; i++) {
783 if ((i % 4) == 0)
784 temp32 = readl_(cntlr.data + i);
785
786 data[i] = (temp32 >> ((i % 4) * 8)) & 0xff;
787 }
788 }
789
ich_hwseq_read(const struct spi_flash * flash,u32 addr,size_t len,void * buf)790 static int ich_hwseq_read(const struct spi_flash *flash, u32 addr, size_t len,
791 void *buf)
792 {
793 uint16_t hsfc;
794 uint16_t timeout = 100 * 60;
795 uint8_t block_len;
796
797 if (addr + len > flash->size) {
798 printk(BIOS_ERR,
799 "Attempt to read %x-%x which is out of chip\n",
800 (unsigned int)addr,
801 (unsigned int)addr+(unsigned int)len);
802 return -1;
803 }
804
805 /* clear FDONE, FCERR, AEL by writing 1 to them (if they are set) */
806 writew_(readw_(&cntlr.ich9_spi->hsfs), &cntlr.ich9_spi->hsfs);
807
808 while (len > 0) {
809 block_len = MIN(len, cntlr.databytes);
810 if (block_len > (~addr & 0xff))
811 block_len = (~addr & 0xff) + 1;
812 ich_hwseq_set_addr(addr);
813 hsfc = readw_(&cntlr.ich9_spi->hsfc);
814 hsfc &= ~HSFC_FCYCLE; /* set read operation */
815 hsfc &= ~HSFC_FDBC; /* clear byte count */
816 /* set byte count */
817 hsfc |= (((block_len - 1) << HSFC_FDBC_OFF) & HSFC_FDBC);
818 hsfc |= HSFC_FGO; /* start */
819 writew_(hsfc, &cntlr.ich9_spi->hsfc);
820
821 if (ich_hwseq_wait_for_cycle_complete(timeout, block_len))
822 return 1;
823 ich_read_data(buf, block_len);
824 addr += block_len;
825 buf += block_len;
826 len -= block_len;
827 }
828 return 0;
829 }
830
831 /* Fill len bytes from the data array into the fdata/spid registers.
832 *
833 * Note that using len > flash->pgm->spi.max_data_write will trash the registers
834 * following the data registers.
835 */
ich_fill_data(const uint8_t * data,int len)836 static void ich_fill_data(const uint8_t *data, int len)
837 {
838 uint32_t temp32 = 0;
839 int i;
840
841 if (len <= 0)
842 return;
843
844 for (i = 0; i < len; i++) {
845 if ((i % 4) == 0)
846 temp32 = 0;
847
848 temp32 |= ((uint32_t)data[i]) << ((i % 4) * 8);
849
850 if ((i % 4) == 3) /* 32 bits are full, write them to regs. */
851 writel_(temp32, cntlr.data + (i - (i % 4)));
852 }
853 i--;
854 if ((i % 4) != 3) /* Write remaining data to regs. */
855 writel_(temp32, cntlr.data + (i - (i % 4)));
856 }
857
ich_hwseq_write(const struct spi_flash * flash,u32 addr,size_t len,const void * buf)858 static int ich_hwseq_write(const struct spi_flash *flash, u32 addr, size_t len,
859 const void *buf)
860 {
861 uint16_t hsfc;
862 uint16_t timeout = 100 * 60;
863 uint8_t block_len;
864 uint32_t start = addr;
865
866 if (addr + len > flash->size) {
867 printk(BIOS_ERR,
868 "Attempt to write 0x%x-0x%x which is out of chip\n",
869 (unsigned int)addr, (unsigned int)(addr+len));
870 return -1;
871 }
872
873 /* clear FDONE, FCERR, AEL by writing 1 to them (if they are set) */
874 writew_(readw_(&cntlr.ich9_spi->hsfs), &cntlr.ich9_spi->hsfs);
875
876 while (len > 0) {
877 block_len = MIN(len, cntlr.databytes);
878 if (block_len > (~addr & 0xff))
879 block_len = (~addr & 0xff) + 1;
880
881 ich_hwseq_set_addr(addr);
882
883 ich_fill_data(buf, block_len);
884 hsfc = readw_(&cntlr.ich9_spi->hsfc);
885 hsfc &= ~HSFC_FCYCLE; /* clear operation */
886 hsfc |= (0x2 << HSFC_FCYCLE_OFF); /* set write operation */
887 hsfc &= ~HSFC_FDBC; /* clear byte count */
888 /* set byte count */
889 hsfc |= (((block_len - 1) << HSFC_FDBC_OFF) & HSFC_FDBC);
890 hsfc |= HSFC_FGO; /* start */
891 writew_(hsfc, &cntlr.ich9_spi->hsfc);
892
893 if (ich_hwseq_wait_for_cycle_complete(timeout, block_len)) {
894 printk(BIOS_ERR, "SF: write failure at %x\n",
895 addr);
896 return -1;
897 }
898 addr += block_len;
899 buf += block_len;
900 len -= block_len;
901 }
902 printk(BIOS_DEBUG, "SF: Successfully written %u bytes @ %#x\n",
903 (unsigned int)(addr - start), start);
904 return 0;
905 }
906
907 static const struct spi_flash_ops spi_flash_ops = {
908 .read = ich_hwseq_read,
909 .write = ich_hwseq_write,
910 .erase = ich_hwseq_erase,
911 };
912
spi_flash_programmer_probe(const struct spi_slave * spi,struct spi_flash * flash)913 static int spi_flash_programmer_probe(const struct spi_slave *spi,
914 struct spi_flash *flash)
915 {
916 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX))
917 return spi_flash_generic_probe(spi, flash);
918
919 /* Try generic probing first if spi_is_multichip returns 0. */
920 if (!spi_is_multichip() && !spi_flash_generic_probe(spi, flash))
921 return 0;
922
923 memcpy(&flash->spi, spi, sizeof(*spi));
924
925 ich_hwseq_set_addr(0);
926 switch ((cntlr.hsfs >> 3) & 3) {
927 case 0:
928 flash->sector_size = 256;
929 break;
930 case 1:
931 flash->sector_size = 4096;
932 break;
933 case 2:
934 flash->sector_size = 8192;
935 break;
936 case 3:
937 flash->sector_size = 65536;
938 break;
939 }
940
941 flash->size = 1 << (19 + (cntlr.flcomp & 7));
942
943 flash->ops = &spi_flash_ops;
944
945 if ((cntlr.hsfs & HSFS_FDV) && ((cntlr.flmap0 >> 8) & 3))
946 flash->size += 1 << (19 + ((cntlr.flcomp >> 3) & 7));
947 printk(BIOS_DEBUG, "flash size 0x%x bytes\n", flash->size);
948
949 return 0;
950 }
951
xfer_vectors(const struct spi_slave * slave,struct spi_op vectors[],size_t count)952 static int xfer_vectors(const struct spi_slave *slave,
953 struct spi_op vectors[], size_t count)
954 {
955 return spi_flash_vector_helper(slave, vectors, count, spi_ctrlr_xfer);
956 }
957
958 #define SPI_FPR_SHIFT 12
959 #define ICH7_SPI_FPR_MASK 0xfff
960 #define ICH9_SPI_FPR_MASK 0x1fff
961 #define SPI_FPR_BASE_SHIFT 0
962 #define ICH7_SPI_FPR_LIMIT_SHIFT 12
963 #define ICH9_SPI_FPR_LIMIT_SHIFT 16
964 #define ICH9_SPI_FPR_RPE (1 << 15) /* Read Protect */
965 #define SPI_FPR_WPE (1 << 31) /* Write Protect */
966
spi_fpr(u32 base,u32 limit)967 static u32 spi_fpr(u32 base, u32 limit)
968 {
969 u32 ret;
970 u32 mask, limit_shift;
971
972 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX)) {
973 mask = ICH7_SPI_FPR_MASK;
974 limit_shift = ICH7_SPI_FPR_LIMIT_SHIFT;
975 } else {
976 mask = ICH9_SPI_FPR_MASK;
977 limit_shift = ICH9_SPI_FPR_LIMIT_SHIFT;
978 }
979 ret = ((limit >> SPI_FPR_SHIFT) & mask) << limit_shift;
980 ret |= ((base >> SPI_FPR_SHIFT) & mask) << SPI_FPR_BASE_SHIFT;
981 return ret;
982 }
983
984 /*
985 * Protect range of SPI flash defined by [start, start+size-1] using Flash
986 * Protected Range (FPR) register if available.
987 * Returns 0 on success, -1 on failure of programming fpr registers.
988 */
spi_flash_protect(const struct spi_flash * flash,const struct region * region,const enum ctrlr_prot_type type)989 static int spi_flash_protect(const struct spi_flash *flash,
990 const struct region *region,
991 const enum ctrlr_prot_type type)
992 {
993 u32 start = region_offset(region);
994 u32 end = start + region_sz(region) - 1;
995 u32 reg;
996 u32 protect_mask = 0;
997 int fpr;
998 uint32_t *fpr_base;
999
1000 fpr_base = cntlr.fpr;
1001
1002 /* Find first empty FPR */
1003 for (fpr = 0; fpr < cntlr.fpr_max; fpr++) {
1004 reg = read32(&fpr_base[fpr]);
1005 if (reg == 0)
1006 break;
1007 }
1008
1009 if (fpr == cntlr.fpr_max) {
1010 printk(BIOS_ERR, "No SPI FPR free!\n");
1011 return -1;
1012 }
1013
1014 switch (type) {
1015 case WRITE_PROTECT:
1016 protect_mask |= SPI_FPR_WPE;
1017 break;
1018 case READ_PROTECT:
1019 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX))
1020 return -1;
1021 protect_mask |= ICH9_SPI_FPR_RPE;
1022 break;
1023 case READ_WRITE_PROTECT:
1024 if (CONFIG(SOUTHBRIDGE_INTEL_I82801GX))
1025 return -1;
1026 protect_mask |= (ICH9_SPI_FPR_RPE | SPI_FPR_WPE);
1027 break;
1028 default:
1029 printk(BIOS_ERR, "Seeking invalid protection!\n");
1030 return -1;
1031 }
1032
1033 /* Set protected range base and limit */
1034 reg = spi_fpr(start, end) | protect_mask;
1035
1036 /* Set the FPR register and verify it is protected */
1037 write32(&fpr_base[fpr], reg);
1038 if (reg != read32(&fpr_base[fpr])) {
1039 printk(BIOS_ERR, "Unable to set SPI FPR %d\n", fpr);
1040 return -1;
1041 }
1042
1043 printk(BIOS_INFO, "%s: FPR %d is enabled for range 0x%08x-0x%08x\n",
1044 __func__, fpr, start, end);
1045 return 0;
1046 }
1047
spi_finalize_ops(void)1048 void spi_finalize_ops(void)
1049 {
1050 u16 spi_opprefix;
1051 u16 optype = 0;
1052 struct intel_swseq_spi_config spi_config_default = {
1053 {0x06, 0x50}, /* OPPREFIXES: EWSR and WREN */
1054 { /* OPCODE and OPTYPE */
1055 {0x01, WRITE_NO_ADDR}, /* WRSR: Write Status Register */
1056 {0x02, WRITE_WITH_ADDR}, /* BYPR: Byte Program */
1057 {0x03, READ_WITH_ADDR}, /* READ: Read Data */
1058 {0x05, READ_NO_ADDR}, /* RDSR: Read Status Register */
1059 {0x20, WRITE_WITH_ADDR}, /* SE20: Sector Erase 0x20 */
1060 {0x9f, READ_NO_ADDR}, /* RDID: Read ID */
1061 {0xd8, WRITE_WITH_ADDR}, /* BED8: Block Erase 0xd8 */
1062 {0x0b, READ_WITH_ADDR}, /* FAST: Fast Read */
1063 }
1064 };
1065 struct intel_swseq_spi_config spi_config_aai_write = {
1066 {0x06, 0x50}, /* OPPREFIXES: EWSR and WREN */
1067 { /* OPCODE and OPTYPE */
1068 {0x01, WRITE_NO_ADDR}, /* WRSR: Write Status Register */
1069 {0x02, WRITE_WITH_ADDR}, /* BYPR: Byte Program */
1070 {0x03, READ_WITH_ADDR}, /* READ: Read Data */
1071 {0x05, READ_NO_ADDR}, /* RDSR: Read Status Register */
1072 {0x20, WRITE_WITH_ADDR}, /* SE20: Sector Erase 0x20 */
1073 {0x9f, READ_NO_ADDR}, /* RDID: Read ID */
1074 {0xad, WRITE_NO_ADDR}, /* Auto Address Increment Word Program */
1075 {0x04, WRITE_NO_ADDR} /* Write Disable */
1076 }
1077 };
1078 const struct spi_flash *flash = boot_device_spi_flash();
1079 struct intel_swseq_spi_config *spi_config = &spi_config_default;
1080 int i;
1081
1082 /*
1083 * Some older SST SPI flashes support AAI write but use 0xaf opcde for
1084 * that. Flashrom uses the byte program opcode to write those flashes,
1085 * so this configuration is fine too. SST25VF064C (id = 0x4b) is an
1086 * exception.
1087 */
1088 if (flash && flash->vendor == VENDOR_ID_SST && (flash->model & 0x00ff) != 0x4b)
1089 spi_config = &spi_config_aai_write;
1090
1091 if (spi_locked())
1092 return;
1093
1094 intel_southbridge_override_spi(spi_config);
1095
1096 spi_opprefix = spi_config->opprefixes[0]
1097 | (spi_config->opprefixes[1] << 8);
1098 writew_(spi_opprefix, cntlr.preop);
1099 for (i = 0; i < ARRAY_SIZE(spi_config->ops); i++) {
1100 optype |= (spi_config->ops[i].type & 3) << (i * 2);
1101 writeb_(spi_config->ops[i].op, &cntlr.opmenu[i]);
1102 }
1103 writew_(optype, cntlr.optype);
1104
1105 spi_set_smm_only_flashing(CONFIG(BOOTMEDIA_SMM_BWP));
1106 }
1107
intel_southbridge_override_spi(struct intel_swseq_spi_config * spi_config)1108 __weak void intel_southbridge_override_spi(struct intel_swseq_spi_config *spi_config)
1109 {
1110 }
1111
1112 #define BIOS_CNTL 0xdc
1113 #define BIOS_CNTL_BIOSWE (1 << 0)
1114 #define BIOS_CNTL_BLE (1 << 1)
1115 #define BIOS_CNTL_SMM_BWP (1 << 5)
1116
spi_set_smm_only_flashing(bool enable)1117 static void spi_set_smm_only_flashing(bool enable)
1118 {
1119 if (!(CONFIG(SOUTHBRIDGE_INTEL_I82801GX) || CONFIG(SOUTHBRIDGE_INTEL_COMMON_SPI_ICH9)))
1120 return;
1121
1122 const pci_devfn_t dev = PCI_DEV(0, 31, 0);
1123
1124 uint8_t bios_cntl = pci_read_config8(dev, BIOS_CNTL);
1125
1126 if (enable) {
1127 bios_cntl &= ~BIOS_CNTL_BIOSWE;
1128 bios_cntl |= BIOS_CNTL_BLE | BIOS_CNTL_SMM_BWP;
1129 } else {
1130 bios_cntl &= ~(BIOS_CNTL_BLE | BIOS_CNTL_SMM_BWP);
1131 bios_cntl |= BIOS_CNTL_BIOSWE;
1132 }
1133
1134 pci_write_config8(dev, BIOS_CNTL, bios_cntl);
1135 }
1136
1137 static const struct spi_ctrlr spi_ctrlr = {
1138 .xfer_vector = xfer_vectors,
1139 .max_xfer_size = member_size(struct ich9_spi_regs, fdata),
1140 .flash_probe = spi_flash_programmer_probe,
1141 .flash_protect = spi_flash_protect,
1142 };
1143
1144 const struct spi_ctrlr_buses spi_ctrlr_bus_map[] = {
1145 {
1146 .ctrlr = &spi_ctrlr,
1147 .bus_start = 0,
1148 .bus_end = 0,
1149 },
1150 };
1151
1152 const size_t spi_ctrlr_bus_map_count = ARRAY_SIZE(spi_ctrlr_bus_map);
1153