1 /*
2 * This file is part of the flashrom project.
3 *
4 * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger
5 * Copyright (C) 2008 Ronald Hoogenboom <[email protected]>
6 * Copyright (C) 2008 coresystems GmbH
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; version 2 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 */
17
18 /*
19 * Contains the ITE IT87* SPI specific routines
20 */
21
22 #include <string.h>
23 #include <stdbool.h>
24 #include <stdlib.h>
25 #include <errno.h>
26 #include "flash.h"
27 #include "chipdrivers.h"
28 #include "programmer.h"
29 #include "hwaccess_physmap.h"
30 #include "hwaccess_x86_io.h"
31 #include "spi.h"
32
33 #define ITE_SUPERIO_PORT1 0x2e
34 #define ITE_SUPERIO_PORT2 0x4e
35
36 #define CHIP_ID_BYTE1_REG 0x20
37 #define CHIP_ID_BYTE2_REG 0x21
38 #define CHIP_VER_REG 0x22
39
40 struct it8716f_spi_data {
41 uint16_t flashport;
42 /* use fast 33MHz SPI (<>0) or slow 16MHz (0) */
43 bool fast_spi;
44 };
45
get_data_from_context(const struct flashctx * flash,struct it8716f_spi_data ** data)46 static int get_data_from_context(const struct flashctx *flash, struct it8716f_spi_data **data)
47 {
48 if (!flash || !flash->mst || !flash->mst->spi.data) {
49 msg_perr("Unable to extract fd from flash context.\n");
50 return SPI_GENERIC_ERROR;
51 }
52 *data = (struct it8716f_spi_data *)flash->mst->spi.data;
53
54 return 0;
55 }
56
57 /* Helper functions for most recent ITE IT87xx Super I/O chips */
enter_conf_mode_ite(uint16_t port)58 void enter_conf_mode_ite(uint16_t port)
59 {
60 OUTB(0x87, port);
61 OUTB(0x01, port);
62 OUTB(0x55, port);
63 if (port == ITE_SUPERIO_PORT1)
64 OUTB(0x55, port);
65 else
66 OUTB(0xaa, port);
67 }
68
exit_conf_mode_ite(uint16_t port)69 void exit_conf_mode_ite(uint16_t port)
70 {
71 sio_write(port, 0x02, 0x02);
72 }
73
probe_id_ite(uint16_t port)74 static uint16_t probe_id_ite(uint16_t port)
75 {
76 uint16_t id;
77
78 enter_conf_mode_ite(port);
79 id = sio_read(port, CHIP_ID_BYTE1_REG) << 8;
80 id |= sio_read(port, CHIP_ID_BYTE2_REG);
81 exit_conf_mode_ite(port);
82
83 return id;
84 }
85
probe_superio_ite(void)86 void probe_superio_ite(void)
87 {
88 struct superio s = {0};
89 uint16_t ite_ports[] = {ITE_SUPERIO_PORT1, ITE_SUPERIO_PORT2, 0};
90 uint16_t *i = ite_ports;
91
92 s.vendor = SUPERIO_VENDOR_ITE;
93 for (; *i; i++) {
94 s.port = *i;
95 s.model = probe_id_ite(s.port);
96 switch (s.model >> 8) {
97 case 0x82:
98 case 0x86:
99 case 0x87:
100 /* FIXME: Print revision for all models? */
101 msg_pdbg("Found ITE Super I/O, ID 0x%04hx on port 0x%x\n", s.model, s.port);
102 register_superio(s);
103 break;
104 case 0x85:
105 msg_pdbg("Found ITE EC, ID 0x%04hx, Rev 0x%02x on port 0x%x.\n",
106 s.model, sio_read(s.port, CHIP_VER_REG), s.port);
107 register_superio(s);
108 break;
109 }
110 }
111
112 return;
113 }
114
115 /* Page size is usually 256 bytes */
it8716f_spi_page_program(struct flashctx * flash,const uint8_t * buf,unsigned int start)116 static int it8716f_spi_page_program(struct flashctx *flash, const uint8_t *buf, unsigned int start)
117 {
118 unsigned int i;
119 int result;
120 chipaddr bios = flash->virtual_memory;
121 struct it8716f_spi_data *data;
122
123 if (get_data_from_context(flash, &data) < 0)
124 return SPI_GENERIC_ERROR;
125
126 result = spi_write_enable(flash);
127 if (result)
128 return result;
129 /* FIXME: The command below seems to be redundant or wrong. */
130 OUTB(0x06, data->flashport + 1);
131 OUTB(((2 + (data->fast_spi ? 1 : 0)) << 4), data->flashport);
132 for (i = 0; i < flash->chip->page_size; i++)
133 mmio_writeb(buf[i], (void *)(bios + start + i));
134 OUTB(0, data->flashport);
135 /* Wait until the Write-In-Progress bit is cleared.
136 * This usually takes 1-10 ms, so wait in 1 ms steps.
137 *
138 * FIXME: This should timeout after some number of retries.
139 */
140 while (true) {
141 uint8_t status;
142 int ret = spi_read_register(flash, STATUS1, &status);
143 if (ret)
144 return ret;
145
146 if((status & SPI_SR_WIP) == 0)
147 return 0;
148
149 default_delay(1000);
150 }
151 return 0;
152 }
153
154 /*
155 * The IT8716F only supports commands with length 1,2,4,5 bytes including
156 * command byte and can not read more than 3 bytes from the device.
157 *
158 * This function expects writearr[0] to be the first byte sent to the device,
159 * whereas the IT8716F splits commands internally into address and non-address
160 * commands with the address in inverse wire order. That's why the register
161 * ordering in case 4 and 5 may seem strange.
162 */
it8716f_spi_send_command(const struct flashctx * flash,unsigned int writecnt,unsigned int readcnt,const unsigned char * writearr,unsigned char * readarr)163 static int it8716f_spi_send_command(const struct flashctx *flash,
164 unsigned int writecnt, unsigned int readcnt,
165 const unsigned char *writearr,
166 unsigned char *readarr)
167 {
168 uint8_t busy, writeenc;
169 struct it8716f_spi_data *data;
170
171 if (get_data_from_context(flash, &data) < 0)
172 return SPI_GENERIC_ERROR;
173
174 do {
175 busy = INB(data->flashport) & 0x80;
176 } while (busy);
177 if (readcnt > 3) {
178 msg_pinfo("%s called with unsupported readcnt %i.\n",
179 __func__, readcnt);
180 return SPI_INVALID_LENGTH;
181 }
182 switch (writecnt) {
183 case 1:
184 OUTB(writearr[0], data->flashport + 1);
185 writeenc = 0x0;
186 break;
187 case 2:
188 OUTB(writearr[0], data->flashport + 1);
189 OUTB(writearr[1], data->flashport + 7);
190 writeenc = 0x1;
191 break;
192 case 4:
193 OUTB(writearr[0], data->flashport + 1);
194 OUTB(writearr[1], data->flashport + 4);
195 OUTB(writearr[2], data->flashport + 3);
196 OUTB(writearr[3], data->flashport + 2);
197 writeenc = 0x2;
198 break;
199 case 5:
200 OUTB(writearr[0], data->flashport + 1);
201 OUTB(writearr[1], data->flashport + 4);
202 OUTB(writearr[2], data->flashport + 3);
203 OUTB(writearr[3], data->flashport + 2);
204 OUTB(writearr[4], data->flashport + 7);
205 writeenc = 0x3;
206 break;
207 default:
208 msg_pinfo("%s called with unsupported writecnt %i.\n",
209 __func__, writecnt);
210 return SPI_INVALID_LENGTH;
211 }
212 /*
213 * Start IO, 33 or 16 MHz, readcnt input bytes, writecnt output bytes.
214 * Note:
215 * We can't use writecnt directly, but have to use a strange encoding.
216 */
217 OUTB(((0x4 + (data->fast_spi ? 1 : 0)) << 4)
218 | ((readcnt & 0x3) << 2) | (writeenc), data->flashport);
219
220 if (readcnt > 0) {
221 unsigned int i;
222
223 do {
224 busy = INB(data->flashport) & 0x80;
225 } while (busy);
226
227 for (i = 0; i < readcnt; i++)
228 readarr[i] = INB(data->flashport + 5 + i);
229 }
230
231 return 0;
232 }
233
234 /*
235 * IT8716F only allows maximum of 512 kb SPI mapped to LPC memory cycles
236 * Need to read this big flash using firmware cycles 3 byte at a time.
237 */
it8716f_spi_chip_read(struct flashctx * flash,uint8_t * buf,unsigned int start,unsigned int len)238 static int it8716f_spi_chip_read(struct flashctx *flash, uint8_t *buf,
239 unsigned int start, unsigned int len)
240 {
241 struct it8716f_spi_data *data;
242
243 if (get_data_from_context(flash, &data) < 0)
244 return SPI_GENERIC_ERROR;
245
246 data->fast_spi = false;
247
248 /* FIXME: Check if someone explicitly requested to use IT87 SPI although
249 * the mainboard does not use IT87 SPI translation. This should be done
250 * via a programmer parameter for the internal programmer.
251 */
252 if ((flash->chip->total_size * 1024 > 512 * 1024)) {
253 default_spi_read(flash, buf, start, len);
254 } else {
255 mmio_readn((void *)(flash->virtual_memory + start), buf, len);
256 }
257
258 return 0;
259 }
260
it8716f_spi_chip_write_256(struct flashctx * flash,const uint8_t * buf,unsigned int start,unsigned int len)261 static int it8716f_spi_chip_write_256(struct flashctx *flash, const uint8_t *buf,
262 unsigned int start, unsigned int len)
263 {
264 const struct flashchip *chip = flash->chip;
265 /*
266 * IT8716F only allows maximum of 512 kb SPI chip size for memory
267 * mapped access. It also can't write more than 1+3+256 bytes at once,
268 * so page_size > 256 bytes needs a fallback.
269 * FIXME: Split too big page writes into chunks IT87* can handle instead
270 * of degrading to single-byte program.
271 * FIXME: Check if someone explicitly requested to use IT87 SPI although
272 * the mainboard does not use IT87 SPI translation. This should be done
273 * via a programmer parameter for the internal programmer.
274 */
275 if ((chip->total_size * 1024 > 512 * 1024) || (chip->page_size > 256)) {
276 spi_chip_write_1(flash, buf, start, len);
277 } else {
278 unsigned int lenhere;
279
280 if (start % chip->page_size) {
281 /* start to the end of the page or to start + len,
282 * whichever is smaller.
283 */
284 lenhere = min(len, chip->page_size - start % chip->page_size);
285 spi_chip_write_1(flash, buf, start, lenhere);
286 start += lenhere;
287 len -= lenhere;
288 buf += lenhere;
289 }
290
291 while (len >= chip->page_size) {
292 int ret = it8716f_spi_page_program(flash, buf, start);
293 if (ret)
294 return ret;
295 update_progress(flash, FLASHROM_PROGRESS_WRITE, chip->page_size - len, chip->page_size);
296 start += chip->page_size;
297 len -= chip->page_size;
298 buf += chip->page_size;
299 }
300 if (len)
301 spi_chip_write_1(flash, buf, start, len);
302 }
303
304 return 0;
305 }
306
it8716f_shutdown(void * data)307 static int it8716f_shutdown(void *data)
308 {
309 free(data);
310 return 0;
311 }
312
313 static const struct spi_master spi_master_it87xx = {
314 .max_data_read = 3,
315 .max_data_write = MAX_DATA_UNSPECIFIED,
316 .command = it8716f_spi_send_command,
317 .map_flash_region = physmap,
318 .unmap_flash_region = physunmap,
319 .read = it8716f_spi_chip_read,
320 .write_256 = it8716f_spi_chip_write_256,
321 .write_aai = spi_chip_write_1,
322 .shutdown = it8716f_shutdown,
323 };
324
it87spi_probe(const struct programmer_cfg * cfg,uint16_t port)325 static uint16_t it87spi_probe(const struct programmer_cfg *cfg, uint16_t port)
326 {
327 uint8_t tmp = 0;
328 uint16_t flashport = 0;
329
330 enter_conf_mode_ite(port);
331
332 char *param = extract_programmer_param_str(cfg, "dualbiosindex");
333 if (param != NULL) {
334 sio_write(port, 0x07, 0x07); /* Select GPIO LDN */
335 tmp = sio_read(port, 0xEF);
336 if (*param == '\0') { /* Print current setting only. */
337 free(param);
338 } else {
339 char *dualbiosindex_suffix;
340 errno = 0;
341 long chip_index = strtol(param, &dualbiosindex_suffix, 0);
342 if (errno != 0 || *dualbiosindex_suffix != '\0' || chip_index < 0 || chip_index > 1) {
343 msg_perr("DualBIOS: Invalid chip index requested - choose 0 or 1.\n");
344 free(param);
345 exit_conf_mode_ite(port);
346 return 1;
347 }
348 free(param);
349 if (chip_index != (tmp & 1)) {
350 msg_pdbg("DualBIOS: Previous chip index: %d\n", tmp & 1);
351 sio_write(port, 0xEF, (tmp & 0xFE) | chip_index);
352 tmp = sio_read(port, 0xEF);
353 if ((tmp & 1) != chip_index) {
354 msg_perr("DualBIOS: Chip selection failed.\n");
355 exit_conf_mode_ite(port);
356 return 1;
357 }
358 }
359 }
360 msg_pinfo("DualBIOS: Selected chip: %d\n", tmp & 1);
361 }
362
363 /* NOLDN, reg 0x24, mask out lowest bit (suspend) */
364 tmp = sio_read(port, 0x24) & 0xFE;
365 /* Check if LPC->SPI translation is active. */
366 if (!(tmp & 0x0e)) {
367 msg_pdbg("No IT87* serial flash segment enabled.\n");
368 exit_conf_mode_ite(port);
369 /* Nothing to do. */
370 return 0;
371 }
372 msg_pdbg("Serial flash segment 0x%08x-0x%08x %sabled\n",
373 0xFFFE0000, 0xFFFFFFFF, (tmp & 1 << 1) ? "en" : "dis");
374 msg_pdbg("Serial flash segment 0x%08x-0x%08x %sabled\n",
375 0x000E0000, 0x000FFFFF, (tmp & 1 << 1) ? "en" : "dis");
376 msg_pdbg("Serial flash segment 0x%08x-0x%08x %sabled\n",
377 0xFFEE0000, 0xFFEFFFFF, (tmp & 1 << 2) ? "en" : "dis");
378 msg_pdbg("Serial flash segment 0x%08x-0x%08x %sabled\n",
379 0xFFF80000, 0xFFFEFFFF, (tmp & 1 << 3) ? "en" : "dis");
380 msg_pdbg("LPC write to serial flash %sabled\n",
381 (tmp & 1 << 4) ? "en" : "dis");
382 /* The LPC->SPI force write enable below only makes sense for
383 * non-programmer mode.
384 */
385 /* If any serial flash segment is enabled, enable writing. */
386 if ((tmp & 0xe) && (!(tmp & 1 << 4))) {
387 msg_pdbg("Enabling LPC write to serial flash\n");
388 tmp |= 1 << 4;
389 sio_write(port, 0x24, tmp);
390 }
391 msg_pdbg("Serial flash pin %i\n", (tmp & 1 << 5) ? 87 : 29);
392 /* LDN 0x7, reg 0x64/0x65 */
393 sio_write(port, 0x07, 0x7);
394 flashport = sio_read(port, 0x64) << 8;
395 flashport |= sio_read(port, 0x65);
396 msg_pdbg("Serial flash port 0x%04x\n", flashport);
397 /* Non-default port requested? */
398 param = extract_programmer_param_str(cfg, "it87spiport");
399 if (param) {
400 char *endptr = NULL;
401 unsigned long forced_flashport;
402 forced_flashport = strtoul(param, &endptr, 0);
403 /* Port 0, port >0x1000, unaligned ports and garbage strings
404 * are rejected.
405 */
406 if (!forced_flashport || (forced_flashport >= 0x1000) ||
407 (forced_flashport & 0x7) || (*endptr != '\0')) {
408 /* Using ports below 0x100 is a really bad idea, and
409 * should only be done if no port between 0x100 and
410 * 0xff8 works due to routing issues.
411 */
412 msg_perr("Error: it87spiport specified, but no valid "
413 "port specified.\nPort must be a multiple of "
414 "0x8 and lie between 0x100 and 0xff8.\n");
415 exit_conf_mode_ite(port);
416 free(param);
417 return 1;
418 } else {
419 flashport = (uint16_t)forced_flashport;
420 msg_pinfo("Forcing serial flash port 0x%04x\n",
421 flashport);
422 sio_write(port, 0x64, (flashport >> 8));
423 sio_write(port, 0x65, (flashport & 0xff));
424 }
425 }
426 free(param);
427 exit_conf_mode_ite(port);
428
429 struct it8716f_spi_data *data = calloc(1, sizeof(*data));
430 if (!data) {
431 msg_perr("Unable to allocate space for extra SPI master data.\n");
432 return SPI_GENERIC_ERROR;
433 }
434
435 data->flashport = flashport;
436 data->fast_spi = true;
437
438 if (internal_buses_supported & BUS_SPI)
439 msg_pdbg("Overriding chipset SPI with IT87 SPI.\n");
440 /* FIXME: Add the SPI bus or replace the other buses with it? */
441 return register_spi_master(&spi_master_it87xx, data);
442 }
443
init_superio_ite(const struct programmer_cfg * cfg)444 int init_superio_ite(const struct programmer_cfg *cfg)
445 {
446 int i;
447 int ret = 0;
448
449 for (i = 0; i < superio_count; i++) {
450 if (superios[i].vendor != SUPERIO_VENDOR_ITE)
451 continue;
452
453 switch (superios[i].model) {
454 case 0x8705:
455 ret |= it8705f_write_enable(superios[i].port);
456 break;
457 case 0x8686:
458 case 0x8716:
459 case 0x8718:
460 case 0x8720:
461 case 0x8728:
462 ret |= it87spi_probe(cfg, superios[i].port);
463 break;
464 default:
465 msg_pdbg2("Super I/O ID 0x%04hx is not on the list of flash-capable controllers.\n",
466 superios[i].model);
467 }
468 }
469 return ret;
470 }
471