1 /*
2 * This file is part of the flashrom project.
3 *
4 * Copyright (C) 2020 The Chromium OS Authors
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 */
16
17 #include <stdlib.h>
18 #include <stdint.h>
19 #include <stdio.h>
20 #include <string.h>
21 #include <time.h>
22 #include <errno.h>
23
24 #include "programmer.h"
25 #include "spi.h"
26 #include "i2c_helper.h"
27
28
29 #define MCU_I2C_SLAVE_ADDR 0x94
30 #define REGISTER_ADDRESS (0x94 >> 1)
31 #define RTK_PAGE_SIZE 128
32 #define MAX_SPI_WAIT_RETRIES 1000
33
34 #define MCU_MODE 0x6F
35 #define MCU_ISP_MODE_MASK 0x80
36 #define START_WRITE_XFER 0xA0
37 #define WRITE_XFER_STATUS_MASK 0x20
38
39 #define MCU_DATA_PORT 0x70
40
41 #define MAP_PAGE_BYTE2 0x64
42 #define MAP_PAGE_BYTE1 0x65
43 #define MAP_PAGE_BYTE0 0x66
44
45 //opcodes
46 #define OPCODE_READ 3
47 #define OPCODE_WRITE 2
48
49 #define GPIO_CONFIG_ADDRESS 0x104F
50 #define GPIO_VALUE_ADDRESS 0xFE3F
51
52 struct realtek_mst_i2c_spi_data {
53 int fd;
54 bool reset;
55 };
56
realtek_mst_i2c_spi_write_data(int fd,uint16_t addr,void * buf,uint16_t len)57 static int realtek_mst_i2c_spi_write_data(int fd, uint16_t addr, void *buf, uint16_t len)
58 {
59 i2c_buffer_t data;
60 if (i2c_buffer_t_fill(&data, buf, len))
61 return SPI_GENERIC_ERROR;
62
63 return i2c_write(fd, addr, &data) == len ? 0 : SPI_GENERIC_ERROR;
64 }
65
realtek_mst_i2c_spi_read_data(int fd,uint16_t addr,void * buf,uint16_t len)66 static int realtek_mst_i2c_spi_read_data(int fd, uint16_t addr, void *buf, uint16_t len)
67 {
68 i2c_buffer_t data;
69 if (i2c_buffer_t_fill(&data, buf, len))
70 return SPI_GENERIC_ERROR;
71
72 return i2c_read(fd, addr, &data) == len ? 0 : SPI_GENERIC_ERROR;
73 }
74
get_fd_from_context(const struct flashctx * flash)75 static int get_fd_from_context(const struct flashctx *flash)
76 {
77 if (!flash || !flash->mst || !flash->mst->spi.data) {
78 msg_perr("Unable to extract fd from flash context.\n");
79 return SPI_GENERIC_ERROR;
80 }
81 const struct realtek_mst_i2c_spi_data *data =
82 (const struct realtek_mst_i2c_spi_data *)flash->mst->spi.data;
83
84 return data->fd;
85 }
86
realtek_mst_i2c_spi_write_register(int fd,uint8_t reg,uint8_t value)87 static int realtek_mst_i2c_spi_write_register(int fd, uint8_t reg, uint8_t value)
88 {
89 uint8_t command[] = { reg, value };
90 return realtek_mst_i2c_spi_write_data(fd, REGISTER_ADDRESS, command, 2);
91 }
92
realtek_mst_i2c_spi_read_register(int fd,uint8_t reg,uint8_t * value)93 static int realtek_mst_i2c_spi_read_register(int fd, uint8_t reg, uint8_t *value)
94 {
95 uint8_t command[] = { reg };
96 int ret = realtek_mst_i2c_spi_write_data(fd, REGISTER_ADDRESS, command, 1);
97 ret |= realtek_mst_i2c_spi_read_data(fd, REGISTER_ADDRESS, value, 1);
98
99 return ret ? SPI_GENERIC_ERROR : 0;
100 }
101
realtek_mst_i2c_spi_wait_command_done(int fd,unsigned int offset,int mask,int target,int multiplier)102 static int realtek_mst_i2c_spi_wait_command_done(int fd, unsigned int offset, int mask,
103 int target, int multiplier)
104 {
105 uint8_t val;
106 int tried = 0;
107 int ret = 0;
108 do {
109 ret |= realtek_mst_i2c_spi_read_register(fd, offset, &val);
110 } while (!ret && ((val & mask) != target) && ++tried < (MAX_SPI_WAIT_RETRIES*multiplier));
111
112 if (tried == MAX_SPI_WAIT_RETRIES) {
113 msg_perr("%s: Time out on sending command.\n", __func__);
114 return -MAX_SPI_WAIT_RETRIES;
115 }
116
117 return (val & mask) != target ? SPI_GENERIC_ERROR : ret;
118 }
119
realtek_mst_i2c_spi_enter_isp_mode(int fd)120 static int realtek_mst_i2c_spi_enter_isp_mode(int fd)
121 {
122 int ret = realtek_mst_i2c_spi_write_register(fd, MCU_MODE, MCU_ISP_MODE_MASK);
123 /* wait for ISP mode enter success */
124 ret |= realtek_mst_i2c_spi_wait_command_done(fd, MCU_MODE, MCU_ISP_MODE_MASK, MCU_ISP_MODE_MASK, 1);
125
126 if (ret)
127 return ret;
128
129 // set internal osc divider register to default to speed up MCU
130 // 0x06A0 = 0x74
131 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF4, 0x9F);
132 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF5, 0x06);
133 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF4, 0xA0);
134 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF5, 0x74);
135
136 return ret;
137 }
138
realtek_mst_i2c_execute_write(int fd)139 static int realtek_mst_i2c_execute_write(int fd)
140 {
141 int ret = realtek_mst_i2c_spi_write_register(fd, MCU_MODE, START_WRITE_XFER);
142 ret |= realtek_mst_i2c_spi_wait_command_done(fd, MCU_MODE, WRITE_XFER_STATUS_MASK, 0, 1);
143 return ret;
144 }
145
realtek_mst_i2c_spi_reset_mpu(int fd)146 static int realtek_mst_i2c_spi_reset_mpu(int fd)
147 {
148 uint8_t mcu_mode_val;
149 int ret = realtek_mst_i2c_spi_read_register(fd, MCU_MODE, &mcu_mode_val);
150 if (ret || (mcu_mode_val & MCU_ISP_MODE_MASK) == 0) {
151 msg_perr("%s: MST not in ISP mode, cannot perform MCU reset.\n", __func__);
152 return SPI_GENERIC_ERROR;
153 }
154
155 // 0xFFEE[1] = 1;
156 uint8_t val = 0;
157 ret |= realtek_mst_i2c_spi_read_register(fd, 0xEE, &val);
158 ret |= realtek_mst_i2c_spi_write_register(fd, 0xEE, (val & 0xFD) | 0x02);
159 return ret;
160 }
161
realtek_mst_i2c_spi_select_indexed_register(int fd,uint16_t address)162 static int realtek_mst_i2c_spi_select_indexed_register(int fd, uint16_t address)
163 {
164 int ret = 0;
165
166 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF4, 0x9F);
167 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF5, address >> 8);
168 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF4, address & 0xFF);
169
170 return ret;
171 }
172
realtek_mst_i2c_spi_write_indexed_register(int fd,uint16_t address,uint8_t val)173 static int realtek_mst_i2c_spi_write_indexed_register(int fd, uint16_t address, uint8_t val)
174 {
175 int ret = 0;
176
177 ret |= realtek_mst_i2c_spi_select_indexed_register(fd, address);
178 ret |= realtek_mst_i2c_spi_write_register(fd, 0xF5, val);
179
180 return ret;
181 }
182
realtek_mst_i2c_spi_read_indexed_register(int fd,uint16_t address,uint8_t * val)183 static int realtek_mst_i2c_spi_read_indexed_register(int fd, uint16_t address, uint8_t *val)
184 {
185 int ret = 0;
186
187 ret |= realtek_mst_i2c_spi_select_indexed_register(fd, address);
188 ret |= realtek_mst_i2c_spi_read_register(fd, 0xF5, val);
189
190 return ret;
191 }
192
193
194 /* Toggle the GPIO pin 88, reserved for write protection pin of the external flash. */
realtek_mst_i2c_spi_toggle_gpio_88_strap(int fd,bool toggle)195 static int realtek_mst_i2c_spi_toggle_gpio_88_strap(int fd, bool toggle)
196 {
197 int ret = 0;
198 uint8_t val = 0;
199
200 /* Read register 0x104F into val. */
201 ret |= realtek_mst_i2c_spi_read_indexed_register(fd, GPIO_CONFIG_ADDRESS, &val);
202 /* Write 0x104F[3:0] = b0001 to enable the toggle of pin value. */
203 ret |= realtek_mst_i2c_spi_write_indexed_register(fd, GPIO_CONFIG_ADDRESS, (val & 0xF0) | 0x01);
204
205 /* Read register 0xFE3F into val. */
206 ret |= realtek_mst_i2c_spi_read_indexed_register(fd, GPIO_VALUE_ADDRESS, &val);
207 /* Write 0xFE3F[0] = b|toggle| to toggle pin value to low/high. */
208 ret |= realtek_mst_i2c_spi_write_indexed_register(fd, GPIO_VALUE_ADDRESS, (val & 0xFE) | toggle);
209
210 return ret;
211 }
212
realtek_mst_i2c_spi_send_command(const struct flashctx * flash,unsigned int writecnt,unsigned int readcnt,const unsigned char * writearr,unsigned char * readarr)213 static int realtek_mst_i2c_spi_send_command(const struct flashctx *flash,
214 unsigned int writecnt, unsigned int readcnt,
215 const unsigned char *writearr,
216 unsigned char *readarr)
217 {
218 unsigned i;
219 int max_timeout_mul = 1;
220 int ret = 0;
221
222 if (writecnt > 4 || readcnt > 3 || writecnt == 0) {
223 return SPI_GENERIC_ERROR;
224 }
225
226 int fd = get_fd_from_context(flash);
227 if (fd < 0)
228 return SPI_GENERIC_ERROR;
229
230 /* First byte of writearr should be the spi opcode value, followed by the value to write. */
231 writecnt--;
232
233 /**
234 * Before dispatching a SPI opcode the MCU register 0x60 requires
235 * the following configuration byte set:
236 *
237 * BIT0 - start [0] , end [1].
238 * BITS[1-4] - counts.
239 * BITS[5-7] - opcode type.
240 *
241 * | bit7 | bit6 | bit5 |
242 * +------+------+------+
243 * | 0 | 1 | 0 | ~ JEDEC_RDID,REMS,READ
244 * | 0 | 1 | 1 | ~ JEDEC_WRSR
245 * | 1 | 0 | 1 | ~ JEDEC_.. erasures.
246 */
247 uint8_t ctrl_reg_val = (writecnt << 3) | (readcnt << 1);
248 switch (writearr[0]) {
249 /* WREN isn't a supported somehow? ignore it. */
250 case JEDEC_WREN: return 0;
251 /* WRSR requires BIT6 && BIT5 set. */
252 case JEDEC_WRSR:
253 ctrl_reg_val |= (1 << 5);
254 ctrl_reg_val |= (2 << 5);
255 break;
256 /* Erasures require BIT7 && BIT5 set. */
257 case JEDEC_CE_C7:
258 max_timeout_mul *= 20; /* chip erasures take much longer! */
259 /* FALLTHRU */
260 case JEDEC_CE_60:
261 case JEDEC_BE_52:
262 case JEDEC_BE_D8:
263 case JEDEC_BE_D7:
264 case JEDEC_SE:
265 ctrl_reg_val |= (1 << 5);
266 ctrl_reg_val |= (4 << 5);
267 break;
268 default:
269 /* Otherwise things like RDID,REMS,READ require BIT6 */
270 ctrl_reg_val |= (2 << 5);
271 }
272 ret |= realtek_mst_i2c_spi_write_register(fd, 0x60, ctrl_reg_val);
273 ret |= realtek_mst_i2c_spi_write_register(fd, 0x61, writearr[0]); /* opcode */
274
275 for (i = 0; i < writecnt; ++i)
276 ret |= realtek_mst_i2c_spi_write_register(fd, 0x64 + i, writearr[i + 1]);
277 ret |= realtek_mst_i2c_spi_write_register(fd, 0x60, ctrl_reg_val | 0x1);
278 if (ret)
279 return ret;
280
281 ret = realtek_mst_i2c_spi_wait_command_done(fd, 0x60, 0x01, 0, max_timeout_mul);
282 if (ret)
283 return ret;
284
285 for (i = 0; i < readcnt; ++i)
286 ret |= realtek_mst_i2c_spi_read_register(fd, 0x67 + i, &readarr[i]);
287
288 return ret;
289 }
290
realtek_mst_i2c_spi_map_page(int fd,uint32_t addr)291 static int realtek_mst_i2c_spi_map_page(int fd, uint32_t addr)
292 {
293 int ret = 0;
294
295 uint8_t block_idx = (addr >> 16) & 0xff;
296 uint8_t page_idx = (addr >> 8) & 0xff;
297 uint8_t byte_idx = addr & 0xff;
298
299 ret |= realtek_mst_i2c_spi_write_register(fd, MAP_PAGE_BYTE2, block_idx);
300 ret |= realtek_mst_i2c_spi_write_register(fd, MAP_PAGE_BYTE1, page_idx);
301 ret |= realtek_mst_i2c_spi_write_register(fd, MAP_PAGE_BYTE0, byte_idx);
302
303 return ret ? SPI_GENERIC_ERROR : 0;
304 }
305
realtek_mst_i2c_spi_write_page(int fd,uint8_t reg,const uint8_t * buf,unsigned int len)306 static int realtek_mst_i2c_spi_write_page(int fd, uint8_t reg, const uint8_t *buf, unsigned int len)
307 {
308 /**
309 * Using static buffer with maximum possible size,
310 * extra byte is needed for prefixing the data port register at index 0.
311 */
312 uint8_t wbuf[RTK_PAGE_SIZE + 1] = { MCU_DATA_PORT };
313 if (len > RTK_PAGE_SIZE)
314 return SPI_GENERIC_ERROR;
315
316 memcpy(&wbuf[1], buf, len);
317
318 return realtek_mst_i2c_spi_write_data(fd, REGISTER_ADDRESS, wbuf, len + 1);
319 }
320
realtek_mst_i2c_spi_read(struct flashctx * flash,uint8_t * buf,unsigned int start,unsigned int len)321 static int realtek_mst_i2c_spi_read(struct flashctx *flash, uint8_t *buf,
322 unsigned int start, unsigned int len)
323 {
324 unsigned i;
325 int ret = 0;
326
327 if (start & 0xff)
328 return default_spi_read(flash, buf, start, len);
329
330 int fd = get_fd_from_context(flash);
331 if (fd < 0)
332 return SPI_GENERIC_ERROR;
333
334 start--;
335 ret |= realtek_mst_i2c_spi_write_register(fd, 0x60, 0x46); // **
336 ret |= realtek_mst_i2c_spi_write_register(fd, 0x61, OPCODE_READ);
337 ret |= realtek_mst_i2c_spi_map_page(fd, start);
338 ret |= realtek_mst_i2c_spi_write_register(fd, 0x6a, 0x03);
339 ret |= realtek_mst_i2c_spi_write_register(fd, 0x60, 0x47); // **
340 if (ret)
341 return ret;
342
343 ret = realtek_mst_i2c_spi_wait_command_done(fd, 0x60, 0x01, 0, 1);
344 if (ret)
345 return ret;
346
347 /**
348 * The first byte is just a null, probably a status code?
349 * Advance the read by a offset of one byte and continue.
350 */
351 uint8_t dummy;
352 realtek_mst_i2c_spi_read_register(fd, MCU_DATA_PORT, &dummy);
353
354 for (i = 0; i < len; i += RTK_PAGE_SIZE) {
355 ret |= realtek_mst_i2c_spi_read_data(fd, REGISTER_ADDRESS,
356 buf + i, min(len - i, RTK_PAGE_SIZE));
357 if (ret)
358 return ret;
359 }
360
361 return ret;
362 }
363
realtek_mst_i2c_spi_write_256(struct flashctx * flash,const uint8_t * buf,unsigned int start,unsigned int len)364 static int realtek_mst_i2c_spi_write_256(struct flashctx *flash, const uint8_t *buf,
365 unsigned int start, unsigned int len)
366 {
367 unsigned i;
368 int ret = 0;
369
370 if (start & 0xff)
371 return default_spi_write_256(flash, buf, start, len);
372
373 int fd = get_fd_from_context(flash);
374 if (fd < 0)
375 return SPI_GENERIC_ERROR;
376
377 ret |= realtek_mst_i2c_spi_write_register(fd, 0x6D, 0x02); /* write opcode */
378 ret |= realtek_mst_i2c_spi_write_register(fd, 0x71, (RTK_PAGE_SIZE - 1)); /* fit len=256 */
379
380 for (i = 0; i < len; i += RTK_PAGE_SIZE) {
381 uint16_t page_len = min(len - i, RTK_PAGE_SIZE);
382 if (len - i < RTK_PAGE_SIZE)
383 ret |= realtek_mst_i2c_spi_write_register(fd, 0x71, page_len-1);
384 ret |= realtek_mst_i2c_spi_map_page(fd, start + i);
385 if (ret)
386 break;
387
388 /* Wait for empty buffer. */
389 ret |= realtek_mst_i2c_spi_wait_command_done(fd, MCU_MODE, 0x10, 0x10, 1);
390 if (ret)
391 break;
392
393 ret |= realtek_mst_i2c_spi_write_page(fd, MCU_DATA_PORT,
394 buf + i, page_len);
395 if (ret)
396 break;
397 ret |= realtek_mst_i2c_execute_write(fd);
398 if (ret)
399 break;
400 update_progress(flash, FLASHROM_PROGRESS_WRITE, i + RTK_PAGE_SIZE, len);
401 }
402
403 return ret;
404 }
405
realtek_mst_i2c_spi_write_aai(struct flashctx * flash,const uint8_t * buf,unsigned int start,unsigned int len)406 static int realtek_mst_i2c_spi_write_aai(struct flashctx *flash, const uint8_t *buf,
407 unsigned int start, unsigned int len)
408 {
409 msg_perr("%s: AAI write function is not supported.\n", __func__);
410 return SPI_GENERIC_ERROR;
411 }
412
realtek_mst_i2c_spi_shutdown(void * data)413 static int realtek_mst_i2c_spi_shutdown(void *data)
414 {
415 int ret = 0;
416 struct realtek_mst_i2c_spi_data *realtek_mst_data =
417 (struct realtek_mst_i2c_spi_data *)data;
418 int fd = realtek_mst_data->fd;
419 ret |= realtek_mst_i2c_spi_toggle_gpio_88_strap(fd, false);
420 if (realtek_mst_data->reset) {
421 /*
422 * Return value for reset mpu is not checked since
423 * the return value is not guaranteed to be 0 on a
424 * success reset. Currently there is no way to fix
425 * that. For more details see b:147402710.
426 */
427 realtek_mst_i2c_spi_reset_mpu(fd);
428 }
429 i2c_close(fd);
430 free(data);
431
432 return ret;
433 }
434
435 static const struct spi_master spi_master_i2c_realtek_mst = {
436 .max_data_read = 16,
437 .max_data_write = 8,
438 .command = realtek_mst_i2c_spi_send_command,
439 .read = realtek_mst_i2c_spi_read,
440 .write_256 = realtek_mst_i2c_spi_write_256,
441 .write_aai = realtek_mst_i2c_spi_write_aai,
442 .shutdown = realtek_mst_i2c_spi_shutdown,
443 };
444
get_params(const struct programmer_cfg * cfg,bool * reset,bool * enter_isp,bool * allow_brick)445 static int get_params(const struct programmer_cfg *cfg, bool *reset, bool *enter_isp, bool *allow_brick)
446 {
447 char *param_str;
448 int ret = 0;
449
450 *allow_brick = false; /* Default behaviour is to bail. */
451 param_str = extract_programmer_param_str(cfg, "allow_brick");
452 if (param_str) {
453 if (!strcmp(param_str, "yes")) {
454 *allow_brick = true;
455 } else {
456 msg_perr("%s: Incorrect param format, allow_brick=yes.\n", __func__);
457 ret = SPI_GENERIC_ERROR;
458 }
459 }
460 free(param_str);
461
462 *reset = false; /* Default behaviour is no MCU reset on tear-down. */
463 param_str = extract_programmer_param_str(cfg, "reset_mcu");
464 if (param_str) {
465 if (param_str[0] == '1') {
466 *reset = true;
467 } else if (param_str[0] == '0') {
468 *reset = false;
469 } else {
470 msg_perr("%s: Incorrect param format, reset_mcu=1 or 0.\n", __func__);
471 ret = SPI_GENERIC_ERROR;
472 }
473 }
474 free(param_str);
475
476 *enter_isp = true; /* Default behaviour is enter ISP on setup. */
477 param_str = extract_programmer_param_str(cfg, "enter_isp");
478 if (param_str) {
479 if (param_str[0] == '1') {
480 *enter_isp = true;
481 } else if (param_str[0] == '0') {
482 *enter_isp = false;
483 } else {
484 msg_perr("%s: Incorrect param format, enter_isp=1 or 0.\n", __func__);
485 ret = SPI_GENERIC_ERROR;
486 }
487 }
488 free(param_str);
489
490 return ret;
491 }
492
realtek_mst_i2c_spi_init(const struct programmer_cfg * cfg)493 static int realtek_mst_i2c_spi_init(const struct programmer_cfg *cfg)
494 {
495 int ret = 0;
496 bool reset, enter_isp, allow_brick;
497
498 if (get_params(cfg, &reset, &enter_isp, &allow_brick))
499 return SPI_GENERIC_ERROR;
500
501 /*
502 * TODO: Once board_enable can facilitate safe i2c allow listing
503 * then this can be removed.
504 */
505 if (!allow_brick) {
506 msg_perr("%s: For i2c drivers you must explicitly 'allow_brick=yes'. ", __func__);
507 msg_perr("There is currently no way to determine if the programmer works on a board "
508 "as i2c device address space can be overloaded. Set 'allow_brick=yes' if "
509 "you are sure you know what you are doing.\n");
510 return SPI_GENERIC_ERROR;
511 }
512
513 int fd = i2c_open_from_programmer_params(cfg, REGISTER_ADDRESS, 0);
514 if (fd < 0)
515 return fd;
516
517 if (enter_isp) {
518 ret |= realtek_mst_i2c_spi_enter_isp_mode(fd);
519 if (ret)
520 return ret;
521 }
522
523 ret |= realtek_mst_i2c_spi_toggle_gpio_88_strap(fd, true);
524 if (ret) {
525 msg_perr("Unable to toggle gpio 88 strap to True.\n");
526 return ret;
527 }
528
529 struct realtek_mst_i2c_spi_data *data = calloc(1, sizeof(*data));
530 if (!data) {
531 msg_perr("Unable to allocate space for extra SPI master data.\n");
532 return SPI_GENERIC_ERROR;
533 }
534
535 data->fd = fd;
536 data->reset = reset;
537 return register_spi_master(&spi_master_i2c_realtek_mst, data);
538 }
539
540 const struct programmer_entry programmer_realtek_mst_i2c_spi = {
541 .name = "realtek_mst_i2c_spi",
542 .type = OTHER,
543 .devs.note = "Device files /dev/i2c-*.\n",
544 .init = realtek_mst_i2c_spi_init,
545 };
546