1 /* 2 * This file is part of the flashrom project. 3 * 4 * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger 5 * Copyright (C) 2008 Ronald Hoogenboom <ronald@zonnet.nl> 6 * Copyright (C) 2008 coresystems GmbH 7 * Copyright (C) 2010 Google Inc. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; version 2 of the License. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 */ 18 19 /* 20 * Contains the ITE IT85* SPI specific routines 21 */ 22 23 #if defined(__i386__) || defined(__x86_64__) 24 25 #include <string.h> 26 #include <stdio.h> 27 #include <stdlib.h> 28 #include "flash.h" 29 #include "spi.h" 30 #include "programmer.h" 31 #include "hwaccess.h" 32 33 #define MAX_TIMEOUT 100000 34 #define MAX_TRY 5 35 36 /* Constants for I/O ports */ 37 #define ITE_SUPERIO_PORT1 0x2e 38 #define ITE_SUPERIO_PORT2 0x4e 39 40 /* Legacy I/O */ 41 #define LEGACY_KBC_PORT_DATA 0x60 42 #define LEGACY_KBC_PORT_CMD 0x64 43 44 /* Constants for Logical Device registers */ 45 #define LDNSEL 0x07 46 47 /* These are standard Super I/O 16-bit base address registers */ 48 #define SHM_IO_BAR0 0x60 /* big-endian, this is high bits */ 49 #define SHM_IO_BAR1 0x61 50 51 /* The 8042 keyboard controller uses an input buffer and an output buffer to 52 * communicate with the host CPU. Both buffers are 1-byte depth. That means 53 * IBF is set to 1 when the host CPU sends a command to the input buffer 54 * of the EC. IBF is cleared to 0 once the command is read by the EC. 55 */ 56 #define KB_IBF (1 << 1) /* Input Buffer Full */ 57 #define KB_OBF (1 << 0) /* Output Buffer Full */ 58 59 /* IT8502 supports two access modes: 60 * LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode) 61 * LPC_IO: through I/O port (so called indirect memory) 62 */ 63 #undef LPC_MEMORY 64 #define LPC_IO 65 66 #ifdef LPC_IO 67 /* macro to fill in indirect-access registers. */ 68 #define INDIRECT_A0(base, value) OUTB(value, (base) + 0) /* little-endian */ 69 #define INDIRECT_A1(base, value) OUTB(value, (base) + 1) 70 #define INDIRECT_A2(base, value) OUTB(value, (base) + 2) 71 #define INDIRECT_A3(base, value) OUTB(value, (base) + 3) 72 #define INDIRECT_READ(base) INB((base) + 4) 73 #define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4) 74 #endif /* LPC_IO */ 75 76 #ifdef LPC_IO 77 static unsigned int shm_io_base; 78 #endif 79 static unsigned char *ce_high, *ce_low; 80 static int it85xx_scratch_rom_reenter = 0; 81 82 /* This function will poll the keyboard status register until either 83 * an expected value shows up, or the timeout is reached. 84 * timeout is in usec. 85 * 86 * Returns: 0 -- the expected value showed up. 87 * 1 -- timeout. 88 */ 89 static int wait_for(const unsigned int mask, const unsigned int expected_value, 90 const int timeout, const char * error_message, 91 const char * function_name, const int lineno) 92 { 93 int time_passed; 94 95 for (time_passed = 0;; ++time_passed) { 96 if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value) 97 return 0; 98 if (time_passed >= timeout) 99 break; 100 programmer_delay(1); 101 } 102 if (error_message) 103 msg_perr("%s():%d %s", function_name, lineno, error_message); 104 return 1; 105 } 106 107 /* IT8502 employs a scratch RAM when flash is being updated. Call the following 108 * two functions before/after flash erase/program. */ 109 static void it85xx_enter_scratch_rom(void) 110 { 111 int ret, tries; 112 113 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__); 114 if (it85xx_scratch_rom_reenter > 0) 115 return; 116 117 #if 0 118 /* FIXME: this a workaround for the bug that SMBus signal would 119 * interfere the EC firmware update. Should be removed if 120 * we find out the root cause. */ 121 ret = system("stop powerd >&2"); 122 if (ret) 123 msg_perr("Cannot stop powerd.\n"); 124 #endif 125 126 for (tries = 0; tries < MAX_TRY; ++tries) { 127 /* Wait until IBF (input buffer) is not full. */ 128 if (wait_for(KB_IBF, 0, MAX_TIMEOUT, 129 "* timeout at waiting for IBF==0.\n", 130 __func__, __LINE__)) 131 continue; 132 133 /* Copy EC firmware to SRAM. */ 134 OUTB(0xb4, LEGACY_KBC_PORT_CMD); 135 136 /* Confirm EC has taken away the command. */ 137 if (wait_for(KB_IBF, 0, MAX_TIMEOUT, 138 "* timeout at taking command.\n", 139 __func__, __LINE__)) 140 continue; 141 142 /* Waiting for OBF (output buffer) has data. 143 * Note sometimes the replied command might be stolen by kernel 144 * ISR so that it is okay as long as the command is 0xFA. */ 145 if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0)) 146 msg_pdbg("%s():%d * timeout at waiting for OBF.\n", 147 __func__, __LINE__); 148 if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) { 149 break; 150 } else { 151 msg_perr("%s():%d * not run on SRAM ret=%d\n", 152 __func__, __LINE__, ret); 153 continue; 154 } 155 } 156 157 if (tries < MAX_TRY) { 158 /* EC already runs on SRAM */ 159 it85xx_scratch_rom_reenter++; 160 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__); 161 } else { 162 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__); 163 } 164 } 165 166 static void it85xx_exit_scratch_rom(void) 167 { 168 #if 0 169 int ret; 170 #endif 171 int tries; 172 173 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__); 174 if (it85xx_scratch_rom_reenter <= 0) 175 return; 176 177 for (tries = 0; tries < MAX_TRY; ++tries) { 178 /* Wait until IBF (input buffer) is not full. */ 179 if (wait_for(KB_IBF, 0, MAX_TIMEOUT, 180 "* timeout at waiting for IBF==0.\n", 181 __func__, __LINE__)) 182 continue; 183 184 /* Exit SRAM. Run on flash. */ 185 OUTB(0xFE, LEGACY_KBC_PORT_CMD); 186 187 /* Confirm EC has taken away the command. */ 188 if (wait_for(KB_IBF, 0, MAX_TIMEOUT, 189 "* timeout at taking command.\n", 190 __func__, __LINE__)) { 191 /* We cannot ensure if EC has exited update mode. 192 * If EC is in normal mode already, a further 0xFE 193 * command will reboot system. So, exit loop here. */ 194 tries = MAX_TRY; 195 break; 196 } 197 198 break; 199 } 200 201 if (tries < MAX_TRY) { 202 it85xx_scratch_rom_reenter = 0; 203 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__); 204 } else { 205 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__); 206 } 207 208 #if 0 209 /* FIXME: this a workaround for the bug that SMBus signal would 210 * interfere the EC firmware update. Should be removed if 211 * we find out the root cause. */ 212 ret = system("start powerd >&2"); 213 if (ret) 214 msg_perr("Cannot start powerd again.\n"); 215 #endif 216 } 217 218 static int it85xx_shutdown(void *data) 219 { 220 msg_pdbg("%s():%d\n", __func__, __LINE__); 221 it85xx_exit_scratch_rom(); 222 223 return 0; /* FIXME: Should probably return something meaningful */ 224 } 225 226 static int it85xx_spi_common_init(struct superio s) 227 { 228 chipaddr base; 229 230 msg_pdbg("%s():%d superio.vendor=0x%02x\n", __func__, __LINE__, 231 s.vendor); 232 233 if (register_shutdown(it85xx_shutdown, NULL)) 234 return 1; 235 236 #ifdef LPC_IO 237 /* Get LPCPNP of SHM. That's big-endian. */ 238 sio_write(s.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */ 239 shm_io_base = (sio_read(s.port, SHM_IO_BAR0) << 8) + 240 sio_read(s.port, SHM_IO_BAR1); 241 msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__, 242 shm_io_base); 243 244 /* These pointers are not used directly. They will be send to EC's 245 * register for indirect access. */ 246 base = 0xFFFFF000; 247 ce_high = ((unsigned char *)base) + 0xE00; /* 0xFFFFFE00 */ 248 ce_low = ((unsigned char *)base) + 0xD00; /* 0xFFFFFD00 */ 249 250 /* pre-set indirect-access registers since in most of cases they are 251 * 0xFFFFxx00. */ 252 INDIRECT_A0(shm_io_base, base & 0xFF); 253 INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF); 254 INDIRECT_A3(shm_io_base, (base >> 24)); 255 #endif 256 #ifdef LPC_MEMORY 257 /* FIXME: We should block accessing that region for anything else. 258 * Major TODO here, and it will be a lot of work. 259 */ 260 base = (chipaddr)physmap("it85 communication", 0xFFFFF000, 0x1000); 261 if (base == (chipaddr)ERROR_PTR) 262 return 1; 263 264 msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__, 265 (unsigned int)base); 266 ce_high = (unsigned char *)(base + 0xE00); /* 0xFFFFFE00 */ 267 ce_low = (unsigned char *)(base + 0xD00); /* 0xFFFFFD00 */ 268 #endif 269 270 return 0; 271 } 272 273 static int it85xx_spi_send_command(struct flashctx *flash, 274 unsigned int writecnt, unsigned int readcnt, 275 const unsigned char *writearr, 276 unsigned char *readarr); 277 278 static const struct spi_master spi_master_it85xx = { 279 .max_data_read = 64, 280 .max_data_write = 64, 281 .command = it85xx_spi_send_command, 282 .multicommand = default_spi_send_multicommand, 283 .read = default_spi_read, 284 .write_256 = default_spi_write_256, 285 .write_aai = default_spi_write_aai, 286 }; 287 288 int it85xx_spi_init(struct superio s) 289 { 290 int ret; 291 292 if (!(internal_buses_supported & BUS_FWH)) { 293 msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__); 294 return 1; 295 } 296 ret = it85xx_spi_common_init(s); 297 msg_pdbg("FWH: %s():%d ret=%d\n", __func__, __LINE__, ret); 298 if (!ret) { 299 msg_pdbg("%s: internal_buses_supported=0x%x\n", __func__, 300 internal_buses_supported); 301 /* Check for FWH because IT85 listens to FWH cycles. 302 * FIXME: The big question is whether FWH cycles are necessary 303 * for communication even if LPC_IO is defined. 304 */ 305 if (internal_buses_supported & BUS_FWH) 306 msg_pdbg("Registering IT85 SPI.\n"); 307 /* FIXME: Really leave FWH enabled? We can't use this region 308 * anymore since accessing it would mess up IT85 communication. 309 * If we decide to disable FWH for this region, we should print 310 * a debug message about it. 311 */ 312 /* Set this as SPI controller. */ 313 register_spi_master(&spi_master_it85xx); 314 } 315 return ret; 316 } 317 318 /* According to ITE 8502 document, the procedure to follow mode is following: 319 * 1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high) 320 * 2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI 321 * with data) 322 * 3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get 323 * data from MISO) 324 */ 325 static int it85xx_spi_send_command(struct flashctx *flash, 326 unsigned int writecnt, unsigned int readcnt, 327 const unsigned char *writearr, 328 unsigned char *readarr) 329 { 330 unsigned int i; 331 332 it85xx_enter_scratch_rom(); 333 /* Exit scratch ROM ONLY when programmer shuts down. Otherwise, the 334 * temporary flash state may halt the EC. 335 */ 336 337 #ifdef LPC_IO 338 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); 339 INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ 340 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_low) >> 8) & 0xff); 341 #endif 342 #ifdef LPC_MEMORY 343 mmio_writeb(0, ce_high); 344 #endif 345 for (i = 0; i < writecnt; ++i) { 346 #ifdef LPC_IO 347 INDIRECT_WRITE(shm_io_base, writearr[i]); 348 #endif 349 #ifdef LPC_MEMORY 350 mmio_writeb(writearr[i], ce_low); 351 #endif 352 } 353 for (i = 0; i < readcnt; ++i) { 354 #ifdef LPC_IO 355 readarr[i] = INDIRECT_READ(shm_io_base); 356 #endif 357 #ifdef LPC_MEMORY 358 readarr[i] = mmio_readb(ce_low); 359 #endif 360 } 361 #ifdef LPC_IO 362 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff); 363 INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/ 364 #endif 365 #ifdef LPC_MEMORY 366 mmio_writeb(0, ce_high); 367 #endif 368 369 return 0; 370 } 371 372 #endif 373