blob: 9812fc722ba06306dc03d15f92975284162bf189 [file] [log] [blame]
Donald Huang44ebb042011-02-22 17:16:34 +00001/*
2 * This file is part of the flashrom project.
3 *
4 * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger
5 * Copyright (C) 2008 Ronald Hoogenboom <ronald@zonnet.nl>
6 * Copyright (C) 2008 coresystems GmbH
7 * Copyright (C) 2010 Google Inc.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; version 2 of the License.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
Donald Huang44ebb042011-02-22 17:16:34 +000017 */
18
19/*
20 * Contains the ITE IT85* SPI specific routines
21 */
22
23#if defined(__i386__) || defined(__x86_64__)
24
25#include <string.h>
David Hendricks4e748392011-02-28 23:58:15 +000026#include <stdio.h>
Donald Huang44ebb042011-02-22 17:16:34 +000027#include <stdlib.h>
28#include "flash.h"
Donald Huang44ebb042011-02-22 17:16:34 +000029#include "spi.h"
30#include "programmer.h"
Patrick Georgi32508eb2012-07-20 20:35:14 +000031#include "hwaccess.h"
Donald Huang44ebb042011-02-22 17:16:34 +000032
David Hendricks4e748392011-02-28 23:58:15 +000033#define MAX_TIMEOUT 100000
34#define MAX_TRY 5
35
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000036/* Constants for I/O ports */
Donald Huang44ebb042011-02-22 17:16:34 +000037#define ITE_SUPERIO_PORT1 0x2e
38#define ITE_SUPERIO_PORT2 0x4e
39
40/* Legacy I/O */
David Hendricks4e748392011-02-28 23:58:15 +000041#define LEGACY_KBC_PORT_DATA 0x60
42#define LEGACY_KBC_PORT_CMD 0x64
Donald Huang44ebb042011-02-22 17:16:34 +000043
44/* Constants for Logical Device registers */
45#define LDNSEL 0x07
Donald Huang44ebb042011-02-22 17:16:34 +000046
47/* These are standard Super I/O 16-bit base address registers */
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000048#define SHM_IO_BAR0 0x60 /* big-endian, this is high bits */
49#define SHM_IO_BAR1 0x61
Donald Huang44ebb042011-02-22 17:16:34 +000050
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000051/* The 8042 keyboard controller uses an input buffer and an output buffer to
52 * communicate with the host CPU. Both buffers are 1-byte depth. That means
Elyes HAOUAS124ef382018-03-27 12:15:09 +020053 * IBF is set to 1 when the host CPU sends a command to the input buffer
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000054 * of the EC. IBF is cleared to 0 once the command is read by the EC.
55 */
Elyes HAOUASac01baa2018-05-28 16:52:21 +020056#define KB_IBF (1 << 1) /* Input Buffer Full */
57#define KB_OBF (1 << 0) /* Output Buffer Full */
David Hendricks4e748392011-02-28 23:58:15 +000058
Donald Huang44ebb042011-02-22 17:16:34 +000059/* IT8502 supports two access modes:
60 * LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode)
61 * LPC_IO: through I/O port (so called indirect memory)
62 */
63#undef LPC_MEMORY
64#define LPC_IO
65
66#ifdef LPC_IO
67/* macro to fill in indirect-access registers. */
68#define INDIRECT_A0(base, value) OUTB(value, (base) + 0) /* little-endian */
69#define INDIRECT_A1(base, value) OUTB(value, (base) + 1)
70#define INDIRECT_A2(base, value) OUTB(value, (base) + 2)
71#define INDIRECT_A3(base, value) OUTB(value, (base) + 3)
72#define INDIRECT_READ(base) INB((base) + 4)
73#define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4)
74#endif /* LPC_IO */
75
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +110076struct it85spi_data {
Donald Huang44ebb042011-02-22 17:16:34 +000077#ifdef LPC_IO
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +110078 unsigned int shm_io_base;
Donald Huang44ebb042011-02-22 17:16:34 +000079#endif
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +110080 unsigned char *ce_high, *ce_low;
81 int it85xx_scratch_rom_reenter;
82};
Donald Huang44ebb042011-02-22 17:16:34 +000083
David Hendricks4e748392011-02-28 23:58:15 +000084/* This function will poll the keyboard status register until either
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000085 * an expected value shows up, or the timeout is reached.
86 * timeout is in usec.
David Hendricks4e748392011-02-28 23:58:15 +000087 *
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000088 * Returns: 0 -- the expected value showed up.
89 * 1 -- timeout.
David Hendricks4e748392011-02-28 23:58:15 +000090 */
Uwe Hermann91f4afa2011-07-28 08:13:25 +000091static int wait_for(const unsigned int mask, const unsigned int expected_value,
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000092 const int timeout, const char * error_message,
93 const char * function_name, const int lineno)
Uwe Hermann91f4afa2011-07-28 08:13:25 +000094{
David Hendricks4e748392011-02-28 23:58:15 +000095 int time_passed;
96
97 for (time_passed = 0;; ++time_passed) {
98 if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value)
99 return 0;
100 if (time_passed >= timeout)
101 break;
102 programmer_delay(1);
103 }
104 if (error_message)
105 msg_perr("%s():%d %s", function_name, lineno, error_message);
106 return 1;
107}
108
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000109/* IT8502 employs a scratch RAM when flash is being updated. Call the following
David Hendricks4e748392011-02-28 23:58:15 +0000110 * two functions before/after flash erase/program. */
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100111static void it85xx_enter_scratch_rom(struct it85spi_data *data)
Donald Huang44ebb042011-02-22 17:16:34 +0000112{
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000113 int ret, tries;
David Hendricks4e748392011-02-28 23:58:15 +0000114
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000115 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__);
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100116 if (data->it85xx_scratch_rom_reenter > 0)
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000117 return;
David Hendricks4e748392011-02-28 23:58:15 +0000118
119#if 0
120 /* FIXME: this a workaround for the bug that SMBus signal would
121 * interfere the EC firmware update. Should be removed if
122 * we find out the root cause. */
123 ret = system("stop powerd >&2");
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000124 if (ret)
David Hendricks4e748392011-02-28 23:58:15 +0000125 msg_perr("Cannot stop powerd.\n");
David Hendricks4e748392011-02-28 23:58:15 +0000126#endif
127
128 for (tries = 0; tries < MAX_TRY; ++tries) {
129 /* Wait until IBF (input buffer) is not full. */
130 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
131 "* timeout at waiting for IBF==0.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000132 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000133 continue;
134
135 /* Copy EC firmware to SRAM. */
136 OUTB(0xb4, LEGACY_KBC_PORT_CMD);
137
138 /* Confirm EC has taken away the command. */
139 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
140 "* timeout at taking command.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000141 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000142 continue;
143
144 /* Waiting for OBF (output buffer) has data.
145 * Note sometimes the replied command might be stolen by kernel
146 * ISR so that it is okay as long as the command is 0xFA. */
147 if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0))
148 msg_pdbg("%s():%d * timeout at waiting for OBF.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000149 __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000150 if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) {
151 break;
152 } else {
153 msg_perr("%s():%d * not run on SRAM ret=%d\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000154 __func__, __LINE__, ret);
David Hendricks4e748392011-02-28 23:58:15 +0000155 continue;
156 }
157 }
158
159 if (tries < MAX_TRY) {
160 /* EC already runs on SRAM */
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100161 data->it85xx_scratch_rom_reenter++;
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000162 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000163 } else {
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000164 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000165 }
Donald Huang44ebb042011-02-22 17:16:34 +0000166}
167
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100168static void it85xx_exit_scratch_rom(struct it85spi_data *data)
Donald Huang44ebb042011-02-22 17:16:34 +0000169{
David Hendricks4e748392011-02-28 23:58:15 +0000170#if 0
171 int ret;
172#endif
173 int tries;
174
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000175 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__);
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100176 if (data->it85xx_scratch_rom_reenter <= 0)
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000177 return;
David Hendricks4e748392011-02-28 23:58:15 +0000178
179 for (tries = 0; tries < MAX_TRY; ++tries) {
180 /* Wait until IBF (input buffer) is not full. */
181 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
182 "* timeout at waiting for IBF==0.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000183 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000184 continue;
185
186 /* Exit SRAM. Run on flash. */
187 OUTB(0xFE, LEGACY_KBC_PORT_CMD);
188
189 /* Confirm EC has taken away the command. */
190 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
191 "* timeout at taking command.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000192 __func__, __LINE__)) {
David Hendricks4e748392011-02-28 23:58:15 +0000193 /* We cannot ensure if EC has exited update mode.
194 * If EC is in normal mode already, a further 0xFE
195 * command will reboot system. So, exit loop here. */
196 tries = MAX_TRY;
197 break;
198 }
199
200 break;
201 }
202
203 if (tries < MAX_TRY) {
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100204 data->it85xx_scratch_rom_reenter = 0;
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000205 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000206 } else {
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000207 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000208 }
209
210#if 0
211 /* FIXME: this a workaround for the bug that SMBus signal would
212 * interfere the EC firmware update. Should be removed if
213 * we find out the root cause. */
214 ret = system("start powerd >&2");
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000215 if (ret)
David Hendricks4e748392011-02-28 23:58:15 +0000216 msg_perr("Cannot start powerd again.\n");
David Hendricks4e748392011-02-28 23:58:15 +0000217#endif
Donald Huang44ebb042011-02-22 17:16:34 +0000218}
219
David Hendricks8bb20212011-06-14 01:35:36 +0000220static int it85xx_shutdown(void *data)
221{
222 msg_pdbg("%s():%d\n", __func__, __LINE__);
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100223 it85xx_exit_scratch_rom(data);
224 free(data);
David Hendricks8bb20212011-06-14 01:35:36 +0000225
226 return 0; /* FIXME: Should probably return something meaningful */
227}
228
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100229/* According to ITE 8502 document, the procedure to follow mode is following:
230 * 1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high)
231 * 2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI
232 * with data)
233 * 3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get
234 * data from MISO)
235 */
236static int it85xx_spi_send_command(const struct flashctx *flash,
237 unsigned int writecnt, unsigned int readcnt,
238 const unsigned char *writearr,
239 unsigned char *readarr)
240{
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100241 unsigned int i;
242 struct it85spi_data *data = flash->mst->spi.data;
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100243
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100244 it85xx_enter_scratch_rom(data);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100245 /* Exit scratch ROM ONLY when programmer shuts down. Otherwise, the
246 * temporary flash state may halt the EC.
247 */
248
249#ifdef LPC_IO
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100250 INDIRECT_A1(data->shm_io_base, (((unsigned long int)data->ce_high) >> 8) & 0xff);
251 INDIRECT_WRITE(data->shm_io_base, 0xFF); /* Write anything to this address.*/
252 INDIRECT_A1(data->shm_io_base, (((unsigned long int)data->ce_low) >> 8) & 0xff);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100253#endif
254#ifdef LPC_MEMORY
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100255 mmio_writeb(0, data->ce_high);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100256#endif
257 for (i = 0; i < writecnt; ++i) {
258#ifdef LPC_IO
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100259 INDIRECT_WRITE(data->shm_io_base, writearr[i]);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100260#endif
261#ifdef LPC_MEMORY
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100262 mmio_writeb(writearr[i], data->ce_low);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100263#endif
264 }
265 for (i = 0; i < readcnt; ++i) {
266#ifdef LPC_IO
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100267 readarr[i] = INDIRECT_READ(data->shm_io_base);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100268#endif
269#ifdef LPC_MEMORY
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100270 readarr[i] = mmio_readb(data->ce_low);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100271#endif
272 }
273#ifdef LPC_IO
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100274 INDIRECT_A1(data->shm_io_base, (((unsigned long int)data->ce_high) >> 8) & 0xff);
275 INDIRECT_WRITE(data->shm_io_base, 0xFF); /* Write anything to this address.*/
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100276#endif
277#ifdef LPC_MEMORY
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100278 mmio_writeb(0, data->ce_high);
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100279#endif
280
281 return 0;
282}
283
Nico Huber90739d12021-05-11 17:53:34 +0200284static const struct spi_master spi_master_it85xx = {
Anastasia Klimchuk5783c042020-11-17 16:09:51 +1100285 .max_data_read = 64,
286 .max_data_write = 64,
287 .command = it85xx_spi_send_command,
288 .multicommand = default_spi_send_multicommand,
289 .read = default_spi_read,
290 .write_256 = default_spi_write_256,
291 .write_aai = default_spi_write_aai,
292};
293
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100294int it85xx_spi_init(struct superio s)
Donald Huang44ebb042011-02-22 17:16:34 +0000295{
296 chipaddr base;
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100297 struct it85spi_data *data;
298 unsigned int shm_io_base = 0;
Donald Huang44ebb042011-02-22 17:16:34 +0000299
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100300 msg_pdbg("%s():%d superio.vendor=0x%02x internal_buses_supported=0x%x\n",
301 __func__, __LINE__, s.vendor, internal_buses_supported);
302
303 /* Check for FWH because IT85 listens to FWH cycles.
304 * FIXME: The big question is whether FWH cycles are necessary
305 * for communication even if LPC_IO is defined.
306 */
307 if (!(internal_buses_supported & BUS_FWH)) {
308 msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__);
309 return 1;
310 }
311
312 msg_pdbg("Registering IT85 SPI.\n");
313
314#ifdef LPC_IO
315 /* Get LPCPNP of SHM. That's big-endian. */
316 sio_write(s.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */
317 shm_io_base = (sio_read(s.port, SHM_IO_BAR0) << 8) +
318 sio_read(s.port, SHM_IO_BAR1);
319 msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__,
320 shm_io_base);
321
322 /* These pointers are not used directly. They will be send to EC's
323 * register for indirect access. */
324 base = 0xFFFFF000;
325
326 /* pre-set indirect-access registers since in most of cases they are
327 * 0xFFFFxx00. */
328 INDIRECT_A0(shm_io_base, base & 0xFF);
329 INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF);
330 INDIRECT_A3(shm_io_base, (base >> 24));
331#endif
332#ifdef LPC_MEMORY
333 /* FIXME: We should block accessing that region for anything else.
334 * Major TODO here, and it will be a lot of work.
335 */
336 base = physmap("it85 communication", 0xFFFFF000, 0x1000);
337 if (base == ERROR_PTR)
338 return 1;
339
340 msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__,
341 (unsigned int)base);
342#endif
343
Angel Pons3bd47522021-06-07 12:33:53 +0200344 data = calloc(1, sizeof(*data));
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100345 if (!data) {
346 msg_perr("Unable to allocate space for extra SPI master data.\n");
347 return SPI_GENERIC_ERROR;
348 }
349
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100350#ifdef LPC_IO
351 data->shm_io_base = shm_io_base;
352#endif
353 data->ce_high = ((unsigned char *)base) + 0xE00; /* 0xFFFFFE00 */
354 data->ce_low = ((unsigned char *)base) + 0xD00; /* 0xFFFFFD00 */
Donald Huang44ebb042011-02-22 17:16:34 +0000355
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100356 if (register_shutdown(it85xx_shutdown, data)) {
357 free(data);
David Hendricks8bb20212011-06-14 01:35:36 +0000358 return 1;
Anastasia Klimchuk22f0b062020-11-17 13:25:46 +1100359 }
David Hendricks8bb20212011-06-14 01:35:36 +0000360
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100361 /* FIXME: Really leave FWH enabled? We can't use this region
362 * anymore since accessing it would mess up IT85 communication.
363 * If we decide to disable FWH for this region, we should print
364 * a debug message about it.
Carl-Daniel Hailfingereaacd2d2011-11-09 23:40:00 +0000365 */
Anastasia Klimchuk554a01f2020-12-01 15:55:34 +1100366 /* Set this as SPI controller. */
Nico Huber90739d12021-05-11 17:53:34 +0200367 register_spi_master(&spi_master_it85xx, data);
Donald Huang44ebb042011-02-22 17:16:34 +0000368
Donald Huang44ebb042011-02-22 17:16:34 +0000369 return 0;
370}
371
Donald Huang44ebb042011-02-22 17:16:34 +0000372#endif