blob: d25f5ac60562302179121fbe0e9c3022d285e3d5 [file] [log] [blame]
Donald Huang44ebb042011-02-22 17:16:34 +00001/*
2 * This file is part of the flashrom project.
3 *
4 * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger
5 * Copyright (C) 2008 Ronald Hoogenboom <ronald@zonnet.nl>
6 * Copyright (C) 2008 coresystems GmbH
7 * Copyright (C) 2010 Google Inc.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; version 2 of the License.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21 */
22
23/*
24 * Contains the ITE IT85* SPI specific routines
25 */
26
27#if defined(__i386__) || defined(__x86_64__)
28
29#include <string.h>
David Hendricks4e748392011-02-28 23:58:15 +000030#include <stdio.h>
Donald Huang44ebb042011-02-22 17:16:34 +000031#include <stdlib.h>
32#include "flash.h"
Donald Huang44ebb042011-02-22 17:16:34 +000033#include "spi.h"
34#include "programmer.h"
35
David Hendricks4e748392011-02-28 23:58:15 +000036#define MAX_TIMEOUT 100000
37#define MAX_TRY 5
38
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000039/* Constants for I/O ports */
Donald Huang44ebb042011-02-22 17:16:34 +000040#define ITE_SUPERIO_PORT1 0x2e
41#define ITE_SUPERIO_PORT2 0x4e
42
43/* Legacy I/O */
David Hendricks4e748392011-02-28 23:58:15 +000044#define LEGACY_KBC_PORT_DATA 0x60
45#define LEGACY_KBC_PORT_CMD 0x64
Donald Huang44ebb042011-02-22 17:16:34 +000046
47/* Constants for Logical Device registers */
48#define LDNSEL 0x07
Donald Huang44ebb042011-02-22 17:16:34 +000049
50/* These are standard Super I/O 16-bit base address registers */
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000051#define SHM_IO_BAR0 0x60 /* big-endian, this is high bits */
52#define SHM_IO_BAR1 0x61
Donald Huang44ebb042011-02-22 17:16:34 +000053
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +000054/* The 8042 keyboard controller uses an input buffer and an output buffer to
55 * communicate with the host CPU. Both buffers are 1-byte depth. That means
56 * IBF is set to 1 when the host CPU sends a command to the input buffer
57 * of the EC. IBF is cleared to 0 once the command is read by the EC.
58 */
David Hendricks4e748392011-02-28 23:58:15 +000059#define KB_IBF (1 << 1) /* Input Buffer Full */
60#define KB_OBF (1 << 0) /* Output Buffer Full */
61
Donald Huang44ebb042011-02-22 17:16:34 +000062/* IT8502 supports two access modes:
63 * LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode)
64 * LPC_IO: through I/O port (so called indirect memory)
65 */
66#undef LPC_MEMORY
67#define LPC_IO
68
69#ifdef LPC_IO
70/* macro to fill in indirect-access registers. */
71#define INDIRECT_A0(base, value) OUTB(value, (base) + 0) /* little-endian */
72#define INDIRECT_A1(base, value) OUTB(value, (base) + 1)
73#define INDIRECT_A2(base, value) OUTB(value, (base) + 2)
74#define INDIRECT_A3(base, value) OUTB(value, (base) + 3)
75#define INDIRECT_READ(base) INB((base) + 4)
76#define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4)
77#endif /* LPC_IO */
78
79#ifdef LPC_IO
80unsigned int shm_io_base;
81#endif
82unsigned char *ce_high, *ce_low;
83static int it85xx_scratch_rom_reenter = 0;
84
David Hendricks4e748392011-02-28 23:58:15 +000085/* This function will poll the keyboard status register until either
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000086 * an expected value shows up, or the timeout is reached.
87 * timeout is in usec.
David Hendricks4e748392011-02-28 23:58:15 +000088 *
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000089 * Returns: 0 -- the expected value showed up.
90 * 1 -- timeout.
David Hendricks4e748392011-02-28 23:58:15 +000091 */
Uwe Hermann91f4afa2011-07-28 08:13:25 +000092static int wait_for(const unsigned int mask, const unsigned int expected_value,
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +000093 const int timeout, const char * error_message,
94 const char * function_name, const int lineno)
Uwe Hermann91f4afa2011-07-28 08:13:25 +000095{
David Hendricks4e748392011-02-28 23:58:15 +000096 int time_passed;
97
98 for (time_passed = 0;; ++time_passed) {
99 if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value)
100 return 0;
101 if (time_passed >= timeout)
102 break;
103 programmer_delay(1);
104 }
105 if (error_message)
106 msg_perr("%s():%d %s", function_name, lineno, error_message);
107 return 1;
108}
109
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000110/* IT8502 employs a scratch RAM when flash is being updated. Call the following
David Hendricks4e748392011-02-28 23:58:15 +0000111 * two functions before/after flash erase/program. */
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000112void it85xx_enter_scratch_rom(void)
Donald Huang44ebb042011-02-22 17:16:34 +0000113{
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000114 int ret, tries;
David Hendricks4e748392011-02-28 23:58:15 +0000115
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000116 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__);
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000117 if (it85xx_scratch_rom_reenter > 0)
118 return;
David Hendricks4e748392011-02-28 23:58:15 +0000119
120#if 0
121 /* FIXME: this a workaround for the bug that SMBus signal would
122 * interfere the EC firmware update. Should be removed if
123 * we find out the root cause. */
124 ret = system("stop powerd >&2");
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000125 if (ret)
David Hendricks4e748392011-02-28 23:58:15 +0000126 msg_perr("Cannot stop powerd.\n");
David Hendricks4e748392011-02-28 23:58:15 +0000127#endif
128
129 for (tries = 0; tries < MAX_TRY; ++tries) {
130 /* Wait until IBF (input buffer) is not full. */
131 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
132 "* timeout at waiting for IBF==0.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000133 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000134 continue;
135
136 /* Copy EC firmware to SRAM. */
137 OUTB(0xb4, LEGACY_KBC_PORT_CMD);
138
139 /* Confirm EC has taken away the command. */
140 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
141 "* timeout at taking command.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000142 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000143 continue;
144
145 /* Waiting for OBF (output buffer) has data.
146 * Note sometimes the replied command might be stolen by kernel
147 * ISR so that it is okay as long as the command is 0xFA. */
148 if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0))
149 msg_pdbg("%s():%d * timeout at waiting for OBF.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000150 __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000151 if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) {
152 break;
153 } else {
154 msg_perr("%s():%d * not run on SRAM ret=%d\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000155 __func__, __LINE__, ret);
David Hendricks4e748392011-02-28 23:58:15 +0000156 continue;
157 }
158 }
159
160 if (tries < MAX_TRY) {
161 /* EC already runs on SRAM */
162 it85xx_scratch_rom_reenter++;
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000163 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000164 } else {
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000165 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000166 }
Donald Huang44ebb042011-02-22 17:16:34 +0000167}
168
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000169void it85xx_exit_scratch_rom(void)
Donald Huang44ebb042011-02-22 17:16:34 +0000170{
David Hendricks4e748392011-02-28 23:58:15 +0000171#if 0
172 int ret;
173#endif
174 int tries;
175
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000176 msg_pdbg("%s():%d was called ...\n", __func__, __LINE__);
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000177 if (it85xx_scratch_rom_reenter <= 0)
178 return;
David Hendricks4e748392011-02-28 23:58:15 +0000179
180 for (tries = 0; tries < MAX_TRY; ++tries) {
181 /* Wait until IBF (input buffer) is not full. */
182 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
183 "* timeout at waiting for IBF==0.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000184 __func__, __LINE__))
David Hendricks4e748392011-02-28 23:58:15 +0000185 continue;
186
187 /* Exit SRAM. Run on flash. */
188 OUTB(0xFE, LEGACY_KBC_PORT_CMD);
189
190 /* Confirm EC has taken away the command. */
191 if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
192 "* timeout at taking command.\n",
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000193 __func__, __LINE__)) {
David Hendricks4e748392011-02-28 23:58:15 +0000194 /* We cannot ensure if EC has exited update mode.
195 * If EC is in normal mode already, a further 0xFE
196 * command will reboot system. So, exit loop here. */
197 tries = MAX_TRY;
198 break;
199 }
200
201 break;
202 }
203
204 if (tries < MAX_TRY) {
205 it85xx_scratch_rom_reenter = 0;
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000206 msg_pdbg("%s():%d * SUCCESS.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000207 } else {
Uwe Hermanne187d5e2011-07-29 20:13:45 +0000208 msg_perr("%s():%d * Max try reached.\n", __func__, __LINE__);
David Hendricks4e748392011-02-28 23:58:15 +0000209 }
210
211#if 0
212 /* FIXME: this a workaround for the bug that SMBus signal would
213 * interfere the EC firmware update. Should be removed if
214 * we find out the root cause. */
215 ret = system("start powerd >&2");
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000216 if (ret)
David Hendricks4e748392011-02-28 23:58:15 +0000217 msg_perr("Cannot start powerd again.\n");
David Hendricks4e748392011-02-28 23:58:15 +0000218#endif
Donald Huang44ebb042011-02-22 17:16:34 +0000219}
220
David Hendricks8bb20212011-06-14 01:35:36 +0000221static int it85xx_shutdown(void *data)
222{
223 msg_pdbg("%s():%d\n", __func__, __LINE__);
224 it85xx_exit_scratch_rom();
225
226 return 0; /* FIXME: Should probably return something meaningful */
227}
228
Carl-Daniel Hailfingerbfecef62011-04-27 14:34:08 +0000229static int it85xx_spi_common_init(struct superio s)
Donald Huang44ebb042011-02-22 17:16:34 +0000230{
231 chipaddr base;
232
233 msg_pdbg("%s():%d superio.vendor=0x%02x\n", __func__, __LINE__,
Carl-Daniel Hailfingerbfecef62011-04-27 14:34:08 +0000234 s.vendor);
Donald Huang44ebb042011-02-22 17:16:34 +0000235
David Hendricks8bb20212011-06-14 01:35:36 +0000236 if (register_shutdown(it85xx_shutdown, NULL))
237 return 1;
238
Donald Huang44ebb042011-02-22 17:16:34 +0000239#ifdef LPC_IO
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000240 /* Get LPCPNP of SHM. That's big-endian. */
Carl-Daniel Hailfingerbfecef62011-04-27 14:34:08 +0000241 sio_write(s.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */
242 shm_io_base = (sio_read(s.port, SHM_IO_BAR0) << 8) +
243 sio_read(s.port, SHM_IO_BAR1);
Donald Huang44ebb042011-02-22 17:16:34 +0000244 msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__,
245 shm_io_base);
246
247 /* These pointers are not used directly. They will be send to EC's
248 * register for indirect access. */
249 base = 0xFFFFF000;
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000250 ce_high = ((unsigned char *)base) + 0xE00; /* 0xFFFFFE00 */
251 ce_low = ((unsigned char *)base) + 0xD00; /* 0xFFFFFD00 */
Donald Huang44ebb042011-02-22 17:16:34 +0000252
253 /* pre-set indirect-access registers since in most of cases they are
254 * 0xFFFFxx00. */
255 INDIRECT_A0(shm_io_base, base & 0xFF);
256 INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF);
257 INDIRECT_A3(shm_io_base, (base >> 24));
258#endif
259#ifdef LPC_MEMORY
Carl-Daniel Hailfingereaacd2d2011-11-09 23:40:00 +0000260 /* FIXME: We should block accessing that region for anything else.
261 * Major TODO here, and it will be a lot of work.
262 */
263 base = (chipaddr)physmap("it85 communication", 0xFFFFF000, 0x1000);
Donald Huang44ebb042011-02-22 17:16:34 +0000264 msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__,
265 (unsigned int)base);
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000266 ce_high = (unsigned char *)(base + 0xE00); /* 0xFFFFFE00 */
267 ce_low = (unsigned char *)(base + 0xD00); /* 0xFFFFFD00 */
Donald Huang44ebb042011-02-22 17:16:34 +0000268#endif
269
Donald Huang44ebb042011-02-22 17:16:34 +0000270 return 0;
271}
272
Michael Karcherb9dbe482011-05-11 17:07:07 +0000273static int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt,
274 const unsigned char *writearr, unsigned char *readarr);
275
276static const struct spi_programmer spi_programmer_it85xx = {
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000277 .type = SPI_CONTROLLER_IT85XX,
278 .max_data_read = 64,
279 .max_data_write = 64,
280 .command = it85xx_spi_send_command,
281 .multicommand = default_spi_send_multicommand,
282 .read = default_spi_read,
283 .write_256 = default_spi_write_256,
Michael Karcherb9dbe482011-05-11 17:07:07 +0000284};
285
Carl-Daniel Hailfingerbfecef62011-04-27 14:34:08 +0000286int it85xx_spi_init(struct superio s)
Donald Huang44ebb042011-02-22 17:16:34 +0000287{
288 int ret;
289
Carl-Daniel Hailfingereaacd2d2011-11-09 23:40:00 +0000290 if (!(internal_buses_supported & BUS_FWH)) {
Donald Huang44ebb042011-02-22 17:16:34 +0000291 msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__);
292 return 1;
293 }
Carl-Daniel Hailfingerbfecef62011-04-27 14:34:08 +0000294 ret = it85xx_spi_common_init(s);
Donald Huang44ebb042011-02-22 17:16:34 +0000295 msg_pdbg("FWH: %s():%d ret=%d\n", __func__, __LINE__, ret);
296 if (!ret) {
Carl-Daniel Hailfingereaacd2d2011-11-09 23:40:00 +0000297 msg_pdbg("%s: internal_buses_supported=0x%x\n", __func__,
298 internal_buses_supported);
299 /* Check for FWH because IT85 listens to FWH cycles.
300 * FIXME: The big question is whether FWH cycles are necessary
301 * for communication even if LPC_IO is defined.
302 */
303 if (internal_buses_supported & BUS_FWH)
304 msg_pdbg("Registering IT85 SPI.\n");
305 /* FIXME: Really leave FWH enabled? We can't use this region
306 * anymore since accessing it would mess up IT85 communication.
307 * If we decide to disable FWH for this region, we should print
308 * a debug message about it.
309 */
Uwe Hermann91f4afa2011-07-28 08:13:25 +0000310 /* Set this as SPI controller. */
Michael Karcherb9dbe482011-05-11 17:07:07 +0000311 register_spi_programmer(&spi_programmer_it85xx);
Donald Huang44ebb042011-02-22 17:16:34 +0000312 }
313 return ret;
314}
315
Donald Huang44ebb042011-02-22 17:16:34 +0000316/* According to ITE 8502 document, the procedure to follow mode is following:
317 * 1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high)
318 * 2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI
319 * with data)
320 * 3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get
321 * data from MISO)
322 */
Michael Karcherb9dbe482011-05-11 17:07:07 +0000323static int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt,
Donald Huang44ebb042011-02-22 17:16:34 +0000324 const unsigned char *writearr, unsigned char *readarr)
325{
326 int i;
327
328 it85xx_enter_scratch_rom();
Carl-Daniel Hailfinger082c8b52011-08-15 19:54:20 +0000329 /* Exit scratch ROM ONLY when programmer shuts down. Otherwise, the
330 * temporary flash state may halt the EC.
331 */
Donald Huang44ebb042011-02-22 17:16:34 +0000332
333#ifdef LPC_IO
334 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff);
335 INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/
336 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_low) >> 8) & 0xff);
337#endif
338#ifdef LPC_MEMORY
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +0000339 mmio_writeb(0, ce_high);
Donald Huang44ebb042011-02-22 17:16:34 +0000340#endif
341 for (i = 0; i < writecnt; ++i) {
342#ifdef LPC_IO
343 INDIRECT_WRITE(shm_io_base, writearr[i]);
344#endif
345#ifdef LPC_MEMORY
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +0000346 mmio_writeb(writearr[i], ce_low);
Donald Huang44ebb042011-02-22 17:16:34 +0000347#endif
348 }
349 for (i = 0; i < readcnt; ++i) {
350#ifdef LPC_IO
351 readarr[i] = INDIRECT_READ(shm_io_base);
352#endif
353#ifdef LPC_MEMORY
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +0000354 readarr[i] = mmio_readb(ce_low);
Donald Huang44ebb042011-02-22 17:16:34 +0000355#endif
356 }
David Hendricks4e748392011-02-28 23:58:15 +0000357#ifdef LPC_IO
358 INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff);
359 INDIRECT_WRITE(shm_io_base, 0xFF); /* Write anything to this address.*/
360#endif
361#ifdef LPC_MEMORY
Carl-Daniel Hailfinger7f517a72011-03-08 00:23:49 +0000362 mmio_writeb(0, ce_high);
David Hendricks4e748392011-02-28 23:58:15 +0000363#endif
364
Donald Huang44ebb042011-02-22 17:16:34 +0000365 return 0;
366}
367
Donald Huang44ebb042011-02-22 17:16:34 +0000368#endif