ichspi.c 56.9 KB
Newer Older
1 2 3 4 5 6
/*
 * This file is part of the flashrom project.
 *
 * Copyright (C) 2008 Stefan Wildemann <stefan.wildemann@kontron.com>
 * Copyright (C) 2008 Claus Gindhart <claus.gindhart@kontron.com>
 * Copyright (C) 2008 Dominik Geyer <dominik.geyer@kontron.com>
Stefan Reinauer's avatar
Stefan Reinauer committed
7
 * Copyright (C) 2008 coresystems GmbH <info@coresystems.de>
8
 * Copyright (C) 2009, 2010 Carl-Daniel Hailfinger
9
 * Copyright (C) 2011 Stefan Tauner
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
 */

26 27
#if defined(__i386__) || defined(__x86_64__)

28
#include <string.h>
29
#include <stdlib.h>
30
#include "flash.h"
31
#include "programmer.h"
32
#include "hwaccess.h"
33
#include "spi.h"
34
#include "ich_descriptors.h"
35

Stefan Reinauer's avatar
Stefan Reinauer committed
36
/* ICH9 controller register definition */
37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67
#define ICH9_REG_HSFS		0x04	/* 16 Bits Hardware Sequencing Flash Status */
#define HSFS_FDONE_OFF		0	/* 0: Flash Cycle Done */
#define HSFS_FDONE		(0x1 << HSFS_FDONE_OFF)
#define HSFS_FCERR_OFF		1	/* 1: Flash Cycle Error */
#define HSFS_FCERR		(0x1 << HSFS_FCERR_OFF)
#define HSFS_AEL_OFF		2	/* 2: Access Error Log */
#define HSFS_AEL		(0x1 << HSFS_AEL_OFF)
#define HSFS_BERASE_OFF		3	/* 3-4: Block/Sector Erase Size */
#define HSFS_BERASE		(0x3 << HSFS_BERASE_OFF)
#define HSFS_SCIP_OFF		5	/* 5: SPI Cycle In Progress */
#define HSFS_SCIP		(0x1 << HSFS_SCIP_OFF)
					/* 6-12: reserved */
#define HSFS_FDOPSS_OFF		13	/* 13: Flash Descriptor Override Pin-Strap Status */
#define HSFS_FDOPSS		(0x1 << HSFS_FDOPSS_OFF)
#define HSFS_FDV_OFF		14	/* 14: Flash Descriptor Valid */
#define HSFS_FDV		(0x1 << HSFS_FDV_OFF)
#define HSFS_FLOCKDN_OFF	15	/* 15: Flash Configuration Lock-Down */
#define HSFS_FLOCKDN		(0x1 << HSFS_FLOCKDN_OFF)

#define ICH9_REG_HSFC		0x06	/* 16 Bits Hardware Sequencing Flash Control */
#define HSFC_FGO_OFF		0	/* 0: Flash Cycle Go */
#define HSFC_FGO		(0x1 << HSFC_FGO_OFF)
#define HSFC_FCYCLE_OFF		1	/* 1-2: FLASH Cycle */
#define HSFC_FCYCLE		(0x3 << HSFC_FCYCLE_OFF)
					/* 3-7: reserved */
#define HSFC_FDBC_OFF		8	/* 8-13: Flash Data Byte Count */
#define HSFC_FDBC		(0x3f << HSFC_FDBC_OFF)
					/* 14: reserved */
#define HSFC_SME_OFF		15	/* 15: SPI SMI# Enable */
#define HSFC_SME		(0x1 << HSFC_SME_OFF)

68 69
#define ICH9_REG_FADDR		0x08	/* 32 Bits */
#define ICH9_REG_FDATA0		0x10	/* 64 Bytes */
Stefan Reinauer's avatar
Stefan Reinauer committed
70

71 72 73 74
#define ICH9_REG_FRAP		0x50	/* 32 Bytes Flash Region Access Permissions */
#define ICH9_REG_FREG0		0x54	/* 32 Bytes Flash Region 0 */

#define ICH9_REG_PR0		0x74	/* 32 Bytes Protected Range 0 */
75 76
#define PR_WP_OFF		31	/* 31: write protection enable */
#define PR_RP_OFF		15	/* 15: read protection enable */
77

78
#define ICH9_REG_SSFS		0x90	/* 08 Bits */
79 80 81 82 83 84 85 86
#define SSFS_SCIP_OFF		0	/* SPI Cycle In Progress */
#define SSFS_SCIP		(0x1 << SSFS_SCIP_OFF)
#define SSFS_FDONE_OFF		2	/* Cycle Done Status */
#define SSFS_FDONE		(0x1 << SSFS_FDONE_OFF)
#define SSFS_FCERR_OFF		3	/* Flash Cycle Error */
#define SSFS_FCERR		(0x1 << SSFS_FCERR_OFF)
#define SSFS_AEL_OFF		4	/* Access Error Log */
#define SSFS_AEL		(0x1 << SSFS_AEL_OFF)
87
/* The following bits are reserved in SSFS: 1,5-7. */
88
#define SSFS_RESERVED_MASK	0x000000e2
Stefan Reinauer's avatar
Stefan Reinauer committed
89

90 91
#define ICH9_REG_SSFC		0x91	/* 24 Bits */
/* We combine SSFS and SSFC to one 32-bit word,
92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
 * therefore SSFC bits are off by 8. */
						/* 0: reserved */
#define SSFC_SCGO_OFF		(1 + 8)		/* 1: SPI Cycle Go */
#define SSFC_SCGO		(0x1 << SSFC_SCGO_OFF)
#define SSFC_ACS_OFF		(2 + 8)		/* 2: Atomic Cycle Sequence */
#define SSFC_ACS		(0x1 << SSFC_ACS_OFF)
#define SSFC_SPOP_OFF		(3 + 8)		/* 3: Sequence Prefix Opcode Pointer */
#define SSFC_SPOP		(0x1 << SSFC_SPOP_OFF)
#define SSFC_COP_OFF		(4 + 8)		/* 4-6: Cycle Opcode Pointer */
#define SSFC_COP		(0x7 << SSFC_COP_OFF)
						/* 7: reserved */
#define SSFC_DBC_OFF		(8 + 8)		/* 8-13: Data Byte Count */
#define SSFC_DBC		(0x3f << SSFC_DBC_OFF)
#define SSFC_DS_OFF		(14 + 8)	/* 14: Data Cycle */
#define SSFC_DS			(0x1 << SSFC_DS_OFF)
#define SSFC_SME_OFF		(15 + 8)	/* 15: SPI SMI# Enable */
#define SSFC_SME		(0x1 << SSFC_SME_OFF)
#define SSFC_SCF_OFF		(16 + 8)	/* 16-18: SPI Cycle Frequency */
#define SSFC_SCF		(0x7 << SSFC_SCF_OFF)
#define SSFC_SCF_20MHZ		0x00000000
#define SSFC_SCF_33MHZ		0x01000000
						/* 19-23: reserved */
114
#define SSFC_RESERVED_MASK	0xf8008100
Stefan Reinauer's avatar
Stefan Reinauer committed
115

116 117 118
#define ICH9_REG_PREOP		0x94	/* 16 Bits */
#define ICH9_REG_OPTYPE		0x96	/* 16 Bits */
#define ICH9_REG_OPMENU		0x98	/* 64 Bits */
119

120 121 122
#define ICH9_REG_BBAR		0xA0	/* 32 Bits BIOS Base Address Configuration */
#define BBAR_MASK	0x00ffff00		/* 8-23: Bottom of System Flash */

123 124 125 126 127 128 129 130 131 132
#define ICH8_REG_VSCC		0xC1	/* 32 Bits Vendor Specific Component Capabilities */
#define ICH9_REG_LVSCC		0xC4	/* 32 Bits Host Lower Vendor Specific Component Capabilities */
#define ICH9_REG_UVSCC		0xC8	/* 32 Bits Host Upper Vendor Specific Component Capabilities */
/* The individual fields of the VSCC registers are defined in the file
 * ich_descriptors.h. The reason is that the same layout is also used in the
 * flash descriptor to define the properties of the different flash chips
 * supported. The BIOS (or the ME?) is responsible to populate the ICH registers
 * with the information from the descriptor on startup depending on the actual
 * chip(s) detected. */

133 134 135 136
#define ICH9_REG_FPB		0xD0	/* 32 Bits Flash Partition Boundary */
#define FPB_FPBA_OFF		0	/* 0-12: Block/Sector Erase Size */
#define FPB_FPBA			(0x1FFF << FPB_FPBA_OFF)

137
// ICH9R SPI commands
138 139 140 141
#define SPI_OPCODE_TYPE_READ_NO_ADDRESS		0
#define SPI_OPCODE_TYPE_WRITE_NO_ADDRESS	1
#define SPI_OPCODE_TYPE_READ_WITH_ADDRESS	2
#define SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS	3
142

Stefan Reinauer's avatar
Stefan Reinauer committed
143
// ICH7 registers
144
#define ICH7_REG_SPIS		0x00	/* 16 Bits */
145 146 147 148 149
#define SPIS_SCIP		0x0001
#define SPIS_GRANT		0x0002
#define SPIS_CDS		0x0004
#define SPIS_FCERR		0x0008
#define SPIS_RESERVED_MASK	0x7ff0
Stefan Reinauer's avatar
Stefan Reinauer committed
150

151 152 153 154 155 156 157 158 159 160
/* VIA SPI is compatible with ICH7, but maxdata
   to transfer is 16 bytes.

   DATA byte count on ICH7 is 8:13, on VIA 8:11

   bit 12 is port select CS0 CS1
   bit 13 is FAST READ enable
   bit 7  is used with fast read and one shot controls CS de-assert?
*/

161 162 163 164 165
#define ICH7_REG_SPIC		0x02	/* 16 Bits */
#define SPIC_SCGO		0x0002
#define SPIC_ACS		0x0004
#define SPIC_SPOP		0x0008
#define SPIC_DS			0x4000
Stefan Reinauer's avatar
Stefan Reinauer committed
166

167 168 169 170 171
#define ICH7_REG_SPIA		0x04	/* 32 Bits */
#define ICH7_REG_SPID0		0x08	/* 64 Bytes */
#define ICH7_REG_PREOP		0x54	/* 16 Bits */
#define ICH7_REG_OPTYPE		0x56	/* 16 Bits */
#define ICH7_REG_OPMENU		0x58	/* 64 Bits */
Stefan Reinauer's avatar
Stefan Reinauer committed
172

173
/* ICH SPI configuration lock-down. May be set during chipset enabling. */
174
static int ichspi_lock = 0;
175

176
static enum ich_chipset ich_generation = CHIPSET_ICH_UNKNOWN;
177 178
uint32_t ichspi_bbar = 0;

179
static void *ich_spibar = NULL;
180

181 182 183 184 185 186
typedef struct _OPCODE {
	uint8_t opcode;		//This commands spi opcode
	uint8_t spi_type;	//This commands spi type
	uint8_t atomic;		//Use preop: (0: none, 1: preop0, 2: preop1
} OPCODE;

187
/* Suggested opcode definition:
188 189 190 191 192 193 194 195 196
 * Preop 1: Write Enable
 * Preop 2: Write Status register enable
 *
 * OP 0: Write address
 * OP 1: Read Address
 * OP 2: ERASE block
 * OP 3: Read Status register
 * OP 4: Read ID
 * OP 5: Write Status register
197
 * OP 6: chip private (read JEDEC id)
198 199 200 201 202 203 204
 * OP 7: Chip erase
 */
typedef struct _OPCODES {
	uint8_t preop[2];
	OPCODE opcode[8];
} OPCODES;

205
static OPCODES *curopcodes = NULL;
206 207

/* HW access functions */
208
static uint32_t REGREAD32(int X)
209
{
210
	return mmio_readl(ich_spibar + X);
Stefan Reinauer's avatar
Stefan Reinauer committed
211 212
}

213
static uint16_t REGREAD16(int X)
Stefan Reinauer's avatar
Stefan Reinauer committed
214
{
215
	return mmio_readw(ich_spibar + X);
216 217
}

218 219 220 221 222
static uint16_t REGREAD8(int X)
{
	return mmio_readb(ich_spibar + X);
}

223 224 225
#define REGWRITE32(off, val) mmio_writel(val, ich_spibar+(off))
#define REGWRITE16(off, val) mmio_writew(val, ich_spibar+(off))
#define REGWRITE8(off, val)  mmio_writeb(val, ich_spibar+(off))
226 227

/* Common SPI functions */
228 229
static int find_opcode(OPCODES *op, uint8_t opcode);
static int find_preop(OPCODES *op, uint8_t preop);
FENG yu ning's avatar
FENG yu ning committed
230
static int generate_opcodes(OPCODES * op);
231
static int program_opcodes(OPCODES *op, int enable_undo);
232
static int run_opcode(const struct flashctx *flash, OPCODE op, uint32_t offset,
233
		      uint8_t datalength, uint8_t * data);
234

FENG yu ning's avatar
FENG yu ning committed
235 236 237 238 239 240
/* for pairing opcodes with their required preop */
struct preop_opcode_pair {
	uint8_t preop;
	uint8_t opcode;
};

241
/* List of opcodes which need preopcodes and matching preopcodes. Unused. */
242
const struct preop_opcode_pair pops[] = {
FENG yu ning's avatar
FENG yu ning committed
243 244 245 246 247 248
	{JEDEC_WREN, JEDEC_BYTE_PROGRAM},
	{JEDEC_WREN, JEDEC_SE}, /* sector erase */
	{JEDEC_WREN, JEDEC_BE_52}, /* block erase */
	{JEDEC_WREN, JEDEC_BE_D8}, /* block erase */
	{JEDEC_WREN, JEDEC_CE_60}, /* chip erase */
	{JEDEC_WREN, JEDEC_CE_C7}, /* chip erase */
249 250
	 /* FIXME: WRSR requires either EWSR or WREN depending on chip type. */
	{JEDEC_WREN, JEDEC_WRSR},
FENG yu ning's avatar
FENG yu ning committed
251 252 253 254
	{JEDEC_EWSR, JEDEC_WRSR},
	{0,}
};

255 256 257
/* Reasonable default configuration. Needs ad-hoc modifications if we
 * encounter unlisted opcodes. Fun.
 */
258
static OPCODES O_ST_M25P = {
259 260
	{
	 JEDEC_WREN,
261 262
	 JEDEC_EWSR,
	},
263
	{
264
	 {JEDEC_BYTE_PROGRAM, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Write Byte
265
	 {JEDEC_READ, SPI_OPCODE_TYPE_READ_WITH_ADDRESS, 0},	// Read Data
266
	 {JEDEC_BE_D8, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Erase Sector
267
	 {JEDEC_RDSR, SPI_OPCODE_TYPE_READ_NO_ADDRESS, 0},	// Read Device Status Reg
268
	 {JEDEC_REMS, SPI_OPCODE_TYPE_READ_WITH_ADDRESS, 0},	// Read Electronic Manufacturer Signature
269
	 {JEDEC_WRSR, SPI_OPCODE_TYPE_WRITE_NO_ADDRESS, 0},	// Write Status Register
270
	 {JEDEC_RDID, SPI_OPCODE_TYPE_READ_NO_ADDRESS, 0},	// Read JDEC ID
271 272
	 {JEDEC_CE_C7, SPI_OPCODE_TYPE_WRITE_NO_ADDRESS, 0},	// Bulk erase
	}
273 274
};

275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292
/* List of opcodes with their corresponding spi_type
 * It is used to reprogram the chipset OPCODE table on-the-fly if an opcode
 * is needed which is currently not in the chipset OPCODE table
 */
static OPCODE POSSIBLE_OPCODES[] = {
	 {JEDEC_BYTE_PROGRAM, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Write Byte
	 {JEDEC_READ, SPI_OPCODE_TYPE_READ_WITH_ADDRESS, 0},	// Read Data
	 {JEDEC_BE_D8, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Erase Sector
	 {JEDEC_RDSR, SPI_OPCODE_TYPE_READ_NO_ADDRESS, 0},	// Read Device Status Reg
	 {JEDEC_REMS, SPI_OPCODE_TYPE_READ_WITH_ADDRESS, 0},	// Read Electronic Manufacturer Signature
	 {JEDEC_WRSR, SPI_OPCODE_TYPE_WRITE_NO_ADDRESS, 0},	// Write Status Register
	 {JEDEC_RDID, SPI_OPCODE_TYPE_READ_NO_ADDRESS, 0},	// Read JDEC ID
	 {JEDEC_CE_C7, SPI_OPCODE_TYPE_WRITE_NO_ADDRESS, 0},	// Bulk erase
	 {JEDEC_SE, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Sector erase
	 {JEDEC_BE_52, SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS, 0},	// Block erase
	 {JEDEC_AAI_WORD_PROGRAM, SPI_OPCODE_TYPE_WRITE_NO_ADDRESS, 0},	// Auto Address Increment
};

293
static OPCODES O_EXISTING = {};
294

295
/* pretty printing functions */
296
static void prettyprint_opcodes(OPCODES *ops)
297 298
{
	OPCODE oc;
299 300
	const char *t;
	const char *a;
301
	uint8_t i;
302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317
	static const char *const spi_type[4] = {
		"read  w/o addr",
		"write w/o addr",
		"read  w/  addr",
		"write w/  addr"
	};
	static const char *const atomic_type[3] = {
		"none",
		" 0  ",
		" 1  "
	};

	if (ops == NULL)
		return;

	msg_pdbg2("        OP        Type      Pre-OP\n");
318 319
	for (i = 0; i < 8; i++) {
		oc = ops->opcode[i];
320 321 322
		t = (oc.spi_type > 3) ? "invalid" : spi_type[oc.spi_type];
		a = (oc.atomic > 2) ? "invalid" : atomic_type[oc.atomic];
		msg_pdbg2("op[%d]: 0x%02x, %s, %s\n", i, oc.opcode, t, a);
323
	}
324 325
	msg_pdbg2("Pre-OP 0: 0x%02x, Pre-OP 1: 0x%02x\n", ops->preop[0],
		 ops->preop[1]);
326 327 328 329
}

#define pprint_reg(reg, bit, val, sep) msg_pdbg("%s=%d" sep, #bit, (val & reg##_##bit)>>reg##_##bit##_OFF)

330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351
static void prettyprint_ich9_reg_hsfs(uint16_t reg_val)
{
	msg_pdbg("HSFS: ");
	pprint_reg(HSFS, FDONE, reg_val, ", ");
	pprint_reg(HSFS, FCERR, reg_val, ", ");
	pprint_reg(HSFS, AEL, reg_val, ", ");
	pprint_reg(HSFS, BERASE, reg_val, ", ");
	pprint_reg(HSFS, SCIP, reg_val, ", ");
	pprint_reg(HSFS, FDOPSS, reg_val, ", ");
	pprint_reg(HSFS, FDV, reg_val, ", ");
	pprint_reg(HSFS, FLOCKDN, reg_val, "\n");
}

static void prettyprint_ich9_reg_hsfc(uint16_t reg_val)
{
	msg_pdbg("HSFC: ");
	pprint_reg(HSFC, FGO, reg_val, ", ");
	pprint_reg(HSFC, FCYCLE, reg_val, ", ");
	pprint_reg(HSFC, FDBC, reg_val, ", ");
	pprint_reg(HSFC, SME, reg_val, "\n");
}

352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372
static void prettyprint_ich9_reg_ssfs(uint32_t reg_val)
{
	msg_pdbg("SSFS: ");
	pprint_reg(SSFS, SCIP, reg_val, ", ");
	pprint_reg(SSFS, FDONE, reg_val, ", ");
	pprint_reg(SSFS, FCERR, reg_val, ", ");
	pprint_reg(SSFS, AEL, reg_val, "\n");
}

static void prettyprint_ich9_reg_ssfc(uint32_t reg_val)
{
	msg_pdbg("SSFC: ");
	pprint_reg(SSFC, SCGO, reg_val, ", ");
	pprint_reg(SSFC, ACS, reg_val, ", ");
	pprint_reg(SSFC, SPOP, reg_val, ", ");
	pprint_reg(SSFC, COP, reg_val, ", ");
	pprint_reg(SSFC, DBC, reg_val, ", ");
	pprint_reg(SSFC, SME, reg_val, ", ");
	pprint_reg(SSFC, SCF, reg_val, "\n");
}

373 374 375 376
static uint8_t lookup_spi_type(uint8_t opcode)
{
	int a;

377
	for (a = 0; a < ARRAY_SIZE(POSSIBLE_OPCODES); a++) {
378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408
		if (POSSIBLE_OPCODES[a].opcode == opcode)
			return POSSIBLE_OPCODES[a].spi_type;
	}

	return 0xFF;
}

static int reprogram_opcode_on_the_fly(uint8_t opcode, unsigned int writecnt, unsigned int readcnt)
{
	uint8_t spi_type;

	spi_type = lookup_spi_type(opcode);
	if (spi_type > 3) {
		/* Try to guess spi type from read/write sizes.
		 * The following valid writecnt/readcnt combinations exist:
		 * writecnt  = 4, readcnt >= 0
		 * writecnt  = 1, readcnt >= 0
		 * writecnt >= 4, readcnt  = 0
		 * writecnt >= 1, readcnt  = 0
		 * writecnt >= 1 is guaranteed for all commands.
		 */
		if (readcnt == 0)
			/* if readcnt=0 and writecount >= 4, we don't know if it is WRITE_NO_ADDRESS
			 * or WRITE_WITH_ADDRESS. But if we use WRITE_NO_ADDRESS and the first 3 data
			 * bytes are actual the address, they go to the bus anyhow
			 */
			spi_type = SPI_OPCODE_TYPE_WRITE_NO_ADDRESS;
		else if (writecnt == 1) // and readcnt is > 0
			spi_type = SPI_OPCODE_TYPE_READ_NO_ADDRESS;
		else if (writecnt == 4) // and readcnt is > 0
			spi_type = SPI_OPCODE_TYPE_READ_WITH_ADDRESS;
409 410 411 412 413 414 415 416
		else // we have an invalid case
			return SPI_INVALID_LENGTH;
	}
	int oppos = 2;	// use original JEDEC_BE_D8 offset
	curopcodes->opcode[oppos].opcode = opcode;
	curopcodes->opcode[oppos].spi_type = spi_type;
	program_opcodes(curopcodes, 0);
	oppos = find_opcode(curopcodes, opcode);
417
	msg_pdbg2("on-the-fly OPCODE (0x%02X) re-programmed, op-pos=%d\n", opcode, oppos);
418
	return oppos;
419 420
}

421
static int find_opcode(OPCODES *op, uint8_t opcode)
422 423 424
{
	int a;

425 426 427 428 429
	if (op == NULL) {
		msg_perr("\n%s: null OPCODES pointer!\n", __func__);
		return -1;
	}

430 431 432 433 434 435 436 437
	for (a = 0; a < 8; a++) {
		if (op->opcode[a].opcode == opcode)
			return a;
	}

	return -1;
}

438
static int find_preop(OPCODES *op, uint8_t preop)
439 440 441
{
	int a;

442 443 444 445 446
	if (op == NULL) {
		msg_perr("\n%s: null OPCODES pointer!\n", __func__);
		return -1;
	}

447 448 449 450 451 452 453 454
	for (a = 0; a < 2; a++) {
		if (op->preop[a] == preop)
			return a;
	}

	return -1;
}

455
/* Create a struct OPCODES based on what we find in the locked down chipset. */
FENG yu ning's avatar
FENG yu ning committed
456
static int generate_opcodes(OPCODES * op)
457
{
458
	int a;
459 460 461 462
	uint16_t preop, optype;
	uint32_t opmenu[2];

	if (op == NULL) {
463
		msg_perr("\n%s: null OPCODES pointer!\n", __func__);
464 465 466
		return -1;
	}

467 468
	switch (ich_generation) {
	case CHIPSET_ICH7:
469 470 471 472 473
		preop = REGREAD16(ICH7_REG_PREOP);
		optype = REGREAD16(ICH7_REG_OPTYPE);
		opmenu[0] = REGREAD32(ICH7_REG_OPMENU);
		opmenu[1] = REGREAD32(ICH7_REG_OPMENU + 4);
		break;
474 475
	case CHIPSET_ICH8:
	default:		/* Future version might behave the same */
476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500
		preop = REGREAD16(ICH9_REG_PREOP);
		optype = REGREAD16(ICH9_REG_OPTYPE);
		opmenu[0] = REGREAD32(ICH9_REG_OPMENU);
		opmenu[1] = REGREAD32(ICH9_REG_OPMENU + 4);
		break;
	}

	op->preop[0] = (uint8_t) preop;
	op->preop[1] = (uint8_t) (preop >> 8);

	for (a = 0; a < 8; a++) {
		op->opcode[a].spi_type = (uint8_t) (optype & 0x3);
		optype >>= 2;
	}

	for (a = 0; a < 4; a++) {
		op->opcode[a].opcode = (uint8_t) (opmenu[0] & 0xff);
		opmenu[0] >>= 8;
	}

	for (a = 4; a < 8; a++) {
		op->opcode[a].opcode = (uint8_t) (opmenu[1] & 0xff);
		opmenu[1] >>= 8;
	}

501 502
	/* No preopcodes used by default. */
	for (a = 0; a < 8; a++)
503 504 505 506 507
		op->opcode[a].atomic = 0;

	return 0;
}

508
static int program_opcodes(OPCODES *op, int enable_undo)
509 510
{
	uint8_t a;
511 512
	uint16_t preop, optype;
	uint32_t opmenu[2];
513 514 515

	/* Program Prefix Opcodes */
	/* 0:7 Prefix Opcode 1 */
516
	preop = (op->preop[0]);
517
	/* 8:16 Prefix Opcode 2 */
518
	preop |= ((uint16_t) op->preop[1]) << 8;
519

Stefan Reinauer's avatar
Stefan Reinauer committed
520
	/* Program Opcode Types 0 - 7 */
521
	optype = 0;
522
	for (a = 0; a < 8; a++) {
523
		optype |= ((uint16_t) op->opcode[a].spi_type) << (a * 2);
524
	}
525

Stefan Reinauer's avatar
Stefan Reinauer committed
526
	/* Program Allowable Opcodes 0 - 3 */
527
	opmenu[0] = 0;
528
	for (a = 0; a < 4; a++) {
529
		opmenu[0] |= ((uint32_t) op->opcode[a].opcode) << (a * 8);
Stefan Reinauer's avatar
Stefan Reinauer committed
530 531
	}

532
	/*Program Allowable Opcodes 4 - 7 */
533
	opmenu[1] = 0;
534
	for (a = 4; a < 8; a++) {
535
		opmenu[1] |= ((uint32_t) op->opcode[a].opcode) << ((a - 4) * 8);
Stefan Reinauer's avatar
Stefan Reinauer committed
536 537
	}

538
	msg_pdbg2("\n%s: preop=%04x optype=%04x opmenu=%08x%08x\n", __func__, preop, optype, opmenu[0], opmenu[1]);
539 540
	switch (ich_generation) {
	case CHIPSET_ICH7:
541 542 543 544 545 546 547 548 549 550 551
		/* Register undo only for enable_undo=1, i.e. first call. */
		if (enable_undo) {
			rmmio_valw(ich_spibar + ICH7_REG_PREOP);
			rmmio_valw(ich_spibar + ICH7_REG_OPTYPE);
			rmmio_vall(ich_spibar + ICH7_REG_OPMENU);
			rmmio_vall(ich_spibar + ICH7_REG_OPMENU + 4);
		}
		mmio_writew(preop, ich_spibar + ICH7_REG_PREOP);
		mmio_writew(optype, ich_spibar + ICH7_REG_OPTYPE);
		mmio_writel(opmenu[0], ich_spibar + ICH7_REG_OPMENU);
		mmio_writel(opmenu[1], ich_spibar + ICH7_REG_OPMENU + 4);
552
		break;
553 554
	case CHIPSET_ICH8:
	default:		/* Future version might behave the same */
555 556 557 558 559 560 561 562 563 564 565
		/* Register undo only for enable_undo=1, i.e. first call. */
		if (enable_undo) {
			rmmio_valw(ich_spibar + ICH9_REG_PREOP);
			rmmio_valw(ich_spibar + ICH9_REG_OPTYPE);
			rmmio_vall(ich_spibar + ICH9_REG_OPMENU);
			rmmio_vall(ich_spibar + ICH9_REG_OPMENU + 4);
		}
		mmio_writew(preop, ich_spibar + ICH9_REG_PREOP);
		mmio_writew(optype, ich_spibar + ICH9_REG_OPTYPE);
		mmio_writel(opmenu[0], ich_spibar + ICH9_REG_OPMENU);
		mmio_writel(opmenu[1], ich_spibar + ICH9_REG_OPMENU + 4);
566
		break;
Stefan Reinauer's avatar
Stefan Reinauer committed
567 568 569 570 571
	}

	return 0;
}

572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596
/*
 * Returns -1 if at least one mandatory opcode is inaccessible, 0 otherwise.
 * FIXME: this should also check for
 *   - at least one probing opcode (RDID (incl. AT25F variants?), REMS, RES?)
 *   - at least one erasing opcode (lots.)
 *   - at least one program opcode (BYTE_PROGRAM, AAI_WORD_PROGRAM, ...?)
 *   - necessary preops? (EWSR, WREN, ...?)
 */
static int ich_missing_opcodes()
{
	uint8_t ops[] = {
		JEDEC_READ,
		JEDEC_RDSR,
		0
	};
	int i = 0;
	while (ops[i] != 0) {
		msg_pspew("checking for opcode 0x%02x\n", ops[i]);
		if (find_opcode(curopcodes, ops[i]) == -1)
			return -1;
		i++;
	}
	return 0;
}

597 598 599 600
/*
 * Try to set BBAR (BIOS Base Address Register), but read back the value in case
 * it didn't stick.
 */
601
static void ich_set_bbar(uint32_t min_addr)
602
{
603
	int bbar_off;
604
	switch (ich_generation) {
605
	case CHIPSET_ICH7:
606
		bbar_off = 0x50;
607
		break;
608
	case CHIPSET_ICH8:
609 610
		msg_perr("BBAR offset is unknown on ICH8!\n");
		return;
611
	case CHIPSET_ICH9:
612
	default:		/* Future version might behave the same */
613
		bbar_off = ICH9_REG_BBAR;
614
		break;
615 616 617 618 619 620
	}
	
	ichspi_bbar = mmio_readl(ich_spibar + bbar_off) & ~BBAR_MASK;
	if (ichspi_bbar) {
		msg_pdbg("Reserved bits in BBAR not zero: 0x%08x\n",
			 ichspi_bbar);
621
	}
622 623 624 625 626 627 628 629 630
	min_addr &= BBAR_MASK;
	ichspi_bbar |= min_addr;
	rmmio_writel(ichspi_bbar, ich_spibar + bbar_off);
	ichspi_bbar = mmio_readl(ich_spibar + bbar_off) & BBAR_MASK;

	/* We don't have any option except complaining. And if the write
	 * failed, the restore will fail as well, so no problem there.
	 */
	if (ichspi_bbar != min_addr)
631 632
		msg_perr("Setting BBAR to 0x%08x failed! New value: 0x%08x.\n",
			 min_addr, ichspi_bbar);
633 634
}

635 636
/* Read len bytes from the fdata/spid register into the data array.
 *
637
 * Note that using len > flash->pgm->spi.max_data_read will return garbage or
638 639
 * may even crash.
 */
640
static void ich_read_data(uint8_t *data, int len, int reg0_off)
641 642 643 644 645 646 647 648 649 650 651 652 653 654
 {
	int i;
	uint32_t temp32 = 0;

	for (i = 0; i < len; i++) {
		if ((i % 4) == 0)
			temp32 = REGREAD32(reg0_off + i);

		data[i] = (temp32 >> ((i % 4) * 8)) & 0xff;
	}
}

/* Fill len bytes from the data array into the fdata/spid registers.
 *
655
 * Note that using len > flash->pgm->spi.max_data_write will trash the registers
656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679
 * following the data registers.
 */
static void ich_fill_data(const uint8_t *data, int len, int reg0_off)
{
	uint32_t temp32 = 0;
	int i;

	if (len <= 0)
		return;

	for (i = 0; i < len; i++) {
		if ((i % 4) == 0)
			temp32 = 0;

		temp32 |= ((uint32_t) data[i]) << ((i % 4) * 8);

		if ((i % 4) == 3) /* 32 bits are full, write them to regs. */
			REGWRITE32(reg0_off + (i - (i % 4)), temp32);
	}
	i--;
	if ((i % 4) != 3) /* Write remaining data to regs. */
		REGWRITE32(reg0_off + (i - (i % 4)), temp32);
}

FENG yu ning's avatar
FENG yu ning committed
680 681
/* This function generates OPCODES from or programs OPCODES to ICH according to
 * the chipset's SPI configuration lock.
682
 *
FENG yu ning's avatar
FENG yu ning committed
683
 * It should be called before ICH sends any spi command.
684
 */
685
static int ich_init_opcodes(void)
686 687 688 689 690 691 692 693
{
	int rc = 0;
	OPCODES *curopcodes_done;

	if (curopcodes)
		return 0;

	if (ichspi_lock) {
694
		msg_pdbg("Reading OPCODES... ");
695
		curopcodes_done = &O_EXISTING;
FENG yu ning's avatar
FENG yu ning committed
696
		rc = generate_opcodes(curopcodes_done);
697
	} else {
698
		msg_pdbg("Programming OPCODES... ");
699
		curopcodes_done = &O_ST_M25P;
700
		rc = program_opcodes(curopcodes_done, 1);
701 702 703 704
	}

	if (rc) {
		curopcodes = NULL;
705
		msg_perr("failed\n");
706 707 708
		return 1;
	} else {
		curopcodes = curopcodes_done;
709
		msg_pdbg("done\n");
710
		prettyprint_opcodes(curopcodes);
711 712 713 714
		return 0;
	}
}

715
static int ich7_run_opcode(OPCODE op, uint32_t offset,
716
			   uint8_t datalength, uint8_t * data, int maxdata)
Stefan Reinauer's avatar
Stefan Reinauer committed
717 718 719
{
	int write_cmd = 0;
	int timeout;
720
	uint32_t temp32;
Stefan Reinauer's avatar
Stefan Reinauer committed
721
	uint16_t temp16;
722 723
	uint64_t opmenu;
	int opcode_index;
Stefan Reinauer's avatar
Stefan Reinauer committed
724 725 726 727 728 729 730

	/* Is it a write command? */
	if ((op.spi_type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS)
	    || (op.spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS)) {
		write_cmd = 1;
	}

731 732 733 734 735 736 737 738 739
	timeout = 100 * 60;	/* 60 ms are 9.6 million cycles at 16 MHz. */
	while ((REGREAD16(ICH7_REG_SPIS) & SPIS_SCIP) && --timeout) {
		programmer_delay(10);
	}
	if (!timeout) {
		msg_perr("Error: SCIP never cleared!\n");
		return 1;
	}

740 741 742
	/* Program offset in flash into SPIA while preserving reserved bits. */
	temp32 = REGREAD32(ICH7_REG_SPIA) & ~0x00FFFFFF;
	REGWRITE32(ICH7_REG_SPIA, (offset & 0x00FFFFFF) | temp32);
Stefan Reinauer's avatar
Stefan Reinauer committed
743

744
	/* Program data into SPID0 to N */
745 746
	if (write_cmd && (datalength != 0))
		ich_fill_data(data, datalength, ICH7_REG_SPID0);
Stefan Reinauer's avatar
Stefan Reinauer committed
747 748

	/* Assemble SPIS */
749 750 751
	temp16 = REGREAD16(ICH7_REG_SPIS);
	/* keep reserved bits */
	temp16 &= SPIS_RESERVED_MASK;
Stefan Reinauer's avatar
Stefan Reinauer committed
752
	/* clear error status registers */
753
	temp16 |= (SPIS_CDS | SPIS_FCERR);
Stefan Reinauer's avatar
Stefan Reinauer committed
754 755 756 757 758 759 760
	REGWRITE16(ICH7_REG_SPIS, temp16);

	/* Assemble SPIC */
	temp16 = 0;

	if (datalength != 0) {
		temp16 |= SPIC_DS;
761
		temp16 |= ((uint32_t) ((datalength - 1) & (maxdata - 1))) << 8;
Stefan Reinauer's avatar
Stefan Reinauer committed
762 763 764
	}

	/* Select opcode */
765 766 767
	opmenu = REGREAD32(ICH7_REG_OPMENU);
	opmenu |= ((uint64_t)REGREAD32(ICH7_REG_OPMENU + 4)) << 32;

768 769
	for (opcode_index = 0; opcode_index < 8; opcode_index++) {
		if ((opmenu & 0xff) == op.opcode) {
770 771 772 773 774
			break;
		}
		opmenu >>= 8;
	}
	if (opcode_index == 8) {
775
		msg_pdbg("Opcode %x not found.\n", op.opcode);
776 777 778
		return 1;
	}
	temp16 |= ((uint16_t) (opcode_index & 0x07)) << 4;
Stefan Reinauer's avatar
Stefan Reinauer committed
779

780 781 782 783 784 785 786
	timeout = 100 * 60;	/* 60 ms are 9.6 million cycles at 16 MHz. */
	/* Handle Atomic. Atomic commands include three steps:
	    - sending the preop (mainly EWSR or WREN)
	    - sending the main command
	    - waiting for the busy bit (WIP) to be cleared
	   This means the timeout must be sufficient for chip erase
	   of slow high-capacity chips.
787
	 */
788 789 790 791 792 793 794
	switch (op.atomic) {
	case 2:
		/* Select second preop. */
		temp16 |= SPIC_SPOP;
		/* And fall through. */
	case 1:
		/* Atomic command (preop+op) */
Stefan Reinauer's avatar
Stefan Reinauer committed
795
		temp16 |= SPIC_ACS;
796
		timeout = 100 * 1000 * 60;	/* 60 seconds */
797
		break;
Stefan Reinauer's avatar
Stefan Reinauer committed
798 799 800 801 802 803 804 805
	}

	/* Start */
	temp16 |= SPIC_SCGO;

	/* write it */
	REGWRITE16(ICH7_REG_SPIC, temp16);

806 807 808
	/* Wait for Cycle Done Status or Flash Cycle Error. */
	while (((REGREAD16(ICH7_REG_SPIS) & (SPIS_CDS | SPIS_FCERR)) == 0) &&
	       --timeout) {
809
		programmer_delay(10);
Stefan Reinauer's avatar
Stefan Reinauer committed
810 811
	}
	if (!timeout) {
812 813 814
		msg_perr("timeout, ICH7_REG_SPIS=0x%04x\n",
			 REGREAD16(ICH7_REG_SPIS));
		return 1;
Stefan Reinauer's avatar
Stefan Reinauer committed
815 816
	}

817
	/* FIXME: make sure we do not needlessly cause transaction errors. */
818 819
	temp16 = REGREAD16(ICH7_REG_SPIS);
	if (temp16 & SPIS_FCERR) {
820
		msg_perr("Transaction error!\n");
821 822 823
		/* keep reserved bits */
		temp16 &= SPIS_RESERVED_MASK;
		REGWRITE16(ICH7_REG_SPIS, temp16 | SPIS_FCERR);
Stefan Reinauer's avatar
Stefan Reinauer committed
824 825 826
		return 1;
	}

827 828
	if ((!write_cmd) && (datalength != 0))
		ich_read_data(data, datalength, ICH7_REG_SPID0);
829 830 831 832

	return 0;
}

833
static int ich9_run_opcode(OPCODE op, uint32_t offset,
Stefan Reinauer's avatar
Stefan Reinauer committed
834
			   uint8_t datalength, uint8_t * data)
835 836
{
	int write_cmd = 0;
837
	int timeout;
838
	uint32_t temp32;
839 840
	uint64_t opmenu;
	int opcode_index;
841 842 843 844 845 846 847

	/* Is it a write command? */
	if ((op.spi_type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS)
	    || (op.spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS)) {
		write_cmd = 1;
	}

848 849 850 851 852 853 854 855 856
	timeout = 100 * 60;	/* 60 ms are 9.6 million cycles at 16 MHz. */
	while ((REGREAD8(ICH9_REG_SSFS) & SSFS_SCIP) && --timeout) {
		programmer_delay(10);
	}
	if (!timeout) {
		msg_perr("Error: SCIP never cleared!\n");
		return 1;
	}

857 858 859 860
	/* Program offset in flash into FADDR while preserve the reserved bits
	 * and clearing the 25. address bit which is only useable in hwseq. */
	temp32 = REGREAD32(ICH9_REG_FADDR) & ~0x01FFFFFF;
	REGWRITE32(ICH9_REG_FADDR, (offset & 0x00FFFFFF) | temp32);
861 862

	/* Program data into FDATA0 to N */
863 864
	if (write_cmd && (datalength != 0))
		ich_fill_data(data, datalength, ICH9_REG_FDATA0);
865 866

	/* Assemble SSFS + SSFC */
867
	temp32 = REGREAD32(ICH9_REG_SSFS);
868
	/* Keep reserved bits only */
869
	temp32 &= SSFS_RESERVED_MASK | SSFC_RESERVED_MASK;
870 871
	/* Clear cycle done and cycle error status registers */
	temp32 |= (SSFS_FDONE | SSFS_FCERR);
872 873
	REGWRITE32(ICH9_REG_SSFS, temp32);

874
	/* Use 20 MHz */
875 876
	temp32 |= SSFC_SCF_20MHZ;

877
	/* Set data byte count (DBC) and data cycle bit (DS) */
878 879 880
	if (datalength != 0) {
		uint32_t datatemp;
		temp32 |= SSFC_DS;
881 882
		datatemp = ((((uint32_t)datalength - 1) << SSFC_DBC_OFF) &
			    SSFC_DBC);
883 884 885 886
		temp32 |= datatemp;
	}

	/* Select opcode */
887 888 889
	opmenu = REGREAD32(ICH9_REG_OPMENU);
	opmenu |= ((uint64_t)REGREAD32(ICH9_REG_OPMENU + 4)) << 32;

890 891
	for (opcode_index = 0; opcode_index < 8; opcode_index++) {
		if ((opmenu & 0xff) == op.opcode) {
892 893 894 895 896
			break;
		}
		opmenu >>= 8;
	}
	if (opcode_index == 8) {
897
		msg_pdbg("Opcode %x not found.\n", op.opcode);
898 899 900
		return 1;
	}
	temp32 |= ((uint32_t) (opcode_index & 0x07)) << (8 + 4);
901

902 903 904 905 906 907 908
	timeout = 100 * 60;	/* 60 ms are 9.6 million cycles at 16 MHz. */
	/* Handle Atomic. Atomic commands include three steps:
	    - sending the preop (mainly EWSR or WREN)
	    - sending the main command
	    - waiting for the busy bit (WIP) to be cleared
	   This means the timeout must be sufficient for chip erase
	   of slow high-capacity chips.
909
	 */
910 911 912 913 914 915 916
	switch (op.atomic) {
	case 2:
		/* Select second preop. */
		temp32 |= SSFC_SPOP;
		/* And fall through. */
	case 1:
		/* Atomic command (preop+op) */
917
		temp32 |= SSFC_ACS;
918
		timeout = 100 * 1000 * 60;	/* 60 seconds */
919
		break;
920 921 922 923 924 925
	}

	/* Start */
	temp32 |= SSFC_SCGO;

	/* write it */
Stefan Reinauer's avatar
Stefan Reinauer committed
926
	REGWRITE32(ICH9_REG_SSFS, temp32);
927

928
	/* Wait for Cycle Done Status or Flash Cycle Error. */
929
	while (((REGREAD32(ICH9_REG_SSFS) & (SSFS_FDONE | SSFS_FCERR)) == 0) &&
930
	       --timeout) {
931
		programmer_delay(10);
932 933
	}
	if (!timeout) {
934 935 936
		msg_perr("timeout, ICH9_REG_SSFS=0x%08x\n",
			 REGREAD32(ICH9_REG_SSFS));
		return 1;
937 938
	}

939
	/* FIXME make sure we do not needlessly cause transaction errors. */
940 941
	temp32 = REGREAD32(ICH9_REG_SSFS);
	if (temp32 & SSFS_FCERR) {
942
		msg_perr("Transaction error!\n");
943 944
		prettyprint_ich9_reg_ssfs(temp32);
		prettyprint_ich9_reg_ssfc(temp32);
945 946 947 948
		/* keep reserved bits */
		temp32 &= SSFS_RESERVED_MASK | SSFC_RESERVED_MASK;
		/* Clear the transaction error. */
		REGWRITE32(ICH9_REG_SSFS, temp32 | SSFS_FCERR);
949 950 951
		return 1;
	}

952 953
	if ((!write_cmd) && (datalength != 0))
		ich_read_data(data, datalength, ICH9_REG_FDATA0);
954 955 956 957

	return 0;
}

958
static int run_opcode(const struct flashctx *flash, OPCODE op, uint32_t offset,
Stefan Reinauer's avatar
Stefan Reinauer committed
959 960
		      uint8_t datalength, uint8_t * data)
{
961
	/* max_data_read == max_data_write for all Intel/VIA SPI masters */
962
	uint8_t maxlength = flash->pgm->spi.max_data_read;
963

964
	if (ich_generation == CHIPSET_ICH_UNKNOWN) {
965 966 967 968 969 970 971 972 973 974 975
		msg_perr("%s: unsupported chipset\n", __func__);
		return -1;
	}

	if (datalength > maxlength) {
		msg_perr("%s: Internal command size error for "
			"opcode 0x%02x, got datalength=%i, want <=%i\n",
			__func__, op.opcode, datalength, maxlength);
		return SPI_INVALID_LENGTH;
	}

976 977
	switch (ich_generation) {
	case CHIPSET_ICH7:
978
		return ich7_run_opcode(op, offset, datalength, data, maxlength);
979 980
	case CHIPSET_ICH8:
	default:		/* Future version might behave the same */
981
		return ich9_run_opcode(op, offset, datalength, data);
982
	}
Stefan Reinauer's avatar
Stefan Reinauer committed
983 984
}

985 986 987 988
static int ich_spi_send_command(struct flashctx *flash, unsigned int writecnt,
				unsigned int readcnt,
				const unsigned char *writearr,
				unsigned char *readarr)
989
{
990
	int result;
991 992 993 994 995 996 997 998
	int opcode_index = -1;
	const unsigned char cmd = *writearr;
	OPCODE *opcode;
	uint32_t addr = 0;
	uint8_t *data;
	int count;

	/* find cmd in opcodes-table */
999
	opcode_index = find_opcode(curopcodes, cmd);
1000
	if (opcode_index == -1) {
1001 1002
		if (!ichspi_lock)
			opcode_index = reprogram_opcode_on_the_fly(cmd, writecnt, readcnt);
1003 1004 1005 1006
		if (opcode_index == SPI_INVALID_LENGTH) {
			msg_pdbg("OPCODE 0x%02x has unsupported length, will not execute.\n", cmd);
			return SPI_INVALID_LENGTH;
		} else if (opcode_index == -1) {
Stefan Tauner's avatar
Stefan Tauner committed
1007 1008
			msg_pdbg("Invalid OPCODE 0x%02x, will not execute.\n",
				 cmd);
1009 1010
			return SPI_INVALID_OPCODE;
		}
1011 1012 1013 1014
	}

	opcode = &(curopcodes->opcode[opcode_index]);

1015 1016 1017 1018 1019 1020 1021 1022 1023
	/* The following valid writecnt/readcnt combinations exist:
	 * writecnt  = 4, readcnt >= 0
	 * writecnt  = 1, readcnt >= 0
	 * writecnt >= 4, readcnt  = 0
	 * writecnt >= 1, readcnt  = 0
	 * writecnt >= 1 is guaranteed for all commands.
	 */
	if ((opcode->spi_type == SPI_OPCODE_TYPE_READ_WITH_ADDRESS) &&
	    (writecnt != 4)) {
1024
		msg_perr("%s: Internal command size error for opcode "
1025 1026 1027 1028 1029 1030
			"0x%02x, got writecnt=%i, want =4\n", __func__, cmd,
			writecnt);
		return SPI_INVALID_LENGTH;
	}
	if ((opcode->spi_type == SPI_OPCODE_TYPE_READ_NO_ADDRESS) &&
	    (writecnt != 1)) {
1031
		msg_perr("%s: Internal command size error for opcode "
1032 1033 1034 1035 1036 1037
			"0x%02x, got writecnt=%i, want =1\n", __func__, cmd,
			writecnt);
		return SPI_INVALID_LENGTH;
	}
	if ((opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) &&
	    (writecnt < 4)) {
1038
		msg_perr("%s: Internal command size error for opcode "
1039 1040 1041 1042 1043 1044 1045
			"0x%02x, got writecnt=%i, want >=4\n", __func__, cmd,
			writecnt);
		return SPI_INVALID_LENGTH;
	}
	if (((opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) ||
	     (opcode->spi_type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS)) &&
	    (readcnt)) {
1046
		msg_perr("%s: Internal command size error for opcode "
1047 1048 1049 1050 1051
			"0x%02x, got readcnt=%i, want =0\n", __func__, cmd,
			readcnt);
		return SPI_INVALID_LENGTH;
	}

1052 1053 1054
	/* if opcode-type requires an address */
	if (opcode->spi_type == SPI_OPCODE_TYPE_READ_WITH_ADDRESS ||
	    opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) {
1055 1056
		addr = (writearr[1] << 16) |
		    (writearr[2] << 8) | (writearr[3] << 0);
1057 1058 1059 1060 1061
		if (addr < ichspi_bbar) {
			msg_perr("%s: Address 0x%06x below allowed "
				 "range 0x%06x-0xffffff\n", __func__,
				 addr, ichspi_bbar);
			return SPI_INVALID_ADDRESS;
1062
		}
1063
	}
1064

1065 1066 1067 1068 1069 1070 1071
	/* Translate read/write array/count.
	 * The maximum data length is identical for the maximum read length and
	 * for the maximum write length excluding opcode and address. Opcode and
	 * address are stored in separate registers, not in the data registers
	 * and are thus not counted towards data length. The only exception
	 * applies if the opcode definition (un)intentionally classifies said
	 * opcode incorrectly as non-address opcode or vice versa. */
1072
	if (opcode->spi_type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS) {
1073 1074 1075 1076 1077 1078 1079
		data = (uint8_t *) (writearr + 1);
		count = writecnt - 1;
	} else if (opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) {
		data = (uint8_t *) (writearr + 4);
		count = writecnt - 4;
	} else {
		data = (uint8_t *) readarr;
1080 1081
		count = readcnt;
	}
1082

1083
	result = run_opcode(flash, *opcode, addr, count, data);
1084
	if (result) {
1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098
		msg_pdbg("Running OPCODE 0x%02x failed ", opcode->opcode);
		if ((opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) ||
		    (opcode->spi_type == SPI_OPCODE_TYPE_READ_WITH_ADDRESS)) {
			msg_pdbg("at address 0x%06x ", addr);
		}
		msg_pdbg("(payload length was %d).\n", count);

		/* Print out the data array if it contains data to write.
		 * Errors are detected before the received data is read back into
		 * the array so it won't make sense to print it then. */
		if ((opcode->spi_type == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS) ||
		    (opcode->spi_type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS)) {
			int i;
			msg_pspew("The data was:\n");
1099
			for (i = 0; i < count; i++){
1100 1101 1102
				msg_pspew("%3d: 0x%02x\n", i, data[i]);
			}
		}
1103 1104
	}

1105
	return result;
1106
}
1107

1108 1109 1110 1111 1112
static struct hwseq_data {
	uint32_t size_comp0;
	uint32_t size_comp1;
} hwseq_data;

1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
/* Sets FLA in FADDR to (addr & 0x01FFFFFF) without touching other bits. */
static void ich_hwseq_set_addr(uint32_t addr)
{
	uint32_t addr_old = REGREAD32(ICH9_REG_FADDR) & ~0x01FFFFFF;
	REGWRITE32(ICH9_REG_FADDR, (addr & 0x01FFFFFF) | addr_old);
}

/* Sets FADDR.FLA to 'addr' and returns the erase block size in bytes
 * of the block containing this address. May return nonsense if the address is
 * not valid. The erase block size for a specific address depends on the flash
 * partition layout as specified by FPB and the partition properties as defined
 * by UVSCC and LVSCC respectively. An alternative to implement this method
 * would be by querying FPB and the respective VSCC register directly.
 */
static uint32_t ich_hwseq_get_erase_block_size(unsigned int addr)
{
	uint8_t enc_berase;
1130
	static const uint32_t dec_berase[4] = {
1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162
		256,
		4 * 1024,
		8 * 1024,
		64 * 1024
	};

	ich_hwseq_set_addr(addr);
	enc_berase = (REGREAD16(ICH9_REG_HSFS) & HSFS_BERASE) >>
		     HSFS_BERASE_OFF;
	return dec_berase[enc_berase];
}

/* Polls for Cycle Done Status, Flash Cycle Error or timeout in 8 us intervals.
   Resets all error flags in HSFS.
   Returns 0 if the cycle completes successfully without errors within
   timeout us, 1 on errors. */
static int ich_hwseq_wait_for_cycle_complete(unsigned int timeout,
					     unsigned int len)
{
	uint16_t hsfs;
	uint32_t addr;

	timeout /= 8; /* scale timeout duration to counter */
	while ((((hsfs = REGREAD16(ICH9_REG_HSFS)) &
		 (HSFS_FDONE | HSFS_FCERR)) == 0) &&
	       --timeout) {
		programmer_delay(8);
	}
	REGWRITE16(ICH9_REG_HSFS, REGREAD16(ICH9_REG_HSFS));
	if (!timeout) {
		addr = REGREAD32(ICH9_REG_FADDR) & 0x01FFFFFF;
		msg_perr("Timeout error between offset 0x%08x and "
1163 1164
			 "0x%08x (= 0x%08x + %d)!\n",
			 addr, addr + len - 1, addr, len - 1);
1165 1166 1167 1168 1169 1170 1171 1172
		prettyprint_ich9_reg_hsfs(hsfs);
		prettyprint_ich9_reg_hsfc(REGREAD16(ICH9_REG_HSFC));
		return 1;
	}

	if (hsfs & HSFS_FCERR) {
		addr = REGREAD32(ICH9_REG_FADDR) & 0x01FFFFFF;
		msg_perr("Transaction error between offset 0x%08x and "
1173
			 "0x%08x (= 0x%08x + %d)!\n",
1174 1175 1176 1177 1178 1179 1180
			 addr, addr + len - 1, addr, len - 1);
		prettyprint_ich9_reg_hsfs(hsfs);
		prettyprint_ich9_reg_hsfc(REGREAD16(ICH9_REG_HSFC));
		return 1;
	}
	return 0;
}
1181

1182
static int ich_hwseq_probe(struct flashctx *flash)
1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195
{
	uint32_t total_size, boundary;
	uint32_t erase_size_low, size_low, erase_size_high, size_high;
	struct block_eraser *eraser;

	total_size = hwseq_data.size_comp0 + hwseq_data.size_comp1;
	msg_cdbg("Found %d attached SPI flash chip",
		 (hwseq_data.size_comp1 != 0) ? 2 : 1);
	if (hwseq_data.size_comp1 != 0)
		msg_cdbg("s with a combined");
	else
		msg_cdbg(" with a");
	msg_cdbg(" density of %d kB.\n", total_size / 1024);
1196
	flash->chip->total_size = total_size / 1024;
1197

1198
	eraser = &(flash->chip->block_erasers[0]);
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212
	boundary = (REGREAD32(ICH9_REG_FPB) & FPB_FPBA) << 12;
	size_high = total_size - boundary;
	erase_size_high = ich_hwseq_get_erase_block_size(boundary);

	if (boundary == 0) {
		msg_cdbg("There is only one partition containing the whole "
			 "address space (0x%06x - 0x%06x).\n", 0, size_high-1);
		eraser->eraseblocks[0].size = erase_size_high;
		eraser->eraseblocks[0].count = size_high / erase_size_high;
		msg_cdbg("There are %d erase blocks with %d B each.\n",
			 size_high / erase_size_high, erase_size_high);
	} else {
		msg_cdbg("The flash address space (0x%06x - 0x%06x) is divided "
			 "at address 0x%06x in two partitions.\n",
1213
			 0, total_size-1, boundary);
1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226
		size_low = total_size - size_high;
		erase_size_low = ich_hwseq_get_erase_block_size(0);

		eraser->eraseblocks[0].size = erase_size_low;
		eraser->eraseblocks[0].count = size_low / erase_size_low;
		msg_cdbg("The first partition ranges from 0x%06x to 0x%06x.\n",
			 0, size_low-1);
		msg_cdbg("In that range are %d erase blocks with %d B each.\n",
			 size_low / erase_size_low, erase_size_low);

		eraser->eraseblocks[1].size = erase_size_high;
		eraser->eraseblocks[1].count = size_high / erase_size_high;
		msg_cdbg("The second partition ranges from 0x%06x to 0x%06x.\n",
1227
			 boundary, total_size-1);
1228 1229 1230
		msg_cdbg("In that range are %d erase blocks with %d B each.\n",
			 size_high / erase_size_high, erase_size_high);
	}
1231
	flash->chip->tested = TEST_OK_PREW;
1232 1233 1234
	return 1;
}

1235 1236
static int ich_hwseq_block_erase(struct flashctx *flash, unsigned int addr,
				 unsigned int len)
1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258
{
	uint32_t erase_block;
	uint16_t hsfc;
	uint32_t timeout = 5000 * 1000; /* 5 s for max 64 kB */

	erase_block = ich_hwseq_get_erase_block_size(addr);
	if (len != erase_block) {
		msg_cerr("Erase block size for address 0x%06x is %d B, "
			 "but requested erase block size is %d B. "
			 "Not erasing anything.\n", addr, erase_block, len);
		return -1;
	}

	/* Although the hardware supports this (it would erase the whole block
	 * containing the address) we play safe here. */
	if (addr % erase_block != 0) {
		msg_cerr("Erase address 0x%06x is not aligned to the erase "
			 "block boundary (any multiple of %d). "
			 "Not erasing anything.\n", addr, erase_block);
		return -1;
	}

1259
	if (addr + len > flash->chip->total_size * 1024) {
1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283
		msg_perr("Request to erase some inaccessible memory address(es)"
			 " (addr=0x%x, len=%d). "
			 "Not erasing anything.\n", addr, len);
		return -1;
	}

	msg_pdbg("Erasing %d bytes starting at 0x%06x.\n", len, addr);

	/* make sure FDONE, FCERR, AEL are cleared by writing 1 to them */
	REGWRITE16(ICH9_REG_HSFS, REGREAD16(ICH9_REG_HSFS));

	hsfc = REGREAD16(ICH9_REG_HSFC);
	hsfc &= ~HSFC_FCYCLE; /* clear operation */
	hsfc |= (0x3 << HSFC_FCYCLE_OFF); /* set erase operation */
	hsfc |= HSFC_FGO; /* start */
	msg_pdbg("HSFC used for block erasing: ");
	prettyprint_ich9_reg_hsfc(hsfc);
	REGWRITE16(ICH9_REG_HSFC, hsfc);

	if (ich_hwseq_wait_for_cycle_complete(timeout, len))
		return -1;
	return 0;
}

1284 1285
static int ich_hwseq_read(struct flashctx *flash, uint8_t *buf,
			  unsigned int addr, unsigned int len)
1286 1287 1288 1289 1290
{
	uint16_t hsfc;
	uint16_t timeout = 100 * 60;
	uint8_t block_len;

1291
	if (addr + len > flash->chip->total_size * 1024) {
1292 1293 1294 1295 1296 1297 1298 1299 1300 1301
		msg_perr("Request to read from an inaccessible memory address "
			 "(addr=0x%x, len=%d).\n", addr, len);
		return -1;
	}

	msg_pdbg("Reading %d bytes starting at 0x%06x.\n", len, addr);
	/* clear FDONE, FCERR, AEL by writing 1 to them (if they are set) */
	REGWRITE16(ICH9_REG_HSFS, REGREAD16(ICH9_REG_HSFS));

	while (len > 0) {
1302
		block_len = min(len, flash->pgm->opaque.max_data_read);
1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321
		ich_hwseq_set_addr(addr);
		hsfc = REGREAD16(ICH9_REG_HSFC);
		hsfc &= ~HSFC_FCYCLE; /* set read operation */
		hsfc &= ~HSFC_FDBC; /* clear byte count */
		/* set byte count */
		hsfc |= (((block_len - 1) << HSFC_FDBC_OFF) & HSFC_FDBC);
		hsfc |= HSFC_FGO; /* start */
		REGWRITE16(ICH9_REG_HSFC, hsfc);

		if (ich_hwseq_wait_for_cycle_complete(timeout, block_len))
			return 1;
		ich_read_data(buf, block_len, ICH9_REG_FDATA0);
		addr += block_len;
		buf += block_len;
		len -= block_len;
	}
	return 0;
}

1322 1323
static int ich_hwseq_write(struct flashctx *flash, uint8_t *buf,
			   unsigned int addr, unsigned int len)
1324 1325 1326 1327 1328
{
	uint16_t hsfc;
	uint16_t timeout = 100 * 60;
	uint8_t block_len;

1329
	if (addr + len > flash->chip->total_size * 1024) {
1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340
		msg_perr("Request to write to an inaccessible memory address "
			 "(addr=0x%x, len=%d).\n", addr, len);
		return -1;
	}

	msg_pdbg("Writing %d bytes starting at 0x%06x.\n", len, addr);
	/* clear FDONE, FCERR, AEL by writing 1 to them (if they are set) */
	REGWRITE16(ICH9_REG_HSFS, REGREAD16(ICH9_REG_HSFS));

	while (len > 0) {
		ich_hwseq_set_addr(addr);
1341
		block_len = min(len, flash->pgm->opaque.max_data_write);
1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359
		ich_fill_data(buf, block_len, ICH9_REG_FDATA0);
		hsfc = REGREAD16(ICH9_REG_HSFC);
		hsfc &= ~HSFC_FCYCLE; /* clear operation */
		hsfc |= (0x2 << HSFC_FCYCLE_OFF); /* set write operation */
		hsfc &= ~HSFC_FDBC; /* clear byte count */
		/* set byte count */
		hsfc |= (((block_len - 1) << HSFC_FDBC_OFF) & HSFC_FDBC);
		hsfc |= HSFC_FGO; /* start */
		REGWRITE16(ICH9_REG_HSFC, hsfc);

		if (ich_hwseq_wait_for_cycle_complete(timeout, block_len))
			return -1;
		addr += block_len;
		buf += block_len;
		len -= block_len;
	}
	return 0;
}
1360

1361 1362
static int ich_spi_send_multicommand(struct flashctx *flash,
				     struct spi_command *cmds)
1363 1364
{
	int ret = 0;
1365
	int i;
1366 1367 1368
	int oppos, preoppos;
	for (; (cmds->writecnt || cmds->readcnt) && !ret; cmds++) {
		if ((cmds + 1)->writecnt || (cmds + 1)->readcnt) {
1369
			/* Next command is valid. */
1370 1371
			preoppos = find_preop(curopcodes, cmds->writearr[0]);
			oppos = find_opcode(curopcodes, (cmds + 1)->writearr[0]);
1372 1373 1374 1375 1376 1377 1378 1379 1380
			if ((oppos == -1) && (preoppos != -1)) {
				/* Current command is listed as preopcode in
				 * ICH struct OPCODES, but next command is not
				 * listed as opcode in that struct.
				 * Check for command sanity, then
				 * try to reprogram the ICH opcode list.
				 */
				if (find_preop(curopcodes,
					       (cmds + 1)->writearr[0]) != -1) {
1381
					msg_perr("%s: Two subsequent "
1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392
						"preopcodes 0x%02x and 0x%02x, "
						"ignoring the first.\n",
						__func__, cmds->writearr[0],
						(cmds + 1)->writearr[0]);
					continue;
				}
				/* If the chipset is locked down, we'll fail
				 * during execution of the next command anyway.
				 * No need to bother with fixups.
				 */
				if (!ichspi_lock) {
1393 1394 1395 1396
					oppos = reprogram_opcode_on_the_fly((cmds + 1)->writearr[0], (cmds + 1)->writecnt, (cmds + 1)->readcnt);
					if (oppos == -1)
						continue;
					curopcodes->opcode[oppos].atomic = preoppos + 1;
1397 1398 1399 1400 1401 1402 1403 1404 1405
					continue;
				}
			}
			if ((oppos != -1) && (preoppos != -1)) {
				/* Current command is listed as preopcode in
				 * ICH struct OPCODES and next command is listed
				 * as opcode in that struct. Match them up.
				 */
				curopcodes->opcode[oppos].atomic = preoppos + 1;
1406
				continue;
1407 1408 1409 1410 1411
			}
			/* If none of the above if-statements about oppos or
			 * preoppos matched, this is a normal opcode.
			 */
		}
1412
		ret = ich_spi_send_command(flash, cmds->writecnt, cmds->readcnt,
1413
					   cmds->writearr, cmds->readarr);
1414 1415 1416
		/* Reset the type of all opcodes to non-atomic. */
		for (i = 0; i < 8; i++)
			curopcodes->opcode[i].atomic = 0;
1417 1418 1419
	}
	return ret;
}
1420

1421 1422 1423 1424 1425
#define ICH_BMWAG(x) ((x >> 24) & 0xff)
#define ICH_BMRAG(x) ((x >> 16) & 0xff)
#define ICH_BRWA(x)  ((x >>  8) & 0xff)
#define ICH_BRRA(x)  ((x >>  0) & 0xff)

1426 1427
/* returns 0 if region is unused or r/w */
static int ich9_handle_frap(uint32_t frap, int i)
1428
{
1429
	static const char *const access_names[4] = {
1430 1431
		"locked", "read-only", "write-only", "read-write"
	};
1432
	static const char *const region_names[5] = {
1433 1434 1435 1436 1437 1438
		"Flash Descriptor", "BIOS", "Management Engine",
		"Gigabit Ethernet", "Platform Data"
	};
	uint32_t base, limit;
	int rwperms = (((ICH_BRWA(frap) >> i) & 1) << 1) |
		      (((ICH_BRRA(frap) >> i) & 1) << 0);
1439
	int offset = ICH9_REG_FREG0 + i * 4;
1440 1441 1442 1443
	uint32_t freg = mmio_readl(ich_spibar + offset);

	base  = ICH_FREG_BASE(freg);
	limit = ICH_FREG_LIMIT(freg);
Stefan Tauner's avatar
Stefan Tauner committed
1444
	if (base > limit || (freg == 0 && i > 0)) {
1445
		/* this FREG is disabled */
1446 1447 1448 1449 1450 1451 1452 1453 1454 1455
		msg_pdbg2("0x%02X: 0x%08x FREG%i: %s region is unused.\n",
			  offset, freg, i, region_names[i]);
		return 0;
	}
	msg_pdbg("0x%02X: 0x%08x ", offset, freg);
	if (rwperms == 0x3) {
		msg_pdbg("FREG%i: %s region (0x%08x-0x%08x) is %s.\n", i,
			 region_names[i], base, (limit | 0x0fff),
			 access_names[rwperms]);
		return 0;
1456 1457
	}

Stefan Tauner's avatar
Stefan Tauner committed
1458
	msg_pwarn("FREG%i: Warning: %s region (0x%08x-0x%08x) is %s.\n", i,
1459 1460 1461
		  region_names[i], base, (limit | 0x0fff),
		  access_names[rwperms]);
	return 1;
1462 1463
}

1464 1465 1466 1467 1468 1469 1470 1471 1472
	/* In contrast to FRAP and the master section of the descriptor the bits
	 * in the PR registers have an inverted meaning. The bits in FRAP
	 * indicate read and write access _grant_. Here they indicate read
	 * and write _protection_ respectively. If both bits are 0 the address
	 * bits are ignored.
	 */
#define ICH_PR_PERMS(pr)	(((~((pr) >> PR_RP_OFF) & 1) << 0) | \
				 ((~((pr) >> PR_WP_OFF) & 1) << 1))

1473 1474
/* returns 0 if range is unused (i.e. r/w) */
static int ich9_handle_pr(int i)
1475
{
1476 1477
	static const char *const access_names[3] = {
		"locked", "read-only", "write-only"
1478 1479 1480
	};
	uint8_t off = ICH9_REG_PR0 + (i * 4);
	uint32_t pr = mmio_readl(ich_spibar + off);
1481
	unsigned int rwperms = ICH_PR_PERMS(pr);
1482

1483 1484 1485 1486 1487 1488
	if (rwperms == 0x3) {
		msg_pdbg2("0x%02X: 0x%08x (PR%u is unused)\n", off, pr, i);
		return 0;
	}

	msg_pdbg("0x%02X: 0x%08x ", off, pr);
Stefan Tauner's avatar
Stefan Tauner committed
1489
	msg_pwarn("PR%u: Warning: 0x%08x-0x%08x is %s.\n", i, ICH_FREG_BASE(pr),
1490 1491
		  ICH_FREG_LIMIT(pr) | 0x0fff, access_names[rwperms]);
	return 1;
1492 1493
}

1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516
/* Set/Clear the read and write protection enable bits of PR register @i
 * according to @read_prot and @write_prot. */
static void ich9_set_pr(int i, int read_prot, int write_prot)
{
	void *addr = ich_spibar + ICH9_REG_PR0 + (i * 4);
	uint32_t old = mmio_readl(addr);
	uint32_t new;

	msg_gspew("PR%u is 0x%08x", i, old);
	new = old & ~((1 << PR_RP_OFF) | (1 << PR_WP_OFF));
	if (read_prot)
		new |= (1 << PR_RP_OFF);
	if (write_prot)
		new |= (1 << PR_WP_OFF);
	if (old == new) {
		msg_gspew(" already.\n");
		return;
	}
	msg_gspew(", trying to set it to 0x%08x ", new);
	rmmio_writel(new, addr);
	msg_gspew("resulted in 0x%08x.\n", mmio_readl(addr));
}

1517 1518 1519 1520 1521 1522 1523 1524
static const struct spi_programmer spi_programmer_ich7 = {
	.type = SPI_CONTROLLER_ICH7,
	.max_data_read = 64,
	.max_data_write = 64,
	.command = ich_spi_send_command,
	.multicommand = ich_spi_send_multicommand,
	.read = default_spi_read,
	.write_256 = default_spi_write_256,
1525
	.write_aai = default_spi_write_aai,
1526 1527 1528 1529 1530 1531 1532 1533 1534 1535
};

static const struct spi_programmer spi_programmer_ich9 = {
	.type = SPI_CONTROLLER_ICH9,
	.max_data_read = 64,
	.max_data_write = 64,
	.command = ich_spi_send_command,
	.multicommand = ich_spi_send_multicommand,
	.read = default_spi_read,
	.write_256 = default_spi_write_256,
1536
	.write_aai = default_spi_write_aai,
1537 1538
};

1539 1540 1541 1542 1543 1544 1545 1546 1547
static const struct opaque_programmer opaque_programmer_ich_hwseq = {
	.max_data_read = 64,
	.max_data_write = 64,
	.probe = ich_hwseq_probe,
	.read = ich_hwseq_read,
	.write = ich_hwseq_write,
	.erase = ich_hwseq_block_erase,
};

1548
int ich_init_spi(struct pci_dev *dev, uint32_t base, void *rcrb,
1549
		 enum ich_chipset ich_gen)
1550 1551 1552 1553 1554
{
	int i;
	uint8_t old, new;
	uint16_t spibar_offset, tmp2;
	uint32_t tmp;
1555
	char *arg;
1556 1557
	int ich_spi_force = 0;
	int ich_spi_rw_restricted = 0;
1558
	int desc_valid = 0;
1559 1560 1561 1562 1563 1564
	struct ich_descriptors desc = {{ 0 }};
	enum ich_spi_mode {
		ich_auto,
		ich_hwseq,
		ich_swseq
	} ich_spi_mode = ich_auto;
1565

1566 1567
	ich_generation = ich_gen;

1568
	switch (ich_generation) {
1569
	case CHIPSET_ICH_UNKNOWN:
1570
		return ERROR_FATAL;
1571 1572
	case CHIPSET_ICH7:
	case CHIPSET_ICH8:
1573 1574
		spibar_offset = 0x3020;
		break;
1575
	case CHIPSET_ICH9:
1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586
	default:		/* Future version might behave the same */
		spibar_offset = 0x3800;
		break;
	}

	/* SPIBAR is at RCRB+0x3020 for ICH[78] and RCRB+0x3800 for ICH9. */
	msg_pdbg("SPIBAR = 0x%x + 0x%04x\n", base, spibar_offset);

	/* Assign Virtual Address */
	ich_spibar = rcrb + spibar_offset;

1587
	switch (ich_generation) {
1588
	case CHIPSET_ICH7:
1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613
		msg_pdbg("0x00: 0x%04x     (SPIS)\n",
			     mmio_readw(ich_spibar + 0));
		msg_pdbg("0x02: 0x%04x     (SPIC)\n",
			     mmio_readw(ich_spibar + 2));
		msg_pdbg("0x04: 0x%08x (SPIA)\n",
			     mmio_readl(ich_spibar + 4));
		for (i = 0; i < 8; i++) {
			int offs;
			offs = 8 + (i * 8);
			msg_pdbg("0x%02x: 0x%08x (SPID%d)\n", offs,
				     mmio_readl(ich_spibar + offs), i);
			msg_pdbg("0x%02x: 0x%08x (SPID%d+4)\n", offs + 4,
				     mmio_readl(ich_spibar + offs + 4), i);
		}
		ichspi_bbar = mmio_readl(ich_spibar + 0x50);
		msg_pdbg("0x50: 0x%08x (BBAR)\n",
			     ichspi_bbar);
		msg_pdbg("0x54: 0x%04x     (PREOP)\n",
			     mmio_readw(ich_spibar + 0x54));
		msg_pdbg("0x56: 0x%04x     (OPTYPE)\n",
			     mmio_readw(ich_spibar + 0x56));
		msg_pdbg("0x58: 0x%08x (OPMENU)\n",
			     mmio_readl(ich_spibar + 0x58));
		msg_pdbg("0x5c: 0x%08x (OPMENU+4)\n",
			     mmio_readl(ich_spibar + 0x5c));
1614
		for (i = 0; i < 3; i++) {
1615 1616 1617 1618 1619 1620
			int offs;
			offs = 0x60 + (i * 4);
			msg_pdbg("0x%02x: 0x%08x (PBR%d)\n", offs,
				     mmio_readl(ich_spibar + offs), i);
		}
		if (mmio_readw(ich_spibar) & (1 << 15)) {
Stefan Tauner's avatar
Stefan Tauner committed
1621
			msg_pwarn("WARNING: SPI Configuration Lockdown activated.\n");
1622 1623
			ichspi_lock = 1;
		}
1624
		ich_init_opcodes();
1625
		ich_set_bbar(0);
1626
		register_spi_programmer(&spi_programmer_ich7);
1627
		break;
1628
	case CHIPSET_ICH8:
1629
	default:		/* Future version might behave the same */
1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651
		arg = extract_programmer_param("ich_spi_mode");
		if (arg && !strcmp(arg, "hwseq")) {
			ich_spi_mode = ich_hwseq;
			msg_pspew("user selected hwseq\n");
		} else if (arg && !strcmp(arg, "swseq")) {
			ich_spi_mode = ich_swseq;
			msg_pspew("user selected swseq\n");
		} else if (arg && !strcmp(arg, "auto")) {
			msg_pspew("user selected auto\n");
			ich_spi_mode = ich_auto;
		} else if (arg && !strlen(arg)) {
			msg_perr("Missing argument for ich_spi_mode.\n");
			free(arg);
			return ERROR_FATAL;
		} else if (arg) {
			msg_perr("Unknown argument for ich_spi_mode: %s\n",
				 arg);
			free(arg);
			return ERROR_FATAL;
		}
		free(arg);

1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667
		arg = extract_programmer_param("ich_spi_force");
		if (arg && !strcmp(arg, "yes")) {
			ich_spi_force = 1;
			msg_pspew("ich_spi_force enabled.\n");
		} else if (arg && !strlen(arg)) {
			msg_perr("Missing argument for ich_spi_force.\n");
			free(arg);
			return ERROR_FATAL;
		} else if (arg) {
			msg_perr("Unknown argument for ich_spi_force: \"%s\" "
				 "(not \"yes\").\n", arg);
			free(arg);
			return ERROR_FATAL;
		}
		free(arg);

1668
		tmp2 = mmio_readw(ich_spibar + ICH9_REG_HSFS);
1669
		msg_pdbg("0x04: 0x%04x (HSFS)\n", tmp2);
1670
		prettyprint_ich9_reg_hsfs(tmp2);
1671
		if (tmp2 & HSFS_FLOCKDN) {
Stefan Tauner's avatar
Stefan Tauner committed
1672
			msg_pwarn("Warning: SPI Configuration Lockdown activated.\n");
1673 1674
			ichspi_lock = 1;
		}
1675
		if (tmp2 & HSFS_FDV)
1676 1677
			desc_valid = 1;
		if (!(tmp2 & HSFS_FDOPSS) && desc_valid)
1678 1679 1680
			msg_pinfo("The Flash Descriptor Override Strap-Pin is set. Restrictions implied by\n"
				  "the Master Section of the flash descriptor are NOT in effect. Please note\n"
				  "that Protected Range (PR) restrictions still apply.\n");
1681
		ich_init_opcodes();
1682

1683 1684 1685 1686 1687
		if (desc_valid) {
			tmp2 = mmio_readw(ich_spibar + ICH9_REG_HSFC);
			msg_pdbg("0x06: 0x%04x (HSFC)\n", tmp2);
			prettyprint_ich9_reg_hsfc(tmp2);
		}
1688

1689
		tmp = mmio_readl(ich_spibar + ICH9_REG_FADDR);
1690
		msg_pdbg2("0x08: 0x%08x (FADDR)\n", tmp);
1691

1692 1693 1694 1695 1696 1697 1698 1699
		if (desc_valid) {
			tmp = mmio_readl(ich_spibar + ICH9_REG_FRAP);
			msg_pdbg("0x50: 0x%08x (FRAP)\n", tmp);
			msg_pdbg("BMWAG 0x%02x, ", ICH_BMWAG(tmp));
			msg_pdbg("BMRAG 0x%02x, ", ICH_BMRAG(tmp));
			msg_pdbg("BRWA 0x%02x, ", ICH_BRWA(tmp));
			msg_pdbg("BRRA 0x%02x\n", ICH_BRRA(tmp));

1700
			/* Handle FREGx and FRAP registers */
1701
			for (i = 0; i < 5; i++)
1702
				ich_spi_rw_restricted |= ich9_handle_frap(tmp, i);
1703 1704 1705 1706
			if (ich_spi_rw_restricted)
				msg_pwarn("Not all flash regions are freely accessible by flashrom. This is "
					  "most likely\ndue to an active ME. Please see http://flashrom.org/ME "
					  "for details.\n");
1707
		}
1708

1709
		/* Handle PR registers */
1710 1711 1712
		for (i = 0; i < 5; i++) {
			/* if not locked down try to disable PR locks first */
			if (!ichspi_lock)
1713
				ich9_set_pr(i, 0, 0);
1714 1715 1716 1717 1718 1719
			ich_spi_rw_restricted |= ich9_handle_pr(i);
		}

		if (ich_spi_rw_restricted) {
			if (!ich_spi_force)
				programmer_may_write = 0;
1720 1721 1722 1723 1724
			msg_pinfo("Writes have been disabled for safety reasons. You can enforce write\n"
				  "support with the ich_spi_force programmer option, but you will most likely\n"
				  "harm your hardware! If you force flashrom you will get no support if\n"
				  "something breaks. On a few mainboards it is possible to enable write\n"
				  "access by setting a jumper (see its documentation or the board itself).\n");
1725
			if (ich_spi_force)
1726
				msg_pinfo("Continuing with write support because the user forced us to!\n");
1727
		}
1728

1729
		tmp = mmio_readl(ich_spibar + ICH9_REG_SSFS);
1730
		msg_pdbg("0x90: 0x%02x (SSFS)\n", tmp & 0xff);
1731
		prettyprint_ich9_reg_ssfs(tmp);
1732
		if (tmp & SSFS_FCERR) {
1733
			msg_pdbg("Clearing SSFS.FCERR\n");
1734
			mmio_writeb(SSFS_FCERR, ich_spibar + ICH9_REG_SSFS);
1735
		}
1736 1737
		msg_pdbg("0x91: 0x%06x (SSFC)\n", tmp >> 8);
		prettyprint_ich9_reg_ssfc(tmp);
1738

1739
		msg_pdbg("0x94: 0x%04x     (PREOP)\n",
1740
			     mmio_readw(ich_spibar + ICH9_REG_PREOP));
1741
		msg_pdbg("0x96: 0x%04x     (OPTYPE)\n",
1742
			     mmio_readw(ich_spibar + ICH9_REG_OPTYPE));
1743
		msg_pdbg("0x98: 0x%08x (OPMENU)\n",
1744
			     mmio_readl(ich_spibar + ICH9_REG_OPMENU));
1745
		msg_pdbg("0x9C: 0x%08x (OPMENU+4)\n",
1746
			     mmio_readl(ich_spibar + ICH9_REG_OPMENU + 4));
1747
		if (ich_generation == CHIPSET_ICH8 && desc_valid) {
1748 1749 1750 1751 1752 1753 1754 1755 1756
			tmp = mmio_readl(ich_spibar + ICH8_REG_VSCC);
			msg_pdbg("0xC1: 0x%08x (VSCC)\n", tmp);
			msg_pdbg("VSCC: ");
			prettyprint_ich_reg_vscc(tmp, MSG_DEBUG);
		} else {
			ichspi_bbar = mmio_readl(ich_spibar + ICH9_REG_BBAR);
			msg_pdbg("0xA0: 0x%08x (BBAR)\n",
				     ichspi_bbar);

1757 1758 1759 1760 1761
			if (desc_valid) {
				tmp = mmio_readl(ich_spibar + ICH9_REG_LVSCC);
				msg_pdbg("0xC4: 0x%08x (LVSCC)\n", tmp);
				msg_pdbg("LVSCC: ");
				prettyprint_ich_reg_vscc(tmp, MSG_DEBUG);
1762

1763 1764 1765 1766
				tmp = mmio_readl(ich_spibar + ICH9_REG_UVSCC);
				msg_pdbg("0xC8: 0x%08x (UVSCC)\n", tmp);
				msg_pdbg("UVSCC: ");
				prettyprint_ich_reg_vscc(tmp, MSG_DEBUG);
1767

1768 1769 1770
				tmp = mmio_readl(ich_spibar + ICH9_REG_FPB);
				msg_pdbg("0xD0: 0x%08x (FPB)\n", tmp);
			}
1771
			ich_set_bbar(0);
1772
		}
1773

1774
		msg_pdbg("\n");
1775
		if (desc_valid) {
1776 1777 1778 1779
			if (read_ich_descriptors_via_fdo(ich_spibar, &desc) ==
			    ICH_RET_OK)
				prettyprint_ich_descriptors(CHIPSET_ICH_UNKNOWN,
							    &desc);
1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809
			/* If the descriptor is valid and indicates multiple
			 * flash devices we need to use hwseq to be able to
			 * access the second flash device.
			 */
			if (ich_spi_mode == ich_auto && desc.content.NC != 0) {
				msg_pinfo("Enabling hardware sequencing due to "
					  "multiple flash chips detected.\n");
				ich_spi_mode = ich_hwseq;
			}
		}

		if (ich_spi_mode == ich_auto && ichspi_lock &&
		    ich_missing_opcodes()) {
			msg_pinfo("Enabling hardware sequencing because "
				  "some important opcode is locked.\n");
			ich_spi_mode = ich_hwseq;
		}

		if (ich_spi_mode == ich_hwseq) {
			if (!desc_valid) {
				msg_perr("Hardware sequencing was requested "
					 "but the flash descriptor is not "
					 "valid. Aborting.\n");
				return ERROR_FATAL;
			}
			hwseq_data.size_comp0 = getFCBA_component_density(&desc, 0);
			hwseq_data.size_comp1 = getFCBA_component_density(&desc, 1);
			register_opaque_programmer(&opaque_programmer_ich_hwseq);
		} else {
			register_spi_programmer(&spi_programmer_ich9);
1810
		}
1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831
		break;
	}

	old = pci_read_byte(dev, 0xdc);
	msg_pdbg("SPI Read Configuration: ");
	new = (old >> 2) & 0x3;
	switch (new) {
	case 0:
	case 1:
	case 2:
		msg_pdbg("prefetching %sabled, caching %sabled, ",
			     (new & 0x2) ? "en" : "dis",
			     (new & 0x1) ? "dis" : "en");
		break;
	default:
		msg_pdbg("invalid prefetching/caching settings, ");
		break;
	}
	return 0;
}

1832 1833 1834 1835 1836 1837 1838 1839
static const struct spi_programmer spi_programmer_via = {
	.type = SPI_CONTROLLER_VIA,
	.max_data_read = 16,
	.max_data_write = 16,
	.command = ich_spi_send_command,
	.multicommand = ich_spi_send_multicommand,
	.read = default_spi_read,
	.write_256 = default_spi_write_256,
1840
	.write_aai = default_spi_write_aai,
1841 1842
};

Helge Wagner's avatar
Helge Wagner committed
1843
int via_init_spi(struct pci_dev *dev, uint32_t mmio_base)
1844
{
1845
	int i;
1846

Helge Wagner's avatar
Helge Wagner committed
1847 1848
	ich_spibar = physmap("VIA SPI MMIO registers", mmio_base, 0x70);
	/* Do we really need no write enable? Like the LPC one at D17F0 0x40 */
1849 1850

	/* Not sure if it speaks all these bus protocols. */
1851
	internal_buses_supported = BUS_LPC | BUS_FWH;
1852
	ich_generation = CHIPSET_ICH7;
1853
	register_spi_programmer(&spi_programmer_via);
1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880

	msg_pdbg("0x00: 0x%04x     (SPIS)\n", mmio_readw(ich_spibar + 0));
	msg_pdbg("0x02: 0x%04x     (SPIC)\n", mmio_readw(ich_spibar + 2));
	msg_pdbg("0x04: 0x%08x (SPIA)\n", mmio_readl(ich_spibar + 4));
	for (i = 0; i < 2; i++) {
		int offs;
		offs = 8 + (i * 8);
		msg_pdbg("0x%02x: 0x%08x (SPID%d)\n", offs,
			 mmio_readl(ich_spibar + offs), i);
		msg_pdbg("0x%02x: 0x%08x (SPID%d+4)\n", offs + 4,
			 mmio_readl(ich_spibar + offs + 4), i);
	}
	ichspi_bbar = mmio_readl(ich_spibar + 0x50);
	msg_pdbg("0x50: 0x%08x (BBAR)\n", ichspi_bbar);
	msg_pdbg("0x54: 0x%04x     (PREOP)\n", mmio_readw(ich_spibar + 0x54));
	msg_pdbg("0x56: 0x%04x     (OPTYPE)\n", mmio_readw(ich_spibar + 0x56));
	msg_pdbg("0x58: 0x%08x (OPMENU)\n", mmio_readl(ich_spibar + 0x58));
	msg_pdbg("0x5c: 0x%08x (OPMENU+4)\n", mmio_readl(ich_spibar + 0x5c));
	for (i = 0; i < 3; i++) {
		int offs;
		offs = 0x60 + (i * 4);
		msg_pdbg("0x%02x: 0x%08x (PBR%d)\n", offs,
			 mmio_readl(ich_spibar + offs), i);
	}
	msg_pdbg("0x6c: 0x%04x     (CLOCK/DEBUG)\n",
		 mmio_readw(ich_spibar + 0x6c));
	if (mmio_readw(ich_spibar) & (1 << 15)) {
Stefan Tauner's avatar
Stefan Tauner committed
1881
		msg_pwarn("Warning: SPI Configuration Lockdown activated.\n");
1882 1883 1884
		ichspi_lock = 1;
	}

1885
	ich_set_bbar(0);
1886 1887 1888 1889 1890
	ich_init_opcodes();

	return 0;
}

1891
#endif