2 * This file is part of the flashrom project.
4 * Copyright (C) 2007, 2008 Carl-Daniel Hailfinger
5 * Copyright (C) 2008 Ronald Hoogenboom <ronald@zonnet.nl>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; version 2 of the License.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22 * Contains the generic SPI framework
31 #define ITE_SUPERIO_PORT1 0x2e
32 #define ITE_SUPERIO_PORT2 0x4e
34 /* Read Electronic ID */
35 #define JEDEC_RDID 0x9f
36 #define JEDEC_RDID_OUTSIZE 0x01
37 #define JEDEC_RDID_INSIZE 0x03
40 #define JEDEC_WREN 0x06
41 #define JEDEC_WREN_OUTSIZE 0x01
42 #define JEDEC_WREN_INSIZE 0x00
45 #define JEDEC_WRDI 0x04
46 #define JEDEC_WRDI_OUTSIZE 0x01
47 #define JEDEC_WRDI_INSIZE 0x00
49 /* Chip Erase 0x60 is supported by Macronix/SST chips. */
50 #define JEDEC_CE_60 0x60
51 #define JEDEC_CE_60_OUTSIZE 0x01
52 #define JEDEC_CE_60_INSIZE 0x00
54 /* Chip Erase 0xc7 is supported by ST/EON/Macronix chips. */
55 #define JEDEC_CE_C7 0xc7
56 #define JEDEC_CE_C7_OUTSIZE 0x01
57 #define JEDEC_CE_C7_INSIZE 0x00
59 /* Block Erase 0x52 is supported by SST chips. */
60 #define JEDEC_BE_52 0x52
61 #define JEDEC_BE_52_OUTSIZE 0x04
62 #define JEDEC_BE_52_INSIZE 0x00
64 /* Block Erase 0xd8 is supported by EON/Macronix chips. */
65 #define JEDEC_BE_D8 0xd8
66 #define JEDEC_BE_D8_OUTSIZE 0x04
67 #define JEDEC_BE_D8_INSIZE 0x00
69 /* Sector Erase 0x20 is supported by Macronix/SST chips. */
71 #define JEDEC_SE_OUTSIZE 0x04
72 #define JEDEC_SE_INSIZE 0x00
74 /* Read Status Register */
75 #define JEDEC_RDSR 0x05
76 #define JEDEC_RDSR_OUTSIZE 0x01
77 #define JEDEC_RDSR_INSIZE 0x01
78 #define JEDEC_RDSR_BIT_WIP (0x01 << 0)
80 /* Write Status Register */
81 #define JEDEC_WRSR 0x01
82 #define JEDEC_WRSR_OUTSIZE 0x02
83 #define JEDEC_WRSR_INSIZE 0x00
86 #define JEDEC_READ 0x03
87 #define JEDEC_READ_OUTSIZE 0x04
88 /* JEDEC_READ_INSIZE : any length */
90 /* Write memory byte */
91 #define JEDEC_BYTE_PROGRAM 0x02
92 #define JEDEC_BYTE_PROGRAM_OUTSIZE 0x05
93 #define JEDEC_BYTE_PROGRAM_INSIZE 0x00
95 uint16_t it8716f_flashport = 0;
96 /* use fast 33MHz SPI (<>0) or slow 16MHz (0) */
99 void spi_prettyprint_status_register(struct flashchip *flash);
100 void spi_disable_blockprotect(void);
102 /* Generic Super I/O helper functions */
103 uint8_t regval(uint16_t port, uint8_t reg)
106 return inb(port + 1);
109 void regwrite(uint16_t port, uint8_t reg, uint8_t val)
115 /* Helper functions for most recent ITE IT87xx Super I/O chips */
116 #define CHIP_ID_BYTE1_REG 0x20
117 #define CHIP_ID_BYTE2_REG 0x21
118 static void enter_conf_mode_ite(uint16_t port)
123 if (port == ITE_SUPERIO_PORT1)
129 static void exit_conf_mode_ite(uint16_t port)
131 regwrite(port, 0x02, 0x02);
134 static uint16_t find_ite_spi_flash_port(uint16_t port)
137 uint16_t id, flashport = 0;
139 enter_conf_mode_ite(port);
141 id = regval(port, CHIP_ID_BYTE1_REG) << 8;
142 id |= regval(port, CHIP_ID_BYTE2_REG);
144 /* TODO: Handle more IT87xx if they support flash translation */
146 /* NOLDN, reg 0x24, mask out lowest bit (suspend) */
147 tmp = regval(port, 0x24) & 0xFE;
148 printf("Serial flash segment 0x%08x-0x%08x %sabled\n",
149 0xFFFE0000, 0xFFFFFFFF, (tmp & 1 << 1) ? "en" : "dis");
150 printf("Serial flash segment 0x%08x-0x%08x %sabled\n",
151 0x000E0000, 0x000FFFFF, (tmp & 1 << 1) ? "en" : "dis");
152 printf("Serial flash segment 0x%08x-0x%08x %sabled\n",
153 0xFFEE0000, 0xFFEFFFFF, (tmp & 1 << 2) ? "en" : "dis");
154 printf("Serial flash segment 0x%08x-0x%08x %sabled\n",
155 0xFFF80000, 0xFFFEFFFF, (tmp & 1 << 3) ? "en" : "dis");
156 printf("LPC write to serial flash %sabled\n",
157 (tmp & 1 << 4) ? "en" : "dis");
158 printf("serial flash pin %i\n", (tmp & 1 << 5) ? 87 : 29);
159 /* LDN 0x7, reg 0x64/0x65 */
160 regwrite(port, 0x07, 0x7);
161 flashport = regval(port, 0x64) << 8;
162 flashport |= regval(port, 0x65);
164 exit_conf_mode_ite(port);
168 int it87xx_probe_spi_flash(const char *name)
170 it8716f_flashport = find_ite_spi_flash_port(ITE_SUPERIO_PORT1);
171 if (!it8716f_flashport)
172 it8716f_flashport = find_ite_spi_flash_port(ITE_SUPERIO_PORT2);
173 return (!it8716f_flashport);
176 /* The IT8716F only supports commands with length 1,2,4,5 bytes including
177 command byte and can not read more than 3 bytes from the device.
178 This function expects writearr[0] to be the first byte sent to the device,
179 whereas the IT8716F splits commands internally into address and non-address
180 commands with the address in inverse wire order. That's why the register
181 ordering in case 4 and 5 may seem strange. */
182 static int it8716f_spi_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr)
184 uint8_t busy, writeenc;
188 busy = inb(it8716f_flashport) & 0x80;
191 printf("%s called with unsupported readcnt %i.\n",
192 __FUNCTION__, readcnt);
197 outb(writearr[0], it8716f_flashport + 1);
201 outb(writearr[0], it8716f_flashport + 1);
202 outb(writearr[1], it8716f_flashport + 7);
206 outb(writearr[0], it8716f_flashport + 1);
207 outb(writearr[1], it8716f_flashport + 4);
208 outb(writearr[2], it8716f_flashport + 3);
209 outb(writearr[3], it8716f_flashport + 2);
213 outb(writearr[0], it8716f_flashport + 1);
214 outb(writearr[1], it8716f_flashport + 4);
215 outb(writearr[2], it8716f_flashport + 3);
216 outb(writearr[3], it8716f_flashport + 2);
217 outb(writearr[4], it8716f_flashport + 7);
221 printf("%s called with unsupported writecnt %i.\n",
222 __FUNCTION__, writecnt);
225 /* Start IO, 33 or 16 MHz, readcnt input bytes, writecnt output bytes.
227 * We can't use writecnt directly, but have to use a strange encoding.
229 outb(((0x4 + (fast_spi ? 1 : 0)) << 4) | ((readcnt & 0x3) << 2) | (writeenc), it8716f_flashport);
233 busy = inb(it8716f_flashport) & 0x80;
236 for (i = 0; i < readcnt; i++) {
237 readarr[i] = inb(it8716f_flashport + 5 + i);
244 int spi_command(unsigned int writecnt, unsigned int readcnt, const unsigned char *writearr, unsigned char *readarr)
246 if (it8716f_flashport)
247 return it8716f_spi_command(writecnt, readcnt, writearr, readarr);
248 printf_debug("%s called, but no SPI chipset detected\n", __FUNCTION__);
252 static int spi_rdid(unsigned char *readarr)
254 const unsigned char cmd[JEDEC_RDID_OUTSIZE] = {JEDEC_RDID};
256 if (spi_command(JEDEC_RDID_OUTSIZE, JEDEC_RDID_INSIZE, cmd, readarr))
258 printf_debug("RDID returned %02x %02x %02x.\n", readarr[0], readarr[1], readarr[2]);
262 void spi_write_enable()
264 const unsigned char cmd[JEDEC_WREN_OUTSIZE] = {JEDEC_WREN};
266 /* Send WREN (Write Enable) */
267 spi_command(JEDEC_WREN_OUTSIZE, JEDEC_WREN_INSIZE, cmd, NULL);
270 void spi_write_disable()
272 const unsigned char cmd[JEDEC_WRDI_OUTSIZE] = {JEDEC_WRDI};
274 /* Send WRDI (Write Disable) */
275 spi_command(JEDEC_WRDI_OUTSIZE, JEDEC_WRDI_INSIZE, cmd, NULL);
278 int probe_spi(struct flashchip *flash)
280 unsigned char readarr[3];
283 if (!spi_rdid(readarr)) {
284 /* Check if this is a continuation vendor ID */
285 if (readarr[0] == 0x7f) {
286 manuf_id = (readarr[0] << 8) | readarr[1];
287 model_id = readarr[2];
289 manuf_id = readarr[0];
290 model_id = (readarr[1] << 8) | readarr[2];
292 printf_debug("%s: id1 0x%x, id2 0x%x\n", __FUNCTION__, manuf_id, model_id);
293 if (manuf_id == flash->manufacture_id &&
294 model_id == flash->model_id) {
295 /* Print the status register to tell the
296 * user about possible write protection.
298 spi_prettyprint_status_register(flash);
302 /* Test if this is a pure vendor match. */
303 if (manuf_id == flash->manufacture_id &&
304 GENERIC_DEVICE_ID == flash->model_id)
311 uint8_t spi_read_status_register()
313 const unsigned char cmd[JEDEC_RDSR_OUTSIZE] = {JEDEC_RDSR};
314 unsigned char readarr[1];
316 /* Read Status Register */
317 spi_command(JEDEC_RDSR_OUTSIZE, JEDEC_RDSR_INSIZE, cmd, readarr);
321 /* Prettyprint the status register. Common definitions.
323 void spi_prettyprint_status_register_common(uint8_t status)
325 printf_debug("Chip status register: Bit 5 / Block Protect 3 (BP3) is "
326 "%sset\n", (status & (1 << 5)) ? "" : "not ");
327 printf_debug("Chip status register: Bit 4 / Block Protect 2 (BP2) is "
328 "%sset\n", (status & (1 << 4)) ? "" : "not ");
329 printf_debug("Chip status register: Bit 3 / Block Protect 1 (BP1) is "
330 "%sset\n", (status & (1 << 3)) ? "" : "not ");
331 printf_debug("Chip status register: Bit 2 / Block Protect 0 (BP0) is "
332 "%sset\n", (status & (1 << 2)) ? "" : "not ");
333 printf_debug("Chip status register: Write Enable Latch (WEL) is "
334 "%sset\n", (status & (1 << 1)) ? "" : "not ");
335 printf_debug("Chip status register: Write In Progress (WIP/BUSY) is "
336 "%sset\n", (status & (1 << 0)) ? "" : "not ");
339 /* Prettyprint the status register. Works for
343 void spi_prettyprint_status_register_st_m25p(uint8_t status)
345 printf_debug("Chip status register: Status Register Write Disable "
346 "(SRWD) is %sset\n", (status & (1 << 7)) ? "" : "not ");
347 printf_debug("Chip status register: Bit 6 is "
348 "%sset\n", (status & (1 << 6)) ? "" : "not ");
349 spi_prettyprint_status_register_common(status);
352 /* Prettyprint the status register. Works for
355 void spi_prettyprint_status_register_sst25vf016(uint8_t status)
357 const char *bpt[] = {
366 printf_debug("Chip status register: Block Protect Write Disable "
367 "(BPL) is %sset\n", (status & (1 << 7)) ? "" : "not ");
368 printf_debug("Chip status register: Auto Address Increment Programming "
369 "(AAI) is %sset\n", (status & (1 << 6)) ? "" : "not ");
370 spi_prettyprint_status_register_common(status);
371 printf_debug("Resulting block protection : %s\n",
372 bpt[(status & 0x1c) >> 2]);
375 void spi_prettyprint_status_register(struct flashchip *flash)
379 status = spi_read_status_register();
380 printf_debug("Chip status register is %02x\n", status);
381 switch (flash->manufacture_id) {
384 if ((flash->model_id & 0xff00) == 0x2000)
385 spi_prettyprint_status_register_st_m25p(status);
388 if (flash->model_id == SST_25VF016B)
389 spi_prettyprint_status_register_sst25vf016(status);
394 int spi_chip_erase_c7(struct flashchip *flash)
396 const unsigned char cmd[JEDEC_CE_C7_OUTSIZE] = {JEDEC_CE_C7};
398 spi_disable_blockprotect();
400 /* Send CE (Chip Erase) */
401 spi_command(JEDEC_CE_C7_OUTSIZE, JEDEC_CE_C7_INSIZE, cmd, NULL);
402 /* Wait until the Write-In-Progress bit is cleared.
403 * This usually takes 1-85 s, so wait in 1 s steps.
405 while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
410 /* Block size is usually
413 * 4-32k non-uniform for EON
415 int spi_block_erase_d8(const struct flashchip *flash, unsigned long addr)
417 unsigned char cmd[JEDEC_BE_D8_OUTSIZE] = {JEDEC_BE_D8};
419 cmd[1] = (addr & 0x00ff0000) >> 16;
420 cmd[2] = (addr & 0x0000ff00) >> 8;
421 cmd[3] = (addr & 0x000000ff);
423 /* Send BE (Block Erase) */
424 spi_command(JEDEC_BE_D8_OUTSIZE, JEDEC_BE_D8_INSIZE, cmd, NULL);
425 /* Wait until the Write-In-Progress bit is cleared.
426 * This usually takes 100-4000 ms, so wait in 100 ms steps.
428 while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
433 /* Sector size is usually 4k, though Macronix eliteflash has 64k */
434 int spi_sector_erase(const struct flashchip *flash, unsigned long addr)
436 unsigned char cmd[JEDEC_SE_OUTSIZE] = {JEDEC_SE};
437 cmd[1] = (addr & 0x00ff0000) >> 16;
438 cmd[2] = (addr & 0x0000ff00) >> 8;
439 cmd[3] = (addr & 0x000000ff);
442 /* Send SE (Sector Erase) */
443 spi_command(JEDEC_SE_OUTSIZE, JEDEC_SE_INSIZE, cmd, NULL);
444 /* Wait until the Write-In-Progress bit is cleared.
445 * This usually takes 15-800 ms, so wait in 10 ms steps.
447 while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
452 /* Page size is usually 256 bytes */
453 void it8716f_spi_page_program(int block, uint8_t *buf, uint8_t *bios) {
457 outb(0x06 , it8716f_flashport + 1);
458 outb(((2 + (fast_spi ? 1 : 0)) << 4), it8716f_flashport);
459 for (i = 0; i < 256; i++) {
460 bios[256 * block + i] = buf[256 * block + i];
462 outb(0, it8716f_flashport);
463 /* Wait until the Write-In-Progress bit is cleared.
464 * This usually takes 1-10 ms, so wait in 1 ms steps.
466 while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
470 void spi_page_program(int block, uint8_t *buf, uint8_t *bios)
472 if (it8716f_flashport)
473 it8716f_spi_page_program(block, buf, bios);
477 * This is according the SST25VF016 datasheet, who knows it is more
478 * generic that this...
480 void spi_write_status_register(int status)
482 const unsigned char cmd[JEDEC_WRSR_OUTSIZE] = {JEDEC_WRSR, (unsigned char)status};
484 /* Send WRSR (Write Status Register) */
485 spi_command(JEDEC_WRSR_OUTSIZE, JEDEC_WRSR_INSIZE, cmd, NULL);
488 void spi_byte_program(int address, uint8_t byte)
490 const unsigned char cmd[JEDEC_BYTE_PROGRAM_OUTSIZE] = {JEDEC_BYTE_PROGRAM,
497 /* Send Byte-Program */
498 spi_command(JEDEC_BYTE_PROGRAM_OUTSIZE, JEDEC_BYTE_PROGRAM_INSIZE, cmd, NULL);
501 void spi_disable_blockprotect(void)
505 status = spi_read_status_register();
506 /* If there is block protection in effect, unprotect it first. */
507 if ((status & 0x3c) != 0) {
508 printf_debug("Some block protection in effect, disabling\n");
510 spi_write_status_register(status & ~0x3c);
515 * IT8716F only allows maximum of 512 kb SPI mapped to LPC memory cycles
516 * Program chip using firmware cycle byte programming. (SLOW!)
518 int it8716f_over512k_spi_chip_write(struct flashchip *flash, uint8_t *buf)
520 int total_size = 1024 * flash->total_size;
524 spi_disable_blockprotect();
525 for (i = 0; i < total_size; i++) {
527 spi_byte_program(i, buf[i]);
528 while (spi_read_status_register() & JEDEC_RDSR_BIT_WIP)
531 /* resume normal ops... */
532 outb(0x20, it8716f_flashport);
536 void spi_3byte_read(int address, uint8_t *bytes, int len)
538 const unsigned char cmd[JEDEC_READ_OUTSIZE] = {JEDEC_READ,
539 (address >> 16) & 0xff,
540 (address >> 8) & 0xff,
541 (address >> 0) & 0xff,
545 spi_command(JEDEC_READ_OUTSIZE, len, cmd, bytes);
549 * IT8716F only allows maximum of 512 kb SPI mapped to LPC memory cycles
550 * Need to read this big flash using firmware cycles 3 byte at a time.
552 int spi_chip_read(struct flashchip *flash, uint8_t *buf)
554 int total_size = 1024 * flash->total_size;
558 if (total_size > 512 * 1024) {
559 for (i = 0; i < total_size; i += 3) {
561 if (total_size - i < toread)
562 toread = total_size - i;
563 spi_3byte_read(i, buf + i, toread);
566 memcpy(buf, (const char *)flash->virtual_memory, total_size);
571 int spi_chip_write(struct flashchip *flash, uint8_t *buf) {
572 int total_size = 1024 * flash->total_size;
574 if (total_size > 512 * 1024) {
575 it8716f_over512k_spi_chip_write(flash, buf);
577 for (i = 0; i < total_size / 256; i++) {
578 spi_page_program(i, buf, (uint8_t *)flash->virtual_memory);