1
0
mirror of https://review.coreboot.org/flashrom.git synced 2025-04-27 15:12:36 +02:00

Add support for the ENE Embedded Debug Interface EDI and KB9012 EC

The ENE Embedded Debug Interface (EDI) is a SPI-based interface for
accessing the memory of ENE embedded controllers.

The ENE KB9012 EC is an embedded controller found on various laptops
such as the Lenovo G505s. It features a 8051 microcontroller and
has 128 KiB of internal storage for program data.

EDI can be accessed on the KB9012 through pins 59-62 (CS-CLK-MOSI-MISO)
when flash direct access is not in use. Some firmwares disable EDI at runtime
so it might be necessary to ground pin 42 to reset the 8051 microcontroller
before accessing the KB9012 via EDI.

The example of flashing KB9012 at Lenovo G505S laptop could be found here:
http://dangerousprototypes.com/docs/Flashing_KB9012_with_Bus_Pirate

Change-Id: Ib8b2eb2feeef5c337d725d15ebf994a299897854
Signed-off-by: Mike Banon <mikebdp2@gmail.com>
Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
Reviewed-on: https://review.coreboot.org/23259
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Nico Huber <nico.h@gmx.de>
This commit is contained in:
Paul Kocialkowski 2018-01-15 01:07:46 +03:00 committed by Nico Huber
parent 995f755ff5
commit 80ae14e510
7 changed files with 611 additions and 2 deletions

View File

@ -518,7 +518,7 @@ endif
CHIP_OBJS = jedec.o stm50.o w39.o w29ee011.o \
sst28sf040.o 82802ab.o \
sst49lfxxxc.o sst_fwhub.o flashchips.o spi.o spi25.o spi25_statusreg.o \
sst49lfxxxc.o sst_fwhub.o edi.o flashchips.o spi.o spi25.o spi25_statusreg.o \
opaque.o sfdp.o en29lv640b.o at45db.o
###############################################################################

View File

@ -199,4 +199,10 @@ int erase_sector_stm50(struct flashctx *flash, unsigned int block, unsigned int
int probe_en29lv640b(struct flashctx *flash);
int write_en29lv640b(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len);
/* edi.c */
int edi_chip_block_erase(struct flashctx *flash, unsigned int page, unsigned int size);
int edi_chip_write(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len);
int edi_chip_read(struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len);
int edi_probe_kb9012(struct flashctx *flash);
#endif /* !__CHIPDRIVERS_H__ */

497
edi.c Normal file
View File

@ -0,0 +1,497 @@
/*
* This file is part of the flashrom project.
*
* Copyright (C) 2015 Paul Kocialkowski <contact@paulk.fr>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#include <string.h>
#include "flash.h"
#include "ene.h"
#include "edi.h"
static unsigned int edi_read_buffer_length = EDI_READ_BUFFER_LENGTH_DEFAULT;
static const struct ene_chip ene_kb9012 = {
.hwversion = ENE_KB9012_HWVERSION,
.ediid = ENE_KB9012_EDIID,
};
static void edi_write_cmd(unsigned char *cmd, unsigned short address, unsigned char data)
{
cmd[0] = EDI_WRITE; /* EDI write command. */
cmd[1] = 0x00; /* Address is only 2 bytes. */
cmd[2] = (address >> 8) & 0xff; /* Address higher byte. */
cmd[3] = (address >> 0) & 0xff; /* Address lower byte. */
cmd[4] = data; /* Write data. */
}
static void edi_read_cmd(unsigned char *cmd, unsigned short address)
{
cmd[0] = EDI_READ; /* EDI read command. */
cmd[1] = 0x00; /* Address is only 2 bytes. */
cmd[2] = (address >> 8) & 0xff; /* Address higher byte. */
cmd[3] = (address >> 0) & 0xff; /* Address lower byte. */
}
static int edi_write(struct flashctx *flash, unsigned short address, unsigned char data)
{
unsigned char cmd[5];
int rc;
edi_write_cmd(cmd, address, data);
rc = spi_send_command(flash, sizeof(cmd), 0, cmd, NULL);
if (rc)
return -1;
return 0;
}
static int edi_read_byte(struct flashctx *flash, unsigned short address, unsigned char *data)
{
unsigned char cmd[4];
unsigned char buffer[edi_read_buffer_length];
unsigned int index;
unsigned int i;
int rc;
edi_read_cmd(cmd, address);
rc = spi_send_command(flash, sizeof(cmd), sizeof(buffer), cmd, buffer);
if (rc)
return -1;
index = 0;
for (i = 0; i < sizeof(buffer); i++) {
index = i;
if (buffer[i] == EDI_NOT_READY)
continue;
if (buffer[i] == EDI_READY) {
if (i == (sizeof(buffer) - 1)) {
/*
* Buffer size was too small for receiving the value.
* This is as good as getting only EDI_NOT_READY.
*/
buffer[i] = EDI_NOT_READY;
break;
}
*data = buffer[i + 1];
return 0;
}
}
if (buffer[index] == EDI_NOT_READY)
return -EDI_NOT_READY;
return -1;
}
static int edi_read(struct flashctx *flash, unsigned short address, unsigned char *data)
{
int rc;
do {
rc = edi_read_byte(flash, address, data);
if (rc == -EDI_NOT_READY) {
/*
* Buffer size is increased, one step at a time,
* to hold more data if we only catch EDI_NOT_READY.
* Once CS is deasserted, no more data will be sent by the EC,
* so we cannot keep reading afterwards and have to start a new
* transaction with a longer buffer, to be safe.
*/
if (edi_read_buffer_length < EDI_READ_BUFFER_LENGTH_MAX) {
msg_pwarn("%s: Retrying read with greater buffer length!\n", __func__);
edi_read_buffer_length++;
} else {
msg_perr("%s: Maximum buffer length reached and data still not ready!\n", __func__);
return -1;
}
} else if (rc < 0) {
return -1;
}
} while (rc == -EDI_NOT_READY);
return 0;
}
static int edi_disable(struct flashctx *flash)
{
unsigned char cmd = EDI_DISABLE;
int rc;
rc = spi_send_command(flash, sizeof(cmd), 0, &cmd, NULL);
if (rc)
return -1;
return 0;
}
static int edi_chip_probe(struct flashctx *flash, const struct ene_chip *chip)
{
unsigned char hwversion;
unsigned char ediid;
int rc;
rc = edi_read(flash, ENE_EC_HWVERSION, &hwversion);
if (rc < 0)
return 0;
rc = edi_read(flash, ENE_EC_EDIID, &ediid);
if (rc < 0)
return 0;
if (chip->hwversion == hwversion && chip->ediid == ediid)
return 1;
return 0;
}
static int edi_spi_enable(struct flashctx *flash)
{
unsigned char buffer;
int rc;
rc = edi_read(flash, ENE_XBI_EFCFG, &buffer);
if (rc < 0)
return -1;
buffer |= ENE_XBI_EFCFG_CMD_WE;
rc = edi_write(flash, ENE_XBI_EFCFG, buffer);
if (rc < 0)
return -1;
return 0;
}
static int edi_spi_disable(struct flashctx *flash)
{
unsigned char buffer;
int rc;
rc = edi_read(flash, ENE_XBI_EFCFG, &buffer);
if (rc < 0)
return -1;
buffer &= ~ENE_XBI_EFCFG_CMD_WE;
rc = edi_write(flash, ENE_XBI_EFCFG, buffer);
if (rc < 0)
return -1;
return 0;
}
static int edi_spi_busy(struct flashctx *flash)
{
unsigned char buffer;
int rc;
rc = edi_read(flash, ENE_XBI_EFCFG, &buffer);
if (rc < 0)
return -1;
return !!(buffer & ENE_XBI_EFCFG_BUSY);
}
static int edi_spi_address(struct flashctx *flash, unsigned int start, unsigned int address)
{
int rc;
if ((address == start) || (((address - 1) & 0xff) != (address & 0xff))) {
rc = edi_write(flash, ENE_XBI_EFA0, ((address & 0xff) >> 0));
if (rc < 0)
return -1;
}
if ((address == start) || (((address - 1) & 0xff00) != (address & 0xff00))) {
rc = edi_write(flash, ENE_XBI_EFA1, ((address & 0xff00) >> 8));
if (rc < 0)
return -1;
}
if ((address == start) || (((address - 1) & 0xff0000) != (address & 0xff0000))) {
rc = edi_write(flash, ENE_XBI_EFA2, ((address & 0xff0000) >> 16));
if (rc < 0)
return -1;
}
return 0;
}
static int edi_8051_reset(struct flashctx *flash)
{
unsigned char buffer;
int rc;
rc = edi_read(flash, ENE_EC_PXCFG, &buffer);
if (rc < 0)
return -1;
buffer |= ENE_EC_PXCFG_8051_RESET;
rc = edi_write(flash, ENE_EC_PXCFG, buffer);
if (rc < 0)
return -1;
return 0;
}
static int edi_8051_execute(struct flashctx *flash)
{
unsigned char buffer;
int rc;
rc = edi_read(flash, ENE_EC_PXCFG, &buffer);
if (rc < 0)
return -1;
buffer &= ~ENE_EC_PXCFG_8051_RESET;
rc = edi_write(flash, ENE_EC_PXCFG, buffer);
if (rc < 0)
return -1;
return 0;
}
int edi_chip_block_erase(struct flashctx *flash, unsigned int page, unsigned int size)
{
unsigned int timeout = 64;
int rc;
if (size != flash->chip->page_size) {
msg_perr("%s: Block erase size is not page size!\n", __func__);
return -1;
}
rc = edi_spi_enable(flash);
if (rc < 0) {
msg_perr("%s: Unable to enable SPI!\n", __func__);
return -1;
}
rc = edi_spi_address(flash, page, page);
if (rc < 0)
return -1;
rc = edi_write(flash, ENE_XBI_EFCMD, ENE_XBI_EFCMD_ERASE);
if (rc < 0)
return -1;
while (edi_spi_busy(flash) == 1 && timeout) {
programmer_delay(10);
timeout--;
}
if (!timeout) {
msg_perr("%s: Timed out waiting for SPI not busy!\n", __func__);
return -1;
}
rc = edi_spi_disable(flash);
if (rc < 0) {
msg_perr("%s: Unable to disable SPI!\n", __func__);
return -1;
}
return 0;
}
int edi_chip_write(struct flashctx *flash, const uint8_t *buf, unsigned int start, unsigned int len)
{
unsigned int address = start;
unsigned int pages;
unsigned int timeout;
unsigned int i, j;
int rc;
if ((start % flash->chip->page_size) != 0) {
msg_perr("%s: Start address is not page-aligned!\n", __func__);
return -1;
}
if ((len % flash->chip->page_size) != 0) {
msg_perr("%s: Length is not page-aligned!\n", __func__);
return -1;
}
pages = len / flash->chip->page_size;
rc = edi_spi_enable(flash);
if (rc < 0) {
msg_perr("%s: Unable to enable SPI!\n", __func__);
return -1;
}
for (i = 0; i < pages; i++) {
timeout = 64;
/* Clear page buffer. */
rc = edi_write(flash, ENE_XBI_EFCMD, ENE_XBI_EFCMD_HVPL_CLEAR);
if (rc < 0)
return -1;
for (j = 0; j < flash->chip->page_size; j++) {
rc = edi_spi_address(flash, start, address);
if (rc < 0)
return -1;
rc = edi_write(flash, ENE_XBI_EFDAT, *buf);
if (rc < 0)
return -1;
rc = edi_write(flash, ENE_XBI_EFCMD, ENE_XBI_EFCMD_HVPL_LATCH);
if (rc < 0)
return -1;
buf++;
address++;
}
/* Program page buffer to flash. */
rc = edi_write(flash, ENE_XBI_EFCMD, ENE_XBI_EFCMD_PROGRAM);
if (rc < 0)
return -1;
while (edi_spi_busy(flash) == 1 && timeout) {
programmer_delay(10);
timeout--;
}
if (!timeout) {
msg_perr("%s: Timed out waiting for SPI not busy!\n", __func__);
return -1;
}
}
rc = edi_spi_disable(flash);
if (rc < 0) {
msg_perr("%s: Unable to disable SPI!\n", __func__);
return -1;
}
return 0;
}
int edi_chip_read(struct flashctx *flash, uint8_t *buf, unsigned int start, unsigned int len)
{
unsigned int address = start;
unsigned int i;
unsigned int timeout;
int rc;
rc = edi_spi_enable(flash);
if (rc < 0) {
msg_perr("%s: Unable to enable SPI!\n", __func__);
return -1;
}
/*
* EDI brings such a drastic overhead that there is about no need to
* have any delay in between calls. The EDI protocol will handle wait
* I/O times on its own anyway.
*/
for (i = 0; i < len; i++) {
timeout = 64;
rc = edi_spi_address(flash, start, address);
if (rc < 0)
return -1;
rc = edi_write(flash, ENE_XBI_EFCMD, ENE_XBI_EFCMD_READ);
if (rc < 0)
return -1;
do {
rc = edi_read(flash, ENE_XBI_EFDAT, buf);
if (rc == 0)
break;
/* Just in case. */
while (edi_spi_busy(flash) == 1 && timeout) {
programmer_delay(10);
timeout--;
}
if (!timeout) {
msg_perr("%s: Timed out waiting for SPI not busy!\n", __func__);
return -1;
}
} while (1);
buf++;
address++;
}
rc = edi_spi_disable(flash);
if (rc < 0) {
msg_perr("%s: Unable to disable SPI!\n", __func__);
return -1;
}
return 0;
}
int edi_shutdown(void *data)
{
struct flashctx *flash;
int rc;
if (data == NULL)
return -1;
flash = (struct flashctx *)data;
rc = edi_8051_execute(flash);
if (rc < 0) {
msg_perr("%s: Unable to execute 8051!\n", __func__);
return -1;
}
rc = edi_disable(flash);
if (rc < 0) {
msg_perr("%s: Unable to disable EDI!\n", __func__);
return -1;
}
return 0;
}
int edi_probe_kb9012(struct flashctx *flash)
{
int probe;
int rc;
probe = edi_chip_probe(flash, &ene_kb9012);
if (!probe)
return 0;
rc = edi_8051_reset(flash);
if (rc < 0) {
msg_perr("%s: Unable to reset 8051!\n", __func__);
return 0;
}
register_shutdown(edi_shutdown, (void *)flash);
return 1;
}

30
edi.h Normal file
View File

@ -0,0 +1,30 @@
/*
* This file is part of the flashrom project.
*
* Copyright (C) 2015 Paul Kocialkowski <contact@paulk.fr>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#ifndef __EDI_H__
#define __EDI_H__ 1
#define EDI_READ 0x30
#define EDI_WRITE 0x40
#define EDI_DISABLE 0xf3
#define EDI_NOT_READY 0x5f
#define EDI_READY 0x50
#define EDI_READ_BUFFER_LENGTH_DEFAULT 3
#define EDI_READ_BUFFER_LENGTH_MAX 32
#endif

51
ene.h Normal file
View File

@ -0,0 +1,51 @@
/*
* This file is part of the flashrom project.
*
* Copyright (C) 2015 Paul Kocialkowski <contact@paulk.fr>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*/
#ifndef __ENE_H__
#define __ENE_H__ 1
#define ENE_XBI_EFA0 0xfea8
#define ENE_XBI_EFA1 0xfea9
#define ENE_XBI_EFA2 0xfeaa
#define ENE_XBI_EFDAT 0xfeab
#define ENE_XBI_EFCMD 0xfeac
#define ENE_XBI_EFCFG 0xfead
#define ENE_XBI_EFCFG_CMD_WE (1 << 3)
#define ENE_XBI_EFCFG_BUSY (1 << 1)
#define ENE_XBI_EFCMD_HVPL_LATCH 0x02
#define ENE_XBI_EFCMD_READ 0x03
#define ENE_XBI_EFCMD_ERASE 0x20
#define ENE_XBI_EFCMD_PROGRAM 0x70
#define ENE_XBI_EFCMD_HVPL_CLEAR 0x80
#define ENE_EC_PXCFG 0xff14
#define ENE_EC_PXCFG_8051_RESET 0x01
#define ENE_EC_HWVERSION 0xff00
#define ENE_EC_EDIID 0xff24
#define ENE_KB9012_HWVERSION 0xc3
#define ENE_KB9012_EDIID 0x04
struct ene_chip {
unsigned char hwversion;
unsigned char ediid;
};
#endif

View File

@ -199,6 +199,7 @@ struct flashchip {
/* SPI25 is very common. Keep it at zero so we don't have
to specify it for each and every chip in the database.*/
SPI25 = 0,
SPI_EDI = 1,
} spi_cmd_set;
int (*probe) (struct flashctx *flash);
@ -266,7 +267,7 @@ struct flashrom_flashctx {
/* Timing used in probe routines. ZERO is -2 to differentiate between an unset
* field and zero delay.
*
*
* SPI devices will always have zero delay and ignore this field.
*/
#define TIMING_FIXME -1

View File

@ -3281,6 +3281,30 @@ const struct flashchip flashchips[] = {
.voltage = {4500, 5500},
},
{
.vendor = "ENE",
.name = "KB9012 (EDI)",
.bustype = BUS_SPI,
.spi_cmd_set = SPI_EDI,
.total_size = 128,
.page_size = 128,
.feature_bits = FEATURE_ERASED_ZERO,
.tested = TEST_OK_PREW,
.probe = edi_probe_kb9012,
.probe_timing = TIMING_ZERO,
.block_erasers =
{
{
.eraseblocks = { {128, 1024} },
.block_erase = edi_chip_block_erase,
},
},
.gran = write_gran_128bytes,
.write = edi_chip_write,
.read = edi_chip_read,
.voltage = {2700, 3600},
},
{
.vendor = "ESMT",
.name = "F49B002UA",