Patchwork Initial ITE IT8500 EC support (second try)

login
register
about
Submitter David Hendricks
Date 2011-01-31 23:54:08
Message ID <AANLkTinfRz7uTAQX-RFk=Lkr=73ac5fJF4zD_eAP3ZXT@mail.gmail.com>
Download mbox | patch
Permalink /patch/2587/
State Accepted
Commit r1263
Headers show

Comments

David Hendricks - 2011-01-31 23:54:08
argh! of course I forgot to actually attach the patch. Here we go again:


On Mon, Jan 31, 2011 at 3:53 PM, David Hendricks <dhendrix@google.com>wrote:

> A few months ago, ITE open sourced the initial IT8500 EC patch on this
> mailing list (
> http://www.flashrom.org/pipermail/flashrom/2010-August/004382.html) so
> that we could check it in to the Chromium OS branch. It didn't quite make it
> upstream, and has been updated since then.
>
> The attached patch basically does the same thing and has been deployed and
> tested to work on the Cr-48. There are a few caveats, though:
> - The boot BIOS straps register must be modified to select LPC. This can be
> done with the attached "select_bbs.sh" script (Install iotools (
> http://code.google.com/p/iotools/) before using select_bbs). We worked
> around this in the Chromium OS branch by adding a bus argument to the
> programmer option, ie "flashrom -p internal:bus=lpc".
>
> - It is very important to disable power management daemons before running
> Flashrom on this EC. I commented out the brute force method we use in the
> Chromium OS branch that disables powerd, since IIRC Carl-Daniel has a better
> approach in the works.
>
> - Due to dependencies which may be introduced by the OEM/ODM EC firmware,
> the code is not guaranteed to work for anything other than the Cr-48.
>
> - Carl-Daniel pointed out that the code might ignore the result of it87
> init code. I've attempted to mitigate this in the patch (see internal.c),
> but I think it's just the symptom of a larger problem with how we detect and
> initialize IO bridges, and should probably be dealt with in a separate
> patch.
>
> *Here is the text from the original patch submission:
> The attached patch adds generalized support for IT8500/IT8502 embedded
> controllers.
> The patch was developed by Google for Flashrom r1082, but applies cleanly
> against r1130.
> It was tested for IT8500E on a Chrome OS platform and may require
> modification
> depending on ODM/OEM customization and EC firmware version.
>
> This patch is not officially supported by ITE Tech Inc.*
>
> Signed-off-by: David Hendricks <dhendrix@google.com>
> (The original patch also included a sign-off from Yung-chieh Lo @ Google
> and Donald Huang @ ITE).
>
> --
> David Hendricks (dhendrix)
> Systems Software Engineer, Google Inc.
>


Signed-off-by: David Hendricks <dhendrix@google.com>
David Hendricks - 2011-01-31 23:55:27
...and the select_bbs.sh script.

I need more coffee.

On Mon, Jan 31, 2011 at 3:54 PM, David Hendricks <dhendrix@google.com>wrote:

> argh! of course I forgot to actually attach the patch. Here we go again:
>
>
> On Mon, Jan 31, 2011 at 3:53 PM, David Hendricks <dhendrix@google.com>wrote:
>
>> A few months ago, ITE open sourced the initial IT8500 EC patch on this
>> mailing list (
>> http://www.flashrom.org/pipermail/flashrom/2010-August/004382.html) so
>> that we could check it in to the Chromium OS branch. It didn't quite make it
>> upstream, and has been updated since then.
>>
>> The attached patch basically does the same thing and has been deployed and
>> tested to work on the Cr-48. There are a few caveats, though:
>> - The boot BIOS straps register must be modified to select LPC. This can
>> be done with the attached "select_bbs.sh" script (Install iotools (
>> http://code.google.com/p/iotools/) before using select_bbs). We worked
>> around this in the Chromium OS branch by adding a bus argument to the
>> programmer option, ie "flashrom -p internal:bus=lpc".
>>
>> - It is very important to disable power management daemons before running
>> Flashrom on this EC. I commented out the brute force method we use in the
>> Chromium OS branch that disables powerd, since IIRC Carl-Daniel has a better
>> approach in the works.
>>
>> - Due to dependencies which may be introduced by the OEM/ODM EC firmware,
>> the code is not guaranteed to work for anything other than the Cr-48.
>>
>> - Carl-Daniel pointed out that the code might ignore the result of it87
>> init code. I've attempted to mitigate this in the patch (see internal.c),
>> but I think it's just the symptom of a larger problem with how we detect and
>> initialize IO bridges, and should probably be dealt with in a separate
>> patch.
>>
>> *Here is the text from the original patch submission:
>> The attached patch adds generalized support for IT8500/IT8502 embedded
>> controllers.
>> The patch was developed by Google for Flashrom r1082, but applies cleanly
>> against r1130.
>> It was tested for IT8500E on a Chrome OS platform and may require
>> modification
>> depending on ODM/OEM customization and EC firmware version.
>>
>> This patch is not officially supported by ITE Tech Inc.*
>>
>> Signed-off-by: David Hendricks <dhendrix@google.com>
>> (The original patch also included a sign-off from Yung-chieh Lo @ Google
>> and Donald Huang @ ITE).
>>
>> --
>> David Hendricks (dhendrix)
>> Systems Software Engineer, Google Inc.
>>
>
>
> Signed-off-by: David Hendricks <dhendrix@google.com>
>
> --
> David Hendricks (dhendrix)
> Systems Software Engineer, Google Inc.
>

Signed-off-by: David Hendricks <dhendrix@google.com>
Carl-Daniel Hailfinger - 2011-03-01 00:02:16
Auf 01.02.2011 00:54, David Hendricks schrieb:
> On Mon, Jan 31, 2011 at 3:53 PM, David Hendricks <dhendrix@google.com>wrote:
>   
>> A few months ago, ITE open sourced the initial IT8500 EC patch on this
>> mailing list [...] updated since then.
>>
>> The attached patch basically does the same thing and has been deployed and
>> tested to work on the Cr-48. There are a few caveats, though:
>> - The boot BIOS straps register must be modified to select LPC. This can be
>> done with the attached "select_bbs.sh" script (Install iotools (
>> http://code.google.com/p/iotools/) before using select_bbs). We worked
>> around this in the Chromium OS branch by adding a bus argument to the
>> programmer option, ie "flashrom -p internal:bus=lpc".
>>     

That's something I don't understand. If the BBS are SPI, the flash
behind the EC should be invisible anyway. If the BBS are LPC, the flash
behind the EC should be visible and no BBS changes would be needed.
Could you clarify this?


>> - It is very important to disable power management daemons before running
>> Flashrom on this EC. I commented out the brute force method we use in the
>> Chromium OS branch that disables powerd, since IIRC Carl-Daniel has a better
>> approach in the works.
>>     

While I advocate stopping powerd and related services, I have other
reasons for doing so: powerd may mess with the timing of flashrom, and
that may cause failures on some hardware.
The comments in your code indicate that you didn't manage to isolate the
reason for the powerd related failures back then. Any progress on that
issue?


>> - Due to dependencies which may be introduced by the OEM/ODM EC firmware,
>> the code is not guaranteed to work for anything other than the Cr-48.
>>     

Noted.


>> - Carl-Daniel pointed out that the code might ignore the result of it87
>> init code. I've attempted to mitigate this in the patch (see internal.c),
>> but I think it's just the symptom of a larger problem with how we detect and
>> initialize IO bridges, and should probably be dealt with in a separate
>> patch.
>>     

AFAICS the new probing just moved the problem elsewhere without solving
it. A real fix would require our infrastructure to handle multiple Super
I/O chips. I hope to add support for that soon, as it is a hard
requirement for most laptops.


> Signed-off-by: David Hendricks <dhendrix@google.com>
>   

The code is not hooked up yet because probing needs to be sorted out.

Acked-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
and committed in r1263.

Regards,
Carl-Daniel
David Hendricks - 2011-03-07 19:42:08
On Mon, Feb 28, 2011 at 4:02 PM, Carl-Daniel Hailfinger <
c-d.hailfinger.devel.2006@gmx.net> wrote:

> Auf 01.02.2011 00:54, David Hendricks schrieb:
> > On Mon, Jan 31, 2011 at 3:53 PM, David Hendricks <dhendrix@google.com
> >wrote:
> >
> >> A few months ago, ITE open sourced the initial IT8500 EC patch on this
> >> mailing list [...] updated since then.
> >>
> >> The attached patch basically does the same thing and has been deployed
> and
> >> tested to work on the Cr-48. There are a few caveats, though:
> >> - The boot BIOS straps register must be modified to select LPC. This can
> be
> >> done with the attached "select_bbs.sh" script (Install iotools (
> >> http://code.google.com/p/iotools/) before using select_bbs). We worked
> >> around this in the Chromium OS branch by adding a bus argument to the
> >> programmer option, ie "flashrom -p internal:bus=lpc".
> >>
>
> That's something I don't understand. If the BBS are SPI, the flash
> behind the EC should be invisible anyway. If the BBS are LPC, the flash
> behind the EC should be visible and no BBS changes would be needed.
> Could you clarify this?
>

That's correct. However, the correct BBS value might not be set by default.

For example, on the Cr-48 we have two SPI flash parts; the BIOS ROM which is
connected directly to the southbridge's SPI controller and the EC firmware
ROM connected to the EC (which is connected to the southbridge via LPC).
When the machine comes up, the BBS setting is set for SPI. To flash the EC
firmware, you need to set it to LPC.

On Mon, Feb 28, 2011 at 4:02 PM, Carl-Daniel Hailfinger <
c-d.hailfinger.devel.2006@gmx.net> wrote:

> >> - It is very important to disable power management daemons before
> running
> >> Flashrom on this EC. I commented out the brute force method we use in
> the
> >> Chromium OS branch that disables powerd, since IIRC Carl-Daniel has a
> better
> >> approach in the works.
> >>
>
> While I advocate stopping powerd and related services, I have other
> reasons for doing so: powerd may mess with the timing of flashrom, and
> that may cause failures on some hardware.
> The comments in your code indicate that you didn't manage to isolate the
> reason for the powerd related failures back then. Any progress on that
> issue?
>

Yes -- On the Cr-48 the ambient light sensor is attached to I2C via the EC.
Polling the light sensor interrupts the EC and can cause very bad things to
happen during firmware updates.

Also, the EC has a debugging mechanism which logs port80h traffic if
enabled. This is helpful, but unfortunate if your kernel uses port80h as an
IO delay mechanism (CONFIG_IO_DELAY_TYPE_0X80). I recommend that anyone
using a laptop select one of the alternative IO delay mechanisms (port 0xED
or udelay) to avoid issues.
Carl-Daniel Hailfinger - 2011-03-08 00:52:29
Auf 07.03.2011 20:42, David Hendricks schrieb:
> On Mon, Feb 28, 2011 at 4:02 PM, Carl-Daniel Hailfinger wrote:
>
>   
>> That's something I don't understand. If the BBS are SPI, the flash
>> behind the EC should be invisible anyway. If the BBS are LPC, the flash
>> behind the EC should be visible and no BBS changes would be needed.
>> Could you clarify this?
>>     
> That's correct. However, the correct BBS value might not be set by default.
>
> For example, on the Cr-48 we have two SPI flash parts; the BIOS ROM which is
> connected directly to the southbridge's SPI controller and the EC firmware
> ROM connected to the EC (which is connected to the southbridge via LPC).
> When the machine comes up, the BBS setting is set for SPI. To flash the EC
> firmware, you need to set it to LPC.
>   

AFAICS the only reason why you need to set BBS to LPC for EC flashing is
to make sure the MEM interface to the EC works because that interface
lives in the 4G-something region. However, given that you use the I/O
interface by default for EC communication, isn't that requirement
obsolete unless someone explicitly changes the source to switch to MEM
based EC communication?


> On Mon, Feb 28, 2011 at 4:02 PM, Carl-Daniel Hailfinger wrote:
>
>   
>>>> - It is very important to disable power management daemons before
>>>> running Flashrom on this EC. I commented out the brute force
>>>> method we use in the Chromium OS branch that disables powerd,
>>>> since IIRC Carl-Daniel has a better approach in the works.
>>>>         
>> While I advocate stopping powerd and related services, I have other
>> reasons for doing so: powerd may mess with the timing of flashrom, and
>> that may cause failures on some hardware.
>> The comments in your code indicate that you didn't manage to isolate the
>> reason for the powerd related failures back then. Any progress on that
>> issue?
>>     
> Yes -- On the Cr-48 the ambient light sensor is attached to I2C via the EC.
> Polling the light sensor interrupts the EC and can cause very bad things to
> happen during firmware updates.
>   

Ouch!
If powerd is stopped, can the user still suspend/shutdown the system? If
yes, that may be another problem source.


> Also, the EC has a debugging mechanism which logs port80h traffic if
> enabled. This is helpful, but unfortunate if your kernel uses port80h as an
> IO delay mechanism (CONFIG_IO_DELAY_TYPE_0X80). I recommend that anyone
> using a laptop select one of the alternative IO delay mechanisms (port 0xED
> or udelay) to avoid issues.
>   

We should add most of the contents of your mail to the wiki on this
page: http://www.flashrom.org/Laptops
Would that be OK for you? The issues you describe are not limited to the
Cr-48 and I'd rather have some info directly visible in the wiki before
someone complains.

Regards,
Carl-Daniel

Patch

Index: Makefile
===================================================================
--- Makefile	(revision 1257)
+++ Makefile	(working copy)
@@ -181,7 +181,7 @@ 
 FEATURE_CFLAGS += -D'CONFIG_INTERNAL=1'
 PROGRAMMER_OBJS += processor_enable.o chipset_enable.o board_enable.o cbtable.o dmi.o internal.o
 # FIXME: The PROGRAMMER_OBJS below should only be included on x86.
-PROGRAMMER_OBJS += it87spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o
+PROGRAMMER_OBJS += it87spi.o it85spi.o ichspi.o sb600spi.o wbsio_spi.o mcp6x_spi.o
 NEED_PCI := yes
 endif
 
Index: internal.c
===================================================================
--- internal.c	(revision 1257)
+++ internal.c	(working copy)
@@ -104,6 +104,7 @@ 
 void probe_superio(void)
 {
 	superio = probe_superio_ite();
+	superio = probe_superio_ite85xx();
 #if 0
 	/* Winbond Super I/O code is not yet available. */
 	if (superio.vendor == SUPERIO_VENDOR_NONE)
@@ -114,6 +115,18 @@ 
 
 int is_laptop = 0;
 
+static void probe_lpc_bridges(void)
+{
+	/* Probe unconditionally for IT87* LPC->SPI translation and for
+	 * IT87* Parallel write enable.
+	 */
+	if (!init_superio_ite())
+		return;
+
+	if (!it85xx_probe_spi_flash(NULL))
+		return;
+}
+
 int internal_init(void)
 {
 #if __FLASHROM_LITTLE_ENDIAN__
@@ -230,10 +243,7 @@ 
 	}
 
 #if defined(__i386__) || defined(__x86_64__)
-	/* Probe unconditionally for IT87* LPC->SPI translation and for
-	 * IT87* Parallel write enable.
-	 */
-	init_superio_ite();
+	probe_lpc_bridges();
 #endif
 
 	board_flash_enable(lb_vendor, lb_part);
@@ -268,6 +278,10 @@ 
 {
 	release_io_perms();
 
+#if defined(__i386__) || defined(__x86_64__)
+	it85xx_shutdown();
+#endif
+
 	return 0;
 }
 #endif
Index: it85spi.c
===================================================================
--- it85spi.c	(revision 0)
+++ it85spi.c	(revision 0)
@@ -0,0 +1,407 @@ 
+/*
+ * This file is part of the flashrom project.
+ *
+ * Copyright (C) 2007, 2008, 2009 Carl-Daniel Hailfinger
+ * Copyright (C) 2008 Ronald Hoogenboom <ronald@zonnet.nl>
+ * Copyright (C) 2008 coresystems GmbH
+ * Copyright (C) 2010 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ */
+
+/*
+ * Contains the ITE IT85* SPI specific routines
+ */
+
+#if defined(__i386__) || defined(__x86_64__)
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "flash.h"
+#include "chipdrivers.h"
+#include "spi.h"
+#include "programmer.h"
+
+#define MAX_TIMEOUT 100000
+#define MAX_TRY 5
+
+/* Constans for I/O ports */
+#define ITE_SUPERIO_PORT1	0x2e
+#define ITE_SUPERIO_PORT2	0x4e
+
+/* Legacy I/O */
+#define LEGACY_KBC_PORT_DATA	0x60
+#define LEGACY_KBC_PORT_CMD	0x64
+
+/* Constants for Logical Device registers */
+#define LDNSEL			0x07
+#define CHIP_ID_BYTE1_REG	0x20
+#define CHIP_ID_BYTE2_REG	0x21
+#define CHIP_CHIP_VER_REG	0x22
+
+/* These are standard Super I/O 16-bit base address registers */
+#define SHM_IO_BAD0		0x60  /* big-endian, this is high bits */
+#define SHM_IO_BAD1		0x61
+
+/* 8042 keyboard controller uses an input buffer and an output buffer to
+ * communicate with host CPU. Both buffers are 1-byte depth. That means the
+ * IBF is set to 1 when host CPU sends a command to input buffer (standing on
+ * the EC side). IBF is cleared to 0 once the command is read by EC. */
+#define KB_IBF 			(1 << 1)  /* Input Buffer Full */
+#define KB_OBF 			(1 << 0)  /* Output Buffer Full */
+
+/* IT8502 supports two access modes:
+ *   LPC_MEMORY: through the memory window in 0xFFFFFxxx (follow mode)
+ *   LPC_IO: through I/O port (so called indirect memory)
+ */
+#undef LPC_MEMORY
+#define LPC_IO
+
+#ifdef LPC_IO
+/* macro to fill in indirect-access registers. */
+#define INDIRECT_A0(base, value) OUTB(value, (base) + 0)  /* little-endian */
+#define INDIRECT_A1(base, value) OUTB(value, (base) + 1)
+#define INDIRECT_A2(base, value) OUTB(value, (base) + 2)
+#define INDIRECT_A3(base, value) OUTB(value, (base) + 3)
+#define INDIRECT_READ(base) INB((base) + 4)
+#define INDIRECT_WRITE(base, value) OUTB(value, (base) + 4)
+#endif  /* LPC_IO */
+
+#ifdef LPC_IO
+unsigned int shm_io_base;
+#endif
+unsigned char *ce_high, *ce_low;
+static int it85xx_scratch_rom_reenter = 0;
+
+uint16_t probe_id_ite85(uint16_t port)
+{
+	uint16_t id;
+
+	id = sio_read(port, CHIP_ID_BYTE1_REG) << 8 |
+	     sio_read(port, CHIP_ID_BYTE2_REG);
+
+	return id;
+}
+
+struct superio probe_superio_ite85xx(void)
+{
+	struct superio ret = {};
+	uint16_t ite_ports[] = {ITE_SUPERIO_PORT1, ITE_SUPERIO_PORT2, 0};
+	uint16_t *i = ite_ports;
+
+	ret.vendor = SUPERIO_VENDOR_ITE;
+	for (; *i; i++) {
+		ret.port = *i;
+		ret.model = probe_id_ite85(ret.port);
+		switch (ret.model >> 8) {
+		case 0x85:
+			msg_pdbg("Found EC: ITE85xx (Vendor:0x%02x,ID:0x%02x,"
+			         "Rev:0x%02x) on sio_port:0x%x.\n",
+			         ret.model >> 8, ret.model & 0xff,
+			         sio_read(ret.port, CHIP_CHIP_VER_REG),
+			         ret.port);
+			return ret;
+		}
+	}
+
+	/* No good ID found. */
+	ret.vendor = SUPERIO_VENDOR_NONE;
+	ret.port = 0;
+	ret.model = 0;
+	return ret;
+}
+
+/* This function will poll the keyboard status register until either
+ *   an expected value shows up, or
+ *   timeout reaches.
+ *
+ * Returns: 0 -- the expected value has shown.
+ *          1 -- timeout reached.
+ */
+static int wait_for(
+		const unsigned int mask,
+		const unsigned int expected_value,
+		const int timeout,  /* in usec */
+		const char* error_message,
+		const char* function_name,
+		const int lineno
+) {
+	int time_passed;
+
+	for (time_passed = 0;; ++time_passed) {
+		if ((INB(LEGACY_KBC_PORT_CMD) & mask) == expected_value)
+			return 0;
+		if (time_passed >= timeout)
+			break;
+		programmer_delay(1);
+	}
+	if (error_message)
+		msg_perr("%s():%d %s", function_name, lineno, error_message);
+	return 1;
+}
+
+/* IT8502 employs a scratch ram when flash is being updated. Call the following
+ * two functions before/after flash erase/program. */
+void it85xx_enter_scratch_rom()
+{
+	int ret;
+	int tries;
+
+	msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__);
+	if (it85xx_scratch_rom_reenter > 0) return;
+
+#if 0
+	/* FIXME: this a workaround for the bug that SMBus signal would
+	 *        interfere the EC firmware update. Should be removed if
+	 *        we find out the root cause. */
+	ret = system("stop powerd >&2");
+	if (ret) {
+		msg_perr("Cannot stop powerd.\n");
+	}
+#endif
+
+	for (tries = 0; tries < MAX_TRY; ++tries) {
+		/* Wait until IBF (input buffer) is not full. */
+		if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
+		             "* timeout at waiting for IBF==0.\n",
+		             __FUNCTION__, __LINE__))
+			continue;
+
+		/* Copy EC firmware to SRAM. */
+		OUTB(0xb4, LEGACY_KBC_PORT_CMD);
+
+		/* Confirm EC has taken away the command. */
+		if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
+		             "* timeout at taking command.\n",
+		             __FUNCTION__, __LINE__))
+			continue;
+
+		/* Waiting for OBF (output buffer) has data.
+		 * Note sometimes the replied command might be stolen by kernel
+		 * ISR so that it is okay as long as the command is 0xFA. */
+		if (wait_for(KB_OBF, KB_OBF, MAX_TIMEOUT, NULL, NULL, 0))
+			msg_pdbg("%s():%d * timeout at waiting for OBF.\n",
+			         __FUNCTION__, __LINE__);
+		if ((ret = INB(LEGACY_KBC_PORT_DATA)) == 0xFA) {
+			break;
+		} else {
+			msg_perr("%s():%d * not run on SRAM ret=%d\n",
+			         __FUNCTION__, __LINE__, ret);
+			continue;
+		}
+	}
+
+	if (tries < MAX_TRY) {
+		/* EC already runs on SRAM */
+		it85xx_scratch_rom_reenter++;
+		msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__);
+	} else {
+		msg_perr("%s():%d * Max try reached.\n",
+		         __FUNCTION__, __LINE__);
+	}
+}
+
+void it85xx_exit_scratch_rom()
+{
+	int ret;
+	int tries;
+
+	msg_pdbg("%s():%d was called ...\n", __FUNCTION__, __LINE__);
+	if (it85xx_scratch_rom_reenter <= 0) return;
+
+	for (tries = 0; tries < MAX_TRY; ++tries) {
+		/* Wait until IBF (input buffer) is not full. */
+		if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
+		             "* timeout at waiting for IBF==0.\n",
+		             __FUNCTION__, __LINE__))
+			continue;
+
+		/* Exit SRAM. Run on flash. */
+		OUTB(0xFE, LEGACY_KBC_PORT_CMD);
+
+		/* Confirm EC has taken away the command. */
+		if (wait_for(KB_IBF, 0, MAX_TIMEOUT,
+		             "* timeout at taking command.\n",
+		             __FUNCTION__, __LINE__)) {
+			/* We cannot ensure if EC has exited update mode.
+			 * If EC is in normal mode already, a further 0xFE
+			 * command will reboot system. So, exit loop here. */
+			tries = MAX_TRY;
+			break;
+		}
+
+		break;
+	}
+
+	if (tries < MAX_TRY) {
+		it85xx_scratch_rom_reenter = 0;
+		msg_pdbg("%s():%d * SUCCESS.\n", __FUNCTION__, __LINE__);
+	} else {
+		msg_perr("%s():%d * Max try reached.\n",
+		         __FUNCTION__, __LINE__);
+	}
+
+#if 0
+	/* FIXME: this a workaround for the bug that SMBus signal would
+	 *        interfere the EC firmware update. Should be removed if
+	 *        we find out the root cause. */
+	ret = system("start powerd >&2");
+	if (ret) {
+		msg_perr("Cannot start powerd again.\n");
+	}
+#endif
+}
+
+int it85xx_spi_common_init(void)
+{
+	chipaddr base;
+
+	msg_pdbg("%s():%d superio.vendor=0x%02x\n", __func__, __LINE__,
+	         superio.vendor);
+	if (superio.vendor != SUPERIO_VENDOR_ITE)
+		return 1;
+
+#ifdef LPC_IO
+	/* Get LPCPNP of SHM. That's big-endian */
+	sio_write(superio.port, LDNSEL, 0x0F); /* Set LDN to SHM (0x0F) */
+	shm_io_base = (sio_read(superio.port, SHM_IO_BAD0) << 8) +
+	              sio_read(superio.port, SHM_IO_BAD1);
+	msg_pdbg("%s():%d shm_io_base=0x%04x\n", __func__, __LINE__,
+	         shm_io_base);
+
+	/* These pointers are not used directly. They will be send to EC's
+	 * register for indirect access. */
+	base = 0xFFFFF000;
+	ce_high = ((unsigned char*)base) + 0xE00;  /* 0xFFFFFE00 */
+	ce_low = ((unsigned char*)base) + 0xD00;  /* 0xFFFFFD00 */
+
+	/* pre-set indirect-access registers since in most of cases they are
+	 * 0xFFFFxx00. */
+	INDIRECT_A0(shm_io_base, base & 0xFF);
+	INDIRECT_A2(shm_io_base, (base >> 16) & 0xFF);
+	INDIRECT_A3(shm_io_base, (base >> 24));
+#endif
+#ifdef LPC_MEMORY
+	base = (chipaddr)programmer_map_flash_region("flash base", 0xFFFFF000,
+	                                             0x1000);
+	msg_pdbg("%s():%d base=0x%08x\n", __func__, __LINE__,
+	         (unsigned int)base);
+	ce_high = (unsigned char*)(base + 0xE00);  /* 0xFFFFFE00 */
+	ce_low = (unsigned char*)(base + 0xD00);  /* 0xFFFFFD00 */
+#endif
+
+	/* Set this as spi controller. */
+	spi_controller = SPI_CONTROLLER_IT85XX;
+
+	return 0;
+}
+
+/* Called by programmer_entry .init */
+int it85xx_spi_init(void)
+{
+	int ret;
+
+	get_io_perms();
+	/* Probe for the Super I/O chip and fill global struct superio. */
+	probe_superio();
+	ret = it85xx_spi_common_init();
+	if (!ret) {
+		buses_supported = CHIP_BUSTYPE_SPI;
+	} else {
+		buses_supported = CHIP_BUSTYPE_NONE;
+	}
+	return ret;
+}
+
+/* Called by internal_init() */
+int it85xx_probe_spi_flash(const char *name)
+{
+	int ret;
+
+	if (!(buses_supported & CHIP_BUSTYPE_FWH)) {
+		msg_pdbg("%s():%d buses not support FWH\n", __func__, __LINE__);
+		return 1;
+	}
+	ret = it85xx_spi_common_init();
+	msg_pdbg("FWH: %s():%d ret=%d\n", __func__, __LINE__, ret);
+	if (!ret) {
+		msg_pdbg("%s():%d buses_supported=0x%x\n", __func__, __LINE__,
+		          buses_supported);
+		if (buses_supported & CHIP_BUSTYPE_FWH)
+			msg_pdbg("Overriding chipset SPI with IT85 FWH|SPI.\n");
+		buses_supported |= CHIP_BUSTYPE_FWH | CHIP_BUSTYPE_SPI;
+	}
+	return ret;
+}
+
+int it85xx_shutdown(void)
+{
+	msg_pdbg("%s():%d\n", __func__, __LINE__);
+	it85xx_exit_scratch_rom();
+	return 0;
+}
+
+/* According to ITE 8502 document, the procedure to follow mode is following:
+ *   1. write 0x00 to LPC/FWH address 0xffff_fexxh (drive CE# high)
+ *   2. write data to LPC/FWH address 0xffff_fdxxh (drive CE# low and MOSI
+ *      with data)
+ *   3. read date from LPC/FWH address 0xffff_fdxxh (drive CE# low and get
+ *      data from MISO)
+ */
+int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt,
+			const unsigned char *writearr, unsigned char *readarr)
+{
+	int i;
+
+	it85xx_enter_scratch_rom();
+	/* exit scratch rom ONLY when programmer shuts down. Otherwise, the
+	 * temporary flash state may halt EC. */
+
+#ifdef LPC_IO
+	INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff);
+	INDIRECT_WRITE(shm_io_base, 0xFF);  /* Write anything to this address.*/
+	INDIRECT_A1(shm_io_base, (((unsigned long int)ce_low) >> 8) & 0xff);
+#endif
+#ifdef LPC_MEMORY
+	*ce_high = 0;
+#endif
+	for (i = 0; i < writecnt; ++i) {
+#ifdef LPC_IO
+		INDIRECT_WRITE(shm_io_base, writearr[i]);
+#endif
+#ifdef LPC_MEMORY
+		*ce_low = writearr[i];
+#endif
+	}
+	for (i = 0; i < readcnt; ++i) {
+#ifdef LPC_IO
+		readarr[i] = INDIRECT_READ(shm_io_base);
+#endif
+#ifdef LPC_MEMORY
+		readarr[i] = *ce_low;
+#endif
+	}
+#ifdef LPC_IO
+	INDIRECT_A1(shm_io_base, (((unsigned long int)ce_high) >> 8) & 0xff);
+	INDIRECT_WRITE(shm_io_base, 0xFF);  /* Write anything to this address.*/
+#endif
+#ifdef LPC_MEMORY
+	*ce_high = 0;
+#endif
+
+	return 0;
+}
+
+#endif
Index: programmer.h
===================================================================
--- programmer.h	(revision 1257)
+++ programmer.h	(working copy)
@@ -511,6 +511,7 @@ 
 #if defined(__i386__) || defined(__x86_64__)
 	SPI_CONTROLLER_ICH7,
 	SPI_CONTROLLER_ICH9,
+	SPI_CONTROLLER_IT85XX,
 	SPI_CONTROLLER_IT87XX,
 	SPI_CONTROLLER_SB600,
 	SPI_CONTROLLER_VIA,
@@ -571,6 +572,14 @@ 
 int ich_spi_send_multicommand(struct spi_command *cmds);
 #endif
 
+/* it85spi.c */
+struct superio probe_superio_ite85xx(void);
+int it85xx_spi_init(void);
+int it85xx_shutdown(void);
+int it85xx_probe_spi_flash(const char *name);
+int it85xx_spi_send_command(unsigned int writecnt, unsigned int readcnt,
+			const unsigned char *writearr, unsigned char *readarr);
+
 /* it87spi.c */
 void enter_conf_mode_ite(uint16_t port);
 void exit_conf_mode_ite(uint16_t port);