Software User Guide Revision 1read.pudn.com/downloads365/ebook/1585622/WPCE775x_UG_1.0.pdf · 2.1.2...

WPCE775xSoftware User Guide

Revision 1.0

November 2007

Winbond Confidential

ii

REVISION RECORD

REVISION RELEASE DATE SUMMARY OF CHANGES

1.0 November 2007 First release


iii

PREFACE

This document provides guidelines for designing firmware and software for the WinbondWPCE775x family of products.

The information contained in this document is subject to change without notice. No part of thisdocument may be reproduced in any form or by any means without the prior written consent of

Winbond Corporation.1

1. All brand or product names are trademarks of their respective holders.


iv

CONTENTS

Chapter 1 INTRODUCTION

1.1 SOFTWARE GUIDE OVERVIEW....................................................................................... 1

1.2 LIST OF TERMS................................................................................................................. 1

1.3 REFERENCES ................................................................................................................... 1

Chapter 2 SYSTEM BIOS PORTING GUIDE

2.1 I/O MAPPING AND ACCESS ............................................................................................. 2

2.1.1 The Index/Data Register Pair .................................................................................. 2

2.1.2 Banked Logical Device Register Structure .............................................................. 2

2.1.3 Standard Configuration Registers ........................................................................... 4

2.2 DIFFERENCES WITH PREVIOUS DEVICES.................................................................... 4

2.2.1 Feature List Comparison ......................................................................................... 4

2.3 PIN MULTIPLEXING........................................................................................................... 5

2.4 MODULE CONFIGURATION ............................................................................................. 5

2.4.1 Common Constants ................................................................................................ 6

2.4.2 Logical Device Number (LDN) Macros .................................................................... 6

2.4.3 Mobile System Wake-Up Control (MSWC) ............................................................. 8

2.4.4 Keyboard and Mouse .............................................................................................. 9

2.4.5 Power Management Channels ................................................................................ 9

2.4.6 Shared Memory ....................................................................................................... 9

2.4.7 Serial Port with Fast Infrared (FIR) ....................................................................... 11

2.4.8 Consumer IR (CIR) Port ........................................................................................ 12

2.5 ACPI SUPPORT FOR CIR DRIVERS .............................................................................. 13

2.5.1 Available Drivers and PnP ID ................................................................................ 13

2.5.2 ASL Code Example for CIR Port Driver (Receive Only or including Transmit and Learn) .................................................................................................................... 14

2.5.3 ASL Code Example for CIR HID Driver (Receive Only Mode) .............................. 14

2.5.4 Supporting Vista and XP with the Same BIOS/ACPI Code ................................... 14

2.5.5 Required Hardware Configuration ......................................................................... 15

2.6 CIR FIRMWARE SUPPORT............................................................................................. 15

2.7 UPDATING THE SYSTEM BIOS AND EC FIRMWARE................................................... 16

Chapter 3 DEVELOPMENT ENVIRONMENT

3.1 DEVELOPMENT ENVIRONMENT SETUP ...................................................................... 17

3.1.1 Software ................................................................................................................ 17


v

3.1.2 Hardware ............................................................................................................... 17

3.2 ENVIRONMENT SETUP USING winIDEA ....................................................................... 18

3.2.1 Creating a New Work Environment (Workspace) ................................................. 18

3.2.2 Configuring winIDEA to Work with the SPI Flash .................................................. 19

3.2.3 Downloading the WPCE775x Firmware ................................................................ 21

3.2.4 Downloading the FW+System BIOS to the SPI Flash .......................................... 23

3.3 START-UP CODE............................................................................................................. 26

3.3.1 The Booter Program .............................................................................................. 26

3.3.2 Creating the Booter Header .................................................................................. 27

3.3.3 The First Firmware Code Lines ............................................................................. 29

3.3.4 Initialization of Host-Controlled Modules from the Firmware ................................. 30

3.5 DEBUGGING HINTS ........................................................................................................ 30

Chapter 4 EC FIRMWARE PORTING GUIDE

4.1 HIGH LEVEL CHANGES BETWEEN WPC876XL AND WPCE775X............................... 31

4.2 PORTING CHECKLIST .................................................................................................... 32

Chapter 5 FLASH UPDATE

5.1 OVERVIEW....................................................................................................................... 34

5.2 HIGH-LEVEL DATA FLOW............................................................................................... 34

5.3 HOST TO CORE COMMUNICATION .............................................................................. 35

5.4 METHOD OF OPERATION .............................................................................................. 35

5.5 RAM USAGE .................................................................................................................... 38

5.6 WRITE COMMAND BUFFER PROTOCOL (WCB) .......................................................... 38

5.6.1 Write Command Buffer .......................................................................................... 38

5.6.2 Shared Access Window 2, Semaphore Byte (Offset 00h) .................................... 38

5.6.3 WCB Transaction Steps ........................................................................................ 39

5.6.4 Using the WCB Protocol from the Host ................................................................. 39

5.7 WCB COMMANDS ........................................................................................................... 40

5.7.1 Init Flash ................................................................................................................ 41

5.7.2 Enter Flash Update ............................................................................................... 42

5.7.3 Exit Flash Update .................................................................................................. 42

5.7.4 Reset EC ............................................................................................................... 42

5.7.5 Go To Book Block ................................................................................................. 43

5.7.6 Read ID ................................................................................................................. 43

5.7.7 Sector/Block Erase ................................................................................................ 43

5.7.8 Set Address ........................................................................................................... 44

5.7.9 Program ................................................................................................................ 44

5.7.10 Set Write Window .................................................................................................. 44


vi

5.8 FLASH UPDATE API ........................................................................................................ 45

5.8.1 Types .................................................................................................................... 45

5.8.2 Functions ............................................................................................................... 45

5.9 CUSTOMIZING FLASH UPDATE PROTOCOL ............................................................... 46

Appendix A ADDITIONAL INFORMATION

A.1 RUNNING CODE FROM INTERNAL RAM ....................................................................... 47

A.2 WORKING WITH ATI CHIPSETS...................................................................................... 50

A.2.1 Issue Description ................................................................................................... 50

A.2.2 Solution ................................................................................................................. 50

A.3 COMPACTRISC TOOLS VERSION 4.1 CRDB DEBUGGER ........................................... 51

A.3.1 Preparation ............................................................................................................ 51

A.3.2 Starting the CRDB ................................................................................................. 52

A.3.3 Running the Code ................................................................................................. 54

A.3.4 Breakpoints ........................................................................................................... 54

A.3.5 Viewing and Changing Memory ............................................................................ 55

A.4 PORTING CODE FROM THE CR16B TO THE CR16CPLUS .......................................... 56

A.4.1 Introduction ........................................................................................................... 56

A.4.2 Comparing the CR16B and CR16CPlus ............................................................... 56

A.4.3 Porting C Code ...................................................................................................... 59

A.4.4 Porting Assembly Language Code ........................................................................ 60

A.5 PORTING FROM COMPACTRISC TOOLSET VERSION 3.X TO 4.X.............................. 64

A.5.1 Porting Linker Script File ....................................................................................... 64


WPCE775x Software User Guide Revision 1.0 1 INTRODUCTION

Chapter 1INTRODUCTION

The WPCE775x Software User Guide is intended for system BIOS and EmbeddedController firmware developers. It describes the development environment andprovides porting guidelines for both the system BIOS and Embedded Controllerfirmware.

1.1 SOFTWARE GUIDE OVERVIEW

Chapter 2 - SYSTEM BIOS PORTING GUIDE. Intended for the BIOS developer.Describes the WPCE775x family from the BIOS developer’s point of view andprovides BIOS porting guidelines.

Chapter 3 - DEVELOPMENT ENVIRONMENT. Intended for the EmbeddedController firmware developer. Describes the CR16CPlus developmentenvironment and helps the developer to quickly begin code development.

Chapter 4 - EC FIRMWARE PORTING GUIDE. Explains the changes in theembedded controller modules between the WPCE775x and WPC876xL (theprevious Winbond Embedded Controller).

Appendix - ADDITIONAL INFORMATION.

1.2 LIST OF TERMS

• WPCE775x - Family of products: currently refers to the WPCE775L,WPCE775C and WPCE775F

• EC - Embedded Controller

• Core - The EC core (National Semiconductor CompactRISC© CR16CPlus)

• Firmware - Code that runs on the WPCE775x internal core

• Host - The PC that the WPCE775x is connected to

1.3 REFERENCES

• WPCE775x Embedded Controller with SPI™ Flash Interface Datasheet

• The CompactRISC© Toolset for 16-Bit Cores Ver. 4.1 Documentation

• CompactRISC© CR16B Programmer’s Reference Manual

• CompactRISC© CR16C Programmer’s Reference Manual


SYSTEM BIOS PORTING GUIDE 2 WPCE775x Software User Guide Revision 1.0

Chapter 2SYSTEM BIOS PORTING GUIDE

This section describes the WPCE775x family from the BIOS developer’s point ofview and provides BIOS porting guidelines.

2.1 I/O MAPPING AND ACCESS

The WPCE775x configuration of the host-controlled functions is based on a set ofbanked registers (Same as in WPC876xL).

2.1.1 The Index/Data Register Pair

Access to the WPCE775x configuration registers is via an Index-Data registerpair, using only two system I/O byte locations. The base address of this registerpair (i.e., the address of the Index register) is determined during power-upaccording to the state of the hardware strapping option on the BADDR pins. Thebase address is either 164Eh or 2Eh, according to the strapping, as follows:

• No pull-down resistor: 164Eh-164Fh

• 10 KΩ external pull-down resistor on BADDR0: 2Eh-2Fh

• 10 KΩ external pull-down resistor on BADDR1: Core defined (the EC firmwarecan configure the BADDR to any I/O address, using HCBAH and HCBAL reg-isters)

2.1.2 Banked Logical Device Register Structure

Each functional block, e.g., CIR Port (see Table 2-1), is associated with a LogicalDevice Number (LDN). Each LDN is associated with a bank of registers thatincludes the following registers (see Figure 2-1):

• Logical Device Control register (Index 30h)

• Standard Logical Device Configuration registers (Indexes 60h-75h)

• Special (Vendor-defined) Logical Device Configuration registers (Indexes F0h-FFh)

A bank is selected by the Logical Device Number register using the Index/Dataregisters (see Section 2.1.1). For example, writing 07h to the Index register andthen writing 03h to the Data register selects the CIR bank (see Table 2-1).

After a bank is selected, it is possible to access that bank’s registers. Thus, afterselecting the CIR bank (03h), writing 30h to the Index register (Logical DeviceControl register) and then writing 01h to the Data register enables the Serial Portmodule. Writing any value in the range 30h-FFh to the Index register results inselecting a register within the CIR LDN bank. Switching to another bank (LDN) isdone by writing 07h to the Index register and then writing the value of thedesired bank (LDN) to the Data register.

Note that the Logical Device Number register (Index 07h) and Configurationregisters (Index 10h-2Fh) are not banked but are accessed directly through the


WPCE775x Software User Guide Revision 1.0 3 SYSTEM BIOS PORTING GUIDE

Index/Data registers. For example, writing 20h to the Index register and thenreading from the Data register returns the SuperI/O ID value.

Figure 2-1 illustrates both banked and non-banked registers.

For some LDNs (i.e., banks), not all registers are implemented. Write accesses tonon-implemented registers (i.e., accessing the Data register while the Indexregister points to a non-existent register) are ignored. Read accesses return 00hfor all non-implemented addresses except 74h and 75h (the DMA configurationregisters), which return 04h, which indicates that there is no DMA channelsupport.

The device configuration registers can be accessed immediately after reset.However, physical access may be delayed until the core finishes its boot(HOSTWAIT bit in SMC_CTL Register is cleared).

Table 2-1. LDN Values of Functional Blocks

LDN Functional Block

03h CIR Port

04h Mobile System Wake-Up Control (MSWC)

05h Keyboard and Mouse Controller (KBC) - Mouse Interface

06h Keyboard and Mouse Controller (KBC) - Keyboard Interface

0Fh Shared Memory (SHM)

11h Power Management I/F Channel 1 (PM1)


15h Enhanced Wake On CIR (EWOC)


1Ah Serial Port with Fast Infrared Port (FIR)

07h

10h

30h

60h

75h

FFh

Logical Device Number Register

SuperI/O Configuration Registers

Logical Device Control Register

Standard Logical Device

Special (Vendor-defined)

Configuration Registers

Banks

2Fh

F0hBank

63h

74h

70h71h Configuration Registers

(One per Logical Device)

Logical DeviceSelect

Figure 2-1. Standard Configuration Register File Structure

50h



2.1.3 Standard Configuration Registers

2.2 DIFFERENCES WITH PREVIOUS DEVICES

System BIOS developers should be aware of the following differences between theWPCE775x and previous devices, since these differences may affect system BIOSprogramming.

2.2.1 Feature List Comparison

The WPCE775x feature list differs from that of its predecessor chips. Thesedifferences may affect the system BIOS. Non-existing modules/features inWPCE775x must be removed from the system BIOS; other features such asshared memory might require modification of the system BIOS code.

SuperI/OConfiguration Registers

Logical Device Control and

one per Logical Device Configuration Registers -

Index Register Name

07h Logical Device Number

20h SuperI/O ID

21h SuperI/O Configuration 1



27h SuperI/O Revision ID



2Dh SuperI/O Configuration D

2Eh-2Fh Reserved exclusively for Winbond use

30h Logical Device Control (Activate)

50h Memory Base Descriptor

60h I/O Base Address Descriptor 0 Bits 15-8




70h Interrupt Number and Wake-Up on IRQ Enable

71h IRQ Type Select

74h DMA Channel Select 0

75h DMA Channel Select 1

F0h-F9h Device Specific Logical Device Configuration 1 to 10

(some are optional)

Figure 2-2. Configuration Register Map



Table 2-2 compares the feature list of the WPCE775x with those of itspredecessors. It includes only modules that may affect the system BIOS. For acomparison of the embedded controller features see Table 4-6 on page 31.

2.3 PIN MULTIPLEXING

Pin multiplexing is configured by the core, using the Device Alternate Functionregisters DEVALT0 to DEVALTA.

Note that the pins of IR, CIR, Serial Port and other modules, are not selected bydefault. The core firmware must enable them by setting the relevant bits in therelevant DEVALT0-A registers.

2.4 MODULE CONFIGURATION

This section focuses on programming the WPCE775x host-controlled modulesand provides code examples. It does not show how to configure the chipset,which must be performed before WPCE775x configuration. For example, beforethe WPCE775x can be accessed, the LPC address decoding must be configuredthrough the South Bridge LPC Configuration registers; otherwise, I/Otransactions cannot reach the WPCE775x.

The code examples in this section show how the host can configure theWPCE775x. Note that it is also possible to configure WPCE775x host-controlledmodules from the EC core.

Important Note: Any configuration through I/O Index/Data registers must notbe interruptible. If an interrupt occurs during configuration, its code could

Table 2-2. Host Feature Comparison

Feature WPCE775L/C/F WPC8763LWPC8765LWPC8769L

87541V

SID FCh FCh FCh EChMobile System Wake-Up Control (MSWC)

Keyboard and Mouse Controller (KBC)

Host General Purpose I/O Ports (HGPIO)

Shared Memory (SHM)

Power Management Channel 1-2 (PM1-2)

Power Management Channel 3 (PM3)

Serial Port With Fast Infrared (FIR)

Only in C/FF = Serial Port +

FIRC = Serial Port

onlyConsumer Infrared Port (CIR)

Only in C/F

Enhanced Wake On CIR (EWOC)

Valid Battery and Oscillator (VBO)



change the Index register, which may cause data to be delivered from or to thewrong device or register.

All registers with reserved bits should be written using the Read-Modify-Writesequence. Modifying a reserved bit may cause unpredictable results andtherefore should be avoided.

2.4.1 Common Constants

The following general constants are used in the code examples in this section:

; General constantsIDX EQU 164Eh ; I/O Index register (BADDR)DATA EQU 164Fh ; I/O Data register (BADDR)LDN EQU 07h ; Logical Device Number registerIRQ EQU 70h ; IRQ number registerADDR0_HIGH EQU 60h ; I/O base address high byte Descriptor 0 reg.ADDR0_LOW EQU 61h ; I/O base address low byte Descriptor 0 reg.ADDR1_HIGH EQU 62h ; I/O base address high byte Descriptor 1 reg.ADDR1_LOW EQU 63h ; I/O base address low byte Descriptor 1 reg.LDN_ACT EQU 30h ; LDN Activate register

2.4.2 Logical Device Number (LDN) Macros

The following macros configure a given LDN number. They are used to select,enable/disable, and set the I/O base address and IRQ of a logical device. Thesemacros are used in the following code example sections.

CONFIG_WRITE MACRO Reg Valmov dx, IDX ; Device selectmov al, Regout dx, almov dx, DATA ; Select desired LDN devicemov al, Valout dx, al

ENDM

; *Select a logical device number*LDN_SELECT MACRO LDN_Num

mov dx, IDX ; Device selectmov al, LDNout dx, almov dx, DATA ; Select desired LDN devicemov al, LDN_Numout dx, al

ENDM

; *Enable currently selected logical device*LDN_ENABLE MACRO

mov dx, IDXmov al, LDN_ACT ; Activate Logical Deviceout dx, almov dx, DATAmov al, 01hout dx, al

ENDM



; *Disable currently selected logical device*LDN_DISABLE MACRO

mov dx, IDXmov al, LDN_ACT ; Deactivate Logical Deviceout dx, almov dx, DATAmov al, 00hout dx, al

ENDM; *Sets the I/O base address of the currently selected LDN*LDN_SET_BASE_ADDRESS0 MACRO Address

mov dx, IDX ; Set high byte address (bits 8-15)mov al, ADDR0_HIGHout dx, almov dx, DATAmov al, Address Shr 8out dx, al

mov dx, IDX ; Set low byte address (bits 0-7)mov al, ADDR0_LOWout dx, almov dx, DATAmov al, Address And 0FFhout dx, al

ENDM

; *Sets the I/O base address of the currently selected LDN*LDN_SET_BASE_ADDRESS1 MACRO Address

mov dx, IDX ; Set high byte address (bits 8-15)mov al, ADDR1_HIGHout dx, almov dx, DATAmov al, Address Shr 8out dx, al

mov dx, IDX ; Set low byte address (bits 0-7)mov al, ADDR1_LOWout dx, almov dx, DATAmov al, Address And 0FFhout dx, al

ENDM

; *Sets the IRQ number of the currently selected LDN*LDN_SET_IRQ MACRO IRQ_Num

mov dx, IDXmov al, IRQ ; IRQ Selectout dx, almov dx, DATAin al, dx ; Use Read-Modify-Writeand al, 0F0h ; Clear current IRQ setting (bits 0-3)or al, IRQ_NUM ; Set the desired IRQ numberout dx, al

ENDM

; *Sets value “Val” into register “Reg” of the currently selected LDN*CONFIG_WRITE MACRO Reg Val

mov dx, IDX ; Device selectmov al, Regout dx, al



mov dx, DATA ; Select desired LDN devicemov al, Valout dx, al

ENDM

Note: The host cannot write to Configuration registers unless LKCFG (LockConfiguration Registers Host Access) bit in Lock Host Access register(LKSIOHA) is cleared (default value). LKCFG can only be cleared by the core.

2.4.3 Mobile System Wake-Up Control (MSWC)

The MSWC detects and handles wake-up events from various sources in thehost-controlled modules. The MSWC interrupts the host via SMI or PWUREQ,and/or alerts the core, which enables the core to control the wake-up sequence.This section only highlights some of the MSWC features. For a full descriptionplease refer to the WPCE775x datasheet.

Wake On CIR (WOC) Message

The MSWC includes the Wake On CIR (WOC) module which is used for bothwake up and regular CIR data handling.

• Wake up from a specific CIR message (for example pressing the remote con-trol power button) is handled by the EC firmware. Winbond provides theneeded code as part of its FW package.

• On going CIR data receiving is done by the host using Winbond CIR HID driv-er for Microsoft Windows XP and Vista™ (see Table 2-4 on page 13)

General Configuration

The code below sets up the base address for the MSWC Runtime registers andassigns an IRQ. It then enables the MSWC LDN.

LDN_SELECT 04h ; Select MSWC LDNLDN_SET_BASE_ADDRESS0 7200h ; Set Base address MSWC - 7200hLDN_SET_IRQ 03h ; Assign IRQLDN_ENABLE ; Enable MSWC LDN

Change Sleep State

The host can signal the core Firmware to switch to a Sleep state S1-S5. This isdone by enabling a corresponding bit in Wake-Up ACPI State register(WK_STATE). It is up to the core Firmware to handle this event.

; Request core to change to S2 statemov dx, MSWC_BASE+07h ; Wake-Up ACPI State register (WK_STATE)in al, dxor al, 04h ; Set bit 2. Request a change to S2 Stateout dx, al



2.4.4 Keyboard and Mouse

Mouse and Keyboard LDNs are disabled by default. To enable them, set bit 0 inActivate register (Index 30h), as demonstrated in the code below. Also, by default(reset value), Keyboard Interface registers are mapped to I/O ports 60h/64h, andInterrupt is assigned to IRQ 01h. The mouse interrupt is assigned to IRQ 12.These I/O and IRQ assignments can be changed (using LDN registers, Index 60h-63h and 70h), though this is not usually necessary, since these assignmentshave become a PC standard. Changing I/O address and interrupt assignmentsshould be done before enabling the module.

LDN_SELECT 06h ; Select Keyboard LDNLDN_ENABLE ; Enable Keyboard LDN

LDN_SELECT 05h ; Select Mouse LDNLDN_ENABLE ; Enable Mouse LDN

2.4.5 Power Management Channels

There are three Power Management LDNs: 11h, 12h and 17h. These LDNs aredisabled by default and must be enabled by writing 01h to Index 30h (Activateregister). Each LDN uses two I/O addresses. The base address of these I/Oaddresses is defined using Indexes 60h-61h (Data Register Base Address) and62h-63h (Command/Status Base Address). The reset values are described inTable 2-3. The code below demonstrates how to configure a base addressesdifferent from the default.

By default (reset value), IRQ 01h is assigned for all channels.

LDN_SELECT 12h ; Select PM Channel 2 LDNLDN_SET_BASE_ADDRESS0 100h ; Set Base address for PMC2_DATALDN_SET_BASE_ADDRESS1 104h ; Set Base address for PMC1_CMDLDN_SET_IRQ 04h ; Assign IRQLDN_ENABLE ; Enable PM Channel 2 LDN

2.4.6 Shared Memory

The SHM module allows sharing of the flash memory and on-chip RAM by boththe core and the host. It supports the following features:

• BIOS and Firmware code storage and execution - Note that writing to theshared flash memory can only be done from the core; for information on up-dating the flash from the host, see Section A.3 on page 51. Reading theshared flash memory is enabled for both host and core.

• Core/host communication via shared RAM windows (mailbox)

• Core/host bulk data transfer

Table 2-3. Power Management Default I/O Base Addresses

60h-61h(Data Register Base Address)

62h-63h(Command/Status Base Address)

Channel 1 0062h 0066h

Channel 2 0068h 006Ch

Channel 3 006Ah 006Eh



The following sections show how to configure and access the shared memoryfrom the host side.

General Configuration

The following code selects the Shared Memory LDN, sets up the module I/O BaseAddress registers and enables the LDN.

LDN_SELECT 0Fh ; Select Shared Memory LDNLDN_SET_BASE_ADDRESS0 7500h ; Set Base addressLDN_ENABLE ; Enable Shared Memory LDN

Shared Flash Memory Protection

If it is required to protect the shared flash memory for reading from the host side,this can be done using Shared Memory Host Access Protect Registers 0-3(SMHAP0-3). Each SMHAPn register controls a group of 16 blocks (64K Byteeach), as follows:

• SMHAP0 controls blocks 0-15 (addresses 0-1 MB).




The following code shows how to read the current lock state and disable a blockfor reading.

SMHAP0 EQU 7500h ; offset 0

; Select memory block 1mov dx, SMHAP0 ; mov al, 18h ; select block 1 (addresses 10000h-1FFFFh); out dx, al ; Index Write

Note: When setting the desired Index (block), bit 3 (Index Write) must be set;otherwise, the protection bits (0-2) are modified during the Index selec-tion.

; Read current locking statein al, dx ; Read SMHAP0

; Protect block 1 for readingor al, 01h ; Set bit 0 - Host Read Protectionout dx, al ; Protected memory block for reading by host

Shared Access RAM Window (Mailbox Functionality)

The host can map a user-defined memory address space (a window) to access thecore memory. The size of the window can be from 1 byte to 4 KB. The SharedRAM can be accessed using both Window 1 and Window 2. The code below showshow to configure Window 2 base address to access the Shared RAM. Note thatthe registers for setting Window 2 (or 1) base address are part of the SHM moduleconfiguration registers (offset F4h to FBh). Both the size of a Shared RAM windowand its base address within the core RAM can be configured only by the core,using the RAM Window Size register (WIN_SIZE) and RAM Window 1-2 Baseregister (WIN_BASE1-2).



Note: The Shared RAM is not protected by default. Enabling the protectionbits can be done only by the core, through the RAM Windows Protectionregister (WIN_PROT).

The following code example configures Window 2 base address to FF800000:

LDN_SELECT 0Fh ; Select Shared Memory LDNCONFIG_WRITE F0h, E8h ; SHM_CFG - Config FWH memory access

; and FWH ID as Eh.CONFIG_WRITE F8h, 00h ; SHAW2BA_0 - Set Window 2 base bits 0-7CONFIG_WRITE F9h, 00h ; SHAW2BA_1 - Set Window 2 base bits 8-15CONFIG_WRITE FAh, 80h ; SHAW2BA_2 - Set Window 2 base bits 16-23CONFIG_WRITE FBh, FFh ; SHAW2BA_3 - Set Window 2 base bits 24-31

Shared Memory Semaphore Register

Shared Access Window 1-2 Semaphore registers (SHAW1-2_SEM) bits 0-3 can bewritten only by the host, bits 4-7 can be written only by the core. Both core andhost can read bits 0-7. Accessing the semaphore registers is done through Index0 of the window base address; i.e., reading from offset 0 of the base address doesnot result in reading the flash or RAM. If needed, a core interrupt can begenerated when the host writes to the Semaphore register. This is done using theShared Memory Core Control register (SMC_CTL).

2.4.7 Serial Port with Fast Infrared (FIR)

Only supported in WPC775F. From the application point of view this module canbe used for:

• Serial Port - 16550 compatible UART. Can be used with any standard/legacySerial Port driver.

• FIR - Using the standard Microsoft FIR driver.

Module Pins

IRTX/SOUT2, IRRX2_IRSL0 and IRRX1/SIN2 signals, function as GPIOs bydefault. Therefore, after chip reset, be sure to configure the multiplexing for therelevant pins. This can only be done from the embedded controller firmware.

FIR Configuration

Change the pin multiplexing (from the firmware).

• Clear DEVALT1 bits 0 - Select FIR or GPIO pins.

• Set DEVALT1 bit 5 - Select IRTX, IRRX.

• Set DEVALT1 bit 6 - Select IRRX2_IRSL0.



The following code shows how to configure the module to work with the standardFIR driver.

LDN_SELECT 1Ah ; Select Fast Infrared (FIR) LDNLDN_SET_BASE_ADDRESS0 2F8 ; Set Base address - 2F8hLDN_SET_IRQ 07h ; Set IRQCONFIG_WRITE 74h, 01h ; Enable DMA1CONFIG_WRITE F0h, 82h ; Enable Bank switchingLDN_ENABLE ; Enable module

The BIOS must also pass the appropriate PnP ID to the OS according to the IRmode. For example:

• PNP0510 or PNP511 - for a generic (SIR) IrDA-compatible device

• Unique PnP - for an FIR port

The unique PnP identifier describes the chipset and transceiver combination of aspecific device. The vendor usually supplies it after consulting with Microsoft.

Serial Port Configuration

Change the pin multiplexing (from the firmware).

• Set DEVALT1 bits 0

By default (after reset) LDN 1Ah is configured as a Serial Port (16550-Compatiblemode) with base address at 3F8h and IRQ 3 therefore the only thing which theBIOS need to do is to enable the Bank switching and enable the module.

LDN_SELECT 1Ah ; Select Fast Infrared (FIR) LDNCONFIG_WRITE F0h, 82h ; Enable Bank switchingLDN_ENABLE ; Enable module

2.4.8 Consumer IR (CIR) Port

The CIR port is used for Consumer Electronic IR (also called TV Remote orConsumer remote control). It is used by the Winbond CIR port driver for Vista toenable working with Microsoft Media Center applications.

This section shows the initialization of the CIR port.

CIR Signals

CIRTX1,CIRTX2, CIRRXM and CIRRXL, signals, function as GPIOs by default.Therefore, after chip reset, make sure to configure the multiplexing for therelevant pins. This can only be done from the embedded controller firmware.



CIR Configuration

The following code shows how to select the CIR LDN, set up a I/O Base Addressregisters for the CIR module and then enable the LDN.

LDN_SELECT 03h ; Select (CIR) LDNLDN_SET_BASE_ADDRESS0 3F8h ; Set Base addressLDN_SET_IRQ 04h ; Select IRQCONFIG_WRITE F0h, 82h ; Enable Bank switchingLDN_ENABLE ; Enable module

2.5 ACPI SUPPORT FOR CIR DRIVERS

This section defines the ACPI support required to enable working with theWinbond WPCE775x CIR drivers.

2.5.1 Available Drivers and PnP ID

The WPCE775x is backward compatible with the WPC876xL CIR Port driverhowever there is a new CIR Port driver for the WPCE775x. Using the WPCE77xCIR Port driver enables the system to work with both CIR and FIR. The followingtable defines the available drivers and their operation modes.

The CIR drivers communicate with the CIR, EWOC or MSWC modules (as definedin the above table). These modules are I/O mapped and require the following I/Oresources:

• CIR: 8 I/O bytes

• EWOC: 16 I/O bytes

• MSWC: 32 I/O bytes

The <Available IRQ list> in the ASL code examples below should specify theavailable IRQs for the platform.

The <.... base address> in the ASL code examples below should specify the I/Obase address of the respective host module (CIR, EWOC or MSWC).

Table 2-4. Drivers summary

Driver Name PnP IDUsed Host

ModuleOperation Mode

IR Protocol

Comments OS

CIR Port driver WEC1024CIR

EWOC

- Receive only

- Receive, Transmit and Learn

RC6Compatible with Microsoft Media Center requirement

Vista

CIR HID driver WEC1023 MSWC Receive onlyRC6 RC5 NEC

Enables working with Microsoft Media Center applications. Vista: using None RC6 protocol.XP: using RC6 or None RC6 protocols.

Vista

XP



2.5.2 ASL Code Example for CIR Port Driver (Receive Only or including Transmit and Learn)

Scope(\_SB.PCI0.LPC)

Device (CIR) Name (_HID, EISAID("WEC1024")) Name (_CRS, ResourceTemplate()

IO (Decode16, <CIR base address>, <CIR base address>, 0x01, 0x08)IO (Decode16, <EWOC base address>, <EWOC base address>, 0x01, 0x10)IRQ(Edge,ActiveHigh,Exclusive,IRQ0)<Available IRQ list>

)

Important:<EWOC base address> must be bigger than <CIR base address>.

2.5.3 ASL Code Example for CIR HID Driver (Receive Only Mode)

Scope(\_SB.PCI0.LPC)

Device (CIRnoneRC6) Name (_HID, EISAID("WEC1023")) Name (_CRS, ResourceTemplate()

IO (Decode16, <MSWC base address>, <MSWC base address>, 0x01, 0x20)IRQ(Edge,ActiveHigh,Exclusive,IRQ0)<Available IRQ list>

)

2.5.4 Supporting Vista and XP with the Same BIOS/ACPI Code

For a system that supports CIR on both XP and Vista, use the CIR driver (PnPWEC1024) on Vista, and use the HID driver (PnP ID WEC1023) on XP.

The ACPI code for such a system should:

1. include ACPI code for both the HID and CIR drivers (see above code example).

2. use the _STA method as follows:

– The _STA Method for the CIR port driver should return 0 when the OS isXP and 0xF when the OS is Vista.

– The _STA Method for the HID driver should return 0 when the OS is Vistaand 0xF when the OS is XP.



2.5.5 Required Hardware Configuration

Either the BIOS or the firmware should perform the following configuration:

Bank Select Enable Bit

• In CIR Port Host Module (LDN 03h) set bit 7 of the CIR Port Configurationregister (index F0h).

Module I/O Base Address

• I/O Base Address for CIR port host module (LDN 03h). Configured in Stan-dard Host Configuration Registers index 60h-61h. Base Address is limited upto 7F8h (bits 2-0 are read only, '000').

• I/O Base Address for EWOC host module (LDN 15h). Configured in StandardHost Configuration Registers index 62h-63h (bits 3-0 are read only, '0000').

• The I/O Base Address for WOC host module in LDN 15h (Configuration Reg-isters index 60h-61h) is not used by the driver, but it should still be config-ured. Leaving it at 0h might cause conflicts on the LPC bus with otherdevices which need to access addresses 0h to 10h. To prevent any conflict,configure the Base Address to an unused LPC address. This should be con-figured in Standard Host Configuration Registers index 60h-61h (bits 3-0 areread only, '0000').

• I/O Base Address for MSWC Host module (LDN 04h). Configured in StandardHost Configuration Registers index 60h-61h. (Bits 0-4 of the Base Addressare read only '00000'.)

Module IRQ

• For EWOC do not configure the IRQ.

• IRQ for MSWC (LDN 04h) must be different from that for CIR (LDN 03h).

• IRQ is configured in Standard Host Configuration Registers index 70h.

Module enable

• In all relevant modules (EWOC: LDN 15h, CIR: LDN 03h or MSWC: LDN 04h)enable the module by setting bit 0 of the Logical Device Control (Activate)Register - index 30h in the Standard Host Configuration Registers.

2.6 CIR FIRMWARE SUPPORT

To fully support Windows Vista Media Center functionality, some EC firmwarecode is needed. This code is responsible for:

• CEIR input-pin configuration.

• CEIR wake-up handling.

• Emitter Detection.

• LED Flashing.

Winbond provides all this functionality as part of the EC Firmware package.

Note: For Receive-only systems, Emitter Detection and LED Flashing are notrequired.



2.7 UPDATING THE SYSTEM BIOS AND EC FIRMWARE

The host cannot update the SPI flash directly; it needs assistance from the core.The recommended steps for updating the flash are:

1. A flash utility, running on the host, signals the WPCE775x core to get ready.This can be done by using a semaphore register (SHAW1-2_SEM), whichcauses an interrupt to the core. (A sample flash utility is provided byWinbond.)

2. The flash cannot be updated while the EC core is reading it or running fromit (otherwise, invalid data might be read from the flash). Therefore, the coremust copy the essential code from the flash to the on-chip RAM. The corethen runs from this code and signals the host that it is ready for flash updat-ing.

3. The host passes the data and address to the core, which does the actualflash programming.

4. When the flash update is complete, the host can signal the core to resume itsnormal working state or it can reset the system.


WPCE775x Software User Guide Revision 1.0 17 DEVELOPMENT ENVIRONMENT

Chapter 3DEVELOPMENT ENVIRONMENT

This section, intended for the Embedded Controller firmware developer, describesthe CR16CPlus development environment and enables the developer to set it upquickly.

3.1 DEVELOPMENT ENVIRONMENT SETUP

This section describes:

• Required software and hardware

• Environment setup using winIDEA

• Start-up code

3.1.1 Software

The following software is required to set up the development environment.Contact your local Winbond representative for this software.

• National CompactRISC© Development Tools version 4.1: A C and C++ compilertool chain developed by National Semiconductor from the GNU tools.

• iSYSTEM winIDEA project manager and debugger: Integrated DevelopmentEnvironment (IDE) for compiling, downloading and debugging application pro-grams.

• SFR (Special Function Register) package: An add-on to winIDEA thatenables you to view and access chip registers. First, install winIDEA, then ex-tract the content of the winIDEA_sfr.zip file under the C:\winIDEA\<Year>directory (e.g., C:\winIDEA\2005). This creates the SFR directory.

• SPI Flash support package: An add-on to winIDEA that enables working withSPI Flash. Extract the content of the SpiFlashSupport.zip file under theC:\winIDEA\<Year>\FLASH directory.

• Winbond KBC Firmware: Winbond Keyboard Controller firmware code,based on the Insyde KeyPROTM Keyboard Controller firmware.

3.1.2 Hardware

The required hardware environment includes the following components:

• WPCE775x development board (or customer board) with a JTAG interface.

• iONE: A USB-to-JTAG debug communication channel to connect betweenwinIDEA debugger and the WPCE775x core. (supplied by iSYSTEM)

Figure 3-3 illustrates a development environment using a Winbond Evaluation Board.


DEVELOPMENT ENVIRONMENT 18 WPCE775x Software User Guide Revision 1.0

3.2 ENVIRONMENT SETUP USING winIDEA

This section explains how to use winIDEA to set up the developmentenvironment. For more information, refer to the winIDEA documentation.

3.2.1 Creating a New Work Environment (Workspace)

1. Open winIDEA.

2. In the File menu, select: Workspace --> New Workspace...

3. Set the workspace Name and Location and click OK.

4. In the Hardware Configuration window:

a. In the Hardware Type tab, set Hardware to iONE, iTAG, VBox.

Winbond WPCE775x

iONE

USB

JTAG

LPCHeader

Development PC

Motherboard with LPC Header

Figure 3-3. Hardware Connections

Evaluation Board

winIDEA



b. In the Communication tab, select USB and specify the Device (this de-pends on the iONE connected to your system). Then click Close.

5. In the Emulation Options window CPU tab:

a. For Family, select National CR16.

b. For POD/iCARD/iTAG, select CR16C.

c. For CPU, select CR16C+.

d. For Custom CPU variant, select WPCE775L\C\F (the SFR package, asspecified in Section 3.1.1, must already be installed).

e. Click Close.

3.2.2 Configuring winIDEA to Work with the SPI Flash

The WPCE775x uses an external SPI flash device to store its firmware, as well asthe system BIOS code. Using an SPI flash device in a shared flash architecturesubstantially reduces board space because of the very small package and thesmall number of signals required to route between the EC and the flash device.winIDEA supports an SPI flash, using a custom flash device support packageprovided by Winbond.



To set up winIDEA to work with the SPI flash, extract the SpiFlashSupport.zipfile, provided by Winbond, to the FLASH directory under the winIDEA installationdirectory (C:\winIDEA\<Year>\FLASH).

1. In the menu bar, open the FLASH-->Setup... menu

2. In the Device tab:

a. Set the Manufacturer (for example select Winbond)

b. Set the Device (for example select W25X80(*).)

c. Check Ignore FLASH ID.

d. Set the Address to 20000.

3. In the Target tab, click Hardware Setup... to open the FLASH Setup window

4. In the FLASH Setup Window:

a. Select Through FLASH monitor.

b. Set the RAM Address to 10000.

c. Clear Load monitor code with RAM Address offset.

d. Click OK (to return to the Flash Programming Setup Window).

5. Click OK (in the FLASH Programming Setup window).



3.2.3 Downloading the WPCE775x Firmware

1. Select the file to be downloaded to the flash:

a. In the Debug menu, select Files For Download...

b. To browse for the appropriate file, click the small yellow button ( - seered arrow).

c. Select the file and click Open.

d. In the ELF/DWARF Options window, set “Load Code from” to ProgramHeader / Physical and click OK.

e. In the Download File Options window, click OK.



f. In the Download window, click OK.

Note: At this point, pressing the Download button ( ) loads the codeinto winIDEA but does not program the code into the flash. (Thisis good when it is needed to debug code that is already in theflash.)

g. To also program the code into flash:

i. Open the FLASH-->Setup... menu.

ii. In the Target tab, set Auto program FLASH to before download.

iii. Check Use Debug download files.

iv. Check Verify on the fly.

v. Click OK.

2. At this point, pressing the download button ( ) also programs the flash.



3.2.4 Downloading the FW+System BIOS to the SPI Flash

Preparation

1. Prepare a binary file that includes both the system BIOS and the EmbeddedController (EC) firmware.

To convert the EC firmware to binary format, run the following command:

crobjcopy -O binary <in file *.elf> <out file>

For example:

crobjcopy -O binary firmware.elf firmware.bin

crobjcopy can be found under the CR Tools 4.1 installation directory.

2. Make sure that the firmware includes the correct header (see: Section 3.3.2on page 27).

3. Combine the BIOS and the firmware.bin to make one file, which shouldlook like this:

Note: To download the BIOS binary, it is suggested to open a new winIDEAworkspace (see Section 3.2.1 on page 18).

4. Open the FLASH-->Setup... menu and select the Download Files tab.

CoreAddressSpace

8761h signature

CR Code

BIOS Code

20000h

20100h

20000h

0

+ CR Code

Flash size

size

CR Codesize

HostAddressSpace

+ Flash size

20100h (Code Stat)



5. Click the small yellow button ( ) to browse for the desired binary file.

6. Select the binary file and click Open. A message should appear, saying thatthe file format could not be identified and that winIDEA assumes the file isbinary. Click OK.

The Download File Options window is displayed.

a. In the Offset section set Code to 20000.

b. Click OK.

7. Click OK to close the FLASH Programming Setup window.



Programming the Flash

1. Select the FLASH-->Program menu.

2. In the FLASH Program window, click Start and wait for programming to end.



3.3 START-UP CODE

3.3.1 The Booter Program

The WPCE775x includes a Booter program on the chip ROM. The Booter runsautomatically immediately after the WPCE775x boots up. Its main purpose is toinitialize the chip and check the validity of the firmware. If the firmware iscorrupt (i.e., a bad signature or checksum), the Booter might stop the firmwarecode, depending on the problem; for more information, see Figure 3-4 and theWPCE775x Datasheet.).

The Booter takes the initialization parameters from the Booter header, which iscreated and defined by the programmer. The Booter header is a data structure inthe flash, from address 00h to FFh (20000h-200FFh in the CR core addressspace). For more details on creating the Booter header, see Section 3.3.2.

Figure 3-4 shows the Booter flow. Note that the flow depends on one of thefollowing boot types:

• Cold Boot - caused by VCC Power-Up, Watchdog Cold reset, Debugger Coldreset or VCC_POR Input

• Warm Boot - caused by Watchdog Warm reset or Debugger Warm reset

The Booter does only the minimum initialization necessary to start running thecode from the flash. The firmware must complete the chip initialization and thenclear the HOSTWAIT bit in SMC_CTL. This releases the LPC interface and allowsthe host to access the system BIOS.



Figure 3-4. Booter Flow

3.3.2 Creating the Booter Header

It is the programmer’s responsibility to create the Booter header with theappropriate values; for details on the header structure, see the WPCE775xDatasheet.

A sample file (header.c), provided with the Winbond software package, containsthe default values of the header data items. This file should be compiled andlinked as part of the firmware code.

Note that the Booter header must start at address 20000h. To ensure that thisoccurs, add the following lines to the linker definition file:

MEMORY ... header : ORIGIN = 0x20000, LENGTH = 0x100 /* Booter header */...

Start

Warm Boot?

Signature =

8761h?

Header checksum

OK?

If BADDR1-0 = 01configure the Host Configuration Base

Address

Initialize the High Frequency Clock

Generator

Configure Flash and core clocks

Configure Shared Memory module

Jump to firmwarestart

Firmware checksum

OK?

Yes

No

Endless loopNo

No

Yes

Yes

No

Yes

(BAD_FCKSM_IGN =1)

Yes

Ignorebad checksum

Calculate firmware checksum and set R2.R2 = 1, good checksum R2 = 0, bad checksum



SECTIONS

.header : header.o(.text) > header

...

There are four header fields that require special attention:

• Firmware Start Address (default 20100h): a double-word field used by theBooter when transferring control to the firmware. This is the address theBooter jumps to. It is also the initial address for firmware checksum calcula-tion.

• Firmware Size: a double-word field that contains the firmware size (in words).It is used by the Booter for firmware checksum calculations. Its default value(in header.c) is 0, which means that if the firmware header is left unchanged,the final firmware checksum value is also 0.

• Header Checksum: a word field that contains the header checksum (calculat-ed on offsets 00-3Eh). Its default value is 0. If left unchanged, the Booter en-ters Recovery mode due to an incorrect header checksum (see Figure 3-4).

• Firmware Checksum: a double-word field that contains the firmware check-sum, calculated from Firmware Start Address for the entire length of thefirmware defined in the Firmware Size field (see above).

Updating the Fields

All four fields can be updated after the binary (bin) or elf file has already beencreated and before programming the firmware to the flash. To update these fields,use the “Booter Generate Checksum” (BogCheck) tool, which automates thechecksum calculation and field replacement for both bin and elf files.

To update these four fields in bin or elf files, run the respective command:

bogcheck -bin mybin.bin [bin flags] [general flags]

bogcheck -elf myelf.elf [elf flags] [general flags]

The optional flags are as follows:

• General Flags:– -v (Verbose): prints information messages.

– -vv (Super Verbose): prints information messages and prints intermediatevalues during firmware checksum calculation.

• Bin Flags:– -st 0xXXXX (Firmware Start Address, hex format): If not supplied, the

application uses default 0x20100. The value supplied shouldmatch the origin of the flash segment, as written in theLinkObj.def file.

– -sz 0xXXXX (Firmware Size in words, hex format): If not supplied, the ap-plication uses the whole binary file, from the Firmware StartAddress until the last byte in the file.

– -hc 0xXX (Header Checksum, hex format): If not supplied, the applicationcalculates the header checksum.

– -fc 0xXXXX (Firmware Checksum, hex format): If not supplied, the appli-cation calculates the firmware checksum.

• Elf Flags:



– -p 0xXX (Pad Value, hex format): If not supplied, the application usesdefault 0xFF. This value is used to fill the bytes between twosegments when there is a gap between them.

3.3.3 The First Firmware Code Lines

After the Booter finishes its part of the chip initialization, it jumps to thefirmware start address. The Booter takes the 32-bit firmware start address fromoffset 14h in the Booter header.

At this point the clocks and the flash are already initialized. The firmware mustthen set up the code environment (i.e., before starting the main firmwarefunctionality). This is done as follows:

1. Initialize the stack (set the SP register).

2. Initialize the interrupt stack (set the ISP register).

3. Set a pointer to the interrupt dispatch table (set the intbase register).

4. Initialize the bss and data sections.

5. Enable the cache.

The following is a code example:

.text .align 2 .globl _main .code_label _main

start:: #----------------------------------------------------------------------# # Handle for bad checksum (the Booter returns 0 in R2). #----------------------------------------------------------------------# cmpb $0, r2 beq _recover # jump to the recovery function #----------------------------------------------------------------------# # Initialize the stack pointers. The constants __STACK_START and # # __ISTACK_START should be defined in the linker definition file. # #----------------------------------------------------------------------# movd $__STACK_START, (sp) movd $__ISTACK_START, (r1,r0) lprd (r1,r0), isp

#----------------------------------------------------------------------# # disable all interrupts by clearing PSR # #----------------------------------------------------------------------# movw $0, r0 lpr r0, psr

#----------------------------------------------------------------------# # Initialize the default sections according to the linker script. # #----------------------------------------------------------------------# bal (ra), _init_bss_data

#----------------------------------------------------------------------# # Set the Extended Dispatch bit in the CFG register (this is the # # default configuration for CR16C) and enable instruction cache # #----------------------------------------------------------------------# spr cfg, r0 orw $0x110, r0 lpr r0, cfg

#----------------------------------------------------------------------# # Initialize the intbase (pointer to the dispatch table). # #----------------------------------------------------------------------# movd $__dispatch_table, (r1,r0)



lprd (r1,r0), intbase

bal (ra), _main # jump to the main function

# Main never exits.

3.3.4 Initialization of Host-Controlled Modules from the Firmware

Host-controlled modules are powered by VDD; however, the firmware is poweredby VSB. If the firmware includes code for initialization of host-controlled modules,this code can be executed only after VDD is active. To do this, the firmwareshould wait for LPC Reset Active (LPCRSTA=0) and Host Power On (HPWRON=1).Both bits are located in MSWCTL1 register. The following is example code:

while((MSWCTL1& 0x06) != 2); //Wait for VDD and LPC reset

/* Start host-controlled modules initialization */

...

...

/* End host-controlled modules initialization */

SMC_CTL = SMC_CTL | 0x80 ; // release host wait

3.5 DEBUGGING HINTS

• The content of registers that are not 4-byte aligned is not displayed correctlyin the “memory view” window. To view or change registers use the Hardware-->Tools... menu or the View-->Special Function Registers (SFR) window.

• When developing code, define the interrupt handlers for Illegal Address (IAD)and Undefined Opcode (UND), as follows. This can detect illegal code execu-tion or an illegal code/data fetch. If the code reaches the IAD_handler or theUND_handler, check the last address in the interrupt stack to find where theproblem occurred.

void IAD_handler(void)#ifdef DEBUG__asm__("excp bpt");// Trigger bpt #elsereturn;#endif

void UND_handler(void)#ifdef DEBUG__asm__("excp bpt");// Trigger bpt #elsereturn;#endif


WPCE775x Software User Guide Revision 1.0 31 EC FIRMWARE PORTING GUIDE

Chapter 4EC FIRMWARE PORTING GUIDE

The following section highlights the changes between WPC876xL family andWPCE775x family and provides a checklist to help porting code from WPC876xLto WPCE775x

4.1 HIGH LEVEL CHANGES BETWEEN WPC876XL AND WPCE775X

The following table highlights the differences between the WPC876xL andWPCE775x. For more details, refer to the relevant Datasheet.

Table 4-6. Differences Between the WPC876xL and WPCE775x

Family WPC876XL WPCE775X

Device WPC8763L WPC8769L WPC8765L WPCE775L WPCE775C WPCE775F

Core CompactRISCTM CR16C+

RAM 4K

Flash I/F SPI

KB Scan 18x8

PS/2 3

SMBus 2 4

PWM8 (2x4)

2 PWM modules each with 4 outputs

8

8 Individual modules with Individual clocks + heartbeat.All with LED drive.

MFT16 2 3

Watchdog Enhanced (two pre-scalers)

MP Channels 2 3

GPIOs

88

28 with wake-up.4 with LED drive.

2 are VDD only the rest are selectable VDD/VCC

95

49 with wake-up.17 with LED drive.

All are selectable VDD/VCC

ADC Channels 4(8 bit) 6 (8 bit) 6 (10 bit) 8 (8 bit)

DAC Channels 2 4 4

SPI I/F

EC UART

MIWU Up to 40 wake-up or interrupt inputs

SensorPath

Host GPIO

COM Port 1 1 2

CIR Port

FIR Port


EC FIRMWARE PORTING GUIDE 32 WPCE775x Software User Guide Revision 1.0

4.2 PORTING CHECKLIST

In general, the WPCE775x is backward compatible with the WPC876xL, thereforeit is possible to easily convert a system with WPC876xL to work with WPCE775x.To properly port the system to work with WPCE775x some minimal HW/SWchanges might be needed. The following checklist describes these changes.

Changes with possible impact on hardware

1. Host GPIO pins were removed.

2. JEN0# strap was moved to KBSOUT0.

3. Vbat was replaced by GPIO41 (default floating).

4. All internal Pull-Ups and Pull-Downs were changed to 110 Kohm.

5. GPIO pins were changed to default float.

6. 5VT was removed from KBSIN7-0, KBSOUT17-0, GPIO55/CLKOUT.

7. Added CLKIN48 option on GPIO40 (for FIR).

Changes with possible impact on Firmware

1. Changed GPIO pins:

In WPC876xL In WPCE775x

GPIO64/SMI changed to: GPIO65/SMI

GPIO61/SCL2 changed to: GPIO73/SCL2

GPIO62/SDA2 changed to: GPIO74/SDA2

GPIO63/PWUREQ# changed to: GPIO67/PWUREQ#

2. Changed default signal selection. In WPCE775x the default value of the fol-lowing pins is GPIO.


A_PWM0 changed to: GPIO15/A_PWM

SDA1 changed to: GPIO22/SDA1

SCL1 changed to: GPIO17/SCL1

PSDAT1 changed to: GPIO35/PSDAT1

PSCLK1 changed to: GPIO37/PSCLK1

3. PWM changes.In WPCE775x the PWM programming model was enhanced; there are morePWM channels and each PWM has its individual clock source.


A_PWM1 changed to: B_PWM

B_PWM0 changed to: C_PWM


WPCE775x Software User Guide Revision 1.0 33 EC FIRMWARE PORTING GUIDE

4. System configuration.

• The meaning of the bits in DEVALT0-7 registers has been changed, referto the datasheet for more details.

• DEVALT6 address was changed from FF_F035h to FF_F016h,

• Added DEVALTA register.

5. Changed GPIO11 and GPIO24 power well from VDD to VCC.


FLASH UPDATE 34 WPCE775x Software User Guide Revision 1.0

Chapter 5 FLASH UPDATE

5.1 OVERVIEW

Typically, all system providers supply a utility (running under DOS or Windows)for updating/upgrading the system BIOS. For previous flash devices (e.g., FWHflash), the host accessed and updated the flash directly. However, this is not thecase with the SPI flash. To update the system SPI flash, the EC must be involved.

Winbond provides a sample flash update host utility (FLUPDATE.exe runningunder DOS) and a firmware (part of the Winbond KBC Firmware) for handlingthe flash update process.

This section explains the Winbond flash update solution.

5.2 HIGH-LEVEL DATA FLOW

Note: The host cannot directly program the SPI flash (only the WPCE775x corecan program the SPI flash). Also the WPCE775x firmware cannot runfrom the flash while the flash is being updated (programmed). Thismeans that, the firmware code that updates the flash must run from theWPCE775x ROM or RAM.

The main concept is that the BIOS or some utility running on the host sends thedata to be programmed (for example this data can be read from a file) to theWPCE775x using the WCB protocol (explained in Section 5.6). The data is firstsaved in RAM and then the WPCE775x flash update code, which is running fromthe WPCE775x ROM, programs the data into the SPI flash.

Figure 5-5. High Level Flash Update Data Flow

Flash update codeRunning on Host Data file

SPI Flash

ReadFile

Flash update code(on ROM)

Write commandbuffer (On RAM)

Send / ReceiveData, status

Program FlashReceive

Data, statusWPCE775x


WPCE775x Software User Guide Revision 1.0 35 FLASH UPDATE

5.3 HOST TO CORE COMMUNICATION

The Host communicates with the WPCE775x through the Shared Memory (SHM)module, using Shared RAM Window 2. Therefore the Host must configure theSHM (this should be done by the BIOS) to capture memory writes to a specificaddress range in memory, and use this memory range to transferdata/commands between the host and the core.

5.4 METHOD OF OPERATION

The flash update functionality enables the modification of the contents ofWPCE775x (external) flash memory. The functionality is supported by theWinbond KBC firmware, which calls the FLASH_UPDATE_handle() function thatresides on the WPCE775x ROM. The WPCE775x ROM includes the neededfunctionality to initialize, program and control the flash update process. All thesefunctions are invoked indirectly, through the Write Command Buffer (WCB)protocol, by a host application or BIOS routines.

Using the WCB protocol, the Host can transfer protocol commands and data tothe shared RAM. It also transfers protocol-control signals through the semaphorebyte associated with Shared RAM Window 2.

After boot, both firmware and BIOS need to configure the SHM module andinitialize Shared RAM Window 2. From the firmware this is done by calling theFLASH_UPDATE_init() function (this function is also part of the WPCE775xROM). Once this is done, the firmware is ready to respond to any WCB protocoltransaction initiated by the host, and execute the actions requested according tothe WCB contents. On termination of each command, the firmware issues acompletion indication via the semaphore byte.

Whenever the Host issues a command, it polls the semaphore byte for thecompletion indication. When it finds the completion indication, it can theninitiate a new WCB command. A detailed description of the WCB protocol can befound in Section 5.6.

Figure 5-6 shows the flash update flow from the host point of view. Figure 5-7shows a flow chart of FLASH_UPDATE_handle() function (which resides in theWPCE775x ROM).



Figure 5-6. Host Flash Update Main Flow

Send Init Flashcommand

Send Enter Flash updatecommand

Send Sector/Block Erasecommand

Send Address Set command

Send Program data command

More data inSector

Yes

More Sectorsto program

No

Send Exist Flash Update command

No

Yes



Figure 5-7. FLASH_UPDATE_handle() Flow

Wait for new WCBcommand

(busy loop)

FU_ActiveTRUE

FALSE

OEM_hook(command)

Command is:“Init” or

“Read ID” or“Set Write Win”

Command is:Enter Flash

Update

Command is:”Set Address” or“Sector Erase” or“Program Data”

Command is:Exit Flash

Update

No

No

Handle command

FU_Active= TRUE

Yes

Yes

Handle command

Command is:Reset EC

Command is:Jump to Boot

block

No

No

Set Completion bitin WCB

semaphore

1. FU_Active = FALSE2. Jump to boot block

Yes

Reset EC Return to EC

FU_Active = FALSE

Yes

Yes

No

got new WCBcommand

Yes

FU_Active = FALSE

Return to ECNo

Start

OEM_hook =Null

No

Yes

OEM_hookreturns 0xFF

FU_Active

No

FALSE

TRUE

Set Error Bit

No

Yes

Yes



5.5 RAM USAGE

The flash update code, which resides on the WPCE775x ROM, uses 64 Bytesfrom the top of the RAM, therefore the main EC firmware should not useaddresses from 10FC0h to 11000h.

This RAM section is divided as follows:

- 10FC0h to 10FEF - Internal Variables

- 10FF0h to 11000h - Write Command Buffer (WCB)

5.6 WRITE COMMAND BUFFER PROTOCOL (WCB)

Accesses to the flash are requested by the host via the Write Command Buffer(WCB), using a specific command sequence. The WCB resides in shared RAM andis accessed via LPC Memory or FWH write/read operations.

5.6.1 Write Command Buffer

The Write Command Buffer (WCB) is 16-byte long. The WCB layout is:

Offset Description

00h WCB synchronization byte (Semaphore register of Window 2)01h-02h Reserved03h WCB Command code04h-0Fh WCB Command arguments

Byte 0 (the Semaphore) is used for status indication and handshake. Byte 3, theCommand Code define the operation to be done and bytes 4 to 15, contains thecommand arguments. Illegal operations (or operations with illegal parameters)can lead to unexpected results.

5.6.2 Shared Access Window 2, Semaphore Byte (Offset 00h)

This semaphore provides three bits for communication between the host and theWPCE775x.

Location: Offset 00h (from base address in SHAW2BA3-0 registers)Type: Varies per bit

Bit 7 6 5 4 3 2 1 0

Name RDY ERR Reserved EXE

Reset 0 0 0 0 0 0 0 0

Bit Type Description

7 RO RDY. Set by the WPCE775x firmware when operation is complete. It is cleared after the host clears the EXE bit.



5.6.3 WCB Transaction Steps

Note: For each WCB transaction the host must perform the following sequence:

1. Wait for RDY bit to be 0.

2. Write the command to the WCB.

3. Set EXE to 1.

4. Wait for RDY to be 1.

5. Verify that no error occurred (ERR == 0).

6. Clear EXE to 0.

5.6.4 Using the WCB Protocol from the Host

1. Allocate the WCB in the host memory space via SHAW2BA3-0.

2. Perform WCB transactions for flash identification:

a. Issue Init Flash command.

b. Issue Read ID command.

c. Repeat steps a. and b. until appropriate flash ID is found.

3. Perform WCB transactions for flash programming:

a. Issue Enter Flash Update command.

b. Sector/Block programming:

i. Issue Sector/Block Erase command (a sector is erased when byte Ah of the Init Flash commands includes the spi flash sector erase command; a block is erased when byte Ah is set to the spi flash block erase command).

ii. Issue Address Set command (alignment must be legal for the current flash device)

iii. Issue Program command with up to 8 bytes.

iv. While there is more data to program in the sector, repeat step iii.

v. While there are more sectors/blocks to be programed, go to step i. (Call Init Flash commands if it is required to switch between sector and block erase commands).

4. Termination

a. Issue Exit Flash Update command, Reset EC command or Go to BootBlock command.

6 RO ERR. Set by the WPCE775x when an error occurs during any WCB operation. It is cleared after the host clears the EXE bit.

5-1 Reserved.

0 R/W EXE. Set by the host when a valid command is ready in the WCB for processing. It should be cleared by the host after the WPCE775x sets the RDY bit.



5.7 WCB COMMANDS

The following table lists the available WCB commands.

Operation

Com-mand Code

Command Field1

Byte3h

Byte4h

Byte5h

Byte6h

Byte7h

Byte8h

Byte9h

ByteAh

ByteBh

ByteCh

ByteDh

ByteEh

ByteFh

Init Flash 5Ah Read Device

ID

Write Status Enable

Write Enable

Read Status Regis-

ter

Write Status Regis-

ter

Flash Pro-gram

Sector or

Block Erase

Status Busy Mask

Status Register

Value

Program Unit Size

Page Size

Read Device

ID

Type

EnterFlash Update

10h 55h AAh CDh BEh Reserved

Exit FlashUpdate

20h Reserved

Reset EC 21h Reserved

Go toBoot Block

22h Reserved

Read ID C0h ID Byte 0

ID Byte 1

ID Byte 2

ID Byte 3

Reserved

Sector/BlockErase

80h Address within the sector Reserved

Address Set

A0h Address Reserved

Program Bnh Data Byte 0

Data Byte 1

Data Byte 2

Data Byte 3

Data Byte 4

Data Byte 5

Data Byte 6

Data Byte 7

Reserved

Set Write Win-dows

C5h Address Size Reserved



5.7.1 Init Flash

SPI Flash devices from different manufactures might use different instruction op-codes and might have different flash characteristics. The purpose of the InitFlash command is to communicate these characteristics and op-codes to the EC.This command should be called before any other command. However it is alsopossible to call this command at any other time during the flash update processin case there is a need to change one of the op-codes.

Example: When byte Ah holds the op-code of the Sector-Erase instruction, theSector/Block Erase command erases a sector. If for some reason it is nowrequired to erase a block, then first the Init Flash command should be called,this time with the op-code of the Block-Erase instruction, and only then theSector/Block Erase command should be called.

Byte Description

Fh Read Device ID Type. There are two main ways to read the flash ID (depending on the flash type). A. Send the "Read ID" op-code (as defined in byte 4), then send 3 dummy address bytes, then read the ID bytes

B. Send the "Read ID" op-code (as defined in byte 4) command and immediately read the ID bytes.

When the value in this field is 47h, method B is used. Otherwise (any other value) method A is used.

Eh Page Size. This value is only relevant when the Program Unit Size = FFh. When this is the case, the value should be X, where 2X = flash page size (for example, when page size is 256, use 8 since 28 = 256).

Dh Program Unit Size. Number of bytes to program in one flash write transaction. Calling the Program command (Command code: Bnh) can generate a few flash write transaction depending on this value. Example: Sending the B8 (program 8 bytes) command when Program Unit Size = 2 generates 4 flash write transactions each one with 2 bytes. Note that the number of bytes to be programed (when calling the Bn Program command) must be a multiple of Program Unit Size. Possible values are 1 to 8 or FFh. FFh means that the Program Unit Size equals Page Size (as defined in byte Eh).

Ch Status Register Value. Value that should be written to the flash device’s Status register to remove flash write protection.

Bh Status Busy Mask. Set to 1 only the bit which represents the location of the BUSY bit in the flash Status-Register.

Ah Sector or Block Erase. The op-code for the Sector erase (or Block erase) instruction of the specific flash device. Depends on what should be erased when calling the Sector/Block Erase command (80h).

9h Flash Program. The op-code of the program command in the specific flash device.

8h Write Status Register. The op-code for the Write-Status-Register command in the specific flash device.

7h Read Status Register. The op-code for the Read-Status-Register command in the specific flash device.

6h Write Enable. The op-code for the Write-Enable command in the specific flash device.

5h Write Status Enable. The op-code of the Write-Status-Register Enable command (the command that should be sent just before the Write-Status-Register command) in the specific flash device.

4h Read Device ID. The op-code for the Read-Device-ID command in the specific flash device.

3h 5Ah



5.7.2 Enter Flash Update

Once this command is called the flash update code (running in ROM) enters abusy loop waiting for WCB commands and executing them. It only returns to themain EC Firmware (on the Flash) after getting one of the exit commands (ExitFlash Update, Reset EC or Go to Boot Block). This command must be calledbefore calling any of the following commands: Sector/Block Erase, Set Address,Program, Exit Flash Update, Reset EC and Go to Boot Block

5.7.3 Exit Flash Update

When flash update is in progress (after calling Enter Flash Update command),calling this command causes the flash update code (running in a busy loop fromROM) to exit and return back to the main EC firmware (return to flash).

5.7.4 Reset EC

When flash update is in progress (after calling Enter Flash Update command),calling this command resets the EC, and re-starts the execution of the ECfirmware from the start.

Byte Description

8h to Fh

Reserved

7h BEh

6h CDh

5h AAh

4h 55h

3h 10h

Byte Description

4h to Fh

Reserved

3h 20h

Byte Description

4h to Fh

Reserved

3h 21h



5.7.5 Go To Book Block

When flash update is in progress (after calling Enter Flash Update command),calling this command causes the flash update code (running in a busy loop fromROM) to exit and jump to the “Boot Block” address. This address is defined bythe EC firmware when calling the FLASH_UPDATE_init() function.

5.7.6 Read ID

Read the flash device ID using the op-code defined in byte 4h and Fh of the InitFlash command. This command can be executed before calling the Enter FlashUpdate command. Once the execution of the command is completed (thesemaphore RDY bit is set to 1) the received ID is stored in bytes 4h to 7h of theWCB and can be read by the host.

5.7.7 Sector/Block Erase

Execute a flash erase transaction using the op-code defined in byte Ah of the InitFlash command.

Byte Description

4h to Fh

Reserved

3h 22h

Byte Description

8h to Fh

Reserved

4h to 7h

ID Bytes. ID byte 0 to ID byte 3

3h C0h

Byte Description

8h to Fh

Reserved

4h to 7h

Address. Address within the sector/block to be erased. The address can be either an offset from the flash start (in this case it should be less than flash size) or system address (in this case it should be greater than or equal to 4 GB minus the flash size).

3h 80h



5.7.8 Set Address

Set the address for the next Program command. Note that this address isincremented automatically upon each Program command, hence it is necessaryto issue an additional Set Address command only for any non-consecutive writetransaction.

5.7.9 Program

Execute a flash Program transaction using the op-code defined in byte 9h of theInit Flash command. The Program command assumes that the programmingaddress was already defined (see Set Address command). The programmingaddress is incremented automatically after each Program command.

5.7.10 Set Write Window

The purpose of this command it to enable flash protection. Calling this commandopens a virtual writable window on the flash. Once the window is opened(windows Size > 0) data can be written only to addresses inside this windowwhile all other flash addresses are protected. When window Size is 0, the flash isprotected.

The second parameter of FLASH_UPDATE_init() defines the starting value of thiswindow: when set to TRUE the flash is protected (window Size = 0). When set to FALSEthe flash is not protected (window base Address = 0, window Size = flash size).

Byte Description

8h to Fh

Reserved

4h to 7h

Address. The address to be used for the following Program commands. The address can be either an offset from the flash start (in this case it should be less than flash size) or system address (in this case it should be greater than or equal to 4 GB minus the flash size).

3h A0h

Byte Description

Ch to Fh

Reserved

4h to Bh

Data. The data to be program to the flash. The programming order is from byte 4h to byte Bh. The number of bytes to be programed depends on n (as defined below).

3h Bnh. The n values can be 1..8, designating up to 8 data bytes per program transaction. Note that n must be a multiple of the flash device’s allowed programming unit, e.g., if for a specific flash device the minimum programing unit is 2 then n can only be 2,4,6 or 8.

Byte Description

Ch to Fh

Reserved

8h to Bh

Size. Window size, from 0 to flash size. When Size = 0 the flash is protected.



5.8 FLASH UPDATE API

This section describes the interface of the flash update code which is in the chipROM. Note that this code does not run by itself, it is the responsibility of the ECFirmware to call this API.

5.8.1 Types

typedef unsigned char (* HOOK_OP_func_ptr)(unsigned char);

5.8.2 Functions

void FLASH_UPDATE_init(unsigned long address,int flash_protect,HOOK_OP_func_ptr func)

Parameters

address - boot block address. The flash update code jumps to thisaddress when getting the Go To Book Block commandfrom the host.

flash_protect - TRUE: flash is protected, any Program or Erasecommands are ignored. FALSE: Flash is not protected.

func - Pointer to an OEM hook function, to enable easycustomization of the flash update process. Must be set toNULL (0) if customization is not needed.

Return value

None.

Description

Initializes the Flash Update mechanism.

void FLASH_UPDATE_handle(void)

Parameters

None.

Return value

None.

4h to 7h

Address. Window base address. The address can be either an offset from the flash start (in this case it should be less than flash size) or system address (in this case it should be greater than or equal to 4 GB minus the flash size).

3h C5h.



Description

Should be called periodically by the EC Firmware. Checks if there is arequest to handle any flash update activity (through the Shared Memory)and handle it. Once flash update is in progress (after a valid Enter FlashUpdate command) this function does not return until the end of the flashupdate process (after a valid exit command).

void FLASH_UPDATE_set_write_win(unsigned long w_start,unsigned long w_size)

Parameters

w_start - Base address of window in range 0 to flash size

w_size - Window size in range 0 to flash size. When w_size == 0 theflash is protected.

Return value

None.

Description

Configures the start address and size of the unprotected area on the flash.Only the area inside the windows can be written/erased

5.9 CUSTOMIZING FLASH UPDATE PROTOCOL

Customizing the flash update is possible by using the OEM hook function.

1. Create a function to handle flash update commands. This function is calledeach time the host sends a new WCB command (see Figure 5-7). The hookfunction gets as a parameter the current WCB command code. If it handlesthe command it should return FFh otherwise it should return the commandcode. Example:

unsigned char MY_HOOK_func(unsigned char op)

if (op == READ_IDS_OP) // Do somethingreturn 0xFF; // indicating that the operation was

// handled by this hook function.return op;

2. The Hook function must run from RAM

3. Initialization. Example: FLASH_UPDATE_init(Addres,0,MY_HOOK_func);


WPCE775x Software User Guide Revision 1.0 47 ADDITIONAL INFORMATION

Appendix AADDITIONAL INFORMATION

A.1 RUNNING CODE FROM INTERNAL RAM

Normally, the boot code is run from the on-chip ROM, and the rest of the code isrun from external flash. However, in certain cases there might be a need to runcode from the internal RAM instead of from the flash (for example, code thatupdates the flash cannot run from the flash and therefore must be run fromRAM. Other possible reasons might be speed considerations.). Running code fromRAM does not save space in flash, since the code must be kept in flash before itis copied to the RAM.

In this section, “critical code” refers to code that is to be run from RAM.

To run code from the RAM:

1. Modify the linker script as follows:

a. The .text section of file or files containing the critical code should be allo-cated a memory area in RAM in addition to the load memory area in theflash1. Due to linker script syntax, care must be taken not to place theoutput section statement for the critical code before the output sectionstatements for any code that must reside in the beginning of the flash(e.g., Booter header or start code). See “Step 1” on the following page.

b. Set link-time variables to the beginning and end addresses of these mem-ory areas. These variables are used for initializing the RAM at run-time.

2. To the application, add code that copies the code from the flash to RAM. Thiscode can run during initialization or at any time before the critical code isrun. See “Step 2” on the following page.

1. If the specified code is in assembly, the assembler .section Segment ControlDirective may be used to direct the code to a user defined section. In thiscase this user section name, instead of “.text”, may be used to specify the in-put section that is directed to RAM. see the description of the .section direc-tive in the CompactRISC© Assembler Reference Manual.


ADDITIONAL INFORMATION 48 WPCE775x Software User Guide Revision 1.0

The following excerpts illustrate the steps mentioned above.

Step 1. Linker script:

MEMORY ... RAM: ORIGIN = 0x10000, LENGTH = 0x800 /* 2K Internal RAM */FLASH:ORIGIN = 0x20000, LENGTH = 0x100000 /* 1M flash */...

SECTIONS ....text_crit :

__CRIT_START = .; crit.o(.text) __CRIT_END = .; > RAM AT > FLASH

.text : *(.text) > FLASH

...

/* Set _CRIT_IMAGE_START to start address of *//* critical code image kept on flash. */__CRIT_IMAGE_START = LOADADDR(.text_crit);

Step 2. Corresponding initialization code:

for (i = 0; i < &_CRIT_END - &_CRIT_START; i++) *(&_CRIT_START + i) = *(&_CRIT_IMAGE_START + i);

Or (when libc is used):

memcpy (&_CRIT_START, &_CRIT_IMAGE_START,&_CRIT_END - &_CRIT_START);

Examples

Linker Script: MEMORY

/* CR16CPlus core System RAM */ram: ORIGIN = 0x10000, LENGTH = 0x800

boot_flash: ORIGIN = 0x20000, LENGTH = 0x100 /* Booter header */ flash: ORIGIN = 0x20100, LENGTH = 0x100000 - 0x100 /* 1M */

SECTIONS /* Booter header */.boot_flash : .rdata(booter.c) > boot_flash

/* start code must reside immediately after the Booter header */.start : main\start.o(.text) > flash



/* critical code */.text_crit :

__CRIT_START = .; main\main_crit.o(.text) drivers\crit.o(.text) __CRIT_END = .;

> ram AT > flash

/* rest of the code - placing this statement before the output section statement for the critical code would result in the latter being ignored, due to the ‘*’ */.text : *(.text) > flash

/* Handle .data .bss etc. */ ...

__CRIT_IMAGE_START = LOADADDR(.text_crit);__DATA_IMAGE_START = LOADADDR(.data);__NDATA_IMAGE_START = LOADADDR(.ndata);

Application Code that Calls Functions Residing in RAM

extern char _CRIT_IMAGE_START, _CRIT_START, _CRIT_END;

...

application()

...

/* copy code from flash to RAM */

memcpy (&_CRIT_START, &_CRIT_IMAGE_START, &_CRIT_END - &_CRIT_START);

crit();

...

Related Documentation

See the description of the Overlay mechanism in the CompactRISC© Object ToolsReference Manual.



A.2 WORKING WITH ATI CHIPSETS

This section describes an issue that occurs when using an ATI chipset,specifically the ATI SB400 South Bridge; however, it is possible that this issuealso occurs on newer ATI chipset versions.

A.2.1 Issue Description

• The ATI chipset has a time-out mechanism that aborts an LPC transactionthat includes a Long Wait SYNC of more than 7.678 µs (i.e., 255 clocks).

• The WPCE775x uses a Long Wait SYNC when it needs more time to fetchdata from the shared SPI flash.

• Fetching data from the SPI flash can take more than 7.678 µs (this dependson the flash frequency; for example, it can take up to 10.2 µs in a 33 MHzSPI flash).

For the above reasons, the BIOS might not be able to boot without the proper ATIand WPCE775x configurations.

A.2.2 Solution

Option 1 (Recommended)

• Use an SPI flash that can work at 50 MHz. At this frequency, the longestfetch time is 6.72 µs, which is shorter than the ATI time-out.

• The ATI chipset time-out mechanism can be disabled by software. It is recom-mended to disable this time-out as one of the first steps performed by theBIOS. On the ATI SB400, this can be done by clearing bit 7 of the “IO/MemPort Decode Enable” register (PCI_reg: 0x48h).

Option 2

For slower SPI flashes (for example, 33 MHz), perform the following steps at boottime.

• BIOS: As the first step of the BIOS, add code to the BIOS to disable the ATILPC time-out. On the ATI SB400, this can be done by clearing bit 7 of the“IO/Mem Port Decode Enable” register (PCI_reg: 0x48h).

• EC code:a. Keep the CPU in reset by holding the KBRST pin low

(set MSWCTL1.HRSTOB = 1).

b. When VDD is On (i.e., after power-up), if needed, do an SIO initialization.

c. Clear HOST_WAIT and set the KBRST pin high (MSWCTL1.HRSTOB = 0).At this point the host starts to fetch and execute the BIOS code.

d. Put the EC code in an idle loop for a few milliseconds until the host dis-ables the ATI LPC time-out mechanism.



A.3 COMPACTRISC TOOLS VERSION 4.1 CRDB DEBUGGER

This section is a quick start manual for activating and using the CR ToolsDebugger (CRDB). For detailed information on debugger commands, refer to theDebugger Reference Manual (Start Menu -> Programs -> CR164.1 -> Documents)or to Debugger help (in the Console window).

A.3.1 Preparation

1. Connect the host PC to the target board. The communication channel be-tween the CRDB and the target board is through the PC parallel port, usinga parallel port cable and a parallel port to the JTAG converter.

Figure A-1. PC-Target Board Connection Via Parallel Port

2. Make sure that the executable file to be debugged (typically a *.elf file) isdownloaded to the target flash. To download the executable, use the RiderLoader Tool, as described in the Loading Firmware into Flash for PC876xLDevices Technical Bulletin.

3. By default, the debugger works with the CR16 simulator. To configure thedebugger to work with a actual target chip (i.e., not the simulator), create thefile crdb.cfg and place it in the directory that includes the executable to bedebugged.

The crdb.cfg file must include the following line:

TARGET = CR16CSDI



A.3.2 Starting the CRDB

1. Run crdb.exe (Start Menu -> Programs -> CR164.1 -> CRDB). This opensthe Source window:

2. Click File->Open to select the executable file (*.elf file).

3. Connect to the Target:

a. Select Run->Connect to target. This opens the Target Selection window.



b. In the Target Selection window:i. Set “Target” to Remote/TCP (this automatically changes “Baud Rate” to “Hostname”).ii. Set “Hostname” to the IP address of your computer.iii. Set “Port” to 1000iv. Leave all checkboxes unchecked.v. Click OK.

c. After the “Successfully connected” message appears, click OK.

4. Click Run->download to download the executable file.Note that this downloads the code to the debugger, not to the target.



A.3.3 Running the Code

1. Click View->Console to open the Console window:

.

2. To execute the code step by step use the si (Step Asm Instruction) commandin the console window. Alternately, in the Source window, use the followingbutton:

3. To run the code, use the c (Continue) command from the Console window, orpress from the Source window.

A.3.4 Breakpoints

Use only hardware breakpoints when debugging code running from ROM (e.g.,from the flash device).

Setting Breakpoints

To set a hardware breakpoint, use the hbreak command in the Console window.The following is an example of how to set two hardware breakpoints, one ataddress 0x20132 and one in function main().

Step Asm Instruction



Viewing Breakpoints

To view all currently set breakpoints, use the info breakpoints command inthe Console window (breakpoints are numbered automatically):

Deleting Breakpoints

To delete a breakpoint, use the delete command in the Console window. Forexample, to delete breakpoint number 1, type delete 1 at the (crdb) prompt.

A.3.5 Viewing and Changing Memory

To display the contents of memory, use the X (examine memory) command. Thiscommand enables the display of memory in several different formats.

The following example displays two consecutive units of memory starting ataddress 0x20000, in 8-bit (2xb), 16-bit (2xh), and 32-bit (2xw) formats. For moreinformation about the X command, type help X.

To change a value in memory or in a memory-mapped register, use the set*<address> = <value> command. The following example changes the contentsof address 0x1000 to be equal to 0xAA.



A.4 PORTING CODE FROM THE CR16B TO THE CR16CPLUS

This section provides guidelines for porting CR16B assembly code to CR16CPlus.

A.4.1 Introduction

For code written in C, porting from the CR16B to the CR16CPlus is relativelysimple. For code written in assembly language, however, porting is morecomplicated.

This chapter explains the main differences between the CR16B and CR16CPlusand provides porting guidelines. It contains the following sections:

• Section A.4.2, “Comparing the CR16B and CR16CPlus”. Read this beforejumping into the code, especially for code written in assembly language.

• Section A.4.3, “Porting C Code”. This section provides guidelines for porting Ccode.

• Section A.4.4, “Porting Assembly Language Code”. This section providesguidelines for porting code written in assembly language from the CR16Bsmall programming model to CR16CPlus. Before reading this section, it isrecommended that you read Section A.4.2.

For a detailed explanation of the CR16B and CR16C programming models, see

the CompactRISC© CR16B Programmer’s Reference Manual and CompactRISC©

CR16C Programmer’s Reference Manual, respectively.

A.4.2 Comparing the CR16B and CR16CPlus

Major CR16CPLUS Enhancements

The CR16CPlus architecture is an enhancement of the CR16B architecture. Themajor enhancement is that CR16CPlus offers more linear address space.CR16CPlus supports 32-bit addresses, allowing 16 MB of address space for codeand 4 GB of address space for data. The increased address size affectsinstruction encoding and register usage.

CR16CPlus instruction encoding accommodates additional commands, whichallows more efficient handling of larger address pointers. As a result, binarycompatibility with CR16B code is no longer supported; however, assembly-levelcompatibility is supported.

In addition, registers R12, R13, RA and SP are doubled in size to handle largeraddress pointers.

To simplify backward assembly-level compatibility with the CR16B largeprogramming model, the CR16CPlus provides a configuration bit, CFG.SR, whichsets the relevant registers to 16-bit wide.

Note that there is no backward assembly level compatibility with the CR16Bsmall programming model.



Register Set

General-Purpose Registers

In the CR16B, the General-Purpose registers are 16 bits wide.

In the CR16CPlus registers R12, R13, RA and SP are 32 bits wide and can beconsidered as register pairs

Processor Registers

• Dedicated Address Registers: In the CR16B, the three dedicated addressregisters, PC, ISP and INTBASE, are 21 bits wide. The five most significantbits of the ISP register are always cleared. In the CR16CPlus, these registersare all 24 bits. In addition, in the CR16B, the INTBASEL register is used ifCFG.ED = 0; the CR16CPlus uses the complete INTBASE register independentof CFG.ED.

• Configuration bits: A short register bit enables the registers to be used as inthe CR16B large programming model; that is, the extended version of R12,R13 and RA is effectively disabled. In addition, support for a cache is includ-ed with instruction and data cache enable bits (note, however, that theWPC876xL has an instruction cache only).

• PSR: A User mode status bit (Bit U - Bit 3 in the PSR) has been added to in-dicate whether the processor is currently in User mode or in Supervisormode.

ISP

PSR

Address

Processor Status Register

R0R1R2R3R4R5R6R7R8R9

R10R11R12

R13/ERA

RASP

General-

CFG

Configuration Register

15 0

15 0

15 0PC

20 0

00000INTBASEH

15

INTBASEL

Registers RegistersPurpose

Dedicated

PSR

Address

Processor Status Register

R0R1R2R3R4R5R6R7R8R9

R10R11

R12R13

RASP

General-

CFG

Configuration Register

15 0

15 0

15 0PC

31 0

ISPH

15

ISPL

Registers RegistersPurpose

Dedicated

USPLUSPHINTBASEH INTBASEL

23

31

CR16B Registers CR16CPlus Registers

Figure A-2. CR16B and CR16CPlus Registers



Instruction Set

New Instructions

The following commands have been added to support additional operations thataccommodate the larger CR16CPlus address space and pointers:

• LOAD/STORE double-word

• Compare double

• Add double

• Subtract double

• Arithmetic/Logical shift double

• MOVXW/MOVZW

• AND/OR/XOR double

In response to user feedback and to facilitate simple DSP algorithms, a basic setof Multiply and Accumulate instructions has been included in the instruction set:

• MACSW

• MACUW

• MACQW

Relative Addressing

Addressing relative to a register pair has been expanded to allow all memoryaccess commands to use a register pair as the base address. Direct access using20- and 24-bit labels is also provided for all data access operations.

Index Addressing Mode

Index Addressing mode was added to improve support for relocatable data. Thisallows the location of data to be determined at runtime.

Expanded Instructions

The following instructions have expanded functionality:

• push/pop/popret - These operate on up to eight registers, with an additionalparameter determining whether the RA should be pushed/popped to/fromthe stack.

• Load/Store Multiple - These allow a count of up to eight registers and allowthe source and destination to be 32 bits long. Note that the CR16BLoad/Store Multiple instruction, which uses a single register pointer, isstill supported but with a count of up to eight.

• bit and Store Immediate - All registers, including register pairs, can be usedto hold the address base.

Retired Instructions

Since the CR16B small programming model is no longer supported directly, theCR16CPlus no longer supports the following instructions:

• bal reg, disp17

• jal reg, reg

• Jcond reg

• jump reg

• popret small programming model

The Bcond1i assembly instruction is no longer implemented by the CR16CPlus.Bcond1i is converted by the assembler to two instructions: cmp and bcond.



Exception Handling

Dispatch Table The dispatch table in CR16CPlus does not have any location restrictions and cannow exist anywhere in memory. The CFG.ED bit now determines only if thedispatch table contains single-word or double-word entries.

Interrupt Stack Due to the larger address pointers, an entry on the interrupt stack must now bein a three-word format, which comprises:

– PSR

– Return Address High

– Return Address Low

Wraparound In CR16B, address wraparound is not supported. In CR16CPlus, an addressbeyond the range of 0 to 16M triggers an IAD trap.

A.4.3 Porting C Code

Architecture Related Issues

Pointers:

In the CR16B, a data pointer is 16 bits; a far data pointer is 32 bits. A functionpointer in the small programming model is 16 bits; a function pointer in the largemodel is 32 bits. In the CR16CPlus, all pointers are 32 bits long. The int typesize is 16 bits in both CR16B and CR16CPlus; therefore, you must check that thecode handles pointers correctly. For example:

• Do not try to cast a pointer into a type smaller than 32 bits. Casting a pointerto an int truncates the higher 16 bits.

• The difference between two pointers (diff = pointer1 - pointer2) shouldbe put into a long int variable.

The following is a short code example:

Table A-1. Code Example

typedef unsigned short ADDRESS;

void print_address(ADDRESS);

int my_array[10];

void my_func(void)

print_address((ADDRESS)my_array);

Although this code compiles for theCR16CPlus with no errors, it does not workproperly since in CR16CPlus, the address ofmy_array is 32 bits long and should behandled as unsigned long, not unsignedshort.

In this example, the solution is to change thedefinition of ADDRESS to:

typedef unsigned long ADDRESS;



Interrupt Stack:

In the CR16CPlus, an entry on the interrupt stack contains three words: PSR,Return Address High and Return Address Low (see Figure A-3). In the CR16B, anentry on the interrupt stack contains two words: PSR and Return Address. Thisis important when porting code that deliberately changes the content of theinterrupt stack. For example, some Real-Time Operating Systems (RTOSs)change the contents in the interrupt stack to handle task switching.

Compiler Related Issues

• If the code uses symbols predefined by the compiler, for example:

__CR16B__, __CR16BS__ or __CR16BL__

make sure that you port these code sections to the new compiler.

• Watch out for all __asm__ commands because they are core specific.

• The National CompactRISC Toolset version 4 does not support the __farqualifier.

A.4.4 Porting Assembly Language Code

This section only applies to porting CR16B small programming model assemblycode and provides the main guidelines for porting such code to the CR16CPlus.

Note: There is no one-to-one translation; you must apply the changes accord-ing to the requirements of your application.

Address Range

When writing in the CR16B small programming model, the supported addressrange is limited to 128 KB of program address space and 256 KB of data addressspace. It is thus sufficient to use one register as an operand to hold an address.The CR16CPlus supports 16 MB of address space for code and 4 GB for data;therefore, instructions must (in most cases) use a pair of registers as an operand.

PC16-1

PC23-7

PSR11-0

LowReturn

AddressHigh

ReturnAddress

SavedStatus

(Push)

(Push)

(Push)

16Lower Addresses

ISP After Exception

ISP Before Exception

Higher Addresses

Figure A-3. Interrupt Stack



For example, in the CR16B small model:

jump r3

changes, in CR16CPlus, to:

jump (r4, r3)

In this example, the 32-bit jump address is stored in R3 and R4, where R3 holdsthe 16 least significant bits and R4 holds the 16 most significant bits.

Register Pairs Only the following register pairs can be used:

• (R1, R0), (R2, R1) ... (R11, R10)

• (R12, R11) - In this case only the least significant word of R12 is used.

• (R12), (R13), (RA), (SP)

Note: R12, R13, RA and SP are 32-bit registers and therefore are also consid-ered register pairs.

Porting Guidelines

In the following examples, changes are highlighted using bold and underline (e.g.,movd).

32-Bit Addresses and Pointers

Consider all addresses and pointers as 32 bits wide. Find all the places in thecode that refer to pointers (e.g., arrays, variables or functions) and make sureyou handle them correctly. Technically, any code that moves an address/pointerto or from a register should use the new instructions (movd, loadd, ...) that wereadded to CR16CPlus to support the larger address space. See the examples inthe following table:

Table A-2. Pointers and Address Examples

CR16B Code CR16CPlus Code Explanation

func2: loadb 20(r2),r0 jump ra

func1: .... movw $buffer,r2 bal ra,func2 ....

func2: loadb 20(r3,r2),r0 jump (ra)

func1: .... movd $buffer,(r3,r2) bal (ra),func2 ....

In the following CR16B codefunc1 calls func2 and passesit (in r2) a pointer to buffer(array of bytes). func2 loadsentry 20 in buffer intoregister r0 and returns.

When porting the code toCR16CPlus the pointer to thearray is 32 bits wide; thus aregister pair is needed to hold itinstead of one register.

# Initialize program stack

movw $__STACK_START, sp

# Initialize program stack

movd $__STACK_START, (sp)

• movw changes to movd• Since sp is considered a

register pair, place it withinparentheses.

# Save interrupt stack ad-dress

movw $__ISTACK_START, r0

# Save interrupt stack address

movd $__ISTACK_START, (r1,r0)

• movw changes to movd• Since the address can be

32 bits, use a register pairto hold it.Note: Make sure that theR1 is not already used bythe application for anotherpurpose.



Unsupported Instruction Formats

Since the CR16B small programming model is no longer supported, CR16CPlusno longer supports the following instruction formats:

• bal reg, disp17

• jal reg, reg

• Jcond reg

• jump reg

Port these commands to use a register pair instead of one 16-bit register. If thesecommands already use registers R12, R13, RA or SP, which are 32-bit registersin CR16CPlus, the registers should be enclosed in parentheses to indicate aregister pair. If these commands use registers other than R12, R13, RA or SP, thecommand should be changed to fit the new format. See the examples in thefollowing table:

Make sure that the second register added (R4 in the above examples) is notalready used by the application for other purposes.

# Load an address from a table

loadw Func_Table(r1), r12

# jump to the selected address

jump r12

# Load an address from a table

loadd Func_Table(r1), (r12)

# jump to the selected address

jump (r12)

• loadw changes to loadd• Although it is not shown in

this code, each entry in theFunc_Table should bechanged to hold a 32-bitpointer.

• Since R12 is considered aregister pair, place it withinparentheses.

Table A-2. Pointers and Address Examples (Continued)


Table A-3. Unsupported Instruction Format


bal ra, disp bal (ra), disp Add parentheses around the register pair.

jal ra, r12 jal (ra), (r12) Add parentheses around the register pair.

jge r13 jge (r13) Add parentheses around the register pair.

jump ra jump (ra) Add parentheses around the register pair.

bal r3, disp bal (r4, r3), disp Change R3 to the register pair (R4, R3).

jump r3 jump (r4, r3) Change R3 to the register pair (R4, R3).

jeq r3 jeq (r4, r3) Change R3 to the register pair (R4, R3).

jal ra, r3 jal (ra), (r4, r3)Change R3 to the register pair (R4, R3) and place RA within parentheses to note that it is a register pair.



pop/popret/push <count> <register>

When using a push, pop or popret instruction, note that:

• The count operand reflects the total number of words (16-bits) to restore orsave, not the number of registers, as in CR16B. Therefore, when using regis-ter R12, R13 or RA, in most cases, you pop or push two words (i.e., 32 bits)from the stack.

• The count operand is between 1 to 8.

• The new instruction can pop or push up to eight adjacent registers and theRA. For example:

The following table shows some pop and popret code examples:

32-Bit Processor Registers

Some of the processor registers (e.g., INTBASE and ISP) are now 32 bits long. To loador store the contents of these registers, use the LPRD or SPRD command. For example:

pop $8, r1 Restores eight words from the stack into registers R1 to R8.

push $8, r1 Saves registers R1 to R8 to the stack.

pop $8, r1, raRestores eight words from the stack into registers R1 to R8,and also into RA (note that RA pops two extra words fromthe stack).

push $8, r1, raSaves R1 to R8, and RA to the stack (note that RA pushestwo words into the stack).

Table A-4. pop and popret Examples

CR16B CR16CPlus Explanation

popret $2, r5 popret $2, r5 No change.

pop $4, r8 pop $4, r8 No change.

pop $4, r9 pop $5, r9

count changes from 4 to 5, since here we also pop R12, which is a two-word (32-bit) register in CR16CPlus (5 = 1 word for R9 + 1 word for R10 + 1 word for R11 + 2 words for R12).Note: To pop only four words, you do not need to change count. As a result, only the least significant word of R12 is changed.

push $4, r8 push $4, r8 No change.

push $4, r9 push $5, r9

count changes from 4 to 5, since here we also push R12, which is a two-word (32-bit) register in CR16CPlus (5 = 1 word for R9 + 1 word for R10 + 1 word for R11 + 2 words for R12).

Note: To push only four words, you do not need to change count. As a result, only the least significant word of R12 is saved.

Table A-5. spr/lpr Examples

CR16B CR16CPlus Explanation

spr intbase, r0 sprd intbase, (r1,r0)• Use sprd instead of spr.• Change R0 to register pair (R1, R0).

lpr r0, isp lprd, (r12), isp• Use lprd instead of lpr.• Change R0 to a register pair. Any

legal register pair can be used.



A.5 PORTING FROM COMPACTRISC TOOLSET VERSION 3.X TO 4.X

CompactRISC Toolset version 3.x was replaced by version 4.x, which is based onthe GNU toolset but retargeted to the CompactRISC architecture. Therefore, thetool interface is different.

For more details, see the Toolset Version 3 to Version 4 Porting Guide (part of theVersion 4.x installation), which describes the major changes and enhancements ofCompactRISC Toolset version 4.x.

A.5.1 Porting Linker Script File

The following are clarifications to the Toolset Version 3 to Version 4 Porting Guide:

• In the Memory Description section, spaces are important (e.g., before andafter “:” and “=”).

In crlink (version 3.x):code_mem: ORIGIN=0x1000, LENGTH=0xD000

In crld (version 4.x):code_mem : ORIGIN = 0x1000, LENGTH = 0xD000

• The INTO(X) macro was changed to: > X and was moved to the end of thesection definition.

In crlink (version 3.x):.text INTO(code_mem): "main\start.o"(.text)

In crld (version 4.x):.text : main\start.o(.text) > code_mem

• Section alignment using the ALIGN(num) macro has changed.

In crlink (version 3.x):.rdata ALIGN(4) INTO(code_mem): *(.rdata_4) *(.rdata_2) *(.rdata_1)

In crld (version 4.x):.rdata : . = ALIGN(4) ; *(.rdata_4) *(.rdata_2) *(.rdata_1) > code_mem


Winbond provides comprehensive service and support. For product information and technical assistance, contact the nearest Winbond center.

HeadquartersNo. 4, Creation Rd. III,Science-Based Industrial Park,Hsinchu, TaiwanTEL: 886-3-5770066FAX: 886-3-5665577http://www.winbond.com.tw/

Winbond Electronics Corporation America2727 North First Street, San Jose,CA 95134, U.S.A.TEL: 1-408-9436666FAX: 1-408-5441798

Winbond Electronics (Shanghai) Ltd.27F, 2299 Yan An W. Rd. Shanghai,200336 ChinaTEL: 86-21-62365999FAX: 86-21-62365998

Taipei Office9F, No.480, Rueiguang Rd.,Neihu District, Taipei, 114,Taiwan, R.O.C.TEL: 886-2-8177-7168FAX: 886-2-8751-3579

Winbond Electronics Corporation Japan7F Daini-ueno BLDG, 3-7-18Shinyokohama Kohoku-ku,Yokohama, 222-0033TEL: 81-45-4781881FAX: 81-45-4781800

Winbond Electronics (H.K.) Ltd.Unit 9-15, 22F, Millennium City,No. 378 Kwun Tong Rd.,Kowloon, Hong KongTEL: 852-27513100FAX: 852-27552064

For Advanced PC Product Line information contact: [email protected]

© 2007 Winbond Electronics Corporation. All rights reserved.

www.winbond.com

Winbond does not assume any responsibility for use of any circuitry described, no circuit patent licenses are implied and Winbond reserves the right at any time without notice to change said circuitry and specifications.


Software User Guide Revision 1read.pudn.com/downloads365/ebook/1585622/WPCE775x_UG_1.0.pdf · 2.1.2...

Documents

Transcript of Software User Guide Revision 1read.pudn.com/downloads365/ebook/1585622/WPCE775x_UG_1.0.pdf · 2.1.2...