2 * Copyright (c) 2011-12 The Chromium OS Authors.
4 * SPDX-License-Identifier: GPL-2.0+
6 * This file is derived from the flashrom project.
19 #define SPI_OPCODE_WREN 0x06
20 #define SPI_OPCODE_FAST_READ 0x0b
23 pci_dev_t dev
; /* PCI device number */
24 int ich_version
; /* Controller version, 7 or 9 */
25 bool use_sbase
; /* Use SBASE instead of RCB */
30 void *base
; /* Base of register set */
39 uint32_t *pr
; /* only for ich9 */
40 uint8_t *speed
; /* pointer to speed control */
41 ulong max_speed
; /* Maximum bus speed in MHz */
46 static inline struct ich_spi_slave
*to_ich_spi(struct spi_slave
*slave
)
48 return container_of(slave
, struct ich_spi_slave
, slave
);
51 static unsigned int ich_reg(const void *addr
)
53 return (unsigned)(addr
- ctlr
.base
) & 0xffff;
56 static u8
ich_readb(const void *addr
)
58 u8 value
= readb(addr
);
60 debug("read %2.2x from %4.4x\n", value
, ich_reg(addr
));
65 static u16
ich_readw(const void *addr
)
67 u16 value
= readw(addr
);
69 debug("read %4.4x from %4.4x\n", value
, ich_reg(addr
));
74 static u32
ich_readl(const void *addr
)
76 u32 value
= readl(addr
);
78 debug("read %8.8x from %4.4x\n", value
, ich_reg(addr
));
83 static void ich_writeb(u8 value
, void *addr
)
86 debug("wrote %2.2x to %4.4x\n", value
, ich_reg(addr
));
89 static void ich_writew(u16 value
, void *addr
)
92 debug("wrote %4.4x to %4.4x\n", value
, ich_reg(addr
));
95 static void ich_writel(u32 value
, void *addr
)
98 debug("wrote %8.8x to %4.4x\n", value
, ich_reg(addr
));
101 static void write_reg(const void *value
, void *dest
, uint32_t size
)
103 memcpy_toio(dest
, value
, size
);
106 static void read_reg(const void *src
, void *value
, uint32_t size
)
108 memcpy_fromio(value
, src
, size
);
111 static void ich_set_bbar(struct ich_ctlr
*ctlr
, uint32_t minaddr
)
113 const uint32_t bbar_mask
= 0x00ffff00;
114 uint32_t ichspi_bbar
;
116 minaddr
&= bbar_mask
;
117 ichspi_bbar
= ich_readl(ctlr
->bbar
) & ~bbar_mask
;
118 ichspi_bbar
|= minaddr
;
119 ich_writel(ichspi_bbar
, ctlr
->bbar
);
122 int spi_cs_is_valid(unsigned int bus
, unsigned int cs
)
124 puts("spi_cs_is_valid used but not implemented\n");
128 struct spi_slave
*spi_setup_slave(unsigned int bus
, unsigned int cs
,
129 unsigned int max_hz
, unsigned int mode
)
131 struct ich_spi_slave
*ich
;
133 ich
= spi_alloc_slave(struct ich_spi_slave
, bus
, cs
);
135 puts("ICH SPI: Out of memory\n");
140 * Yes this controller can only write a small number of bytes at
141 * once! The limit is typically 64 bytes.
143 ich
->slave
.max_write_size
= ctlr
.databytes
;
147 * ICH 7 SPI controller only supports array read command
148 * and byte program command for SST flash
150 if (ctlr
.ich_version
== 7 || ctlr
.use_sbase
) {
151 ich
->slave
.op_mode_rx
= SPI_OPM_RX_AS
;
152 ich
->slave
.op_mode_tx
= SPI_OPM_TX_BP
;
158 struct spi_slave
*spi_setup_slave_fdt(const void *blob
, int slave_node
,
161 /* We only support a single SPI at present */
162 return spi_setup_slave(0, 0, 20000000, 0);
165 void spi_free_slave(struct spi_slave
*slave
)
167 struct ich_spi_slave
*ich
= to_ich_spi(slave
);
173 * Check if this device ID matches one of supported Intel PCH devices.
175 * Return the ICH version if there is a match, or zero otherwise.
177 static int get_ich_version(uint16_t device_id
)
179 if (device_id
== PCI_DEVICE_ID_INTEL_TGP_LPC
||
180 device_id
== PCI_DEVICE_ID_INTEL_ITC_LPC
||
181 device_id
== PCI_DEVICE_ID_INTEL_QRK_ILB
)
184 if ((device_id
>= PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MIN
&&
185 device_id
<= PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MAX
) ||
186 (device_id
>= PCI_DEVICE_ID_INTEL_PANTHERPOINT_LPC_MIN
&&
187 device_id
<= PCI_DEVICE_ID_INTEL_PANTHERPOINT_LPC_MAX
) ||
188 device_id
== PCI_DEVICE_ID_INTEL_VALLEYVIEW_LPC
)
194 /* @return 1 if the SPI flash supports the 33MHz speed */
195 static int ich9_can_do_33mhz(pci_dev_t dev
)
199 /* Observe SPI Descriptor Component Section 0 */
200 pci_write_config_dword(dev
, 0xb0, 0x1000);
202 /* Extract the Write/Erase SPI Frequency from descriptor */
203 pci_read_config_dword(dev
, 0xb4, &fdod
);
205 /* Bits 23:21 have the fast read clock frequency, 0=20MHz, 1=33MHz */
206 speed
= (fdod
>> 21) & 7;
211 static int ich_find_spi_controller(struct ich_ctlr
*ich
)
213 int last_bus
= pci_last_busno();
216 if (last_bus
== -1) {
217 debug("No PCI busses?\n");
221 for (bus
= 0; bus
<= last_bus
; bus
++) {
222 uint16_t vendor_id
, device_id
;
226 dev
= PCI_BDF(bus
, 31, 0);
227 pci_read_config_dword(dev
, 0, &ids
);
229 device_id
= ids
>> 16;
231 if (vendor_id
== PCI_VENDOR_ID_INTEL
) {
233 ich
->ich_version
= get_ich_version(device_id
);
234 if (device_id
== PCI_DEVICE_ID_INTEL_VALLEYVIEW_LPC
)
235 ich
->use_sbase
= true;
236 return ich
->ich_version
== 0 ? -ENODEV
: 0;
240 debug("ICH SPI: No ICH found.\n");
244 static int ich_init_controller(struct ich_ctlr
*ctlr
)
246 uint8_t *rcrb
; /* Root Complex Register Block */
247 uint32_t rcba
; /* Root Complex Base Address */
251 pci_read_config_dword(ctlr
->dev
, 0xf0, &rcba
);
252 /* Bits 31-14 are the base address, 13-1 are reserved, 0 is enable. */
253 rcrb
= (uint8_t *)(rcba
& 0xffffc000);
255 /* SBASE is similar */
256 pci_read_config_dword(ctlr
->dev
, 0x54, &sbase_addr
);
257 sbase
= (uint8_t *)(sbase_addr
& 0xfffffe00);
259 if (ctlr
->ich_version
== 7) {
260 struct ich7_spi_regs
*ich7_spi
;
262 ich7_spi
= (struct ich7_spi_regs
*)(rcrb
+ 0x3020);
263 ctlr
->ichspi_lock
= ich_readw(&ich7_spi
->spis
) & SPIS_LOCK
;
264 ctlr
->opmenu
= ich7_spi
->opmenu
;
265 ctlr
->menubytes
= sizeof(ich7_spi
->opmenu
);
266 ctlr
->optype
= &ich7_spi
->optype
;
267 ctlr
->addr
= &ich7_spi
->spia
;
268 ctlr
->data
= (uint8_t *)ich7_spi
->spid
;
269 ctlr
->databytes
= sizeof(ich7_spi
->spid
);
270 ctlr
->status
= (uint8_t *)&ich7_spi
->spis
;
271 ctlr
->control
= &ich7_spi
->spic
;
272 ctlr
->bbar
= &ich7_spi
->bbar
;
273 ctlr
->preop
= &ich7_spi
->preop
;
274 ctlr
->base
= ich7_spi
;
275 } else if (ctlr
->ich_version
== 9) {
276 struct ich9_spi_regs
*ich9_spi
;
279 ich9_spi
= (struct ich9_spi_regs
*)sbase
;
281 ich9_spi
= (struct ich9_spi_regs
*)(rcrb
+ 0x3800);
282 ctlr
->ichspi_lock
= ich_readw(&ich9_spi
->hsfs
) & HSFS_FLOCKDN
;
283 ctlr
->opmenu
= ich9_spi
->opmenu
;
284 ctlr
->menubytes
= sizeof(ich9_spi
->opmenu
);
285 ctlr
->optype
= &ich9_spi
->optype
;
286 ctlr
->addr
= &ich9_spi
->faddr
;
287 ctlr
->data
= (uint8_t *)ich9_spi
->fdata
;
288 ctlr
->databytes
= sizeof(ich9_spi
->fdata
);
289 ctlr
->status
= &ich9_spi
->ssfs
;
290 ctlr
->control
= (uint16_t *)ich9_spi
->ssfc
;
291 ctlr
->speed
= ich9_spi
->ssfc
+ 2;
292 ctlr
->bbar
= &ich9_spi
->bbar
;
293 ctlr
->preop
= &ich9_spi
->preop
;
294 ctlr
->pr
= &ich9_spi
->pr
[0];
295 ctlr
->base
= ich9_spi
;
297 debug("ICH SPI: Unrecognized ICH version %d.\n",
302 /* Work out the maximum speed we can support */
303 ctlr
->max_speed
= 20000000;
304 if (ctlr
->ich_version
== 9 && ich9_can_do_33mhz(ctlr
->dev
))
305 ctlr
->max_speed
= 33000000;
306 debug("ICH SPI: Version %d detected at %p, speed %ld\n",
307 ctlr
->ich_version
, ctlr
->base
, ctlr
->max_speed
);
309 ich_set_bbar(ctlr
, 0);
318 if (ich_find_spi_controller(&ctlr
)) {
319 printf("ICH SPI: Cannot find device\n");
323 if (ich_init_controller(&ctlr
)) {
324 printf("ICH SPI: Cannot setup controller\n");
329 * Disable the BIOS write protect so write commands are allowed. On
330 * v9, deassert SMM BIOS Write Protect Disable.
332 if (ctlr
.use_sbase
) {
333 struct ich9_spi_regs
*ich9_spi
;
335 ich9_spi
= (struct ich9_spi_regs
*)ctlr
.base
;
336 bios_cntl
= ich_readb(&ich9_spi
->bcr
);
337 bios_cntl
&= ~(1 << 5); /* clear Enable InSMM_STS (EISS) */
338 bios_cntl
|= 1; /* Write Protect Disable (WPD) */
339 ich_writeb(bios_cntl
, &ich9_spi
->bcr
);
341 pci_read_config_byte(ctlr
.dev
, 0xdc, &bios_cntl
);
342 if (ctlr
.ich_version
== 9)
343 bios_cntl
&= ~(1 << 5);
344 pci_write_config_byte(ctlr
.dev
, 0xdc, bios_cntl
| 0x1);
348 int spi_claim_bus(struct spi_slave
*slave
)
350 /* Handled by ICH automatically. */
354 void spi_release_bus(struct spi_slave
*slave
)
356 /* Handled by ICH automatically. */
359 void spi_cs_activate(struct spi_slave
*slave
)
361 /* Handled by ICH automatically. */
364 void spi_cs_deactivate(struct spi_slave
*slave
)
366 /* Handled by ICH automatically. */
369 static inline void spi_use_out(struct spi_trans
*trans
, unsigned bytes
)
372 trans
->bytesout
-= bytes
;
375 static inline void spi_use_in(struct spi_trans
*trans
, unsigned bytes
)
378 trans
->bytesin
-= bytes
;
381 static void spi_setup_type(struct spi_trans
*trans
, int data_bytes
)
385 /* Try to guess spi type from read/write sizes. */
386 if (trans
->bytesin
== 0) {
387 if (trans
->bytesout
+ data_bytes
> 4)
389 * If bytesin = 0 and bytesout > 4, we presume this is
390 * a write data operation, which is accompanied by an
393 trans
->type
= SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS
;
395 trans
->type
= SPI_OPCODE_TYPE_WRITE_NO_ADDRESS
;
399 if (trans
->bytesout
== 1) { /* and bytesin is > 0 */
400 trans
->type
= SPI_OPCODE_TYPE_READ_NO_ADDRESS
;
404 if (trans
->bytesout
== 4) /* and bytesin is > 0 */
405 trans
->type
= SPI_OPCODE_TYPE_READ_WITH_ADDRESS
;
407 /* Fast read command is called with 5 bytes instead of 4 */
408 if (trans
->out
[0] == SPI_OPCODE_FAST_READ
&& trans
->bytesout
== 5) {
409 trans
->type
= SPI_OPCODE_TYPE_READ_WITH_ADDRESS
;
414 static int spi_setup_opcode(struct spi_trans
*trans
)
417 uint8_t opmenu
[ctlr
.menubytes
];
419 trans
->opcode
= trans
->out
[0];
420 spi_use_out(trans
, 1);
421 if (!ctlr
.ichspi_lock
) {
422 /* The lock is off, so just use index 0. */
423 ich_writeb(trans
->opcode
, ctlr
.opmenu
);
424 optypes
= ich_readw(ctlr
.optype
);
425 optypes
= (optypes
& 0xfffc) | (trans
->type
& 0x3);
426 ich_writew(optypes
, ctlr
.optype
);
429 /* The lock is on. See if what we need is on the menu. */
431 uint16_t opcode_index
;
433 /* Write Enable is handled as atomic prefix */
434 if (trans
->opcode
== SPI_OPCODE_WREN
)
437 read_reg(ctlr
.opmenu
, opmenu
, sizeof(opmenu
));
438 for (opcode_index
= 0; opcode_index
< ctlr
.menubytes
;
440 if (opmenu
[opcode_index
] == trans
->opcode
)
444 if (opcode_index
== ctlr
.menubytes
) {
445 printf("ICH SPI: Opcode %x not found\n",
450 optypes
= ich_readw(ctlr
.optype
);
451 optype
= (optypes
>> (opcode_index
* 2)) & 0x3;
452 if (trans
->type
== SPI_OPCODE_TYPE_WRITE_NO_ADDRESS
&&
453 optype
== SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS
&&
454 trans
->bytesout
>= 3) {
455 /* We guessed wrong earlier. Fix it up. */
456 trans
->type
= optype
;
458 if (optype
!= trans
->type
) {
459 printf("ICH SPI: Transaction doesn't fit type %d\n",
467 static int spi_setup_offset(struct spi_trans
*trans
)
469 /* Separate the SPI address and data. */
470 switch (trans
->type
) {
471 case SPI_OPCODE_TYPE_READ_NO_ADDRESS
:
472 case SPI_OPCODE_TYPE_WRITE_NO_ADDRESS
:
474 case SPI_OPCODE_TYPE_READ_WITH_ADDRESS
:
475 case SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS
:
476 trans
->offset
= ((uint32_t)trans
->out
[0] << 16) |
477 ((uint32_t)trans
->out
[1] << 8) |
478 ((uint32_t)trans
->out
[2] << 0);
479 spi_use_out(trans
, 3);
482 printf("Unrecognized SPI transaction type %#x\n", trans
->type
);
488 * Wait for up to 6s til status register bit(s) turn 1 (in case wait_til_set
489 * below is true) or 0. In case the wait was for the bit(s) to set - write
490 * those bits back, which would cause resetting them.
492 * Return the last read status value on success or -1 on failure.
494 static int ich_status_poll(u16 bitmask
, int wait_til_set
)
496 int timeout
= 600000; /* This will result in 6s */
500 status
= ich_readw(ctlr
.status
);
501 if (wait_til_set
^ ((status
& bitmask
) == 0)) {
503 ich_writew((status
& bitmask
), ctlr
.status
);
509 printf("ICH SPI: SCIP timeout, read %x, expected %x\n",
515 int spi_xfer(struct spi_slave *slave, const void *dout,
516 unsigned int bitsout, void *din, unsigned int bitsin)
518 int spi_xfer(struct spi_slave
*slave
, unsigned int bitlen
, const void *dout
,
519 void *din
, unsigned long flags
)
521 struct ich_spi_slave
*ich
= to_ich_spi(slave
);
523 int16_t opcode_index
;
526 int bytes
= bitlen
/ 8;
527 struct spi_trans
*trans
= &ich
->trans
;
528 unsigned type
= flags
& (SPI_XFER_BEGIN
| SPI_XFER_END
);
531 /* Ee don't support writing partial bytes. */
533 debug("ICH SPI: Accessing partial bytes not supported\n");
537 /* An empty end transaction can be ignored */
538 if (type
== SPI_XFER_END
&& !dout
&& !din
)
541 if (type
& SPI_XFER_BEGIN
)
542 memset(trans
, '\0', sizeof(*trans
));
544 /* Dp we need to come back later to finish it? */
545 if (dout
&& type
== SPI_XFER_BEGIN
) {
546 if (bytes
> ICH_MAX_CMD_LEN
) {
547 debug("ICH SPI: Command length limit exceeded\n");
550 memcpy(trans
->cmd
, dout
, bytes
);
551 trans
->cmd_len
= bytes
;
552 debug("ICH SPI: Saved %d bytes\n", bytes
);
557 * We process a 'middle' spi_xfer() call, which has no
558 * SPI_XFER_BEGIN/END, as an independent transaction as if it had
559 * an end. We therefore repeat the command. This is because ICH
560 * seems to have no support for this, or because interest (in digging
561 * out the details and creating a special case in the code) is low.
563 if (trans
->cmd_len
) {
564 trans
->out
= trans
->cmd
;
565 trans
->bytesout
= trans
->cmd_len
;
567 debug("ICH SPI: Using %d bytes\n", trans
->cmd_len
);
570 trans
->bytesout
= dout
? bytes
: 0;
574 trans
->bytesin
= din
? bytes
: 0;
576 /* There has to always at least be an opcode. */
577 if (!trans
->bytesout
) {
578 debug("ICH SPI: No opcode for transfer\n");
582 if (ich_status_poll(SPIS_SCIP
, 0) == -1)
585 ich_writew(SPIS_CDS
| SPIS_FCERR
, ctlr
.status
);
587 spi_setup_type(trans
, using_cmd
? bytes
: 0);
588 opcode_index
= spi_setup_opcode(trans
);
589 if (opcode_index
< 0)
591 with_address
= spi_setup_offset(trans
);
592 if (with_address
< 0)
595 if (trans
->opcode
== SPI_OPCODE_WREN
) {
597 * Treat Write Enable as Atomic Pre-Op if possible
598 * in order to prevent the Management Engine from
599 * issuing a transaction between WREN and DATA.
601 if (!ctlr
.ichspi_lock
)
602 ich_writew(trans
->opcode
, ctlr
.preop
);
606 if (ctlr
.speed
&& ctlr
.max_speed
>= 33000000) {
609 byte
= ich_readb(ctlr
.speed
);
610 if (ich
->speed
>= 33000000)
611 byte
|= SSFC_SCF_33MHZ
;
613 byte
&= ~SSFC_SCF_33MHZ
;
614 ich_writeb(byte
, ctlr
.speed
);
617 /* See if we have used up the command data */
618 if (using_cmd
&& dout
&& bytes
) {
620 trans
->bytesout
= bytes
;
621 debug("ICH SPI: Moving to data, %d bytes\n", bytes
);
624 /* Preset control fields */
625 control
= ich_readw(ctlr
.control
);
626 control
&= ~SSFC_RESERVED
;
627 control
= SPIC_SCGO
| ((opcode_index
& 0x07) << 4);
629 /* Issue atomic preop cycle if needed */
630 if (ich_readw(ctlr
.preop
))
633 if (!trans
->bytesout
&& !trans
->bytesin
) {
634 /* SPI addresses are 24 bit only */
636 ich_writel(trans
->offset
& 0x00FFFFFF, ctlr
.addr
);
639 * This is a 'no data' command (like Write Enable), its
640 * bitesout size was 1, decremented to zero while executing
641 * spi_setup_opcode() above. Tell the chip to send the
644 ich_writew(control
, ctlr
.control
);
646 /* wait for the result */
647 status
= ich_status_poll(SPIS_CDS
| SPIS_FCERR
, 1);
651 if (status
& SPIS_FCERR
) {
652 debug("ICH SPI: Command transaction error\n");
660 * Check if this is a write command atempting to transfer more bytes
661 * than the controller can handle. Iterations for writes are not
662 * supported here because each SPI write command needs to be preceded
663 * and followed by other SPI commands, and this sequence is controlled
664 * by the SPI chip driver.
666 if (trans
->bytesout
> ctlr
.databytes
) {
667 debug("ICH SPI: Too much to write. This should be prevented by the driver's max_write_size?\n");
672 * Read or write up to databytes bytes at a time until everything has
675 while (trans
->bytesout
|| trans
->bytesin
) {
676 uint32_t data_length
;
678 /* SPI addresses are 24 bit only */
679 ich_writel(trans
->offset
& 0x00FFFFFF, ctlr
.addr
);
682 data_length
= min(trans
->bytesout
, ctlr
.databytes
);
684 data_length
= min(trans
->bytesin
, ctlr
.databytes
);
686 /* Program data into FDATA0 to N */
687 if (trans
->bytesout
) {
688 write_reg(trans
->out
, ctlr
.data
, data_length
);
689 spi_use_out(trans
, data_length
);
691 trans
->offset
+= data_length
;
694 /* Add proper control fields' values */
695 control
&= ~((ctlr
.databytes
- 1) << 8);
697 control
|= (data_length
- 1) << 8;
700 ich_writew(control
, ctlr
.control
);
702 /* Wait for Cycle Done Status or Flash Cycle Error. */
703 status
= ich_status_poll(SPIS_CDS
| SPIS_FCERR
, 1);
707 if (status
& SPIS_FCERR
) {
708 debug("ICH SPI: Data transaction error\n");
712 if (trans
->bytesin
) {
713 read_reg(ctlr
.data
, trans
->in
, data_length
);
714 spi_use_in(trans
, data_length
);
716 trans
->offset
+= data_length
;
720 /* Clear atomic preop now that xfer is done */
721 ich_writew(0, ctlr
.preop
);
728 * This uses the SPI controller from the Intel Cougar Point and Panther Point
729 * PCH to write-protect portions of the SPI flash until reboot. The changes
730 * don't actually take effect until the HSFS[FLOCKDN] bit is set, but that's
733 int spi_write_protect_region(uint32_t lower_limit
, uint32_t length
, int hint
)
736 uint32_t upper_limit
;
739 printf("%s: operation not supported on this chipset\n",
745 lower_limit
> (0xFFFFFFFFUL
- length
) + 1 ||
746 hint
< 0 || hint
> 4) {
747 printf("%s(0x%x, 0x%x, %d): invalid args\n", __func__
,
748 lower_limit
, length
, hint
);
752 upper_limit
= lower_limit
+ length
- 1;
755 * Determine bits to write, as follows:
756 * 31 Write-protection enable (includes erase operation)
758 * 28:16 Upper Limit (FLA address bits 24:12, with 11:0 == 0xfff)
759 * 15 Read-protection enable
761 * 12:0 Lower Limit (FLA address bits 24:12, with 11:0 == 0x000)
763 tmplong
= 0x80000000 |
764 ((upper_limit
& 0x01fff000) << 4) |
765 ((lower_limit
& 0x01fff000) >> 12);
767 printf("%s: writing 0x%08x to %p\n", __func__
, tmplong
,
769 ctlr
.pr
[hint
] = tmplong
;