2 * Copyright (c) 2011-12 The Chromium OS Authors.
4 * SPDX-License-Identifier: GPL-2.0+
6 * This file is derived from the flashrom project.
18 #define SPI_OPCODE_WREN 0x06
19 #define SPI_OPCODE_FAST_READ 0x0b
22 pci_dev_t dev; /* PCI device number */
23 int ich_version; /* Controller version, 7 or 9 */
28 void *base; /* Base of register set */
37 uint32_t *pr; /* only for ich9 */
38 uint8_t *speed; /* pointer to speed control */
39 ulong max_speed; /* Maximum bus speed in MHz */
44 static inline struct ich_spi_slave *to_ich_spi(struct spi_slave *slave)
46 return container_of(slave, struct ich_spi_slave, slave);
49 static unsigned int ich_reg(const void *addr)
51 return (unsigned)(addr - ctlr.base) & 0xffff;
54 static u8 ich_readb(const void *addr)
56 u8 value = readb(addr);
58 debug("read %2.2x from %4.4x\n", value, ich_reg(addr));
63 static u16 ich_readw(const void *addr)
65 u16 value = readw(addr);
67 debug("read %4.4x from %4.4x\n", value, ich_reg(addr));
72 static u32 ich_readl(const void *addr)
74 u32 value = readl(addr);
76 debug("read %8.8x from %4.4x\n", value, ich_reg(addr));
81 static void ich_writeb(u8 value, void *addr)
84 debug("wrote %2.2x to %4.4x\n", value, ich_reg(addr));
87 static void ich_writew(u16 value, void *addr)
90 debug("wrote %4.4x to %4.4x\n", value, ich_reg(addr));
93 static void ich_writel(u32 value, void *addr)
96 debug("wrote %8.8x to %4.4x\n", value, ich_reg(addr));
99 static void write_reg(const void *value, void *dest, uint32_t size)
101 memcpy_toio(dest, value, size);
104 static void read_reg(const void *src, void *value, uint32_t size)
106 memcpy_fromio(value, src, size);
109 static void ich_set_bbar(struct ich_ctlr *ctlr, uint32_t minaddr)
111 const uint32_t bbar_mask = 0x00ffff00;
112 uint32_t ichspi_bbar;
114 minaddr &= bbar_mask;
115 ichspi_bbar = ich_readl(ctlr->bbar) & ~bbar_mask;
116 ichspi_bbar |= minaddr;
117 ich_writel(ichspi_bbar, ctlr->bbar);
120 int spi_cs_is_valid(unsigned int bus, unsigned int cs)
122 puts("spi_cs_is_valid used but not implemented\n");
126 struct spi_slave *spi_setup_slave(unsigned int bus, unsigned int cs,
127 unsigned int max_hz, unsigned int mode)
129 struct ich_spi_slave *ich;
131 ich = spi_alloc_slave(struct ich_spi_slave, bus, cs);
133 puts("ICH SPI: Out of memory\n");
138 * Yes this controller can only write a small number of bytes at
139 * once! The limit is typically 64 bytes.
141 ich->slave.max_write_size = ctlr.databytes;
145 * ICH 7 SPI controller only supports array read command
146 * and byte program command for SST flash
148 if (ctlr.ich_version == 7) {
149 ich->slave.op_mode_rx = SPI_OPM_RX_AS;
150 ich->slave.op_mode_tx = SPI_OPM_TX_BP;
156 struct spi_slave *spi_setup_slave_fdt(const void *blob, int slave_node,
159 /* We only support a single SPI at present */
160 return spi_setup_slave(0, 0, 20000000, 0);
163 void spi_free_slave(struct spi_slave *slave)
165 struct ich_spi_slave *ich = to_ich_spi(slave);
171 * Check if this device ID matches one of supported Intel PCH devices.
173 * Return the ICH version if there is a match, or zero otherwise.
175 static int get_ich_version(uint16_t device_id)
177 if (device_id == PCI_DEVICE_ID_INTEL_TGP_LPC ||
178 device_id == PCI_DEVICE_ID_INTEL_ITC_LPC)
181 if ((device_id >= PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MIN &&
182 device_id <= PCI_DEVICE_ID_INTEL_COUGARPOINT_LPC_MAX) ||
183 (device_id >= PCI_DEVICE_ID_INTEL_PANTHERPOINT_LPC_MIN &&
184 device_id <= PCI_DEVICE_ID_INTEL_PANTHERPOINT_LPC_MAX))
190 /* @return 1 if the SPI flash supports the 33MHz speed */
191 static int ich9_can_do_33mhz(pci_dev_t dev)
195 /* Observe SPI Descriptor Component Section 0 */
196 pci_write_config_dword(dev, 0xb0, 0x1000);
198 /* Extract the Write/Erase SPI Frequency from descriptor */
199 pci_read_config_dword(dev, 0xb4, &fdod);
201 /* Bits 23:21 have the fast read clock frequency, 0=20MHz, 1=33MHz */
202 speed = (fdod >> 21) & 7;
207 static int ich_find_spi_controller(pci_dev_t *devp, int *ich_versionp)
209 int last_bus = pci_last_busno();
212 if (last_bus == -1) {
213 debug("No PCI busses?\n");
217 for (bus = 0; bus <= last_bus; bus++) {
218 uint16_t vendor_id, device_id;
222 dev = PCI_BDF(bus, 31, 0);
223 pci_read_config_dword(dev, 0, &ids);
225 device_id = ids >> 16;
227 if (vendor_id == PCI_VENDOR_ID_INTEL) {
229 *ich_versionp = get_ich_version(device_id);
234 debug("ICH SPI: No ICH found.\n");
238 static int ich_init_controller(struct ich_ctlr *ctlr)
240 uint8_t *rcrb; /* Root Complex Register Block */
241 uint32_t rcba; /* Root Complex Base Address */
243 pci_read_config_dword(ctlr->dev, 0xf0, &rcba);
244 /* Bits 31-14 are the base address, 13-1 are reserved, 0 is enable. */
245 rcrb = (uint8_t *)(rcba & 0xffffc000);
246 if (ctlr->ich_version == 7) {
247 struct ich7_spi_regs *ich7_spi;
249 ich7_spi = (struct ich7_spi_regs *)(rcrb + 0x3020);
250 ctlr->ichspi_lock = ich_readw(&ich7_spi->spis) & SPIS_LOCK;
251 ctlr->opmenu = ich7_spi->opmenu;
252 ctlr->menubytes = sizeof(ich7_spi->opmenu);
253 ctlr->optype = &ich7_spi->optype;
254 ctlr->addr = &ich7_spi->spia;
255 ctlr->data = (uint8_t *)ich7_spi->spid;
256 ctlr->databytes = sizeof(ich7_spi->spid);
257 ctlr->status = (uint8_t *)&ich7_spi->spis;
258 ctlr->control = &ich7_spi->spic;
259 ctlr->bbar = &ich7_spi->bbar;
260 ctlr->preop = &ich7_spi->preop;
261 ctlr->base = ich7_spi;
262 } else if (ctlr->ich_version == 9) {
263 struct ich9_spi_regs *ich9_spi;
265 ich9_spi = (struct ich9_spi_regs *)(rcrb + 0x3800);
266 ctlr->ichspi_lock = ich_readw(&ich9_spi->hsfs) & HSFS_FLOCKDN;
267 ctlr->opmenu = ich9_spi->opmenu;
268 ctlr->menubytes = sizeof(ich9_spi->opmenu);
269 ctlr->optype = &ich9_spi->optype;
270 ctlr->addr = &ich9_spi->faddr;
271 ctlr->data = (uint8_t *)ich9_spi->fdata;
272 ctlr->databytes = sizeof(ich9_spi->fdata);
273 ctlr->status = &ich9_spi->ssfs;
274 ctlr->control = (uint16_t *)ich9_spi->ssfc;
275 ctlr->speed = ich9_spi->ssfc + 2;
276 ctlr->bbar = &ich9_spi->bbar;
277 ctlr->preop = &ich9_spi->preop;
278 ctlr->pr = &ich9_spi->pr[0];
279 ctlr->base = ich9_spi;
281 debug("ICH SPI: Unrecognized ICH version %d.\n",
285 debug("ICH SPI: Version %d detected\n", ctlr->ich_version);
287 /* Work out the maximum speed we can support */
288 ctlr->max_speed = 20000000;
289 if (ctlr->ich_version == 9 && ich9_can_do_33mhz(ctlr->dev))
290 ctlr->max_speed = 33000000;
292 ich_set_bbar(ctlr, 0);
301 if (ich_find_spi_controller(&ctlr.dev, &ctlr.ich_version)) {
302 printf("ICH SPI: Cannot find device\n");
306 if (ich_init_controller(&ctlr)) {
307 printf("ICH SPI: Cannot setup controller\n");
312 * Disable the BIOS write protect so write commands are allowed. On
313 * v9, deassert SMM BIOS Write Protect Disable.
315 pci_read_config_byte(ctlr.dev, 0xdc, &bios_cntl);
316 if (ctlr.ich_version == 9)
317 bios_cntl &= ~(1 << 5);
318 pci_write_config_byte(ctlr.dev, 0xdc, bios_cntl | 0x1);
321 int spi_claim_bus(struct spi_slave *slave)
323 /* Handled by ICH automatically. */
327 void spi_release_bus(struct spi_slave *slave)
329 /* Handled by ICH automatically. */
332 void spi_cs_activate(struct spi_slave *slave)
334 /* Handled by ICH automatically. */
337 void spi_cs_deactivate(struct spi_slave *slave)
339 /* Handled by ICH automatically. */
342 static inline void spi_use_out(struct spi_trans *trans, unsigned bytes)
345 trans->bytesout -= bytes;
348 static inline void spi_use_in(struct spi_trans *trans, unsigned bytes)
351 trans->bytesin -= bytes;
354 static void spi_setup_type(struct spi_trans *trans, int data_bytes)
358 /* Try to guess spi type from read/write sizes. */
359 if (trans->bytesin == 0) {
360 if (trans->bytesout + data_bytes > 4)
362 * If bytesin = 0 and bytesout > 4, we presume this is
363 * a write data operation, which is accompanied by an
366 trans->type = SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS;
368 trans->type = SPI_OPCODE_TYPE_WRITE_NO_ADDRESS;
372 if (trans->bytesout == 1) { /* and bytesin is > 0 */
373 trans->type = SPI_OPCODE_TYPE_READ_NO_ADDRESS;
377 if (trans->bytesout == 4) /* and bytesin is > 0 */
378 trans->type = SPI_OPCODE_TYPE_READ_WITH_ADDRESS;
380 /* Fast read command is called with 5 bytes instead of 4 */
381 if (trans->out[0] == SPI_OPCODE_FAST_READ && trans->bytesout == 5) {
382 trans->type = SPI_OPCODE_TYPE_READ_WITH_ADDRESS;
387 static int spi_setup_opcode(struct spi_trans *trans)
390 uint8_t opmenu[ctlr.menubytes];
392 trans->opcode = trans->out[0];
393 spi_use_out(trans, 1);
394 if (!ctlr.ichspi_lock) {
395 /* The lock is off, so just use index 0. */
396 ich_writeb(trans->opcode, ctlr.opmenu);
397 optypes = ich_readw(ctlr.optype);
398 optypes = (optypes & 0xfffc) | (trans->type & 0x3);
399 ich_writew(optypes, ctlr.optype);
402 /* The lock is on. See if what we need is on the menu. */
404 uint16_t opcode_index;
406 /* Write Enable is handled as atomic prefix */
407 if (trans->opcode == SPI_OPCODE_WREN)
410 read_reg(ctlr.opmenu, opmenu, sizeof(opmenu));
411 for (opcode_index = 0; opcode_index < ctlr.menubytes;
413 if (opmenu[opcode_index] == trans->opcode)
417 if (opcode_index == ctlr.menubytes) {
418 printf("ICH SPI: Opcode %x not found\n",
423 optypes = ich_readw(ctlr.optype);
424 optype = (optypes >> (opcode_index * 2)) & 0x3;
425 if (trans->type == SPI_OPCODE_TYPE_WRITE_NO_ADDRESS &&
426 optype == SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS &&
427 trans->bytesout >= 3) {
428 /* We guessed wrong earlier. Fix it up. */
429 trans->type = optype;
431 if (optype != trans->type) {
432 printf("ICH SPI: Transaction doesn't fit type %d\n",
440 static int spi_setup_offset(struct spi_trans *trans)
442 /* Separate the SPI address and data. */
443 switch (trans->type) {
444 case SPI_OPCODE_TYPE_READ_NO_ADDRESS:
445 case SPI_OPCODE_TYPE_WRITE_NO_ADDRESS:
447 case SPI_OPCODE_TYPE_READ_WITH_ADDRESS:
448 case SPI_OPCODE_TYPE_WRITE_WITH_ADDRESS:
449 trans->offset = ((uint32_t)trans->out[0] << 16) |
450 ((uint32_t)trans->out[1] << 8) |
451 ((uint32_t)trans->out[2] << 0);
452 spi_use_out(trans, 3);
455 printf("Unrecognized SPI transaction type %#x\n", trans->type);
461 * Wait for up to 6s til status register bit(s) turn 1 (in case wait_til_set
462 * below is true) or 0. In case the wait was for the bit(s) to set - write
463 * those bits back, which would cause resetting them.
465 * Return the last read status value on success or -1 on failure.
467 static int ich_status_poll(u16 bitmask, int wait_til_set)
469 int timeout = 600000; /* This will result in 6s */
473 status = ich_readw(ctlr.status);
474 if (wait_til_set ^ ((status & bitmask) == 0)) {
476 ich_writew((status & bitmask), ctlr.status);
482 printf("ICH SPI: SCIP timeout, read %x, expected %x\n",
488 int spi_xfer(struct spi_slave *slave, const void *dout,
489 unsigned int bitsout, void *din, unsigned int bitsin)
491 int spi_xfer(struct spi_slave *slave, unsigned int bitlen, const void *dout,
492 void *din, unsigned long flags)
494 struct ich_spi_slave *ich = to_ich_spi(slave);
496 int16_t opcode_index;
499 int bytes = bitlen / 8;
500 struct spi_trans *trans = &ich->trans;
501 unsigned type = flags & (SPI_XFER_BEGIN | SPI_XFER_END);
504 /* Ee don't support writing partial bytes. */
506 debug("ICH SPI: Accessing partial bytes not supported\n");
510 /* An empty end transaction can be ignored */
511 if (type == SPI_XFER_END && !dout && !din)
514 if (type & SPI_XFER_BEGIN)
515 memset(trans, '\0', sizeof(*trans));
517 /* Dp we need to come back later to finish it? */
518 if (dout && type == SPI_XFER_BEGIN) {
519 if (bytes > ICH_MAX_CMD_LEN) {
520 debug("ICH SPI: Command length limit exceeded\n");
523 memcpy(trans->cmd, dout, bytes);
524 trans->cmd_len = bytes;
525 debug("ICH SPI: Saved %d bytes\n", bytes);
530 * We process a 'middle' spi_xfer() call, which has no
531 * SPI_XFER_BEGIN/END, as an independent transaction as if it had
532 * an end. We therefore repeat the command. This is because ICH
533 * seems to have no support for this, or because interest (in digging
534 * out the details and creating a special case in the code) is low.
536 if (trans->cmd_len) {
537 trans->out = trans->cmd;
538 trans->bytesout = trans->cmd_len;
540 debug("ICH SPI: Using %d bytes\n", trans->cmd_len);
543 trans->bytesout = dout ? bytes : 0;
547 trans->bytesin = din ? bytes : 0;
549 /* There has to always at least be an opcode. */
550 if (!trans->bytesout) {
551 debug("ICH SPI: No opcode for transfer\n");
555 if (ich_status_poll(SPIS_SCIP, 0) == -1)
558 ich_writew(SPIS_CDS | SPIS_FCERR, ctlr.status);
560 spi_setup_type(trans, using_cmd ? bytes : 0);
561 opcode_index = spi_setup_opcode(trans);
562 if (opcode_index < 0)
564 with_address = spi_setup_offset(trans);
565 if (with_address < 0)
568 if (trans->opcode == SPI_OPCODE_WREN) {
570 * Treat Write Enable as Atomic Pre-Op if possible
571 * in order to prevent the Management Engine from
572 * issuing a transaction between WREN and DATA.
574 if (!ctlr.ichspi_lock)
575 ich_writew(trans->opcode, ctlr.preop);
579 if (ctlr.speed && ctlr.max_speed >= 33000000) {
582 byte = ich_readb(ctlr.speed);
583 if (ich->speed >= 33000000)
584 byte |= SSFC_SCF_33MHZ;
586 byte &= ~SSFC_SCF_33MHZ;
587 ich_writeb(byte, ctlr.speed);
590 /* See if we have used up the command data */
591 if (using_cmd && dout && bytes) {
593 trans->bytesout = bytes;
594 debug("ICH SPI: Moving to data, %d bytes\n", bytes);
597 /* Preset control fields */
598 control = ich_readw(ctlr.control);
599 control &= ~SSFC_RESERVED;
600 control = SPIC_SCGO | ((opcode_index & 0x07) << 4);
602 /* Issue atomic preop cycle if needed */
603 if (ich_readw(ctlr.preop))
606 if (!trans->bytesout && !trans->bytesin) {
607 /* SPI addresses are 24 bit only */
609 ich_writel(trans->offset & 0x00FFFFFF, ctlr.addr);
612 * This is a 'no data' command (like Write Enable), its
613 * bitesout size was 1, decremented to zero while executing
614 * spi_setup_opcode() above. Tell the chip to send the
617 ich_writew(control, ctlr.control);
619 /* wait for the result */
620 status = ich_status_poll(SPIS_CDS | SPIS_FCERR, 1);
624 if (status & SPIS_FCERR) {
625 debug("ICH SPI: Command transaction error\n");
633 * Check if this is a write command atempting to transfer more bytes
634 * than the controller can handle. Iterations for writes are not
635 * supported here because each SPI write command needs to be preceded
636 * and followed by other SPI commands, and this sequence is controlled
637 * by the SPI chip driver.
639 if (trans->bytesout > ctlr.databytes) {
640 debug("ICH SPI: Too much to write. This should be prevented by the driver's max_write_size?\n");
645 * Read or write up to databytes bytes at a time until everything has
648 while (trans->bytesout || trans->bytesin) {
649 uint32_t data_length;
651 /* SPI addresses are 24 bit only */
652 ich_writel(trans->offset & 0x00FFFFFF, ctlr.addr);
655 data_length = min(trans->bytesout, ctlr.databytes);
657 data_length = min(trans->bytesin, ctlr.databytes);
659 /* Program data into FDATA0 to N */
660 if (trans->bytesout) {
661 write_reg(trans->out, ctlr.data, data_length);
662 spi_use_out(trans, data_length);
664 trans->offset += data_length;
667 /* Add proper control fields' values */
668 control &= ~((ctlr.databytes - 1) << 8);
670 control |= (data_length - 1) << 8;
673 ich_writew(control, ctlr.control);
675 /* Wait for Cycle Done Status or Flash Cycle Error. */
676 status = ich_status_poll(SPIS_CDS | SPIS_FCERR, 1);
680 if (status & SPIS_FCERR) {
681 debug("ICH SPI: Data transaction error\n");
685 if (trans->bytesin) {
686 read_reg(ctlr.data, trans->in, data_length);
687 spi_use_in(trans, data_length);
689 trans->offset += data_length;
693 /* Clear atomic preop now that xfer is done */
694 ich_writew(0, ctlr.preop);
701 * This uses the SPI controller from the Intel Cougar Point and Panther Point
702 * PCH to write-protect portions of the SPI flash until reboot. The changes
703 * don't actually take effect until the HSFS[FLOCKDN] bit is set, but that's
706 int spi_write_protect_region(uint32_t lower_limit, uint32_t length, int hint)
709 uint32_t upper_limit;
712 printf("%s: operation not supported on this chipset\n",
718 lower_limit > (0xFFFFFFFFUL - length) + 1 ||
719 hint < 0 || hint > 4) {
720 printf("%s(0x%x, 0x%x, %d): invalid args\n", __func__,
721 lower_limit, length, hint);
725 upper_limit = lower_limit + length - 1;
728 * Determine bits to write, as follows:
729 * 31 Write-protection enable (includes erase operation)
731 * 28:16 Upper Limit (FLA address bits 24:12, with 11:0 == 0xfff)
732 * 15 Read-protection enable
734 * 12:0 Lower Limit (FLA address bits 24:12, with 11:0 == 0x000)
736 tmplong = 0x80000000 |
737 ((upper_limit & 0x01fff000) << 4) |
738 ((lower_limit & 0x01fff000) >> 12);
740 printf("%s: writing 0x%08x to %p\n", __func__, tmplong,
742 ctlr.pr[hint] = tmplong;