2 * intel_scu_ipc.c: Driver for the Intel SCU IPC mechanism
4 * (C) Copyright 2008-2010 Intel Corporation
5 * Author: Sreedhara DS (sreedhara.ds@intel.com)
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; version 2
12 * SCU runing in ARC processor communicates with other entity running in IA
13 * core through IPC mechanism which in turn messaging between IA core ad SCU.
14 * SCU has two IPC mechanism IPC-1 and IPC-2. IPC-1 is used between IA32 and
15 * SCU where IPC-2 is used between P-Unit and SCU. This driver delas with
16 * IPC-1 Driver provides an API for power control unit registers (e.g. MSIC)
17 * along with other APIs.
19 #include <linux/delay.h>
20 #include <linux/errno.h>
21 #include <linux/init.h>
22 #include <linux/sysdev.h>
24 #include <linux/pci.h>
25 #include <linux/interrupt.h>
26 #include <linux/sfi.h>
28 #include <asm/intel_scu_ipc.h>
31 /* IPC defines the following message types */
32 #define IPCMSG_WATCHDOG_TIMER 0xF8 /* Set Kernel Watchdog Threshold */
33 #define IPCMSG_BATTERY 0xEF /* Coulomb Counter Accumulator */
34 #define IPCMSG_FW_UPDATE 0xFE /* Firmware update */
35 #define IPCMSG_PCNTRL 0xFF /* Power controller unit read/write */
36 #define IPCMSG_FW_REVISION 0xF4 /* Get firmware revision */
38 /* Command id associated with message IPCMSG_PCNTRL */
39 #define IPC_CMD_PCNTRL_W 0 /* Register write */
40 #define IPC_CMD_PCNTRL_R 1 /* Register read */
41 #define IPC_CMD_PCNTRL_M 2 /* Register read-modify-write */
44 * IPC register summary
46 * IPC register blocks are memory mapped at fixed address of 0xFF11C000
47 * To read or write information to the SCU, driver writes to IPC-1 memory
48 * mapped registers (base address 0xFF11C000). The following is the IPC
51 * 1. IA core cDMI interface claims this transaction and converts it to a
52 * Transaction Layer Packet (TLP) message which is sent across the cDMI.
54 * 2. South Complex cDMI block receives this message and writes it to
55 * the IPC-1 register block, causing an interrupt to the SCU
57 * 3. SCU firmware decodes this interrupt and IPC message and the appropriate
58 * message handler is called within firmware.
61 #define IPC_BASE_ADDR 0xFF11C000 /* IPC1 base register address */
62 #define IPC_MAX_ADDR 0x100 /* Maximum IPC regisers */
63 #define IPC_WWBUF_SIZE 20 /* IPC Write buffer Size */
64 #define IPC_RWBUF_SIZE 20 /* IPC Read buffer Size */
65 #define IPC_I2C_BASE 0xFF12B000 /* I2C control register base address */
66 #define IPC_I2C_MAX_ADDR 0x10 /* Maximum I2C regisers */
68 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id);
69 static void ipc_remove(struct pci_dev *pdev);
71 struct intel_scu_ipc_dev {
73 void __iomem *ipc_base;
74 void __iomem *i2c_base;
77 static struct intel_scu_ipc_dev ipcdev; /* Only one for now */
79 static int platform; /* Platform type */
82 * IPC Read Buffer (Read Only):
83 * 16 byte buffer for receiving data from SCU, if IPC command
84 * processing results in response data
86 #define IPC_READ_BUFFER 0x90
88 #define IPC_I2C_CNTRL_ADDR 0
89 #define I2C_DATA_ADDR 0x04
91 static DEFINE_MUTEX(ipclock); /* lock used to prevent multiple call to SCU */
94 * Command Register (Write Only):
95 * A write to this register results in an interrupt to the SCU core processor
97 * |rfu2(8) | size(8) | command id(4) | rfu1(3) | ioc(1) | command(8)|
99 static inline void ipc_command(u32 cmd) /* Send ipc command */
101 writel(cmd, ipcdev.ipc_base);
105 * IPC Write Buffer (Write Only):
106 * 16-byte buffer for sending data associated with IPC command to
107 * SCU. Size of the data is specified in the IPC_COMMAND_REG register
109 static inline void ipc_data_writel(u32 data, u32 offset) /* Write ipc data */
111 writel(data, ipcdev.ipc_base + 0x80 + offset);
115 * Status Register (Read Only):
116 * Driver will read this register to get the ready/busy status of the IPC
117 * block and error status of the IPC command that was just processed by SCU
119 * |rfu3(8)|error code(8)|initiator id(8)|cmd id(4)|rfu1(2)|error(1)|busy(1)|
122 static inline u8 ipc_read_status(void)
124 return __raw_readl(ipcdev.ipc_base + 0x04);
127 static inline u8 ipc_data_readb(u32 offset) /* Read ipc byte data */
129 return readb(ipcdev.ipc_base + IPC_READ_BUFFER + offset);
132 static inline u32 ipc_data_readl(u32 offset) /* Read ipc u32 data */
134 return readl(ipcdev.ipc_base + IPC_READ_BUFFER + offset);
137 static inline int busy_loop(void) /* Wait till scu status is busy */
142 status = ipc_read_status();
144 udelay(1); /* scu processing time is in few u secods */
145 status = ipc_read_status();
147 /* break if scu doesn't reset busy bit after huge retry */
148 if (loop_count > 100000) {
149 dev_err(&ipcdev.pdev->dev, "IPC timed out");
153 if ((status >> 1) & 1)
159 /* Read/Write power control(PMIC in Langwell, MSIC in PenWell) registers */
160 static int pwr_reg_rdwr(u16 *addr, u8 *data, u32 count, u32 op, u32 id)
165 u8 cbuf[IPC_WWBUF_SIZE] = { };
166 u32 *wbuf = (u32 *)&cbuf;
168 mutex_lock(&ipclock);
170 memset(cbuf, 0, sizeof(cbuf));
172 if (ipcdev.pdev == NULL) {
173 mutex_unlock(&ipclock);
177 if (platform != MRST_CPU_CHIP_PENWELL) {
180 for (i = 0; i < count; i++) {
181 cbuf[bytes++] = addr[i];
182 cbuf[bytes++] = addr[i] >> 8;
183 if (id != IPC_CMD_PCNTRL_R)
184 cbuf[bytes++] = data[d++];
185 if (id == IPC_CMD_PCNTRL_M)
186 cbuf[bytes++] = data[d++];
188 for (i = 0; i < bytes; i += 4)
189 ipc_data_writel(wbuf[i/4], i);
190 ipc_command(bytes << 16 | id << 12 | 0 << 8 | op);
192 for (nc = 0; nc < count; nc++, offset += 2) {
193 cbuf[offset] = addr[nc];
194 cbuf[offset + 1] = addr[nc] >> 8;
197 if (id == IPC_CMD_PCNTRL_R) {
198 for (nc = 0, offset = 0; nc < count; nc++, offset += 4)
199 ipc_data_writel(wbuf[nc], offset);
200 ipc_command((count*2) << 16 | id << 12 | 0 << 8 | op);
201 } else if (id == IPC_CMD_PCNTRL_W) {
202 for (nc = 0; nc < count; nc++, offset += 1)
203 cbuf[offset] = data[nc];
204 for (nc = 0, offset = 0; nc < count; nc++, offset += 4)
205 ipc_data_writel(wbuf[nc], offset);
206 ipc_command((count*3) << 16 | id << 12 | 0 << 8 | op);
207 } else if (id == IPC_CMD_PCNTRL_M) {
208 cbuf[offset] = data[0];
209 cbuf[offset + 1] = data[1];
210 ipc_data_writel(wbuf[0], 0); /* Write wbuff */
211 ipc_command(4 << 16 | id << 12 | 0 << 8 | op);
216 if (id == IPC_CMD_PCNTRL_R) { /* Read rbuf */
217 /* Workaround: values are read as 0 without memcpy_fromio */
218 memcpy_fromio(cbuf, ipcdev.ipc_base + 0x90, 16);
219 if (platform != MRST_CPU_CHIP_PENWELL) {
220 for (nc = 0, offset = 2; nc < count; nc++, offset += 3)
221 data[nc] = ipc_data_readb(offset);
223 for (nc = 0; nc < count; nc++)
224 data[nc] = ipc_data_readb(nc);
227 mutex_unlock(&ipclock);
232 * intel_scu_ipc_ioread8 - read a word via the SCU
233 * @addr: register on SCU
234 * @data: return pointer for read byte
236 * Read a single register. Returns 0 on success or an error code. All
237 * locking between SCU accesses is handled for the caller.
239 * This function may sleep.
241 int intel_scu_ipc_ioread8(u16 addr, u8 *data)
243 return pwr_reg_rdwr(&addr, data, 1, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_R);
245 EXPORT_SYMBOL(intel_scu_ipc_ioread8);
248 * intel_scu_ipc_ioread16 - read a word via the SCU
249 * @addr: register on SCU
250 * @data: return pointer for read word
252 * Read a register pair. Returns 0 on success or an error code. All
253 * locking between SCU accesses is handled for the caller.
255 * This function may sleep.
257 int intel_scu_ipc_ioread16(u16 addr, u16 *data)
259 u16 x[2] = {addr, addr + 1 };
260 return pwr_reg_rdwr(x, (u8 *)data, 2, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_R);
262 EXPORT_SYMBOL(intel_scu_ipc_ioread16);
265 * intel_scu_ipc_ioread32 - read a dword via the SCU
266 * @addr: register on SCU
267 * @data: return pointer for read dword
269 * Read four registers. Returns 0 on success or an error code. All
270 * locking between SCU accesses is handled for the caller.
272 * This function may sleep.
274 int intel_scu_ipc_ioread32(u16 addr, u32 *data)
276 u16 x[4] = {addr, addr + 1, addr + 2, addr + 3};
277 return pwr_reg_rdwr(x, (u8 *)data, 4, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_R);
279 EXPORT_SYMBOL(intel_scu_ipc_ioread32);
282 * intel_scu_ipc_iowrite8 - write a byte via the SCU
283 * @addr: register on SCU
284 * @data: byte to write
286 * Write a single register. Returns 0 on success or an error code. All
287 * locking between SCU accesses is handled for the caller.
289 * This function may sleep.
291 int intel_scu_ipc_iowrite8(u16 addr, u8 data)
293 return pwr_reg_rdwr(&addr, &data, 1, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_W);
295 EXPORT_SYMBOL(intel_scu_ipc_iowrite8);
298 * intel_scu_ipc_iowrite16 - write a word via the SCU
299 * @addr: register on SCU
300 * @data: word to write
302 * Write two registers. Returns 0 on success or an error code. All
303 * locking between SCU accesses is handled for the caller.
305 * This function may sleep.
307 int intel_scu_ipc_iowrite16(u16 addr, u16 data)
309 u16 x[2] = {addr, addr + 1 };
310 return pwr_reg_rdwr(x, (u8 *)&data, 2, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_W);
312 EXPORT_SYMBOL(intel_scu_ipc_iowrite16);
315 * intel_scu_ipc_iowrite32 - write a dword via the SCU
316 * @addr: register on SCU
317 * @data: dword to write
319 * Write four registers. Returns 0 on success or an error code. All
320 * locking between SCU accesses is handled for the caller.
322 * This function may sleep.
324 int intel_scu_ipc_iowrite32(u16 addr, u32 data)
326 u16 x[4] = {addr, addr + 1, addr + 2, addr + 3};
327 return pwr_reg_rdwr(x, (u8 *)&data, 4, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_W);
329 EXPORT_SYMBOL(intel_scu_ipc_iowrite32);
332 * intel_scu_ipc_readvv - read a set of registers
333 * @addr: register list
334 * @data: bytes to return
335 * @len: length of array
337 * Read registers. Returns 0 on success or an error code. All
338 * locking between SCU accesses is handled for the caller.
340 * The largest array length permitted by the hardware is 5 items.
342 * This function may sleep.
344 int intel_scu_ipc_readv(u16 *addr, u8 *data, int len)
346 return pwr_reg_rdwr(addr, data, len, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_R);
348 EXPORT_SYMBOL(intel_scu_ipc_readv);
351 * intel_scu_ipc_writev - write a set of registers
352 * @addr: register list
353 * @data: bytes to write
354 * @len: length of array
356 * Write registers. Returns 0 on success or an error code. All
357 * locking between SCU accesses is handled for the caller.
359 * The largest array length permitted by the hardware is 5 items.
361 * This function may sleep.
364 int intel_scu_ipc_writev(u16 *addr, u8 *data, int len)
366 return pwr_reg_rdwr(addr, data, len, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_W);
368 EXPORT_SYMBOL(intel_scu_ipc_writev);
372 * intel_scu_ipc_update_register - r/m/w a register
373 * @addr: register address
374 * @bits: bits to update
375 * @mask: mask of bits to update
377 * Read-modify-write power control unit register. The first data argument
378 * must be register value and second is mask value
379 * mask is a bitmap that indicates which bits to update.
380 * 0 = masked. Don't modify this bit, 1 = modify this bit.
381 * returns 0 on success or an error code.
383 * This function may sleep. Locking between SCU accesses is handled
386 int intel_scu_ipc_update_register(u16 addr, u8 bits, u8 mask)
388 u8 data[2] = { bits, mask };
389 return pwr_reg_rdwr(&addr, data, 1, IPCMSG_PCNTRL, IPC_CMD_PCNTRL_M);
391 EXPORT_SYMBOL(intel_scu_ipc_update_register);
394 * intel_scu_ipc_simple_command - send a simple command
398 * Issue a simple command to the SCU. Do not use this interface if
399 * you must then access data as any data values may be overwritten
400 * by another SCU access by the time this function returns.
402 * This function may sleep. Locking for SCU accesses is handled for
405 int intel_scu_ipc_simple_command(int cmd, int sub)
409 mutex_lock(&ipclock);
410 if (ipcdev.pdev == NULL) {
411 mutex_unlock(&ipclock);
414 ipc_command(sub << 12 | cmd);
416 mutex_unlock(&ipclock);
419 EXPORT_SYMBOL(intel_scu_ipc_simple_command);
422 * intel_scu_ipc_command - command with data
426 * @inlen: input length in dwords
428 * @outlein: output length in dwords
430 * Issue a command to the SCU which involves data transfers. Do the
431 * data copies under the lock but leave it for the caller to interpret
434 int intel_scu_ipc_command(int cmd, int sub, u32 *in, int inlen,
435 u32 *out, int outlen)
440 mutex_lock(&ipclock);
441 if (ipcdev.pdev == NULL) {
442 mutex_unlock(&ipclock);
446 for (i = 0; i < inlen; i++)
447 ipc_data_writel(*in++, 4 * i);
449 ipc_command((inlen << 16) | (sub << 12) | cmd);
452 for (i = 0; i < outlen; i++)
453 *out++ = ipc_data_readl(4 * i);
455 mutex_unlock(&ipclock);
458 EXPORT_SYMBOL(intel_scu_ipc_command);
461 #define IPC_I2C_WRITE 1 /* I2C Write command */
462 #define IPC_I2C_READ 2 /* I2C Read command */
465 * intel_scu_ipc_i2c_cntrl - I2C read/write operations
466 * @addr: I2C address + command bits
467 * @data: data to read/write
469 * Perform an an I2C read/write operation via the SCU. All locking is
470 * handled for the caller. This function may sleep.
472 * Returns an error code or 0 on success.
474 * This has to be in the IPC driver for the locking.
476 int intel_scu_ipc_i2c_cntrl(u32 addr, u32 *data)
480 mutex_lock(&ipclock);
481 if (ipcdev.pdev == NULL) {
482 mutex_unlock(&ipclock);
485 cmd = (addr >> 24) & 0xFF;
486 if (cmd == IPC_I2C_READ) {
487 writel(addr, ipcdev.i2c_base + IPC_I2C_CNTRL_ADDR);
488 /* Write not getting updated without delay */
490 *data = readl(ipcdev.i2c_base + I2C_DATA_ADDR);
491 } else if (cmd == IPC_I2C_WRITE) {
492 writel(*data, ipcdev.i2c_base + I2C_DATA_ADDR);
494 writel(addr, ipcdev.i2c_base + IPC_I2C_CNTRL_ADDR);
496 dev_err(&ipcdev.pdev->dev,
497 "intel_scu_ipc: I2C INVALID_CMD = 0x%x\n", cmd);
499 mutex_unlock(&ipclock);
502 mutex_unlock(&ipclock);
505 EXPORT_SYMBOL(intel_scu_ipc_i2c_cntrl);
507 #define IPC_FW_LOAD_ADDR 0xFFFC0000 /* Storage location for FW image */
508 #define IPC_FW_UPDATE_MBOX_ADDR 0xFFFFDFF4 /* Mailbox between ipc and scu */
509 #define IPC_MAX_FW_SIZE 262144 /* 256K storage size for loading the FW image */
510 #define IPC_FW_MIP_HEADER_SIZE 2048 /* Firmware MIP header size */
511 /* IPC inform SCU to get ready for update process */
512 #define IPC_CMD_FW_UPDATE_READY 0x10FE
513 /* IPC inform SCU to go for update process */
514 #define IPC_CMD_FW_UPDATE_GO 0x20FE
515 /* Status code for fw update */
516 #define IPC_FW_UPDATE_SUCCESS 0x444f4e45 /* Status code 'DONE' */
517 #define IPC_FW_UPDATE_BADN 0x4241444E /* Status code 'BADN' */
518 #define IPC_FW_TXHIGH 0x54784849 /* Status code 'IPC_FW_TXHIGH' */
519 #define IPC_FW_TXLOW 0x54784c4f /* Status code 'IPC_FW_TXLOW' */
521 struct fw_update_mailbox {
529 * intel_scu_ipc_fw_update - Firmware update utility
530 * @buffer: firmware buffer
531 * @length: size of firmware buffer
533 * This function provides an interface to load the firmware into
534 * the SCU. Returns 0 on success or -1 on failure
536 int intel_scu_ipc_fw_update(u8 *buffer, u32 length)
538 void __iomem *fw_update_base;
539 struct fw_update_mailbox __iomem *mailbox = NULL;
543 mutex_lock(&ipclock);
544 fw_update_base = ioremap_nocache(IPC_FW_LOAD_ADDR, (128*1024));
545 if (fw_update_base == NULL) {
546 mutex_unlock(&ipclock);
549 mailbox = ioremap_nocache(IPC_FW_UPDATE_MBOX_ADDR,
550 sizeof(struct fw_update_mailbox));
551 if (mailbox == NULL) {
552 iounmap(fw_update_base);
553 mutex_unlock(&ipclock);
557 ipc_command(IPC_CMD_FW_UPDATE_READY);
559 /* Intitialize mailbox */
560 writel(0, &mailbox->status);
561 writel(0, &mailbox->scu_flag);
562 writel(0, &mailbox->driver_flag);
564 /* Driver copies the 2KB MIP header to SRAM at 0xFFFC0000*/
565 memcpy_toio(fw_update_base, buffer, 0x800);
567 /* Driver sends "FW Update" IPC command (CMD_ID 0xFE; MSG_ID 0x02).
568 * Upon receiving this command, SCU will write the 2K MIP header
569 * from 0xFFFC0000 into NAND.
570 * SCU will write a status code into the Mailbox, and then set scu_flag.
573 ipc_command(IPC_CMD_FW_UPDATE_GO);
575 /*Driver stalls until scu_flag is set */
576 while (readl(&mailbox->scu_flag) != 1) {
581 /* Driver checks Mailbox status.
582 * If the status is 'BADN', then abort (bad NAND).
583 * If the status is 'IPC_FW_TXLOW', then continue.
585 while (readl(&mailbox->status) != IPC_FW_TXLOW) {
595 if (readl(&mailbox->status) != IPC_FW_TXLOW)
597 buffer = buffer + 0x800;
598 memcpy_toio(fw_update_base, buffer, 0x20000);
599 writel(1, &mailbox->driver_flag);
600 while (readl(&mailbox->scu_flag) == 1) {
605 /* check for 'BADN' */
606 if (readl(&mailbox->status) == IPC_FW_UPDATE_BADN)
609 while (readl(&mailbox->status) != IPC_FW_TXHIGH) {
615 if (readl(&mailbox->status) != IPC_FW_TXHIGH)
618 buffer = buffer + 0x20000;
619 memcpy_toio(fw_update_base, buffer, 0x20000);
620 writel(0, &mailbox->driver_flag);
622 while (mailbox->scu_flag == 0) {
627 /* check for 'BADN' */
628 if (readl(&mailbox->status) == IPC_FW_UPDATE_BADN)
631 if (readl(&mailbox->status) == IPC_FW_TXLOW) {
637 status = readl(&mailbox->status);
639 iounmap(fw_update_base);
641 mutex_unlock(&ipclock);
643 if (status == IPC_FW_UPDATE_SUCCESS)
647 EXPORT_SYMBOL(intel_scu_ipc_fw_update);
650 * Interrupt handler gets called when ioc bit of IPC_COMMAND_REG set to 1
651 * When ioc bit is set to 1, caller api must wait for interrupt handler called
652 * which in turn unlocks the caller api. Currently this is not used
654 * This is edge triggered so we need take no action to clear anything
656 static irqreturn_t ioc(int irq, void *dev_id)
662 * ipc_probe - probe an Intel SCU IPC
663 * @dev: the PCI device matching
664 * @id: entry in the match table
666 * Enable and install an intel SCU IPC. This appears in the PCI space
667 * but uses some hard coded addresses as well.
669 static int ipc_probe(struct pci_dev *dev, const struct pci_device_id *id)
672 resource_size_t pci_resource;
674 if (ipcdev.pdev) /* We support only one SCU */
677 ipcdev.pdev = pci_dev_get(dev);
679 err = pci_enable_device(dev);
683 err = pci_request_regions(dev, "intel_scu_ipc");
687 pci_resource = pci_resource_start(dev, 0);
691 if (request_irq(dev->irq, ioc, 0, "intel_scu_ipc", &ipcdev))
694 ipcdev.ipc_base = ioremap_nocache(IPC_BASE_ADDR, IPC_MAX_ADDR);
695 if (!ipcdev.ipc_base)
698 ipcdev.i2c_base = ioremap_nocache(IPC_I2C_BASE, IPC_I2C_MAX_ADDR);
699 if (!ipcdev.i2c_base) {
700 iounmap(ipcdev.ipc_base);
704 intel_scu_devices_create();
710 * ipc_remove - remove a bound IPC device
713 * In practice the SCU is not removable but this function is also
714 * called for each device on a module unload or cleanup which is the
715 * path that will get used.
717 * Free up the mappings and release the PCI resources
719 static void ipc_remove(struct pci_dev *pdev)
721 free_irq(pdev->irq, &ipcdev);
722 pci_release_regions(pdev);
723 pci_dev_put(ipcdev.pdev);
724 iounmap(ipcdev.ipc_base);
725 iounmap(ipcdev.i2c_base);
727 intel_scu_devices_destroy();
730 static const struct pci_device_id pci_ids[] = {
731 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x080e)},
732 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x082a)},
735 MODULE_DEVICE_TABLE(pci, pci_ids);
737 static struct pci_driver ipc_driver = {
738 .name = "intel_scu_ipc",
741 .remove = ipc_remove,
745 static int __init intel_scu_ipc_init(void)
747 platform = mrst_identify_cpu();
750 return pci_register_driver(&ipc_driver);
753 static void __exit intel_scu_ipc_exit(void)
755 pci_unregister_driver(&ipc_driver);
758 MODULE_AUTHOR("Sreedhara DS <sreedhara.ds@intel.com>");
759 MODULE_DESCRIPTION("Intel SCU IPC driver");
760 MODULE_LICENSE("GPL");
762 module_init(intel_scu_ipc_init);
763 module_exit(intel_scu_ipc_exit);