2 * This file is part of the coreboot project.
4 * Copyright 2017-2018 Intel Inc.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; version 2 of the License.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
17 #include <commonlib/helpers.h>
18 #include <console/console.h>
19 #include <device/mmio.h>
21 #include <device/pci.h>
22 #include <device/pci_ids.h>
23 #include <device/pci_ops.h>
24 #include <intelblocks/cse.h>
25 #include <soc/iomap.h>
26 #include <soc/pci_devs.h>
31 #define MAX_HECI_MESSAGE_RETRY_COUNT 5
33 /* Wait up to 15 sec for HECI to get ready */
34 #define HECI_DELAY_READY (15 * 1000)
35 /* Wait up to 100 usec between circular buffer polls */
36 #define HECI_DELAY 100
37 /* Wait up to 5 sec for CSE to chew something we sent */
38 #define HECI_SEND_TIMEOUT (5 * 1000)
39 /* Wait up to 5 sec for CSE to blurp a reply */
40 #define HECI_READ_TIMEOUT (5 * 1000)
42 #define SLOT_SIZE sizeof(uint32_t)
44 #define MMIO_CSE_CB_WW 0x00
45 #define MMIO_HOST_CSR 0x04
46 #define MMIO_CSE_CB_RW 0x08
47 #define MMIO_CSE_CSR 0x0c
49 #define CSR_IE (1 << 0)
50 #define CSR_IS (1 << 1)
51 #define CSR_IG (1 << 2)
52 #define CSR_READY (1 << 3)
53 #define CSR_RESET (1 << 4)
54 #define CSR_RP_START 8
55 #define CSR_RP (((1 << 8) - 1) << CSR_RP_START)
56 #define CSR_WP_START 16
57 #define CSR_WP (((1 << 8) - 1) << CSR_WP_START)
58 #define CSR_CBD_START 24
59 #define CSR_CBD (((1 << 8) - 1) << CSR_CBD_START)
61 #define MEI_HDR_IS_COMPLETE (1 << 31)
62 #define MEI_HDR_LENGTH_START 16
63 #define MEI_HDR_LENGTH_SIZE 9
64 #define MEI_HDR_LENGTH (((1 << MEI_HDR_LENGTH_SIZE) - 1) \
65 << MEI_HDR_LENGTH_START)
66 #define MEI_HDR_HOST_ADDR_START 8
67 #define MEI_HDR_HOST_ADDR (((1 << 8) - 1) << MEI_HDR_HOST_ADDR_START)
68 #define MEI_HDR_CSE_ADDR_START 0
69 #define MEI_HDR_CSE_ADDR (((1 << 8) - 1) << MEI_HDR_CSE_ADDR_START)
71 static struct cse_device
{
76 * Initialize the device with provided temporary BAR. If BAR is 0 use a
77 * default. This is intended for pre-mem usage only where BARs haven't been
78 * assigned yet and devices are not enabled.
80 void heci_init(uintptr_t tempbar
)
82 #if defined(__SIMPLE_DEVICE__)
83 pci_devfn_t dev
= PCH_DEV_CSE
;
85 struct device
*dev
= PCH_DEV_CSE
;
89 /* Assume it is already initialized, nothing else to do */
93 /* Use default pre-ram bar */
95 tempbar
= HECI1_BASE_ADDRESS
;
97 /* Assign Resources to HECI1 */
98 /* Clear BIT 1-2 of Command Register */
99 pcireg
= pci_read_config8(dev
, PCI_COMMAND
);
100 pcireg
&= ~(PCI_COMMAND_MASTER
| PCI_COMMAND_MEMORY
);
101 pci_write_config8(dev
, PCI_COMMAND
, pcireg
);
103 /* Program Temporary BAR for HECI1 */
104 pci_write_config32(dev
, PCI_BASE_ADDRESS_0
, tempbar
);
105 pci_write_config32(dev
, PCI_BASE_ADDRESS_1
, 0x0);
107 /* Enable Bus Master and MMIO Space */
108 pcireg
= pci_read_config8(dev
, PCI_COMMAND
);
109 pcireg
|= PCI_COMMAND_MASTER
| PCI_COMMAND_MEMORY
;
110 pci_write_config8(dev
, PCI_COMMAND
, pcireg
);
112 cse
.sec_bar
= tempbar
;
115 /* Get HECI BAR 0 from PCI configuration space */
116 static uint32_t get_cse_bar(void)
120 bar
= pci_read_config32(PCH_DEV_CSE
, PCI_BASE_ADDRESS_0
);
123 * Bits 31-12 are the base address as per EDS for SPI,
124 * Don't care about 0-11 bit
126 return bar
& ~PCI_BASE_ADDRESS_MEM_ATTR_MASK
;
129 static uint32_t read_bar(uint32_t offset
)
131 /* Load and cache BAR */
133 cse
.sec_bar
= get_cse_bar();
134 return read32((void *)(cse
.sec_bar
+ offset
));
137 static void write_bar(uint32_t offset
, uint32_t val
)
139 /* Load and cache BAR */
141 cse
.sec_bar
= get_cse_bar();
142 return write32((void *)(cse
.sec_bar
+ offset
), val
);
145 static uint32_t read_cse_csr(void)
147 return read_bar(MMIO_CSE_CSR
);
150 static uint32_t read_host_csr(void)
152 return read_bar(MMIO_HOST_CSR
);
155 static void write_host_csr(uint32_t data
)
157 write_bar(MMIO_HOST_CSR
, data
);
160 static size_t filled_slots(uint32_t data
)
163 rp
= data
>> CSR_RP_START
;
164 wp
= data
>> CSR_WP_START
;
165 return (uint8_t) (wp
- rp
);
168 static size_t cse_filled_slots(void)
170 return filled_slots(read_cse_csr());
173 static size_t host_empty_slots(void)
176 csr
= read_host_csr();
178 return ((csr
& CSR_CBD
) >> CSR_CBD_START
) - filled_slots(csr
);
181 static void clear_int(void)
184 csr
= read_host_csr();
189 static uint32_t read_slot(void)
191 return read_bar(MMIO_CSE_CB_RW
);
194 static void write_slot(uint32_t val
)
196 write_bar(MMIO_CSE_CB_WW
, val
);
199 static int wait_write_slots(size_t cnt
)
203 stopwatch_init_msecs_expire(&sw
, HECI_SEND_TIMEOUT
);
204 while (host_empty_slots() < cnt
) {
206 if (stopwatch_expired(&sw
)) {
207 printk(BIOS_ERR
, "HECI: timeout, buffer not drained\n");
214 static int wait_read_slots(size_t cnt
)
218 stopwatch_init_msecs_expire(&sw
, HECI_READ_TIMEOUT
);
219 while (cse_filled_slots() < cnt
) {
221 if (stopwatch_expired(&sw
)) {
222 printk(BIOS_ERR
, "HECI: timed out reading answer!\n");
229 /* get number of full 4-byte slots */
230 static size_t bytes_to_slots(size_t bytes
)
232 return ALIGN_UP(bytes
, SLOT_SIZE
) / SLOT_SIZE
;
235 static int cse_ready(void)
238 csr
= read_cse_csr();
239 return csr
& CSR_READY
;
242 static bool cse_check_hfs1_com(int mode
)
244 union me_hfsts1 hfs1
;
245 hfs1
.data
= me_read_config32(PCI_ME_HFSTS1
);
246 return hfs1
.fields
.operation_mode
== mode
;
249 bool cse_is_hfs1_cws_normal(void)
251 union me_hfsts1 hfs1
;
252 hfs1
.data
= me_read_config32(PCI_ME_HFSTS1
);
253 if (hfs1
.fields
.working_state
== ME_HFS1_CWS_NORMAL
)
258 bool cse_is_hfs1_com_normal(void)
260 return cse_check_hfs1_com(ME_HFS1_COM_NORMAL
);
263 bool cse_is_hfs1_com_secover_mei_msg(void)
265 return cse_check_hfs1_com(ME_HFS1_COM_SECOVER_MEI_MSG
);
268 bool cse_is_hfs1_com_soft_temp_disable(void)
270 return cse_check_hfs1_com(ME_HFS1_COM_SOFT_TEMP_DISABLE
);
273 bool cse_is_hfs3_fw_sku_custom(void)
275 union me_hfsts3 hfs3
;
276 hfs3
.data
= me_read_config32(PCI_ME_HFSTS3
);
277 return hfs3
.fields
.fw_sku
== ME_HFS3_FW_SKU_CUSTOM
;
280 /* Makes the host ready to communicate with CSE */
281 void cse_set_host_ready(void)
284 csr
= read_host_csr();
286 csr
|= (CSR_IG
| CSR_READY
);
290 /* Polls for ME mode ME_HFS1_COM_SECOVER_MEI_MSG for 15 seconds */
291 uint8_t cse_wait_sec_override_mode(void)
294 stopwatch_init_msecs_expire(&sw
, HECI_DELAY_READY
);
295 while (!cse_is_hfs1_com_secover_mei_msg()) {
297 if (stopwatch_expired(&sw
)) {
298 printk(BIOS_ERR
, "HECI: Timed out waiting for SEC_OVERRIDE mode!\n");
302 printk(BIOS_DEBUG
, "HECI: CSE took %lu ms to enter security override mode\n",
303 stopwatch_duration_msecs(&sw
));
307 static int wait_heci_ready(void)
311 stopwatch_init_msecs_expire(&sw
, HECI_DELAY_READY
);
312 while (!cse_ready()) {
314 if (stopwatch_expired(&sw
))
321 static void host_gen_interrupt(void)
324 csr
= read_host_csr();
329 static size_t hdr_get_length(uint32_t hdr
)
331 return (hdr
& MEI_HDR_LENGTH
) >> MEI_HDR_LENGTH_START
;
335 send_one_message(uint32_t hdr
, const void *buff
)
337 size_t pend_len
, pend_slots
, remainder
, i
;
339 const uint32_t *p
= buff
;
341 /* Get space for the header */
342 if (!wait_write_slots(1))
345 /* First, write header */
348 pend_len
= hdr_get_length(hdr
);
349 pend_slots
= bytes_to_slots(pend_len
);
351 if (!wait_write_slots(pend_slots
))
354 /* Write the body in whole slots */
356 while (i
< ALIGN_DOWN(pend_len
, SLOT_SIZE
)) {
361 remainder
= pend_len
% SLOT_SIZE
;
362 /* Pad to 4 bytes not touching caller's buffer */
364 memcpy(&tmp
, p
, remainder
);
368 host_gen_interrupt();
370 /* Make sure nothing bad happened during transmission */
378 heci_send(const void *msg
, size_t len
, uint8_t host_addr
, uint8_t client_addr
)
382 size_t sent
, remaining
, cb_size
, max_length
;
390 for (retry
= 0; retry
< MAX_HECI_MESSAGE_RETRY_COUNT
; retry
++) {
393 if (!wait_heci_ready()) {
394 printk(BIOS_ERR
, "HECI: not ready\n");
398 csr
= read_host_csr();
399 cb_size
= ((csr
& CSR_CBD
) >> CSR_CBD_START
) * SLOT_SIZE
;
401 * Reserve one slot for the header. Limit max message
402 * length by 9 bits that are available in the header.
404 max_length
= MIN(cb_size
, (1 << MEI_HDR_LENGTH_SIZE
) - 1)
409 * Fragment the message into smaller messages not exceeding
410 * useful circular buffer length. Mark last message complete.
413 hdr
= MIN(max_length
, remaining
)
414 << MEI_HDR_LENGTH_START
;
415 hdr
|= client_addr
<< MEI_HDR_CSE_ADDR_START
;
416 hdr
|= host_addr
<< MEI_HDR_HOST_ADDR_START
;
417 hdr
|= (MIN(max_length
, remaining
) == remaining
) ?
418 MEI_HDR_IS_COMPLETE
: 0;
419 sent
= send_one_message(hdr
, p
);
422 } while (remaining
> 0 && sent
!= 0);
431 recv_one_message(uint32_t *hdr
, void *buff
, size_t maxlen
)
433 uint32_t reg
, *p
= buff
;
434 size_t recv_slots
, recv_len
, remainder
, i
;
436 /* first get the header */
437 if (!wait_read_slots(1))
441 recv_len
= hdr_get_length(*hdr
);
444 printk(BIOS_WARNING
, "HECI: message is zero-sized\n");
446 recv_slots
= bytes_to_slots(recv_len
);
449 if (recv_len
> maxlen
) {
450 printk(BIOS_ERR
, "HECI: response is too big\n");
454 /* wait for the rest of messages to arrive */
455 wait_read_slots(recv_slots
);
457 /* fetch whole slots first */
458 while (i
< ALIGN_DOWN(recv_len
, SLOT_SIZE
)) {
464 * If ME is not ready, something went wrong and
470 remainder
= recv_len
% SLOT_SIZE
;
474 memcpy(p
, ®
, remainder
);
480 int heci_receive(void *buff
, size_t *maxlen
)
483 size_t left
, received
;
487 if (!buff
|| !maxlen
|| !*maxlen
)
492 for (retry
= 0; retry
< MAX_HECI_MESSAGE_RETRY_COUNT
; retry
++) {
496 if (!wait_heci_ready()) {
497 printk(BIOS_ERR
, "HECI: not ready\n");
502 * Receive multiple packets until we meet one marked
503 * complete or we run out of space in caller-provided buffer.
506 received
= recv_one_message(&hdr
, p
, left
);
508 printk(BIOS_ERR
, "HECI: Failed to receive!\n");
513 /* If we read out everything ping to send more */
514 if (!(hdr
& MEI_HDR_IS_COMPLETE
) && !cse_filled_slots())
515 host_gen_interrupt();
516 } while (received
&& !(hdr
& MEI_HDR_IS_COMPLETE
) && left
> 0);
518 if ((hdr
& MEI_HDR_IS_COMPLETE
) && received
) {
519 *maxlen
= p
- (uint8_t *) buff
;
526 int heci_send_receive(const void *snd_msg
, size_t snd_sz
, void *rcv_msg
, size_t *rcv_sz
)
528 if (!heci_send(snd_msg
, snd_sz
, BIOS_HOST_ADDR
, HECI_MKHI_ADDR
)) {
529 printk(BIOS_ERR
, "HECI: send Failed\n");
533 if (rcv_msg
!= NULL
) {
534 if (!heci_receive(rcv_msg
, rcv_sz
)) {
535 printk(BIOS_ERR
, "HECI: receive Failed\n");
543 * Attempt to reset the device. This is useful when host and ME are out
544 * of sync during transmission or ME didn't understand the message.
550 /* Send reset request */
551 csr
= read_host_csr();
552 csr
|= (CSR_RESET
| CSR_IG
);
555 if (wait_heci_ready()) {
556 /* Device is back on its imaginary feet, clear reset */
557 cse_set_host_ready();
561 printk(BIOS_CRIT
, "HECI: reset failed\n");
566 bool is_cse_enabled(void)
568 const struct device
*cse_dev
= pcidev_path_on_root(PCH_DEVFN_CSE
);
570 if (!cse_dev
|| !cse_dev
->enabled
) {
571 printk(BIOS_WARNING
, "HECI: No CSE device\n");
575 if (pci_read_config16(PCH_DEV_CSE
, PCI_VENDOR_ID
) == 0xFFFF) {
576 printk(BIOS_WARNING
, "HECI: CSE device is hidden\n");
583 uint32_t me_read_config32(int offset
)
585 return pci_read_config32(PCH_DEV_CSE
, offset
);
589 * Sends GLOBAL_RESET_REQ cmd to CSE.The reset type can be GLOBAL_RESET/
590 * HOST_RESET_ONLY/CSE_RESET_ONLY.
592 int cse_request_global_reset(enum rst_req_type rst_type
)
595 struct mkhi_hdr reply
;
596 struct reset_message
{
601 struct reset_message msg
= {
603 .group_id
= MKHI_GROUP_ID_CBM
,
604 .command
= MKHI_CBM_GLOBAL_RESET_REQ
,
606 .req_origin
= GR_ORIGIN_BIOS_POST
,
607 .reset_type
= rst_type
611 printk(BIOS_DEBUG
, "HECI: Global Reset(Type:%d) Command\n", rst_type
);
612 if (!((rst_type
== GLOBAL_RESET
) ||
613 (rst_type
== HOST_RESET_ONLY
) || (rst_type
== CSE_RESET_ONLY
))) {
614 printk(BIOS_ERR
, "HECI: Unsupported reset type is requested\n");
620 reply_size
= sizeof(reply
);
621 memset(&reply
, 0, reply_size
);
623 if (rst_type
== CSE_RESET_ONLY
)
624 status
= heci_send(&msg
, sizeof(msg
), BIOS_HOST_ADDR
, HECI_MKHI_ADDR
);
626 status
= heci_send_receive(&msg
, sizeof(msg
), &reply
, &reply_size
);
628 printk(BIOS_DEBUG
, "HECI: Global Reset %s!\n", status
? "success" : "failure");
632 /* Sends HMRFPO Enable command to CSE */
633 int cse_hmrfpo_enable(void)
635 struct hmrfpo_enable_msg
{
640 /* HMRFPO Enable message */
641 struct hmrfpo_enable_msg msg
= {
643 .group_id
= MKHI_GROUP_ID_HMRFPO
,
644 .command
= MKHI_HMRFPO_ENABLE
,
649 /* HMRFPO Enable response */
650 struct hmrfpo_enable_resp
{
652 /* Base addr for factory data area, not relevant for client SKUs */
654 /* Length of factory data area, not relevant for client SKUs */
660 struct hmrfpo_enable_resp resp
;
661 size_t resp_size
= sizeof(struct hmrfpo_enable_resp
);
663 printk(BIOS_DEBUG
, "HECI: Send HMRFPO Enable Command\n");
665 * This command can be run only if:
666 * - Working state is normal and
667 * - Operation mode is normal or temporary disable mode.
669 if (!cse_is_hfs1_cws_normal() ||
670 (!cse_is_hfs1_com_normal() && !cse_is_hfs1_com_soft_temp_disable())) {
671 printk(BIOS_ERR
, "HECI: ME not in required Mode\n");
675 if (!heci_send_receive(&msg
, sizeof(struct hmrfpo_enable_msg
),
679 if (resp
.hdr
.result
) {
680 printk(BIOS_ERR
, "HECI: Resp Failed:%d\n", resp
.hdr
.result
);
690 * Sends HMRFPO Get Status command to CSE to get the HMRFPO status.
691 * The status can be DISABLED/LOCKED/ENABLED
693 int cse_hmrfpo_get_status(void)
695 struct hmrfpo_get_status_msg
{
699 struct hmrfpo_get_status_resp
{
705 struct hmrfpo_get_status_msg msg
= {
707 .group_id
= MKHI_GROUP_ID_HMRFPO
,
708 .command
= MKHI_HMRFPO_GET_STATUS
,
711 struct hmrfpo_get_status_resp resp
;
712 size_t resp_size
= sizeof(struct hmrfpo_get_status_resp
);
714 printk(BIOS_INFO
, "HECI: Sending Get HMRFPO Status Command\n");
716 if (!heci_send_receive(&msg
, sizeof(struct hmrfpo_get_status_msg
),
717 &resp
, &resp_size
)) {
718 printk(BIOS_ERR
, "HECI: HMRFPO send/receive fail\n");
722 if (resp
.hdr
.result
) {
723 printk(BIOS_ERR
, "HECI: HMRFPO Resp Failed:%d\n",
733 static void update_sec_bar(struct device
*dev
)
735 cse
.sec_bar
= find_resource(dev
, PCI_BASE_ADDRESS_0
)->base
;
738 static void cse_set_resources(struct device
*dev
)
740 if (dev
->path
.pci
.devfn
== PCH_DEVFN_CSE
)
743 pci_dev_set_resources(dev
);
746 static struct device_operations cse_ops
= {
747 .set_resources
= cse_set_resources
,
748 .read_resources
= pci_dev_read_resources
,
749 .enable_resources
= pci_dev_enable_resources
,
750 .init
= pci_dev_init
,
751 .ops_pci
= &pci_dev_ops_pci
,
754 static const unsigned short pci_device_ids
[] = {
755 PCI_DEVICE_ID_INTEL_APL_CSE0
,
756 PCI_DEVICE_ID_INTEL_GLK_CSE0
,
757 PCI_DEVICE_ID_INTEL_CNL_CSE0
,
758 PCI_DEVICE_ID_INTEL_SKL_CSE0
,
759 PCI_DEVICE_ID_INTEL_LWB_CSE0
,
760 PCI_DEVICE_ID_INTEL_LWB_CSE0_SUPER
,
761 PCI_DEVICE_ID_INTEL_CNP_H_CSE0
,
762 PCI_DEVICE_ID_INTEL_ICL_CSE0
,
763 PCI_DEVICE_ID_INTEL_CMP_CSE0
,
764 PCI_DEVICE_ID_INTEL_CMP_H_CSE0
,
765 PCI_DEVICE_ID_INTEL_TGL_CSE0
,
766 PCI_DEVICE_ID_INTEL_JSP_PRE_PROD_CSE0
,
767 PCI_DEVICE_ID_INTEL_MCC_CSE0
,
768 PCI_DEVICE_ID_INTEL_MCC_CSE1
,
769 PCI_DEVICE_ID_INTEL_MCC_CSE2
,
770 PCI_DEVICE_ID_INTEL_MCC_CSE3
,
774 static const struct pci_driver cse_driver __pci_driver
= {
776 .vendor
= PCI_VENDOR_ID_INTEL
,
777 /* SoC/chipset needs to provide PCI device ID */
778 .devices
= pci_device_ids