1 // SPDX-License-Identifier: GPL-2.0-only
3 * DDR PHY Front End (DPFE) driver for Broadcom set top box SoCs
5 * Copyright (c) 2017 Broadcom
9 * This driver provides access to the DPFE interface of Broadcom STB SoCs.
10 * The firmware running on the DCPU inside the DDR PHY can provide current
11 * information about the system's RAM, for instance the DRAM refresh rate.
12 * This can be used as an indirect indicator for the DRAM's temperature.
13 * Slower refresh rate means cooler RAM, higher refresh rate means hotter
16 * Throughout the driver, we use readl_relaxed() and writel_relaxed(), which
17 * already contain the appropriate le32_to_cpu()/cpu_to_le32() calls.
19 * Note regarding the loading of the firmware image: we use be32_to_cpu()
20 * and le_32_to_cpu(), so we can support the following four cases:
21 * - LE kernel + LE firmware image (the most common case)
22 * - LE kernel + BE firmware image
23 * - BE kernel + LE firmware image
24 * - BE kernel + BE firmware image
26 * The DPCU always runs in big endian mode. The firwmare image, however, can
27 * be in either format. Also, communication between host CPU and DCPU is
28 * always in little endian.
31 #include <linux/delay.h>
32 #include <linux/firmware.h>
34 #include <linux/module.h>
35 #include <linux/of_address.h>
36 #include <linux/platform_device.h>
38 #define DRVNAME "brcmstb-dpfe"
39 #define FIRMWARE_NAME "dpfe.bin"
41 /* DCPU register offsets */
42 #define REG_DCPU_RESET 0x0
43 #define REG_TO_DCPU_MBOX 0x10
44 #define REG_TO_HOST_MBOX 0x14
46 /* Macros to process offsets returned by the DCPU */
47 #define DRAM_MSG_ADDR_OFFSET 0x0
48 #define DRAM_MSG_TYPE_OFFSET 0x1c
49 #define DRAM_MSG_ADDR_MASK ((1UL << DRAM_MSG_TYPE_OFFSET) - 1)
50 #define DRAM_MSG_TYPE_MASK ((1UL << \
51 (BITS_PER_LONG - DRAM_MSG_TYPE_OFFSET)) - 1)
54 #define DCPU_MSG_RAM_START 0x100
55 #define DCPU_MSG_RAM(x) (DCPU_MSG_RAM_START + (x) * sizeof(u32))
57 /* DRAM Info Offsets & Masks */
58 #define DRAM_INFO_INTERVAL 0x0
59 #define DRAM_INFO_MR4 0x4
60 #define DRAM_INFO_ERROR 0x8
61 #define DRAM_INFO_MR4_MASK 0xff
63 /* DRAM MR4 Offsets & Masks */
64 #define DRAM_MR4_REFRESH 0x0 /* Refresh rate */
65 #define DRAM_MR4_SR_ABORT 0x3 /* Self Refresh Abort */
66 #define DRAM_MR4_PPRE 0x4 /* Post-package repair entry/exit */
67 #define DRAM_MR4_TH_OFFS 0x5 /* Thermal Offset; vendor specific */
68 #define DRAM_MR4_TUF 0x7 /* Temperature Update Flag */
70 #define DRAM_MR4_REFRESH_MASK 0x7
71 #define DRAM_MR4_SR_ABORT_MASK 0x1
72 #define DRAM_MR4_PPRE_MASK 0x1
73 #define DRAM_MR4_TH_OFFS_MASK 0x3
74 #define DRAM_MR4_TUF_MASK 0x1
76 /* DRAM Vendor Offsets & Masks */
77 #define DRAM_VENDOR_MR5 0x0
78 #define DRAM_VENDOR_MR6 0x4
79 #define DRAM_VENDOR_MR7 0x8
80 #define DRAM_VENDOR_MR8 0xc
81 #define DRAM_VENDOR_ERROR 0x10
82 #define DRAM_VENDOR_MASK 0xff
84 /* Reset register bits & masks */
85 #define DCPU_RESET_SHIFT 0x0
86 #define DCPU_RESET_MASK 0x1
87 #define DCPU_CLK_DISABLE_SHIFT 0x2
89 /* DCPU return codes */
90 #define DCPU_RET_ERROR_BIT BIT(31)
91 #define DCPU_RET_SUCCESS 0x1
92 #define DCPU_RET_ERR_HEADER (DCPU_RET_ERROR_BIT | BIT(0))
93 #define DCPU_RET_ERR_INVAL (DCPU_RET_ERROR_BIT | BIT(1))
94 #define DCPU_RET_ERR_CHKSUM (DCPU_RET_ERROR_BIT | BIT(2))
95 #define DCPU_RET_ERR_COMMAND (DCPU_RET_ERROR_BIT | BIT(3))
96 /* This error code is not firmware defined and only used in the driver. */
97 #define DCPU_RET_ERR_TIMEDOUT (DCPU_RET_ERROR_BIT | BIT(4))
100 #define DPFE_BE_MAGIC 0xfe1010fe
101 #define DPFE_LE_MAGIC 0xfe0101fe
104 #define ERR_INVALID_MAGIC -1
105 #define ERR_INVALID_SIZE -2
106 #define ERR_INVALID_CHKSUM -3
109 #define DPFE_MSG_TYPE_COMMAND 1
110 #define DPFE_MSG_TYPE_RESPONSE 2
112 #define DELAY_LOOP_MAX 200000
114 enum dpfe_msg_fields {
120 MSG_FIELD_MAX /* Last entry */
125 DPFE_CMD_GET_REFRESH,
127 DPFE_CMD_MAX /* Last entry */
135 u32 chksum; /* This is the sum of all other entries. */
139 * Format of the binary firmware file:
143 * value: 0xfe0101fe <== little endian
144 * 0xfe1010fe <== big endian
146 * [31:16] total segments on this build
147 * [15:0] this segment sequence.
153 * last checksum ==> sum of everything
155 struct dpfe_firmware_header {
163 /* Things we only need during initialization. */
165 unsigned int dmem_len;
166 unsigned int imem_len;
171 /* Things we need for as long as we are active. */
172 struct private_data {
180 static const char *error_text[] = {
181 "Success", "Header code incorrect", "Unknown command or argument",
182 "Incorrect checksum", "Malformed command", "Timed out",
185 /* List of supported firmware commands */
186 static const u32 dpfe_commands[DPFE_CMD_MAX][MSG_FIELD_MAX] = {
187 [DPFE_CMD_GET_INFO] = {
188 [MSG_HEADER] = DPFE_MSG_TYPE_COMMAND,
194 [DPFE_CMD_GET_REFRESH] = {
195 [MSG_HEADER] = DPFE_MSG_TYPE_COMMAND,
201 [DPFE_CMD_GET_VENDOR] = {
202 [MSG_HEADER] = DPFE_MSG_TYPE_COMMAND,
210 static bool is_dcpu_enabled(void __iomem *regs)
214 val = readl_relaxed(regs + REG_DCPU_RESET);
216 return !(val & DCPU_RESET_MASK);
219 static void __disable_dcpu(void __iomem *regs)
223 if (!is_dcpu_enabled(regs))
226 /* Put DCPU in reset if it's running. */
227 val = readl_relaxed(regs + REG_DCPU_RESET);
228 val |= (1 << DCPU_RESET_SHIFT);
229 writel_relaxed(val, regs + REG_DCPU_RESET);
232 static void __enable_dcpu(void __iomem *regs)
236 /* Clear mailbox registers. */
237 writel_relaxed(0, regs + REG_TO_DCPU_MBOX);
238 writel_relaxed(0, regs + REG_TO_HOST_MBOX);
240 /* Disable DCPU clock gating */
241 val = readl_relaxed(regs + REG_DCPU_RESET);
242 val &= ~(1 << DCPU_CLK_DISABLE_SHIFT);
243 writel_relaxed(val, regs + REG_DCPU_RESET);
245 /* Take DCPU out of reset */
246 val = readl_relaxed(regs + REG_DCPU_RESET);
247 val &= ~(1 << DCPU_RESET_SHIFT);
248 writel_relaxed(val, regs + REG_DCPU_RESET);
251 static unsigned int get_msg_chksum(const u32 msg[])
253 unsigned int sum = 0;
256 /* Don't include the last field in the checksum. */
257 for (i = 0; i < MSG_FIELD_MAX - 1; i++)
263 static void __iomem *get_msg_ptr(struct private_data *priv, u32 response,
264 char *buf, ssize_t *size)
266 unsigned int msg_type;
268 void __iomem *ptr = NULL;
270 msg_type = (response >> DRAM_MSG_TYPE_OFFSET) & DRAM_MSG_TYPE_MASK;
271 offset = (response >> DRAM_MSG_ADDR_OFFSET) & DRAM_MSG_ADDR_MASK;
274 * msg_type == 1: the offset is relative to the message RAM
275 * msg_type == 0: the offset is relative to the data RAM (this is the
276 * previous way of passing data)
277 * msg_type is anything else: there's critical hardware problem
281 ptr = priv->regs + DCPU_MSG_RAM_START + offset;
284 ptr = priv->dmem + offset;
287 dev_emerg(priv->dev, "invalid message reply from DCPU: %#x\n",
291 "FATAL: communication error with DCPU\n");
297 static int __send_command(struct private_data *priv, unsigned int cmd,
300 const u32 *msg = dpfe_commands[cmd];
301 void __iomem *regs = priv->regs;
302 unsigned int i, chksum;
306 if (cmd >= DPFE_CMD_MAX)
309 mutex_lock(&priv->lock);
311 /* Write command and arguments to message area */
312 for (i = 0; i < MSG_FIELD_MAX; i++)
313 writel_relaxed(msg[i], regs + DCPU_MSG_RAM(i));
315 /* Tell DCPU there is a command waiting */
316 writel_relaxed(1, regs + REG_TO_DCPU_MBOX);
318 /* Wait for DCPU to process the command */
319 for (i = 0; i < DELAY_LOOP_MAX; i++) {
320 /* Read response code */
321 resp = readl_relaxed(regs + REG_TO_HOST_MBOX);
327 if (i == DELAY_LOOP_MAX) {
328 resp = (DCPU_RET_ERR_TIMEDOUT & ~DCPU_RET_ERROR_BIT);
331 /* Read response data */
332 for (i = 0; i < MSG_FIELD_MAX; i++)
333 result[i] = readl_relaxed(regs + DCPU_MSG_RAM(i));
336 /* Tell DCPU we are done */
337 writel_relaxed(0, regs + REG_TO_HOST_MBOX);
339 mutex_unlock(&priv->lock);
344 /* Verify response */
345 chksum = get_msg_chksum(result);
346 if (chksum != result[MSG_CHKSUM])
347 resp = DCPU_RET_ERR_CHKSUM;
349 if (resp != DCPU_RET_SUCCESS) {
350 resp &= ~DCPU_RET_ERROR_BIT;
357 /* Ensure that the firmware file loaded meets all the requirements. */
358 static int __verify_firmware(struct init_data *init,
359 const struct firmware *fw)
361 const struct dpfe_firmware_header *header = (void *)fw->data;
362 unsigned int dmem_size, imem_size, total_size;
363 bool is_big_endian = false;
364 const u32 *chksum_ptr;
366 if (header->magic == DPFE_BE_MAGIC)
367 is_big_endian = true;
368 else if (header->magic != DPFE_LE_MAGIC)
369 return ERR_INVALID_MAGIC;
372 dmem_size = be32_to_cpu(header->dmem_size);
373 imem_size = be32_to_cpu(header->imem_size);
375 dmem_size = le32_to_cpu(header->dmem_size);
376 imem_size = le32_to_cpu(header->imem_size);
379 /* Data and instruction sections are 32 bit words. */
380 if ((dmem_size % sizeof(u32)) != 0 || (imem_size % sizeof(u32)) != 0)
381 return ERR_INVALID_SIZE;
384 * The header + the data section + the instruction section + the
385 * checksum must be equal to the total firmware size.
387 total_size = dmem_size + imem_size + sizeof(*header) +
389 if (total_size != fw->size)
390 return ERR_INVALID_SIZE;
392 /* The checksum comes at the very end. */
393 chksum_ptr = (void *)fw->data + sizeof(*header) + dmem_size + imem_size;
395 init->is_big_endian = is_big_endian;
396 init->dmem_len = dmem_size;
397 init->imem_len = imem_size;
398 init->chksum = (is_big_endian)
399 ? be32_to_cpu(*chksum_ptr) : le32_to_cpu(*chksum_ptr);
404 /* Verify checksum by reading back the firmware from co-processor RAM. */
405 static int __verify_fw_checksum(struct init_data *init,
406 struct private_data *priv,
407 const struct dpfe_firmware_header *header,
410 u32 magic, sequence, version, sum;
411 u32 __iomem *dmem = priv->dmem;
412 u32 __iomem *imem = priv->imem;
415 if (init->is_big_endian) {
416 magic = be32_to_cpu(header->magic);
417 sequence = be32_to_cpu(header->sequence);
418 version = be32_to_cpu(header->version);
420 magic = le32_to_cpu(header->magic);
421 sequence = le32_to_cpu(header->sequence);
422 version = le32_to_cpu(header->version);
425 sum = magic + sequence + version + init->dmem_len + init->imem_len;
427 for (i = 0; i < init->dmem_len / sizeof(u32); i++)
428 sum += readl_relaxed(dmem + i);
430 for (i = 0; i < init->imem_len / sizeof(u32); i++)
431 sum += readl_relaxed(imem + i);
433 return (sum == checksum) ? 0 : -1;
436 static int __write_firmware(u32 __iomem *mem, const u32 *fw,
437 unsigned int size, bool is_big_endian)
441 /* Convert size to 32-bit words. */
444 /* It is recommended to clear the firmware area first. */
445 for (i = 0; i < size; i++)
446 writel_relaxed(0, mem + i);
450 for (i = 0; i < size; i++)
451 writel_relaxed(be32_to_cpu(fw[i]), mem + i);
453 for (i = 0; i < size; i++)
454 writel_relaxed(le32_to_cpu(fw[i]), mem + i);
460 static int brcmstb_dpfe_download_firmware(struct platform_device *pdev,
461 struct init_data *init)
463 const struct dpfe_firmware_header *header;
464 unsigned int dmem_size, imem_size;
465 struct device *dev = &pdev->dev;
466 bool is_big_endian = false;
467 struct private_data *priv;
468 const struct firmware *fw;
469 const u32 *dmem, *imem;
473 priv = platform_get_drvdata(pdev);
476 * Skip downloading the firmware if the DCPU is already running and
477 * responding to commands.
479 if (is_dcpu_enabled(priv->regs)) {
480 u32 response[MSG_FIELD_MAX];
482 ret = __send_command(priv, DPFE_CMD_GET_INFO, response);
487 ret = request_firmware(&fw, FIRMWARE_NAME, dev);
488 /* request_firmware() prints its own error messages. */
492 ret = __verify_firmware(init, fw);
496 __disable_dcpu(priv->regs);
498 is_big_endian = init->is_big_endian;
499 dmem_size = init->dmem_len;
500 imem_size = init->imem_len;
502 /* At the beginning of the firmware blob is a header. */
503 header = (struct dpfe_firmware_header *)fw->data;
504 /* Void pointer to the beginning of the actual firmware. */
505 fw_blob = fw->data + sizeof(*header);
506 /* IMEM comes right after the header. */
508 /* DMEM follows after IMEM. */
509 dmem = fw_blob + imem_size;
511 ret = __write_firmware(priv->dmem, dmem, dmem_size, is_big_endian);
514 ret = __write_firmware(priv->imem, imem, imem_size, is_big_endian);
518 ret = __verify_fw_checksum(init, priv, header, init->chksum);
522 __enable_dcpu(priv->regs);
527 static ssize_t generic_show(unsigned int command, u32 response[],
528 struct device *dev, char *buf)
530 struct private_data *priv;
533 priv = dev_get_drvdata(dev);
535 return sprintf(buf, "ERROR: driver private data not set\n");
537 ret = __send_command(priv, command, response);
539 return sprintf(buf, "ERROR: %s\n", error_text[-ret]);
544 static ssize_t show_info(struct device *dev, struct device_attribute *devattr,
547 u32 response[MSG_FIELD_MAX];
551 ret = generic_show(DPFE_CMD_GET_INFO, response, dev, buf);
555 info = response[MSG_ARG0];
557 return sprintf(buf, "%u.%u.%u.%u\n",
564 static ssize_t show_refresh(struct device *dev,
565 struct device_attribute *devattr, char *buf)
567 u32 response[MSG_FIELD_MAX];
569 struct private_data *priv;
570 u8 refresh, sr_abort, ppre, thermal_offs, tuf;
574 ret = generic_show(DPFE_CMD_GET_REFRESH, response, dev, buf);
578 priv = dev_get_drvdata(dev);
580 info = get_msg_ptr(priv, response[MSG_ARG0], buf, &ret);
584 mr4 = readl_relaxed(info + DRAM_INFO_MR4) & DRAM_INFO_MR4_MASK;
586 refresh = (mr4 >> DRAM_MR4_REFRESH) & DRAM_MR4_REFRESH_MASK;
587 sr_abort = (mr4 >> DRAM_MR4_SR_ABORT) & DRAM_MR4_SR_ABORT_MASK;
588 ppre = (mr4 >> DRAM_MR4_PPRE) & DRAM_MR4_PPRE_MASK;
589 thermal_offs = (mr4 >> DRAM_MR4_TH_OFFS) & DRAM_MR4_TH_OFFS_MASK;
590 tuf = (mr4 >> DRAM_MR4_TUF) & DRAM_MR4_TUF_MASK;
592 return sprintf(buf, "%#x %#x %#x %#x %#x %#x %#x\n",
593 readl_relaxed(info + DRAM_INFO_INTERVAL),
594 refresh, sr_abort, ppre, thermal_offs, tuf,
595 readl_relaxed(info + DRAM_INFO_ERROR));
598 static ssize_t store_refresh(struct device *dev, struct device_attribute *attr,
599 const char *buf, size_t count)
601 u32 response[MSG_FIELD_MAX];
602 struct private_data *priv;
607 if (kstrtoul(buf, 0, &val) < 0)
610 priv = dev_get_drvdata(dev);
612 ret = __send_command(priv, DPFE_CMD_GET_REFRESH, response);
616 info = get_msg_ptr(priv, response[MSG_ARG0], NULL, NULL);
620 writel_relaxed(val, info + DRAM_INFO_INTERVAL);
625 static ssize_t show_vendor(struct device *dev, struct device_attribute *devattr,
628 u32 response[MSG_FIELD_MAX];
629 struct private_data *priv;
633 ret = generic_show(DPFE_CMD_GET_VENDOR, response, dev, buf);
637 priv = dev_get_drvdata(dev);
639 info = get_msg_ptr(priv, response[MSG_ARG0], buf, &ret);
643 return sprintf(buf, "%#x %#x %#x %#x %#x\n",
644 readl_relaxed(info + DRAM_VENDOR_MR5) & DRAM_VENDOR_MASK,
645 readl_relaxed(info + DRAM_VENDOR_MR6) & DRAM_VENDOR_MASK,
646 readl_relaxed(info + DRAM_VENDOR_MR7) & DRAM_VENDOR_MASK,
647 readl_relaxed(info + DRAM_VENDOR_MR8) & DRAM_VENDOR_MASK,
648 readl_relaxed(info + DRAM_VENDOR_ERROR) &
652 static int brcmstb_dpfe_resume(struct platform_device *pdev)
654 struct init_data init;
656 return brcmstb_dpfe_download_firmware(pdev, &init);
659 static DEVICE_ATTR(dpfe_info, 0444, show_info, NULL);
660 static DEVICE_ATTR(dpfe_refresh, 0644, show_refresh, store_refresh);
661 static DEVICE_ATTR(dpfe_vendor, 0444, show_vendor, NULL);
662 static struct attribute *dpfe_attrs[] = {
663 &dev_attr_dpfe_info.attr,
664 &dev_attr_dpfe_refresh.attr,
665 &dev_attr_dpfe_vendor.attr,
668 ATTRIBUTE_GROUPS(dpfe);
670 static int brcmstb_dpfe_probe(struct platform_device *pdev)
672 struct device *dev = &pdev->dev;
673 struct private_data *priv;
674 struct init_data init;
675 struct resource *res;
678 priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
682 mutex_init(&priv->lock);
683 platform_set_drvdata(pdev, priv);
685 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-cpu");
686 priv->regs = devm_ioremap_resource(dev, res);
687 if (IS_ERR(priv->regs)) {
688 dev_err(dev, "couldn't map DCPU registers\n");
692 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-dmem");
693 priv->dmem = devm_ioremap_resource(dev, res);
694 if (IS_ERR(priv->dmem)) {
695 dev_err(dev, "Couldn't map DCPU data memory\n");
699 res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dpfe-imem");
700 priv->imem = devm_ioremap_resource(dev, res);
701 if (IS_ERR(priv->imem)) {
702 dev_err(dev, "Couldn't map DCPU instruction memory\n");
706 ret = brcmstb_dpfe_download_firmware(pdev, &init);
710 ret = sysfs_create_groups(&pdev->dev.kobj, dpfe_groups);
712 dev_info(dev, "registered.\n");
717 static int brcmstb_dpfe_remove(struct platform_device *pdev)
719 sysfs_remove_groups(&pdev->dev.kobj, dpfe_groups);
724 static const struct of_device_id brcmstb_dpfe_of_match[] = {
725 { .compatible = "brcm,dpfe-cpu", },
728 MODULE_DEVICE_TABLE(of, brcmstb_dpfe_of_match);
730 static struct platform_driver brcmstb_dpfe_driver = {
733 .of_match_table = brcmstb_dpfe_of_match,
735 .probe = brcmstb_dpfe_probe,
736 .remove = brcmstb_dpfe_remove,
737 .resume = brcmstb_dpfe_resume,
740 module_platform_driver(brcmstb_dpfe_driver);
742 MODULE_AUTHOR("Markus Mayer <mmayer@broadcom.com>");
743 MODULE_DESCRIPTION("BRCMSTB DDR PHY Front End Driver");
744 MODULE_LICENSE("GPL");