cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

qcom,ebi2.txt (6321B)


      1Qualcomm External Bus Interface 2 (EBI2)
      2
      3The EBI2 contains two peripheral blocks: XMEM and LCDC. The XMEM handles any
      4external memory (such as NAND or other memory-mapped peripherals) whereas
      5LCDC handles LCD displays.
      6
      7As it says it connects devices to an external bus interface, meaning address
      8lines (up to 9 address lines so can only address 1KiB external memory space),
      9data lines (16 bits), OE (output enable), ADV (address valid, used on some
     10NOR flash memories), WE (write enable). This on top of 6 different chip selects
     11(CS0 thru CS5) so that in theory 6 different devices can be connected.
     12
     13Apparently this bus is clocked at 64MHz. It has dedicated pins on the package
     14and the bus can only come out on these pins, however if some of the pins are
     15unused they can be left unconnected or remuxed to be used as GPIO or in some
     16cases other orthogonal functions as well.
     17
     18Also CS1 and CS2 has -A and -B signals. Why they have that is unclear to me.
     19
     20The chip selects have the following memory range assignments. This region of
     21memory is referred to as "Chip Peripheral SS FPB0" and is 168MB big.
     22
     23Chip Select                     Physical address base
     24CS0 GPIO134                     0x1a800000-0x1b000000 (8MB)
     25CS1 GPIO39 (A) / GPIO123 (B)    0x1b000000-0x1b800000 (8MB)
     26CS2 GPIO40 (A) / GPIO124 (B)    0x1b800000-0x1c000000 (8MB)
     27CS3 GPIO133                     0x1d000000-0x25000000 (128 MB)
     28CS4 GPIO132                     0x1c800000-0x1d000000 (8MB)
     29CS5 GPIO131                     0x1c000000-0x1c800000 (8MB)
     30
     31The APQ8060 Qualcomm Application Processor User Guide, 80-N7150-14 Rev. A,
     32August 6, 2012 contains some incomplete documentation of the EBI2.
     33
     34FIXME: the manual mentions "write precharge cycles" and "precharge cycles".
     35We have not been able to figure out which bit fields these correspond to
     36in the hardware, or what valid values exist. The current hypothesis is that
     37this is something just used on the FAST chip selects and that the SLOW
     38chip selects are understood fully. There is also a "byte device enable"
     39flag somewhere for 8bit memories.
     40
     41FIXME: The chipselects have SLOW and FAST configuration registers. It's a bit
     42unclear what this means, if they are mutually exclusive or can be used
     43together, or if some chip selects are hardwired to be FAST and others are SLOW
     44by design.
     45
     46The XMEM registers are totally undocumented but could be partially decoded
     47because the Cypress AN49576 Antioch Westbridge apparently has suspiciously
     48similar register layout, see: http://www.cypress.com/file/105771/download
     49
     50Required properties:
     51- compatible: should be one of:
     52  "qcom,msm8660-ebi2"
     53  "qcom,apq8060-ebi2"
     54- #address-cells: should be <2>: the first cell is the chipselect,
     55  the second cell is the offset inside the memory range
     56- #size-cells: should be <1>
     57- ranges: should be set to:
     58  ranges = <0 0x0 0x1a800000 0x00800000>,
     59           <1 0x0 0x1b000000 0x00800000>,
     60           <2 0x0 0x1b800000 0x00800000>,
     61           <3 0x0 0x1d000000 0x08000000>,
     62           <4 0x0 0x1c800000 0x00800000>,
     63           <5 0x0 0x1c000000 0x00800000>;
     64- reg: two ranges of registers: EBI2 config and XMEM config areas
     65- reg-names: should be "ebi2", "xmem"
     66- clocks: two clocks, EBI_2X and EBI
     67- clock-names: should be "ebi2x", "ebi2"
     68
     69Optional subnodes:
     70- Nodes inside the EBI2 will be considered device nodes.
     71
     72The following optional properties are properties that can be tagged onto
     73any device subnode. We are assuming that there can be only ONE device per
     74chipselect subnode, else the properties will become ambiguous.
     75
     76Optional properties arrays for SLOW chip selects:
     77- qcom,xmem-recovery-cycles: recovery cycles is the time the memory continues to
     78  drive the data bus after OE is de-asserted, in order to avoid contention on
     79  the data bus. They are inserted when reading one CS and switching to another
     80  CS or read followed by write on the same CS. Valid values 0 thru 15. Minimum
     81  value is actually 1, so a value of 0 will still yield 1 recovery cycle.
     82- qcom,xmem-write-hold-cycles: write hold cycles, these are extra cycles
     83  inserted after every write minimum 1. The data out is driven from the time
     84  WE is asserted until CS is asserted. With a hold of 1 (value = 0), the CS
     85  stays active for 1 extra cycle etc. Valid values 0 thru 15.
     86- qcom,xmem-write-delta-cycles: initial latency for write cycles inserted for
     87  the first write to a page or burst memory. Valid values 0 thru 255.
     88- qcom,xmem-read-delta-cycles: initial latency for read cycles inserted for the
     89  first read to a page or burst memory. Valid values 0 thru 255.
     90- qcom,xmem-write-wait-cycles: number of wait cycles for every write access, 0=1
     91  cycle. Valid values 0 thru 15.
     92- qcom,xmem-read-wait-cycles: number of wait cycles for every read access, 0=1
     93  cycle. Valid values 0 thru 15.
     94
     95Optional properties arrays for FAST chip selects:
     96- qcom,xmem-address-hold-enable: this is a boolean property stating that we
     97  shall hold the address for an extra cycle to meet hold time requirements
     98  with ADV assertion.
     99- qcom,xmem-adv-to-oe-recovery-cycles: the number of cycles elapsed before an OE
    100  assertion, with respect to the cycle where ADV (address valid) is asserted.
    101  2 means 2 cycles between ADV and OE. Valid values 0, 1, 2 or 3.
    102- qcom,xmem-read-hold-cycles: the length in cycles of the first segment of a
    103  read transfer. For a single read transfer this will be the time from CS
    104  assertion to OE assertion. Valid values 0 thru 15.
    105
    106
    107Example:
    108
    109ebi2@1a100000 {
    110	compatible = "qcom,apq8060-ebi2";
    111	#address-cells = <2>;
    112	#size-cells = <1>;
    113	ranges = <0 0x0 0x1a800000 0x00800000>,
    114		 <1 0x0 0x1b000000 0x00800000>,
    115		 <2 0x0 0x1b800000 0x00800000>,
    116		 <3 0x0 0x1d000000 0x08000000>,
    117		 <4 0x0 0x1c800000 0x00800000>,
    118		 <5 0x0 0x1c000000 0x00800000>;
    119	reg = <0x1a100000 0x1000>, <0x1a110000 0x1000>;
    120	reg-names = "ebi2", "xmem";
    121	clocks = <&gcc EBI2_2X_CLK>, <&gcc EBI2_CLK>;
    122	clock-names = "ebi2x", "ebi2";
    123	/* Make sure to set up the pin control for the EBI2 */
    124	pinctrl-names = "default";
    125	pinctrl-0 = <&foo_ebi2_pins>;
    126
    127	foo-ebi2@2,0 {
    128		compatible = "foo";
    129		reg = <2 0x0 0x100>;
    130		(...)
    131		qcom,xmem-recovery-cycles = <0>;
    132		qcom,xmem-write-hold-cycles = <3>;
    133		qcom,xmem-write-delta-cycles = <31>;
    134		qcom,xmem-read-delta-cycles = <28>;
    135		qcom,xmem-write-wait-cycles = <9>;
    136		qcom,xmem-read-wait-cycles = <9>;
    137	};
    138};