Issue #297 has been updated by Michael Gogiashvili.
Root cause found, fix written and verified at runtime on a T440p. **TL;DR:** The Lenovo firmware contains a DXE module (`DxeRealtekCrcInit`) that initializes the RTS5227 after PCIe enumeration. coreboot omits this entirely, leaving the reader's power path and PHY unconfigured — every SD command that expects a response times out (`rtsx_pci_send_cmd error -110`). Replicating the vendor init sequence in a small coreboot ramstage driver makes the reader fully functional. **The vendor init sequence** (reverse engineered from the vendor BIOS module; only derived register values are published, no vendor code): 1. PCI config-space "vendor settings" that the Linux `rtsx_pci` driver *reads back* but never writes (`rtsx_vendor_setting_valid()`): dword `0x724` and reg `0x814`, bracketed by a write-enable at `0x817` (`0x817 = 0x80` … program … `0x817 = 0x00`; without the unlock the registers silently ignore writes). **Crucially, the values are IC-version dependent:** `DUMMY_REG_RESET_0` (internal reg `0xFE90`) bits 3:0 report the IC version. Version ≤ 2 gets `0x724 = 0xaeff9fea`, `0x814 = 0x60` (byte); version > 2 gets the *reverse-socket* table `0x724 = 0xbeff9fea`, `0x814 = 0x4060` (word, bit 14 = reverse_socket). My T440p reader reports **version 4**. Programming the version-≤2 values on it kills card detect completely (SD_EXIST never asserts; inserting a card produces a spurious removal event). 2. Internal registers via the HAIMR window (BAR0 + `0x10`, write = `0xC0000000 | addr<<16 | mask<<8 | data`): `0xFE57` mask `0x13` data `0x10`, `0xFF03` mask `0x80` data `0x80`, `0xFE8D = 0x00`, `0xFE58 = 0x11`. 3. PCIe PHY tunings (via `0xFE3C..0xFE3F`): PHY `0x1E = 0x78EB`, PHY `0x19 = 0xFE6C`. 4. The card power path — decisive for the dead-card symptom: `PWD_SUSPEND_EN (0xFE76) = 0xFF`, `PWR_GATE_CTRL (0xFE75) = 0xF1`. The Linux driver assumes the firmware did this. **Runtime proof (2026-06-12):** applying exactly this sequence from Linux (setpci with the 0x817 unlock + HAIMR writes via /dev/mem, then rebinding `rtsx_pci`) on an otherwise dead reader: `mmc0: new high speed SDXC card at address 0001`, `mmcblk0` with partitions, zero -110 errors, SD_EXIST asserts on insert. **Ruled out along the way** (all tested live): ASPM (root-port ASPM was already off on LPT-H), GPIO 8/24 levels, runtime PM / D0 pinning, kernel-side LDO power-down, CD_PAD_CTL force bits. A secondary issue is real though: coreboot enables LTR in the root port but never provides LTR max latencies on Lynx Point (only on Wildcat Point), leaving 0 ns — fixed in a separate patch. **Patches** (on Gerrit): 1. [CB:93436](https://review.coreboot.org/c/coreboot/+/93436) `drivers/realtek: Add RTS5227 card reader init for ThinkPad T440p` — new ramstage driver `src/drivers/realtek/rts5227.c` (matches `10ec:5227`/`5229`), IC-version-aware, selected by `BOARD_LENOVO_THINKPAD_T440P`. 2. [CB:93437](https://review.coreboot.org/c/coreboot/+/93437) `sb/intel/lynxpoint: Provide LTR max latencies on LPT as well`. 3. [CB:93438](https://review.coreboot.org/c/coreboot/+/93438) `mb/lenovo/haswell: Match vendor GPIO 8/24 levels on t440p` (cosmetic alignment with vendor FW; not required for the fix). Verified: with the final ROM flashed (2026-06-12) the coreboot console logs `RTS5227: IC version 4 -> reverse socket table` and the card works out of the box across reboots and insert/remove cycles, zero -110 errors. ---------------------------------------- Bug #297: T440P card reader is broken. https://ticket.coreboot.org/issues/297#change-2335 * Author: Jamal Wright * Status: New * Priority: Normal * Start date: 2021-03-03 ---------------------------------------- I've been trying to figure out the reason why the card reader detects but doesn't work and crashes windows. Wanted to track this bug outside of the mailing list since that will probably get lost. I've even cross compared to the X250 and everything looks normal. Am I missing a GPIO? Is there something wrong with the PCIE detection? Perhaps a conflict with the wifi which is on the same PCIE root? Building off master as of 3/3/21 I get this in kernel: kernel: pci 0000:00:1c.1: [8086:8c12] type 01 class 0x060400 kernel: pci 0000:00:1c.1: PME# supported from D0 D3hot D3cold kernel: pci 0000:00:1c.1: PCI bridge to [bus 03] kernel: pci 0000:00:1c.1: bridge window [mem 0x82300000-0x823fffff] kernel: pci 0000:00:1c.1: PCI bridge to [bus 03] kernel: pci 0000:00:1c.1: bridge window [mem 0x82300000-0x823fffff] kernel: pcieport 0000:00:1c.1: PME: Signaling with IRQ 27 kernel: pcieport 0000:00:1c.1: AER: enabled with IRQ 27 This is my PCIE tree: -[0000:00]-+-00.0 Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor DRAM Controller +-02.0 Intel Corporation 4th Gen Core Processor Integrated Graphics Controller +-03.0 Intel Corporation Xeon E3-1200 v3/4th Gen Core Processor HD Audio Controller +-04.0 Intel Corporation Device 0c03 +-14.0 Intel Corporation 8 Series/C220 Series Chipset Family USB xHCI +-16.0 Intel Corporation 8 Series/C220 Series Chipset Family MEI Controller #1 +-19.0 Intel Corporation Ethernet Connection I217-LM +-1a.0 Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #2 +-1b.0 Intel Corporation 8 Series/C220 Series Chipset High Definition Audio Controller +-1c.0-[02]----00.0 Realtek Semiconductor Co., Ltd. RTS5227 PCI Express Card Reader +-1c.1-[03]----00.0 Intel Corporation Wireless 7265 +-1d.0 Intel Corporation 8 Series/C220 Series Chipset Family USB EHCI #1 +-1f.0 Intel Corporation QM87 Express LPC Controller +-1f.2 Intel Corporation 8 Series/C220 Series Chipset Family 6-port SATA Controller 1 [AHCI mode] \-1f.3 Intel Corporation 8 Series/C220 Series Chipset Family SMBus Controller LSPCI -vv : https://pastebin.com/0hbb0vZg I've attached CBMEM logs as well. A bit out of ideas, just sitting with fingers crossed hoping a haswell or lynxpoint commit fixes it :) ---Files-------------------------------- onbtpci.txt (26.2 KB) pcidevs.txt (26.2 KB) x250pci.txt (21.9 KB) pcidevs.txt (26.2 KB) dsdt.pre (568 KB) pcitreeven.txt (1.09 KB) T440P-vendor.txt (22.9 KB) thinkpad_t440p.7z (4.72 KB) logs.7z (118 KB) arch-dmesg.txt (66.1 KB) cinamon-dmesg.txt (57.2 KB) dmesg-buntu.txt (62.2 KB) -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: https://ticket.coreboot.org/my/account _______________________________________________ coreboot mailing list -- [email protected] To unsubscribe send an email to [email protected]
