Commit | Line | Data |
---|---|---|
fd3b339c | 1 | // SPDX-License-Identifier: GPL-2.0 |
3e136768 MW |
2 | /* |
3 | * Thunderbolt DMA configuration based mailbox support | |
4 | * | |
5 | * Copyright (C) 2017, Intel Corporation | |
6 | * Authors: Michael Jamet <michael.jamet@intel.com> | |
7 | * Mika Westerberg <mika.westerberg@linux.intel.com> | |
3e136768 MW |
8 | */ |
9 | ||
10 | #include <linux/delay.h> | |
11 | #include <linux/slab.h> | |
12 | ||
13 | #include "dma_port.h" | |
14 | #include "tb_regs.h" | |
15 | ||
16 | #define DMA_PORT_CAP 0x3e | |
17 | ||
18 | #define MAIL_DATA 1 | |
19 | #define MAIL_DATA_DWORDS 16 | |
20 | ||
21 | #define MAIL_IN 17 | |
22 | #define MAIL_IN_CMD_SHIFT 28 | |
23 | #define MAIL_IN_CMD_MASK GENMASK(31, 28) | |
24 | #define MAIL_IN_CMD_FLASH_WRITE 0x0 | |
25 | #define MAIL_IN_CMD_FLASH_UPDATE_AUTH 0x1 | |
26 | #define MAIL_IN_CMD_FLASH_READ 0x2 | |
27 | #define MAIL_IN_CMD_POWER_CYCLE 0x4 | |
28 | #define MAIL_IN_DWORDS_SHIFT 24 | |
29 | #define MAIL_IN_DWORDS_MASK GENMASK(27, 24) | |
30 | #define MAIL_IN_ADDRESS_SHIFT 2 | |
31 | #define MAIL_IN_ADDRESS_MASK GENMASK(23, 2) | |
32 | #define MAIL_IN_CSS BIT(1) | |
33 | #define MAIL_IN_OP_REQUEST BIT(0) | |
34 | ||
35 | #define MAIL_OUT 18 | |
36 | #define MAIL_OUT_STATUS_RESPONSE BIT(29) | |
37 | #define MAIL_OUT_STATUS_CMD_SHIFT 4 | |
38 | #define MAIL_OUT_STATUS_CMD_MASK GENMASK(7, 4) | |
39 | #define MAIL_OUT_STATUS_MASK GENMASK(3, 0) | |
40 | #define MAIL_OUT_STATUS_COMPLETED 0 | |
41 | #define MAIL_OUT_STATUS_ERR_AUTH 1 | |
42 | #define MAIL_OUT_STATUS_ERR_ACCESS 2 | |
43 | ||
44 | #define DMA_PORT_TIMEOUT 5000 /* ms */ | |
45 | #define DMA_PORT_RETRIES 3 | |
46 | ||
47 | /** | |
48 | * struct tb_dma_port - DMA control port | |
49 | * @sw: Switch the DMA port belongs to | |
50 | * @port: Switch port number where DMA capability is found | |
51 | * @base: Start offset of the mailbox registers | |
52 | * @buf: Temporary buffer to store a single block | |
53 | */ | |
54 | struct tb_dma_port { | |
55 | struct tb_switch *sw; | |
56 | u8 port; | |
57 | u32 base; | |
58 | u8 *buf; | |
59 | }; | |
60 | ||
61 | /* | |
62 | * When the switch is in safe mode it supports very little functionality | |
63 | * so we don't validate that much here. | |
64 | */ | |
65 | static bool dma_port_match(const struct tb_cfg_request *req, | |
66 | const struct ctl_pkg *pkg) | |
67 | { | |
68 | u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63); | |
69 | ||
70 | if (pkg->frame.eof == TB_CFG_PKG_ERROR) | |
71 | return true; | |
72 | if (pkg->frame.eof != req->response_type) | |
73 | return false; | |
74 | if (route != tb_cfg_get_route(req->request)) | |
75 | return false; | |
76 | if (pkg->frame.size != req->response_size) | |
77 | return false; | |
78 | ||
79 | return true; | |
80 | } | |
81 | ||
82 | static bool dma_port_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg) | |
83 | { | |
84 | memcpy(req->response, pkg->buffer, req->response_size); | |
85 | return true; | |
86 | } | |
87 | ||
88 | static int dma_port_read(struct tb_ctl *ctl, void *buffer, u64 route, | |
89 | u32 port, u32 offset, u32 length, int timeout_msec) | |
90 | { | |
91 | struct cfg_read_pkg request = { | |
92 | .header = tb_cfg_make_header(route), | |
93 | .addr = { | |
94 | .seq = 1, | |
95 | .port = port, | |
96 | .space = TB_CFG_PORT, | |
97 | .offset = offset, | |
98 | .length = length, | |
99 | }, | |
100 | }; | |
101 | struct tb_cfg_request *req; | |
102 | struct cfg_write_pkg reply; | |
103 | struct tb_cfg_result res; | |
104 | ||
105 | req = tb_cfg_request_alloc(); | |
106 | if (!req) | |
107 | return -ENOMEM; | |
108 | ||
109 | req->match = dma_port_match; | |
110 | req->copy = dma_port_copy; | |
111 | req->request = &request; | |
112 | req->request_size = sizeof(request); | |
113 | req->request_type = TB_CFG_PKG_READ; | |
114 | req->response = &reply; | |
115 | req->response_size = 12 + 4 * length; | |
116 | req->response_type = TB_CFG_PKG_READ; | |
117 | ||
118 | res = tb_cfg_request_sync(ctl, req, timeout_msec); | |
119 | ||
120 | tb_cfg_request_put(req); | |
121 | ||
122 | if (res.err) | |
123 | return res.err; | |
124 | ||
125 | memcpy(buffer, &reply.data, 4 * length); | |
126 | return 0; | |
127 | } | |
128 | ||
129 | static int dma_port_write(struct tb_ctl *ctl, const void *buffer, u64 route, | |
130 | u32 port, u32 offset, u32 length, int timeout_msec) | |
131 | { | |
132 | struct cfg_write_pkg request = { | |
133 | .header = tb_cfg_make_header(route), | |
134 | .addr = { | |
135 | .seq = 1, | |
136 | .port = port, | |
137 | .space = TB_CFG_PORT, | |
138 | .offset = offset, | |
139 | .length = length, | |
140 | }, | |
141 | }; | |
142 | struct tb_cfg_request *req; | |
143 | struct cfg_read_pkg reply; | |
144 | struct tb_cfg_result res; | |
145 | ||
146 | memcpy(&request.data, buffer, length * 4); | |
147 | ||
148 | req = tb_cfg_request_alloc(); | |
149 | if (!req) | |
150 | return -ENOMEM; | |
151 | ||
152 | req->match = dma_port_match; | |
153 | req->copy = dma_port_copy; | |
154 | req->request = &request; | |
155 | req->request_size = 12 + 4 * length; | |
156 | req->request_type = TB_CFG_PKG_WRITE; | |
157 | req->response = &reply; | |
158 | req->response_size = sizeof(reply); | |
159 | req->response_type = TB_CFG_PKG_WRITE; | |
160 | ||
161 | res = tb_cfg_request_sync(ctl, req, timeout_msec); | |
162 | ||
163 | tb_cfg_request_put(req); | |
164 | ||
165 | return res.err; | |
166 | } | |
167 | ||
168 | static int dma_find_port(struct tb_switch *sw) | |
169 | { | |
4bac471d RM |
170 | static const int ports[] = { 3, 5, 7 }; |
171 | int i; | |
3e136768 MW |
172 | |
173 | /* | |
4bac471d RM |
174 | * The DMA (NHI) port is either 3, 5 or 7 depending on the |
175 | * controller. Try all of them. | |
3e136768 | 176 | */ |
4bac471d RM |
177 | for (i = 0; i < ARRAY_SIZE(ports); i++) { |
178 | u32 type; | |
179 | int ret; | |
180 | ||
181 | ret = dma_port_read(sw->tb->ctl, &type, tb_route(sw), ports[i], | |
182 | 2, 1, DMA_PORT_TIMEOUT); | |
183 | if (!ret && (type & 0xffffff) == TB_TYPE_NHI) | |
184 | return ports[i]; | |
185 | } | |
3e136768 MW |
186 | |
187 | return -ENODEV; | |
188 | } | |
189 | ||
190 | /** | |
191 | * dma_port_alloc() - Finds DMA control port from a switch pointed by route | |
192 | * @sw: Switch from where find the DMA port | |
193 | * | |
194 | * Function checks if the switch NHI port supports DMA configuration | |
195 | * based mailbox capability and if it does, allocates and initializes | |
196 | * DMA port structure. Returns %NULL if the capabity was not found. | |
197 | * | |
198 | * The DMA control port is functional also when the switch is in safe | |
199 | * mode. | |
200 | */ | |
201 | struct tb_dma_port *dma_port_alloc(struct tb_switch *sw) | |
202 | { | |
203 | struct tb_dma_port *dma; | |
204 | int port; | |
205 | ||
206 | port = dma_find_port(sw); | |
207 | if (port < 0) | |
208 | return NULL; | |
209 | ||
210 | dma = kzalloc(sizeof(*dma), GFP_KERNEL); | |
211 | if (!dma) | |
212 | return NULL; | |
213 | ||
214 | dma->buf = kmalloc_array(MAIL_DATA_DWORDS, sizeof(u32), GFP_KERNEL); | |
215 | if (!dma->buf) { | |
216 | kfree(dma); | |
217 | return NULL; | |
218 | } | |
219 | ||
220 | dma->sw = sw; | |
221 | dma->port = port; | |
222 | dma->base = DMA_PORT_CAP; | |
223 | ||
224 | return dma; | |
225 | } | |
226 | ||
227 | /** | |
228 | * dma_port_free() - Release DMA control port structure | |
229 | * @dma: DMA control port | |
230 | */ | |
231 | void dma_port_free(struct tb_dma_port *dma) | |
232 | { | |
233 | if (dma) { | |
234 | kfree(dma->buf); | |
235 | kfree(dma); | |
236 | } | |
237 | } | |
238 | ||
239 | static int dma_port_wait_for_completion(struct tb_dma_port *dma, | |
240 | unsigned int timeout) | |
241 | { | |
242 | unsigned long end = jiffies + msecs_to_jiffies(timeout); | |
243 | struct tb_switch *sw = dma->sw; | |
244 | ||
245 | do { | |
246 | int ret; | |
247 | u32 in; | |
248 | ||
249 | ret = dma_port_read(sw->tb->ctl, &in, tb_route(sw), dma->port, | |
250 | dma->base + MAIL_IN, 1, 50); | |
251 | if (ret) { | |
252 | if (ret != -ETIMEDOUT) | |
253 | return ret; | |
254 | } else if (!(in & MAIL_IN_OP_REQUEST)) { | |
255 | return 0; | |
256 | } | |
257 | ||
258 | usleep_range(50, 100); | |
259 | } while (time_before(jiffies, end)); | |
260 | ||
261 | return -ETIMEDOUT; | |
262 | } | |
263 | ||
264 | static int status_to_errno(u32 status) | |
265 | { | |
266 | switch (status & MAIL_OUT_STATUS_MASK) { | |
267 | case MAIL_OUT_STATUS_COMPLETED: | |
268 | return 0; | |
269 | case MAIL_OUT_STATUS_ERR_AUTH: | |
270 | return -EINVAL; | |
271 | case MAIL_OUT_STATUS_ERR_ACCESS: | |
272 | return -EACCES; | |
273 | } | |
274 | ||
275 | return -EIO; | |
276 | } | |
277 | ||
278 | static int dma_port_request(struct tb_dma_port *dma, u32 in, | |
279 | unsigned int timeout) | |
280 | { | |
281 | struct tb_switch *sw = dma->sw; | |
282 | u32 out; | |
283 | int ret; | |
284 | ||
285 | ret = dma_port_write(sw->tb->ctl, &in, tb_route(sw), dma->port, | |
286 | dma->base + MAIL_IN, 1, DMA_PORT_TIMEOUT); | |
287 | if (ret) | |
288 | return ret; | |
289 | ||
290 | ret = dma_port_wait_for_completion(dma, timeout); | |
291 | if (ret) | |
292 | return ret; | |
293 | ||
294 | ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port, | |
295 | dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT); | |
296 | if (ret) | |
297 | return ret; | |
298 | ||
299 | return status_to_errno(out); | |
300 | } | |
301 | ||
302 | static int dma_port_flash_read_block(struct tb_dma_port *dma, u32 address, | |
303 | void *buf, u32 size) | |
304 | { | |
305 | struct tb_switch *sw = dma->sw; | |
306 | u32 in, dwaddress, dwords; | |
307 | int ret; | |
308 | ||
309 | dwaddress = address / 4; | |
310 | dwords = size / 4; | |
311 | ||
312 | in = MAIL_IN_CMD_FLASH_READ << MAIL_IN_CMD_SHIFT; | |
313 | if (dwords < MAIL_DATA_DWORDS) | |
314 | in |= (dwords << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK; | |
315 | in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK; | |
316 | in |= MAIL_IN_OP_REQUEST; | |
317 | ||
318 | ret = dma_port_request(dma, in, DMA_PORT_TIMEOUT); | |
319 | if (ret) | |
320 | return ret; | |
321 | ||
322 | return dma_port_read(sw->tb->ctl, buf, tb_route(sw), dma->port, | |
323 | dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT); | |
324 | } | |
325 | ||
326 | static int dma_port_flash_write_block(struct tb_dma_port *dma, u32 address, | |
327 | const void *buf, u32 size) | |
328 | { | |
329 | struct tb_switch *sw = dma->sw; | |
330 | u32 in, dwaddress, dwords; | |
331 | int ret; | |
332 | ||
333 | dwords = size / 4; | |
334 | ||
335 | /* Write the block to MAIL_DATA registers */ | |
336 | ret = dma_port_write(sw->tb->ctl, buf, tb_route(sw), dma->port, | |
337 | dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT); | |
338 | ||
339 | in = MAIL_IN_CMD_FLASH_WRITE << MAIL_IN_CMD_SHIFT; | |
340 | ||
341 | /* CSS header write is always done to the same magic address */ | |
342 | if (address >= DMA_PORT_CSS_ADDRESS) { | |
343 | dwaddress = DMA_PORT_CSS_ADDRESS; | |
344 | in |= MAIL_IN_CSS; | |
345 | } else { | |
346 | dwaddress = address / 4; | |
347 | } | |
348 | ||
349 | in |= ((dwords - 1) << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK; | |
350 | in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK; | |
351 | in |= MAIL_IN_OP_REQUEST; | |
352 | ||
353 | return dma_port_request(dma, in, DMA_PORT_TIMEOUT); | |
354 | } | |
355 | ||
356 | /** | |
357 | * dma_port_flash_read() - Read from active flash region | |
358 | * @dma: DMA control port | |
359 | * @address: Address relative to the start of active region | |
360 | * @buf: Buffer where the data is read | |
361 | * @size: Size of the buffer | |
362 | */ | |
363 | int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, | |
364 | void *buf, size_t size) | |
365 | { | |
366 | unsigned int retries = DMA_PORT_RETRIES; | |
367 | unsigned int offset; | |
368 | ||
369 | offset = address & 3; | |
370 | address = address & ~3; | |
371 | ||
372 | do { | |
373 | u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); | |
374 | int ret; | |
375 | ||
376 | ret = dma_port_flash_read_block(dma, address, dma->buf, | |
377 | ALIGN(nbytes, 4)); | |
378 | if (ret) { | |
379 | if (ret == -ETIMEDOUT) { | |
380 | if (retries--) | |
381 | continue; | |
382 | ret = -EIO; | |
383 | } | |
384 | return ret; | |
385 | } | |
386 | ||
387 | memcpy(buf, dma->buf + offset, nbytes); | |
388 | ||
389 | size -= nbytes; | |
390 | address += nbytes; | |
391 | buf += nbytes; | |
392 | } while (size > 0); | |
393 | ||
394 | return 0; | |
395 | } | |
396 | ||
397 | /** | |
398 | * dma_port_flash_write() - Write to non-active flash region | |
399 | * @dma: DMA control port | |
400 | * @address: Address relative to the start of non-active region | |
401 | * @buf: Data to write | |
402 | * @size: Size of the buffer | |
403 | * | |
404 | * Writes block of data to the non-active flash region of the switch. If | |
405 | * the address is given as %DMA_PORT_CSS_ADDRESS the block is written | |
406 | * using CSS command. | |
407 | */ | |
408 | int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address, | |
409 | const void *buf, size_t size) | |
410 | { | |
411 | unsigned int retries = DMA_PORT_RETRIES; | |
412 | unsigned int offset; | |
413 | ||
414 | if (address >= DMA_PORT_CSS_ADDRESS) { | |
415 | offset = 0; | |
416 | if (size > DMA_PORT_CSS_MAX_SIZE) | |
417 | return -E2BIG; | |
418 | } else { | |
419 | offset = address & 3; | |
420 | address = address & ~3; | |
421 | } | |
422 | ||
423 | do { | |
424 | u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); | |
425 | int ret; | |
426 | ||
427 | memcpy(dma->buf + offset, buf, nbytes); | |
428 | ||
429 | ret = dma_port_flash_write_block(dma, address, buf, nbytes); | |
430 | if (ret) { | |
431 | if (ret == -ETIMEDOUT) { | |
432 | if (retries--) | |
433 | continue; | |
434 | ret = -EIO; | |
435 | } | |
436 | return ret; | |
437 | } | |
438 | ||
439 | size -= nbytes; | |
440 | address += nbytes; | |
441 | buf += nbytes; | |
442 | } while (size > 0); | |
443 | ||
444 | return 0; | |
445 | } | |
446 | ||
447 | /** | |
448 | * dma_port_flash_update_auth() - Starts flash authenticate cycle | |
449 | * @dma: DMA control port | |
450 | * | |
451 | * Starts the flash update authentication cycle. If the image in the | |
452 | * non-active area was valid, the switch starts upgrade process where | |
453 | * active and non-active area get swapped in the end. Caller should call | |
454 | * dma_port_flash_update_auth_status() to get status of this command. | |
455 | * This is because if the switch in question is root switch the | |
456 | * thunderbolt host controller gets reset as well. | |
457 | */ | |
458 | int dma_port_flash_update_auth(struct tb_dma_port *dma) | |
459 | { | |
460 | u32 in; | |
461 | ||
462 | in = MAIL_IN_CMD_FLASH_UPDATE_AUTH << MAIL_IN_CMD_SHIFT; | |
463 | in |= MAIL_IN_OP_REQUEST; | |
464 | ||
465 | return dma_port_request(dma, in, 150); | |
466 | } | |
467 | ||
468 | /** | |
469 | * dma_port_flash_update_auth_status() - Reads status of update auth command | |
470 | * @dma: DMA control port | |
471 | * @status: Status code of the operation | |
472 | * | |
473 | * The function checks if there is status available from the last update | |
474 | * auth command. Returns %0 if there is no status and no further | |
475 | * action is required. If there is status, %1 is returned instead and | |
476 | * @status holds the failure code. | |
477 | * | |
478 | * Negative return means there was an error reading status from the | |
479 | * switch. | |
480 | */ | |
481 | int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status) | |
482 | { | |
483 | struct tb_switch *sw = dma->sw; | |
484 | u32 out, cmd; | |
485 | int ret; | |
486 | ||
487 | ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port, | |
488 | dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT); | |
489 | if (ret) | |
490 | return ret; | |
491 | ||
492 | /* Check if the status relates to flash update auth */ | |
493 | cmd = (out & MAIL_OUT_STATUS_CMD_MASK) >> MAIL_OUT_STATUS_CMD_SHIFT; | |
494 | if (cmd == MAIL_IN_CMD_FLASH_UPDATE_AUTH) { | |
495 | if (status) | |
496 | *status = out & MAIL_OUT_STATUS_MASK; | |
497 | ||
498 | /* Reset is needed in any case */ | |
499 | return 1; | |
500 | } | |
501 | ||
502 | return 0; | |
503 | } | |
504 | ||
505 | /** | |
506 | * dma_port_power_cycle() - Power cycles the switch | |
507 | * @dma: DMA control port | |
508 | * | |
509 | * Triggers power cycle to the switch. | |
510 | */ | |
511 | int dma_port_power_cycle(struct tb_dma_port *dma) | |
512 | { | |
513 | u32 in; | |
514 | ||
515 | in = MAIL_IN_CMD_POWER_CYCLE << MAIL_IN_CMD_SHIFT; | |
516 | in |= MAIL_IN_OP_REQUEST; | |
517 | ||
518 | return dma_port_request(dma, in, 150); | |
519 | } |