dma_port.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * Thunderbolt DMA configuration based mailbox support
  4 *
  5 * Copyright (C) 2017, Intel Corporation
  6 * Authors: Michael Jamet <michael.jamet@intel.com>
  7 *          Mika Westerberg <mika.westerberg@linux.intel.com>
  8 */
  9
 10#include <linux/delay.h>
 11#include <linux/slab.h>
 12
 13#include "dma_port.h"
 14#include "tb_regs.h"
 15
 16#define DMA_PORT_CAP			0x3e
 17
 18#define MAIL_DATA			1
 19#define MAIL_DATA_DWORDS		16
 20
 21#define MAIL_IN				17
 22#define MAIL_IN_CMD_SHIFT		28
 23#define MAIL_IN_CMD_MASK		GENMASK(31, 28)
 24#define MAIL_IN_CMD_FLASH_WRITE		0x0
 25#define MAIL_IN_CMD_FLASH_UPDATE_AUTH	0x1
 26#define MAIL_IN_CMD_FLASH_READ		0x2
 27#define MAIL_IN_CMD_POWER_CYCLE		0x4
 28#define MAIL_IN_DWORDS_SHIFT		24
 29#define MAIL_IN_DWORDS_MASK		GENMASK(27, 24)
 30#define MAIL_IN_ADDRESS_SHIFT		2
 31#define MAIL_IN_ADDRESS_MASK		GENMASK(23, 2)
 32#define MAIL_IN_CSS			BIT(1)
 33#define MAIL_IN_OP_REQUEST		BIT(0)
 34
 35#define MAIL_OUT			18
 36#define MAIL_OUT_STATUS_RESPONSE	BIT(29)
 37#define MAIL_OUT_STATUS_CMD_SHIFT	4
 38#define MAIL_OUT_STATUS_CMD_MASK	GENMASK(7, 4)
 39#define MAIL_OUT_STATUS_MASK		GENMASK(3, 0)
 40#define MAIL_OUT_STATUS_COMPLETED	0
 41#define MAIL_OUT_STATUS_ERR_AUTH	1
 42#define MAIL_OUT_STATUS_ERR_ACCESS	2
 43
 44#define DMA_PORT_TIMEOUT		5000 /* ms */
 45#define DMA_PORT_RETRIES		3
 46
 47/**
 48 * struct tb_dma_port - DMA control port
 49 * @sw: Switch the DMA port belongs to
 50 * @port: Switch port number where DMA capability is found
 51 * @base: Start offset of the mailbox registers
 52 * @buf: Temporary buffer to store a single block
 53 */
 54struct tb_dma_port {
 55	struct tb_switch *sw;
 56	u8 port;
 57	u32 base;
 58	u8 *buf;
 59};
 60
 61/*
 62 * When the switch is in safe mode it supports very little functionality
 63 * so we don't validate that much here.
 64 */
 65static bool dma_port_match(const struct tb_cfg_request *req,
 66			   const struct ctl_pkg *pkg)
 67{
 68	u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63);
 69
 70	if (pkg->frame.eof == TB_CFG_PKG_ERROR)
 71		return true;
 72	if (pkg->frame.eof != req->response_type)
 73		return false;
 74	if (route != tb_cfg_get_route(req->request))
 75		return false;
 76	if (pkg->frame.size != req->response_size)
 77		return false;
 78
 79	return true;
 80}
 81
 82static bool dma_port_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
 83{
 84	memcpy(req->response, pkg->buffer, req->response_size);
 85	return true;
 86}
 87
 88static int dma_port_read(struct tb_ctl *ctl, void *buffer, u64 route,
 89			 u32 port, u32 offset, u32 length, int timeout_msec)
 90{
 91	struct cfg_read_pkg request = {
 92		.header = tb_cfg_make_header(route),
 93		.addr = {
 94			.seq = 1,
 95			.port = port,
 96			.space = TB_CFG_PORT,
 97			.offset = offset,
 98			.length = length,
 99		},
100	};
101	struct tb_cfg_request *req;
102	struct cfg_write_pkg reply;
103	struct tb_cfg_result res;
104
105	req = tb_cfg_request_alloc();
106	if (!req)
107		return -ENOMEM;
108
109	req->match = dma_port_match;
110	req->copy = dma_port_copy;
111	req->request = &request;
112	req->request_size = sizeof(request);
113	req->request_type = TB_CFG_PKG_READ;
114	req->response = &reply;
115	req->response_size = 12 + 4 * length;
116	req->response_type = TB_CFG_PKG_READ;
117
118	res = tb_cfg_request_sync(ctl, req, timeout_msec);
119
120	tb_cfg_request_put(req);
121
122	if (res.err)
123		return res.err;
124
125	memcpy(buffer, &reply.data, 4 * length);
126	return 0;
127}
128
129static int dma_port_write(struct tb_ctl *ctl, const void *buffer, u64 route,
130			  u32 port, u32 offset, u32 length, int timeout_msec)
131{
132	struct cfg_write_pkg request = {
133		.header = tb_cfg_make_header(route),
134		.addr = {
135			.seq = 1,
136			.port = port,
137			.space = TB_CFG_PORT,
138			.offset = offset,
139			.length = length,
140		},
141	};
142	struct tb_cfg_request *req;
143	struct cfg_read_pkg reply;
144	struct tb_cfg_result res;
145
146	memcpy(&request.data, buffer, length * 4);
147
148	req = tb_cfg_request_alloc();
149	if (!req)
150		return -ENOMEM;
151
152	req->match = dma_port_match;
153	req->copy = dma_port_copy;
154	req->request = &request;
155	req->request_size = 12 + 4 * length;
156	req->request_type = TB_CFG_PKG_WRITE;
157	req->response = &reply;
158	req->response_size = sizeof(reply);
159	req->response_type = TB_CFG_PKG_WRITE;
160
161	res = tb_cfg_request_sync(ctl, req, timeout_msec);
162
163	tb_cfg_request_put(req);
164
165	return res.err;
166}
167
168static int dma_find_port(struct tb_switch *sw)
169{
170	static const int ports[] = { 3, 5, 7 };
171	int i;
172
173	/*
174	 * The DMA (NHI) port is either 3, 5 or 7 depending on the
175	 * controller. Try all of them.
176	 */
177	for (i = 0; i < ARRAY_SIZE(ports); i++) {
178		u32 type;
179		int ret;
180
181		ret = dma_port_read(sw->tb->ctl, &type, tb_route(sw), ports[i],
182				    2, 1, DMA_PORT_TIMEOUT);
183		if (!ret && (type & 0xffffff) == TB_TYPE_NHI)
184			return ports[i];
185	}
186
187	return -ENODEV;
188}
189
190/**
191 * dma_port_alloc() - Finds DMA control port from a switch pointed by route
192 * @sw: Switch from where find the DMA port
193 *
194 * Function checks if the switch NHI port supports DMA configuration
195 * based mailbox capability and if it does, allocates and initializes
196 * DMA port structure. Returns %NULL if the capabity was not found.
197 *
198 * The DMA control port is functional also when the switch is in safe
199 * mode.
200 *
201 * Return: &struct tb_dma_port on success, %NULL otherwise.
202 */
203struct tb_dma_port *dma_port_alloc(struct tb_switch *sw)
204{
205	struct tb_dma_port *dma;
206	int port;
207
208	port = dma_find_port(sw);
209	if (port < 0)
210		return NULL;
211
212	dma = kzalloc(sizeof(*dma), GFP_KERNEL);
213	if (!dma)
214		return NULL;
215
216	dma->buf = kmalloc_array(MAIL_DATA_DWORDS, sizeof(u32), GFP_KERNEL);
217	if (!dma->buf) {
218		kfree(dma);
219		return NULL;
220	}
221
222	dma->sw = sw;
223	dma->port = port;
224	dma->base = DMA_PORT_CAP;
225
226	return dma;
227}
228
229/**
230 * dma_port_free() - Release DMA control port structure
231 * @dma: DMA control port
232 */
233void dma_port_free(struct tb_dma_port *dma)
234{
235	if (dma) {
236		kfree(dma->buf);
237		kfree(dma);
238	}
239}
240
241static int dma_port_wait_for_completion(struct tb_dma_port *dma,
242					unsigned int timeout)
243{
244	unsigned long end = jiffies + msecs_to_jiffies(timeout);
245	struct tb_switch *sw = dma->sw;
246
247	do {
248		int ret;
249		u32 in;
250
251		ret = dma_port_read(sw->tb->ctl, &in, tb_route(sw), dma->port,
252				    dma->base + MAIL_IN, 1, 50);
253		if (ret) {
254			if (ret != -ETIMEDOUT)
255				return ret;
256		} else if (!(in & MAIL_IN_OP_REQUEST)) {
257			return 0;
258		}
259
260		usleep_range(50, 100);
261	} while (time_before(jiffies, end));
262
263	return -ETIMEDOUT;
264}
265
266static int status_to_errno(u32 status)
267{
268	switch (status & MAIL_OUT_STATUS_MASK) {
269	case MAIL_OUT_STATUS_COMPLETED:
270		return 0;
271	case MAIL_OUT_STATUS_ERR_AUTH:
272		return -EINVAL;
273	case MAIL_OUT_STATUS_ERR_ACCESS:
274		return -EACCES;
275	}
276
277	return -EIO;
278}
279
280static int dma_port_request(struct tb_dma_port *dma, u32 in,
281			    unsigned int timeout)
282{
283	struct tb_switch *sw = dma->sw;
284	u32 out;
285	int ret;
286
287	ret = dma_port_write(sw->tb->ctl, &in, tb_route(sw), dma->port,
288			     dma->base + MAIL_IN, 1, DMA_PORT_TIMEOUT);
289	if (ret)
290		return ret;
291
292	ret = dma_port_wait_for_completion(dma, timeout);
293	if (ret)
294		return ret;
295
296	ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
297			    dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
298	if (ret)
299		return ret;
300
301	return status_to_errno(out);
302}
303
304static int dma_port_flash_read_block(void *data, unsigned int dwaddress,
305				     void *buf, size_t dwords)
306{
307	struct tb_dma_port *dma = data;
308	struct tb_switch *sw = dma->sw;
309	int ret;
310	u32 in;
311
312	in = MAIL_IN_CMD_FLASH_READ << MAIL_IN_CMD_SHIFT;
313	if (dwords < MAIL_DATA_DWORDS)
314		in |= (dwords << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
315	in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
316	in |= MAIL_IN_OP_REQUEST;
317
318	ret = dma_port_request(dma, in, DMA_PORT_TIMEOUT);
319	if (ret)
320		return ret;
321
322	return dma_port_read(sw->tb->ctl, buf, tb_route(sw), dma->port,
323			     dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
324}
325
326static int dma_port_flash_write_block(void *data, unsigned int dwaddress,
327				      const void *buf, size_t dwords)
328{
329	struct tb_dma_port *dma = data;
330	struct tb_switch *sw = dma->sw;
331	int ret;
332	u32 in;
333
334	/* Write the block to MAIL_DATA registers */
335	ret = dma_port_write(sw->tb->ctl, buf, tb_route(sw), dma->port,
336			    dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
337	if (ret)
338		return ret;
339
340	in = MAIL_IN_CMD_FLASH_WRITE << MAIL_IN_CMD_SHIFT;
341
342	/* CSS header write is always done to the same magic address */
343	if (dwaddress >= DMA_PORT_CSS_ADDRESS)
344		in |= MAIL_IN_CSS;
345
346	in |= ((dwords - 1) << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
347	in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
348	in |= MAIL_IN_OP_REQUEST;
349
350	return dma_port_request(dma, in, DMA_PORT_TIMEOUT);
351}
352
353/**
354 * dma_port_flash_read() - Read from active flash region
355 * @dma: DMA control port
356 * @address: Address relative to the start of active region
357 * @buf: Buffer where the data is read
358 * @size: Size of the buffer
359 *
360 * Return: %0 on success, negative errno otherwise.
361 */
362int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
363			void *buf, size_t size)
364{
365	return tb_nvm_read_data(address, buf, size, DMA_PORT_RETRIES,
366				dma_port_flash_read_block, dma);
367}
368
369/**
370 * dma_port_flash_write() - Write to non-active flash region
371 * @dma: DMA control port
372 * @address: Address relative to the start of non-active region
373 * @buf: Data to write
374 * @size: Size of the buffer
375 *
376 * Writes block of data to the non-active flash region of the switch. If
377 * the address is given as %DMA_PORT_CSS_ADDRESS the block is written
378 * using CSS command.
379 *
380 * Return: %0 on success, negative errno otherwise.
381 */
382int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address,
383			 const void *buf, size_t size)
384{
385	if (address >= DMA_PORT_CSS_ADDRESS && size > DMA_PORT_CSS_MAX_SIZE)
386		return -E2BIG;
387
388	return tb_nvm_write_data(address, buf, size, DMA_PORT_RETRIES,
389				 dma_port_flash_write_block, dma);
390}
391
392/**
393 * dma_port_flash_update_auth() - Starts flash authenticate cycle
394 * @dma: DMA control port
395 *
396 * Starts the flash update authentication cycle. If the image in the
397 * non-active area was valid, the switch starts upgrade process where
398 * active and non-active area get swapped in the end. Caller should call
399 * dma_port_flash_update_auth_status() to get status of this command.
400 * This is because if the switch in question is root switch the
401 * thunderbolt host controller gets reset as well.
402 *
403 * Return: %0 on success, negative errno otherwise.
404 */
405int dma_port_flash_update_auth(struct tb_dma_port *dma)
406{
407	u32 in;
408
409	in = MAIL_IN_CMD_FLASH_UPDATE_AUTH << MAIL_IN_CMD_SHIFT;
410	in |= MAIL_IN_OP_REQUEST;
411
412	return dma_port_request(dma, in, 150);
413}
414
415/**
416 * dma_port_flash_update_auth_status() - Reads status of update auth command
417 * @dma: DMA control port
418 * @status: Status code of the operation
419 *
420 * The function checks if there is status available from the last update
421 * auth command.
422 *
423 * Return:
424 * * %0 - If there is no status and no further action is required.
425 * * %1 - If there is some status. @status holds the failure code.
426 * * Negative errno - An error occurred when reading status from the
427 *   switch.
428 */
429int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status)
430{
431	struct tb_switch *sw = dma->sw;
432	u32 out, cmd;
433	int ret;
434
435	ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
436			    dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
437	if (ret)
438		return ret;
439
440	/* Check if the status relates to flash update auth */
441	cmd = (out & MAIL_OUT_STATUS_CMD_MASK) >> MAIL_OUT_STATUS_CMD_SHIFT;
442	if (cmd == MAIL_IN_CMD_FLASH_UPDATE_AUTH) {
443		if (status)
444			*status = out & MAIL_OUT_STATUS_MASK;
445
446		/* Reset is needed in any case */
447		return 1;
448	}
449
450	return 0;
451}
452
453/**
454 * dma_port_power_cycle() - Power cycles the switch
455 * @dma: DMA control port
456 *
457 * Triggers power cycle to the switch.
458 *
459 * Return: %0 on success, negative errno otherwise.
460 */
461int dma_port_power_cycle(struct tb_dma_port *dma)
462{
463	u32 in;
464
465	in = MAIL_IN_CMD_POWER_CYCLE << MAIL_IN_CMD_SHIFT;
466	in |= MAIL_IN_OP_REQUEST;
467
468	return dma_port_request(dma, in, 150);
469}