eeprom.c

  1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * Thunderbolt driver - eeprom access
  4 *
  5 * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
  6 * Copyright (C) 2018, Intel Corporation
  7 */
  8
  9#include <linux/crc32.h>
 10#include <linux/delay.h>
 11#include <linux/property.h>
 12#include <linux/slab.h>
 13#include "tb.h"
 14
 15/*
 16 * tb_eeprom_ctl_write() - write control word
 17 */
 18static int tb_eeprom_ctl_write(struct tb_switch *sw, struct tb_eeprom_ctl *ctl)
 19{
 20	return tb_sw_write(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + ROUTER_CS_4, 1);
 21}
 22
 23/*
 24 * tb_eeprom_ctl_read() - read control word
 25 */
 26static int tb_eeprom_ctl_read(struct tb_switch *sw, struct tb_eeprom_ctl *ctl)
 27{
 28	return tb_sw_read(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + ROUTER_CS_4, 1);
 29}
 30
 31enum tb_eeprom_transfer {
 32	TB_EEPROM_IN,
 33	TB_EEPROM_OUT,
 34};
 35
 36/*
 37 * tb_eeprom_active - enable rom access
 38 *
 39 * WARNING: Always disable access after usage. Otherwise the controller will
 40 * fail to reprobe.
 41 */
 42static int tb_eeprom_active(struct tb_switch *sw, bool enable)
 43{
 44	struct tb_eeprom_ctl ctl;
 45	int res = tb_eeprom_ctl_read(sw, &ctl);
 46	if (res)
 47		return res;
 48	if (enable) {
 49		ctl.bit_banging_enable = 1;
 50		res = tb_eeprom_ctl_write(sw, &ctl);
 51		if (res)
 52			return res;
 53		ctl.fl_cs = 0;
 54		return tb_eeprom_ctl_write(sw, &ctl);
 55	} else {
 56		ctl.fl_cs = 1;
 57		res = tb_eeprom_ctl_write(sw, &ctl);
 58		if (res)
 59			return res;
 60		ctl.bit_banging_enable = 0;
 61		return tb_eeprom_ctl_write(sw, &ctl);
 62	}
 63}
 64
 65/*
 66 * tb_eeprom_transfer - transfer one bit
 67 *
 68 * If TB_EEPROM_IN is passed, then the bit can be retrieved from ctl->fl_do.
 69 * If TB_EEPROM_OUT is passed, then ctl->fl_di will be written.
 70 */
 71static int tb_eeprom_transfer(struct tb_switch *sw, struct tb_eeprom_ctl *ctl,
 72			      enum tb_eeprom_transfer direction)
 73{
 74	int res;
 75	if (direction == TB_EEPROM_OUT) {
 76		res = tb_eeprom_ctl_write(sw, ctl);
 77		if (res)
 78			return res;
 79	}
 80	ctl->fl_sk = 1;
 81	res = tb_eeprom_ctl_write(sw, ctl);
 82	if (res)
 83		return res;
 84	if (direction == TB_EEPROM_IN) {
 85		res = tb_eeprom_ctl_read(sw, ctl);
 86		if (res)
 87			return res;
 88	}
 89	ctl->fl_sk = 0;
 90	return tb_eeprom_ctl_write(sw, ctl);
 91}
 92
 93/*
 94 * tb_eeprom_out - write one byte to the bus
 95 */
 96static int tb_eeprom_out(struct tb_switch *sw, u8 val)
 97{
 98	struct tb_eeprom_ctl ctl;
 99	int i;
100	int res = tb_eeprom_ctl_read(sw, &ctl);
101	if (res)
102		return res;
103	for (i = 0; i < 8; i++) {
104		ctl.fl_di = val & 0x80;
105		res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_OUT);
106		if (res)
107			return res;
108		val <<= 1;
109	}
110	return 0;
111}
112
113/*
114 * tb_eeprom_in - read one byte from the bus
115 */
116static int tb_eeprom_in(struct tb_switch *sw, u8 *val)
117{
118	struct tb_eeprom_ctl ctl;
119	int i;
120	int res = tb_eeprom_ctl_read(sw, &ctl);
121	if (res)
122		return res;
123	*val = 0;
124	for (i = 0; i < 8; i++) {
125		*val <<= 1;
126		res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_IN);
127		if (res)
128			return res;
129		*val |= ctl.fl_do;
130	}
131	return 0;
132}
133
134/*
135 * tb_eeprom_get_drom_offset - get drom offset within eeprom
136 */
137static int tb_eeprom_get_drom_offset(struct tb_switch *sw, u16 *offset)
138{
139	struct tb_cap_plug_events cap;
140	int res;
141
142	if (!sw->cap_plug_events) {
143		tb_sw_warn(sw, "no TB_CAP_PLUG_EVENTS, cannot read eeprom\n");
144		return -ENODEV;
145	}
146	res = tb_sw_read(sw, &cap, TB_CFG_SWITCH, sw->cap_plug_events,
147			     sizeof(cap) / 4);
148	if (res)
149		return res;
150
151	if (!cap.eeprom_ctl.present || cap.eeprom_ctl.not_present) {
152		tb_sw_warn(sw, "no NVM\n");
153		return -ENODEV;
154	}
155
156	if (cap.drom_offset > 0xffff) {
157		tb_sw_warn(sw, "drom offset is larger than 0xffff: %#x\n",
158				cap.drom_offset);
159		return -ENXIO;
160	}
161	*offset = cap.drom_offset;
162	return 0;
163}
164
165/*
166 * tb_eeprom_read_n - read count bytes from offset into val
167 */
168static int tb_eeprom_read_n(struct tb_switch *sw, u16 offset, u8 *val,
169		size_t count)
170{
171	u16 drom_offset;
172	int i, res;
173
174	res = tb_eeprom_get_drom_offset(sw, &drom_offset);
175	if (res)
176		return res;
177
178	offset += drom_offset;
179
180	res = tb_eeprom_active(sw, true);
181	if (res)
182		return res;
183	res = tb_eeprom_out(sw, 3);
184	if (res)
185		return res;
186	res = tb_eeprom_out(sw, offset >> 8);
187	if (res)
188		return res;
189	res = tb_eeprom_out(sw, offset);
190	if (res)
191		return res;
192	for (i = 0; i < count; i++) {
193		res = tb_eeprom_in(sw, val + i);
194		if (res)
195			return res;
196	}
197	return tb_eeprom_active(sw, false);
198}
199
200static u8 tb_crc8(u8 *data, int len)
201{
202	int i, j;
203	u8 val = 0xff;
204	for (i = 0; i < len; i++) {
205		val ^= data[i];
206		for (j = 0; j < 8; j++)
207			val = (val << 1) ^ ((val & 0x80) ? 7 : 0);
208	}
209	return val;
210}
211
212static u32 tb_crc32(void *data, size_t len)
213{
214	return ~crc32c(~0, data, len);
215}
216
217#define TB_DROM_DATA_START		13
218#define TB_DROM_HEADER_SIZE		22
219#define USB4_DROM_HEADER_SIZE		16
220
221struct tb_drom_header {
222	/* BYTE 0 */
223	u8 uid_crc8; /* checksum for uid */
224	/* BYTES 1-8 */
225	u64 uid;
226	/* BYTES 9-12 */
227	u32 data_crc32; /* checksum for data_len bytes starting at byte 13 */
228	/* BYTE 13 */
229	u8 device_rom_revision; /* should be <= 1 */
230	u16 data_len:12;
231	u8 reserved:4;
232	/* BYTES 16-21 - Only for TBT DROM, nonexistent in USB4 DROM */
233	u16 vendor_id;
234	u16 model_id;
235	u8 model_rev;
236	u8 eeprom_rev;
237} __packed;
238
239enum tb_drom_entry_type {
240	/* force unsigned to prevent "one-bit signed bitfield" warning */
241	TB_DROM_ENTRY_GENERIC = 0U,
242	TB_DROM_ENTRY_PORT,
243};
244
245struct tb_drom_entry_header {
246	u8 len;
247	u8 index:6;
248	bool port_disabled:1; /* only valid if type is TB_DROM_ENTRY_PORT */
249	enum tb_drom_entry_type type:1;
250} __packed;
251
252struct tb_drom_entry_generic {
253	struct tb_drom_entry_header header;
254	u8 data[];
255} __packed;
256
257struct tb_drom_entry_port {
258	/* BYTES 0-1 */
259	struct tb_drom_entry_header header;
260	/* BYTE 2 */
261	u8 dual_link_port_rid:4;
262	u8 link_nr:1;
263	u8 unknown1:2;
264	bool has_dual_link_port:1;
265
266	/* BYTE 3 */
267	u8 dual_link_port_nr:6;
268	u8 unknown2:2;
269
270	/* BYTES 4 - 5 TODO decode */
271	u8 micro2:4;
272	u8 micro1:4;
273	u8 micro3;
274
275	/* BYTES 6-7, TODO: verify (find hardware that has these set) */
276	u8 peer_port_rid:4;
277	u8 unknown3:3;
278	bool has_peer_port:1;
279	u8 peer_port_nr:6;
280	u8 unknown4:2;
281} __packed;
282
283/* USB4 product descriptor */
284struct tb_drom_entry_desc {
285	struct tb_drom_entry_header header;
286	u16 bcdUSBSpec;
287	u16 idVendor;
288	u16 idProduct;
289	u16 bcdProductFWRevision;
290	u32 TID;
291	u8 productHWRevision;
292};
293
294/**
295 * tb_drom_read_uid_only() - Read UID directly from DROM
296 * @sw: Router whose UID to read
297 * @uid: UID is placed here
298 *
299 * Does not use the cached copy in sw->drom. Used during resume to check switch
300 * identity.
301 *
302 * Return: %0 on success, negative errno otherwise.
303 */
304int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid)
305{
306	u8 data[9];
307	u8 crc;
308	int res;
309
310	/* read uid */
311	res = tb_eeprom_read_n(sw, 0, data, 9);
312	if (res)
313		return res;
314
315	crc = tb_crc8(data + 1, 8);
316	if (crc != data[0]) {
317		tb_sw_warn(sw, "uid crc8 mismatch (expected: %#x, got: %#x)\n",
318				data[0], crc);
319		return -EIO;
320	}
321
322	*uid = *(u64 *)(data+1);
323	return 0;
324}
325
326static int tb_drom_parse_entry_generic(struct tb_switch *sw,
327		struct tb_drom_entry_header *header)
328{
329	const struct tb_drom_entry_generic *entry =
330		(const struct tb_drom_entry_generic *)header;
331
332	switch (header->index) {
333	case 1:
334		/* Length includes 2 bytes header so remove it before copy */
335		sw->vendor_name = kstrndup(entry->data,
336			header->len - sizeof(*header), GFP_KERNEL);
337		if (!sw->vendor_name)
338			return -ENOMEM;
339		break;
340
341	case 2:
342		sw->device_name = kstrndup(entry->data,
343			header->len - sizeof(*header), GFP_KERNEL);
344		if (!sw->device_name)
345			return -ENOMEM;
346		break;
347	case 9: {
348		const struct tb_drom_entry_desc *desc =
349			(const struct tb_drom_entry_desc *)entry;
350
351		if (!sw->vendor && !sw->device) {
352			sw->vendor = desc->idVendor;
353			sw->device = desc->idProduct;
354		}
355		break;
356	}
357	}
358
359	return 0;
360}
361
362static int tb_drom_parse_entry_port(struct tb_switch *sw,
363				    struct tb_drom_entry_header *header)
364{
365	struct tb_port *port;
366	int res;
367	enum tb_port_type type;
368
369	/*
370	 * Some DROMs list more ports than the controller actually has
371	 * so we skip those but allow the parser to continue.
372	 */
373	if (header->index > sw->config.max_port_number) {
374		dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n");
375		return 0;
376	}
377
378	port = &sw->ports[header->index];
379	port->disabled = header->port_disabled;
380	if (port->disabled)
381		return 0;
382
383	res = tb_port_read(port, &type, TB_CFG_PORT, 2, 1);
384	if (res)
385		return res;
386	type &= 0xffffff;
387
388	if (type == TB_TYPE_PORT) {
389		struct tb_drom_entry_port *entry = (void *) header;
390		if (header->len != sizeof(*entry)) {
391			tb_sw_warn(sw,
392				"port entry has size %#x (expected %#zx)\n",
393				header->len, sizeof(struct tb_drom_entry_port));
394			return -EIO;
395		}
396		port->link_nr = entry->link_nr;
397		if (entry->has_dual_link_port)
398			port->dual_link_port =
399				&port->sw->ports[entry->dual_link_port_nr];
400	}
401	return 0;
402}
403
404/*
405 * tb_drom_parse_entries - parse the linked list of drom entries
406 *
407 * Drom must have been copied to sw->drom.
408 */
409static int tb_drom_parse_entries(struct tb_switch *sw, size_t header_size)
410{
411	struct tb_drom_header *header = (void *) sw->drom;
412	u16 pos = header_size;
413	u16 drom_size = header->data_len + TB_DROM_DATA_START;
414	int res;
415
416	while (pos < drom_size) {
417		struct tb_drom_entry_header *entry = (void *) (sw->drom + pos);
418		if (pos + 1 == drom_size || pos + entry->len > drom_size
419				|| !entry->len) {
420			tb_sw_warn(sw, "DROM buffer overrun\n");
421			return -EIO;
422		}
423
424		switch (entry->type) {
425		case TB_DROM_ENTRY_GENERIC:
426			res = tb_drom_parse_entry_generic(sw, entry);
427			break;
428		case TB_DROM_ENTRY_PORT:
429			res = tb_drom_parse_entry_port(sw, entry);
430			break;
431		}
432		if (res)
433			return res;
434
435		pos += entry->len;
436	}
437	return 0;
438}
439
440static int tb_switch_drom_alloc(struct tb_switch *sw, size_t size)
441{
442	sw->drom = kzalloc(size, GFP_KERNEL);
443	if (!sw->drom)
444		return -ENOMEM;
445
446#ifdef CONFIG_DEBUG_FS
447	sw->drom_blob.data = sw->drom;
448	sw->drom_blob.size = size;
449#endif
450	return 0;
451}
452
453static void tb_switch_drom_free(struct tb_switch *sw)
454{
455#ifdef CONFIG_DEBUG_FS
456	sw->drom_blob.data = NULL;
457	sw->drom_blob.size = 0;
458#endif
459	kfree(sw->drom);
460	sw->drom = NULL;
461}
462
463/*
464 * tb_drom_copy_efi - copy drom supplied by EFI to sw->drom if present
465 */
466static int tb_drom_copy_efi(struct tb_switch *sw, u16 *size)
467{
468	struct device *dev = &sw->tb->nhi->pdev->dev;
469	int len, res;
470
471	len = device_property_count_u8(dev, "ThunderboltDROM");
472	if (len < 0 || len < sizeof(struct tb_drom_header))
473		return -EINVAL;
474
475	res = tb_switch_drom_alloc(sw, len);
476	if (res)
477		return res;
478
479	res = device_property_read_u8_array(dev, "ThunderboltDROM", sw->drom,
480									len);
481	if (res)
482		goto err;
483
484	*size = ((struct tb_drom_header *)sw->drom)->data_len +
485							  TB_DROM_DATA_START;
486	if (*size > len)
487		goto err;
488
489	return 0;
490
491err:
492	tb_switch_drom_free(sw);
493	return -EINVAL;
494}
495
496static int tb_drom_copy_nvm(struct tb_switch *sw, u16 *size)
497{
498	u16 drom_offset;
499	int ret;
500
501	if (!sw->dma_port)
502		return -ENODEV;
503
504	ret = tb_eeprom_get_drom_offset(sw, &drom_offset);
505	if (ret)
506		return ret;
507
508	if (!drom_offset)
509		return -ENODEV;
510
511	ret = dma_port_flash_read(sw->dma_port, drom_offset + 14, size,
512				  sizeof(*size));
513	if (ret)
514		return ret;
515
516	/* Size includes CRC8 + UID + CRC32 */
517	*size += 1 + 8 + 4;
518	ret = tb_switch_drom_alloc(sw, *size);
519	if (ret)
520		return ret;
521
522	ret = dma_port_flash_read(sw->dma_port, drom_offset, sw->drom, *size);
523	if (ret) {
524		tb_switch_drom_free(sw);
525		return ret;
526	}
527
528	/*
529	 * Read UID from the minimal DROM because the one in NVM is just
530	 * a placeholder.
531	 */
532	tb_drom_read_uid_only(sw, &sw->uid);
533	return 0;
534}
535
536static int usb4_copy_drom(struct tb_switch *sw, u16 *size)
537{
538	int ret;
539
540	ret = usb4_switch_drom_read(sw, 14, size, sizeof(*size));
541	if (ret)
542		return ret;
543
544	/* Size includes CRC8 + UID + CRC32 */
545	*size += 1 + 8 + 4;
546	ret = tb_switch_drom_alloc(sw, *size);
547	if (ret)
548		return ret;
549
550	ret = usb4_switch_drom_read(sw, 0, sw->drom, *size);
551	if (ret)
552		tb_switch_drom_free(sw);
553
554	return ret;
555}
556
557static int tb_drom_bit_bang(struct tb_switch *sw, u16 *size)
558{
559	int ret;
560
561	ret = tb_eeprom_read_n(sw, 14, (u8 *)size, 2);
562	if (ret)
563		return ret;
564
565	*size &= 0x3ff;
566	*size += TB_DROM_DATA_START;
567
568	tb_sw_dbg(sw, "reading DROM (length: %#x)\n", *size);
569	if (*size < sizeof(struct tb_drom_header)) {
570		tb_sw_warn(sw, "DROM too small, aborting\n");
571		return -EIO;
572	}
573
574	ret = tb_switch_drom_alloc(sw, *size);
575	if (ret)
576		return ret;
577
578	ret = tb_eeprom_read_n(sw, 0, sw->drom, *size);
579	if (ret)
580		tb_switch_drom_free(sw);
581
582	return ret;
583}
584
585static int tb_drom_parse_v1(struct tb_switch *sw)
586{
587	const struct tb_drom_header *header =
588		(const struct tb_drom_header *)sw->drom;
589	u32 crc;
590
591	crc = tb_crc8((u8 *) &header->uid, 8);
592	if (crc != header->uid_crc8) {
593		tb_sw_warn(sw,
594			"DROM UID CRC8 mismatch (expected: %#x, got: %#x)\n",
595			header->uid_crc8, crc);
596		return -EIO;
597	}
598	if (!sw->uid)
599		sw->uid = header->uid;
600	sw->vendor = header->vendor_id;
601	sw->device = header->model_id;
602
603	crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len);
604	if (crc != header->data_crc32) {
605		tb_sw_warn(sw,
606			"DROM data CRC32 mismatch (expected: %#x, got: %#x), continuing\n",
607			header->data_crc32, crc);
608	}
609
610	return tb_drom_parse_entries(sw, TB_DROM_HEADER_SIZE);
611}
612
613static int usb4_drom_parse(struct tb_switch *sw)
614{
615	const struct tb_drom_header *header =
616		(const struct tb_drom_header *)sw->drom;
617	u32 crc;
618
619	crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len);
620	if (crc != header->data_crc32) {
621		tb_sw_warn(sw,
622			   "DROM data CRC32 mismatch (expected: %#x, got: %#x), continuing\n",
623			   header->data_crc32, crc);
624	}
625
626	return tb_drom_parse_entries(sw, USB4_DROM_HEADER_SIZE);
627}
628
629static int tb_drom_parse(struct tb_switch *sw, u16 size)
630{
631	const struct tb_drom_header *header = (const void *)sw->drom;
632	int ret;
633
634	if (header->data_len + TB_DROM_DATA_START != size) {
635		tb_sw_warn(sw, "DROM size mismatch\n");
636		ret = -EIO;
637		goto err;
638	}
639
640	tb_sw_dbg(sw, "DROM version: %d\n", header->device_rom_revision);
641
642	switch (header->device_rom_revision) {
643	case 3:
644		ret = usb4_drom_parse(sw);
645		break;
646	default:
647		tb_sw_warn(sw, "DROM device_rom_revision %#x unknown\n",
648			   header->device_rom_revision);
649		fallthrough;
650	case 1:
651		ret = tb_drom_parse_v1(sw);
652		break;
653	}
654
655	if (ret) {
656		tb_sw_warn(sw, "parsing DROM failed\n");
657		goto err;
658	}
659
660	return 0;
661
662err:
663	tb_switch_drom_free(sw);
664	return ret;
665}
666
667static int tb_drom_host_read(struct tb_switch *sw)
668{
669	u16 size;
670
671	if (tb_switch_is_usb4(sw)) {
672		usb4_switch_read_uid(sw, &sw->uid);
673		if (!usb4_copy_drom(sw, &size))
674			return tb_drom_parse(sw, size);
675	} else {
676		if (!tb_drom_copy_efi(sw, &size))
677			return tb_drom_parse(sw, size);
678
679		if (!tb_drom_copy_nvm(sw, &size))
680			return tb_drom_parse(sw, size);
681
682		tb_drom_read_uid_only(sw, &sw->uid);
683	}
684
685	return 0;
686}
687
688static int tb_drom_device_read(struct tb_switch *sw)
689{
690	u16 size;
691	int ret;
692
693	if (tb_switch_is_usb4(sw)) {
694		usb4_switch_read_uid(sw, &sw->uid);
695		ret = usb4_copy_drom(sw, &size);
696	} else {
697		ret = tb_drom_bit_bang(sw, &size);
698	}
699
700	if (ret)
701		return ret;
702
703	return tb_drom_parse(sw, size);
704}
705
706/**
707 * tb_drom_read() - Copy DROM to sw->drom and parse it
708 * @sw: Router whose DROM to read and parse
709 *
710 * This function reads router DROM and if successful parses the entries and
711 * populates the fields in @sw accordingly. Can be called for any router
712 * generation.
713 *
714 * Return: %0 on success, negative errno otherwise.
715 */
716int tb_drom_read(struct tb_switch *sw)
717{
718	if (sw->drom)
719		return 0;
720
721	if (!tb_route(sw))
722		return tb_drom_host_read(sw);
723	return tb_drom_device_read(sw);
724}