xref: /openbmc/linux/drivers/cxl/core/memdev.c (revision c56f610fe9470f79c82de3ec765b3c1e66ef2c71)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright(c) 2020 Intel Corporation. */
3 
4 #include <linux/io-64-nonatomic-lo-hi.h>
5 #include <linux/firmware.h>
6 #include <linux/device.h>
7 #include <linux/slab.h>
8 #include <linux/idr.h>
9 #include <linux/pci.h>
10 #include <cxlmem.h>
11 #include "trace.h"
12 #include "core.h"
13 
14 static DECLARE_RWSEM(cxl_memdev_rwsem);
15 
16 /*
17  * An entire PCI topology full of devices should be enough for any
18  * config
19  */
20 #define CXL_MEM_MAX_DEVS 65536
21 
22 static int cxl_mem_major;
23 static DEFINE_IDA(cxl_memdev_ida);
24 
25 static void cxl_memdev_release(struct device *dev)
26 {
27 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
28 
29 	ida_free(&cxl_memdev_ida, cxlmd->id);
30 	kfree(cxlmd);
31 }
32 
33 static char *cxl_memdev_devnode(const struct device *dev, umode_t *mode, kuid_t *uid,
34 				kgid_t *gid)
35 {
36 	return kasprintf(GFP_KERNEL, "cxl/%s", dev_name(dev));
37 }
38 
39 static ssize_t firmware_version_show(struct device *dev,
40 				     struct device_attribute *attr, char *buf)
41 {
42 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
43 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
44 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds);
45 
46 	if (!mds)
47 		return sysfs_emit(buf, "\n");
48 	return sysfs_emit(buf, "%.16s\n", mds->firmware_version);
49 }
50 static DEVICE_ATTR_RO(firmware_version);
51 
52 static ssize_t payload_max_show(struct device *dev,
53 				struct device_attribute *attr, char *buf)
54 {
55 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
56 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
57 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds);
58 
59 	if (!mds)
60 		return sysfs_emit(buf, "\n");
61 	return sysfs_emit(buf, "%zu\n", mds->payload_size);
62 }
63 static DEVICE_ATTR_RO(payload_max);
64 
65 static ssize_t label_storage_size_show(struct device *dev,
66 				       struct device_attribute *attr, char *buf)
67 {
68 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
69 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
70 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds);
71 
72 	if (!mds)
73 		return sysfs_emit(buf, "\n");
74 	return sysfs_emit(buf, "%zu\n", mds->lsa_size);
75 }
76 static DEVICE_ATTR_RO(label_storage_size);
77 
78 static ssize_t ram_size_show(struct device *dev, struct device_attribute *attr,
79 			     char *buf)
80 {
81 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
82 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
83 	unsigned long long len = resource_size(&cxlds->ram_res);
84 
85 	return sysfs_emit(buf, "%#llx\n", len);
86 }
87 
88 static struct device_attribute dev_attr_ram_size =
89 	__ATTR(size, 0444, ram_size_show, NULL);
90 
91 static ssize_t pmem_size_show(struct device *dev, struct device_attribute *attr,
92 			      char *buf)
93 {
94 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
95 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
96 	unsigned long long len = resource_size(&cxlds->pmem_res);
97 
98 	return sysfs_emit(buf, "%#llx\n", len);
99 }
100 
101 static struct device_attribute dev_attr_pmem_size =
102 	__ATTR(size, 0444, pmem_size_show, NULL);
103 
104 static ssize_t serial_show(struct device *dev, struct device_attribute *attr,
105 			   char *buf)
106 {
107 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
108 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
109 
110 	return sysfs_emit(buf, "%#llx\n", cxlds->serial);
111 }
112 static DEVICE_ATTR_RO(serial);
113 
114 static ssize_t numa_node_show(struct device *dev, struct device_attribute *attr,
115 			      char *buf)
116 {
117 	return sprintf(buf, "%d\n", dev_to_node(dev));
118 }
119 static DEVICE_ATTR_RO(numa_node);
120 
121 static ssize_t security_state_show(struct device *dev,
122 				   struct device_attribute *attr,
123 				   char *buf)
124 {
125 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
126 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
127 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds);
128 	unsigned long state = mds->security.state;
129 	int rc = 0;
130 
131 	/* sync with latest submission state */
132 	mutex_lock(&mds->mbox_mutex);
133 	if (mds->security.sanitize_active)
134 		rc = sysfs_emit(buf, "sanitize\n");
135 	mutex_unlock(&mds->mbox_mutex);
136 	if (rc)
137 		return rc;
138 
139 	if (!(state & CXL_PMEM_SEC_STATE_USER_PASS_SET))
140 		return sysfs_emit(buf, "disabled\n");
141 	if (state & CXL_PMEM_SEC_STATE_FROZEN ||
142 	    state & CXL_PMEM_SEC_STATE_MASTER_PLIMIT ||
143 	    state & CXL_PMEM_SEC_STATE_USER_PLIMIT)
144 		return sysfs_emit(buf, "frozen\n");
145 	if (state & CXL_PMEM_SEC_STATE_LOCKED)
146 		return sysfs_emit(buf, "locked\n");
147 	else
148 		return sysfs_emit(buf, "unlocked\n");
149 }
150 static struct device_attribute dev_attr_security_state =
151 	__ATTR(state, 0444, security_state_show, NULL);
152 
153 static ssize_t security_sanitize_store(struct device *dev,
154 				       struct device_attribute *attr,
155 				       const char *buf, size_t len)
156 {
157 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
158 	bool sanitize;
159 	ssize_t rc;
160 
161 	if (kstrtobool(buf, &sanitize) || !sanitize)
162 		return -EINVAL;
163 
164 	rc = cxl_mem_sanitize(cxlmd, CXL_MBOX_OP_SANITIZE);
165 	if (rc)
166 		return rc;
167 
168 	return len;
169 }
170 static struct device_attribute dev_attr_security_sanitize =
171 	__ATTR(sanitize, 0200, NULL, security_sanitize_store);
172 
173 static ssize_t security_erase_store(struct device *dev,
174 				    struct device_attribute *attr,
175 				    const char *buf, size_t len)
176 {
177 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
178 	ssize_t rc;
179 	bool erase;
180 
181 	if (kstrtobool(buf, &erase) || !erase)
182 		return -EINVAL;
183 
184 	rc = cxl_mem_sanitize(cxlmd, CXL_MBOX_OP_SECURE_ERASE);
185 	if (rc)
186 		return rc;
187 
188 	return len;
189 }
190 static struct device_attribute dev_attr_security_erase =
191 	__ATTR(erase, 0200, NULL, security_erase_store);
192 
193 static int cxl_get_poison_by_memdev(struct cxl_memdev *cxlmd)
194 {
195 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
196 	u64 offset, length;
197 	int rc = 0;
198 
199 	/* CXL 3.0 Spec 8.2.9.8.4.1 Separate pmem and ram poison requests */
200 	if (resource_size(&cxlds->pmem_res)) {
201 		offset = cxlds->pmem_res.start;
202 		length = resource_size(&cxlds->pmem_res);
203 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
204 		if (rc)
205 			return rc;
206 	}
207 	if (resource_size(&cxlds->ram_res)) {
208 		offset = cxlds->ram_res.start;
209 		length = resource_size(&cxlds->ram_res);
210 		rc = cxl_mem_get_poison(cxlmd, offset, length, NULL);
211 		/*
212 		 * Invalid Physical Address is not an error for
213 		 * volatile addresses. Device support is optional.
214 		 */
215 		if (rc == -EFAULT)
216 			rc = 0;
217 	}
218 	return rc;
219 }
220 
221 int cxl_trigger_poison_list(struct cxl_memdev *cxlmd)
222 {
223 	struct cxl_port *port;
224 	int rc;
225 
226 	port = cxlmd->endpoint;
227 	if (!port || !is_cxl_endpoint(port))
228 		return -EINVAL;
229 
230 	rc = down_read_interruptible(&cxl_region_rwsem);
231 	if (rc)
232 		return rc;
233 
234 	rc = down_read_interruptible(&cxl_dpa_rwsem);
235 	if (rc) {
236 		up_read(&cxl_region_rwsem);
237 		return rc;
238 	}
239 
240 	if (cxl_num_decoders_committed(port) == 0) {
241 		/* No regions mapped to this memdev */
242 		rc = cxl_get_poison_by_memdev(cxlmd);
243 	} else {
244 		/* Regions mapped, collect poison by endpoint */
245 		rc =  cxl_get_poison_by_endpoint(port);
246 	}
247 	up_read(&cxl_dpa_rwsem);
248 	up_read(&cxl_region_rwsem);
249 
250 	return rc;
251 }
252 EXPORT_SYMBOL_NS_GPL(cxl_trigger_poison_list, CXL);
253 
254 struct cxl_dpa_to_region_context {
255 	struct cxl_region *cxlr;
256 	u64 dpa;
257 };
258 
259 static int __cxl_dpa_to_region(struct device *dev, void *arg)
260 {
261 	struct cxl_dpa_to_region_context *ctx = arg;
262 	struct cxl_endpoint_decoder *cxled;
263 	u64 dpa = ctx->dpa;
264 
265 	if (!is_endpoint_decoder(dev))
266 		return 0;
267 
268 	cxled = to_cxl_endpoint_decoder(dev);
269 	if (!cxled->dpa_res || !resource_size(cxled->dpa_res))
270 		return 0;
271 
272 	if (dpa > cxled->dpa_res->end || dpa < cxled->dpa_res->start)
273 		return 0;
274 
275 	dev_dbg(dev, "dpa:0x%llx mapped in region:%s\n", dpa,
276 		dev_name(&cxled->cxld.region->dev));
277 
278 	ctx->cxlr = cxled->cxld.region;
279 
280 	return 1;
281 }
282 
283 static struct cxl_region *cxl_dpa_to_region(struct cxl_memdev *cxlmd, u64 dpa)
284 {
285 	struct cxl_dpa_to_region_context ctx;
286 	struct cxl_port *port;
287 
288 	ctx = (struct cxl_dpa_to_region_context) {
289 		.dpa = dpa,
290 	};
291 	port = cxlmd->endpoint;
292 	if (port && is_cxl_endpoint(port) && cxl_num_decoders_committed(port))
293 		device_for_each_child(&port->dev, &ctx, __cxl_dpa_to_region);
294 
295 	return ctx.cxlr;
296 }
297 
298 static int cxl_validate_poison_dpa(struct cxl_memdev *cxlmd, u64 dpa)
299 {
300 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
301 
302 	if (!IS_ENABLED(CONFIG_DEBUG_FS))
303 		return 0;
304 
305 	if (!resource_size(&cxlds->dpa_res)) {
306 		dev_dbg(cxlds->dev, "device has no dpa resource\n");
307 		return -EINVAL;
308 	}
309 	if (dpa < cxlds->dpa_res.start || dpa > cxlds->dpa_res.end) {
310 		dev_dbg(cxlds->dev, "dpa:0x%llx not in resource:%pR\n",
311 			dpa, &cxlds->dpa_res);
312 		return -EINVAL;
313 	}
314 	if (!IS_ALIGNED(dpa, 64)) {
315 		dev_dbg(cxlds->dev, "dpa:0x%llx is not 64-byte aligned\n", dpa);
316 		return -EINVAL;
317 	}
318 
319 	return 0;
320 }
321 
322 int cxl_inject_poison(struct cxl_memdev *cxlmd, u64 dpa)
323 {
324 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
325 	struct cxl_mbox_inject_poison inject;
326 	struct cxl_poison_record record;
327 	struct cxl_mbox_cmd mbox_cmd;
328 	struct cxl_region *cxlr;
329 	int rc;
330 
331 	if (!IS_ENABLED(CONFIG_DEBUG_FS))
332 		return 0;
333 
334 	rc = down_read_interruptible(&cxl_dpa_rwsem);
335 	if (rc)
336 		return rc;
337 
338 	rc = cxl_validate_poison_dpa(cxlmd, dpa);
339 	if (rc)
340 		goto out;
341 
342 	inject.address = cpu_to_le64(dpa);
343 	mbox_cmd = (struct cxl_mbox_cmd) {
344 		.opcode = CXL_MBOX_OP_INJECT_POISON,
345 		.size_in = sizeof(inject),
346 		.payload_in = &inject,
347 	};
348 	rc = cxl_internal_send_cmd(mds, &mbox_cmd);
349 	if (rc)
350 		goto out;
351 
352 	cxlr = cxl_dpa_to_region(cxlmd, dpa);
353 	if (cxlr)
354 		dev_warn_once(mds->cxlds.dev,
355 			      "poison inject dpa:%#llx region: %s\n", dpa,
356 			      dev_name(&cxlr->dev));
357 
358 	record = (struct cxl_poison_record) {
359 		.address = cpu_to_le64(dpa),
360 		.length = cpu_to_le32(1),
361 	};
362 	trace_cxl_poison(cxlmd, cxlr, &record, 0, 0, CXL_POISON_TRACE_INJECT);
363 out:
364 	up_read(&cxl_dpa_rwsem);
365 
366 	return rc;
367 }
368 EXPORT_SYMBOL_NS_GPL(cxl_inject_poison, CXL);
369 
370 int cxl_clear_poison(struct cxl_memdev *cxlmd, u64 dpa)
371 {
372 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
373 	struct cxl_mbox_clear_poison clear;
374 	struct cxl_poison_record record;
375 	struct cxl_mbox_cmd mbox_cmd;
376 	struct cxl_region *cxlr;
377 	int rc;
378 
379 	if (!IS_ENABLED(CONFIG_DEBUG_FS))
380 		return 0;
381 
382 	rc = down_read_interruptible(&cxl_dpa_rwsem);
383 	if (rc)
384 		return rc;
385 
386 	rc = cxl_validate_poison_dpa(cxlmd, dpa);
387 	if (rc)
388 		goto out;
389 
390 	/*
391 	 * In CXL 3.0 Spec 8.2.9.8.4.3, the Clear Poison mailbox command
392 	 * is defined to accept 64 bytes of write-data, along with the
393 	 * address to clear. This driver uses zeroes as write-data.
394 	 */
395 	clear = (struct cxl_mbox_clear_poison) {
396 		.address = cpu_to_le64(dpa)
397 	};
398 
399 	mbox_cmd = (struct cxl_mbox_cmd) {
400 		.opcode = CXL_MBOX_OP_CLEAR_POISON,
401 		.size_in = sizeof(clear),
402 		.payload_in = &clear,
403 	};
404 
405 	rc = cxl_internal_send_cmd(mds, &mbox_cmd);
406 	if (rc)
407 		goto out;
408 
409 	cxlr = cxl_dpa_to_region(cxlmd, dpa);
410 	if (cxlr)
411 		dev_warn_once(mds->cxlds.dev,
412 			      "poison clear dpa:%#llx region: %s\n", dpa,
413 			      dev_name(&cxlr->dev));
414 
415 	record = (struct cxl_poison_record) {
416 		.address = cpu_to_le64(dpa),
417 		.length = cpu_to_le32(1),
418 	};
419 	trace_cxl_poison(cxlmd, cxlr, &record, 0, 0, CXL_POISON_TRACE_CLEAR);
420 out:
421 	up_read(&cxl_dpa_rwsem);
422 
423 	return rc;
424 }
425 EXPORT_SYMBOL_NS_GPL(cxl_clear_poison, CXL);
426 
427 static struct attribute *cxl_memdev_attributes[] = {
428 	&dev_attr_serial.attr,
429 	&dev_attr_firmware_version.attr,
430 	&dev_attr_payload_max.attr,
431 	&dev_attr_label_storage_size.attr,
432 	&dev_attr_numa_node.attr,
433 	NULL,
434 };
435 
436 static struct attribute *cxl_memdev_pmem_attributes[] = {
437 	&dev_attr_pmem_size.attr,
438 	NULL,
439 };
440 
441 static struct attribute *cxl_memdev_ram_attributes[] = {
442 	&dev_attr_ram_size.attr,
443 	NULL,
444 };
445 
446 static struct attribute *cxl_memdev_security_attributes[] = {
447 	&dev_attr_security_state.attr,
448 	&dev_attr_security_sanitize.attr,
449 	&dev_attr_security_erase.attr,
450 	NULL,
451 };
452 
453 static umode_t cxl_memdev_visible(struct kobject *kobj, struct attribute *a,
454 				  int n)
455 {
456 	if (!IS_ENABLED(CONFIG_NUMA) && a == &dev_attr_numa_node.attr)
457 		return 0;
458 	return a->mode;
459 }
460 
461 static struct attribute_group cxl_memdev_attribute_group = {
462 	.attrs = cxl_memdev_attributes,
463 	.is_visible = cxl_memdev_visible,
464 };
465 
466 static struct attribute_group cxl_memdev_ram_attribute_group = {
467 	.name = "ram",
468 	.attrs = cxl_memdev_ram_attributes,
469 };
470 
471 static struct attribute_group cxl_memdev_pmem_attribute_group = {
472 	.name = "pmem",
473 	.attrs = cxl_memdev_pmem_attributes,
474 };
475 
476 static umode_t cxl_memdev_security_visible(struct kobject *kobj,
477 					   struct attribute *a, int n)
478 {
479 	struct device *dev = kobj_to_dev(kobj);
480 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
481 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
482 
483 	if (a == &dev_attr_security_sanitize.attr &&
484 	    !test_bit(CXL_SEC_ENABLED_SANITIZE, mds->security.enabled_cmds))
485 		return 0;
486 
487 	if (a == &dev_attr_security_erase.attr &&
488 	    !test_bit(CXL_SEC_ENABLED_SECURE_ERASE, mds->security.enabled_cmds))
489 		return 0;
490 
491 	return a->mode;
492 }
493 
494 static struct attribute_group cxl_memdev_security_attribute_group = {
495 	.name = "security",
496 	.attrs = cxl_memdev_security_attributes,
497 	.is_visible = cxl_memdev_security_visible,
498 };
499 
500 static const struct attribute_group *cxl_memdev_attribute_groups[] = {
501 	&cxl_memdev_attribute_group,
502 	&cxl_memdev_ram_attribute_group,
503 	&cxl_memdev_pmem_attribute_group,
504 	&cxl_memdev_security_attribute_group,
505 	NULL,
506 };
507 
508 static const struct device_type cxl_memdev_type = {
509 	.name = "cxl_memdev",
510 	.release = cxl_memdev_release,
511 	.devnode = cxl_memdev_devnode,
512 	.groups = cxl_memdev_attribute_groups,
513 };
514 
515 bool is_cxl_memdev(const struct device *dev)
516 {
517 	return dev->type == &cxl_memdev_type;
518 }
519 EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, CXL);
520 
521 /**
522  * set_exclusive_cxl_commands() - atomically disable user cxl commands
523  * @mds: The device state to operate on
524  * @cmds: bitmap of commands to mark exclusive
525  *
526  * Grab the cxl_memdev_rwsem in write mode to flush in-flight
527  * invocations of the ioctl path and then disable future execution of
528  * commands with the command ids set in @cmds.
529  */
530 void set_exclusive_cxl_commands(struct cxl_memdev_state *mds,
531 				unsigned long *cmds)
532 {
533 	down_write(&cxl_memdev_rwsem);
534 	bitmap_or(mds->exclusive_cmds, mds->exclusive_cmds, cmds,
535 		  CXL_MEM_COMMAND_ID_MAX);
536 	up_write(&cxl_memdev_rwsem);
537 }
538 EXPORT_SYMBOL_NS_GPL(set_exclusive_cxl_commands, CXL);
539 
540 /**
541  * clear_exclusive_cxl_commands() - atomically enable user cxl commands
542  * @mds: The device state to modify
543  * @cmds: bitmap of commands to mark available for userspace
544  */
545 void clear_exclusive_cxl_commands(struct cxl_memdev_state *mds,
546 				  unsigned long *cmds)
547 {
548 	down_write(&cxl_memdev_rwsem);
549 	bitmap_andnot(mds->exclusive_cmds, mds->exclusive_cmds, cmds,
550 		      CXL_MEM_COMMAND_ID_MAX);
551 	up_write(&cxl_memdev_rwsem);
552 }
553 EXPORT_SYMBOL_NS_GPL(clear_exclusive_cxl_commands, CXL);
554 
555 static void cxl_memdev_shutdown(struct device *dev)
556 {
557 	struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
558 
559 	down_write(&cxl_memdev_rwsem);
560 	cxlmd->cxlds = NULL;
561 	up_write(&cxl_memdev_rwsem);
562 }
563 
564 static void cxl_memdev_unregister(void *_cxlmd)
565 {
566 	struct cxl_memdev *cxlmd = _cxlmd;
567 	struct device *dev = &cxlmd->dev;
568 
569 	cdev_device_del(&cxlmd->cdev, dev);
570 	cxl_memdev_shutdown(dev);
571 	put_device(dev);
572 }
573 
574 static void detach_memdev(struct work_struct *work)
575 {
576 	struct cxl_memdev *cxlmd;
577 
578 	cxlmd = container_of(work, typeof(*cxlmd), detach_work);
579 	device_release_driver(&cxlmd->dev);
580 	put_device(&cxlmd->dev);
581 }
582 
583 static struct lock_class_key cxl_memdev_key;
584 
585 static struct cxl_memdev *cxl_memdev_alloc(struct cxl_dev_state *cxlds,
586 					   const struct file_operations *fops)
587 {
588 	struct cxl_memdev *cxlmd;
589 	struct device *dev;
590 	struct cdev *cdev;
591 	int rc;
592 
593 	cxlmd = kzalloc(sizeof(*cxlmd), GFP_KERNEL);
594 	if (!cxlmd)
595 		return ERR_PTR(-ENOMEM);
596 
597 	rc = ida_alloc_max(&cxl_memdev_ida, CXL_MEM_MAX_DEVS - 1, GFP_KERNEL);
598 	if (rc < 0)
599 		goto err;
600 	cxlmd->id = rc;
601 	cxlmd->depth = -1;
602 
603 	dev = &cxlmd->dev;
604 	device_initialize(dev);
605 	lockdep_set_class(&dev->mutex, &cxl_memdev_key);
606 	dev->parent = cxlds->dev;
607 	dev->bus = &cxl_bus_type;
608 	dev->devt = MKDEV(cxl_mem_major, cxlmd->id);
609 	dev->type = &cxl_memdev_type;
610 	device_set_pm_not_required(dev);
611 	INIT_WORK(&cxlmd->detach_work, detach_memdev);
612 
613 	cdev = &cxlmd->cdev;
614 	cdev_init(cdev, fops);
615 	return cxlmd;
616 
617 err:
618 	kfree(cxlmd);
619 	return ERR_PTR(rc);
620 }
621 
622 static long __cxl_memdev_ioctl(struct cxl_memdev *cxlmd, unsigned int cmd,
623 			       unsigned long arg)
624 {
625 	switch (cmd) {
626 	case CXL_MEM_QUERY_COMMANDS:
627 		return cxl_query_cmd(cxlmd, (void __user *)arg);
628 	case CXL_MEM_SEND_COMMAND:
629 		return cxl_send_cmd(cxlmd, (void __user *)arg);
630 	default:
631 		return -ENOTTY;
632 	}
633 }
634 
635 static long cxl_memdev_ioctl(struct file *file, unsigned int cmd,
636 			     unsigned long arg)
637 {
638 	struct cxl_memdev *cxlmd = file->private_data;
639 	struct cxl_dev_state *cxlds;
640 	int rc = -ENXIO;
641 
642 	down_read(&cxl_memdev_rwsem);
643 	cxlds = cxlmd->cxlds;
644 	if (cxlds && cxlds->type == CXL_DEVTYPE_CLASSMEM)
645 		rc = __cxl_memdev_ioctl(cxlmd, cmd, arg);
646 	up_read(&cxl_memdev_rwsem);
647 
648 	return rc;
649 }
650 
651 static int cxl_memdev_open(struct inode *inode, struct file *file)
652 {
653 	struct cxl_memdev *cxlmd =
654 		container_of(inode->i_cdev, typeof(*cxlmd), cdev);
655 
656 	get_device(&cxlmd->dev);
657 	file->private_data = cxlmd;
658 
659 	return 0;
660 }
661 
662 static int cxl_memdev_release_file(struct inode *inode, struct file *file)
663 {
664 	struct cxl_memdev *cxlmd =
665 		container_of(inode->i_cdev, typeof(*cxlmd), cdev);
666 
667 	put_device(&cxlmd->dev);
668 
669 	return 0;
670 }
671 
672 /**
673  * cxl_mem_get_fw_info - Get Firmware info
674  * @mds: The device data for the operation
675  *
676  * Retrieve firmware info for the device specified.
677  *
678  * Return: 0 if no error: or the result of the mailbox command.
679  *
680  * See CXL-3.0 8.2.9.3.1 Get FW Info
681  */
682 static int cxl_mem_get_fw_info(struct cxl_memdev_state *mds)
683 {
684 	struct cxl_mbox_get_fw_info info;
685 	struct cxl_mbox_cmd mbox_cmd;
686 	int rc;
687 
688 	mbox_cmd = (struct cxl_mbox_cmd) {
689 		.opcode = CXL_MBOX_OP_GET_FW_INFO,
690 		.size_out = sizeof(info),
691 		.payload_out = &info,
692 	};
693 
694 	rc = cxl_internal_send_cmd(mds, &mbox_cmd);
695 	if (rc < 0)
696 		return rc;
697 
698 	mds->fw.num_slots = info.num_slots;
699 	mds->fw.cur_slot = FIELD_GET(CXL_FW_INFO_SLOT_INFO_CUR_MASK,
700 				       info.slot_info);
701 
702 	return 0;
703 }
704 
705 /**
706  * cxl_mem_activate_fw - Activate Firmware
707  * @mds: The device data for the operation
708  * @slot: slot number to activate
709  *
710  * Activate firmware in a given slot for the device specified.
711  *
712  * Return: 0 if no error: or the result of the mailbox command.
713  *
714  * See CXL-3.0 8.2.9.3.3 Activate FW
715  */
716 static int cxl_mem_activate_fw(struct cxl_memdev_state *mds, int slot)
717 {
718 	struct cxl_mbox_activate_fw activate;
719 	struct cxl_mbox_cmd mbox_cmd;
720 
721 	if (slot == 0 || slot > mds->fw.num_slots)
722 		return -EINVAL;
723 
724 	mbox_cmd = (struct cxl_mbox_cmd) {
725 		.opcode = CXL_MBOX_OP_ACTIVATE_FW,
726 		.size_in = sizeof(activate),
727 		.payload_in = &activate,
728 	};
729 
730 	/* Only offline activation supported for now */
731 	activate.action = CXL_FW_ACTIVATE_OFFLINE;
732 	activate.slot = slot;
733 
734 	return cxl_internal_send_cmd(mds, &mbox_cmd);
735 }
736 
737 /**
738  * cxl_mem_abort_fw_xfer - Abort an in-progress FW transfer
739  * @mds: The device data for the operation
740  *
741  * Abort an in-progress firmware transfer for the device specified.
742  *
743  * Return: 0 if no error: or the result of the mailbox command.
744  *
745  * See CXL-3.0 8.2.9.3.2 Transfer FW
746  */
747 static int cxl_mem_abort_fw_xfer(struct cxl_memdev_state *mds)
748 {
749 	struct cxl_mbox_transfer_fw *transfer;
750 	struct cxl_mbox_cmd mbox_cmd;
751 	int rc;
752 
753 	transfer = kzalloc(struct_size(transfer, data, 0), GFP_KERNEL);
754 	if (!transfer)
755 		return -ENOMEM;
756 
757 	/* Set a 1s poll interval and a total wait time of 30s */
758 	mbox_cmd = (struct cxl_mbox_cmd) {
759 		.opcode = CXL_MBOX_OP_TRANSFER_FW,
760 		.size_in = sizeof(*transfer),
761 		.payload_in = transfer,
762 		.poll_interval_ms = 1000,
763 		.poll_count = 30,
764 	};
765 
766 	transfer->action = CXL_FW_TRANSFER_ACTION_ABORT;
767 
768 	rc = cxl_internal_send_cmd(mds, &mbox_cmd);
769 	kfree(transfer);
770 	return rc;
771 }
772 
773 static void cxl_fw_cleanup(struct fw_upload *fwl)
774 {
775 	struct cxl_memdev_state *mds = fwl->dd_handle;
776 
777 	mds->fw.next_slot = 0;
778 }
779 
780 static int cxl_fw_do_cancel(struct fw_upload *fwl)
781 {
782 	struct cxl_memdev_state *mds = fwl->dd_handle;
783 	struct cxl_dev_state *cxlds = &mds->cxlds;
784 	struct cxl_memdev *cxlmd = cxlds->cxlmd;
785 	int rc;
786 
787 	rc = cxl_mem_abort_fw_xfer(mds);
788 	if (rc < 0)
789 		dev_err(&cxlmd->dev, "Error aborting FW transfer: %d\n", rc);
790 
791 	return FW_UPLOAD_ERR_CANCELED;
792 }
793 
794 static enum fw_upload_err cxl_fw_prepare(struct fw_upload *fwl, const u8 *data,
795 					 u32 size)
796 {
797 	struct cxl_memdev_state *mds = fwl->dd_handle;
798 	struct cxl_mbox_transfer_fw *transfer;
799 
800 	if (!size)
801 		return FW_UPLOAD_ERR_INVALID_SIZE;
802 
803 	mds->fw.oneshot = struct_size(transfer, data, size) <
804 			    mds->payload_size;
805 
806 	if (cxl_mem_get_fw_info(mds))
807 		return FW_UPLOAD_ERR_HW_ERROR;
808 
809 	/*
810 	 * So far no state has been changed, hence no other cleanup is
811 	 * necessary. Simply return the cancelled status.
812 	 */
813 	if (test_and_clear_bit(CXL_FW_CANCEL, mds->fw.state))
814 		return FW_UPLOAD_ERR_CANCELED;
815 
816 	return FW_UPLOAD_ERR_NONE;
817 }
818 
819 static enum fw_upload_err cxl_fw_write(struct fw_upload *fwl, const u8 *data,
820 				       u32 offset, u32 size, u32 *written)
821 {
822 	struct cxl_memdev_state *mds = fwl->dd_handle;
823 	struct cxl_dev_state *cxlds = &mds->cxlds;
824 	struct cxl_memdev *cxlmd = cxlds->cxlmd;
825 	struct cxl_mbox_transfer_fw *transfer;
826 	struct cxl_mbox_cmd mbox_cmd;
827 	u32 cur_size, remaining;
828 	size_t size_in;
829 	int rc;
830 
831 	*written = 0;
832 
833 	/* Offset has to be aligned to 128B (CXL-3.0 8.2.9.3.2 Table 8-57) */
834 	if (!IS_ALIGNED(offset, CXL_FW_TRANSFER_ALIGNMENT)) {
835 		dev_err(&cxlmd->dev,
836 			"misaligned offset for FW transfer slice (%u)\n",
837 			offset);
838 		return FW_UPLOAD_ERR_RW_ERROR;
839 	}
840 
841 	/*
842 	 * Pick transfer size based on mds->payload_size @size must bw 128-byte
843 	 * aligned, ->payload_size is a power of 2 starting at 256 bytes, and
844 	 * sizeof(*transfer) is 128.  These constraints imply that @cur_size
845 	 * will always be 128b aligned.
846 	 */
847 	cur_size = min_t(size_t, size, mds->payload_size - sizeof(*transfer));
848 
849 	remaining = size - cur_size;
850 	size_in = struct_size(transfer, data, cur_size);
851 
852 	if (test_and_clear_bit(CXL_FW_CANCEL, mds->fw.state))
853 		return cxl_fw_do_cancel(fwl);
854 
855 	/*
856 	 * Slot numbers are 1-indexed
857 	 * cur_slot is the 0-indexed next_slot (i.e. 'cur_slot - 1 + 1')
858 	 * Check for rollover using modulo, and 1-index it by adding 1
859 	 */
860 	mds->fw.next_slot = (mds->fw.cur_slot % mds->fw.num_slots) + 1;
861 
862 	/* Do the transfer via mailbox cmd */
863 	transfer = kzalloc(size_in, GFP_KERNEL);
864 	if (!transfer)
865 		return FW_UPLOAD_ERR_RW_ERROR;
866 
867 	transfer->offset = cpu_to_le32(offset / CXL_FW_TRANSFER_ALIGNMENT);
868 	memcpy(transfer->data, data + offset, cur_size);
869 	if (mds->fw.oneshot) {
870 		transfer->action = CXL_FW_TRANSFER_ACTION_FULL;
871 		transfer->slot = mds->fw.next_slot;
872 	} else {
873 		if (offset == 0) {
874 			transfer->action = CXL_FW_TRANSFER_ACTION_INITIATE;
875 		} else if (remaining == 0) {
876 			transfer->action = CXL_FW_TRANSFER_ACTION_END;
877 			transfer->slot = mds->fw.next_slot;
878 		} else {
879 			transfer->action = CXL_FW_TRANSFER_ACTION_CONTINUE;
880 		}
881 	}
882 
883 	mbox_cmd = (struct cxl_mbox_cmd) {
884 		.opcode = CXL_MBOX_OP_TRANSFER_FW,
885 		.size_in = size_in,
886 		.payload_in = transfer,
887 		.poll_interval_ms = 1000,
888 		.poll_count = 30,
889 	};
890 
891 	rc = cxl_internal_send_cmd(mds, &mbox_cmd);
892 	if (rc < 0) {
893 		rc = FW_UPLOAD_ERR_RW_ERROR;
894 		goto out_free;
895 	}
896 
897 	*written = cur_size;
898 
899 	/* Activate FW if oneshot or if the last slice was written */
900 	if (mds->fw.oneshot || remaining == 0) {
901 		dev_dbg(&cxlmd->dev, "Activating firmware slot: %d\n",
902 			mds->fw.next_slot);
903 		rc = cxl_mem_activate_fw(mds, mds->fw.next_slot);
904 		if (rc < 0) {
905 			dev_err(&cxlmd->dev, "Error activating firmware: %d\n",
906 				rc);
907 			rc = FW_UPLOAD_ERR_HW_ERROR;
908 			goto out_free;
909 		}
910 	}
911 
912 	rc = FW_UPLOAD_ERR_NONE;
913 
914 out_free:
915 	kfree(transfer);
916 	return rc;
917 }
918 
919 static enum fw_upload_err cxl_fw_poll_complete(struct fw_upload *fwl)
920 {
921 	struct cxl_memdev_state *mds = fwl->dd_handle;
922 
923 	/*
924 	 * cxl_internal_send_cmd() handles background operations synchronously.
925 	 * No need to wait for completions here - any errors would've been
926 	 * reported and handled during the ->write() call(s).
927 	 * Just check if a cancel request was received, and return success.
928 	 */
929 	if (test_and_clear_bit(CXL_FW_CANCEL, mds->fw.state))
930 		return cxl_fw_do_cancel(fwl);
931 
932 	return FW_UPLOAD_ERR_NONE;
933 }
934 
935 static void cxl_fw_cancel(struct fw_upload *fwl)
936 {
937 	struct cxl_memdev_state *mds = fwl->dd_handle;
938 
939 	set_bit(CXL_FW_CANCEL, mds->fw.state);
940 }
941 
942 static const struct fw_upload_ops cxl_memdev_fw_ops = {
943         .prepare = cxl_fw_prepare,
944         .write = cxl_fw_write,
945         .poll_complete = cxl_fw_poll_complete,
946         .cancel = cxl_fw_cancel,
947         .cleanup = cxl_fw_cleanup,
948 };
949 
950 static void cxl_remove_fw_upload(void *fwl)
951 {
952 	firmware_upload_unregister(fwl);
953 }
954 
955 int devm_cxl_setup_fw_upload(struct device *host, struct cxl_memdev_state *mds)
956 {
957 	struct cxl_dev_state *cxlds = &mds->cxlds;
958 	struct device *dev = &cxlds->cxlmd->dev;
959 	struct fw_upload *fwl;
960 
961 	if (!test_bit(CXL_MEM_COMMAND_ID_GET_FW_INFO, mds->enabled_cmds))
962 		return 0;
963 
964 	fwl = firmware_upload_register(THIS_MODULE, dev, dev_name(dev),
965 				       &cxl_memdev_fw_ops, mds);
966 	if (IS_ERR(fwl))
967 		return PTR_ERR(fwl);
968 	return devm_add_action_or_reset(host, cxl_remove_fw_upload, fwl);
969 }
970 EXPORT_SYMBOL_NS_GPL(devm_cxl_setup_fw_upload, CXL);
971 
972 static const struct file_operations cxl_memdev_fops = {
973 	.owner = THIS_MODULE,
974 	.unlocked_ioctl = cxl_memdev_ioctl,
975 	.open = cxl_memdev_open,
976 	.release = cxl_memdev_release_file,
977 	.compat_ioctl = compat_ptr_ioctl,
978 	.llseek = noop_llseek,
979 };
980 
981 struct cxl_memdev *devm_cxl_add_memdev(struct device *host,
982 				       struct cxl_dev_state *cxlds)
983 {
984 	struct cxl_memdev *cxlmd;
985 	struct device *dev;
986 	struct cdev *cdev;
987 	int rc;
988 
989 	cxlmd = cxl_memdev_alloc(cxlds, &cxl_memdev_fops);
990 	if (IS_ERR(cxlmd))
991 		return cxlmd;
992 
993 	dev = &cxlmd->dev;
994 	rc = dev_set_name(dev, "mem%d", cxlmd->id);
995 	if (rc)
996 		goto err;
997 
998 	/*
999 	 * Activate ioctl operations, no cxl_memdev_rwsem manipulation
1000 	 * needed as this is ordered with cdev_add() publishing the device.
1001 	 */
1002 	cxlmd->cxlds = cxlds;
1003 	cxlds->cxlmd = cxlmd;
1004 
1005 	cdev = &cxlmd->cdev;
1006 	rc = cdev_device_add(cdev, dev);
1007 	if (rc)
1008 		goto err;
1009 
1010 	rc = devm_add_action_or_reset(host, cxl_memdev_unregister, cxlmd);
1011 	if (rc)
1012 		return ERR_PTR(rc);
1013 	return cxlmd;
1014 
1015 err:
1016 	/*
1017 	 * The cdev was briefly live, shutdown any ioctl operations that
1018 	 * saw that state.
1019 	 */
1020 	cxl_memdev_shutdown(dev);
1021 	put_device(dev);
1022 	return ERR_PTR(rc);
1023 }
1024 EXPORT_SYMBOL_NS_GPL(devm_cxl_add_memdev, CXL);
1025 
1026 static void sanitize_teardown_notifier(void *data)
1027 {
1028 	struct cxl_memdev_state *mds = data;
1029 	struct kernfs_node *state;
1030 
1031 	/*
1032 	 * Prevent new irq triggered invocations of the workqueue and
1033 	 * flush inflight invocations.
1034 	 */
1035 	mutex_lock(&mds->mbox_mutex);
1036 	state = mds->security.sanitize_node;
1037 	mds->security.sanitize_node = NULL;
1038 	mutex_unlock(&mds->mbox_mutex);
1039 
1040 	cancel_delayed_work_sync(&mds->security.poll_dwork);
1041 	sysfs_put(state);
1042 }
1043 
1044 int devm_cxl_sanitize_setup_notifier(struct device *host,
1045 				     struct cxl_memdev *cxlmd)
1046 {
1047 	struct cxl_dev_state *cxlds = cxlmd->cxlds;
1048 	struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlds);
1049 	struct kernfs_node *sec;
1050 
1051 	if (!test_bit(CXL_SEC_ENABLED_SANITIZE, mds->security.enabled_cmds))
1052 		return 0;
1053 
1054 	/*
1055 	 * Note, the expectation is that @cxlmd would have failed to be
1056 	 * created if these sysfs_get_dirent calls fail.
1057 	 */
1058 	sec = sysfs_get_dirent(cxlmd->dev.kobj.sd, "security");
1059 	if (!sec)
1060 		return -ENOENT;
1061 	mds->security.sanitize_node = sysfs_get_dirent(sec, "state");
1062 	sysfs_put(sec);
1063 	if (!mds->security.sanitize_node)
1064 		return -ENOENT;
1065 
1066 	return devm_add_action_or_reset(host, sanitize_teardown_notifier, mds);
1067 }
1068 EXPORT_SYMBOL_NS_GPL(devm_cxl_sanitize_setup_notifier, CXL);
1069 
1070 __init int cxl_memdev_init(void)
1071 {
1072 	dev_t devt;
1073 	int rc;
1074 
1075 	rc = alloc_chrdev_region(&devt, 0, CXL_MEM_MAX_DEVS, "cxl");
1076 	if (rc)
1077 		return rc;
1078 
1079 	cxl_mem_major = MAJOR(devt);
1080 
1081 	return 0;
1082 }
1083 
1084 void cxl_memdev_exit(void)
1085 {
1086 	unregister_chrdev_region(MKDEV(cxl_mem_major, 0), CXL_MEM_MAX_DEVS);
1087 }
1088