1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/device.h> 4 #include <linux/err.h> 5 #include <linux/errno.h> 6 #include <linux/fs.h> 7 #include <linux/fsi-sbefifo.h> 8 #include <linux/gfp.h> 9 #include <linux/idr.h> 10 #include <linux/kernel.h> 11 #include <linux/list.h> 12 #include <linux/miscdevice.h> 13 #include <linux/mm.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 #include <linux/fsi-occ.h> 17 #include <linux/of.h> 18 #include <linux/of_device.h> 19 #include <linux/platform_device.h> 20 #include <linux/sched.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <asm/unaligned.h> 24 25 #define OCC_SRAM_BYTES 4096 26 #define OCC_CMD_DATA_BYTES 4090 27 #define OCC_RESP_DATA_BYTES 4089 28 29 #define OCC_P9_SRAM_CMD_ADDR 0xFFFBE000 30 #define OCC_P9_SRAM_RSP_ADDR 0xFFFBF000 31 32 #define OCC_P10_SRAM_CMD_ADDR 0xFFFFD000 33 #define OCC_P10_SRAM_RSP_ADDR 0xFFFFE000 34 35 #define OCC_P10_SRAM_MODE 0x58 /* Normal mode, OCB channel 2 */ 36 37 #define OCC_TIMEOUT_MS 1000 38 #define OCC_CMD_IN_PRG_WAIT_MS 50 39 40 enum versions { occ_p9, occ_p10 }; 41 42 struct occ { 43 struct device *dev; 44 struct device *sbefifo; 45 char name[32]; 46 int idx; 47 u8 sequence_number; 48 void *buffer; 49 void *client_buffer; 50 size_t client_buffer_size; 51 size_t client_response_size; 52 enum versions version; 53 struct miscdevice mdev; 54 struct mutex occ_lock; 55 }; 56 57 #define to_occ(x) container_of((x), struct occ, mdev) 58 59 struct occ_response { 60 u8 seq_no; 61 u8 cmd_type; 62 u8 return_status; 63 __be16 data_length; 64 u8 data[OCC_RESP_DATA_BYTES + 2]; /* two bytes checksum */ 65 } __packed; 66 67 struct occ_client { 68 struct occ *occ; 69 struct mutex lock; 70 size_t data_size; 71 size_t read_offset; 72 u8 *buffer; 73 }; 74 75 #define to_client(x) container_of((x), struct occ_client, xfr) 76 77 static DEFINE_IDA(occ_ida); 78 79 static int occ_open(struct inode *inode, struct file *file) 80 { 81 struct occ_client *client = kzalloc(sizeof(*client), GFP_KERNEL); 82 struct miscdevice *mdev = file->private_data; 83 struct occ *occ = to_occ(mdev); 84 85 if (!client) 86 return -ENOMEM; 87 88 client->buffer = (u8 *)__get_free_page(GFP_KERNEL); 89 if (!client->buffer) { 90 kfree(client); 91 return -ENOMEM; 92 } 93 94 client->occ = occ; 95 mutex_init(&client->lock); 96 file->private_data = client; 97 98 /* We allocate a 1-page buffer, make sure it all fits */ 99 BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE); 100 BUILD_BUG_ON((OCC_RESP_DATA_BYTES + 7) > PAGE_SIZE); 101 102 return 0; 103 } 104 105 static ssize_t occ_read(struct file *file, char __user *buf, size_t len, 106 loff_t *offset) 107 { 108 struct occ_client *client = file->private_data; 109 ssize_t rc = 0; 110 111 if (!client) 112 return -ENODEV; 113 114 if (len > OCC_SRAM_BYTES) 115 return -EINVAL; 116 117 mutex_lock(&client->lock); 118 119 /* This should not be possible ... */ 120 if (WARN_ON_ONCE(client->read_offset > client->data_size)) { 121 rc = -EIO; 122 goto done; 123 } 124 125 /* Grab how much data we have to read */ 126 rc = min(len, client->data_size - client->read_offset); 127 if (copy_to_user(buf, client->buffer + client->read_offset, rc)) 128 rc = -EFAULT; 129 else 130 client->read_offset += rc; 131 132 done: 133 mutex_unlock(&client->lock); 134 135 return rc; 136 } 137 138 static ssize_t occ_write(struct file *file, const char __user *buf, 139 size_t len, loff_t *offset) 140 { 141 struct occ_client *client = file->private_data; 142 size_t rlen, data_length; 143 ssize_t rc; 144 u8 *cmd; 145 146 if (!client) 147 return -ENODEV; 148 149 if (len > (OCC_CMD_DATA_BYTES + 3) || len < 3) 150 return -EINVAL; 151 152 mutex_lock(&client->lock); 153 154 /* Construct the command */ 155 cmd = client->buffer; 156 157 /* 158 * Copy the user command (assume user data follows the occ command 159 * format) 160 * byte 0: command type 161 * bytes 1-2: data length (msb first) 162 * bytes 3-n: data 163 */ 164 if (copy_from_user(&cmd[1], buf, len)) { 165 rc = -EFAULT; 166 goto done; 167 } 168 169 /* Extract data length */ 170 data_length = (cmd[2] << 8) + cmd[3]; 171 if (data_length > OCC_CMD_DATA_BYTES) { 172 rc = -EINVAL; 173 goto done; 174 } 175 176 /* Submit command; 4 bytes before the data and 2 bytes after */ 177 rlen = PAGE_SIZE; 178 rc = fsi_occ_submit(client->occ->dev, cmd, data_length + 6, cmd, 179 &rlen); 180 if (rc) 181 goto done; 182 183 /* Set read tracking data */ 184 client->data_size = rlen; 185 client->read_offset = 0; 186 187 /* Done */ 188 rc = len; 189 190 done: 191 mutex_unlock(&client->lock); 192 193 return rc; 194 } 195 196 static int occ_release(struct inode *inode, struct file *file) 197 { 198 struct occ_client *client = file->private_data; 199 200 free_page((unsigned long)client->buffer); 201 kfree(client); 202 203 return 0; 204 } 205 206 static const struct file_operations occ_fops = { 207 .owner = THIS_MODULE, 208 .open = occ_open, 209 .read = occ_read, 210 .write = occ_write, 211 .release = occ_release, 212 }; 213 214 static void occ_save_ffdc(struct occ *occ, __be32 *resp, size_t parsed_len, 215 size_t resp_len) 216 { 217 if (resp_len > parsed_len) { 218 size_t dh = resp_len - parsed_len; 219 size_t ffdc_len = (dh - 1) * 4; /* SBE words are four bytes */ 220 __be32 *ffdc = &resp[parsed_len]; 221 222 if (ffdc_len > occ->client_buffer_size) 223 ffdc_len = occ->client_buffer_size; 224 225 memcpy(occ->client_buffer, ffdc, ffdc_len); 226 occ->client_response_size = ffdc_len; 227 } 228 } 229 230 static int occ_verify_checksum(struct occ *occ, struct occ_response *resp, 231 u16 data_length) 232 { 233 /* Fetch the two bytes after the data for the checksum. */ 234 u16 checksum_resp = get_unaligned_be16(&resp->data[data_length]); 235 u16 checksum; 236 u16 i; 237 238 checksum = resp->seq_no; 239 checksum += resp->cmd_type; 240 checksum += resp->return_status; 241 checksum += (data_length >> 8) + (data_length & 0xFF); 242 243 for (i = 0; i < data_length; ++i) 244 checksum += resp->data[i]; 245 246 if (checksum != checksum_resp) { 247 dev_err(occ->dev, "Bad checksum: %04x!=%04x\n", checksum, 248 checksum_resp); 249 return -EBADMSG; 250 } 251 252 return 0; 253 } 254 255 static int occ_getsram(struct occ *occ, u32 offset, void *data, ssize_t len) 256 { 257 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 258 size_t cmd_len, parsed_len, resp_data_len; 259 size_t resp_len = OCC_MAX_RESP_WORDS; 260 __be32 *resp = occ->buffer; 261 __be32 cmd[6]; 262 int idx = 0, rc; 263 264 /* 265 * Magic sequence to do SBE getsram command. SBE will fetch data from 266 * specified SRAM address. 267 */ 268 switch (occ->version) { 269 default: 270 case occ_p9: 271 cmd_len = 5; 272 cmd[2] = cpu_to_be32(1); /* Normal mode */ 273 cmd[3] = cpu_to_be32(OCC_P9_SRAM_RSP_ADDR + offset); 274 break; 275 case occ_p10: 276 idx = 1; 277 cmd_len = 6; 278 cmd[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 279 cmd[3] = 0; 280 cmd[4] = cpu_to_be32(OCC_P10_SRAM_RSP_ADDR + offset); 281 break; 282 } 283 284 cmd[0] = cpu_to_be32(cmd_len); 285 cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_OCC_SRAM); 286 cmd[4 + idx] = cpu_to_be32(data_len); 287 288 rc = sbefifo_submit(occ->sbefifo, cmd, cmd_len, resp, &resp_len); 289 if (rc) 290 return rc; 291 292 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_GET_OCC_SRAM, 293 resp, resp_len, &parsed_len); 294 if (rc > 0) { 295 dev_err(occ->dev, "SRAM read returned failure status: %08x\n", 296 rc); 297 occ_save_ffdc(occ, resp, parsed_len, resp_len); 298 return -ECOMM; 299 } else if (rc) { 300 return rc; 301 } 302 303 resp_data_len = be32_to_cpu(resp[parsed_len - 1]); 304 if (resp_data_len != data_len) { 305 dev_err(occ->dev, "SRAM read expected %d bytes got %zd\n", 306 data_len, resp_data_len); 307 rc = -EBADMSG; 308 } else { 309 memcpy(data, resp, len); 310 } 311 312 return rc; 313 } 314 315 static int occ_putsram(struct occ *occ, const void *data, ssize_t len, 316 u8 seq_no, u16 checksum) 317 { 318 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 319 size_t cmd_len, parsed_len, resp_data_len; 320 size_t resp_len = OCC_MAX_RESP_WORDS; 321 __be32 *buf = occ->buffer; 322 u8 *byte_buf; 323 int idx = 0, rc; 324 325 cmd_len = (occ->version == occ_p10) ? 6 : 5; 326 cmd_len += data_len >> 2; 327 328 /* 329 * Magic sequence to do SBE putsram command. SBE will transfer 330 * data to specified SRAM address. 331 */ 332 buf[0] = cpu_to_be32(cmd_len); 333 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 334 335 switch (occ->version) { 336 default: 337 case occ_p9: 338 buf[2] = cpu_to_be32(1); /* Normal mode */ 339 buf[3] = cpu_to_be32(OCC_P9_SRAM_CMD_ADDR); 340 break; 341 case occ_p10: 342 idx = 1; 343 buf[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 344 buf[3] = 0; 345 buf[4] = cpu_to_be32(OCC_P10_SRAM_CMD_ADDR); 346 break; 347 } 348 349 buf[4 + idx] = cpu_to_be32(data_len); 350 memcpy(&buf[5 + idx], data, len); 351 352 byte_buf = (u8 *)&buf[5 + idx]; 353 /* 354 * Overwrite the first byte with our sequence number and the last two 355 * bytes with the checksum. 356 */ 357 byte_buf[0] = seq_no; 358 byte_buf[len - 2] = checksum >> 8; 359 byte_buf[len - 1] = checksum & 0xff; 360 361 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 362 if (rc) 363 return rc; 364 365 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 366 buf, resp_len, &parsed_len); 367 if (rc > 0) { 368 dev_err(occ->dev, "SRAM write returned failure status: %08x\n", 369 rc); 370 occ_save_ffdc(occ, buf, parsed_len, resp_len); 371 return -ECOMM; 372 } else if (rc) { 373 return rc; 374 } 375 376 if (parsed_len != 1) { 377 dev_err(occ->dev, "SRAM write response length invalid: %zd\n", 378 parsed_len); 379 rc = -EBADMSG; 380 } else { 381 resp_data_len = be32_to_cpu(buf[0]); 382 if (resp_data_len != data_len) { 383 dev_err(occ->dev, 384 "SRAM write expected %d bytes got %zd\n", 385 data_len, resp_data_len); 386 rc = -EBADMSG; 387 } 388 } 389 390 return rc; 391 } 392 393 static int occ_trigger_attn(struct occ *occ) 394 { 395 __be32 *buf = occ->buffer; 396 size_t cmd_len, parsed_len, resp_data_len; 397 size_t resp_len = OCC_MAX_RESP_WORDS; 398 int idx = 0, rc; 399 400 switch (occ->version) { 401 default: 402 case occ_p9: 403 cmd_len = 7; 404 buf[2] = cpu_to_be32(3); /* Circular mode */ 405 buf[3] = 0; 406 break; 407 case occ_p10: 408 idx = 1; 409 cmd_len = 8; 410 buf[2] = cpu_to_be32(0xd0); /* Circular mode, OCB Channel 1 */ 411 buf[3] = 0; 412 buf[4] = 0; 413 break; 414 } 415 416 buf[0] = cpu_to_be32(cmd_len); /* Chip-op length in words */ 417 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 418 buf[4 + idx] = cpu_to_be32(8); /* Data length in bytes */ 419 buf[5 + idx] = cpu_to_be32(0x20010000); /* Trigger OCC attention */ 420 buf[6 + idx] = 0; 421 422 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 423 if (rc) 424 return rc; 425 426 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 427 buf, resp_len, &parsed_len); 428 if (rc > 0) { 429 dev_err(occ->dev, "SRAM attn returned failure status: %08x\n", 430 rc); 431 occ_save_ffdc(occ, buf, parsed_len, resp_len); 432 return -ECOMM; 433 } else if (rc) { 434 return rc; 435 } 436 437 if (parsed_len != 1) { 438 dev_err(occ->dev, "SRAM attn response length invalid: %zd\n", 439 parsed_len); 440 rc = -EBADMSG; 441 } else { 442 resp_data_len = be32_to_cpu(buf[0]); 443 if (resp_data_len != 8) { 444 dev_err(occ->dev, 445 "SRAM attn expected 8 bytes got %zd\n", 446 resp_data_len); 447 rc = -EBADMSG; 448 } 449 } 450 451 return rc; 452 } 453 454 int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, 455 void *response, size_t *resp_len) 456 { 457 const unsigned long timeout = msecs_to_jiffies(OCC_TIMEOUT_MS); 458 const unsigned long wait_time = 459 msecs_to_jiffies(OCC_CMD_IN_PRG_WAIT_MS); 460 struct occ *occ = dev_get_drvdata(dev); 461 struct occ_response *resp = response; 462 size_t user_resp_len = *resp_len; 463 u8 seq_no; 464 u16 checksum = 0; 465 u16 resp_data_length; 466 const u8 *byte_request = (const u8 *)request; 467 unsigned long start; 468 int rc; 469 size_t i; 470 471 *resp_len = 0; 472 473 if (!occ) 474 return -ENODEV; 475 476 if (user_resp_len < 7) { 477 dev_dbg(dev, "Bad resplen %zd\n", user_resp_len); 478 return -EINVAL; 479 } 480 481 /* Checksum the request, ignoring first byte (sequence number). */ 482 for (i = 1; i < req_len - 2; ++i) 483 checksum += byte_request[i]; 484 485 mutex_lock(&occ->occ_lock); 486 487 occ->client_buffer = response; 488 occ->client_buffer_size = user_resp_len; 489 occ->client_response_size = 0; 490 491 /* 492 * Get a sequence number and update the counter. Avoid a sequence 493 * number of 0 which would pass the response check below even if the 494 * OCC response is uninitialized. Any sequence number the user is 495 * trying to send is overwritten since this function is the only common 496 * interface to the OCC and therefore the only place we can guarantee 497 * unique sequence numbers. 498 */ 499 seq_no = occ->sequence_number++; 500 if (!occ->sequence_number) 501 occ->sequence_number = 1; 502 checksum += seq_no; 503 504 rc = occ_putsram(occ, request, req_len, seq_no, checksum); 505 if (rc) 506 goto done; 507 508 rc = occ_trigger_attn(occ); 509 if (rc) 510 goto done; 511 512 /* Read occ response header */ 513 start = jiffies; 514 do { 515 rc = occ_getsram(occ, 0, resp, 8); 516 if (rc) 517 goto done; 518 519 if (resp->return_status == OCC_RESP_CMD_IN_PRG || 520 resp->return_status == OCC_RESP_CRIT_INIT || 521 resp->seq_no != seq_no) { 522 rc = -ETIMEDOUT; 523 524 if (time_after(jiffies, start + timeout)) { 525 dev_err(occ->dev, "resp timeout status=%02x " 526 "resp seq_no=%d our seq_no=%d\n", 527 resp->return_status, resp->seq_no, 528 seq_no); 529 goto done; 530 } 531 532 set_current_state(TASK_UNINTERRUPTIBLE); 533 schedule_timeout(wait_time); 534 } 535 } while (rc); 536 537 /* Extract size of response data */ 538 resp_data_length = get_unaligned_be16(&resp->data_length); 539 540 /* Message size is data length + 5 bytes header + 2 bytes checksum */ 541 if ((resp_data_length + 7) > user_resp_len) { 542 rc = -EMSGSIZE; 543 goto done; 544 } 545 546 dev_dbg(dev, "resp_status=%02x resp_data_len=%d\n", 547 resp->return_status, resp_data_length); 548 549 /* Grab the rest */ 550 if (resp_data_length > 1) { 551 /* already got 3 bytes resp, also need 2 bytes checksum */ 552 rc = occ_getsram(occ, 8, &resp->data[3], resp_data_length - 1); 553 if (rc) 554 goto done; 555 } 556 557 occ->client_response_size = resp_data_length + 7; 558 rc = occ_verify_checksum(occ, resp, resp_data_length); 559 560 done: 561 *resp_len = occ->client_response_size; 562 mutex_unlock(&occ->occ_lock); 563 564 return rc; 565 } 566 EXPORT_SYMBOL_GPL(fsi_occ_submit); 567 568 static int occ_unregister_child(struct device *dev, void *data) 569 { 570 struct platform_device *hwmon_dev = to_platform_device(dev); 571 572 platform_device_unregister(hwmon_dev); 573 574 return 0; 575 } 576 577 static int occ_probe(struct platform_device *pdev) 578 { 579 int rc; 580 u32 reg; 581 struct occ *occ; 582 struct platform_device *hwmon_dev; 583 struct device *dev = &pdev->dev; 584 struct platform_device_info hwmon_dev_info = { 585 .parent = dev, 586 .name = "occ-hwmon", 587 }; 588 589 occ = devm_kzalloc(dev, sizeof(*occ), GFP_KERNEL); 590 if (!occ) 591 return -ENOMEM; 592 593 /* SBE words are always four bytes */ 594 occ->buffer = kvmalloc(OCC_MAX_RESP_WORDS * 4, GFP_KERNEL); 595 if (!occ->buffer) 596 return -ENOMEM; 597 598 occ->version = (uintptr_t)of_device_get_match_data(dev); 599 occ->dev = dev; 600 occ->sbefifo = dev->parent; 601 occ->sequence_number = 1; 602 mutex_init(&occ->occ_lock); 603 604 if (dev->of_node) { 605 rc = of_property_read_u32(dev->of_node, "reg", ®); 606 if (!rc) { 607 /* make sure we don't have a duplicate from dts */ 608 occ->idx = ida_simple_get(&occ_ida, reg, reg + 1, 609 GFP_KERNEL); 610 if (occ->idx < 0) 611 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 612 GFP_KERNEL); 613 } else { 614 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 615 GFP_KERNEL); 616 } 617 } else { 618 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, GFP_KERNEL); 619 } 620 621 platform_set_drvdata(pdev, occ); 622 623 snprintf(occ->name, sizeof(occ->name), "occ%d", occ->idx); 624 occ->mdev.fops = &occ_fops; 625 occ->mdev.minor = MISC_DYNAMIC_MINOR; 626 occ->mdev.name = occ->name; 627 occ->mdev.parent = dev; 628 629 rc = misc_register(&occ->mdev); 630 if (rc) { 631 dev_err(dev, "failed to register miscdevice: %d\n", rc); 632 ida_simple_remove(&occ_ida, occ->idx); 633 kvfree(occ->buffer); 634 return rc; 635 } 636 637 hwmon_dev_info.id = occ->idx; 638 hwmon_dev = platform_device_register_full(&hwmon_dev_info); 639 if (IS_ERR(hwmon_dev)) 640 dev_warn(dev, "failed to create hwmon device\n"); 641 642 return 0; 643 } 644 645 static int occ_remove(struct platform_device *pdev) 646 { 647 struct occ *occ = platform_get_drvdata(pdev); 648 649 kvfree(occ->buffer); 650 651 misc_deregister(&occ->mdev); 652 653 device_for_each_child(&pdev->dev, NULL, occ_unregister_child); 654 655 ida_simple_remove(&occ_ida, occ->idx); 656 657 return 0; 658 } 659 660 static const struct of_device_id occ_match[] = { 661 { 662 .compatible = "ibm,p9-occ", 663 .data = (void *)occ_p9 664 }, 665 { 666 .compatible = "ibm,p10-occ", 667 .data = (void *)occ_p10 668 }, 669 { }, 670 }; 671 MODULE_DEVICE_TABLE(of, occ_match); 672 673 static struct platform_driver occ_driver = { 674 .driver = { 675 .name = "occ", 676 .of_match_table = occ_match, 677 }, 678 .probe = occ_probe, 679 .remove = occ_remove, 680 }; 681 682 static int occ_init(void) 683 { 684 return platform_driver_register(&occ_driver); 685 } 686 687 static void occ_exit(void) 688 { 689 platform_driver_unregister(&occ_driver); 690 691 ida_destroy(&occ_ida); 692 } 693 694 module_init(occ_init); 695 module_exit(occ_exit); 696 697 MODULE_AUTHOR("Eddie James <eajames@linux.ibm.com>"); 698 MODULE_DESCRIPTION("BMC P9 OCC driver"); 699 MODULE_LICENSE("GPL"); 700