1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/device.h> 4 #include <linux/err.h> 5 #include <linux/errno.h> 6 #include <linux/fs.h> 7 #include <linux/fsi-sbefifo.h> 8 #include <linux/gfp.h> 9 #include <linux/idr.h> 10 #include <linux/kernel.h> 11 #include <linux/list.h> 12 #include <linux/miscdevice.h> 13 #include <linux/module.h> 14 #include <linux/mutex.h> 15 #include <linux/fsi-occ.h> 16 #include <linux/of.h> 17 #include <linux/of_device.h> 18 #include <linux/platform_device.h> 19 #include <linux/sched.h> 20 #include <linux/slab.h> 21 #include <linux/uaccess.h> 22 #include <asm/unaligned.h> 23 24 #define OCC_SRAM_BYTES 4096 25 #define OCC_CMD_DATA_BYTES 4090 26 #define OCC_RESP_DATA_BYTES 4089 27 28 #define OCC_P9_SRAM_CMD_ADDR 0xFFFBE000 29 #define OCC_P9_SRAM_RSP_ADDR 0xFFFBF000 30 31 #define OCC_P10_SRAM_CMD_ADDR 0xFFFFD000 32 #define OCC_P10_SRAM_RSP_ADDR 0xFFFFE000 33 34 #define OCC_P10_SRAM_MODE 0x58 /* Normal mode, OCB channel 2 */ 35 36 /* 37 * Assume we don't have much FFDC, if we do we'll overflow and 38 * fail the command. This needs to be big enough for simple 39 * commands as well. 40 */ 41 #define OCC_SBE_STATUS_WORDS 32 42 43 #define OCC_TIMEOUT_MS 1000 44 #define OCC_CMD_IN_PRG_WAIT_MS 50 45 46 enum versions { occ_p9, occ_p10 }; 47 48 struct occ { 49 struct device *dev; 50 struct device *sbefifo; 51 char name[32]; 52 int idx; 53 enum versions version; 54 struct miscdevice mdev; 55 struct mutex occ_lock; 56 }; 57 58 #define to_occ(x) container_of((x), struct occ, mdev) 59 60 struct occ_response { 61 u8 seq_no; 62 u8 cmd_type; 63 u8 return_status; 64 __be16 data_length; 65 u8 data[OCC_RESP_DATA_BYTES + 2]; /* two bytes checksum */ 66 } __packed; 67 68 struct occ_client { 69 struct occ *occ; 70 struct mutex lock; 71 size_t data_size; 72 size_t read_offset; 73 u8 *buffer; 74 }; 75 76 #define to_client(x) container_of((x), struct occ_client, xfr) 77 78 static DEFINE_IDA(occ_ida); 79 80 static int occ_open(struct inode *inode, struct file *file) 81 { 82 struct occ_client *client = kzalloc(sizeof(*client), GFP_KERNEL); 83 struct miscdevice *mdev = file->private_data; 84 struct occ *occ = to_occ(mdev); 85 86 if (!client) 87 return -ENOMEM; 88 89 client->buffer = (u8 *)__get_free_page(GFP_KERNEL); 90 if (!client->buffer) { 91 kfree(client); 92 return -ENOMEM; 93 } 94 95 client->occ = occ; 96 mutex_init(&client->lock); 97 file->private_data = client; 98 99 /* We allocate a 1-page buffer, make sure it all fits */ 100 BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE); 101 BUILD_BUG_ON((OCC_RESP_DATA_BYTES + 7) > PAGE_SIZE); 102 103 return 0; 104 } 105 106 static ssize_t occ_read(struct file *file, char __user *buf, size_t len, 107 loff_t *offset) 108 { 109 struct occ_client *client = file->private_data; 110 ssize_t rc = 0; 111 112 if (!client) 113 return -ENODEV; 114 115 if (len > OCC_SRAM_BYTES) 116 return -EINVAL; 117 118 mutex_lock(&client->lock); 119 120 /* This should not be possible ... */ 121 if (WARN_ON_ONCE(client->read_offset > client->data_size)) { 122 rc = -EIO; 123 goto done; 124 } 125 126 /* Grab how much data we have to read */ 127 rc = min(len, client->data_size - client->read_offset); 128 if (copy_to_user(buf, client->buffer + client->read_offset, rc)) 129 rc = -EFAULT; 130 else 131 client->read_offset += rc; 132 133 done: 134 mutex_unlock(&client->lock); 135 136 return rc; 137 } 138 139 static ssize_t occ_write(struct file *file, const char __user *buf, 140 size_t len, loff_t *offset) 141 { 142 struct occ_client *client = file->private_data; 143 size_t rlen, data_length; 144 u16 checksum = 0; 145 ssize_t rc, i; 146 u8 *cmd; 147 148 if (!client) 149 return -ENODEV; 150 151 if (len > (OCC_CMD_DATA_BYTES + 3) || len < 3) 152 return -EINVAL; 153 154 mutex_lock(&client->lock); 155 156 /* Construct the command */ 157 cmd = client->buffer; 158 159 /* Sequence number (we could increment and compare with response) */ 160 cmd[0] = 1; 161 162 /* 163 * Copy the user command (assume user data follows the occ command 164 * format) 165 * byte 0: command type 166 * bytes 1-2: data length (msb first) 167 * bytes 3-n: data 168 */ 169 if (copy_from_user(&cmd[1], buf, len)) { 170 rc = -EFAULT; 171 goto done; 172 } 173 174 /* Extract data length */ 175 data_length = (cmd[2] << 8) + cmd[3]; 176 if (data_length > OCC_CMD_DATA_BYTES) { 177 rc = -EINVAL; 178 goto done; 179 } 180 181 /* Calculate checksum */ 182 for (i = 0; i < data_length + 4; ++i) 183 checksum += cmd[i]; 184 185 cmd[data_length + 4] = checksum >> 8; 186 cmd[data_length + 5] = checksum & 0xFF; 187 188 /* Submit command */ 189 rlen = PAGE_SIZE; 190 rc = fsi_occ_submit(client->occ->dev, cmd, data_length + 6, cmd, 191 &rlen); 192 if (rc) 193 goto done; 194 195 /* Set read tracking data */ 196 client->data_size = rlen; 197 client->read_offset = 0; 198 199 /* Done */ 200 rc = len; 201 202 done: 203 mutex_unlock(&client->lock); 204 205 return rc; 206 } 207 208 static int occ_release(struct inode *inode, struct file *file) 209 { 210 struct occ_client *client = file->private_data; 211 212 free_page((unsigned long)client->buffer); 213 kfree(client); 214 215 return 0; 216 } 217 218 static const struct file_operations occ_fops = { 219 .owner = THIS_MODULE, 220 .open = occ_open, 221 .read = occ_read, 222 .write = occ_write, 223 .release = occ_release, 224 }; 225 226 static int occ_verify_checksum(struct occ *occ, struct occ_response *resp, 227 u16 data_length) 228 { 229 /* Fetch the two bytes after the data for the checksum. */ 230 u16 checksum_resp = get_unaligned_be16(&resp->data[data_length]); 231 u16 checksum; 232 u16 i; 233 234 checksum = resp->seq_no; 235 checksum += resp->cmd_type; 236 checksum += resp->return_status; 237 checksum += (data_length >> 8) + (data_length & 0xFF); 238 239 for (i = 0; i < data_length; ++i) 240 checksum += resp->data[i]; 241 242 if (checksum != checksum_resp) { 243 dev_err(occ->dev, "Bad checksum: %04x!=%04x\n", checksum, 244 checksum_resp); 245 return -EBADMSG; 246 } 247 248 return 0; 249 } 250 251 static int occ_getsram(struct occ *occ, u32 offset, void *data, ssize_t len) 252 { 253 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 254 size_t cmd_len, resp_len, resp_data_len; 255 __be32 *resp, cmd[6]; 256 int idx = 0, rc; 257 258 /* 259 * Magic sequence to do SBE getsram command. SBE will fetch data from 260 * specified SRAM address. 261 */ 262 switch (occ->version) { 263 default: 264 case occ_p9: 265 cmd_len = 5; 266 cmd[2] = cpu_to_be32(1); /* Normal mode */ 267 cmd[3] = cpu_to_be32(OCC_P9_SRAM_RSP_ADDR + offset); 268 break; 269 case occ_p10: 270 idx = 1; 271 cmd_len = 6; 272 cmd[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 273 cmd[3] = 0; 274 cmd[4] = cpu_to_be32(OCC_P10_SRAM_RSP_ADDR + offset); 275 break; 276 } 277 278 cmd[0] = cpu_to_be32(cmd_len); 279 cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_OCC_SRAM); 280 cmd[4 + idx] = cpu_to_be32(data_len); 281 282 resp_len = (data_len >> 2) + OCC_SBE_STATUS_WORDS; 283 resp = kzalloc(resp_len << 2, GFP_KERNEL); 284 if (!resp) 285 return -ENOMEM; 286 287 rc = sbefifo_submit(occ->sbefifo, cmd, cmd_len, resp, &resp_len); 288 if (rc) 289 goto free; 290 291 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_GET_OCC_SRAM, 292 resp, resp_len, &resp_len); 293 if (rc) 294 goto free; 295 296 resp_data_len = be32_to_cpu(resp[resp_len - 1]); 297 if (resp_data_len != data_len) { 298 dev_err(occ->dev, "SRAM read expected %d bytes got %zd\n", 299 data_len, resp_data_len); 300 rc = -EBADMSG; 301 } else { 302 memcpy(data, resp, len); 303 } 304 305 free: 306 /* Convert positive SBEI status */ 307 if (rc > 0) { 308 dev_err(occ->dev, "SRAM read returned failure status: %08x\n", 309 rc); 310 rc = -EBADMSG; 311 } 312 313 kfree(resp); 314 return rc; 315 } 316 317 static int occ_putsram(struct occ *occ, const void *data, ssize_t len) 318 { 319 size_t cmd_len, buf_len, resp_len, resp_data_len; 320 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 321 __be32 *buf; 322 int idx = 0, rc; 323 324 cmd_len = (occ->version == occ_p10) ? 6 : 5; 325 326 /* 327 * We use the same buffer for command and response, make 328 * sure it's big enough 329 */ 330 resp_len = OCC_SBE_STATUS_WORDS; 331 cmd_len += data_len >> 2; 332 buf_len = max(cmd_len, resp_len); 333 buf = kzalloc(buf_len << 2, GFP_KERNEL); 334 if (!buf) 335 return -ENOMEM; 336 337 /* 338 * Magic sequence to do SBE putsram command. SBE will transfer 339 * data to specified SRAM address. 340 */ 341 buf[0] = cpu_to_be32(cmd_len); 342 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 343 344 switch (occ->version) { 345 default: 346 case occ_p9: 347 buf[2] = cpu_to_be32(1); /* Normal mode */ 348 buf[3] = cpu_to_be32(OCC_P9_SRAM_CMD_ADDR); 349 break; 350 case occ_p10: 351 idx = 1; 352 buf[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 353 buf[3] = 0; 354 buf[4] = cpu_to_be32(OCC_P10_SRAM_CMD_ADDR); 355 break; 356 } 357 358 buf[4 + idx] = cpu_to_be32(data_len); 359 memcpy(&buf[5 + idx], data, len); 360 361 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 362 if (rc) 363 goto free; 364 365 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 366 buf, resp_len, &resp_len); 367 if (rc) 368 goto free; 369 370 if (resp_len != 1) { 371 dev_err(occ->dev, "SRAM write response length invalid: %zd\n", 372 resp_len); 373 rc = -EBADMSG; 374 } else { 375 resp_data_len = be32_to_cpu(buf[0]); 376 if (resp_data_len != data_len) { 377 dev_err(occ->dev, 378 "SRAM write expected %d bytes got %zd\n", 379 data_len, resp_data_len); 380 rc = -EBADMSG; 381 } 382 } 383 384 free: 385 /* Convert positive SBEI status */ 386 if (rc > 0) { 387 dev_err(occ->dev, "SRAM write returned failure status: %08x\n", 388 rc); 389 rc = -EBADMSG; 390 } 391 392 kfree(buf); 393 return rc; 394 } 395 396 static int occ_trigger_attn(struct occ *occ) 397 { 398 __be32 buf[OCC_SBE_STATUS_WORDS]; 399 size_t cmd_len, resp_len, resp_data_len; 400 int idx = 0, rc; 401 402 BUILD_BUG_ON(OCC_SBE_STATUS_WORDS < 8); 403 resp_len = OCC_SBE_STATUS_WORDS; 404 405 switch (occ->version) { 406 default: 407 case occ_p9: 408 cmd_len = 7; 409 buf[2] = cpu_to_be32(3); /* Circular mode */ 410 buf[3] = 0; 411 break; 412 case occ_p10: 413 idx = 1; 414 cmd_len = 8; 415 buf[2] = cpu_to_be32(0xd0); /* Circular mode, OCB Channel 1 */ 416 buf[3] = 0; 417 buf[4] = 0; 418 break; 419 } 420 421 buf[0] = cpu_to_be32(cmd_len); /* Chip-op length in words */ 422 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 423 buf[4 + idx] = cpu_to_be32(8); /* Data length in bytes */ 424 buf[5 + idx] = cpu_to_be32(0x20010000); /* Trigger OCC attention */ 425 buf[6 + idx] = 0; 426 427 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 428 if (rc) 429 goto error; 430 431 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 432 buf, resp_len, &resp_len); 433 if (rc) 434 goto error; 435 436 if (resp_len != 1) { 437 dev_err(occ->dev, "SRAM attn response length invalid: %zd\n", 438 resp_len); 439 rc = -EBADMSG; 440 } else { 441 resp_data_len = be32_to_cpu(buf[0]); 442 if (resp_data_len != 8) { 443 dev_err(occ->dev, 444 "SRAM attn expected 8 bytes got %zd\n", 445 resp_data_len); 446 rc = -EBADMSG; 447 } 448 } 449 450 error: 451 /* Convert positive SBEI status */ 452 if (rc > 0) { 453 dev_err(occ->dev, "SRAM attn returned failure status: %08x\n", 454 rc); 455 rc = -EBADMSG; 456 } 457 458 return rc; 459 } 460 461 int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, 462 void *response, size_t *resp_len) 463 { 464 const unsigned long timeout = msecs_to_jiffies(OCC_TIMEOUT_MS); 465 const unsigned long wait_time = 466 msecs_to_jiffies(OCC_CMD_IN_PRG_WAIT_MS); 467 struct occ *occ = dev_get_drvdata(dev); 468 struct occ_response *resp = response; 469 u8 seq_no; 470 u16 resp_data_length; 471 unsigned long start; 472 int rc; 473 474 if (!occ) 475 return -ENODEV; 476 477 if (*resp_len < 7) { 478 dev_dbg(dev, "Bad resplen %zd\n", *resp_len); 479 return -EINVAL; 480 } 481 482 mutex_lock(&occ->occ_lock); 483 484 /* Extract the seq_no from the command (first byte) */ 485 seq_no = *(const u8 *)request; 486 rc = occ_putsram(occ, request, req_len); 487 if (rc) 488 goto done; 489 490 rc = occ_trigger_attn(occ); 491 if (rc) 492 goto done; 493 494 /* Read occ response header */ 495 start = jiffies; 496 do { 497 rc = occ_getsram(occ, 0, resp, 8); 498 if (rc) 499 goto done; 500 501 if (resp->return_status == OCC_RESP_CMD_IN_PRG || 502 resp->return_status == OCC_RESP_CRIT_INIT || 503 resp->seq_no != seq_no) { 504 rc = -ETIMEDOUT; 505 506 if (time_after(jiffies, start + timeout)) { 507 dev_err(occ->dev, "resp timeout status=%02x " 508 "resp seq_no=%d our seq_no=%d\n", 509 resp->return_status, resp->seq_no, 510 seq_no); 511 goto done; 512 } 513 514 set_current_state(TASK_UNINTERRUPTIBLE); 515 schedule_timeout(wait_time); 516 } 517 } while (rc); 518 519 /* Extract size of response data */ 520 resp_data_length = get_unaligned_be16(&resp->data_length); 521 522 /* Message size is data length + 5 bytes header + 2 bytes checksum */ 523 if ((resp_data_length + 7) > *resp_len) { 524 rc = -EMSGSIZE; 525 goto done; 526 } 527 528 dev_dbg(dev, "resp_status=%02x resp_data_len=%d\n", 529 resp->return_status, resp_data_length); 530 531 /* Grab the rest */ 532 if (resp_data_length > 1) { 533 /* already got 3 bytes resp, also need 2 bytes checksum */ 534 rc = occ_getsram(occ, 8, &resp->data[3], resp_data_length - 1); 535 if (rc) 536 goto done; 537 } 538 539 *resp_len = resp_data_length + 7; 540 rc = occ_verify_checksum(occ, resp, resp_data_length); 541 542 done: 543 mutex_unlock(&occ->occ_lock); 544 545 return rc; 546 } 547 EXPORT_SYMBOL_GPL(fsi_occ_submit); 548 549 static int occ_unregister_child(struct device *dev, void *data) 550 { 551 struct platform_device *hwmon_dev = to_platform_device(dev); 552 553 platform_device_unregister(hwmon_dev); 554 555 return 0; 556 } 557 558 static int occ_probe(struct platform_device *pdev) 559 { 560 int rc; 561 u32 reg; 562 struct occ *occ; 563 struct platform_device *hwmon_dev; 564 struct device *dev = &pdev->dev; 565 struct platform_device_info hwmon_dev_info = { 566 .parent = dev, 567 .name = "occ-hwmon", 568 }; 569 570 occ = devm_kzalloc(dev, sizeof(*occ), GFP_KERNEL); 571 if (!occ) 572 return -ENOMEM; 573 574 occ->version = (uintptr_t)of_device_get_match_data(dev); 575 occ->dev = dev; 576 occ->sbefifo = dev->parent; 577 mutex_init(&occ->occ_lock); 578 579 if (dev->of_node) { 580 rc = of_property_read_u32(dev->of_node, "reg", ®); 581 if (!rc) { 582 /* make sure we don't have a duplicate from dts */ 583 occ->idx = ida_simple_get(&occ_ida, reg, reg + 1, 584 GFP_KERNEL); 585 if (occ->idx < 0) 586 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 587 GFP_KERNEL); 588 } else { 589 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 590 GFP_KERNEL); 591 } 592 } else { 593 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, GFP_KERNEL); 594 } 595 596 platform_set_drvdata(pdev, occ); 597 598 snprintf(occ->name, sizeof(occ->name), "occ%d", occ->idx); 599 occ->mdev.fops = &occ_fops; 600 occ->mdev.minor = MISC_DYNAMIC_MINOR; 601 occ->mdev.name = occ->name; 602 occ->mdev.parent = dev; 603 604 rc = misc_register(&occ->mdev); 605 if (rc) { 606 dev_err(dev, "failed to register miscdevice: %d\n", rc); 607 ida_simple_remove(&occ_ida, occ->idx); 608 return rc; 609 } 610 611 hwmon_dev_info.id = occ->idx; 612 hwmon_dev = platform_device_register_full(&hwmon_dev_info); 613 if (IS_ERR(hwmon_dev)) 614 dev_warn(dev, "failed to create hwmon device\n"); 615 616 return 0; 617 } 618 619 static int occ_remove(struct platform_device *pdev) 620 { 621 struct occ *occ = platform_get_drvdata(pdev); 622 623 misc_deregister(&occ->mdev); 624 625 device_for_each_child(&pdev->dev, NULL, occ_unregister_child); 626 627 ida_simple_remove(&occ_ida, occ->idx); 628 629 return 0; 630 } 631 632 static const struct of_device_id occ_match[] = { 633 { 634 .compatible = "ibm,p9-occ", 635 .data = (void *)occ_p9 636 }, 637 { 638 .compatible = "ibm,p10-occ", 639 .data = (void *)occ_p10 640 }, 641 { }, 642 }; 643 MODULE_DEVICE_TABLE(of, occ_match); 644 645 static struct platform_driver occ_driver = { 646 .driver = { 647 .name = "occ", 648 .of_match_table = occ_match, 649 }, 650 .probe = occ_probe, 651 .remove = occ_remove, 652 }; 653 654 static int occ_init(void) 655 { 656 return platform_driver_register(&occ_driver); 657 } 658 659 static void occ_exit(void) 660 { 661 platform_driver_unregister(&occ_driver); 662 663 ida_destroy(&occ_ida); 664 } 665 666 module_init(occ_init); 667 module_exit(occ_exit); 668 669 MODULE_AUTHOR("Eddie James <eajames@linux.ibm.com>"); 670 MODULE_DESCRIPTION("BMC P9 OCC driver"); 671 MODULE_LICENSE("GPL"); 672