1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Thunderbolt DMA configuration based mailbox support 4 * 5 * Copyright (C) 2017, Intel Corporation 6 * Authors: Michael Jamet <michael.jamet@intel.com> 7 * Mika Westerberg <mika.westerberg@linux.intel.com> 8 */ 9 10 #include <linux/delay.h> 11 #include <linux/slab.h> 12 13 #include "dma_port.h" 14 #include "tb_regs.h" 15 16 #define DMA_PORT_CAP 0x3e 17 18 #define MAIL_DATA 1 19 #define MAIL_DATA_DWORDS 16 20 21 #define MAIL_IN 17 22 #define MAIL_IN_CMD_SHIFT 28 23 #define MAIL_IN_CMD_MASK GENMASK(31, 28) 24 #define MAIL_IN_CMD_FLASH_WRITE 0x0 25 #define MAIL_IN_CMD_FLASH_UPDATE_AUTH 0x1 26 #define MAIL_IN_CMD_FLASH_READ 0x2 27 #define MAIL_IN_CMD_POWER_CYCLE 0x4 28 #define MAIL_IN_DWORDS_SHIFT 24 29 #define MAIL_IN_DWORDS_MASK GENMASK(27, 24) 30 #define MAIL_IN_ADDRESS_SHIFT 2 31 #define MAIL_IN_ADDRESS_MASK GENMASK(23, 2) 32 #define MAIL_IN_CSS BIT(1) 33 #define MAIL_IN_OP_REQUEST BIT(0) 34 35 #define MAIL_OUT 18 36 #define MAIL_OUT_STATUS_RESPONSE BIT(29) 37 #define MAIL_OUT_STATUS_CMD_SHIFT 4 38 #define MAIL_OUT_STATUS_CMD_MASK GENMASK(7, 4) 39 #define MAIL_OUT_STATUS_MASK GENMASK(3, 0) 40 #define MAIL_OUT_STATUS_COMPLETED 0 41 #define MAIL_OUT_STATUS_ERR_AUTH 1 42 #define MAIL_OUT_STATUS_ERR_ACCESS 2 43 44 #define DMA_PORT_TIMEOUT 5000 /* ms */ 45 #define DMA_PORT_RETRIES 3 46 47 /** 48 * struct tb_dma_port - DMA control port 49 * @sw: Switch the DMA port belongs to 50 * @port: Switch port number where DMA capability is found 51 * @base: Start offset of the mailbox registers 52 * @buf: Temporary buffer to store a single block 53 */ 54 struct tb_dma_port { 55 struct tb_switch *sw; 56 u8 port; 57 u32 base; 58 u8 *buf; 59 }; 60 61 /* 62 * When the switch is in safe mode it supports very little functionality 63 * so we don't validate that much here. 64 */ 65 static bool dma_port_match(const struct tb_cfg_request *req, 66 const struct ctl_pkg *pkg) 67 { 68 u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63); 69 70 if (pkg->frame.eof == TB_CFG_PKG_ERROR) 71 return true; 72 if (pkg->frame.eof != req->response_type) 73 return false; 74 if (route != tb_cfg_get_route(req->request)) 75 return false; 76 if (pkg->frame.size != req->response_size) 77 return false; 78 79 return true; 80 } 81 82 static bool dma_port_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg) 83 { 84 memcpy(req->response, pkg->buffer, req->response_size); 85 return true; 86 } 87 88 static int dma_port_read(struct tb_ctl *ctl, void *buffer, u64 route, 89 u32 port, u32 offset, u32 length, int timeout_msec) 90 { 91 struct cfg_read_pkg request = { 92 .header = tb_cfg_make_header(route), 93 .addr = { 94 .seq = 1, 95 .port = port, 96 .space = TB_CFG_PORT, 97 .offset = offset, 98 .length = length, 99 }, 100 }; 101 struct tb_cfg_request *req; 102 struct cfg_write_pkg reply; 103 struct tb_cfg_result res; 104 105 req = tb_cfg_request_alloc(); 106 if (!req) 107 return -ENOMEM; 108 109 req->match = dma_port_match; 110 req->copy = dma_port_copy; 111 req->request = &request; 112 req->request_size = sizeof(request); 113 req->request_type = TB_CFG_PKG_READ; 114 req->response = &reply; 115 req->response_size = 12 + 4 * length; 116 req->response_type = TB_CFG_PKG_READ; 117 118 res = tb_cfg_request_sync(ctl, req, timeout_msec); 119 120 tb_cfg_request_put(req); 121 122 if (res.err) 123 return res.err; 124 125 memcpy(buffer, &reply.data, 4 * length); 126 return 0; 127 } 128 129 static int dma_port_write(struct tb_ctl *ctl, const void *buffer, u64 route, 130 u32 port, u32 offset, u32 length, int timeout_msec) 131 { 132 struct cfg_write_pkg request = { 133 .header = tb_cfg_make_header(route), 134 .addr = { 135 .seq = 1, 136 .port = port, 137 .space = TB_CFG_PORT, 138 .offset = offset, 139 .length = length, 140 }, 141 }; 142 struct tb_cfg_request *req; 143 struct cfg_read_pkg reply; 144 struct tb_cfg_result res; 145 146 memcpy(&request.data, buffer, length * 4); 147 148 req = tb_cfg_request_alloc(); 149 if (!req) 150 return -ENOMEM; 151 152 req->match = dma_port_match; 153 req->copy = dma_port_copy; 154 req->request = &request; 155 req->request_size = 12 + 4 * length; 156 req->request_type = TB_CFG_PKG_WRITE; 157 req->response = &reply; 158 req->response_size = sizeof(reply); 159 req->response_type = TB_CFG_PKG_WRITE; 160 161 res = tb_cfg_request_sync(ctl, req, timeout_msec); 162 163 tb_cfg_request_put(req); 164 165 return res.err; 166 } 167 168 static int dma_find_port(struct tb_switch *sw) 169 { 170 static const int ports[] = { 3, 5, 7 }; 171 int i; 172 173 /* 174 * The DMA (NHI) port is either 3, 5 or 7 depending on the 175 * controller. Try all of them. 176 */ 177 for (i = 0; i < ARRAY_SIZE(ports); i++) { 178 u32 type; 179 int ret; 180 181 ret = dma_port_read(sw->tb->ctl, &type, tb_route(sw), ports[i], 182 2, 1, DMA_PORT_TIMEOUT); 183 if (!ret && (type & 0xffffff) == TB_TYPE_NHI) 184 return ports[i]; 185 } 186 187 return -ENODEV; 188 } 189 190 /** 191 * dma_port_alloc() - Finds DMA control port from a switch pointed by route 192 * @sw: Switch from where find the DMA port 193 * 194 * Function checks if the switch NHI port supports DMA configuration 195 * based mailbox capability and if it does, allocates and initializes 196 * DMA port structure. Returns %NULL if the capabity was not found. 197 * 198 * The DMA control port is functional also when the switch is in safe 199 * mode. 200 */ 201 struct tb_dma_port *dma_port_alloc(struct tb_switch *sw) 202 { 203 struct tb_dma_port *dma; 204 int port; 205 206 port = dma_find_port(sw); 207 if (port < 0) 208 return NULL; 209 210 dma = kzalloc(sizeof(*dma), GFP_KERNEL); 211 if (!dma) 212 return NULL; 213 214 dma->buf = kmalloc_array(MAIL_DATA_DWORDS, sizeof(u32), GFP_KERNEL); 215 if (!dma->buf) { 216 kfree(dma); 217 return NULL; 218 } 219 220 dma->sw = sw; 221 dma->port = port; 222 dma->base = DMA_PORT_CAP; 223 224 return dma; 225 } 226 227 /** 228 * dma_port_free() - Release DMA control port structure 229 * @dma: DMA control port 230 */ 231 void dma_port_free(struct tb_dma_port *dma) 232 { 233 if (dma) { 234 kfree(dma->buf); 235 kfree(dma); 236 } 237 } 238 239 static int dma_port_wait_for_completion(struct tb_dma_port *dma, 240 unsigned int timeout) 241 { 242 unsigned long end = jiffies + msecs_to_jiffies(timeout); 243 struct tb_switch *sw = dma->sw; 244 245 do { 246 int ret; 247 u32 in; 248 249 ret = dma_port_read(sw->tb->ctl, &in, tb_route(sw), dma->port, 250 dma->base + MAIL_IN, 1, 50); 251 if (ret) { 252 if (ret != -ETIMEDOUT) 253 return ret; 254 } else if (!(in & MAIL_IN_OP_REQUEST)) { 255 return 0; 256 } 257 258 usleep_range(50, 100); 259 } while (time_before(jiffies, end)); 260 261 return -ETIMEDOUT; 262 } 263 264 static int status_to_errno(u32 status) 265 { 266 switch (status & MAIL_OUT_STATUS_MASK) { 267 case MAIL_OUT_STATUS_COMPLETED: 268 return 0; 269 case MAIL_OUT_STATUS_ERR_AUTH: 270 return -EINVAL; 271 case MAIL_OUT_STATUS_ERR_ACCESS: 272 return -EACCES; 273 } 274 275 return -EIO; 276 } 277 278 static int dma_port_request(struct tb_dma_port *dma, u32 in, 279 unsigned int timeout) 280 { 281 struct tb_switch *sw = dma->sw; 282 u32 out; 283 int ret; 284 285 ret = dma_port_write(sw->tb->ctl, &in, tb_route(sw), dma->port, 286 dma->base + MAIL_IN, 1, DMA_PORT_TIMEOUT); 287 if (ret) 288 return ret; 289 290 ret = dma_port_wait_for_completion(dma, timeout); 291 if (ret) 292 return ret; 293 294 ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port, 295 dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT); 296 if (ret) 297 return ret; 298 299 return status_to_errno(out); 300 } 301 302 static int dma_port_flash_read_block(struct tb_dma_port *dma, u32 address, 303 void *buf, u32 size) 304 { 305 struct tb_switch *sw = dma->sw; 306 u32 in, dwaddress, dwords; 307 int ret; 308 309 dwaddress = address / 4; 310 dwords = size / 4; 311 312 in = MAIL_IN_CMD_FLASH_READ << MAIL_IN_CMD_SHIFT; 313 if (dwords < MAIL_DATA_DWORDS) 314 in |= (dwords << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK; 315 in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK; 316 in |= MAIL_IN_OP_REQUEST; 317 318 ret = dma_port_request(dma, in, DMA_PORT_TIMEOUT); 319 if (ret) 320 return ret; 321 322 return dma_port_read(sw->tb->ctl, buf, tb_route(sw), dma->port, 323 dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT); 324 } 325 326 static int dma_port_flash_write_block(struct tb_dma_port *dma, u32 address, 327 const void *buf, u32 size) 328 { 329 struct tb_switch *sw = dma->sw; 330 u32 in, dwaddress, dwords; 331 int ret; 332 333 dwords = size / 4; 334 335 /* Write the block to MAIL_DATA registers */ 336 ret = dma_port_write(sw->tb->ctl, buf, tb_route(sw), dma->port, 337 dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT); 338 if (ret) 339 return ret; 340 341 in = MAIL_IN_CMD_FLASH_WRITE << MAIL_IN_CMD_SHIFT; 342 343 /* CSS header write is always done to the same magic address */ 344 if (address >= DMA_PORT_CSS_ADDRESS) { 345 dwaddress = DMA_PORT_CSS_ADDRESS; 346 in |= MAIL_IN_CSS; 347 } else { 348 dwaddress = address / 4; 349 } 350 351 in |= ((dwords - 1) << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK; 352 in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK; 353 in |= MAIL_IN_OP_REQUEST; 354 355 return dma_port_request(dma, in, DMA_PORT_TIMEOUT); 356 } 357 358 /** 359 * dma_port_flash_read() - Read from active flash region 360 * @dma: DMA control port 361 * @address: Address relative to the start of active region 362 * @buf: Buffer where the data is read 363 * @size: Size of the buffer 364 */ 365 int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address, 366 void *buf, size_t size) 367 { 368 unsigned int retries = DMA_PORT_RETRIES; 369 unsigned int offset; 370 371 offset = address & 3; 372 address = address & ~3; 373 374 do { 375 u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); 376 int ret; 377 378 ret = dma_port_flash_read_block(dma, address, dma->buf, 379 ALIGN(nbytes, 4)); 380 if (ret) { 381 if (ret == -ETIMEDOUT) { 382 if (retries--) 383 continue; 384 ret = -EIO; 385 } 386 return ret; 387 } 388 389 memcpy(buf, dma->buf + offset, nbytes); 390 391 size -= nbytes; 392 address += nbytes; 393 buf += nbytes; 394 } while (size > 0); 395 396 return 0; 397 } 398 399 /** 400 * dma_port_flash_write() - Write to non-active flash region 401 * @dma: DMA control port 402 * @address: Address relative to the start of non-active region 403 * @buf: Data to write 404 * @size: Size of the buffer 405 * 406 * Writes block of data to the non-active flash region of the switch. If 407 * the address is given as %DMA_PORT_CSS_ADDRESS the block is written 408 * using CSS command. 409 */ 410 int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address, 411 const void *buf, size_t size) 412 { 413 unsigned int retries = DMA_PORT_RETRIES; 414 unsigned int offset; 415 416 if (address >= DMA_PORT_CSS_ADDRESS) { 417 offset = 0; 418 if (size > DMA_PORT_CSS_MAX_SIZE) 419 return -E2BIG; 420 } else { 421 offset = address & 3; 422 address = address & ~3; 423 } 424 425 do { 426 u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); 427 int ret; 428 429 memcpy(dma->buf + offset, buf, nbytes); 430 431 ret = dma_port_flash_write_block(dma, address, buf, nbytes); 432 if (ret) { 433 if (ret == -ETIMEDOUT) { 434 if (retries--) 435 continue; 436 ret = -EIO; 437 } 438 return ret; 439 } 440 441 size -= nbytes; 442 address += nbytes; 443 buf += nbytes; 444 } while (size > 0); 445 446 return 0; 447 } 448 449 /** 450 * dma_port_flash_update_auth() - Starts flash authenticate cycle 451 * @dma: DMA control port 452 * 453 * Starts the flash update authentication cycle. If the image in the 454 * non-active area was valid, the switch starts upgrade process where 455 * active and non-active area get swapped in the end. Caller should call 456 * dma_port_flash_update_auth_status() to get status of this command. 457 * This is because if the switch in question is root switch the 458 * thunderbolt host controller gets reset as well. 459 */ 460 int dma_port_flash_update_auth(struct tb_dma_port *dma) 461 { 462 u32 in; 463 464 in = MAIL_IN_CMD_FLASH_UPDATE_AUTH << MAIL_IN_CMD_SHIFT; 465 in |= MAIL_IN_OP_REQUEST; 466 467 return dma_port_request(dma, in, 150); 468 } 469 470 /** 471 * dma_port_flash_update_auth_status() - Reads status of update auth command 472 * @dma: DMA control port 473 * @status: Status code of the operation 474 * 475 * The function checks if there is status available from the last update 476 * auth command. Returns %0 if there is no status and no further 477 * action is required. If there is status, %1 is returned instead and 478 * @status holds the failure code. 479 * 480 * Negative return means there was an error reading status from the 481 * switch. 482 */ 483 int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status) 484 { 485 struct tb_switch *sw = dma->sw; 486 u32 out, cmd; 487 int ret; 488 489 ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port, 490 dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT); 491 if (ret) 492 return ret; 493 494 /* Check if the status relates to flash update auth */ 495 cmd = (out & MAIL_OUT_STATUS_CMD_MASK) >> MAIL_OUT_STATUS_CMD_SHIFT; 496 if (cmd == MAIL_IN_CMD_FLASH_UPDATE_AUTH) { 497 if (status) 498 *status = out & MAIL_OUT_STATUS_MASK; 499 500 /* Reset is needed in any case */ 501 return 1; 502 } 503 504 return 0; 505 } 506 507 /** 508 * dma_port_power_cycle() - Power cycles the switch 509 * @dma: DMA control port 510 * 511 * Triggers power cycle to the switch. 512 */ 513 int dma_port_power_cycle(struct tb_dma_port *dma) 514 { 515 u32 in; 516 517 in = MAIL_IN_CMD_POWER_CYCLE << MAIL_IN_CMD_SHIFT; 518 in |= MAIL_IN_OP_REQUEST; 519 520 return dma_port_request(dma, in, 150); 521 } 522