1 /* 2 * Thunderbolt Cactus Ridge driver - eeprom access 3 * 4 * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com> 5 */ 6 7 #include <linux/crc32.h> 8 #include <linux/property.h> 9 #include <linux/slab.h> 10 #include "tb.h" 11 12 /** 13 * tb_eeprom_ctl_write() - write control word 14 */ 15 static int tb_eeprom_ctl_write(struct tb_switch *sw, struct tb_eeprom_ctl *ctl) 16 { 17 return tb_sw_write(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + 4, 1); 18 } 19 20 /** 21 * tb_eeprom_ctl_write() - read control word 22 */ 23 static int tb_eeprom_ctl_read(struct tb_switch *sw, struct tb_eeprom_ctl *ctl) 24 { 25 return tb_sw_read(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + 4, 1); 26 } 27 28 enum tb_eeprom_transfer { 29 TB_EEPROM_IN, 30 TB_EEPROM_OUT, 31 }; 32 33 /** 34 * tb_eeprom_active - enable rom access 35 * 36 * WARNING: Always disable access after usage. Otherwise the controller will 37 * fail to reprobe. 38 */ 39 static int tb_eeprom_active(struct tb_switch *sw, bool enable) 40 { 41 struct tb_eeprom_ctl ctl; 42 int res = tb_eeprom_ctl_read(sw, &ctl); 43 if (res) 44 return res; 45 if (enable) { 46 ctl.access_high = 1; 47 res = tb_eeprom_ctl_write(sw, &ctl); 48 if (res) 49 return res; 50 ctl.access_low = 0; 51 return tb_eeprom_ctl_write(sw, &ctl); 52 } else { 53 ctl.access_low = 1; 54 res = tb_eeprom_ctl_write(sw, &ctl); 55 if (res) 56 return res; 57 ctl.access_high = 0; 58 return tb_eeprom_ctl_write(sw, &ctl); 59 } 60 } 61 62 /** 63 * tb_eeprom_transfer - transfer one bit 64 * 65 * If TB_EEPROM_IN is passed, then the bit can be retrieved from ctl->data_in. 66 * If TB_EEPROM_OUT is passed, then ctl->data_out will be written. 67 */ 68 static int tb_eeprom_transfer(struct tb_switch *sw, struct tb_eeprom_ctl *ctl, 69 enum tb_eeprom_transfer direction) 70 { 71 int res; 72 if (direction == TB_EEPROM_OUT) { 73 res = tb_eeprom_ctl_write(sw, ctl); 74 if (res) 75 return res; 76 } 77 ctl->clock = 1; 78 res = tb_eeprom_ctl_write(sw, ctl); 79 if (res) 80 return res; 81 if (direction == TB_EEPROM_IN) { 82 res = tb_eeprom_ctl_read(sw, ctl); 83 if (res) 84 return res; 85 } 86 ctl->clock = 0; 87 return tb_eeprom_ctl_write(sw, ctl); 88 } 89 90 /** 91 * tb_eeprom_out - write one byte to the bus 92 */ 93 static int tb_eeprom_out(struct tb_switch *sw, u8 val) 94 { 95 struct tb_eeprom_ctl ctl; 96 int i; 97 int res = tb_eeprom_ctl_read(sw, &ctl); 98 if (res) 99 return res; 100 for (i = 0; i < 8; i++) { 101 ctl.data_out = val & 0x80; 102 res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_OUT); 103 if (res) 104 return res; 105 val <<= 1; 106 } 107 return 0; 108 } 109 110 /** 111 * tb_eeprom_in - read one byte from the bus 112 */ 113 static int tb_eeprom_in(struct tb_switch *sw, u8 *val) 114 { 115 struct tb_eeprom_ctl ctl; 116 int i; 117 int res = tb_eeprom_ctl_read(sw, &ctl); 118 if (res) 119 return res; 120 *val = 0; 121 for (i = 0; i < 8; i++) { 122 *val <<= 1; 123 res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_IN); 124 if (res) 125 return res; 126 *val |= ctl.data_in; 127 } 128 return 0; 129 } 130 131 /** 132 * tb_eeprom_read_n - read count bytes from offset into val 133 */ 134 static int tb_eeprom_read_n(struct tb_switch *sw, u16 offset, u8 *val, 135 size_t count) 136 { 137 int i, res; 138 res = tb_eeprom_active(sw, true); 139 if (res) 140 return res; 141 res = tb_eeprom_out(sw, 3); 142 if (res) 143 return res; 144 res = tb_eeprom_out(sw, offset >> 8); 145 if (res) 146 return res; 147 res = tb_eeprom_out(sw, offset); 148 if (res) 149 return res; 150 for (i = 0; i < count; i++) { 151 res = tb_eeprom_in(sw, val + i); 152 if (res) 153 return res; 154 } 155 return tb_eeprom_active(sw, false); 156 } 157 158 static u8 tb_crc8(u8 *data, int len) 159 { 160 int i, j; 161 u8 val = 0xff; 162 for (i = 0; i < len; i++) { 163 val ^= data[i]; 164 for (j = 0; j < 8; j++) 165 val = (val << 1) ^ ((val & 0x80) ? 7 : 0); 166 } 167 return val; 168 } 169 170 static u32 tb_crc32(void *data, size_t len) 171 { 172 return ~__crc32c_le(~0, data, len); 173 } 174 175 #define TB_DROM_DATA_START 13 176 struct tb_drom_header { 177 /* BYTE 0 */ 178 u8 uid_crc8; /* checksum for uid */ 179 /* BYTES 1-8 */ 180 u64 uid; 181 /* BYTES 9-12 */ 182 u32 data_crc32; /* checksum for data_len bytes starting at byte 13 */ 183 /* BYTE 13 */ 184 u8 device_rom_revision; /* should be <= 1 */ 185 u16 data_len:10; 186 u8 __unknown1:6; 187 /* BYTES 16-21 */ 188 u16 vendor_id; 189 u16 model_id; 190 u8 model_rev; 191 u8 eeprom_rev; 192 } __packed; 193 194 enum tb_drom_entry_type { 195 /* force unsigned to prevent "one-bit signed bitfield" warning */ 196 TB_DROM_ENTRY_GENERIC = 0U, 197 TB_DROM_ENTRY_PORT, 198 }; 199 200 struct tb_drom_entry_header { 201 u8 len; 202 u8 index:6; 203 bool port_disabled:1; /* only valid if type is TB_DROM_ENTRY_PORT */ 204 enum tb_drom_entry_type type:1; 205 } __packed; 206 207 struct tb_drom_entry_generic { 208 struct tb_drom_entry_header header; 209 u8 data[0]; 210 } __packed; 211 212 struct tb_drom_entry_port { 213 /* BYTES 0-1 */ 214 struct tb_drom_entry_header header; 215 /* BYTE 2 */ 216 u8 dual_link_port_rid:4; 217 u8 link_nr:1; 218 u8 unknown1:2; 219 bool has_dual_link_port:1; 220 221 /* BYTE 3 */ 222 u8 dual_link_port_nr:6; 223 u8 unknown2:2; 224 225 /* BYTES 4 - 5 TODO decode */ 226 u8 micro2:4; 227 u8 micro1:4; 228 u8 micro3; 229 230 /* BYTES 6-7, TODO: verify (find hardware that has these set) */ 231 u8 peer_port_rid:4; 232 u8 unknown3:3; 233 bool has_peer_port:1; 234 u8 peer_port_nr:6; 235 u8 unknown4:2; 236 } __packed; 237 238 239 /** 240 * tb_eeprom_get_drom_offset - get drom offset within eeprom 241 */ 242 static int tb_eeprom_get_drom_offset(struct tb_switch *sw, u16 *offset) 243 { 244 struct tb_cap_plug_events cap; 245 int res; 246 if (!sw->cap_plug_events) { 247 tb_sw_warn(sw, "no TB_CAP_PLUG_EVENTS, cannot read eeprom\n"); 248 return -ENOSYS; 249 } 250 res = tb_sw_read(sw, &cap, TB_CFG_SWITCH, sw->cap_plug_events, 251 sizeof(cap) / 4); 252 if (res) 253 return res; 254 255 if (!cap.eeprom_ctl.present || cap.eeprom_ctl.not_present) { 256 tb_sw_warn(sw, "no NVM\n"); 257 return -ENOSYS; 258 } 259 260 if (cap.drom_offset > 0xffff) { 261 tb_sw_warn(sw, "drom offset is larger than 0xffff: %#x\n", 262 cap.drom_offset); 263 return -ENXIO; 264 } 265 *offset = cap.drom_offset; 266 return 0; 267 } 268 269 /** 270 * tb_drom_read_uid_only - read uid directly from drom 271 * 272 * Does not use the cached copy in sw->drom. Used during resume to check switch 273 * identity. 274 */ 275 int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid) 276 { 277 u8 data[9]; 278 u16 drom_offset; 279 u8 crc; 280 int res = tb_eeprom_get_drom_offset(sw, &drom_offset); 281 if (res) 282 return res; 283 284 if (drom_offset == 0) 285 return -ENODEV; 286 287 /* read uid */ 288 res = tb_eeprom_read_n(sw, drom_offset, data, 9); 289 if (res) 290 return res; 291 292 crc = tb_crc8(data + 1, 8); 293 if (crc != data[0]) { 294 tb_sw_warn(sw, "uid crc8 mismatch (expected: %#x, got: %#x)\n", 295 data[0], crc); 296 return -EIO; 297 } 298 299 *uid = *(u64 *)(data+1); 300 return 0; 301 } 302 303 static int tb_drom_parse_entry_generic(struct tb_switch *sw, 304 struct tb_drom_entry_header *header) 305 { 306 const struct tb_drom_entry_generic *entry = 307 (const struct tb_drom_entry_generic *)header; 308 309 switch (header->index) { 310 case 1: 311 /* Length includes 2 bytes header so remove it before copy */ 312 sw->vendor_name = kstrndup(entry->data, 313 header->len - sizeof(*header), GFP_KERNEL); 314 if (!sw->vendor_name) 315 return -ENOMEM; 316 break; 317 318 case 2: 319 sw->device_name = kstrndup(entry->data, 320 header->len - sizeof(*header), GFP_KERNEL); 321 if (!sw->device_name) 322 return -ENOMEM; 323 break; 324 } 325 326 return 0; 327 } 328 329 static int tb_drom_parse_entry_port(struct tb_switch *sw, 330 struct tb_drom_entry_header *header) 331 { 332 struct tb_port *port; 333 int res; 334 enum tb_port_type type; 335 336 /* 337 * Some DROMs list more ports than the controller actually has 338 * so we skip those but allow the parser to continue. 339 */ 340 if (header->index > sw->config.max_port_number) { 341 dev_info_once(&sw->dev, "ignoring unnecessary extra entries in DROM\n"); 342 return 0; 343 } 344 345 port = &sw->ports[header->index]; 346 port->disabled = header->port_disabled; 347 if (port->disabled) 348 return 0; 349 350 res = tb_port_read(port, &type, TB_CFG_PORT, 2, 1); 351 if (res) 352 return res; 353 type &= 0xffffff; 354 355 if (type == TB_TYPE_PORT) { 356 struct tb_drom_entry_port *entry = (void *) header; 357 if (header->len != sizeof(*entry)) { 358 tb_sw_warn(sw, 359 "port entry has size %#x (expected %#zx)\n", 360 header->len, sizeof(struct tb_drom_entry_port)); 361 return -EIO; 362 } 363 port->link_nr = entry->link_nr; 364 if (entry->has_dual_link_port) 365 port->dual_link_port = 366 &port->sw->ports[entry->dual_link_port_nr]; 367 } 368 return 0; 369 } 370 371 /** 372 * tb_drom_parse_entries - parse the linked list of drom entries 373 * 374 * Drom must have been copied to sw->drom. 375 */ 376 static int tb_drom_parse_entries(struct tb_switch *sw) 377 { 378 struct tb_drom_header *header = (void *) sw->drom; 379 u16 pos = sizeof(*header); 380 u16 drom_size = header->data_len + TB_DROM_DATA_START; 381 int res; 382 383 while (pos < drom_size) { 384 struct tb_drom_entry_header *entry = (void *) (sw->drom + pos); 385 if (pos + 1 == drom_size || pos + entry->len > drom_size 386 || !entry->len) { 387 tb_sw_warn(sw, "drom buffer overrun, aborting\n"); 388 return -EIO; 389 } 390 391 switch (entry->type) { 392 case TB_DROM_ENTRY_GENERIC: 393 res = tb_drom_parse_entry_generic(sw, entry); 394 break; 395 case TB_DROM_ENTRY_PORT: 396 res = tb_drom_parse_entry_port(sw, entry); 397 break; 398 } 399 if (res) 400 return res; 401 402 pos += entry->len; 403 } 404 return 0; 405 } 406 407 /** 408 * tb_drom_copy_efi - copy drom supplied by EFI to sw->drom if present 409 */ 410 static int tb_drom_copy_efi(struct tb_switch *sw, u16 *size) 411 { 412 struct device *dev = &sw->tb->nhi->pdev->dev; 413 int len, res; 414 415 len = device_property_read_u8_array(dev, "ThunderboltDROM", NULL, 0); 416 if (len < 0 || len < sizeof(struct tb_drom_header)) 417 return -EINVAL; 418 419 sw->drom = kmalloc(len, GFP_KERNEL); 420 if (!sw->drom) 421 return -ENOMEM; 422 423 res = device_property_read_u8_array(dev, "ThunderboltDROM", sw->drom, 424 len); 425 if (res) 426 goto err; 427 428 *size = ((struct tb_drom_header *)sw->drom)->data_len + 429 TB_DROM_DATA_START; 430 if (*size > len) 431 goto err; 432 433 return 0; 434 435 err: 436 kfree(sw->drom); 437 sw->drom = NULL; 438 return -EINVAL; 439 } 440 441 static int tb_drom_copy_nvm(struct tb_switch *sw, u16 *size) 442 { 443 u32 drom_offset; 444 int ret; 445 446 if (!sw->dma_port) 447 return -ENODEV; 448 449 ret = tb_sw_read(sw, &drom_offset, TB_CFG_SWITCH, 450 sw->cap_plug_events + 12, 1); 451 if (ret) 452 return ret; 453 454 if (!drom_offset) 455 return -ENODEV; 456 457 ret = dma_port_flash_read(sw->dma_port, drom_offset + 14, size, 458 sizeof(*size)); 459 if (ret) 460 return ret; 461 462 /* Size includes CRC8 + UID + CRC32 */ 463 *size += 1 + 8 + 4; 464 sw->drom = kzalloc(*size, GFP_KERNEL); 465 if (!sw->drom) 466 return -ENOMEM; 467 468 ret = dma_port_flash_read(sw->dma_port, drom_offset, sw->drom, *size); 469 if (ret) 470 goto err_free; 471 472 /* 473 * Read UID from the minimal DROM because the one in NVM is just 474 * a placeholder. 475 */ 476 tb_drom_read_uid_only(sw, &sw->uid); 477 return 0; 478 479 err_free: 480 kfree(sw->drom); 481 sw->drom = NULL; 482 return ret; 483 } 484 485 /** 486 * tb_drom_read - copy drom to sw->drom and parse it 487 */ 488 int tb_drom_read(struct tb_switch *sw) 489 { 490 u16 drom_offset; 491 u16 size; 492 u32 crc; 493 struct tb_drom_header *header; 494 int res; 495 if (sw->drom) 496 return 0; 497 498 if (tb_route(sw) == 0) { 499 /* 500 * Apple's NHI EFI driver supplies a DROM for the root switch 501 * in a device property. Use it if available. 502 */ 503 if (tb_drom_copy_efi(sw, &size) == 0) 504 goto parse; 505 506 /* Non-Apple hardware has the DROM as part of NVM */ 507 if (tb_drom_copy_nvm(sw, &size) == 0) 508 goto parse; 509 510 /* 511 * The root switch contains only a dummy drom (header only, 512 * no entries). Hardcode the configuration here. 513 */ 514 tb_drom_read_uid_only(sw, &sw->uid); 515 516 sw->ports[1].link_nr = 0; 517 sw->ports[2].link_nr = 1; 518 sw->ports[1].dual_link_port = &sw->ports[2]; 519 sw->ports[2].dual_link_port = &sw->ports[1]; 520 521 sw->ports[3].link_nr = 0; 522 sw->ports[4].link_nr = 1; 523 sw->ports[3].dual_link_port = &sw->ports[4]; 524 sw->ports[4].dual_link_port = &sw->ports[3]; 525 526 /* Port 5 is inaccessible on this gen 1 controller */ 527 if (sw->config.device_id == PCI_DEVICE_ID_INTEL_LIGHT_RIDGE) 528 sw->ports[5].disabled = true; 529 530 return 0; 531 } 532 533 res = tb_eeprom_get_drom_offset(sw, &drom_offset); 534 if (res) 535 return res; 536 537 res = tb_eeprom_read_n(sw, drom_offset + 14, (u8 *) &size, 2); 538 if (res) 539 return res; 540 size &= 0x3ff; 541 size += TB_DROM_DATA_START; 542 tb_sw_info(sw, "reading drom (length: %#x)\n", size); 543 if (size < sizeof(*header)) { 544 tb_sw_warn(sw, "drom too small, aborting\n"); 545 return -EIO; 546 } 547 548 sw->drom = kzalloc(size, GFP_KERNEL); 549 if (!sw->drom) 550 return -ENOMEM; 551 res = tb_eeprom_read_n(sw, drom_offset, sw->drom, size); 552 if (res) 553 goto err; 554 555 parse: 556 header = (void *) sw->drom; 557 558 if (header->data_len + TB_DROM_DATA_START != size) { 559 tb_sw_warn(sw, "drom size mismatch, aborting\n"); 560 goto err; 561 } 562 563 crc = tb_crc8((u8 *) &header->uid, 8); 564 if (crc != header->uid_crc8) { 565 tb_sw_warn(sw, 566 "drom uid crc8 mismatch (expected: %#x, got: %#x), aborting\n", 567 header->uid_crc8, crc); 568 goto err; 569 } 570 if (!sw->uid) 571 sw->uid = header->uid; 572 sw->vendor = header->vendor_id; 573 sw->device = header->model_id; 574 575 crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len); 576 if (crc != header->data_crc32) { 577 tb_sw_warn(sw, 578 "drom data crc32 mismatch (expected: %#x, got: %#x), continuing\n", 579 header->data_crc32, crc); 580 } 581 582 if (header->device_rom_revision > 2) 583 tb_sw_warn(sw, "drom device_rom_revision %#x unknown\n", 584 header->device_rom_revision); 585 586 return tb_drom_parse_entries(sw); 587 err: 588 kfree(sw->drom); 589 sw->drom = NULL; 590 return -EIO; 591 592 } 593