1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Thunderbolt DMA configuration based mailbox support
4 *
5 * Copyright (C) 2017, Intel Corporation
6 * Authors: Michael Jamet <michael.jamet@intel.com>
7 * Mika Westerberg <mika.westerberg@linux.intel.com>
8 */
9
10 #include <linux/delay.h>
11 #include <linux/slab.h>
12
13 #include "dma_port.h"
14 #include "tb_regs.h"
15
16 #define DMA_PORT_CAP 0x3e
17
18 #define MAIL_DATA 1
19 #define MAIL_DATA_DWORDS 16
20
21 #define MAIL_IN 17
22 #define MAIL_IN_CMD_SHIFT 28
23 #define MAIL_IN_CMD_MASK GENMASK(31, 28)
24 #define MAIL_IN_CMD_FLASH_WRITE 0x0
25 #define MAIL_IN_CMD_FLASH_UPDATE_AUTH 0x1
26 #define MAIL_IN_CMD_FLASH_READ 0x2
27 #define MAIL_IN_CMD_POWER_CYCLE 0x4
28 #define MAIL_IN_DWORDS_SHIFT 24
29 #define MAIL_IN_DWORDS_MASK GENMASK(27, 24)
30 #define MAIL_IN_ADDRESS_SHIFT 2
31 #define MAIL_IN_ADDRESS_MASK GENMASK(23, 2)
32 #define MAIL_IN_CSS BIT(1)
33 #define MAIL_IN_OP_REQUEST BIT(0)
34
35 #define MAIL_OUT 18
36 #define MAIL_OUT_STATUS_RESPONSE BIT(29)
37 #define MAIL_OUT_STATUS_CMD_SHIFT 4
38 #define MAIL_OUT_STATUS_CMD_MASK GENMASK(7, 4)
39 #define MAIL_OUT_STATUS_MASK GENMASK(3, 0)
40 #define MAIL_OUT_STATUS_COMPLETED 0
41 #define MAIL_OUT_STATUS_ERR_AUTH 1
42 #define MAIL_OUT_STATUS_ERR_ACCESS 2
43
44 #define DMA_PORT_TIMEOUT 5000 /* ms */
45 #define DMA_PORT_RETRIES 3
46
47 /**
48 * struct tb_dma_port - DMA control port
49 * @sw: Switch the DMA port belongs to
50 * @port: Switch port number where DMA capability is found
51 * @base: Start offset of the mailbox registers
52 * @buf: Temporary buffer to store a single block
53 */
54 struct tb_dma_port {
55 struct tb_switch *sw;
56 u8 port;
57 u32 base;
58 u8 *buf;
59 };
60
61 /*
62 * When the switch is in safe mode it supports very little functionality
63 * so we don't validate that much here.
64 */
dma_port_match(const struct tb_cfg_request * req,const struct ctl_pkg * pkg)65 static bool dma_port_match(const struct tb_cfg_request *req,
66 const struct ctl_pkg *pkg)
67 {
68 u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63);
69
70 if (pkg->frame.eof == TB_CFG_PKG_ERROR)
71 return true;
72 if (pkg->frame.eof != req->response_type)
73 return false;
74 if (route != tb_cfg_get_route(req->request))
75 return false;
76 if (pkg->frame.size != req->response_size)
77 return false;
78
79 return true;
80 }
81
dma_port_copy(struct tb_cfg_request * req,const struct ctl_pkg * pkg)82 static bool dma_port_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
83 {
84 memcpy(req->response, pkg->buffer, req->response_size);
85 return true;
86 }
87
dma_port_read(struct tb_ctl * ctl,void * buffer,u64 route,u32 port,u32 offset,u32 length,int timeout_msec)88 static int dma_port_read(struct tb_ctl *ctl, void *buffer, u64 route,
89 u32 port, u32 offset, u32 length, int timeout_msec)
90 {
91 struct cfg_read_pkg request = {
92 .header = tb_cfg_make_header(route),
93 .addr = {
94 .seq = 1,
95 .port = port,
96 .space = TB_CFG_PORT,
97 .offset = offset,
98 .length = length,
99 },
100 };
101 struct tb_cfg_request *req;
102 struct cfg_write_pkg reply;
103 struct tb_cfg_result res;
104
105 req = tb_cfg_request_alloc();
106 if (!req)
107 return -ENOMEM;
108
109 req->match = dma_port_match;
110 req->copy = dma_port_copy;
111 req->request = &request;
112 req->request_size = sizeof(request);
113 req->request_type = TB_CFG_PKG_READ;
114 req->response = &reply;
115 req->response_size = 12 + 4 * length;
116 req->response_type = TB_CFG_PKG_READ;
117
118 res = tb_cfg_request_sync(ctl, req, timeout_msec);
119
120 tb_cfg_request_put(req);
121
122 if (res.err)
123 return res.err;
124
125 memcpy(buffer, &reply.data, 4 * length);
126 return 0;
127 }
128
dma_port_write(struct tb_ctl * ctl,const void * buffer,u64 route,u32 port,u32 offset,u32 length,int timeout_msec)129 static int dma_port_write(struct tb_ctl *ctl, const void *buffer, u64 route,
130 u32 port, u32 offset, u32 length, int timeout_msec)
131 {
132 struct cfg_write_pkg request = {
133 .header = tb_cfg_make_header(route),
134 .addr = {
135 .seq = 1,
136 .port = port,
137 .space = TB_CFG_PORT,
138 .offset = offset,
139 .length = length,
140 },
141 };
142 struct tb_cfg_request *req;
143 struct cfg_read_pkg reply;
144 struct tb_cfg_result res;
145
146 memcpy(&request.data, buffer, length * 4);
147
148 req = tb_cfg_request_alloc();
149 if (!req)
150 return -ENOMEM;
151
152 req->match = dma_port_match;
153 req->copy = dma_port_copy;
154 req->request = &request;
155 req->request_size = 12 + 4 * length;
156 req->request_type = TB_CFG_PKG_WRITE;
157 req->response = &reply;
158 req->response_size = sizeof(reply);
159 req->response_type = TB_CFG_PKG_WRITE;
160
161 res = tb_cfg_request_sync(ctl, req, timeout_msec);
162
163 tb_cfg_request_put(req);
164
165 return res.err;
166 }
167
dma_find_port(struct tb_switch * sw)168 static int dma_find_port(struct tb_switch *sw)
169 {
170 static const int ports[] = { 3, 5, 7 };
171 int i;
172
173 /*
174 * The DMA (NHI) port is either 3, 5 or 7 depending on the
175 * controller. Try all of them.
176 */
177 for (i = 0; i < ARRAY_SIZE(ports); i++) {
178 u32 type;
179 int ret;
180
181 ret = dma_port_read(sw->tb->ctl, &type, tb_route(sw), ports[i],
182 2, 1, DMA_PORT_TIMEOUT);
183 if (!ret && (type & 0xffffff) == TB_TYPE_NHI)
184 return ports[i];
185 }
186
187 return -ENODEV;
188 }
189
190 /**
191 * dma_port_alloc() - Finds DMA control port from a switch pointed by route
192 * @sw: Switch from where find the DMA port
193 *
194 * Function checks if the switch NHI port supports DMA configuration
195 * based mailbox capability and if it does, allocates and initializes
196 * DMA port structure. Returns %NULL if the capabity was not found.
197 *
198 * The DMA control port is functional also when the switch is in safe
199 * mode.
200 */
dma_port_alloc(struct tb_switch * sw)201 struct tb_dma_port *dma_port_alloc(struct tb_switch *sw)
202 {
203 struct tb_dma_port *dma;
204 int port;
205
206 port = dma_find_port(sw);
207 if (port < 0)
208 return NULL;
209
210 dma = kzalloc(sizeof(*dma), GFP_KERNEL);
211 if (!dma)
212 return NULL;
213
214 dma->buf = kmalloc_array(MAIL_DATA_DWORDS, sizeof(u32), GFP_KERNEL);
215 if (!dma->buf) {
216 kfree(dma);
217 return NULL;
218 }
219
220 dma->sw = sw;
221 dma->port = port;
222 dma->base = DMA_PORT_CAP;
223
224 return dma;
225 }
226
227 /**
228 * dma_port_free() - Release DMA control port structure
229 * @dma: DMA control port
230 */
dma_port_free(struct tb_dma_port * dma)231 void dma_port_free(struct tb_dma_port *dma)
232 {
233 if (dma) {
234 kfree(dma->buf);
235 kfree(dma);
236 }
237 }
238
dma_port_wait_for_completion(struct tb_dma_port * dma,unsigned int timeout)239 static int dma_port_wait_for_completion(struct tb_dma_port *dma,
240 unsigned int timeout)
241 {
242 unsigned long end = jiffies + msecs_to_jiffies(timeout);
243 struct tb_switch *sw = dma->sw;
244
245 do {
246 int ret;
247 u32 in;
248
249 ret = dma_port_read(sw->tb->ctl, &in, tb_route(sw), dma->port,
250 dma->base + MAIL_IN, 1, 50);
251 if (ret) {
252 if (ret != -ETIMEDOUT)
253 return ret;
254 } else if (!(in & MAIL_IN_OP_REQUEST)) {
255 return 0;
256 }
257
258 usleep_range(50, 100);
259 } while (time_before(jiffies, end));
260
261 return -ETIMEDOUT;
262 }
263
status_to_errno(u32 status)264 static int status_to_errno(u32 status)
265 {
266 switch (status & MAIL_OUT_STATUS_MASK) {
267 case MAIL_OUT_STATUS_COMPLETED:
268 return 0;
269 case MAIL_OUT_STATUS_ERR_AUTH:
270 return -EINVAL;
271 case MAIL_OUT_STATUS_ERR_ACCESS:
272 return -EACCES;
273 }
274
275 return -EIO;
276 }
277
dma_port_request(struct tb_dma_port * dma,u32 in,unsigned int timeout)278 static int dma_port_request(struct tb_dma_port *dma, u32 in,
279 unsigned int timeout)
280 {
281 struct tb_switch *sw = dma->sw;
282 u32 out;
283 int ret;
284
285 ret = dma_port_write(sw->tb->ctl, &in, tb_route(sw), dma->port,
286 dma->base + MAIL_IN, 1, DMA_PORT_TIMEOUT);
287 if (ret)
288 return ret;
289
290 ret = dma_port_wait_for_completion(dma, timeout);
291 if (ret)
292 return ret;
293
294 ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
295 dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
296 if (ret)
297 return ret;
298
299 return status_to_errno(out);
300 }
301
dma_port_flash_read_block(struct tb_dma_port * dma,u32 address,void * buf,u32 size)302 static int dma_port_flash_read_block(struct tb_dma_port *dma, u32 address,
303 void *buf, u32 size)
304 {
305 struct tb_switch *sw = dma->sw;
306 u32 in, dwaddress, dwords;
307 int ret;
308
309 dwaddress = address / 4;
310 dwords = size / 4;
311
312 in = MAIL_IN_CMD_FLASH_READ << MAIL_IN_CMD_SHIFT;
313 if (dwords < MAIL_DATA_DWORDS)
314 in |= (dwords << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
315 in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
316 in |= MAIL_IN_OP_REQUEST;
317
318 ret = dma_port_request(dma, in, DMA_PORT_TIMEOUT);
319 if (ret)
320 return ret;
321
322 return dma_port_read(sw->tb->ctl, buf, tb_route(sw), dma->port,
323 dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
324 }
325
dma_port_flash_write_block(struct tb_dma_port * dma,u32 address,const void * buf,u32 size)326 static int dma_port_flash_write_block(struct tb_dma_port *dma, u32 address,
327 const void *buf, u32 size)
328 {
329 struct tb_switch *sw = dma->sw;
330 u32 in, dwaddress, dwords;
331 int ret;
332
333 dwords = size / 4;
334
335 /* Write the block to MAIL_DATA registers */
336 ret = dma_port_write(sw->tb->ctl, buf, tb_route(sw), dma->port,
337 dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
338
339 in = MAIL_IN_CMD_FLASH_WRITE << MAIL_IN_CMD_SHIFT;
340
341 /* CSS header write is always done to the same magic address */
342 if (address >= DMA_PORT_CSS_ADDRESS) {
343 dwaddress = DMA_PORT_CSS_ADDRESS;
344 in |= MAIL_IN_CSS;
345 } else {
346 dwaddress = address / 4;
347 }
348
349 in |= ((dwords - 1) << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
350 in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
351 in |= MAIL_IN_OP_REQUEST;
352
353 return dma_port_request(dma, in, DMA_PORT_TIMEOUT);
354 }
355
356 /**
357 * dma_port_flash_read() - Read from active flash region
358 * @dma: DMA control port
359 * @address: Address relative to the start of active region
360 * @buf: Buffer where the data is read
361 * @size: Size of the buffer
362 */
dma_port_flash_read(struct tb_dma_port * dma,unsigned int address,void * buf,size_t size)363 int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
364 void *buf, size_t size)
365 {
366 unsigned int retries = DMA_PORT_RETRIES;
367 unsigned int offset;
368
369 offset = address & 3;
370 address = address & ~3;
371
372 do {
373 u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
374 int ret;
375
376 ret = dma_port_flash_read_block(dma, address, dma->buf,
377 ALIGN(nbytes, 4));
378 if (ret) {
379 if (ret == -ETIMEDOUT) {
380 if (retries--)
381 continue;
382 ret = -EIO;
383 }
384 return ret;
385 }
386
387 memcpy(buf, dma->buf + offset, nbytes);
388
389 size -= nbytes;
390 address += nbytes;
391 buf += nbytes;
392 } while (size > 0);
393
394 return 0;
395 }
396
397 /**
398 * dma_port_flash_write() - Write to non-active flash region
399 * @dma: DMA control port
400 * @address: Address relative to the start of non-active region
401 * @buf: Data to write
402 * @size: Size of the buffer
403 *
404 * Writes block of data to the non-active flash region of the switch. If
405 * the address is given as %DMA_PORT_CSS_ADDRESS the block is written
406 * using CSS command.
407 */
dma_port_flash_write(struct tb_dma_port * dma,unsigned int address,const void * buf,size_t size)408 int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address,
409 const void *buf, size_t size)
410 {
411 unsigned int retries = DMA_PORT_RETRIES;
412 unsigned int offset;
413
414 if (address >= DMA_PORT_CSS_ADDRESS) {
415 offset = 0;
416 if (size > DMA_PORT_CSS_MAX_SIZE)
417 return -E2BIG;
418 } else {
419 offset = address & 3;
420 address = address & ~3;
421 }
422
423 do {
424 u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
425 int ret;
426
427 memcpy(dma->buf + offset, buf, nbytes);
428
429 ret = dma_port_flash_write_block(dma, address, buf, nbytes);
430 if (ret) {
431 if (ret == -ETIMEDOUT) {
432 if (retries--)
433 continue;
434 ret = -EIO;
435 }
436 return ret;
437 }
438
439 size -= nbytes;
440 address += nbytes;
441 buf += nbytes;
442 } while (size > 0);
443
444 return 0;
445 }
446
447 /**
448 * dma_port_flash_update_auth() - Starts flash authenticate cycle
449 * @dma: DMA control port
450 *
451 * Starts the flash update authentication cycle. If the image in the
452 * non-active area was valid, the switch starts upgrade process where
453 * active and non-active area get swapped in the end. Caller should call
454 * dma_port_flash_update_auth_status() to get status of this command.
455 * This is because if the switch in question is root switch the
456 * thunderbolt host controller gets reset as well.
457 */
dma_port_flash_update_auth(struct tb_dma_port * dma)458 int dma_port_flash_update_auth(struct tb_dma_port *dma)
459 {
460 u32 in;
461
462 in = MAIL_IN_CMD_FLASH_UPDATE_AUTH << MAIL_IN_CMD_SHIFT;
463 in |= MAIL_IN_OP_REQUEST;
464
465 return dma_port_request(dma, in, 150);
466 }
467
468 /**
469 * dma_port_flash_update_auth_status() - Reads status of update auth command
470 * @dma: DMA control port
471 * @status: Status code of the operation
472 *
473 * The function checks if there is status available from the last update
474 * auth command. Returns %0 if there is no status and no further
475 * action is required. If there is status, %1 is returned instead and
476 * @status holds the failure code.
477 *
478 * Negative return means there was an error reading status from the
479 * switch.
480 */
dma_port_flash_update_auth_status(struct tb_dma_port * dma,u32 * status)481 int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status)
482 {
483 struct tb_switch *sw = dma->sw;
484 u32 out, cmd;
485 int ret;
486
487 ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
488 dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
489 if (ret)
490 return ret;
491
492 /* Check if the status relates to flash update auth */
493 cmd = (out & MAIL_OUT_STATUS_CMD_MASK) >> MAIL_OUT_STATUS_CMD_SHIFT;
494 if (cmd == MAIL_IN_CMD_FLASH_UPDATE_AUTH) {
495 if (status)
496 *status = out & MAIL_OUT_STATUS_MASK;
497
498 /* Reset is needed in any case */
499 return 1;
500 }
501
502 return 0;
503 }
504
505 /**
506 * dma_port_power_cycle() - Power cycles the switch
507 * @dma: DMA control port
508 *
509 * Triggers power cycle to the switch.
510 */
dma_port_power_cycle(struct tb_dma_port * dma)511 int dma_port_power_cycle(struct tb_dma_port *dma)
512 {
513 u32 in;
514
515 in = MAIL_IN_CMD_POWER_CYCLE << MAIL_IN_CMD_SHIFT;
516 in |= MAIL_IN_OP_REQUEST;
517
518 return dma_port_request(dma, in, 150);
519 }
520