1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Thunderbolt DMA configuration based mailbox support
4 *
5 * Copyright (C) 2017, Intel Corporation
6 * Authors: Michael Jamet <michael.jamet@intel.com>
7 *          Mika Westerberg <mika.westerberg@linux.intel.com>
8 */
9
10#include <linux/delay.h>
11#include <linux/slab.h>
12
13#include "dma_port.h"
14#include "tb_regs.h"
15
16#define DMA_PORT_CAP			0x3e
17
18#define MAIL_DATA			1
19#define MAIL_DATA_DWORDS		16
20
21#define MAIL_IN				17
22#define MAIL_IN_CMD_SHIFT		28
23#define MAIL_IN_CMD_MASK		GENMASK(31, 28)
24#define MAIL_IN_CMD_FLASH_WRITE		0x0
25#define MAIL_IN_CMD_FLASH_UPDATE_AUTH	0x1
26#define MAIL_IN_CMD_FLASH_READ		0x2
27#define MAIL_IN_CMD_POWER_CYCLE		0x4
28#define MAIL_IN_DWORDS_SHIFT		24
29#define MAIL_IN_DWORDS_MASK		GENMASK(27, 24)
30#define MAIL_IN_ADDRESS_SHIFT		2
31#define MAIL_IN_ADDRESS_MASK		GENMASK(23, 2)
32#define MAIL_IN_CSS			BIT(1)
33#define MAIL_IN_OP_REQUEST		BIT(0)
34
35#define MAIL_OUT			18
36#define MAIL_OUT_STATUS_RESPONSE	BIT(29)
37#define MAIL_OUT_STATUS_CMD_SHIFT	4
38#define MAIL_OUT_STATUS_CMD_MASK	GENMASK(7, 4)
39#define MAIL_OUT_STATUS_MASK		GENMASK(3, 0)
40#define MAIL_OUT_STATUS_COMPLETED	0
41#define MAIL_OUT_STATUS_ERR_AUTH	1
42#define MAIL_OUT_STATUS_ERR_ACCESS	2
43
44#define DMA_PORT_TIMEOUT		5000 /* ms */
45#define DMA_PORT_RETRIES		3
46
47/**
48 * struct tb_dma_port - DMA control port
49 * @sw: Switch the DMA port belongs to
50 * @port: Switch port number where DMA capability is found
51 * @base: Start offset of the mailbox registers
52 * @buf: Temporary buffer to store a single block
53 */
54struct tb_dma_port {
55	struct tb_switch *sw;
56	u8 port;
57	u32 base;
58	u8 *buf;
59};
60
61/*
62 * When the switch is in safe mode it supports very little functionality
63 * so we don't validate that much here.
64 */
65static bool dma_port_match(const struct tb_cfg_request *req,
66			   const struct ctl_pkg *pkg)
67{
68	u64 route = tb_cfg_get_route(pkg->buffer) & ~BIT_ULL(63);
69
70	if (pkg->frame.eof == TB_CFG_PKG_ERROR)
71		return true;
72	if (pkg->frame.eof != req->response_type)
73		return false;
74	if (route != tb_cfg_get_route(req->request))
75		return false;
76	if (pkg->frame.size != req->response_size)
77		return false;
78
79	return true;
80}
81
82static bool dma_port_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
83{
84	memcpy(req->response, pkg->buffer, req->response_size);
85	return true;
86}
87
88static int dma_port_read(struct tb_ctl *ctl, void *buffer, u64 route,
89			 u32 port, u32 offset, u32 length, int timeout_msec)
90{
91	struct cfg_read_pkg request = {
92		.header = tb_cfg_make_header(route),
93		.addr = {
94			.seq = 1,
95			.port = port,
96			.space = TB_CFG_PORT,
97			.offset = offset,
98			.length = length,
99		},
100	};
101	struct tb_cfg_request *req;
102	struct cfg_write_pkg reply;
103	struct tb_cfg_result res;
104
105	req = tb_cfg_request_alloc();
106	if (!req)
107		return -ENOMEM;
108
109	req->match = dma_port_match;
110	req->copy = dma_port_copy;
111	req->request = &request;
112	req->request_size = sizeof(request);
113	req->request_type = TB_CFG_PKG_READ;
114	req->response = &reply;
115	req->response_size = 12 + 4 * length;
116	req->response_type = TB_CFG_PKG_READ;
117
118	res = tb_cfg_request_sync(ctl, req, timeout_msec);
119
120	tb_cfg_request_put(req);
121
122	if (res.err)
123		return res.err;
124
125	memcpy(buffer, &reply.data, 4 * length);
126	return 0;
127}
128
129static int dma_port_write(struct tb_ctl *ctl, const void *buffer, u64 route,
130			  u32 port, u32 offset, u32 length, int timeout_msec)
131{
132	struct cfg_write_pkg request = {
133		.header = tb_cfg_make_header(route),
134		.addr = {
135			.seq = 1,
136			.port = port,
137			.space = TB_CFG_PORT,
138			.offset = offset,
139			.length = length,
140		},
141	};
142	struct tb_cfg_request *req;
143	struct cfg_read_pkg reply;
144	struct tb_cfg_result res;
145
146	memcpy(&request.data, buffer, length * 4);
147
148	req = tb_cfg_request_alloc();
149	if (!req)
150		return -ENOMEM;
151
152	req->match = dma_port_match;
153	req->copy = dma_port_copy;
154	req->request = &request;
155	req->request_size = 12 + 4 * length;
156	req->request_type = TB_CFG_PKG_WRITE;
157	req->response = &reply;
158	req->response_size = sizeof(reply);
159	req->response_type = TB_CFG_PKG_WRITE;
160
161	res = tb_cfg_request_sync(ctl, req, timeout_msec);
162
163	tb_cfg_request_put(req);
164
165	return res.err;
166}
167
168static int dma_find_port(struct tb_switch *sw)
169{
170	static const int ports[] = { 3, 5, 7 };
171	int i;
172
173	/*
174	 * The DMA (NHI) port is either 3, 5 or 7 depending on the
175	 * controller. Try all of them.
176	 */
177	for (i = 0; i < ARRAY_SIZE(ports); i++) {
178		u32 type;
179		int ret;
180
181		ret = dma_port_read(sw->tb->ctl, &type, tb_route(sw), ports[i],
182				    2, 1, DMA_PORT_TIMEOUT);
183		if (!ret && (type & 0xffffff) == TB_TYPE_NHI)
184			return ports[i];
185	}
186
187	return -ENODEV;
188}
189
190/**
191 * dma_port_alloc() - Finds DMA control port from a switch pointed by route
192 * @sw: Switch from where find the DMA port
193 *
194 * Function checks if the switch NHI port supports DMA configuration
195 * based mailbox capability and if it does, allocates and initializes
196 * DMA port structure. Returns %NULL if the capabity was not found.
197 *
198 * The DMA control port is functional also when the switch is in safe
199 * mode.
200 */
201struct tb_dma_port *dma_port_alloc(struct tb_switch *sw)
202{
203	struct tb_dma_port *dma;
204	int port;
205
206	port = dma_find_port(sw);
207	if (port < 0)
208		return NULL;
209
210	dma = kzalloc(sizeof(*dma), GFP_KERNEL);
211	if (!dma)
212		return NULL;
213
214	dma->buf = kmalloc_array(MAIL_DATA_DWORDS, sizeof(u32), GFP_KERNEL);
215	if (!dma->buf) {
216		kfree(dma);
217		return NULL;
218	}
219
220	dma->sw = sw;
221	dma->port = port;
222	dma->base = DMA_PORT_CAP;
223
224	return dma;
225}
226
227/**
228 * dma_port_free() - Release DMA control port structure
229 * @dma: DMA control port
230 */
231void dma_port_free(struct tb_dma_port *dma)
232{
233	if (dma) {
234		kfree(dma->buf);
235		kfree(dma);
236	}
237}
238
239static int dma_port_wait_for_completion(struct tb_dma_port *dma,
240					unsigned int timeout)
241{
242	unsigned long end = jiffies + msecs_to_jiffies(timeout);
243	struct tb_switch *sw = dma->sw;
244
245	do {
246		int ret;
247		u32 in;
248
249		ret = dma_port_read(sw->tb->ctl, &in, tb_route(sw), dma->port,
250				    dma->base + MAIL_IN, 1, 50);
251		if (ret) {
252			if (ret != -ETIMEDOUT)
253				return ret;
254		} else if (!(in & MAIL_IN_OP_REQUEST)) {
255			return 0;
256		}
257
258		usleep_range(50, 100);
259	} while (time_before(jiffies, end));
260
261	return -ETIMEDOUT;
262}
263
264static int status_to_errno(u32 status)
265{
266	switch (status & MAIL_OUT_STATUS_MASK) {
267	case MAIL_OUT_STATUS_COMPLETED:
268		return 0;
269	case MAIL_OUT_STATUS_ERR_AUTH:
270		return -EINVAL;
271	case MAIL_OUT_STATUS_ERR_ACCESS:
272		return -EACCES;
273	}
274
275	return -EIO;
276}
277
278static int dma_port_request(struct tb_dma_port *dma, u32 in,
279			    unsigned int timeout)
280{
281	struct tb_switch *sw = dma->sw;
282	u32 out;
283	int ret;
284
285	ret = dma_port_write(sw->tb->ctl, &in, tb_route(sw), dma->port,
286			     dma->base + MAIL_IN, 1, DMA_PORT_TIMEOUT);
287	if (ret)
288		return ret;
289
290	ret = dma_port_wait_for_completion(dma, timeout);
291	if (ret)
292		return ret;
293
294	ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
295			    dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
296	if (ret)
297		return ret;
298
299	return status_to_errno(out);
300}
301
302static int dma_port_flash_read_block(struct tb_dma_port *dma, u32 address,
303				     void *buf, u32 size)
304{
305	struct tb_switch *sw = dma->sw;
306	u32 in, dwaddress, dwords;
307	int ret;
308
309	dwaddress = address / 4;
310	dwords = size / 4;
311
312	in = MAIL_IN_CMD_FLASH_READ << MAIL_IN_CMD_SHIFT;
313	if (dwords < MAIL_DATA_DWORDS)
314		in |= (dwords << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
315	in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
316	in |= MAIL_IN_OP_REQUEST;
317
318	ret = dma_port_request(dma, in, DMA_PORT_TIMEOUT);
319	if (ret)
320		return ret;
321
322	return dma_port_read(sw->tb->ctl, buf, tb_route(sw), dma->port,
323			     dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
324}
325
326static int dma_port_flash_write_block(struct tb_dma_port *dma, u32 address,
327				      const void *buf, u32 size)
328{
329	struct tb_switch *sw = dma->sw;
330	u32 in, dwaddress, dwords;
331	int ret;
332
333	dwords = size / 4;
334
335	/* Write the block to MAIL_DATA registers */
336	ret = dma_port_write(sw->tb->ctl, buf, tb_route(sw), dma->port,
337			    dma->base + MAIL_DATA, dwords, DMA_PORT_TIMEOUT);
338
339	in = MAIL_IN_CMD_FLASH_WRITE << MAIL_IN_CMD_SHIFT;
340
341	/* CSS header write is always done to the same magic address */
342	if (address >= DMA_PORT_CSS_ADDRESS) {
343		dwaddress = DMA_PORT_CSS_ADDRESS;
344		in |= MAIL_IN_CSS;
345	} else {
346		dwaddress = address / 4;
347	}
348
349	in |= ((dwords - 1) << MAIL_IN_DWORDS_SHIFT) & MAIL_IN_DWORDS_MASK;
350	in |= (dwaddress << MAIL_IN_ADDRESS_SHIFT) & MAIL_IN_ADDRESS_MASK;
351	in |= MAIL_IN_OP_REQUEST;
352
353	return dma_port_request(dma, in, DMA_PORT_TIMEOUT);
354}
355
356/**
357 * dma_port_flash_read() - Read from active flash region
358 * @dma: DMA control port
359 * @address: Address relative to the start of active region
360 * @buf: Buffer where the data is read
361 * @size: Size of the buffer
362 */
363int dma_port_flash_read(struct tb_dma_port *dma, unsigned int address,
364			void *buf, size_t size)
365{
366	unsigned int retries = DMA_PORT_RETRIES;
367
368	do {
369		unsigned int offset;
370		size_t nbytes;
371		int ret;
372
373		offset = address & 3;
374		nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4);
375
376		ret = dma_port_flash_read_block(dma, address, dma->buf,
377						ALIGN(nbytes, 4));
378		if (ret) {
379			if (ret == -ETIMEDOUT) {
380				if (retries--)
381					continue;
382				ret = -EIO;
383			}
384			return ret;
385		}
386
387		nbytes -= offset;
388		memcpy(buf, dma->buf + offset, nbytes);
389
390		size -= nbytes;
391		address += nbytes;
392		buf += nbytes;
393	} while (size > 0);
394
395	return 0;
396}
397
398/**
399 * dma_port_flash_write() - Write to non-active flash region
400 * @dma: DMA control port
401 * @address: Address relative to the start of non-active region
402 * @buf: Data to write
403 * @size: Size of the buffer
404 *
405 * Writes block of data to the non-active flash region of the switch. If
406 * the address is given as %DMA_PORT_CSS_ADDRESS the block is written
407 * using CSS command.
408 */
409int dma_port_flash_write(struct tb_dma_port *dma, unsigned int address,
410			 const void *buf, size_t size)
411{
412	unsigned int retries = DMA_PORT_RETRIES;
413	unsigned int offset;
414
415	if (address >= DMA_PORT_CSS_ADDRESS) {
416		offset = 0;
417		if (size > DMA_PORT_CSS_MAX_SIZE)
418			return -E2BIG;
419	} else {
420		offset = address & 3;
421		address = address & ~3;
422	}
423
424	do {
425		u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
426		int ret;
427
428		memcpy(dma->buf + offset, buf, nbytes);
429
430		ret = dma_port_flash_write_block(dma, address, buf, nbytes);
431		if (ret) {
432			if (ret == -ETIMEDOUT) {
433				if (retries--)
434					continue;
435				ret = -EIO;
436			}
437			return ret;
438		}
439
440		size -= nbytes;
441		address += nbytes;
442		buf += nbytes;
443	} while (size > 0);
444
445	return 0;
446}
447
448/**
449 * dma_port_flash_update_auth() - Starts flash authenticate cycle
450 * @dma: DMA control port
451 *
452 * Starts the flash update authentication cycle. If the image in the
453 * non-active area was valid, the switch starts upgrade process where
454 * active and non-active area get swapped in the end. Caller should call
455 * dma_port_flash_update_auth_status() to get status of this command.
456 * This is because if the switch in question is root switch the
457 * thunderbolt host controller gets reset as well.
458 */
459int dma_port_flash_update_auth(struct tb_dma_port *dma)
460{
461	u32 in;
462
463	in = MAIL_IN_CMD_FLASH_UPDATE_AUTH << MAIL_IN_CMD_SHIFT;
464	in |= MAIL_IN_OP_REQUEST;
465
466	return dma_port_request(dma, in, 150);
467}
468
469/**
470 * dma_port_flash_update_auth_status() - Reads status of update auth command
471 * @dma: DMA control port
472 * @status: Status code of the operation
473 *
474 * The function checks if there is status available from the last update
475 * auth command. Returns %0 if there is no status and no further
476 * action is required. If there is status, %1 is returned instead and
477 * @status holds the failure code.
478 *
479 * Negative return means there was an error reading status from the
480 * switch.
481 */
482int dma_port_flash_update_auth_status(struct tb_dma_port *dma, u32 *status)
483{
484	struct tb_switch *sw = dma->sw;
485	u32 out, cmd;
486	int ret;
487
488	ret = dma_port_read(sw->tb->ctl, &out, tb_route(sw), dma->port,
489			    dma->base + MAIL_OUT, 1, DMA_PORT_TIMEOUT);
490	if (ret)
491		return ret;
492
493	/* Check if the status relates to flash update auth */
494	cmd = (out & MAIL_OUT_STATUS_CMD_MASK) >> MAIL_OUT_STATUS_CMD_SHIFT;
495	if (cmd == MAIL_IN_CMD_FLASH_UPDATE_AUTH) {
496		if (status)
497			*status = out & MAIL_OUT_STATUS_MASK;
498
499		/* Reset is needed in any case */
500		return 1;
501	}
502
503	return 0;
504}
505
506/**
507 * dma_port_power_cycle() - Power cycles the switch
508 * @dma: DMA control port
509 *
510 * Triggers power cycle to the switch.
511 */
512int dma_port_power_cycle(struct tb_dma_port *dma)
513{
514	u32 in;
515
516	in = MAIL_IN_CMD_POWER_CYCLE << MAIL_IN_CMD_SHIFT;
517	in |= MAIL_IN_OP_REQUEST;
518
519	return dma_port_request(dma, in, 150);
520}
521