1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * APEI Error INJection support 4 * 5 * EINJ provides a hardware error injection mechanism, this is useful 6 * for debugging and testing of other APEI and RAS features. 7 * 8 * For more information about EINJ, please refer to ACPI Specification 9 * version 4.0, section 17.5. 10 * 11 * Copyright 2009-2010 Intel Corp. 12 * Author: Huang Ying <ying.huang@intel.com> 13 */ 14 15 #include <linux/kernel.h> 16 #include <linux/module.h> 17 #include <linux/init.h> 18 #include <linux/io.h> 19 #include <linux/debugfs.h> 20 #include <linux/seq_file.h> 21 #include <linux/nmi.h> 22 #include <linux/delay.h> 23 #include <linux/mm.h> 24 #include <linux/device/faux.h> 25 #include <linux/unaligned.h> 26 27 #include "apei-internal.h" 28 29 #undef pr_fmt 30 #define pr_fmt(fmt) "EINJ: " fmt 31 32 #define SLEEP_UNIT_MIN 1000 /* 1ms */ 33 #define SLEEP_UNIT_MAX 5000 /* 5ms */ 34 /* Firmware should respond within 1 seconds */ 35 #define FIRMWARE_TIMEOUT (1 * USEC_PER_SEC) 36 #define COMPONENT_LEN 16 37 #define ACPI65_EINJV2_SUPP BIT(30) 38 #define ACPI5_VENDOR_BIT BIT(31) 39 #define MEM_ERROR_MASK (ACPI_EINJ_MEMORY_CORRECTABLE | \ 40 ACPI_EINJ_MEMORY_UNCORRECTABLE | \ 41 ACPI_EINJ_MEMORY_FATAL) 42 #define CXL_ERROR_MASK (ACPI_EINJ_CXL_CACHE_CORRECTABLE | \ 43 ACPI_EINJ_CXL_CACHE_UNCORRECTABLE | \ 44 ACPI_EINJ_CXL_CACHE_FATAL | \ 45 ACPI_EINJ_CXL_MEM_CORRECTABLE | \ 46 ACPI_EINJ_CXL_MEM_UNCORRECTABLE | \ 47 ACPI_EINJ_CXL_MEM_FATAL) 48 49 /* 50 * ACPI version 5 provides a SET_ERROR_TYPE_WITH_ADDRESS action. 51 */ 52 static int acpi5; 53 54 struct syndrome_array { 55 union { 56 u8 acpi_id[COMPONENT_LEN]; 57 u8 device_id[COMPONENT_LEN]; 58 u8 pcie_sbdf[COMPONENT_LEN]; 59 u8 vendor_id[COMPONENT_LEN]; 60 } comp_id; 61 union { 62 u8 proc_synd[COMPONENT_LEN]; 63 u8 mem_synd[COMPONENT_LEN]; 64 u8 pcie_synd[COMPONENT_LEN]; 65 u8 vendor_synd[COMPONENT_LEN]; 66 } comp_synd; 67 }; 68 69 struct einjv2_extension_struct { 70 u32 length; 71 u16 revision; 72 u16 component_arr_count; 73 struct syndrome_array component_arr[] __counted_by(component_arr_count); 74 }; 75 76 struct set_error_type_with_address { 77 u32 type; 78 u32 vendor_extension; 79 u32 flags; 80 u32 apicid; 81 u64 memory_address; 82 u64 memory_address_range; 83 u32 pcie_sbdf; 84 struct einjv2_extension_struct einjv2_struct; 85 }; 86 enum { 87 SETWA_FLAGS_APICID = 1, 88 SETWA_FLAGS_MEM = 2, 89 SETWA_FLAGS_PCIE_SBDF = 4, 90 SETWA_FLAGS_EINJV2 = 8, 91 }; 92 93 /* 94 * Vendor extensions for platform specific operations 95 */ 96 struct vendor_error_type_extension { 97 u32 length; 98 u32 pcie_sbdf; 99 u16 vendor_id; 100 u16 device_id; 101 u8 rev_id; 102 u8 reserved[3]; 103 }; 104 105 static u32 notrigger; 106 107 static u32 vendor_flags; 108 static struct debugfs_blob_wrapper vendor_blob; 109 static struct debugfs_blob_wrapper vendor_errors; 110 static char vendor_dev[64]; 111 112 static u32 max_nr_components; 113 static u32 available_error_type; 114 static u32 available_error_type_v2; 115 static struct syndrome_array *syndrome_data; 116 117 /* 118 * Some BIOSes allow parameters to the SET_ERROR_TYPE entries in the 119 * EINJ table through an unpublished extension. Use with caution as 120 * most will ignore the parameter and make their own choice of address 121 * for error injection. This extension is used only if 122 * param_extension module parameter is specified. 123 */ 124 struct einj_parameter { 125 u64 type; 126 u64 reserved1; 127 u64 reserved2; 128 u64 param1; 129 u64 param2; 130 }; 131 132 #define EINJ_OP_BUSY 0x1 133 #define EINJ_STATUS_SUCCESS 0x0 134 #define EINJ_STATUS_FAIL 0x1 135 #define EINJ_STATUS_INVAL 0x2 136 137 #define EINJ_TAB_ENTRY(tab) \ 138 ((struct acpi_whea_header *)((char *)(tab) + \ 139 sizeof(struct acpi_table_einj))) 140 141 static bool param_extension; 142 module_param(param_extension, bool, 0); 143 144 static struct acpi_table_einj *einj_tab; 145 146 static struct apei_resources einj_resources; 147 148 static struct apei_exec_ins_type einj_ins_type[] = { 149 [ACPI_EINJ_READ_REGISTER] = { 150 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 151 .run = apei_exec_read_register, 152 }, 153 [ACPI_EINJ_READ_REGISTER_VALUE] = { 154 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 155 .run = apei_exec_read_register_value, 156 }, 157 [ACPI_EINJ_WRITE_REGISTER] = { 158 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 159 .run = apei_exec_write_register, 160 }, 161 [ACPI_EINJ_WRITE_REGISTER_VALUE] = { 162 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 163 .run = apei_exec_write_register_value, 164 }, 165 [ACPI_EINJ_NOOP] = { 166 .flags = 0, 167 .run = apei_exec_noop, 168 }, 169 }; 170 171 /* 172 * Prevent EINJ interpreter to run simultaneously, because the 173 * corresponding firmware implementation may not work properly when 174 * invoked simultaneously. 175 */ 176 static DEFINE_MUTEX(einj_mutex); 177 178 /* 179 * Exported APIs use this flag to exit early if einj_probe() failed. 180 */ 181 bool einj_initialized __ro_after_init; 182 183 static void __iomem *einj_param; 184 static u32 v5param_size; 185 static bool is_v2; 186 187 static void einj_exec_ctx_init(struct apei_exec_context *ctx) 188 { 189 apei_exec_ctx_init(ctx, einj_ins_type, ARRAY_SIZE(einj_ins_type), 190 EINJ_TAB_ENTRY(einj_tab), einj_tab->entries); 191 } 192 193 static int __einj_get_available_error_type(u32 *type, int einj_action) 194 { 195 struct apei_exec_context ctx; 196 int rc; 197 198 einj_exec_ctx_init(&ctx); 199 rc = apei_exec_run(&ctx, einj_action); 200 if (rc) 201 return rc; 202 *type = apei_exec_ctx_get_output(&ctx); 203 204 return 0; 205 } 206 207 /* Get error injection capabilities of the platform */ 208 int einj_get_available_error_type(u32 *type, int einj_action) 209 { 210 int rc; 211 212 mutex_lock(&einj_mutex); 213 rc = __einj_get_available_error_type(type, einj_action); 214 mutex_unlock(&einj_mutex); 215 216 return rc; 217 } 218 219 static int einj_get_available_error_types(u32 *type1, u32 *type2) 220 { 221 int rc; 222 223 rc = einj_get_available_error_type(type1, ACPI_EINJ_GET_ERROR_TYPE); 224 if (rc) 225 return rc; 226 if (*type1 & ACPI65_EINJV2_SUPP) { 227 rc = einj_get_available_error_type(type2, 228 ACPI_EINJV2_GET_ERROR_TYPE); 229 if (rc) 230 return rc; 231 } 232 233 return 0; 234 } 235 236 static int einj_timedout(u64 *t) 237 { 238 if ((s64)*t < SLEEP_UNIT_MIN) { 239 pr_warn(FW_WARN "Firmware does not respond in time\n"); 240 return 1; 241 } 242 *t -= SLEEP_UNIT_MIN; 243 usleep_range(SLEEP_UNIT_MIN, SLEEP_UNIT_MAX); 244 245 return 0; 246 } 247 248 static void get_oem_vendor_struct(u64 paddr, int offset, 249 struct vendor_error_type_extension *v) 250 { 251 unsigned long vendor_size; 252 u64 target_pa = paddr + offset + sizeof(struct vendor_error_type_extension); 253 254 vendor_size = v->length - sizeof(struct vendor_error_type_extension); 255 256 if (vendor_size) 257 vendor_errors.data = acpi_os_map_memory(target_pa, vendor_size); 258 259 if (vendor_errors.data) 260 vendor_errors.size = vendor_size; 261 } 262 263 static void check_vendor_extension(u64 paddr, 264 struct set_error_type_with_address *v5param) 265 { 266 int offset = v5param->vendor_extension; 267 struct vendor_error_type_extension v; 268 struct vendor_error_type_extension __iomem *p; 269 u32 sbdf; 270 271 if (!offset) 272 return; 273 p = acpi_os_map_iomem(paddr + offset, sizeof(*p)); 274 if (!p) 275 return; 276 memcpy_fromio(&v, p, sizeof(v)); 277 get_oem_vendor_struct(paddr, offset, &v); 278 sbdf = v.pcie_sbdf; 279 sprintf(vendor_dev, "%x:%x:%x.%x vendor_id=%x device_id=%x rev_id=%x\n", 280 sbdf >> 24, (sbdf >> 16) & 0xff, 281 (sbdf >> 11) & 0x1f, (sbdf >> 8) & 0x7, 282 v.vendor_id, v.device_id, v.rev_id); 283 acpi_os_unmap_iomem(p, sizeof(v)); 284 } 285 286 static void __iomem *einj_get_parameter_address(void) 287 { 288 int i; 289 u64 pa_v4 = 0, pa_v5 = 0; 290 struct acpi_whea_header *entry; 291 292 entry = EINJ_TAB_ENTRY(einj_tab); 293 for (i = 0; i < einj_tab->entries; i++) { 294 if (entry->action == ACPI_EINJ_SET_ERROR_TYPE && 295 entry->instruction == ACPI_EINJ_WRITE_REGISTER && 296 entry->register_region.space_id == 297 ACPI_ADR_SPACE_SYSTEM_MEMORY) 298 pa_v4 = get_unaligned(&entry->register_region.address); 299 if (entry->action == ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS && 300 entry->instruction == ACPI_EINJ_WRITE_REGISTER && 301 entry->register_region.space_id == 302 ACPI_ADR_SPACE_SYSTEM_MEMORY) 303 pa_v5 = get_unaligned(&entry->register_region.address); 304 entry++; 305 } 306 if (pa_v5) { 307 struct set_error_type_with_address v5param; 308 struct set_error_type_with_address __iomem *p; 309 310 v5param_size = sizeof(v5param); 311 p = acpi_os_map_iomem(pa_v5, sizeof(*p)); 312 if (p) { 313 int offset, len; 314 315 memcpy_fromio(&v5param, p, v5param_size); 316 acpi5 = 1; 317 check_vendor_extension(pa_v5, &v5param); 318 if (is_v2 && available_error_type & ACPI65_EINJV2_SUPP) { 319 len = v5param.einjv2_struct.length; 320 offset = offsetof(struct einjv2_extension_struct, component_arr); 321 max_nr_components = (len - offset) / 322 sizeof(v5param.einjv2_struct.component_arr[0]); 323 /* 324 * The first call to acpi_os_map_iomem above does not include the 325 * component array, instead it is used to read and calculate maximum 326 * number of components supported by the system. Below, the mapping 327 * is expanded to include the component array. 328 */ 329 acpi_os_unmap_iomem(p, v5param_size); 330 offset = offsetof(struct set_error_type_with_address, einjv2_struct); 331 v5param_size = offset + struct_size(&v5param.einjv2_struct, 332 component_arr, max_nr_components); 333 p = acpi_os_map_iomem(pa_v5, v5param_size); 334 } 335 return p; 336 } 337 } 338 if (param_extension && pa_v4) { 339 struct einj_parameter v4param; 340 struct einj_parameter __iomem *p; 341 342 p = acpi_os_map_iomem(pa_v4, sizeof(*p)); 343 if (!p) 344 return NULL; 345 memcpy_fromio(&v4param, p, sizeof(v4param)); 346 if (v4param.reserved1 || v4param.reserved2) { 347 acpi_os_unmap_iomem(p, sizeof(v4param)); 348 return NULL; 349 } 350 return p; 351 } 352 353 return NULL; 354 } 355 356 /* do sanity check to trigger table */ 357 static int einj_check_trigger_header(struct acpi_einj_trigger *trigger_tab) 358 { 359 if (trigger_tab->header_size != sizeof(struct acpi_einj_trigger)) 360 return -EINVAL; 361 if (trigger_tab->table_size > PAGE_SIZE || 362 trigger_tab->table_size < trigger_tab->header_size) 363 return -EINVAL; 364 if (trigger_tab->entry_count != 365 (trigger_tab->table_size - trigger_tab->header_size) / 366 sizeof(struct acpi_einj_entry)) 367 return -EINVAL; 368 369 return 0; 370 } 371 372 static struct acpi_generic_address *einj_get_trigger_parameter_region( 373 struct acpi_einj_trigger *trigger_tab, u64 param1, u64 param2) 374 { 375 int i; 376 struct acpi_whea_header *entry; 377 378 entry = (struct acpi_whea_header *) 379 ((char *)trigger_tab + sizeof(struct acpi_einj_trigger)); 380 for (i = 0; i < trigger_tab->entry_count; i++) { 381 if (entry->action == ACPI_EINJ_TRIGGER_ERROR && 382 entry->instruction <= ACPI_EINJ_WRITE_REGISTER_VALUE && 383 entry->register_region.space_id == 384 ACPI_ADR_SPACE_SYSTEM_MEMORY && 385 (entry->register_region.address & param2) == (param1 & param2)) 386 return &entry->register_region; 387 entry++; 388 } 389 390 return NULL; 391 } 392 /* Execute instructions in trigger error action table */ 393 static int __einj_error_trigger(u64 trigger_paddr, u32 type, 394 u64 param1, u64 param2) 395 { 396 struct acpi_einj_trigger trigger_tab; 397 struct acpi_einj_trigger *full_trigger_tab; 398 struct apei_exec_context trigger_ctx; 399 struct apei_resources trigger_resources; 400 struct acpi_whea_header *trigger_entry; 401 struct resource *r; 402 u32 table_size; 403 int rc = -EIO; 404 struct acpi_generic_address *trigger_param_region = NULL; 405 struct acpi_einj_trigger __iomem *p = NULL; 406 407 r = request_mem_region(trigger_paddr, sizeof(trigger_tab), 408 "APEI EINJ Trigger Table"); 409 if (!r) { 410 pr_err("Can not request [mem %#010llx-%#010llx] for Trigger table\n", 411 (unsigned long long)trigger_paddr, 412 (unsigned long long)trigger_paddr + 413 sizeof(trigger_tab) - 1); 414 goto out; 415 } 416 p = ioremap_cache(trigger_paddr, sizeof(*p)); 417 if (!p) { 418 pr_err("Failed to map trigger table!\n"); 419 goto out_rel_header; 420 } 421 memcpy_fromio(&trigger_tab, p, sizeof(trigger_tab)); 422 rc = einj_check_trigger_header(&trigger_tab); 423 if (rc) { 424 pr_warn(FW_BUG "Invalid trigger error action table.\n"); 425 goto out_rel_header; 426 } 427 428 /* No action structures in the TRIGGER_ERROR table, nothing to do */ 429 if (!trigger_tab.entry_count) 430 goto out_rel_header; 431 432 rc = -EIO; 433 table_size = trigger_tab.table_size; 434 full_trigger_tab = kmalloc(table_size, GFP_KERNEL); 435 if (!full_trigger_tab) 436 goto out_rel_header; 437 r = request_mem_region(trigger_paddr + sizeof(trigger_tab), 438 table_size - sizeof(trigger_tab), 439 "APEI EINJ Trigger Table"); 440 if (!r) { 441 pr_err("Can not request [mem %#010llx-%#010llx] for Trigger Table Entry\n", 442 (unsigned long long)trigger_paddr + sizeof(trigger_tab), 443 (unsigned long long)trigger_paddr + table_size - 1); 444 goto out_free_trigger_tab; 445 } 446 iounmap(p); 447 p = ioremap_cache(trigger_paddr, table_size); 448 if (!p) { 449 pr_err("Failed to map trigger table!\n"); 450 goto out_rel_entry; 451 } 452 memcpy_fromio(full_trigger_tab, p, table_size); 453 trigger_entry = (struct acpi_whea_header *) 454 ((char *)full_trigger_tab + sizeof(struct acpi_einj_trigger)); 455 apei_resources_init(&trigger_resources); 456 apei_exec_ctx_init(&trigger_ctx, einj_ins_type, 457 ARRAY_SIZE(einj_ins_type), 458 trigger_entry, trigger_tab.entry_count); 459 rc = apei_exec_collect_resources(&trigger_ctx, &trigger_resources); 460 if (rc) 461 goto out_fini; 462 rc = apei_resources_sub(&trigger_resources, &einj_resources); 463 if (rc) 464 goto out_fini; 465 /* 466 * Some firmware will access target address specified in 467 * param1 to trigger the error when injecting memory error. 468 * This will cause resource conflict with regular memory. So 469 * remove it from trigger table resources. 470 */ 471 if ((param_extension || acpi5) && (type & MEM_ERROR_MASK) && param2) { 472 struct apei_resources addr_resources; 473 474 apei_resources_init(&addr_resources); 475 trigger_param_region = einj_get_trigger_parameter_region( 476 full_trigger_tab, param1, param2); 477 if (trigger_param_region) { 478 rc = apei_resources_add(&addr_resources, 479 trigger_param_region->address, 480 trigger_param_region->bit_width/8, true); 481 if (rc) 482 goto out_fini; 483 rc = apei_resources_sub(&trigger_resources, 484 &addr_resources); 485 } 486 apei_resources_fini(&addr_resources); 487 if (rc) 488 goto out_fini; 489 } 490 rc = apei_resources_request(&trigger_resources, "APEI EINJ Trigger"); 491 if (rc) 492 goto out_fini; 493 rc = apei_exec_pre_map_gars(&trigger_ctx); 494 if (rc) 495 goto out_release; 496 497 rc = apei_exec_run(&trigger_ctx, ACPI_EINJ_TRIGGER_ERROR); 498 499 apei_exec_post_unmap_gars(&trigger_ctx); 500 out_release: 501 apei_resources_release(&trigger_resources); 502 out_fini: 503 apei_resources_fini(&trigger_resources); 504 out_rel_entry: 505 release_mem_region(trigger_paddr + sizeof(trigger_tab), 506 table_size - sizeof(trigger_tab)); 507 out_free_trigger_tab: 508 kfree(full_trigger_tab); 509 out_rel_header: 510 release_mem_region(trigger_paddr, sizeof(trigger_tab)); 511 out: 512 if (p) 513 iounmap(p); 514 515 return rc; 516 } 517 518 static bool is_end_of_list(u8 *val) 519 { 520 for (int i = 0; i < COMPONENT_LEN; ++i) { 521 if (val[i] != 0xFF) 522 return false; 523 } 524 return true; 525 } 526 static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, 527 u64 param3, u64 param4) 528 { 529 struct apei_exec_context ctx; 530 u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT; 531 int i, rc; 532 533 einj_exec_ctx_init(&ctx); 534 535 rc = apei_exec_run_optional(&ctx, ACPI_EINJ_BEGIN_OPERATION); 536 if (rc) 537 return rc; 538 apei_exec_ctx_set_input(&ctx, type); 539 if (acpi5) { 540 struct set_error_type_with_address *v5param; 541 542 v5param = kmalloc(v5param_size, GFP_KERNEL); 543 if (!v5param) 544 return -ENOMEM; 545 546 memcpy_fromio(v5param, einj_param, v5param_size); 547 v5param->type = type; 548 if (type & ACPI5_VENDOR_BIT) { 549 switch (vendor_flags) { 550 case SETWA_FLAGS_APICID: 551 v5param->apicid = param1; 552 break; 553 case SETWA_FLAGS_MEM: 554 v5param->memory_address = param1; 555 v5param->memory_address_range = param2; 556 break; 557 case SETWA_FLAGS_PCIE_SBDF: 558 v5param->pcie_sbdf = param1; 559 break; 560 } 561 v5param->flags = vendor_flags; 562 } else if (flags) { 563 v5param->flags = flags; 564 v5param->memory_address = param1; 565 v5param->memory_address_range = param2; 566 567 if (is_v2) { 568 for (i = 0; i < max_nr_components; i++) { 569 if (is_end_of_list(syndrome_data[i].comp_id.acpi_id)) 570 break; 571 v5param->einjv2_struct.component_arr[i].comp_id = 572 syndrome_data[i].comp_id; 573 v5param->einjv2_struct.component_arr[i].comp_synd = 574 syndrome_data[i].comp_synd; 575 } 576 v5param->einjv2_struct.component_arr_count = i; 577 } else { 578 v5param->apicid = param3; 579 v5param->pcie_sbdf = param4; 580 } 581 } else { 582 switch (type) { 583 case ACPI_EINJ_PROCESSOR_CORRECTABLE: 584 case ACPI_EINJ_PROCESSOR_UNCORRECTABLE: 585 case ACPI_EINJ_PROCESSOR_FATAL: 586 v5param->apicid = param1; 587 v5param->flags = SETWA_FLAGS_APICID; 588 break; 589 case ACPI_EINJ_MEMORY_CORRECTABLE: 590 case ACPI_EINJ_MEMORY_UNCORRECTABLE: 591 case ACPI_EINJ_MEMORY_FATAL: 592 v5param->memory_address = param1; 593 v5param->memory_address_range = param2; 594 v5param->flags = SETWA_FLAGS_MEM; 595 break; 596 case ACPI_EINJ_PCIX_CORRECTABLE: 597 case ACPI_EINJ_PCIX_UNCORRECTABLE: 598 case ACPI_EINJ_PCIX_FATAL: 599 v5param->pcie_sbdf = param1; 600 v5param->flags = SETWA_FLAGS_PCIE_SBDF; 601 break; 602 } 603 } 604 memcpy_toio(einj_param, v5param, v5param_size); 605 kfree(v5param); 606 } else { 607 rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE); 608 if (rc) 609 return rc; 610 if (einj_param) { 611 struct einj_parameter v4param; 612 613 memcpy_fromio(&v4param, einj_param, sizeof(v4param)); 614 v4param.param1 = param1; 615 v4param.param2 = param2; 616 memcpy_toio(einj_param, &v4param, sizeof(v4param)); 617 } 618 } 619 rc = apei_exec_run(&ctx, ACPI_EINJ_EXECUTE_OPERATION); 620 if (rc) 621 return rc; 622 for (;;) { 623 rc = apei_exec_run(&ctx, ACPI_EINJ_CHECK_BUSY_STATUS); 624 if (rc) 625 return rc; 626 val = apei_exec_ctx_get_output(&ctx); 627 if (!(val & EINJ_OP_BUSY)) 628 break; 629 if (einj_timedout(&timeout)) 630 return -EIO; 631 } 632 rc = apei_exec_run(&ctx, ACPI_EINJ_GET_COMMAND_STATUS); 633 if (rc) 634 return rc; 635 val = apei_exec_ctx_get_output(&ctx); 636 if (val == EINJ_STATUS_FAIL) 637 return -EBUSY; 638 else if (val == EINJ_STATUS_INVAL) 639 return -EINVAL; 640 641 /* 642 * The error is injected into the platform successfully, then it needs 643 * to trigger the error. 644 */ 645 rc = apei_exec_run(&ctx, ACPI_EINJ_GET_TRIGGER_TABLE); 646 if (rc) 647 return rc; 648 trigger_paddr = apei_exec_ctx_get_output(&ctx); 649 if (notrigger == 0) { 650 rc = __einj_error_trigger(trigger_paddr, type, param1, param2); 651 if (rc) 652 return rc; 653 } 654 rc = apei_exec_run_optional(&ctx, ACPI_EINJ_END_OPERATION); 655 656 return rc; 657 } 658 659 /* Allow almost all types of address except MMIO. */ 660 static bool is_allowed_range(u64 base_addr, u64 size) 661 { 662 int i; 663 /* 664 * MMIO region is usually claimed with IORESOURCE_MEM + IORES_DESC_NONE. 665 * However, IORES_DESC_NONE is treated like a wildcard when we check if 666 * region intersects with known resource. So do an allow list check for 667 * IORES_DESCs that definitely or most likely not MMIO. 668 */ 669 int non_mmio_desc[] = { 670 IORES_DESC_CRASH_KERNEL, 671 IORES_DESC_ACPI_TABLES, 672 IORES_DESC_ACPI_NV_STORAGE, 673 IORES_DESC_PERSISTENT_MEMORY, 674 IORES_DESC_PERSISTENT_MEMORY_LEGACY, 675 /* Treat IORES_DESC_DEVICE_PRIVATE_MEMORY as MMIO. */ 676 IORES_DESC_RESERVED, 677 IORES_DESC_SOFT_RESERVED, 678 }; 679 680 if (region_intersects(base_addr, size, IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE) 681 == REGION_INTERSECTS) 682 return true; 683 684 for (i = 0; i < ARRAY_SIZE(non_mmio_desc); ++i) { 685 if (region_intersects(base_addr, size, IORESOURCE_MEM, non_mmio_desc[i]) 686 == REGION_INTERSECTS) 687 return true; 688 } 689 690 if (arch_is_platform_page(base_addr)) 691 return true; 692 693 return false; 694 } 695 696 /* Inject the specified hardware error */ 697 int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, 698 u64 param4) 699 { 700 int rc; 701 u64 base_addr, size; 702 703 /* If user manually set "flags", make sure it is legal */ 704 if (flags && (flags & ~(SETWA_FLAGS_APICID | SETWA_FLAGS_MEM | 705 SETWA_FLAGS_PCIE_SBDF | SETWA_FLAGS_EINJV2))) 706 return -EINVAL; 707 708 /* check if type is a valid EINJv2 error type */ 709 if (is_v2) { 710 if (!(type & available_error_type_v2)) 711 return -EINVAL; 712 } 713 /* 714 * We need extra sanity checks for memory errors. 715 * Other types leap directly to injection. 716 */ 717 718 /* ensure param1/param2 existed */ 719 if (!(param_extension || acpi5)) 720 goto inject; 721 722 /* ensure injection is memory related */ 723 if (type & ACPI5_VENDOR_BIT) { 724 if (vendor_flags != SETWA_FLAGS_MEM) 725 goto inject; 726 } else if (!(type & MEM_ERROR_MASK) && !(flags & SETWA_FLAGS_MEM)) { 727 goto inject; 728 } 729 730 /* 731 * Injections targeting a CXL 1.0/1.1 port have to be injected 732 * via the einj_cxl_rch_error_inject() path as that does the proper 733 * validation of the given RCRB base (MMIO) address. 734 */ 735 if (einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM)) 736 return -EINVAL; 737 738 /* 739 * Disallow crazy address masks that give BIOS leeway to pick 740 * injection address almost anywhere. Insist on page or 741 * better granularity and that target address is normal RAM or 742 * as long as is not MMIO. 743 */ 744 base_addr = param1 & param2; 745 size = ~param2 + 1; 746 747 if ((param2 & PAGE_MASK) != PAGE_MASK) 748 return -EINVAL; 749 750 if (!is_allowed_range(base_addr, size)) 751 return -EINVAL; 752 753 if (is_zero_pfn(base_addr >> PAGE_SHIFT)) 754 return -EADDRINUSE; 755 756 inject: 757 mutex_lock(&einj_mutex); 758 rc = __einj_error_inject(type, flags, param1, param2, param3, param4); 759 mutex_unlock(&einj_mutex); 760 761 return rc; 762 } 763 764 int einj_cxl_rch_error_inject(u32 type, u32 flags, u64 param1, u64 param2, 765 u64 param3, u64 param4) 766 { 767 int rc; 768 769 if (!(einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM))) 770 return -EINVAL; 771 772 mutex_lock(&einj_mutex); 773 rc = __einj_error_inject(type, flags, param1, param2, param3, param4); 774 mutex_unlock(&einj_mutex); 775 776 return rc; 777 } 778 779 static u32 error_type; 780 static u32 error_flags; 781 static u64 error_param1; 782 static u64 error_param2; 783 static u64 error_param3; 784 static u64 error_param4; 785 static struct dentry *einj_debug_dir; 786 static char einj_buf[32]; 787 static bool einj_v2_enabled; 788 static struct { u32 mask; const char *str; } const einj_error_type_string[] = { 789 { BIT(0), "Processor Correctable" }, 790 { BIT(1), "Processor Uncorrectable non-fatal" }, 791 { BIT(2), "Processor Uncorrectable fatal" }, 792 { BIT(3), "Memory Correctable" }, 793 { BIT(4), "Memory Uncorrectable non-fatal" }, 794 { BIT(5), "Memory Uncorrectable fatal" }, 795 { BIT(6), "PCI Express Correctable" }, 796 { BIT(7), "PCI Express Uncorrectable non-fatal" }, 797 { BIT(8), "PCI Express Uncorrectable fatal" }, 798 { BIT(9), "Platform Correctable" }, 799 { BIT(10), "Platform Uncorrectable non-fatal" }, 800 { BIT(11), "Platform Uncorrectable fatal"}, 801 { BIT(31), "Vendor Defined Error Types" }, 802 }; 803 804 static struct { u32 mask; const char *str; } const einjv2_error_type_string[] = { 805 { BIT(0), "EINJV2 Processor Error" }, 806 { BIT(1), "EINJV2 Memory Error" }, 807 { BIT(2), "EINJV2 PCI Express Error" }, 808 }; 809 810 static int available_error_type_show(struct seq_file *m, void *v) 811 { 812 813 for (int pos = 0; pos < ARRAY_SIZE(einj_error_type_string); pos++) 814 if (available_error_type & einj_error_type_string[pos].mask) 815 seq_printf(m, "0x%08x\t%s\n", einj_error_type_string[pos].mask, 816 einj_error_type_string[pos].str); 817 if ((available_error_type & ACPI65_EINJV2_SUPP) && einj_v2_enabled) { 818 for (int pos = 0; pos < ARRAY_SIZE(einjv2_error_type_string); pos++) { 819 if (available_error_type_v2 & einjv2_error_type_string[pos].mask) 820 seq_printf(m, "V2_0x%08x\t%s\n", einjv2_error_type_string[pos].mask, 821 einjv2_error_type_string[pos].str); 822 } 823 } 824 return 0; 825 } 826 827 DEFINE_SHOW_ATTRIBUTE(available_error_type); 828 829 static ssize_t error_type_get(struct file *file, char __user *buf, 830 size_t count, loff_t *ppos) 831 { 832 return simple_read_from_buffer(buf, count, ppos, einj_buf, strlen(einj_buf)); 833 } 834 835 bool einj_is_cxl_error_type(u64 type) 836 { 837 return (type & CXL_ERROR_MASK) && (!(type & ACPI5_VENDOR_BIT)); 838 } 839 840 int einj_validate_error_type(u64 type) 841 { 842 u32 tval, vendor; 843 844 /* Only low 32 bits for error type are valid */ 845 if (type & GENMASK_ULL(63, 32)) 846 return -EINVAL; 847 848 /* 849 * Vendor defined types have 0x80000000 bit set, and 850 * are not enumerated by ACPI_EINJ_GET_ERROR_TYPE 851 */ 852 vendor = type & ACPI5_VENDOR_BIT; 853 tval = type & GENMASK(30, 0); 854 855 /* Only one error type can be specified */ 856 if (tval & (tval - 1)) 857 return -EINVAL; 858 if (!vendor) 859 if (!(type & (available_error_type | available_error_type_v2))) 860 return -EINVAL; 861 862 return 0; 863 } 864 865 static ssize_t error_type_set(struct file *file, const char __user *buf, 866 size_t count, loff_t *ppos) 867 { 868 int rc; 869 u64 val; 870 871 /* Leave the last character for the NUL terminator */ 872 if (count > sizeof(einj_buf) - 1) 873 return -EINVAL; 874 875 memset(einj_buf, 0, sizeof(einj_buf)); 876 if (copy_from_user(einj_buf, buf, count)) 877 return -EFAULT; 878 879 if (strncmp(einj_buf, "V2_", 3) == 0) { 880 if (!sscanf(einj_buf, "V2_%llx", &val)) 881 return -EINVAL; 882 is_v2 = true; 883 } else { 884 if (!sscanf(einj_buf, "%llx", &val)) 885 return -EINVAL; 886 is_v2 = false; 887 } 888 889 rc = einj_validate_error_type(val); 890 if (rc) 891 return rc; 892 893 error_type = val; 894 895 return count; 896 } 897 898 static const struct file_operations error_type_fops = { 899 .read = error_type_get, 900 .write = error_type_set, 901 }; 902 903 static int error_inject_set(void *data, u64 val) 904 { 905 if (!error_type) 906 return -EINVAL; 907 908 if (is_v2) 909 error_flags |= SETWA_FLAGS_EINJV2; 910 else 911 error_flags &= ~SETWA_FLAGS_EINJV2; 912 913 return einj_error_inject(error_type, error_flags, error_param1, error_param2, 914 error_param3, error_param4); 915 } 916 917 DEFINE_DEBUGFS_ATTRIBUTE(error_inject_fops, NULL, error_inject_set, "%llu\n"); 918 919 static int einj_check_table(struct acpi_table_einj *einj_tab) 920 { 921 if ((einj_tab->header_length != 922 (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header))) 923 && (einj_tab->header_length != sizeof(struct acpi_table_einj))) 924 return -EINVAL; 925 if (einj_tab->header.length < sizeof(struct acpi_table_einj)) 926 return -EINVAL; 927 if (einj_tab->entries != 928 (einj_tab->header.length - sizeof(struct acpi_table_einj)) / 929 sizeof(struct acpi_einj_entry)) 930 return -EINVAL; 931 932 return 0; 933 } 934 935 static ssize_t u128_read(struct file *f, char __user *buf, size_t count, loff_t *off) 936 { 937 char output[2 * COMPONENT_LEN + 1]; 938 u8 *data = f->f_inode->i_private; 939 int i; 940 941 if (*off >= sizeof(output)) 942 return 0; 943 944 for (i = 0; i < COMPONENT_LEN; i++) 945 sprintf(output + 2 * i, "%.02x", data[COMPONENT_LEN - i - 1]); 946 output[2 * COMPONENT_LEN] = '\n'; 947 948 return simple_read_from_buffer(buf, count, off, output, sizeof(output)); 949 } 950 951 static ssize_t u128_write(struct file *f, const char __user *buf, size_t count, loff_t *off) 952 { 953 char input[2 + 2 * COMPONENT_LEN + 2]; 954 u8 *save = f->f_inode->i_private; 955 u8 tmp[COMPONENT_LEN]; 956 char byte[3] = {}; 957 char *s, *e; 958 ssize_t c; 959 long val; 960 int i; 961 962 /* Require that user supply whole input line in one write(2) syscall */ 963 if (*off) 964 return -EINVAL; 965 966 c = simple_write_to_buffer(input, sizeof(input), off, buf, count); 967 if (c < 0) 968 return c; 969 970 if (c < 1 || input[c - 1] != '\n') 971 return -EINVAL; 972 973 /* Empty line means invalidate this entry */ 974 if (c == 1) { 975 memset(save, 0xff, COMPONENT_LEN); 976 return c; 977 } 978 979 if (input[0] == '0' && (input[1] == 'x' || input[1] == 'X')) 980 s = input + 2; 981 else 982 s = input; 983 e = input + c - 1; 984 985 for (i = 0; i < COMPONENT_LEN; i++) { 986 byte[1] = *--e; 987 byte[0] = e > s ? *--e : '0'; 988 if (kstrtol(byte, 16, &val)) 989 return -EINVAL; 990 tmp[i] = val; 991 if (e <= s) 992 break; 993 } 994 while (++i < COMPONENT_LEN) 995 tmp[i] = 0; 996 997 memcpy(save, tmp, COMPONENT_LEN); 998 999 return c; 1000 } 1001 1002 static const struct file_operations u128_fops = { 1003 .read = u128_read, 1004 .write = u128_write, 1005 }; 1006 1007 static bool setup_einjv2_component_files(void) 1008 { 1009 char name[32]; 1010 1011 syndrome_data = kcalloc(max_nr_components, sizeof(syndrome_data[0]), GFP_KERNEL); 1012 if (!syndrome_data) 1013 return false; 1014 1015 for (int i = 0; i < max_nr_components; i++) { 1016 sprintf(name, "component_id%d", i); 1017 debugfs_create_file(name, 0600, einj_debug_dir, 1018 &syndrome_data[i].comp_id, &u128_fops); 1019 sprintf(name, "component_syndrome%d", i); 1020 debugfs_create_file(name, 0600, einj_debug_dir, 1021 &syndrome_data[i].comp_synd, &u128_fops); 1022 } 1023 1024 return true; 1025 } 1026 1027 static int __init einj_probe(struct faux_device *fdev) 1028 { 1029 int rc; 1030 acpi_status status; 1031 struct apei_exec_context ctx; 1032 1033 status = acpi_get_table(ACPI_SIG_EINJ, 0, 1034 (struct acpi_table_header **)&einj_tab); 1035 if (status == AE_NOT_FOUND) { 1036 pr_debug("EINJ table not found.\n"); 1037 return -ENODEV; 1038 } else if (ACPI_FAILURE(status)) { 1039 pr_err("Failed to get EINJ table: %s\n", 1040 acpi_format_exception(status)); 1041 return -EINVAL; 1042 } 1043 1044 rc = einj_check_table(einj_tab); 1045 if (rc) { 1046 pr_warn(FW_BUG "Invalid EINJ table.\n"); 1047 goto err_put_table; 1048 } 1049 1050 rc = einj_get_available_error_types(&available_error_type, &available_error_type_v2); 1051 if (rc) 1052 goto err_put_table; 1053 1054 rc = -ENOMEM; 1055 einj_debug_dir = debugfs_create_dir("einj", apei_get_debugfs_dir()); 1056 1057 debugfs_create_file("available_error_type", S_IRUSR, einj_debug_dir, 1058 NULL, &available_error_type_fops); 1059 debugfs_create_file_unsafe("error_type", 0600, einj_debug_dir, 1060 NULL, &error_type_fops); 1061 debugfs_create_file_unsafe("error_inject", 0200, einj_debug_dir, 1062 NULL, &error_inject_fops); 1063 1064 apei_resources_init(&einj_resources); 1065 einj_exec_ctx_init(&ctx); 1066 rc = apei_exec_collect_resources(&ctx, &einj_resources); 1067 if (rc) { 1068 pr_err("Error collecting EINJ resources.\n"); 1069 goto err_fini; 1070 } 1071 1072 rc = apei_resources_request(&einj_resources, "APEI EINJ"); 1073 if (rc) { 1074 pr_err("Error requesting memory/port resources.\n"); 1075 goto err_fini; 1076 } 1077 1078 rc = apei_exec_pre_map_gars(&ctx); 1079 if (rc) { 1080 pr_err("Error pre-mapping GARs.\n"); 1081 goto err_release; 1082 } 1083 1084 einj_param = einj_get_parameter_address(); 1085 if ((param_extension || acpi5) && einj_param) { 1086 debugfs_create_x32("flags", S_IRUSR | S_IWUSR, einj_debug_dir, 1087 &error_flags); 1088 debugfs_create_x64("param1", S_IRUSR | S_IWUSR, einj_debug_dir, 1089 &error_param1); 1090 debugfs_create_x64("param2", S_IRUSR | S_IWUSR, einj_debug_dir, 1091 &error_param2); 1092 debugfs_create_x64("param3", S_IRUSR | S_IWUSR, einj_debug_dir, 1093 &error_param3); 1094 debugfs_create_x64("param4", S_IRUSR | S_IWUSR, einj_debug_dir, 1095 &error_param4); 1096 debugfs_create_x32("notrigger", S_IRUSR | S_IWUSR, 1097 einj_debug_dir, ¬rigger); 1098 if (available_error_type & ACPI65_EINJV2_SUPP) 1099 einj_v2_enabled = setup_einjv2_component_files(); 1100 } 1101 1102 if (vendor_dev[0]) { 1103 vendor_blob.data = vendor_dev; 1104 vendor_blob.size = strlen(vendor_dev); 1105 debugfs_create_blob("vendor", S_IRUSR, einj_debug_dir, 1106 &vendor_blob); 1107 debugfs_create_x32("vendor_flags", S_IRUSR | S_IWUSR, 1108 einj_debug_dir, &vendor_flags); 1109 } 1110 1111 if (vendor_errors.size) 1112 debugfs_create_blob("oem_error", 0600, einj_debug_dir, 1113 &vendor_errors); 1114 1115 pr_info("Error INJection is initialized.\n"); 1116 1117 return 0; 1118 1119 err_release: 1120 apei_resources_release(&einj_resources); 1121 err_fini: 1122 apei_resources_fini(&einj_resources); 1123 debugfs_remove_recursive(einj_debug_dir); 1124 err_put_table: 1125 acpi_put_table((struct acpi_table_header *)einj_tab); 1126 1127 return rc; 1128 } 1129 1130 static void einj_remove(struct faux_device *fdev) 1131 { 1132 struct apei_exec_context ctx; 1133 1134 if (einj_param) { 1135 acpi_size size = (acpi5) ? 1136 v5param_size : 1137 sizeof(struct einj_parameter); 1138 1139 acpi_os_unmap_iomem(einj_param, size); 1140 if (vendor_errors.size) 1141 acpi_os_unmap_memory(vendor_errors.data, vendor_errors.size); 1142 } 1143 einj_exec_ctx_init(&ctx); 1144 apei_exec_post_unmap_gars(&ctx); 1145 apei_resources_release(&einj_resources); 1146 apei_resources_fini(&einj_resources); 1147 debugfs_remove_recursive(einj_debug_dir); 1148 kfree(syndrome_data); 1149 acpi_put_table((struct acpi_table_header *)einj_tab); 1150 } 1151 1152 static struct faux_device *einj_dev; 1153 static struct faux_device_ops einj_device_ops = { 1154 .probe = einj_probe, 1155 .remove = einj_remove, 1156 }; 1157 1158 static int __init einj_init(void) 1159 { 1160 if (acpi_disabled) { 1161 pr_debug("ACPI disabled.\n"); 1162 return -ENODEV; 1163 } 1164 1165 einj_dev = faux_device_create("acpi-einj", NULL, &einj_device_ops); 1166 1167 if (einj_dev) 1168 einj_initialized = true; 1169 1170 return 0; 1171 } 1172 1173 static void __exit einj_exit(void) 1174 { 1175 faux_device_destroy(einj_dev); 1176 } 1177 1178 module_init(einj_init); 1179 module_exit(einj_exit); 1180 1181 MODULE_AUTHOR("Huang Ying"); 1182 MODULE_DESCRIPTION("APEI Error INJection support"); 1183 MODULE_LICENSE("GPL"); 1184