1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * APEI Error INJection support 4 * 5 * EINJ provides a hardware error injection mechanism, this is useful 6 * for debugging and testing of other APEI and RAS features. 7 * 8 * For more information about EINJ, please refer to ACPI Specification 9 * version 4.0, section 17.5. 10 * 11 * Copyright 2009-2010 Intel Corp. 12 * Author: Huang Ying <ying.huang@intel.com> 13 */ 14 15 #include <linux/kernel.h> 16 #include <linux/module.h> 17 #include <linux/init.h> 18 #include <linux/io.h> 19 #include <linux/debugfs.h> 20 #include <linux/seq_file.h> 21 #include <linux/nmi.h> 22 #include <linux/delay.h> 23 #include <linux/mm.h> 24 #include <linux/device/faux.h> 25 #include <linux/unaligned.h> 26 27 #include "apei-internal.h" 28 29 #undef pr_fmt 30 #define pr_fmt(fmt) "EINJ: " fmt 31 32 #define SLEEP_UNIT_MIN 1000 /* 1ms */ 33 #define SLEEP_UNIT_MAX 5000 /* 5ms */ 34 /* Firmware should respond within 1 seconds */ 35 #define FIRMWARE_TIMEOUT (1 * USEC_PER_SEC) 36 #define COMPONENT_LEN 16 37 #define ACPI65_EINJV2_SUPP BIT(30) 38 #define ACPI5_VENDOR_BIT BIT(31) 39 #define MEM_ERROR_MASK (ACPI_EINJ_MEMORY_CORRECTABLE | \ 40 ACPI_EINJ_MEMORY_UNCORRECTABLE | \ 41 ACPI_EINJ_MEMORY_FATAL) 42 #define CXL_ERROR_MASK (ACPI_EINJ_CXL_CACHE_CORRECTABLE | \ 43 ACPI_EINJ_CXL_CACHE_UNCORRECTABLE | \ 44 ACPI_EINJ_CXL_CACHE_FATAL | \ 45 ACPI_EINJ_CXL_MEM_CORRECTABLE | \ 46 ACPI_EINJ_CXL_MEM_UNCORRECTABLE | \ 47 ACPI_EINJ_CXL_MEM_FATAL) 48 49 /* 50 * ACPI version 5 provides a SET_ERROR_TYPE_WITH_ADDRESS action. 51 */ 52 static int acpi5; 53 54 struct syndrome_array { 55 union { 56 u8 acpi_id[COMPONENT_LEN]; 57 u8 device_id[COMPONENT_LEN]; 58 u8 pcie_sbdf[COMPONENT_LEN]; 59 u8 vendor_id[COMPONENT_LEN]; 60 } comp_id; 61 union { 62 u8 proc_synd[COMPONENT_LEN]; 63 u8 mem_synd[COMPONENT_LEN]; 64 u8 pcie_synd[COMPONENT_LEN]; 65 u8 vendor_synd[COMPONENT_LEN]; 66 } comp_synd; 67 }; 68 69 struct einjv2_extension_struct { 70 u32 length; 71 u16 revision; 72 u16 component_arr_count; 73 struct syndrome_array component_arr[] __counted_by(component_arr_count); 74 }; 75 76 struct set_error_type_with_address { 77 u32 type; 78 u32 vendor_extension; 79 u32 flags; 80 u32 apicid; 81 u64 memory_address; 82 u64 memory_address_range; 83 u32 pcie_sbdf; 84 struct einjv2_extension_struct einjv2_struct; 85 }; 86 enum { 87 SETWA_FLAGS_APICID = 1, 88 SETWA_FLAGS_MEM = 2, 89 SETWA_FLAGS_PCIE_SBDF = 4, 90 SETWA_FLAGS_EINJV2 = 8, 91 }; 92 93 /* 94 * Vendor extensions for platform specific operations 95 */ 96 struct vendor_error_type_extension { 97 u32 length; 98 u32 pcie_sbdf; 99 u16 vendor_id; 100 u16 device_id; 101 u8 rev_id; 102 u8 reserved[3]; 103 }; 104 105 static u32 notrigger; 106 107 static u32 vendor_flags; 108 static struct debugfs_blob_wrapper vendor_blob; 109 static struct debugfs_blob_wrapper vendor_errors; 110 static char vendor_dev[64]; 111 112 static u32 max_nr_components; 113 static u32 available_error_type; 114 static u32 available_error_type_v2; 115 static struct syndrome_array *syndrome_data; 116 117 /* 118 * Some BIOSes allow parameters to the SET_ERROR_TYPE entries in the 119 * EINJ table through an unpublished extension. Use with caution as 120 * most will ignore the parameter and make their own choice of address 121 * for error injection. This extension is used only if 122 * param_extension module parameter is specified. 123 */ 124 struct einj_parameter { 125 u64 type; 126 u64 reserved1; 127 u64 reserved2; 128 u64 param1; 129 u64 param2; 130 }; 131 132 #define EINJ_OP_BUSY 0x1 133 #define EINJ_STATUS_SUCCESS 0x0 134 #define EINJ_STATUS_FAIL 0x1 135 #define EINJ_STATUS_INVAL 0x2 136 137 #define EINJ_TAB_ENTRY(tab) \ 138 ((struct acpi_whea_header *)((char *)(tab) + \ 139 sizeof(struct acpi_table_einj))) 140 141 static bool param_extension; 142 module_param(param_extension, bool, 0); 143 144 static struct acpi_table_einj *einj_tab; 145 146 static struct apei_resources einj_resources; 147 148 static struct apei_exec_ins_type einj_ins_type[] = { 149 [ACPI_EINJ_READ_REGISTER] = { 150 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 151 .run = apei_exec_read_register, 152 }, 153 [ACPI_EINJ_READ_REGISTER_VALUE] = { 154 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 155 .run = apei_exec_read_register_value, 156 }, 157 [ACPI_EINJ_WRITE_REGISTER] = { 158 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 159 .run = apei_exec_write_register, 160 }, 161 [ACPI_EINJ_WRITE_REGISTER_VALUE] = { 162 .flags = APEI_EXEC_INS_ACCESS_REGISTER, 163 .run = apei_exec_write_register_value, 164 }, 165 [ACPI_EINJ_NOOP] = { 166 .flags = 0, 167 .run = apei_exec_noop, 168 }, 169 }; 170 171 /* 172 * Prevent EINJ interpreter to run simultaneously, because the 173 * corresponding firmware implementation may not work properly when 174 * invoked simultaneously. 175 */ 176 static DEFINE_MUTEX(einj_mutex); 177 178 /* 179 * Exported APIs use this flag to exit early if einj_probe() failed. 180 */ 181 bool einj_initialized __ro_after_init; 182 183 static void __iomem *einj_param; 184 static u32 v5param_size; 185 static u32 v66param_size; 186 static bool is_v2; 187 188 static void einj_exec_ctx_init(struct apei_exec_context *ctx) 189 { 190 apei_exec_ctx_init(ctx, einj_ins_type, ARRAY_SIZE(einj_ins_type), 191 EINJ_TAB_ENTRY(einj_tab), einj_tab->entries); 192 } 193 194 static int __einj_get_available_error_type(u32 *type, int einj_action) 195 { 196 struct apei_exec_context ctx; 197 int rc; 198 199 einj_exec_ctx_init(&ctx); 200 rc = apei_exec_run(&ctx, einj_action); 201 if (rc) 202 return rc; 203 *type = apei_exec_ctx_get_output(&ctx); 204 205 return 0; 206 } 207 208 /* Get error injection capabilities of the platform */ 209 int einj_get_available_error_type(u32 *type, int einj_action) 210 { 211 int rc; 212 213 mutex_lock(&einj_mutex); 214 rc = __einj_get_available_error_type(type, einj_action); 215 mutex_unlock(&einj_mutex); 216 217 return rc; 218 } 219 220 static int einj_get_available_error_types(u32 *type1, u32 *type2) 221 { 222 int rc; 223 224 rc = einj_get_available_error_type(type1, ACPI_EINJ_GET_ERROR_TYPE); 225 if (rc) 226 return rc; 227 if (*type1 & ACPI65_EINJV2_SUPP) { 228 rc = einj_get_available_error_type(type2, 229 ACPI_EINJV2_GET_ERROR_TYPE); 230 if (rc) 231 return rc; 232 } 233 234 return 0; 235 } 236 237 static int einj_timedout(u64 *t) 238 { 239 if ((s64)*t < SLEEP_UNIT_MIN) { 240 pr_warn(FW_WARN "Firmware does not respond in time\n"); 241 return 1; 242 } 243 *t -= SLEEP_UNIT_MIN; 244 usleep_range(SLEEP_UNIT_MIN, SLEEP_UNIT_MAX); 245 246 return 0; 247 } 248 249 static void get_oem_vendor_struct(u64 paddr, int offset, 250 struct vendor_error_type_extension *v) 251 { 252 unsigned long vendor_size; 253 u64 target_pa = paddr + offset + sizeof(struct vendor_error_type_extension); 254 255 vendor_size = v->length - sizeof(struct vendor_error_type_extension); 256 257 if (vendor_size) 258 vendor_errors.data = acpi_os_map_memory(target_pa, vendor_size); 259 260 if (vendor_errors.data) 261 vendor_errors.size = vendor_size; 262 } 263 264 static void check_vendor_extension(u64 paddr, 265 struct set_error_type_with_address *v5param) 266 { 267 int offset = v5param->vendor_extension; 268 struct vendor_error_type_extension v; 269 struct vendor_error_type_extension __iomem *p; 270 u32 sbdf; 271 272 if (!offset) 273 return; 274 p = acpi_os_map_iomem(paddr + offset, sizeof(*p)); 275 if (!p) 276 return; 277 memcpy_fromio(&v, p, sizeof(v)); 278 get_oem_vendor_struct(paddr, offset, &v); 279 sbdf = v.pcie_sbdf; 280 sprintf(vendor_dev, "%x:%x:%x.%x vendor_id=%x device_id=%x rev_id=%x\n", 281 sbdf >> 24, (sbdf >> 16) & 0xff, 282 (sbdf >> 11) & 0x1f, (sbdf >> 8) & 0x7, 283 v.vendor_id, v.device_id, v.rev_id); 284 acpi_os_unmap_iomem(p, sizeof(v)); 285 } 286 287 static u32 einjv2_init(struct einjv2_extension_struct *e) 288 { 289 if (e->revision != 1) { 290 pr_info("Unknown v2 extension revision %u\n", e->revision); 291 return 0; 292 } 293 if (e->length < sizeof(*e) || e->length > PAGE_SIZE) { 294 pr_info(FW_BUG "Bad1 v2 extension length %u\n", e->length); 295 return 0; 296 } 297 if ((e->length - sizeof(*e)) % sizeof(e->component_arr[0])) { 298 pr_info(FW_BUG "Bad2 v2 extension length %u\n", e->length); 299 return 0; 300 } 301 302 return (e->length - sizeof(*e)) / sizeof(e->component_arr[0]); 303 } 304 305 static void __iomem *einj_get_parameter_address(void) 306 { 307 int i; 308 u64 pa_v4 = 0, pa_v5 = 0; 309 struct acpi_whea_header *entry; 310 311 entry = EINJ_TAB_ENTRY(einj_tab); 312 for (i = 0; i < einj_tab->entries; i++) { 313 if (entry->action == ACPI_EINJ_SET_ERROR_TYPE && 314 entry->instruction == ACPI_EINJ_WRITE_REGISTER && 315 entry->register_region.space_id == 316 ACPI_ADR_SPACE_SYSTEM_MEMORY) 317 pa_v4 = get_unaligned(&entry->register_region.address); 318 if (entry->action == ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS && 319 entry->instruction == ACPI_EINJ_WRITE_REGISTER && 320 entry->register_region.space_id == 321 ACPI_ADR_SPACE_SYSTEM_MEMORY) 322 pa_v5 = get_unaligned(&entry->register_region.address); 323 entry++; 324 } 325 if (pa_v5) { 326 struct set_error_type_with_address v5param; 327 struct set_error_type_with_address __iomem *p; 328 329 v5param_size = sizeof(v5param); 330 p = acpi_os_map_iomem(pa_v5, sizeof(*p)); 331 if (p) { 332 memcpy_fromio(&v5param, p, v5param_size); 333 acpi5 = 1; 334 check_vendor_extension(pa_v5, &v5param); 335 if (available_error_type & ACPI65_EINJV2_SUPP) { 336 struct einjv2_extension_struct *e; 337 338 e = &v5param.einjv2_struct; 339 max_nr_components = einjv2_init(e); 340 341 /* remap including einjv2_extension_struct */ 342 acpi_os_unmap_iomem(p, v5param_size); 343 v66param_size = v5param_size - sizeof(*e) + e->length; 344 p = acpi_os_map_iomem(pa_v5, v66param_size); 345 } 346 347 return p; 348 } 349 } 350 if (param_extension && pa_v4) { 351 struct einj_parameter v4param; 352 struct einj_parameter __iomem *p; 353 354 p = acpi_os_map_iomem(pa_v4, sizeof(*p)); 355 if (!p) 356 return NULL; 357 memcpy_fromio(&v4param, p, sizeof(v4param)); 358 if (v4param.reserved1 || v4param.reserved2) { 359 acpi_os_unmap_iomem(p, sizeof(v4param)); 360 return NULL; 361 } 362 return p; 363 } 364 365 return NULL; 366 } 367 368 /* do sanity check to trigger table */ 369 static int einj_check_trigger_header(struct acpi_einj_trigger *trigger_tab) 370 { 371 if (trigger_tab->header_size != sizeof(struct acpi_einj_trigger)) 372 return -EINVAL; 373 if (trigger_tab->table_size > PAGE_SIZE || 374 trigger_tab->table_size < trigger_tab->header_size) 375 return -EINVAL; 376 if (trigger_tab->entry_count != 377 (trigger_tab->table_size - trigger_tab->header_size) / 378 sizeof(struct acpi_einj_entry)) 379 return -EINVAL; 380 381 return 0; 382 } 383 384 static struct acpi_generic_address *einj_get_trigger_parameter_region( 385 struct acpi_einj_trigger *trigger_tab, u64 param1, u64 param2) 386 { 387 int i; 388 struct acpi_whea_header *entry; 389 390 entry = (struct acpi_whea_header *) 391 ((char *)trigger_tab + sizeof(struct acpi_einj_trigger)); 392 for (i = 0; i < trigger_tab->entry_count; i++) { 393 if (entry->action == ACPI_EINJ_TRIGGER_ERROR && 394 entry->instruction <= ACPI_EINJ_WRITE_REGISTER_VALUE && 395 entry->register_region.space_id == 396 ACPI_ADR_SPACE_SYSTEM_MEMORY && 397 (entry->register_region.address & param2) == (param1 & param2)) 398 return &entry->register_region; 399 entry++; 400 } 401 402 return NULL; 403 } 404 405 static bool is_memory_injection(u32 type, u32 flags) 406 { 407 if (flags & SETWA_FLAGS_EINJV2) 408 return !!(type & ACPI_EINJV2_MEMORY); 409 if (type & ACPI5_VENDOR_BIT) 410 return !!(vendor_flags & SETWA_FLAGS_MEM); 411 return !!(type & MEM_ERROR_MASK) || !!(flags & SETWA_FLAGS_MEM); 412 } 413 414 /* Execute instructions in trigger error action table */ 415 static int __einj_error_trigger(u64 trigger_paddr, u32 type, u32 flags, 416 u64 param1, u64 param2) 417 { 418 struct acpi_einj_trigger trigger_tab; 419 struct acpi_einj_trigger *full_trigger_tab; 420 struct apei_exec_context trigger_ctx; 421 struct apei_resources trigger_resources; 422 struct acpi_whea_header *trigger_entry; 423 struct resource *r; 424 u32 table_size; 425 int rc = -EIO; 426 struct acpi_generic_address *trigger_param_region = NULL; 427 struct acpi_einj_trigger __iomem *p = NULL; 428 429 r = request_mem_region(trigger_paddr, sizeof(trigger_tab), 430 "APEI EINJ Trigger Table"); 431 if (!r) { 432 pr_err("Can not request [mem %#010llx-%#010llx] for Trigger table\n", 433 (unsigned long long)trigger_paddr, 434 (unsigned long long)trigger_paddr + 435 sizeof(trigger_tab) - 1); 436 goto out; 437 } 438 p = ioremap_cache(trigger_paddr, sizeof(*p)); 439 if (!p) { 440 pr_err("Failed to map trigger table!\n"); 441 goto out_rel_header; 442 } 443 memcpy_fromio(&trigger_tab, p, sizeof(trigger_tab)); 444 rc = einj_check_trigger_header(&trigger_tab); 445 if (rc) { 446 pr_warn(FW_BUG "Invalid trigger error action table.\n"); 447 goto out_rel_header; 448 } 449 450 /* No action structures in the TRIGGER_ERROR table, nothing to do */ 451 if (!trigger_tab.entry_count) 452 goto out_rel_header; 453 454 rc = -EIO; 455 table_size = trigger_tab.table_size; 456 full_trigger_tab = kmalloc(table_size, GFP_KERNEL); 457 if (!full_trigger_tab) 458 goto out_rel_header; 459 r = request_mem_region(trigger_paddr + sizeof(trigger_tab), 460 table_size - sizeof(trigger_tab), 461 "APEI EINJ Trigger Table"); 462 if (!r) { 463 pr_err("Can not request [mem %#010llx-%#010llx] for Trigger Table Entry\n", 464 (unsigned long long)trigger_paddr + sizeof(trigger_tab), 465 (unsigned long long)trigger_paddr + table_size - 1); 466 goto out_free_trigger_tab; 467 } 468 iounmap(p); 469 p = ioremap_cache(trigger_paddr, table_size); 470 if (!p) { 471 pr_err("Failed to map trigger table!\n"); 472 goto out_rel_entry; 473 } 474 memcpy_fromio(full_trigger_tab, p, table_size); 475 trigger_entry = (struct acpi_whea_header *) 476 ((char *)full_trigger_tab + sizeof(struct acpi_einj_trigger)); 477 apei_resources_init(&trigger_resources); 478 apei_exec_ctx_init(&trigger_ctx, einj_ins_type, 479 ARRAY_SIZE(einj_ins_type), 480 trigger_entry, trigger_tab.entry_count); 481 rc = apei_exec_collect_resources(&trigger_ctx, &trigger_resources); 482 if (rc) 483 goto out_fini; 484 rc = apei_resources_sub(&trigger_resources, &einj_resources); 485 if (rc) 486 goto out_fini; 487 /* 488 * Some firmware will access target address specified in 489 * param1 to trigger the error when injecting memory error. 490 * This will cause resource conflict with regular memory. So 491 * remove it from trigger table resources. 492 */ 493 if ((param_extension || acpi5) && is_memory_injection(type, flags)) { 494 struct apei_resources addr_resources; 495 496 apei_resources_init(&addr_resources); 497 trigger_param_region = einj_get_trigger_parameter_region( 498 full_trigger_tab, param1, param2); 499 if (trigger_param_region) { 500 rc = apei_resources_add(&addr_resources, 501 trigger_param_region->address, 502 trigger_param_region->bit_width/8, true); 503 if (rc) 504 goto out_fini; 505 rc = apei_resources_sub(&trigger_resources, 506 &addr_resources); 507 } 508 apei_resources_fini(&addr_resources); 509 if (rc) 510 goto out_fini; 511 } 512 rc = apei_resources_request(&trigger_resources, "APEI EINJ Trigger"); 513 if (rc) 514 goto out_fini; 515 rc = apei_exec_pre_map_gars(&trigger_ctx); 516 if (rc) 517 goto out_release; 518 519 rc = apei_exec_run(&trigger_ctx, ACPI_EINJ_TRIGGER_ERROR); 520 521 apei_exec_post_unmap_gars(&trigger_ctx); 522 out_release: 523 apei_resources_release(&trigger_resources); 524 out_fini: 525 apei_resources_fini(&trigger_resources); 526 out_rel_entry: 527 release_mem_region(trigger_paddr + sizeof(trigger_tab), 528 table_size - sizeof(trigger_tab)); 529 out_free_trigger_tab: 530 kfree(full_trigger_tab); 531 out_rel_header: 532 release_mem_region(trigger_paddr, sizeof(trigger_tab)); 533 out: 534 if (p) 535 iounmap(p); 536 537 return rc; 538 } 539 540 static bool is_end_of_list(u8 *val) 541 { 542 for (int i = 0; i < COMPONENT_LEN; ++i) { 543 if (val[i] != 0xFF) 544 return false; 545 } 546 return true; 547 } 548 static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, 549 u64 param3, u64 param4) 550 { 551 struct apei_exec_context ctx; 552 u32 param_size = is_v2 ? v66param_size : v5param_size; 553 u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT; 554 int i, rc; 555 556 einj_exec_ctx_init(&ctx); 557 558 rc = apei_exec_run_optional(&ctx, ACPI_EINJ_BEGIN_OPERATION); 559 if (rc) 560 return rc; 561 apei_exec_ctx_set_input(&ctx, type); 562 if (acpi5) { 563 struct set_error_type_with_address *v5param; 564 565 v5param = kmalloc(param_size, GFP_KERNEL); 566 if (!v5param) 567 return -ENOMEM; 568 569 memcpy_fromio(v5param, einj_param, param_size); 570 v5param->type = type; 571 if (type & ACPI5_VENDOR_BIT) { 572 switch (vendor_flags) { 573 case SETWA_FLAGS_APICID: 574 v5param->apicid = param1; 575 break; 576 case SETWA_FLAGS_MEM: 577 v5param->memory_address = param1; 578 v5param->memory_address_range = param2; 579 break; 580 case SETWA_FLAGS_PCIE_SBDF: 581 v5param->pcie_sbdf = param1; 582 break; 583 } 584 v5param->flags = vendor_flags; 585 } else if (flags) { 586 v5param->flags = flags; 587 v5param->memory_address = param1; 588 v5param->memory_address_range = param2; 589 590 if (is_v2) { 591 for (i = 0; i < max_nr_components; i++) { 592 if (is_end_of_list(syndrome_data[i].comp_id.acpi_id)) 593 break; 594 v5param->einjv2_struct.component_arr[i].comp_id = 595 syndrome_data[i].comp_id; 596 v5param->einjv2_struct.component_arr[i].comp_synd = 597 syndrome_data[i].comp_synd; 598 } 599 v5param->einjv2_struct.component_arr_count = i; 600 } else { 601 v5param->apicid = param3; 602 v5param->pcie_sbdf = param4; 603 } 604 } else { 605 switch (type) { 606 case ACPI_EINJ_PROCESSOR_CORRECTABLE: 607 case ACPI_EINJ_PROCESSOR_UNCORRECTABLE: 608 case ACPI_EINJ_PROCESSOR_FATAL: 609 v5param->apicid = param1; 610 v5param->flags = SETWA_FLAGS_APICID; 611 break; 612 case ACPI_EINJ_MEMORY_CORRECTABLE: 613 case ACPI_EINJ_MEMORY_UNCORRECTABLE: 614 case ACPI_EINJ_MEMORY_FATAL: 615 v5param->memory_address = param1; 616 v5param->memory_address_range = param2; 617 v5param->flags = SETWA_FLAGS_MEM; 618 break; 619 case ACPI_EINJ_PCIX_CORRECTABLE: 620 case ACPI_EINJ_PCIX_UNCORRECTABLE: 621 case ACPI_EINJ_PCIX_FATAL: 622 v5param->pcie_sbdf = param1; 623 v5param->flags = SETWA_FLAGS_PCIE_SBDF; 624 break; 625 } 626 } 627 memcpy_toio(einj_param, v5param, param_size); 628 kfree(v5param); 629 } else { 630 rc = apei_exec_run(&ctx, ACPI_EINJ_SET_ERROR_TYPE); 631 if (rc) 632 return rc; 633 if (einj_param) { 634 struct einj_parameter v4param; 635 636 memcpy_fromio(&v4param, einj_param, sizeof(v4param)); 637 v4param.param1 = param1; 638 v4param.param2 = param2; 639 memcpy_toio(einj_param, &v4param, sizeof(v4param)); 640 } 641 } 642 rc = apei_exec_run(&ctx, ACPI_EINJ_EXECUTE_OPERATION); 643 if (rc) 644 return rc; 645 for (;;) { 646 rc = apei_exec_run(&ctx, ACPI_EINJ_CHECK_BUSY_STATUS); 647 if (rc) 648 return rc; 649 val = apei_exec_ctx_get_output(&ctx); 650 if (!(val & EINJ_OP_BUSY)) 651 break; 652 if (einj_timedout(&timeout)) 653 return -EIO; 654 } 655 rc = apei_exec_run(&ctx, ACPI_EINJ_GET_COMMAND_STATUS); 656 if (rc) 657 return rc; 658 val = apei_exec_ctx_get_output(&ctx); 659 if (val == EINJ_STATUS_FAIL) 660 return -EBUSY; 661 else if (val == EINJ_STATUS_INVAL) 662 return -EINVAL; 663 664 /* 665 * The error is injected into the platform successfully, then it needs 666 * to trigger the error. 667 */ 668 rc = apei_exec_run(&ctx, ACPI_EINJ_GET_TRIGGER_TABLE); 669 if (rc) 670 return rc; 671 trigger_paddr = apei_exec_ctx_get_output(&ctx); 672 if (notrigger == 0) { 673 rc = __einj_error_trigger(trigger_paddr, type, flags, param1, param2); 674 if (rc) 675 return rc; 676 } 677 rc = apei_exec_run_optional(&ctx, ACPI_EINJ_END_OPERATION); 678 679 return rc; 680 } 681 682 /* Allow almost all types of address except MMIO. */ 683 static bool is_allowed_range(u64 base_addr, u64 size) 684 { 685 int i; 686 /* 687 * MMIO region is usually claimed with IORESOURCE_MEM + IORES_DESC_NONE. 688 * However, IORES_DESC_NONE is treated like a wildcard when we check if 689 * region intersects with known resource. So do an allow list check for 690 * IORES_DESCs that definitely or most likely not MMIO. 691 */ 692 static const int non_mmio_desc[] = { 693 IORES_DESC_CRASH_KERNEL, 694 IORES_DESC_ACPI_TABLES, 695 IORES_DESC_ACPI_NV_STORAGE, 696 IORES_DESC_PERSISTENT_MEMORY, 697 IORES_DESC_PERSISTENT_MEMORY_LEGACY, 698 /* Treat IORES_DESC_DEVICE_PRIVATE_MEMORY as MMIO. */ 699 IORES_DESC_RESERVED, 700 IORES_DESC_SOFT_RESERVED, 701 }; 702 703 if (region_intersects(base_addr, size, IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE) 704 == REGION_INTERSECTS) 705 return true; 706 707 for (i = 0; i < ARRAY_SIZE(non_mmio_desc); ++i) { 708 if (region_intersects(base_addr, size, IORESOURCE_MEM, non_mmio_desc[i]) 709 == REGION_INTERSECTS) 710 return true; 711 } 712 713 if (arch_is_platform_page(base_addr)) 714 return true; 715 716 return false; 717 } 718 719 /* Inject the specified hardware error */ 720 int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2, u64 param3, 721 u64 param4) 722 { 723 int rc; 724 u64 base_addr, size; 725 726 /* If user manually set "flags", make sure it is legal */ 727 if (flags && (flags & ~(SETWA_FLAGS_APICID | SETWA_FLAGS_MEM | 728 SETWA_FLAGS_PCIE_SBDF | SETWA_FLAGS_EINJV2))) 729 return -EINVAL; 730 731 /* 732 * Injections targeting a CXL 1.0/1.1 port have to be injected 733 * via the einj_cxl_rch_error_inject() path as that does the proper 734 * validation of the given RCRB base (MMIO) address. 735 */ 736 if (einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM)) 737 return -EINVAL; 738 739 /* check if type is a valid EINJv2 error type */ 740 if (is_v2) { 741 if (!(type & available_error_type_v2)) 742 return -EINVAL; 743 } 744 745 /* ensure param1/param2 existed */ 746 if (!(param_extension || acpi5)) 747 goto inject; 748 749 /* 750 * We need extra sanity checks for memory errors. 751 * Other types leap directly to injection. 752 */ 753 if (!is_memory_injection(type, flags)) 754 goto inject; 755 756 /* 757 * Disallow crazy address masks that give BIOS leeway to pick 758 * injection address almost anywhere. Insist on page or 759 * better granularity and that target address is normal RAM or 760 * as long as is not MMIO. 761 */ 762 base_addr = param1 & param2; 763 size = ~param2 + 1; 764 765 if ((param2 & PAGE_MASK) != PAGE_MASK) 766 return -EINVAL; 767 768 if (!is_allowed_range(base_addr, size)) 769 return -EINVAL; 770 771 if (is_zero_pfn(base_addr >> PAGE_SHIFT)) 772 return -EADDRINUSE; 773 774 inject: 775 mutex_lock(&einj_mutex); 776 rc = __einj_error_inject(type, flags, param1, param2, param3, param4); 777 mutex_unlock(&einj_mutex); 778 779 return rc; 780 } 781 782 int einj_cxl_rch_error_inject(u32 type, u32 flags, u64 param1, u64 param2, 783 u64 param3, u64 param4) 784 { 785 int rc; 786 787 if (!(einj_is_cxl_error_type(type) && (flags & SETWA_FLAGS_MEM))) 788 return -EINVAL; 789 790 mutex_lock(&einj_mutex); 791 rc = __einj_error_inject(type, flags, param1, param2, param3, param4); 792 mutex_unlock(&einj_mutex); 793 794 return rc; 795 } 796 797 static u32 error_type; 798 static u32 error_flags; 799 static u64 error_param1; 800 static u64 error_param2; 801 static u64 error_param3; 802 static u64 error_param4; 803 static struct dentry *einj_debug_dir; 804 static char einj_buf[32]; 805 static bool einj_v2_enabled; 806 static struct { u32 mask; const char *str; } const einj_error_type_string[] = { 807 { BIT(0), "Processor Correctable" }, 808 { BIT(1), "Processor Uncorrectable non-fatal" }, 809 { BIT(2), "Processor Uncorrectable fatal" }, 810 { BIT(3), "Memory Correctable" }, 811 { BIT(4), "Memory Uncorrectable non-fatal" }, 812 { BIT(5), "Memory Uncorrectable fatal" }, 813 { BIT(6), "PCI Express Correctable" }, 814 { BIT(7), "PCI Express Uncorrectable non-fatal" }, 815 { BIT(8), "PCI Express Uncorrectable fatal" }, 816 { BIT(9), "Platform Correctable" }, 817 { BIT(10), "Platform Uncorrectable non-fatal" }, 818 { BIT(11), "Platform Uncorrectable fatal"}, 819 { BIT(31), "Vendor Defined Error Types" }, 820 }; 821 822 static struct { u32 mask; const char *str; } const einjv2_error_type_string[] = { 823 { BIT(0), "EINJV2 Processor Error" }, 824 { BIT(1), "EINJV2 Memory Error" }, 825 { BIT(2), "EINJV2 PCI Express Error" }, 826 }; 827 828 static int available_error_type_show(struct seq_file *m, void *v) 829 { 830 831 for (int pos = 0; pos < ARRAY_SIZE(einj_error_type_string); pos++) 832 if (available_error_type & einj_error_type_string[pos].mask) 833 seq_printf(m, "0x%08x\t%s\n", einj_error_type_string[pos].mask, 834 einj_error_type_string[pos].str); 835 if ((available_error_type & ACPI65_EINJV2_SUPP) && einj_v2_enabled) { 836 for (int pos = 0; pos < ARRAY_SIZE(einjv2_error_type_string); pos++) { 837 if (available_error_type_v2 & einjv2_error_type_string[pos].mask) 838 seq_printf(m, "V2_0x%08x\t%s\n", einjv2_error_type_string[pos].mask, 839 einjv2_error_type_string[pos].str); 840 } 841 } 842 return 0; 843 } 844 845 DEFINE_SHOW_ATTRIBUTE(available_error_type); 846 847 static ssize_t error_type_get(struct file *file, char __user *buf, 848 size_t count, loff_t *ppos) 849 { 850 return simple_read_from_buffer(buf, count, ppos, einj_buf, strlen(einj_buf)); 851 } 852 853 bool einj_is_cxl_error_type(u64 type) 854 { 855 return (type & CXL_ERROR_MASK) && (!(type & ACPI5_VENDOR_BIT)); 856 } 857 858 int einj_validate_error_type(u64 type) 859 { 860 u32 tval, vendor; 861 862 /* Only low 32 bits for error type are valid */ 863 if (type & GENMASK_ULL(63, 32)) 864 return -EINVAL; 865 866 /* 867 * Vendor defined types have 0x80000000 bit set, and 868 * are not enumerated by ACPI_EINJ_GET_ERROR_TYPE 869 */ 870 vendor = type & ACPI5_VENDOR_BIT; 871 tval = type & GENMASK(30, 0); 872 873 /* Only one error type can be specified */ 874 if (tval & (tval - 1)) 875 return -EINVAL; 876 if (!vendor) 877 if (!(type & (available_error_type | available_error_type_v2))) 878 return -EINVAL; 879 880 return 0; 881 } 882 883 static ssize_t error_type_set(struct file *file, const char __user *buf, 884 size_t count, loff_t *ppos) 885 { 886 int rc; 887 u64 val; 888 889 /* Leave the last character for the NUL terminator */ 890 if (count > sizeof(einj_buf) - 1) 891 return -EINVAL; 892 893 memset(einj_buf, 0, sizeof(einj_buf)); 894 if (copy_from_user(einj_buf, buf, count)) 895 return -EFAULT; 896 897 if (strncmp(einj_buf, "V2_", 3) == 0) { 898 if (!sscanf(einj_buf, "V2_%llx", &val)) 899 return -EINVAL; 900 is_v2 = true; 901 } else { 902 if (!sscanf(einj_buf, "%llx", &val)) 903 return -EINVAL; 904 is_v2 = false; 905 } 906 907 rc = einj_validate_error_type(val); 908 if (rc) 909 return rc; 910 911 error_type = val; 912 913 return count; 914 } 915 916 static const struct file_operations error_type_fops = { 917 .read = error_type_get, 918 .write = error_type_set, 919 }; 920 921 static int error_inject_set(void *data, u64 val) 922 { 923 if (!error_type) 924 return -EINVAL; 925 926 if (is_v2) 927 error_flags |= SETWA_FLAGS_EINJV2; 928 else 929 error_flags &= ~SETWA_FLAGS_EINJV2; 930 931 return einj_error_inject(error_type, error_flags, error_param1, error_param2, 932 error_param3, error_param4); 933 } 934 935 DEFINE_DEBUGFS_ATTRIBUTE(error_inject_fops, NULL, error_inject_set, "%llu\n"); 936 937 static int einj_check_table(struct acpi_table_einj *einj_tab) 938 { 939 if ((einj_tab->header_length != 940 (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header))) 941 && (einj_tab->header_length != sizeof(struct acpi_table_einj))) 942 return -EINVAL; 943 if (einj_tab->header.length < sizeof(struct acpi_table_einj)) 944 return -EINVAL; 945 if (einj_tab->entries != 946 (einj_tab->header.length - sizeof(struct acpi_table_einj)) / 947 sizeof(struct acpi_einj_entry)) 948 return -EINVAL; 949 950 return 0; 951 } 952 953 static ssize_t u128_read(struct file *f, char __user *buf, size_t count, loff_t *off) 954 { 955 char output[2 * COMPONENT_LEN + 1]; 956 u8 *data = f->f_inode->i_private; 957 int i; 958 959 if (*off >= sizeof(output)) 960 return 0; 961 962 for (i = 0; i < COMPONENT_LEN; i++) 963 sprintf(output + 2 * i, "%.02x", data[COMPONENT_LEN - i - 1]); 964 output[2 * COMPONENT_LEN] = '\n'; 965 966 return simple_read_from_buffer(buf, count, off, output, sizeof(output)); 967 } 968 969 static ssize_t u128_write(struct file *f, const char __user *buf, size_t count, loff_t *off) 970 { 971 char input[2 + 2 * COMPONENT_LEN + 2]; 972 u8 *save = f->f_inode->i_private; 973 u8 tmp[COMPONENT_LEN]; 974 char byte[3] = {}; 975 char *s, *e; 976 ssize_t c; 977 long val; 978 int i; 979 980 /* Require that user supply whole input line in one write(2) syscall */ 981 if (*off) 982 return -EINVAL; 983 984 c = simple_write_to_buffer(input, sizeof(input), off, buf, count); 985 if (c < 0) 986 return c; 987 988 if (c < 1 || input[c - 1] != '\n') 989 return -EINVAL; 990 991 /* Empty line means invalidate this entry */ 992 if (c == 1) { 993 memset(save, 0xff, COMPONENT_LEN); 994 return c; 995 } 996 997 if (input[0] == '0' && (input[1] == 'x' || input[1] == 'X')) 998 s = input + 2; 999 else 1000 s = input; 1001 e = input + c - 1; 1002 1003 for (i = 0; i < COMPONENT_LEN; i++) { 1004 byte[1] = *--e; 1005 byte[0] = e > s ? *--e : '0'; 1006 if (kstrtol(byte, 16, &val)) 1007 return -EINVAL; 1008 tmp[i] = val; 1009 if (e <= s) 1010 break; 1011 } 1012 while (++i < COMPONENT_LEN) 1013 tmp[i] = 0; 1014 1015 memcpy(save, tmp, COMPONENT_LEN); 1016 1017 return c; 1018 } 1019 1020 static const struct file_operations u128_fops = { 1021 .read = u128_read, 1022 .write = u128_write, 1023 }; 1024 1025 static bool setup_einjv2_component_files(void) 1026 { 1027 char name[32]; 1028 1029 syndrome_data = kzalloc_objs(syndrome_data[0], max_nr_components); 1030 if (!syndrome_data) 1031 return false; 1032 1033 for (int i = 0; i < max_nr_components; i++) { 1034 sprintf(name, "component_id%d", i); 1035 debugfs_create_file(name, 0600, einj_debug_dir, 1036 &syndrome_data[i].comp_id, &u128_fops); 1037 sprintf(name, "component_syndrome%d", i); 1038 debugfs_create_file(name, 0600, einj_debug_dir, 1039 &syndrome_data[i].comp_synd, &u128_fops); 1040 } 1041 1042 return true; 1043 } 1044 1045 static int __init einj_probe(struct faux_device *fdev) 1046 { 1047 int rc; 1048 acpi_status status; 1049 struct apei_exec_context ctx; 1050 1051 status = acpi_get_table(ACPI_SIG_EINJ, 0, 1052 (struct acpi_table_header **)&einj_tab); 1053 if (status == AE_NOT_FOUND) { 1054 pr_debug("EINJ table not found.\n"); 1055 return -ENODEV; 1056 } else if (ACPI_FAILURE(status)) { 1057 pr_err("Failed to get EINJ table: %s\n", 1058 acpi_format_exception(status)); 1059 return -EINVAL; 1060 } 1061 1062 rc = einj_check_table(einj_tab); 1063 if (rc) { 1064 pr_warn(FW_BUG "Invalid EINJ table.\n"); 1065 goto err_put_table; 1066 } 1067 1068 rc = einj_get_available_error_types(&available_error_type, &available_error_type_v2); 1069 if (rc) 1070 goto err_put_table; 1071 1072 rc = -ENOMEM; 1073 einj_debug_dir = debugfs_create_dir("einj", apei_get_debugfs_dir()); 1074 1075 debugfs_create_file("available_error_type", S_IRUSR, einj_debug_dir, 1076 NULL, &available_error_type_fops); 1077 debugfs_create_file_unsafe("error_type", 0600, einj_debug_dir, 1078 NULL, &error_type_fops); 1079 debugfs_create_file_unsafe("error_inject", 0200, einj_debug_dir, 1080 NULL, &error_inject_fops); 1081 1082 apei_resources_init(&einj_resources); 1083 einj_exec_ctx_init(&ctx); 1084 rc = apei_exec_collect_resources(&ctx, &einj_resources); 1085 if (rc) { 1086 pr_err("Error collecting EINJ resources.\n"); 1087 goto err_fini; 1088 } 1089 1090 rc = apei_resources_request(&einj_resources, "APEI EINJ"); 1091 if (rc) { 1092 pr_err("Error requesting memory/port resources.\n"); 1093 goto err_fini; 1094 } 1095 1096 rc = apei_exec_pre_map_gars(&ctx); 1097 if (rc) { 1098 pr_err("Error pre-mapping GARs.\n"); 1099 goto err_release; 1100 } 1101 1102 einj_param = einj_get_parameter_address(); 1103 if ((param_extension || acpi5) && einj_param) { 1104 debugfs_create_x32("flags", S_IRUSR | S_IWUSR, einj_debug_dir, 1105 &error_flags); 1106 debugfs_create_x64("param1", S_IRUSR | S_IWUSR, einj_debug_dir, 1107 &error_param1); 1108 debugfs_create_x64("param2", S_IRUSR | S_IWUSR, einj_debug_dir, 1109 &error_param2); 1110 debugfs_create_x64("param3", S_IRUSR | S_IWUSR, einj_debug_dir, 1111 &error_param3); 1112 debugfs_create_x64("param4", S_IRUSR | S_IWUSR, einj_debug_dir, 1113 &error_param4); 1114 debugfs_create_x32("notrigger", S_IRUSR | S_IWUSR, 1115 einj_debug_dir, ¬rigger); 1116 if (available_error_type & ACPI65_EINJV2_SUPP) 1117 einj_v2_enabled = setup_einjv2_component_files(); 1118 } 1119 1120 if (vendor_dev[0]) { 1121 vendor_blob.data = vendor_dev; 1122 vendor_blob.size = strlen(vendor_dev); 1123 debugfs_create_blob("vendor", S_IRUSR, einj_debug_dir, 1124 &vendor_blob); 1125 debugfs_create_x32("vendor_flags", S_IRUSR | S_IWUSR, 1126 einj_debug_dir, &vendor_flags); 1127 } 1128 1129 if (vendor_errors.size) 1130 debugfs_create_blob("oem_error", 0600, einj_debug_dir, 1131 &vendor_errors); 1132 1133 pr_info("Error INJection is initialized.\n"); 1134 1135 return 0; 1136 1137 err_release: 1138 apei_resources_release(&einj_resources); 1139 err_fini: 1140 apei_resources_fini(&einj_resources); 1141 debugfs_remove_recursive(einj_debug_dir); 1142 err_put_table: 1143 acpi_put_table((struct acpi_table_header *)einj_tab); 1144 1145 return rc; 1146 } 1147 1148 static void einj_remove(struct faux_device *fdev) 1149 { 1150 struct apei_exec_context ctx; 1151 1152 if (einj_param) { 1153 acpi_size size; 1154 1155 if (v66param_size) 1156 size = v66param_size; 1157 else if (acpi5) 1158 size = v5param_size; 1159 else 1160 size = sizeof(struct einj_parameter); 1161 1162 acpi_os_unmap_iomem(einj_param, size); 1163 if (vendor_errors.size) 1164 acpi_os_unmap_memory(vendor_errors.data, vendor_errors.size); 1165 } 1166 einj_exec_ctx_init(&ctx); 1167 apei_exec_post_unmap_gars(&ctx); 1168 apei_resources_release(&einj_resources); 1169 apei_resources_fini(&einj_resources); 1170 debugfs_remove_recursive(einj_debug_dir); 1171 kfree(syndrome_data); 1172 acpi_put_table((struct acpi_table_header *)einj_tab); 1173 } 1174 1175 static struct faux_device *einj_dev; 1176 static struct faux_device_ops einj_device_ops = { 1177 .probe = einj_probe, 1178 .remove = einj_remove, 1179 }; 1180 1181 static int __init einj_init(void) 1182 { 1183 if (acpi_disabled) { 1184 pr_debug("ACPI disabled.\n"); 1185 return -ENODEV; 1186 } 1187 1188 einj_dev = faux_device_create("acpi-einj", NULL, &einj_device_ops); 1189 1190 if (einj_dev) 1191 einj_initialized = true; 1192 1193 return 0; 1194 } 1195 1196 static void __exit einj_exit(void) 1197 { 1198 faux_device_destroy(einj_dev); 1199 } 1200 1201 module_init(einj_init); 1202 module_exit(einj_exit); 1203 1204 MODULE_AUTHOR("Huang Ying"); 1205 MODULE_DESCRIPTION("APEI Error INJection support"); 1206 MODULE_LICENSE("GPL"); 1207