1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/device.h> 4 #include <linux/err.h> 5 #include <linux/errno.h> 6 #include <linux/fs.h> 7 #include <linux/fsi-sbefifo.h> 8 #include <linux/gfp.h> 9 #include <linux/idr.h> 10 #include <linux/kernel.h> 11 #include <linux/list.h> 12 #include <linux/miscdevice.h> 13 #include <linux/mm.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 #include <linux/fsi-occ.h> 17 #include <linux/of.h> 18 #include <linux/of_device.h> 19 #include <linux/platform_device.h> 20 #include <linux/sched.h> 21 #include <linux/slab.h> 22 #include <linux/uaccess.h> 23 #include <asm/unaligned.h> 24 25 #define OCC_SRAM_BYTES 4096 26 #define OCC_CMD_DATA_BYTES 4090 27 #define OCC_RESP_DATA_BYTES 4089 28 29 #define OCC_P9_SRAM_CMD_ADDR 0xFFFBE000 30 #define OCC_P9_SRAM_RSP_ADDR 0xFFFBF000 31 32 #define OCC_P10_SRAM_CMD_ADDR 0xFFFFD000 33 #define OCC_P10_SRAM_RSP_ADDR 0xFFFFE000 34 35 #define OCC_P10_SRAM_MODE 0x58 /* Normal mode, OCB channel 2 */ 36 37 #define OCC_TIMEOUT_MS 1000 38 #define OCC_CMD_IN_PRG_WAIT_MS 50 39 40 enum versions { occ_p9, occ_p10 }; 41 42 struct occ { 43 struct device *dev; 44 struct device *sbefifo; 45 char name[32]; 46 int idx; 47 u8 sequence_number; 48 void *buffer; 49 void *client_buffer; 50 size_t client_buffer_size; 51 size_t client_response_size; 52 enum versions version; 53 struct miscdevice mdev; 54 struct mutex occ_lock; 55 }; 56 57 #define to_occ(x) container_of((x), struct occ, mdev) 58 59 struct occ_response { 60 u8 seq_no; 61 u8 cmd_type; 62 u8 return_status; 63 __be16 data_length; 64 u8 data[OCC_RESP_DATA_BYTES + 2]; /* two bytes checksum */ 65 } __packed; 66 67 struct occ_client { 68 struct occ *occ; 69 struct mutex lock; 70 size_t data_size; 71 size_t read_offset; 72 u8 *buffer; 73 }; 74 75 #define to_client(x) container_of((x), struct occ_client, xfr) 76 77 static DEFINE_IDA(occ_ida); 78 79 static int occ_open(struct inode *inode, struct file *file) 80 { 81 struct occ_client *client = kzalloc(sizeof(*client), GFP_KERNEL); 82 struct miscdevice *mdev = file->private_data; 83 struct occ *occ = to_occ(mdev); 84 85 if (!client) 86 return -ENOMEM; 87 88 client->buffer = (u8 *)__get_free_page(GFP_KERNEL); 89 if (!client->buffer) { 90 kfree(client); 91 return -ENOMEM; 92 } 93 94 client->occ = occ; 95 mutex_init(&client->lock); 96 file->private_data = client; 97 98 /* We allocate a 1-page buffer, make sure it all fits */ 99 BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE); 100 BUILD_BUG_ON((OCC_RESP_DATA_BYTES + 7) > PAGE_SIZE); 101 102 return 0; 103 } 104 105 static ssize_t occ_read(struct file *file, char __user *buf, size_t len, 106 loff_t *offset) 107 { 108 struct occ_client *client = file->private_data; 109 ssize_t rc = 0; 110 111 if (!client) 112 return -ENODEV; 113 114 if (len > OCC_SRAM_BYTES) 115 return -EINVAL; 116 117 mutex_lock(&client->lock); 118 119 /* This should not be possible ... */ 120 if (WARN_ON_ONCE(client->read_offset > client->data_size)) { 121 rc = -EIO; 122 goto done; 123 } 124 125 /* Grab how much data we have to read */ 126 rc = min(len, client->data_size - client->read_offset); 127 if (copy_to_user(buf, client->buffer + client->read_offset, rc)) 128 rc = -EFAULT; 129 else 130 client->read_offset += rc; 131 132 done: 133 mutex_unlock(&client->lock); 134 135 return rc; 136 } 137 138 static ssize_t occ_write(struct file *file, const char __user *buf, 139 size_t len, loff_t *offset) 140 { 141 struct occ_client *client = file->private_data; 142 size_t rlen, data_length; 143 ssize_t rc; 144 u8 *cmd; 145 146 if (!client) 147 return -ENODEV; 148 149 if (len > (OCC_CMD_DATA_BYTES + 3) || len < 3) 150 return -EINVAL; 151 152 mutex_lock(&client->lock); 153 154 /* Construct the command */ 155 cmd = client->buffer; 156 157 /* 158 * Copy the user command (assume user data follows the occ command 159 * format) 160 * byte 0: command type 161 * bytes 1-2: data length (msb first) 162 * bytes 3-n: data 163 */ 164 if (copy_from_user(&cmd[1], buf, len)) { 165 rc = -EFAULT; 166 goto done; 167 } 168 169 /* Extract data length */ 170 data_length = (cmd[2] << 8) + cmd[3]; 171 if (data_length > OCC_CMD_DATA_BYTES) { 172 rc = -EINVAL; 173 goto done; 174 } 175 176 /* Submit command; 4 bytes before the data and 2 bytes after */ 177 rlen = PAGE_SIZE; 178 rc = fsi_occ_submit(client->occ->dev, cmd, data_length + 6, cmd, 179 &rlen); 180 if (rc) 181 goto done; 182 183 /* Set read tracking data */ 184 client->data_size = rlen; 185 client->read_offset = 0; 186 187 /* Done */ 188 rc = len; 189 190 done: 191 mutex_unlock(&client->lock); 192 193 return rc; 194 } 195 196 static int occ_release(struct inode *inode, struct file *file) 197 { 198 struct occ_client *client = file->private_data; 199 200 free_page((unsigned long)client->buffer); 201 kfree(client); 202 203 return 0; 204 } 205 206 static const struct file_operations occ_fops = { 207 .owner = THIS_MODULE, 208 .open = occ_open, 209 .read = occ_read, 210 .write = occ_write, 211 .release = occ_release, 212 }; 213 214 static void occ_save_ffdc(struct occ *occ, __be32 *resp, size_t parsed_len, 215 size_t resp_len) 216 { 217 if (resp_len > parsed_len) { 218 size_t dh = resp_len - parsed_len; 219 size_t ffdc_len = (dh - 1) * 4; /* SBE words are four bytes */ 220 __be32 *ffdc = &resp[parsed_len]; 221 222 if (ffdc_len > occ->client_buffer_size) 223 ffdc_len = occ->client_buffer_size; 224 225 memcpy(occ->client_buffer, ffdc, ffdc_len); 226 occ->client_response_size = ffdc_len; 227 } 228 } 229 230 static int occ_verify_checksum(struct occ *occ, struct occ_response *resp, 231 u16 data_length) 232 { 233 /* Fetch the two bytes after the data for the checksum. */ 234 u16 checksum_resp = get_unaligned_be16(&resp->data[data_length]); 235 u16 checksum; 236 u16 i; 237 238 checksum = resp->seq_no; 239 checksum += resp->cmd_type; 240 checksum += resp->return_status; 241 checksum += (data_length >> 8) + (data_length & 0xFF); 242 243 for (i = 0; i < data_length; ++i) 244 checksum += resp->data[i]; 245 246 if (checksum != checksum_resp) { 247 dev_err(occ->dev, "Bad checksum: %04x!=%04x\n", checksum, 248 checksum_resp); 249 return -EBADMSG; 250 } 251 252 return 0; 253 } 254 255 static int occ_getsram(struct occ *occ, u32 offset, void *data, ssize_t len) 256 { 257 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 258 size_t cmd_len, parsed_len, resp_data_len; 259 size_t resp_len = OCC_MAX_RESP_WORDS; 260 __be32 *resp = occ->buffer; 261 __be32 cmd[6]; 262 int idx = 0, rc; 263 264 /* 265 * Magic sequence to do SBE getsram command. SBE will fetch data from 266 * specified SRAM address. 267 */ 268 switch (occ->version) { 269 default: 270 case occ_p9: 271 cmd_len = 5; 272 cmd[2] = cpu_to_be32(1); /* Normal mode */ 273 cmd[3] = cpu_to_be32(OCC_P9_SRAM_RSP_ADDR + offset); 274 break; 275 case occ_p10: 276 idx = 1; 277 cmd_len = 6; 278 cmd[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 279 cmd[3] = 0; 280 cmd[4] = cpu_to_be32(OCC_P10_SRAM_RSP_ADDR + offset); 281 break; 282 } 283 284 cmd[0] = cpu_to_be32(cmd_len); 285 cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_OCC_SRAM); 286 cmd[4 + idx] = cpu_to_be32(data_len); 287 288 rc = sbefifo_submit(occ->sbefifo, cmd, cmd_len, resp, &resp_len); 289 if (rc) 290 return rc; 291 292 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_GET_OCC_SRAM, 293 resp, resp_len, &parsed_len); 294 if (rc > 0) { 295 dev_err(occ->dev, "SRAM read returned failure status: %08x\n", 296 rc); 297 occ_save_ffdc(occ, resp, parsed_len, resp_len); 298 return -ECOMM; 299 } else if (rc) { 300 return rc; 301 } 302 303 resp_data_len = be32_to_cpu(resp[parsed_len - 1]); 304 if (resp_data_len != data_len) { 305 dev_err(occ->dev, "SRAM read expected %d bytes got %zd\n", 306 data_len, resp_data_len); 307 rc = -EBADMSG; 308 } else { 309 memcpy(data, resp, len); 310 } 311 312 return rc; 313 } 314 315 static int occ_putsram(struct occ *occ, const void *data, ssize_t len, 316 u8 seq_no, u16 checksum) 317 { 318 u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */ 319 size_t cmd_len, parsed_len, resp_data_len; 320 size_t resp_len = OCC_MAX_RESP_WORDS; 321 __be32 *buf = occ->buffer; 322 u8 *byte_buf; 323 int idx = 0, rc; 324 325 cmd_len = (occ->version == occ_p10) ? 6 : 5; 326 cmd_len += data_len >> 2; 327 328 /* 329 * Magic sequence to do SBE putsram command. SBE will transfer 330 * data to specified SRAM address. 331 */ 332 buf[0] = cpu_to_be32(cmd_len); 333 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 334 335 switch (occ->version) { 336 default: 337 case occ_p9: 338 buf[2] = cpu_to_be32(1); /* Normal mode */ 339 buf[3] = cpu_to_be32(OCC_P9_SRAM_CMD_ADDR); 340 break; 341 case occ_p10: 342 idx = 1; 343 buf[2] = cpu_to_be32(OCC_P10_SRAM_MODE); 344 buf[3] = 0; 345 buf[4] = cpu_to_be32(OCC_P10_SRAM_CMD_ADDR); 346 break; 347 } 348 349 buf[4 + idx] = cpu_to_be32(data_len); 350 memcpy(&buf[5 + idx], data, len); 351 352 byte_buf = (u8 *)&buf[5 + idx]; 353 /* 354 * Overwrite the first byte with our sequence number and the last two 355 * bytes with the checksum. 356 */ 357 byte_buf[0] = seq_no; 358 byte_buf[len - 2] = checksum >> 8; 359 byte_buf[len - 1] = checksum & 0xff; 360 361 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 362 if (rc) 363 return rc; 364 365 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 366 buf, resp_len, &parsed_len); 367 if (rc > 0) { 368 dev_err(occ->dev, "SRAM write returned failure status: %08x\n", 369 rc); 370 occ_save_ffdc(occ, buf, parsed_len, resp_len); 371 return -ECOMM; 372 } else if (rc) { 373 return rc; 374 } 375 376 if (parsed_len != 1) { 377 dev_err(occ->dev, "SRAM write response length invalid: %zd\n", 378 parsed_len); 379 rc = -EBADMSG; 380 } else { 381 resp_data_len = be32_to_cpu(buf[0]); 382 if (resp_data_len != data_len) { 383 dev_err(occ->dev, 384 "SRAM write expected %d bytes got %zd\n", 385 data_len, resp_data_len); 386 rc = -EBADMSG; 387 } 388 } 389 390 return rc; 391 } 392 393 static int occ_trigger_attn(struct occ *occ) 394 { 395 __be32 *buf = occ->buffer; 396 size_t cmd_len, parsed_len, resp_data_len; 397 size_t resp_len = OCC_MAX_RESP_WORDS; 398 int idx = 0, rc; 399 400 switch (occ->version) { 401 default: 402 case occ_p9: 403 cmd_len = 7; 404 buf[2] = cpu_to_be32(3); /* Circular mode */ 405 buf[3] = 0; 406 break; 407 case occ_p10: 408 idx = 1; 409 cmd_len = 8; 410 buf[2] = cpu_to_be32(0xd0); /* Circular mode, OCB Channel 1 */ 411 buf[3] = 0; 412 buf[4] = 0; 413 break; 414 } 415 416 buf[0] = cpu_to_be32(cmd_len); /* Chip-op length in words */ 417 buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM); 418 buf[4 + idx] = cpu_to_be32(8); /* Data length in bytes */ 419 buf[5 + idx] = cpu_to_be32(0x20010000); /* Trigger OCC attention */ 420 buf[6 + idx] = 0; 421 422 rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len); 423 if (rc) 424 return rc; 425 426 rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM, 427 buf, resp_len, &parsed_len); 428 if (rc > 0) { 429 dev_err(occ->dev, "SRAM attn returned failure status: %08x\n", 430 rc); 431 occ_save_ffdc(occ, buf, parsed_len, resp_len); 432 return -ECOMM; 433 } else if (rc) { 434 return rc; 435 } 436 437 if (parsed_len != 1) { 438 dev_err(occ->dev, "SRAM attn response length invalid: %zd\n", 439 parsed_len); 440 rc = -EBADMSG; 441 } else { 442 resp_data_len = be32_to_cpu(buf[0]); 443 if (resp_data_len != 8) { 444 dev_err(occ->dev, 445 "SRAM attn expected 8 bytes got %zd\n", 446 resp_data_len); 447 rc = -EBADMSG; 448 } 449 } 450 451 return rc; 452 } 453 454 static bool fsi_occ_response_not_ready(struct occ_response *resp, u8 seq_no, 455 u8 cmd_type) 456 { 457 return resp->return_status == OCC_RESP_CMD_IN_PRG || 458 resp->return_status == OCC_RESP_CRIT_INIT || 459 resp->seq_no != seq_no || resp->cmd_type != cmd_type; 460 } 461 462 int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, 463 void *response, size_t *resp_len) 464 { 465 const unsigned long timeout = msecs_to_jiffies(OCC_TIMEOUT_MS); 466 const unsigned long wait_time = 467 msecs_to_jiffies(OCC_CMD_IN_PRG_WAIT_MS); 468 struct occ *occ = dev_get_drvdata(dev); 469 struct occ_response *resp = response; 470 size_t user_resp_len = *resp_len; 471 u8 seq_no; 472 u8 cmd_type; 473 u16 checksum = 0; 474 u16 resp_data_length; 475 const u8 *byte_request = (const u8 *)request; 476 unsigned long end; 477 int rc; 478 size_t i; 479 480 *resp_len = 0; 481 482 if (!occ) 483 return -ENODEV; 484 485 if (user_resp_len < 7) { 486 dev_dbg(dev, "Bad resplen %zd\n", user_resp_len); 487 return -EINVAL; 488 } 489 490 cmd_type = byte_request[1]; 491 492 /* Checksum the request, ignoring first byte (sequence number). */ 493 for (i = 1; i < req_len - 2; ++i) 494 checksum += byte_request[i]; 495 496 mutex_lock(&occ->occ_lock); 497 498 occ->client_buffer = response; 499 occ->client_buffer_size = user_resp_len; 500 occ->client_response_size = 0; 501 502 /* 503 * Get a sequence number and update the counter. Avoid a sequence 504 * number of 0 which would pass the response check below even if the 505 * OCC response is uninitialized. Any sequence number the user is 506 * trying to send is overwritten since this function is the only common 507 * interface to the OCC and therefore the only place we can guarantee 508 * unique sequence numbers. 509 */ 510 seq_no = occ->sequence_number++; 511 if (!occ->sequence_number) 512 occ->sequence_number = 1; 513 checksum += seq_no; 514 515 rc = occ_putsram(occ, request, req_len, seq_no, checksum); 516 if (rc) 517 goto done; 518 519 rc = occ_trigger_attn(occ); 520 if (rc) 521 goto done; 522 523 end = jiffies + timeout; 524 while (true) { 525 /* Read occ response header */ 526 rc = occ_getsram(occ, 0, resp, 8); 527 if (rc) 528 goto done; 529 530 if (fsi_occ_response_not_ready(resp, seq_no, cmd_type)) { 531 if (time_after(jiffies, end)) { 532 dev_err(occ->dev, 533 "resp timeout status=%02x seq=%d cmd=%d, our seq=%d cmd=%d\n", 534 resp->return_status, resp->seq_no, 535 resp->cmd_type, seq_no, cmd_type); 536 rc = -ETIMEDOUT; 537 goto done; 538 } 539 540 set_current_state(TASK_UNINTERRUPTIBLE); 541 schedule_timeout(wait_time); 542 } else { 543 /* Extract size of response data */ 544 resp_data_length = 545 get_unaligned_be16(&resp->data_length); 546 547 /* 548 * Message size is data length + 5 bytes header + 2 549 * bytes checksum 550 */ 551 if ((resp_data_length + 7) > user_resp_len) { 552 rc = -EMSGSIZE; 553 goto done; 554 } 555 556 /* 557 * Get the entire response including the header again, 558 * in case it changed 559 */ 560 if (resp_data_length > 1) { 561 rc = occ_getsram(occ, 0, resp, 562 resp_data_length + 7); 563 if (rc) 564 goto done; 565 566 if (!fsi_occ_response_not_ready(resp, seq_no, 567 cmd_type)) 568 break; 569 } else { 570 break; 571 } 572 } 573 } 574 575 dev_dbg(dev, "resp_status=%02x resp_data_len=%d\n", 576 resp->return_status, resp_data_length); 577 578 occ->client_response_size = resp_data_length + 7; 579 rc = occ_verify_checksum(occ, resp, resp_data_length); 580 581 done: 582 *resp_len = occ->client_response_size; 583 mutex_unlock(&occ->occ_lock); 584 585 return rc; 586 } 587 EXPORT_SYMBOL_GPL(fsi_occ_submit); 588 589 static int occ_unregister_child(struct device *dev, void *data) 590 { 591 struct platform_device *hwmon_dev = to_platform_device(dev); 592 593 platform_device_unregister(hwmon_dev); 594 595 return 0; 596 } 597 598 static int occ_probe(struct platform_device *pdev) 599 { 600 int rc; 601 u32 reg; 602 struct occ *occ; 603 struct platform_device *hwmon_dev; 604 struct device *dev = &pdev->dev; 605 struct platform_device_info hwmon_dev_info = { 606 .parent = dev, 607 .name = "occ-hwmon", 608 }; 609 610 occ = devm_kzalloc(dev, sizeof(*occ), GFP_KERNEL); 611 if (!occ) 612 return -ENOMEM; 613 614 /* SBE words are always four bytes */ 615 occ->buffer = kvmalloc(OCC_MAX_RESP_WORDS * 4, GFP_KERNEL); 616 if (!occ->buffer) 617 return -ENOMEM; 618 619 occ->version = (uintptr_t)of_device_get_match_data(dev); 620 occ->dev = dev; 621 occ->sbefifo = dev->parent; 622 /* 623 * Quickly derive a pseudo-random number from jiffies so that 624 * re-probing the driver doesn't accidentally overlap sequence numbers. 625 */ 626 occ->sequence_number = (u8)((jiffies % 0xff) + 1); 627 mutex_init(&occ->occ_lock); 628 629 if (dev->of_node) { 630 rc = of_property_read_u32(dev->of_node, "reg", ®); 631 if (!rc) { 632 /* make sure we don't have a duplicate from dts */ 633 occ->idx = ida_simple_get(&occ_ida, reg, reg + 1, 634 GFP_KERNEL); 635 if (occ->idx < 0) 636 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 637 GFP_KERNEL); 638 } else { 639 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, 640 GFP_KERNEL); 641 } 642 } else { 643 occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, GFP_KERNEL); 644 } 645 646 platform_set_drvdata(pdev, occ); 647 648 snprintf(occ->name, sizeof(occ->name), "occ%d", occ->idx); 649 occ->mdev.fops = &occ_fops; 650 occ->mdev.minor = MISC_DYNAMIC_MINOR; 651 occ->mdev.name = occ->name; 652 occ->mdev.parent = dev; 653 654 rc = misc_register(&occ->mdev); 655 if (rc) { 656 dev_err(dev, "failed to register miscdevice: %d\n", rc); 657 ida_simple_remove(&occ_ida, occ->idx); 658 kvfree(occ->buffer); 659 return rc; 660 } 661 662 hwmon_dev_info.id = occ->idx; 663 hwmon_dev = platform_device_register_full(&hwmon_dev_info); 664 if (IS_ERR(hwmon_dev)) 665 dev_warn(dev, "failed to create hwmon device\n"); 666 667 return 0; 668 } 669 670 static int occ_remove(struct platform_device *pdev) 671 { 672 struct occ *occ = platform_get_drvdata(pdev); 673 674 kvfree(occ->buffer); 675 676 misc_deregister(&occ->mdev); 677 678 device_for_each_child(&pdev->dev, NULL, occ_unregister_child); 679 680 ida_simple_remove(&occ_ida, occ->idx); 681 682 return 0; 683 } 684 685 static const struct of_device_id occ_match[] = { 686 { 687 .compatible = "ibm,p9-occ", 688 .data = (void *)occ_p9 689 }, 690 { 691 .compatible = "ibm,p10-occ", 692 .data = (void *)occ_p10 693 }, 694 { }, 695 }; 696 MODULE_DEVICE_TABLE(of, occ_match); 697 698 static struct platform_driver occ_driver = { 699 .driver = { 700 .name = "occ", 701 .of_match_table = occ_match, 702 }, 703 .probe = occ_probe, 704 .remove = occ_remove, 705 }; 706 707 static int occ_init(void) 708 { 709 return platform_driver_register(&occ_driver); 710 } 711 712 static void occ_exit(void) 713 { 714 platform_driver_unregister(&occ_driver); 715 716 ida_destroy(&occ_ida); 717 } 718 719 module_init(occ_init); 720 module_exit(occ_exit); 721 722 MODULE_AUTHOR("Eddie James <eajames@linux.ibm.com>"); 723 MODULE_DESCRIPTION("BMC P9 OCC driver"); 724 MODULE_LICENSE("GPL"); 725