1 /* 2 * Thunderbolt Cactus Ridge driver - eeprom access 3 * 4 * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com> 5 */ 6 7 #include <linux/crc32.h> 8 #include <linux/property.h> 9 #include <linux/slab.h> 10 #include "tb.h" 11 12 /** 13 * tb_eeprom_ctl_write() - write control word 14 */ 15 static int tb_eeprom_ctl_write(struct tb_switch *sw, struct tb_eeprom_ctl *ctl) 16 { 17 return tb_sw_write(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + 4, 1); 18 } 19 20 /** 21 * tb_eeprom_ctl_write() - read control word 22 */ 23 static int tb_eeprom_ctl_read(struct tb_switch *sw, struct tb_eeprom_ctl *ctl) 24 { 25 return tb_sw_read(sw, ctl, TB_CFG_SWITCH, sw->cap_plug_events + 4, 1); 26 } 27 28 enum tb_eeprom_transfer { 29 TB_EEPROM_IN, 30 TB_EEPROM_OUT, 31 }; 32 33 /** 34 * tb_eeprom_active - enable rom access 35 * 36 * WARNING: Always disable access after usage. Otherwise the controller will 37 * fail to reprobe. 38 */ 39 static int tb_eeprom_active(struct tb_switch *sw, bool enable) 40 { 41 struct tb_eeprom_ctl ctl; 42 int res = tb_eeprom_ctl_read(sw, &ctl); 43 if (res) 44 return res; 45 if (enable) { 46 ctl.access_high = 1; 47 res = tb_eeprom_ctl_write(sw, &ctl); 48 if (res) 49 return res; 50 ctl.access_low = 0; 51 return tb_eeprom_ctl_write(sw, &ctl); 52 } else { 53 ctl.access_low = 1; 54 res = tb_eeprom_ctl_write(sw, &ctl); 55 if (res) 56 return res; 57 ctl.access_high = 0; 58 return tb_eeprom_ctl_write(sw, &ctl); 59 } 60 } 61 62 /** 63 * tb_eeprom_transfer - transfer one bit 64 * 65 * If TB_EEPROM_IN is passed, then the bit can be retrieved from ctl->data_in. 66 * If TB_EEPROM_OUT is passed, then ctl->data_out will be written. 67 */ 68 static int tb_eeprom_transfer(struct tb_switch *sw, struct tb_eeprom_ctl *ctl, 69 enum tb_eeprom_transfer direction) 70 { 71 int res; 72 if (direction == TB_EEPROM_OUT) { 73 res = tb_eeprom_ctl_write(sw, ctl); 74 if (res) 75 return res; 76 } 77 ctl->clock = 1; 78 res = tb_eeprom_ctl_write(sw, ctl); 79 if (res) 80 return res; 81 if (direction == TB_EEPROM_IN) { 82 res = tb_eeprom_ctl_read(sw, ctl); 83 if (res) 84 return res; 85 } 86 ctl->clock = 0; 87 return tb_eeprom_ctl_write(sw, ctl); 88 } 89 90 /** 91 * tb_eeprom_out - write one byte to the bus 92 */ 93 static int tb_eeprom_out(struct tb_switch *sw, u8 val) 94 { 95 struct tb_eeprom_ctl ctl; 96 int i; 97 int res = tb_eeprom_ctl_read(sw, &ctl); 98 if (res) 99 return res; 100 for (i = 0; i < 8; i++) { 101 ctl.data_out = val & 0x80; 102 res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_OUT); 103 if (res) 104 return res; 105 val <<= 1; 106 } 107 return 0; 108 } 109 110 /** 111 * tb_eeprom_in - read one byte from the bus 112 */ 113 static int tb_eeprom_in(struct tb_switch *sw, u8 *val) 114 { 115 struct tb_eeprom_ctl ctl; 116 int i; 117 int res = tb_eeprom_ctl_read(sw, &ctl); 118 if (res) 119 return res; 120 *val = 0; 121 for (i = 0; i < 8; i++) { 122 *val <<= 1; 123 res = tb_eeprom_transfer(sw, &ctl, TB_EEPROM_IN); 124 if (res) 125 return res; 126 *val |= ctl.data_in; 127 } 128 return 0; 129 } 130 131 /** 132 * tb_eeprom_read_n - read count bytes from offset into val 133 */ 134 static int tb_eeprom_read_n(struct tb_switch *sw, u16 offset, u8 *val, 135 size_t count) 136 { 137 int i, res; 138 res = tb_eeprom_active(sw, true); 139 if (res) 140 return res; 141 res = tb_eeprom_out(sw, 3); 142 if (res) 143 return res; 144 res = tb_eeprom_out(sw, offset >> 8); 145 if (res) 146 return res; 147 res = tb_eeprom_out(sw, offset); 148 if (res) 149 return res; 150 for (i = 0; i < count; i++) { 151 res = tb_eeprom_in(sw, val + i); 152 if (res) 153 return res; 154 } 155 return tb_eeprom_active(sw, false); 156 } 157 158 static u8 tb_crc8(u8 *data, int len) 159 { 160 int i, j; 161 u8 val = 0xff; 162 for (i = 0; i < len; i++) { 163 val ^= data[i]; 164 for (j = 0; j < 8; j++) 165 val = (val << 1) ^ ((val & 0x80) ? 7 : 0); 166 } 167 return val; 168 } 169 170 static u32 tb_crc32(void *data, size_t len) 171 { 172 return ~__crc32c_le(~0, data, len); 173 } 174 175 #define TB_DROM_DATA_START 13 176 struct tb_drom_header { 177 /* BYTE 0 */ 178 u8 uid_crc8; /* checksum for uid */ 179 /* BYTES 1-8 */ 180 u64 uid; 181 /* BYTES 9-12 */ 182 u32 data_crc32; /* checksum for data_len bytes starting at byte 13 */ 183 /* BYTE 13 */ 184 u8 device_rom_revision; /* should be <= 1 */ 185 u16 data_len:10; 186 u8 __unknown1:6; 187 /* BYTES 16-21 */ 188 u16 vendor_id; 189 u16 model_id; 190 u8 model_rev; 191 u8 eeprom_rev; 192 } __packed; 193 194 enum tb_drom_entry_type { 195 /* force unsigned to prevent "one-bit signed bitfield" warning */ 196 TB_DROM_ENTRY_GENERIC = 0U, 197 TB_DROM_ENTRY_PORT, 198 }; 199 200 struct tb_drom_entry_header { 201 u8 len; 202 u8 index:6; 203 bool port_disabled:1; /* only valid if type is TB_DROM_ENTRY_PORT */ 204 enum tb_drom_entry_type type:1; 205 } __packed; 206 207 struct tb_drom_entry_port { 208 /* BYTES 0-1 */ 209 struct tb_drom_entry_header header; 210 /* BYTE 2 */ 211 u8 dual_link_port_rid:4; 212 u8 link_nr:1; 213 u8 unknown1:2; 214 bool has_dual_link_port:1; 215 216 /* BYTE 3 */ 217 u8 dual_link_port_nr:6; 218 u8 unknown2:2; 219 220 /* BYTES 4 - 5 TODO decode */ 221 u8 micro2:4; 222 u8 micro1:4; 223 u8 micro3; 224 225 /* BYTES 6-7, TODO: verify (find hardware that has these set) */ 226 u8 peer_port_rid:4; 227 u8 unknown3:3; 228 bool has_peer_port:1; 229 u8 peer_port_nr:6; 230 u8 unknown4:2; 231 } __packed; 232 233 234 /** 235 * tb_eeprom_get_drom_offset - get drom offset within eeprom 236 */ 237 static int tb_eeprom_get_drom_offset(struct tb_switch *sw, u16 *offset) 238 { 239 struct tb_cap_plug_events cap; 240 int res; 241 if (!sw->cap_plug_events) { 242 tb_sw_warn(sw, "no TB_CAP_PLUG_EVENTS, cannot read eeprom\n"); 243 return -ENOSYS; 244 } 245 res = tb_sw_read(sw, &cap, TB_CFG_SWITCH, sw->cap_plug_events, 246 sizeof(cap) / 4); 247 if (res) 248 return res; 249 250 if (!cap.eeprom_ctl.present || cap.eeprom_ctl.not_present) { 251 tb_sw_warn(sw, "no NVM\n"); 252 return -ENOSYS; 253 } 254 255 if (cap.drom_offset > 0xffff) { 256 tb_sw_warn(sw, "drom offset is larger than 0xffff: %#x\n", 257 cap.drom_offset); 258 return -ENXIO; 259 } 260 *offset = cap.drom_offset; 261 return 0; 262 } 263 264 /** 265 * tb_drom_read_uid_only - read uid directly from drom 266 * 267 * Does not use the cached copy in sw->drom. Used during resume to check switch 268 * identity. 269 */ 270 int tb_drom_read_uid_only(struct tb_switch *sw, u64 *uid) 271 { 272 u8 data[9]; 273 u16 drom_offset; 274 u8 crc; 275 int res = tb_eeprom_get_drom_offset(sw, &drom_offset); 276 if (res) 277 return res; 278 279 /* read uid */ 280 res = tb_eeprom_read_n(sw, drom_offset, data, 9); 281 if (res) 282 return res; 283 284 crc = tb_crc8(data + 1, 8); 285 if (crc != data[0]) { 286 tb_sw_warn(sw, "uid crc8 missmatch (expected: %#x, got: %#x)\n", 287 data[0], crc); 288 return -EIO; 289 } 290 291 *uid = *(u64 *)(data+1); 292 return 0; 293 } 294 295 static void tb_drom_parse_port_entry(struct tb_port *port, 296 struct tb_drom_entry_port *entry) 297 { 298 port->link_nr = entry->link_nr; 299 if (entry->has_dual_link_port) 300 port->dual_link_port = 301 &port->sw->ports[entry->dual_link_port_nr]; 302 } 303 304 static int tb_drom_parse_entry(struct tb_switch *sw, 305 struct tb_drom_entry_header *header) 306 { 307 struct tb_port *port; 308 int res; 309 enum tb_port_type type; 310 311 if (header->type != TB_DROM_ENTRY_PORT) 312 return 0; 313 314 port = &sw->ports[header->index]; 315 port->disabled = header->port_disabled; 316 if (port->disabled) 317 return 0; 318 319 res = tb_port_read(port, &type, TB_CFG_PORT, 2, 1); 320 if (res) 321 return res; 322 type &= 0xffffff; 323 324 if (type == TB_TYPE_PORT) { 325 struct tb_drom_entry_port *entry = (void *) header; 326 if (header->len != sizeof(*entry)) { 327 tb_sw_warn(sw, 328 "port entry has size %#x (expected %#zx)\n", 329 header->len, sizeof(struct tb_drom_entry_port)); 330 return -EIO; 331 } 332 tb_drom_parse_port_entry(port, entry); 333 } 334 return 0; 335 } 336 337 /** 338 * tb_drom_parse_entries - parse the linked list of drom entries 339 * 340 * Drom must have been copied to sw->drom. 341 */ 342 static int tb_drom_parse_entries(struct tb_switch *sw) 343 { 344 struct tb_drom_header *header = (void *) sw->drom; 345 u16 pos = sizeof(*header); 346 u16 drom_size = header->data_len + TB_DROM_DATA_START; 347 348 while (pos < drom_size) { 349 struct tb_drom_entry_header *entry = (void *) (sw->drom + pos); 350 if (pos + 1 == drom_size || pos + entry->len > drom_size 351 || !entry->len) { 352 tb_sw_warn(sw, "drom buffer overrun, aborting\n"); 353 return -EIO; 354 } 355 356 tb_drom_parse_entry(sw, entry); 357 358 pos += entry->len; 359 } 360 return 0; 361 } 362 363 /** 364 * tb_drom_copy_efi - copy drom supplied by EFI to sw->drom if present 365 */ 366 static int tb_drom_copy_efi(struct tb_switch *sw, u16 *size) 367 { 368 struct device *dev = &sw->tb->nhi->pdev->dev; 369 int len, res; 370 371 len = device_property_read_u8_array(dev, "ThunderboltDROM", NULL, 0); 372 if (len < 0 || len < sizeof(struct tb_drom_header)) 373 return -EINVAL; 374 375 sw->drom = kmalloc(len, GFP_KERNEL); 376 if (!sw->drom) 377 return -ENOMEM; 378 379 res = device_property_read_u8_array(dev, "ThunderboltDROM", sw->drom, 380 len); 381 if (res) 382 goto err; 383 384 *size = ((struct tb_drom_header *)sw->drom)->data_len + 385 TB_DROM_DATA_START; 386 if (*size > len) 387 goto err; 388 389 return 0; 390 391 err: 392 kfree(sw->drom); 393 sw->drom = NULL; 394 return -EINVAL; 395 } 396 397 /** 398 * tb_drom_read - copy drom to sw->drom and parse it 399 */ 400 int tb_drom_read(struct tb_switch *sw) 401 { 402 u16 drom_offset; 403 u16 size; 404 u32 crc; 405 struct tb_drom_header *header; 406 int res; 407 if (sw->drom) 408 return 0; 409 410 if (tb_route(sw) == 0) { 411 /* 412 * Apple's NHI EFI driver supplies a DROM for the root switch 413 * in a device property. Use it if available. 414 */ 415 if (tb_drom_copy_efi(sw, &size) == 0) 416 goto parse; 417 418 /* 419 * The root switch contains only a dummy drom (header only, 420 * no entries). Hardcode the configuration here. 421 */ 422 tb_drom_read_uid_only(sw, &sw->uid); 423 424 sw->ports[1].link_nr = 0; 425 sw->ports[2].link_nr = 1; 426 sw->ports[1].dual_link_port = &sw->ports[2]; 427 sw->ports[2].dual_link_port = &sw->ports[1]; 428 429 sw->ports[3].link_nr = 0; 430 sw->ports[4].link_nr = 1; 431 sw->ports[3].dual_link_port = &sw->ports[4]; 432 sw->ports[4].dual_link_port = &sw->ports[3]; 433 434 /* Port 5 is inaccessible on this gen 1 controller */ 435 if (sw->config.device_id == PCI_DEVICE_ID_INTEL_LIGHT_RIDGE) 436 sw->ports[5].disabled = true; 437 438 return 0; 439 } 440 441 res = tb_eeprom_get_drom_offset(sw, &drom_offset); 442 if (res) 443 return res; 444 445 res = tb_eeprom_read_n(sw, drom_offset + 14, (u8 *) &size, 2); 446 if (res) 447 return res; 448 size &= 0x3ff; 449 size += TB_DROM_DATA_START; 450 tb_sw_info(sw, "reading drom (length: %#x)\n", size); 451 if (size < sizeof(*header)) { 452 tb_sw_warn(sw, "drom too small, aborting\n"); 453 return -EIO; 454 } 455 456 sw->drom = kzalloc(size, GFP_KERNEL); 457 if (!sw->drom) 458 return -ENOMEM; 459 res = tb_eeprom_read_n(sw, drom_offset, sw->drom, size); 460 if (res) 461 goto err; 462 463 parse: 464 header = (void *) sw->drom; 465 466 if (header->data_len + TB_DROM_DATA_START != size) { 467 tb_sw_warn(sw, "drom size mismatch, aborting\n"); 468 goto err; 469 } 470 471 crc = tb_crc8((u8 *) &header->uid, 8); 472 if (crc != header->uid_crc8) { 473 tb_sw_warn(sw, 474 "drom uid crc8 mismatch (expected: %#x, got: %#x), aborting\n", 475 header->uid_crc8, crc); 476 goto err; 477 } 478 sw->uid = header->uid; 479 480 crc = tb_crc32(sw->drom + TB_DROM_DATA_START, header->data_len); 481 if (crc != header->data_crc32) { 482 tb_sw_warn(sw, 483 "drom data crc32 mismatch (expected: %#x, got: %#x), aborting\n", 484 header->data_crc32, crc); 485 goto err; 486 } 487 488 if (header->device_rom_revision > 1) 489 tb_sw_warn(sw, "drom device_rom_revision %#x unknown\n", 490 header->device_rom_revision); 491 492 return tb_drom_parse_entries(sw); 493 err: 494 kfree(sw->drom); 495 sw->drom = NULL; 496 return -EIO; 497 498 } 499