1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * NVM helpers
4  *
5  * Copyright (C) 2020, Intel Corporation
6  * Author: Mika Westerberg <mika.westerberg@linux.intel.com>
7  */
8 
9 #include <linux/idr.h>
10 #include <linux/slab.h>
11 #include <linux/vmalloc.h>
12 
13 #include "tb.h"
14 
15 #define NVM_MIN_SIZE		SZ_32K
16 #define NVM_MAX_SIZE		SZ_1M
17 #define NVM_DATA_DWORDS		16
18 
19 /* Intel specific NVM offsets */
20 #define INTEL_NVM_DEVID			0x05
21 #define INTEL_NVM_VERSION		0x08
22 #define INTEL_NVM_CSS			0x10
23 #define INTEL_NVM_FLASH_SIZE		0x45
24 
25 /* ASMedia specific NVM offsets */
26 #define ASMEDIA_NVM_DATE		0x1c
27 #define ASMEDIA_NVM_VERSION		0x28
28 
29 static DEFINE_IDA(nvm_ida);
30 
31 /**
32  * struct tb_nvm_vendor_ops - Vendor specific NVM operations
33  * @read_version: Reads out NVM version from the flash
34  * @validate: Validates the NVM image before update (optional)
35  * @write_headers: Writes headers before the rest of the image (optional)
36  */
37 struct tb_nvm_vendor_ops {
38 	int (*read_version)(struct tb_nvm *nvm);
39 	int (*validate)(struct tb_nvm *nvm);
40 	int (*write_headers)(struct tb_nvm *nvm);
41 };
42 
43 /**
44  * struct tb_nvm_vendor - Vendor to &struct tb_nvm_vendor_ops mapping
45  * @vendor: Vendor ID
46  * @vops: Vendor specific NVM operations
47  *
48  * Maps vendor ID to NVM vendor operations. If there is no mapping then
49  * NVM firmware upgrade is disabled for the device.
50  */
51 struct tb_nvm_vendor {
52 	u16 vendor;
53 	const struct tb_nvm_vendor_ops *vops;
54 };
55 
intel_switch_nvm_version(struct tb_nvm * nvm)56 static int intel_switch_nvm_version(struct tb_nvm *nvm)
57 {
58 	struct tb_switch *sw = tb_to_switch(nvm->dev);
59 	u32 val, nvm_size, hdr_size;
60 	int ret;
61 
62 	/*
63 	 * If the switch is in safe-mode the only accessible portion of
64 	 * the NVM is the non-active one where userspace is expected to
65 	 * write new functional NVM.
66 	 */
67 	if (sw->safe_mode)
68 		return 0;
69 
70 	ret = tb_switch_nvm_read(sw, INTEL_NVM_FLASH_SIZE, &val, sizeof(val));
71 	if (ret)
72 		return ret;
73 
74 	hdr_size = sw->generation < 3 ? SZ_8K : SZ_16K;
75 	nvm_size = (SZ_1M << (val & 7)) / 8;
76 	nvm_size = (nvm_size - hdr_size) / 2;
77 
78 	ret = tb_switch_nvm_read(sw, INTEL_NVM_VERSION, &val, sizeof(val));
79 	if (ret)
80 		return ret;
81 
82 	nvm->major = (val >> 16) & 0xff;
83 	nvm->minor = (val >> 8) & 0xff;
84 	nvm->active_size = nvm_size;
85 
86 	return 0;
87 }
88 
intel_switch_nvm_validate(struct tb_nvm * nvm)89 static int intel_switch_nvm_validate(struct tb_nvm *nvm)
90 {
91 	struct tb_switch *sw = tb_to_switch(nvm->dev);
92 	unsigned int image_size, hdr_size;
93 	u16 ds_size, device_id;
94 	u8 *buf = nvm->buf;
95 
96 	image_size = nvm->buf_data_size;
97 
98 	/*
99 	 * FARB pointer must point inside the image and must at least
100 	 * contain parts of the digital section we will be reading here.
101 	 */
102 	hdr_size = (*(u32 *)buf) & 0xffffff;
103 	if (hdr_size + INTEL_NVM_DEVID + 2 >= image_size)
104 		return -EINVAL;
105 
106 	/* Digital section start should be aligned to 4k page */
107 	if (!IS_ALIGNED(hdr_size, SZ_4K))
108 		return -EINVAL;
109 
110 	/*
111 	 * Read digital section size and check that it also fits inside
112 	 * the image.
113 	 */
114 	ds_size = *(u16 *)(buf + hdr_size);
115 	if (ds_size >= image_size)
116 		return -EINVAL;
117 
118 	if (sw->safe_mode)
119 		return 0;
120 
121 	/*
122 	 * Make sure the device ID in the image matches the one
123 	 * we read from the switch config space.
124 	 */
125 	device_id = *(u16 *)(buf + hdr_size + INTEL_NVM_DEVID);
126 	if (device_id != sw->config.device_id)
127 		return -EINVAL;
128 
129 	/* Skip headers in the image */
130 	nvm->buf_data_start = buf + hdr_size;
131 	nvm->buf_data_size = image_size - hdr_size;
132 
133 	return 0;
134 }
135 
intel_switch_nvm_write_headers(struct tb_nvm * nvm)136 static int intel_switch_nvm_write_headers(struct tb_nvm *nvm)
137 {
138 	struct tb_switch *sw = tb_to_switch(nvm->dev);
139 
140 	if (sw->generation < 3) {
141 		int ret;
142 
143 		/* Write CSS headers first */
144 		ret = dma_port_flash_write(sw->dma_port,
145 			DMA_PORT_CSS_ADDRESS, nvm->buf + INTEL_NVM_CSS,
146 			DMA_PORT_CSS_MAX_SIZE);
147 		if (ret)
148 			return ret;
149 	}
150 
151 	return 0;
152 }
153 
154 static const struct tb_nvm_vendor_ops intel_switch_nvm_ops = {
155 	.read_version = intel_switch_nvm_version,
156 	.validate = intel_switch_nvm_validate,
157 	.write_headers = intel_switch_nvm_write_headers,
158 };
159 
asmedia_switch_nvm_version(struct tb_nvm * nvm)160 static int asmedia_switch_nvm_version(struct tb_nvm *nvm)
161 {
162 	struct tb_switch *sw = tb_to_switch(nvm->dev);
163 	u32 val;
164 	int ret;
165 
166 	ret = tb_switch_nvm_read(sw, ASMEDIA_NVM_VERSION, &val, sizeof(val));
167 	if (ret)
168 		return ret;
169 
170 	nvm->major = (val << 16) & 0xff0000;
171 	nvm->major |= val & 0x00ff00;
172 	nvm->major |= (val >> 16) & 0x0000ff;
173 
174 	ret = tb_switch_nvm_read(sw, ASMEDIA_NVM_DATE, &val, sizeof(val));
175 	if (ret)
176 		return ret;
177 
178 	nvm->minor = (val << 16) & 0xff0000;
179 	nvm->minor |= val & 0x00ff00;
180 	nvm->minor |= (val >> 16) & 0x0000ff;
181 
182 	/* ASMedia NVM size is fixed to 512k */
183 	nvm->active_size = SZ_512K;
184 
185 	return 0;
186 }
187 
188 static const struct tb_nvm_vendor_ops asmedia_switch_nvm_ops = {
189 	.read_version = asmedia_switch_nvm_version,
190 };
191 
192 /* Router vendor NVM support table */
193 static const struct tb_nvm_vendor switch_nvm_vendors[] = {
194 	{ 0x174c, &asmedia_switch_nvm_ops },
195 	{ PCI_VENDOR_ID_INTEL, &intel_switch_nvm_ops },
196 	{ 0x8087, &intel_switch_nvm_ops },
197 };
198 
intel_retimer_nvm_version(struct tb_nvm * nvm)199 static int intel_retimer_nvm_version(struct tb_nvm *nvm)
200 {
201 	struct tb_retimer *rt = tb_to_retimer(nvm->dev);
202 	u32 val, nvm_size;
203 	int ret;
204 
205 	ret = tb_retimer_nvm_read(rt, INTEL_NVM_VERSION, &val, sizeof(val));
206 	if (ret)
207 		return ret;
208 
209 	nvm->major = (val >> 16) & 0xff;
210 	nvm->minor = (val >> 8) & 0xff;
211 
212 	ret = tb_retimer_nvm_read(rt, INTEL_NVM_FLASH_SIZE, &val, sizeof(val));
213 	if (ret)
214 		return ret;
215 
216 	nvm_size = (SZ_1M << (val & 7)) / 8;
217 	nvm_size = (nvm_size - SZ_16K) / 2;
218 	nvm->active_size = nvm_size;
219 
220 	return 0;
221 }
222 
intel_retimer_nvm_validate(struct tb_nvm * nvm)223 static int intel_retimer_nvm_validate(struct tb_nvm *nvm)
224 {
225 	struct tb_retimer *rt = tb_to_retimer(nvm->dev);
226 	unsigned int image_size, hdr_size;
227 	u8 *buf = nvm->buf;
228 	u16 ds_size, device;
229 
230 	image_size = nvm->buf_data_size;
231 
232 	/*
233 	 * FARB pointer must point inside the image and must at least
234 	 * contain parts of the digital section we will be reading here.
235 	 */
236 	hdr_size = (*(u32 *)buf) & 0xffffff;
237 	if (hdr_size + INTEL_NVM_DEVID + 2 >= image_size)
238 		return -EINVAL;
239 
240 	/* Digital section start should be aligned to 4k page */
241 	if (!IS_ALIGNED(hdr_size, SZ_4K))
242 		return -EINVAL;
243 
244 	/*
245 	 * Read digital section size and check that it also fits inside
246 	 * the image.
247 	 */
248 	ds_size = *(u16 *)(buf + hdr_size);
249 	if (ds_size >= image_size)
250 		return -EINVAL;
251 
252 	/*
253 	 * Make sure the device ID in the image matches the retimer
254 	 * hardware.
255 	 */
256 	device = *(u16 *)(buf + hdr_size + INTEL_NVM_DEVID);
257 	if (device != rt->device)
258 		return -EINVAL;
259 
260 	/* Skip headers in the image */
261 	nvm->buf_data_start = buf + hdr_size;
262 	nvm->buf_data_size = image_size - hdr_size;
263 
264 	return 0;
265 }
266 
267 static const struct tb_nvm_vendor_ops intel_retimer_nvm_ops = {
268 	.read_version = intel_retimer_nvm_version,
269 	.validate = intel_retimer_nvm_validate,
270 };
271 
272 /* Retimer vendor NVM support table */
273 static const struct tb_nvm_vendor retimer_nvm_vendors[] = {
274 	{ 0x8087, &intel_retimer_nvm_ops },
275 };
276 
277 /**
278  * tb_nvm_alloc() - Allocate new NVM structure
279  * @dev: Device owning the NVM
280  *
281  * Allocates new NVM structure with unique @id and returns it. In case
282  * of error returns ERR_PTR(). Specifically returns %-EOPNOTSUPP if the
283  * NVM format of the @dev is not known by the kernel.
284  */
tb_nvm_alloc(struct device * dev)285 struct tb_nvm *tb_nvm_alloc(struct device *dev)
286 {
287 	const struct tb_nvm_vendor_ops *vops = NULL;
288 	struct tb_nvm *nvm;
289 	int ret, i;
290 
291 	if (tb_is_switch(dev)) {
292 		const struct tb_switch *sw = tb_to_switch(dev);
293 
294 		for (i = 0; i < ARRAY_SIZE(switch_nvm_vendors); i++) {
295 			const struct tb_nvm_vendor *v = &switch_nvm_vendors[i];
296 
297 			if (v->vendor == sw->config.vendor_id) {
298 				vops = v->vops;
299 				break;
300 			}
301 		}
302 
303 		if (!vops) {
304 			tb_sw_dbg(sw, "router NVM format of vendor %#x unknown\n",
305 				  sw->config.vendor_id);
306 			return ERR_PTR(-EOPNOTSUPP);
307 		}
308 	} else if (tb_is_retimer(dev)) {
309 		const struct tb_retimer *rt = tb_to_retimer(dev);
310 
311 		for (i = 0; i < ARRAY_SIZE(retimer_nvm_vendors); i++) {
312 			const struct tb_nvm_vendor *v = &retimer_nvm_vendors[i];
313 
314 			if (v->vendor == rt->vendor) {
315 				vops = v->vops;
316 				break;
317 			}
318 		}
319 
320 		if (!vops) {
321 			dev_dbg(dev, "retimer NVM format of vendor %#x unknown\n",
322 				rt->vendor);
323 			return ERR_PTR(-EOPNOTSUPP);
324 		}
325 	} else {
326 		return ERR_PTR(-EOPNOTSUPP);
327 	}
328 
329 	nvm = kzalloc(sizeof(*nvm), GFP_KERNEL);
330 	if (!nvm)
331 		return ERR_PTR(-ENOMEM);
332 
333 	ret = ida_simple_get(&nvm_ida, 0, 0, GFP_KERNEL);
334 	if (ret < 0) {
335 		kfree(nvm);
336 		return ERR_PTR(ret);
337 	}
338 
339 	nvm->id = ret;
340 	nvm->dev = dev;
341 	nvm->vops = vops;
342 
343 	return nvm;
344 }
345 
346 /**
347  * tb_nvm_read_version() - Read and populate NVM version
348  * @nvm: NVM structure
349  *
350  * Uses vendor specific means to read out and fill in the existing
351  * active NVM version. Returns %0 in case of success and negative errno
352  * otherwise.
353  */
tb_nvm_read_version(struct tb_nvm * nvm)354 int tb_nvm_read_version(struct tb_nvm *nvm)
355 {
356 	const struct tb_nvm_vendor_ops *vops = nvm->vops;
357 
358 	if (vops && vops->read_version)
359 		return vops->read_version(nvm);
360 
361 	return -EOPNOTSUPP;
362 }
363 
364 /**
365  * tb_nvm_validate() - Validate new NVM image
366  * @nvm: NVM structure
367  *
368  * Runs vendor specific validation over the new NVM image and if all
369  * checks pass returns %0. As side effect updates @nvm->buf_data_start
370  * and @nvm->buf_data_size fields to match the actual data to be written
371  * to the NVM.
372  *
373  * If the validation does not pass then returns negative errno.
374  */
tb_nvm_validate(struct tb_nvm * nvm)375 int tb_nvm_validate(struct tb_nvm *nvm)
376 {
377 	const struct tb_nvm_vendor_ops *vops = nvm->vops;
378 	unsigned int image_size;
379 	u8 *buf = nvm->buf;
380 
381 	if (!buf)
382 		return -EINVAL;
383 	if (!vops)
384 		return -EOPNOTSUPP;
385 
386 	/* Just do basic image size checks */
387 	image_size = nvm->buf_data_size;
388 	if (image_size < NVM_MIN_SIZE || image_size > NVM_MAX_SIZE)
389 		return -EINVAL;
390 
391 	/*
392 	 * Set the default data start in the buffer. The validate method
393 	 * below can change this if needed.
394 	 */
395 	nvm->buf_data_start = buf;
396 
397 	return vops->validate ? vops->validate(nvm) : 0;
398 }
399 
400 /**
401  * tb_nvm_write_headers() - Write headers before the rest of the image
402  * @nvm: NVM structure
403  *
404  * If the vendor NVM format requires writing headers before the rest of
405  * the image, this function does that. Can be called even if the device
406  * does not need this.
407  *
408  * Returns %0 in case of success and negative errno otherwise.
409  */
tb_nvm_write_headers(struct tb_nvm * nvm)410 int tb_nvm_write_headers(struct tb_nvm *nvm)
411 {
412 	const struct tb_nvm_vendor_ops *vops = nvm->vops;
413 
414 	return vops->write_headers ? vops->write_headers(nvm) : 0;
415 }
416 
417 /**
418  * tb_nvm_add_active() - Adds active NVMem device to NVM
419  * @nvm: NVM structure
420  * @reg_read: Pointer to the function to read the NVM (passed directly to the
421  *	      NVMem device)
422  *
423  * Registers new active NVmem device for @nvm. The @reg_read is called
424  * directly from NVMem so it must handle possible concurrent access if
425  * needed. The first parameter passed to @reg_read is @nvm structure.
426  * Returns %0 in success and negative errno otherwise.
427  */
tb_nvm_add_active(struct tb_nvm * nvm,nvmem_reg_read_t reg_read)428 int tb_nvm_add_active(struct tb_nvm *nvm, nvmem_reg_read_t reg_read)
429 {
430 	struct nvmem_config config;
431 	struct nvmem_device *nvmem;
432 
433 	memset(&config, 0, sizeof(config));
434 
435 	config.name = "nvm_active";
436 	config.reg_read = reg_read;
437 	config.read_only = true;
438 	config.id = nvm->id;
439 	config.stride = 4;
440 	config.word_size = 4;
441 	config.size = nvm->active_size;
442 	config.dev = nvm->dev;
443 	config.owner = THIS_MODULE;
444 	config.priv = nvm;
445 
446 	nvmem = nvmem_register(&config);
447 	if (IS_ERR(nvmem))
448 		return PTR_ERR(nvmem);
449 
450 	nvm->active = nvmem;
451 	return 0;
452 }
453 
454 /**
455  * tb_nvm_write_buf() - Write data to @nvm buffer
456  * @nvm: NVM structure
457  * @offset: Offset where to write the data
458  * @val: Data buffer to write
459  * @bytes: Number of bytes to write
460  *
461  * Helper function to cache the new NVM image before it is actually
462  * written to the flash. Copies @bytes from @val to @nvm->buf starting
463  * from @offset.
464  */
tb_nvm_write_buf(struct tb_nvm * nvm,unsigned int offset,void * val,size_t bytes)465 int tb_nvm_write_buf(struct tb_nvm *nvm, unsigned int offset, void *val,
466 		     size_t bytes)
467 {
468 	if (!nvm->buf) {
469 		nvm->buf = vmalloc(NVM_MAX_SIZE);
470 		if (!nvm->buf)
471 			return -ENOMEM;
472 	}
473 
474 	nvm->flushed = false;
475 	nvm->buf_data_size = offset + bytes;
476 	memcpy(nvm->buf + offset, val, bytes);
477 	return 0;
478 }
479 
480 /**
481  * tb_nvm_add_non_active() - Adds non-active NVMem device to NVM
482  * @nvm: NVM structure
483  * @reg_write: Pointer to the function to write the NVM (passed directly
484  *	       to the NVMem device)
485  *
486  * Registers new non-active NVmem device for @nvm. The @reg_write is called
487  * directly from NVMem so it must handle possible concurrent access if
488  * needed. The first parameter passed to @reg_write is @nvm structure.
489  * The size of the NVMem device is set to %NVM_MAX_SIZE.
490  *
491  * Returns %0 in success and negative errno otherwise.
492  */
tb_nvm_add_non_active(struct tb_nvm * nvm,nvmem_reg_write_t reg_write)493 int tb_nvm_add_non_active(struct tb_nvm *nvm, nvmem_reg_write_t reg_write)
494 {
495 	struct nvmem_config config;
496 	struct nvmem_device *nvmem;
497 
498 	memset(&config, 0, sizeof(config));
499 
500 	config.name = "nvm_non_active";
501 	config.reg_write = reg_write;
502 	config.root_only = true;
503 	config.id = nvm->id;
504 	config.stride = 4;
505 	config.word_size = 4;
506 	config.size = NVM_MAX_SIZE;
507 	config.dev = nvm->dev;
508 	config.owner = THIS_MODULE;
509 	config.priv = nvm;
510 
511 	nvmem = nvmem_register(&config);
512 	if (IS_ERR(nvmem))
513 		return PTR_ERR(nvmem);
514 
515 	nvm->non_active = nvmem;
516 	return 0;
517 }
518 
519 /**
520  * tb_nvm_free() - Release NVM and its resources
521  * @nvm: NVM structure to release
522  *
523  * Releases NVM and the NVMem devices if they were registered.
524  */
tb_nvm_free(struct tb_nvm * nvm)525 void tb_nvm_free(struct tb_nvm *nvm)
526 {
527 	if (nvm) {
528 		nvmem_unregister(nvm->non_active);
529 		nvmem_unregister(nvm->active);
530 		vfree(nvm->buf);
531 		ida_simple_remove(&nvm_ida, nvm->id);
532 	}
533 	kfree(nvm);
534 }
535 
536 /**
537  * tb_nvm_read_data() - Read data from NVM
538  * @address: Start address on the flash
539  * @buf: Buffer where the read data is copied
540  * @size: Size of the buffer in bytes
541  * @retries: Number of retries if block read fails
542  * @read_block: Function that reads block from the flash
543  * @read_block_data: Data passsed to @read_block
544  *
545  * This is a generic function that reads data from NVM or NVM like
546  * device.
547  *
548  * Returns %0 on success and negative errno otherwise.
549  */
tb_nvm_read_data(unsigned int address,void * buf,size_t size,unsigned int retries,read_block_fn read_block,void * read_block_data)550 int tb_nvm_read_data(unsigned int address, void *buf, size_t size,
551 		     unsigned int retries, read_block_fn read_block,
552 		     void *read_block_data)
553 {
554 	do {
555 		unsigned int dwaddress, dwords, offset;
556 		u8 data[NVM_DATA_DWORDS * 4];
557 		size_t nbytes;
558 		int ret;
559 
560 		offset = address & 3;
561 		nbytes = min_t(size_t, size + offset, NVM_DATA_DWORDS * 4);
562 
563 		dwaddress = address / 4;
564 		dwords = ALIGN(nbytes, 4) / 4;
565 
566 		ret = read_block(read_block_data, dwaddress, data, dwords);
567 		if (ret) {
568 			if (ret != -ENODEV && retries--)
569 				continue;
570 			return ret;
571 		}
572 
573 		nbytes -= offset;
574 		memcpy(buf, data + offset, nbytes);
575 
576 		size -= nbytes;
577 		address += nbytes;
578 		buf += nbytes;
579 	} while (size > 0);
580 
581 	return 0;
582 }
583 
584 /**
585  * tb_nvm_write_data() - Write data to NVM
586  * @address: Start address on the flash
587  * @buf: Buffer where the data is copied from
588  * @size: Size of the buffer in bytes
589  * @retries: Number of retries if the block write fails
590  * @write_block: Function that writes block to the flash
591  * @write_block_data: Data passwd to @write_block
592  *
593  * This is generic function that writes data to NVM or NVM like device.
594  *
595  * Returns %0 on success and negative errno otherwise.
596  */
tb_nvm_write_data(unsigned int address,const void * buf,size_t size,unsigned int retries,write_block_fn write_block,void * write_block_data)597 int tb_nvm_write_data(unsigned int address, const void *buf, size_t size,
598 		      unsigned int retries, write_block_fn write_block,
599 		      void *write_block_data)
600 {
601 	do {
602 		unsigned int offset, dwaddress;
603 		u8 data[NVM_DATA_DWORDS * 4];
604 		size_t nbytes;
605 		int ret;
606 
607 		offset = address & 3;
608 		nbytes = min_t(u32, size + offset, NVM_DATA_DWORDS * 4);
609 
610 		memcpy(data + offset, buf, nbytes);
611 
612 		dwaddress = address / 4;
613 		ret = write_block(write_block_data, dwaddress, data, nbytes / 4);
614 		if (ret) {
615 			if (ret == -ETIMEDOUT) {
616 				if (retries--)
617 					continue;
618 				ret = -EIO;
619 			}
620 			return ret;
621 		}
622 
623 		size -= nbytes;
624 		address += nbytes;
625 		buf += nbytes;
626 	} while (size > 0);
627 
628 	return 0;
629 }
630 
tb_nvm_exit(void)631 void tb_nvm_exit(void)
632 {
633 	ida_destroy(&nvm_ida);
634 }
635