linux/drivers/fsi/fsi-occ.c
Eddie James 3dcf3c84f5 fsi: occ: Improve response status checking
If the driver sequence number coincidentally equals the previous
command response sequence number, the driver may proceed with
fetching the entire buffer before the OCC has processed the current
command. To be sure the correct response is obtained, check the
command type and also retry if any of the response parameters have
changed when the rest of the buffer is fetched. Also initialize the
driver with a random sequence number in order to reduce the chances
of this happening.

Signed-off-by: Eddie James <eajames@linux.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20220208152235.19686-1-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
2022-02-21 19:37:03 +10:30

725 lines
16 KiB
C

// SPDX-License-Identifier: GPL-2.0
#include <linux/device.h>
#include <linux/err.h>
#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/fsi-sbefifo.h>
#include <linux/gfp.h>
#include <linux/idr.h>
#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/miscdevice.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/fsi-occ.h>
#include <linux/of.h>
#include <linux/of_device.h>
#include <linux/platform_device.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <asm/unaligned.h>
#define OCC_SRAM_BYTES 4096
#define OCC_CMD_DATA_BYTES 4090
#define OCC_RESP_DATA_BYTES 4089
#define OCC_P9_SRAM_CMD_ADDR 0xFFFBE000
#define OCC_P9_SRAM_RSP_ADDR 0xFFFBF000
#define OCC_P10_SRAM_CMD_ADDR 0xFFFFD000
#define OCC_P10_SRAM_RSP_ADDR 0xFFFFE000
#define OCC_P10_SRAM_MODE 0x58 /* Normal mode, OCB channel 2 */
#define OCC_TIMEOUT_MS 1000
#define OCC_CMD_IN_PRG_WAIT_MS 50
enum versions { occ_p9, occ_p10 };
struct occ {
struct device *dev;
struct device *sbefifo;
char name[32];
int idx;
u8 sequence_number;
void *buffer;
void *client_buffer;
size_t client_buffer_size;
size_t client_response_size;
enum versions version;
struct miscdevice mdev;
struct mutex occ_lock;
};
#define to_occ(x) container_of((x), struct occ, mdev)
struct occ_response {
u8 seq_no;
u8 cmd_type;
u8 return_status;
__be16 data_length;
u8 data[OCC_RESP_DATA_BYTES + 2]; /* two bytes checksum */
} __packed;
struct occ_client {
struct occ *occ;
struct mutex lock;
size_t data_size;
size_t read_offset;
u8 *buffer;
};
#define to_client(x) container_of((x), struct occ_client, xfr)
static DEFINE_IDA(occ_ida);
static int occ_open(struct inode *inode, struct file *file)
{
struct occ_client *client = kzalloc(sizeof(*client), GFP_KERNEL);
struct miscdevice *mdev = file->private_data;
struct occ *occ = to_occ(mdev);
if (!client)
return -ENOMEM;
client->buffer = (u8 *)__get_free_page(GFP_KERNEL);
if (!client->buffer) {
kfree(client);
return -ENOMEM;
}
client->occ = occ;
mutex_init(&client->lock);
file->private_data = client;
/* We allocate a 1-page buffer, make sure it all fits */
BUILD_BUG_ON((OCC_CMD_DATA_BYTES + 3) > PAGE_SIZE);
BUILD_BUG_ON((OCC_RESP_DATA_BYTES + 7) > PAGE_SIZE);
return 0;
}
static ssize_t occ_read(struct file *file, char __user *buf, size_t len,
loff_t *offset)
{
struct occ_client *client = file->private_data;
ssize_t rc = 0;
if (!client)
return -ENODEV;
if (len > OCC_SRAM_BYTES)
return -EINVAL;
mutex_lock(&client->lock);
/* This should not be possible ... */
if (WARN_ON_ONCE(client->read_offset > client->data_size)) {
rc = -EIO;
goto done;
}
/* Grab how much data we have to read */
rc = min(len, client->data_size - client->read_offset);
if (copy_to_user(buf, client->buffer + client->read_offset, rc))
rc = -EFAULT;
else
client->read_offset += rc;
done:
mutex_unlock(&client->lock);
return rc;
}
static ssize_t occ_write(struct file *file, const char __user *buf,
size_t len, loff_t *offset)
{
struct occ_client *client = file->private_data;
size_t rlen, data_length;
ssize_t rc;
u8 *cmd;
if (!client)
return -ENODEV;
if (len > (OCC_CMD_DATA_BYTES + 3) || len < 3)
return -EINVAL;
mutex_lock(&client->lock);
/* Construct the command */
cmd = client->buffer;
/*
* Copy the user command (assume user data follows the occ command
* format)
* byte 0: command type
* bytes 1-2: data length (msb first)
* bytes 3-n: data
*/
if (copy_from_user(&cmd[1], buf, len)) {
rc = -EFAULT;
goto done;
}
/* Extract data length */
data_length = (cmd[2] << 8) + cmd[3];
if (data_length > OCC_CMD_DATA_BYTES) {
rc = -EINVAL;
goto done;
}
/* Submit command; 4 bytes before the data and 2 bytes after */
rlen = PAGE_SIZE;
rc = fsi_occ_submit(client->occ->dev, cmd, data_length + 6, cmd,
&rlen);
if (rc)
goto done;
/* Set read tracking data */
client->data_size = rlen;
client->read_offset = 0;
/* Done */
rc = len;
done:
mutex_unlock(&client->lock);
return rc;
}
static int occ_release(struct inode *inode, struct file *file)
{
struct occ_client *client = file->private_data;
free_page((unsigned long)client->buffer);
kfree(client);
return 0;
}
static const struct file_operations occ_fops = {
.owner = THIS_MODULE,
.open = occ_open,
.read = occ_read,
.write = occ_write,
.release = occ_release,
};
static void occ_save_ffdc(struct occ *occ, __be32 *resp, size_t parsed_len,
size_t resp_len)
{
if (resp_len > parsed_len) {
size_t dh = resp_len - parsed_len;
size_t ffdc_len = (dh - 1) * 4; /* SBE words are four bytes */
__be32 *ffdc = &resp[parsed_len];
if (ffdc_len > occ->client_buffer_size)
ffdc_len = occ->client_buffer_size;
memcpy(occ->client_buffer, ffdc, ffdc_len);
occ->client_response_size = ffdc_len;
}
}
static int occ_verify_checksum(struct occ *occ, struct occ_response *resp,
u16 data_length)
{
/* Fetch the two bytes after the data for the checksum. */
u16 checksum_resp = get_unaligned_be16(&resp->data[data_length]);
u16 checksum;
u16 i;
checksum = resp->seq_no;
checksum += resp->cmd_type;
checksum += resp->return_status;
checksum += (data_length >> 8) + (data_length & 0xFF);
for (i = 0; i < data_length; ++i)
checksum += resp->data[i];
if (checksum != checksum_resp) {
dev_err(occ->dev, "Bad checksum: %04x!=%04x\n", checksum,
checksum_resp);
return -EBADMSG;
}
return 0;
}
static int occ_getsram(struct occ *occ, u32 offset, void *data, ssize_t len)
{
u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */
size_t cmd_len, parsed_len, resp_data_len;
size_t resp_len = OCC_MAX_RESP_WORDS;
__be32 *resp = occ->buffer;
__be32 cmd[6];
int idx = 0, rc;
/*
* Magic sequence to do SBE getsram command. SBE will fetch data from
* specified SRAM address.
*/
switch (occ->version) {
default:
case occ_p9:
cmd_len = 5;
cmd[2] = cpu_to_be32(1); /* Normal mode */
cmd[3] = cpu_to_be32(OCC_P9_SRAM_RSP_ADDR + offset);
break;
case occ_p10:
idx = 1;
cmd_len = 6;
cmd[2] = cpu_to_be32(OCC_P10_SRAM_MODE);
cmd[3] = 0;
cmd[4] = cpu_to_be32(OCC_P10_SRAM_RSP_ADDR + offset);
break;
}
cmd[0] = cpu_to_be32(cmd_len);
cmd[1] = cpu_to_be32(SBEFIFO_CMD_GET_OCC_SRAM);
cmd[4 + idx] = cpu_to_be32(data_len);
rc = sbefifo_submit(occ->sbefifo, cmd, cmd_len, resp, &resp_len);
if (rc)
return rc;
rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_GET_OCC_SRAM,
resp, resp_len, &parsed_len);
if (rc > 0) {
dev_err(occ->dev, "SRAM read returned failure status: %08x\n",
rc);
occ_save_ffdc(occ, resp, parsed_len, resp_len);
return -ECOMM;
} else if (rc) {
return rc;
}
resp_data_len = be32_to_cpu(resp[parsed_len - 1]);
if (resp_data_len != data_len) {
dev_err(occ->dev, "SRAM read expected %d bytes got %zd\n",
data_len, resp_data_len);
rc = -EBADMSG;
} else {
memcpy(data, resp, len);
}
return rc;
}
static int occ_putsram(struct occ *occ, const void *data, ssize_t len,
u8 seq_no, u16 checksum)
{
u32 data_len = ((len + 7) / 8) * 8; /* must be multiples of 8 B */
size_t cmd_len, parsed_len, resp_data_len;
size_t resp_len = OCC_MAX_RESP_WORDS;
__be32 *buf = occ->buffer;
u8 *byte_buf;
int idx = 0, rc;
cmd_len = (occ->version == occ_p10) ? 6 : 5;
cmd_len += data_len >> 2;
/*
* Magic sequence to do SBE putsram command. SBE will transfer
* data to specified SRAM address.
*/
buf[0] = cpu_to_be32(cmd_len);
buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM);
switch (occ->version) {
default:
case occ_p9:
buf[2] = cpu_to_be32(1); /* Normal mode */
buf[3] = cpu_to_be32(OCC_P9_SRAM_CMD_ADDR);
break;
case occ_p10:
idx = 1;
buf[2] = cpu_to_be32(OCC_P10_SRAM_MODE);
buf[3] = 0;
buf[4] = cpu_to_be32(OCC_P10_SRAM_CMD_ADDR);
break;
}
buf[4 + idx] = cpu_to_be32(data_len);
memcpy(&buf[5 + idx], data, len);
byte_buf = (u8 *)&buf[5 + idx];
/*
* Overwrite the first byte with our sequence number and the last two
* bytes with the checksum.
*/
byte_buf[0] = seq_no;
byte_buf[len - 2] = checksum >> 8;
byte_buf[len - 1] = checksum & 0xff;
rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len);
if (rc)
return rc;
rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM,
buf, resp_len, &parsed_len);
if (rc > 0) {
dev_err(occ->dev, "SRAM write returned failure status: %08x\n",
rc);
occ_save_ffdc(occ, buf, parsed_len, resp_len);
return -ECOMM;
} else if (rc) {
return rc;
}
if (parsed_len != 1) {
dev_err(occ->dev, "SRAM write response length invalid: %zd\n",
parsed_len);
rc = -EBADMSG;
} else {
resp_data_len = be32_to_cpu(buf[0]);
if (resp_data_len != data_len) {
dev_err(occ->dev,
"SRAM write expected %d bytes got %zd\n",
data_len, resp_data_len);
rc = -EBADMSG;
}
}
return rc;
}
static int occ_trigger_attn(struct occ *occ)
{
__be32 *buf = occ->buffer;
size_t cmd_len, parsed_len, resp_data_len;
size_t resp_len = OCC_MAX_RESP_WORDS;
int idx = 0, rc;
switch (occ->version) {
default:
case occ_p9:
cmd_len = 7;
buf[2] = cpu_to_be32(3); /* Circular mode */
buf[3] = 0;
break;
case occ_p10:
idx = 1;
cmd_len = 8;
buf[2] = cpu_to_be32(0xd0); /* Circular mode, OCB Channel 1 */
buf[3] = 0;
buf[4] = 0;
break;
}
buf[0] = cpu_to_be32(cmd_len); /* Chip-op length in words */
buf[1] = cpu_to_be32(SBEFIFO_CMD_PUT_OCC_SRAM);
buf[4 + idx] = cpu_to_be32(8); /* Data length in bytes */
buf[5 + idx] = cpu_to_be32(0x20010000); /* Trigger OCC attention */
buf[6 + idx] = 0;
rc = sbefifo_submit(occ->sbefifo, buf, cmd_len, buf, &resp_len);
if (rc)
return rc;
rc = sbefifo_parse_status(occ->sbefifo, SBEFIFO_CMD_PUT_OCC_SRAM,
buf, resp_len, &parsed_len);
if (rc > 0) {
dev_err(occ->dev, "SRAM attn returned failure status: %08x\n",
rc);
occ_save_ffdc(occ, buf, parsed_len, resp_len);
return -ECOMM;
} else if (rc) {
return rc;
}
if (parsed_len != 1) {
dev_err(occ->dev, "SRAM attn response length invalid: %zd\n",
parsed_len);
rc = -EBADMSG;
} else {
resp_data_len = be32_to_cpu(buf[0]);
if (resp_data_len != 8) {
dev_err(occ->dev,
"SRAM attn expected 8 bytes got %zd\n",
resp_data_len);
rc = -EBADMSG;
}
}
return rc;
}
static bool fsi_occ_response_not_ready(struct occ_response *resp, u8 seq_no,
u8 cmd_type)
{
return resp->return_status == OCC_RESP_CMD_IN_PRG ||
resp->return_status == OCC_RESP_CRIT_INIT ||
resp->seq_no != seq_no || resp->cmd_type != cmd_type;
}
int fsi_occ_submit(struct device *dev, const void *request, size_t req_len,
void *response, size_t *resp_len)
{
const unsigned long timeout = msecs_to_jiffies(OCC_TIMEOUT_MS);
const unsigned long wait_time =
msecs_to_jiffies(OCC_CMD_IN_PRG_WAIT_MS);
struct occ *occ = dev_get_drvdata(dev);
struct occ_response *resp = response;
size_t user_resp_len = *resp_len;
u8 seq_no;
u8 cmd_type;
u16 checksum = 0;
u16 resp_data_length;
const u8 *byte_request = (const u8 *)request;
unsigned long end;
int rc;
size_t i;
*resp_len = 0;
if (!occ)
return -ENODEV;
if (user_resp_len < 7) {
dev_dbg(dev, "Bad resplen %zd\n", user_resp_len);
return -EINVAL;
}
cmd_type = byte_request[1];
/* Checksum the request, ignoring first byte (sequence number). */
for (i = 1; i < req_len - 2; ++i)
checksum += byte_request[i];
mutex_lock(&occ->occ_lock);
occ->client_buffer = response;
occ->client_buffer_size = user_resp_len;
occ->client_response_size = 0;
/*
* Get a sequence number and update the counter. Avoid a sequence
* number of 0 which would pass the response check below even if the
* OCC response is uninitialized. Any sequence number the user is
* trying to send is overwritten since this function is the only common
* interface to the OCC and therefore the only place we can guarantee
* unique sequence numbers.
*/
seq_no = occ->sequence_number++;
if (!occ->sequence_number)
occ->sequence_number = 1;
checksum += seq_no;
rc = occ_putsram(occ, request, req_len, seq_no, checksum);
if (rc)
goto done;
rc = occ_trigger_attn(occ);
if (rc)
goto done;
end = jiffies + timeout;
while (true) {
/* Read occ response header */
rc = occ_getsram(occ, 0, resp, 8);
if (rc)
goto done;
if (fsi_occ_response_not_ready(resp, seq_no, cmd_type)) {
if (time_after(jiffies, end)) {
dev_err(occ->dev,
"resp timeout status=%02x seq=%d cmd=%d, our seq=%d cmd=%d\n",
resp->return_status, resp->seq_no,
resp->cmd_type, seq_no, cmd_type);
rc = -ETIMEDOUT;
goto done;
}
set_current_state(TASK_UNINTERRUPTIBLE);
schedule_timeout(wait_time);
} else {
/* Extract size of response data */
resp_data_length =
get_unaligned_be16(&resp->data_length);
/*
* Message size is data length + 5 bytes header + 2
* bytes checksum
*/
if ((resp_data_length + 7) > user_resp_len) {
rc = -EMSGSIZE;
goto done;
}
/*
* Get the entire response including the header again,
* in case it changed
*/
if (resp_data_length > 1) {
rc = occ_getsram(occ, 0, resp,
resp_data_length + 7);
if (rc)
goto done;
if (!fsi_occ_response_not_ready(resp, seq_no,
cmd_type))
break;
} else {
break;
}
}
}
dev_dbg(dev, "resp_status=%02x resp_data_len=%d\n",
resp->return_status, resp_data_length);
occ->client_response_size = resp_data_length + 7;
rc = occ_verify_checksum(occ, resp, resp_data_length);
done:
*resp_len = occ->client_response_size;
mutex_unlock(&occ->occ_lock);
return rc;
}
EXPORT_SYMBOL_GPL(fsi_occ_submit);
static int occ_unregister_child(struct device *dev, void *data)
{
struct platform_device *hwmon_dev = to_platform_device(dev);
platform_device_unregister(hwmon_dev);
return 0;
}
static int occ_probe(struct platform_device *pdev)
{
int rc;
u32 reg;
struct occ *occ;
struct platform_device *hwmon_dev;
struct device *dev = &pdev->dev;
struct platform_device_info hwmon_dev_info = {
.parent = dev,
.name = "occ-hwmon",
};
occ = devm_kzalloc(dev, sizeof(*occ), GFP_KERNEL);
if (!occ)
return -ENOMEM;
/* SBE words are always four bytes */
occ->buffer = kvmalloc(OCC_MAX_RESP_WORDS * 4, GFP_KERNEL);
if (!occ->buffer)
return -ENOMEM;
occ->version = (uintptr_t)of_device_get_match_data(dev);
occ->dev = dev;
occ->sbefifo = dev->parent;
/*
* Quickly derive a pseudo-random number from jiffies so that
* re-probing the driver doesn't accidentally overlap sequence numbers.
*/
occ->sequence_number = (u8)((jiffies % 0xff) + 1);
mutex_init(&occ->occ_lock);
if (dev->of_node) {
rc = of_property_read_u32(dev->of_node, "reg", &reg);
if (!rc) {
/* make sure we don't have a duplicate from dts */
occ->idx = ida_simple_get(&occ_ida, reg, reg + 1,
GFP_KERNEL);
if (occ->idx < 0)
occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX,
GFP_KERNEL);
} else {
occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX,
GFP_KERNEL);
}
} else {
occ->idx = ida_simple_get(&occ_ida, 1, INT_MAX, GFP_KERNEL);
}
platform_set_drvdata(pdev, occ);
snprintf(occ->name, sizeof(occ->name), "occ%d", occ->idx);
occ->mdev.fops = &occ_fops;
occ->mdev.minor = MISC_DYNAMIC_MINOR;
occ->mdev.name = occ->name;
occ->mdev.parent = dev;
rc = misc_register(&occ->mdev);
if (rc) {
dev_err(dev, "failed to register miscdevice: %d\n", rc);
ida_simple_remove(&occ_ida, occ->idx);
kvfree(occ->buffer);
return rc;
}
hwmon_dev_info.id = occ->idx;
hwmon_dev = platform_device_register_full(&hwmon_dev_info);
if (IS_ERR(hwmon_dev))
dev_warn(dev, "failed to create hwmon device\n");
return 0;
}
static int occ_remove(struct platform_device *pdev)
{
struct occ *occ = platform_get_drvdata(pdev);
kvfree(occ->buffer);
misc_deregister(&occ->mdev);
device_for_each_child(&pdev->dev, NULL, occ_unregister_child);
ida_simple_remove(&occ_ida, occ->idx);
return 0;
}
static const struct of_device_id occ_match[] = {
{
.compatible = "ibm,p9-occ",
.data = (void *)occ_p9
},
{
.compatible = "ibm,p10-occ",
.data = (void *)occ_p10
},
{ },
};
MODULE_DEVICE_TABLE(of, occ_match);
static struct platform_driver occ_driver = {
.driver = {
.name = "occ",
.of_match_table = occ_match,
},
.probe = occ_probe,
.remove = occ_remove,
};
static int occ_init(void)
{
return platform_driver_register(&occ_driver);
}
static void occ_exit(void)
{
platform_driver_unregister(&occ_driver);
ida_destroy(&occ_ida);
}
module_init(occ_init);
module_exit(occ_exit);
MODULE_AUTHOR("Eddie James <eajames@linux.ibm.com>");
MODULE_DESCRIPTION("BMC P9 OCC driver");
MODULE_LICENSE("GPL");