interrupt.c 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright (c) 2003-2018, Intel Corporation. All rights reserved.
  4. * Intel Management Engine Interface (Intel MEI) Linux driver
  5. */
  6. #include <linux/export.h>
  7. #include <linux/kthread.h>
  8. #include <linux/interrupt.h>
  9. #include <linux/fs.h>
  10. #include <linux/jiffies.h>
  11. #include <linux/slab.h>
  12. #include <linux/pm_runtime.h>
  13. #include <linux/mei.h>
  14. #include "mei_dev.h"
  15. #include "hbm.h"
  16. #include "client.h"
  17. /**
  18. * mei_irq_compl_handler - dispatch complete handlers
  19. * for the completed callbacks
  20. *
  21. * @dev: mei device
  22. * @cmpl_list: list of completed cbs
  23. */
  24. void mei_irq_compl_handler(struct mei_device *dev, struct list_head *cmpl_list)
  25. {
  26. struct mei_cl_cb *cb, *next;
  27. struct mei_cl *cl;
  28. list_for_each_entry_safe(cb, next, cmpl_list, list) {
  29. cl = cb->cl;
  30. list_del_init(&cb->list);
  31. dev_dbg(dev->dev, "completing call back.\n");
  32. mei_cl_complete(cl, cb);
  33. }
  34. }
  35. EXPORT_SYMBOL_GPL(mei_irq_compl_handler);
  36. /**
  37. * mei_cl_hbm_equal - check if hbm is addressed to the client
  38. *
  39. * @cl: host client
  40. * @mei_hdr: header of mei client message
  41. *
  42. * Return: true if matches, false otherwise
  43. */
  44. static inline int mei_cl_hbm_equal(struct mei_cl *cl,
  45. struct mei_msg_hdr *mei_hdr)
  46. {
  47. return mei_cl_host_addr(cl) == mei_hdr->host_addr &&
  48. mei_cl_me_id(cl) == mei_hdr->me_addr;
  49. }
  50. /**
  51. * mei_irq_discard_msg - discard received message
  52. *
  53. * @dev: mei device
  54. * @hdr: message header
  55. * @discard_len: the length of the message to discard (excluding header)
  56. */
  57. static void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr,
  58. size_t discard_len)
  59. {
  60. if (hdr->dma_ring) {
  61. mei_dma_ring_read(dev, NULL,
  62. hdr->extension[dev->rd_msg_hdr_count - 2]);
  63. discard_len = 0;
  64. }
  65. /*
  66. * no need to check for size as it is guarantied
  67. * that length fits into rd_msg_buf
  68. */
  69. mei_read_slots(dev, dev->rd_msg_buf, discard_len);
  70. dev_dbg(dev->dev, "discarding message " MEI_HDR_FMT "\n",
  71. MEI_HDR_PRM(hdr));
  72. }
  73. /**
  74. * mei_cl_irq_read_msg - process client message
  75. *
  76. * @cl: reading client
  77. * @mei_hdr: header of mei client message
  78. * @meta: extend meta header
  79. * @cmpl_list: completion list
  80. *
  81. * Return: always 0
  82. */
  83. static int mei_cl_irq_read_msg(struct mei_cl *cl,
  84. struct mei_msg_hdr *mei_hdr,
  85. struct mei_ext_meta_hdr *meta,
  86. struct list_head *cmpl_list)
  87. {
  88. struct mei_device *dev = cl->dev;
  89. struct mei_cl_cb *cb;
  90. size_t buf_sz;
  91. u32 length;
  92. int ext_len;
  93. length = mei_hdr->length;
  94. ext_len = 0;
  95. if (mei_hdr->extended) {
  96. ext_len = sizeof(*meta) + mei_slots2data(meta->size);
  97. length -= ext_len;
  98. }
  99. cb = list_first_entry_or_null(&cl->rd_pending, struct mei_cl_cb, list);
  100. if (!cb) {
  101. if (!mei_cl_is_fixed_address(cl)) {
  102. cl_err(dev, cl, "pending read cb not found\n");
  103. goto discard;
  104. }
  105. cb = mei_cl_alloc_cb(cl, mei_cl_mtu(cl), MEI_FOP_READ, cl->fp);
  106. if (!cb)
  107. goto discard;
  108. list_add_tail(&cb->list, &cl->rd_pending);
  109. }
  110. if (mei_hdr->extended) {
  111. struct mei_ext_hdr *ext;
  112. struct mei_ext_hdr *vtag = NULL;
  113. ext = mei_ext_begin(meta);
  114. do {
  115. switch (ext->type) {
  116. case MEI_EXT_HDR_VTAG:
  117. vtag = ext;
  118. break;
  119. case MEI_EXT_HDR_NONE:
  120. fallthrough;
  121. default:
  122. cb->status = -EPROTO;
  123. break;
  124. }
  125. ext = mei_ext_next(ext);
  126. } while (!mei_ext_last(meta, ext));
  127. if (!vtag) {
  128. cl_dbg(dev, cl, "vtag not found in extended header.\n");
  129. cb->status = -EPROTO;
  130. goto discard;
  131. }
  132. cl_dbg(dev, cl, "vtag: %d\n", vtag->ext_payload[0]);
  133. if (cb->vtag && cb->vtag != vtag->ext_payload[0]) {
  134. cl_err(dev, cl, "mismatched tag: %d != %d\n",
  135. cb->vtag, vtag->ext_payload[0]);
  136. cb->status = -EPROTO;
  137. goto discard;
  138. }
  139. cb->vtag = vtag->ext_payload[0];
  140. }
  141. if (!mei_cl_is_connected(cl)) {
  142. cl_dbg(dev, cl, "not connected\n");
  143. cb->status = -ENODEV;
  144. goto discard;
  145. }
  146. if (mei_hdr->dma_ring)
  147. length = mei_hdr->extension[mei_data2slots(ext_len)];
  148. buf_sz = length + cb->buf_idx;
  149. /* catch for integer overflow */
  150. if (buf_sz < cb->buf_idx) {
  151. cl_err(dev, cl, "message is too big len %d idx %zu\n",
  152. length, cb->buf_idx);
  153. cb->status = -EMSGSIZE;
  154. goto discard;
  155. }
  156. if (cb->buf.size < buf_sz) {
  157. cl_dbg(dev, cl, "message overflow. size %zu len %d idx %zu\n",
  158. cb->buf.size, length, cb->buf_idx);
  159. cb->status = -EMSGSIZE;
  160. goto discard;
  161. }
  162. if (mei_hdr->dma_ring) {
  163. mei_dma_ring_read(dev, cb->buf.data + cb->buf_idx, length);
  164. /* for DMA read 0 length to generate interrupt to the device */
  165. mei_read_slots(dev, cb->buf.data + cb->buf_idx, 0);
  166. } else {
  167. mei_read_slots(dev, cb->buf.data + cb->buf_idx, length);
  168. }
  169. cb->buf_idx += length;
  170. if (mei_hdr->msg_complete) {
  171. cl_dbg(dev, cl, "completed read length = %zu\n", cb->buf_idx);
  172. list_move_tail(&cb->list, cmpl_list);
  173. } else {
  174. pm_runtime_mark_last_busy(dev->dev);
  175. pm_request_autosuspend(dev->dev);
  176. }
  177. return 0;
  178. discard:
  179. if (cb)
  180. list_move_tail(&cb->list, cmpl_list);
  181. mei_irq_discard_msg(dev, mei_hdr, length);
  182. return 0;
  183. }
  184. /**
  185. * mei_cl_irq_disconnect_rsp - send disconnection response message
  186. *
  187. * @cl: client
  188. * @cb: callback block.
  189. * @cmpl_list: complete list.
  190. *
  191. * Return: 0, OK; otherwise, error.
  192. */
  193. static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb,
  194. struct list_head *cmpl_list)
  195. {
  196. struct mei_device *dev = cl->dev;
  197. u32 msg_slots;
  198. int slots;
  199. int ret;
  200. msg_slots = mei_hbm2slots(sizeof(struct hbm_client_connect_response));
  201. slots = mei_hbuf_empty_slots(dev);
  202. if (slots < 0)
  203. return -EOVERFLOW;
  204. if ((u32)slots < msg_slots)
  205. return -EMSGSIZE;
  206. ret = mei_hbm_cl_disconnect_rsp(dev, cl);
  207. list_move_tail(&cb->list, cmpl_list);
  208. return ret;
  209. }
  210. /**
  211. * mei_cl_irq_read - processes client read related operation from the
  212. * interrupt thread context - request for flow control credits
  213. *
  214. * @cl: client
  215. * @cb: callback block.
  216. * @cmpl_list: complete list.
  217. *
  218. * Return: 0, OK; otherwise, error.
  219. */
  220. static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb,
  221. struct list_head *cmpl_list)
  222. {
  223. struct mei_device *dev = cl->dev;
  224. u32 msg_slots;
  225. int slots;
  226. int ret;
  227. if (!list_empty(&cl->rd_pending))
  228. return 0;
  229. msg_slots = mei_hbm2slots(sizeof(struct hbm_flow_control));
  230. slots = mei_hbuf_empty_slots(dev);
  231. if (slots < 0)
  232. return -EOVERFLOW;
  233. if ((u32)slots < msg_slots)
  234. return -EMSGSIZE;
  235. ret = mei_hbm_cl_flow_control_req(dev, cl);
  236. if (ret) {
  237. cl->status = ret;
  238. cb->buf_idx = 0;
  239. list_move_tail(&cb->list, cmpl_list);
  240. return ret;
  241. }
  242. pm_runtime_mark_last_busy(dev->dev);
  243. pm_request_autosuspend(dev->dev);
  244. list_move_tail(&cb->list, &cl->rd_pending);
  245. return 0;
  246. }
  247. static inline bool hdr_is_hbm(struct mei_msg_hdr *mei_hdr)
  248. {
  249. return mei_hdr->host_addr == 0 && mei_hdr->me_addr == 0;
  250. }
  251. static inline bool hdr_is_fixed(struct mei_msg_hdr *mei_hdr)
  252. {
  253. return mei_hdr->host_addr == 0 && mei_hdr->me_addr != 0;
  254. }
  255. static inline int hdr_is_valid(u32 msg_hdr)
  256. {
  257. struct mei_msg_hdr *mei_hdr;
  258. u32 expected_len = 0;
  259. mei_hdr = (struct mei_msg_hdr *)&msg_hdr;
  260. if (!msg_hdr || mei_hdr->reserved)
  261. return -EBADMSG;
  262. if (mei_hdr->dma_ring)
  263. expected_len += MEI_SLOT_SIZE;
  264. if (mei_hdr->extended)
  265. expected_len += MEI_SLOT_SIZE;
  266. if (mei_hdr->length < expected_len)
  267. return -EBADMSG;
  268. return 0;
  269. }
  270. /**
  271. * mei_irq_read_handler - bottom half read routine after ISR to
  272. * handle the read processing.
  273. *
  274. * @dev: the device structure
  275. * @cmpl_list: An instance of our list structure
  276. * @slots: slots to read.
  277. *
  278. * Return: 0 on success, <0 on failure.
  279. */
  280. int mei_irq_read_handler(struct mei_device *dev,
  281. struct list_head *cmpl_list, s32 *slots)
  282. {
  283. struct mei_msg_hdr *mei_hdr;
  284. struct mei_ext_meta_hdr *meta_hdr = NULL;
  285. struct mei_cl *cl;
  286. int ret;
  287. u32 ext_meta_hdr_u32;
  288. u32 hdr_size_left;
  289. u32 hdr_size_ext;
  290. int i;
  291. int ext_hdr_end;
  292. if (!dev->rd_msg_hdr[0]) {
  293. dev->rd_msg_hdr[0] = mei_read_hdr(dev);
  294. dev->rd_msg_hdr_count = 1;
  295. (*slots)--;
  296. dev_dbg(dev->dev, "slots =%08x.\n", *slots);
  297. ret = hdr_is_valid(dev->rd_msg_hdr[0]);
  298. if (ret) {
  299. dev_err(dev->dev, "corrupted message header 0x%08X\n",
  300. dev->rd_msg_hdr[0]);
  301. goto end;
  302. }
  303. }
  304. mei_hdr = (struct mei_msg_hdr *)dev->rd_msg_hdr;
  305. dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
  306. if (mei_slots2data(*slots) < mei_hdr->length) {
  307. dev_err(dev->dev, "less data available than length=%08x.\n",
  308. *slots);
  309. /* we can't read the message */
  310. ret = -ENODATA;
  311. goto end;
  312. }
  313. ext_hdr_end = 1;
  314. hdr_size_left = mei_hdr->length;
  315. if (mei_hdr->extended) {
  316. if (!dev->rd_msg_hdr[1]) {
  317. ext_meta_hdr_u32 = mei_read_hdr(dev);
  318. dev->rd_msg_hdr[1] = ext_meta_hdr_u32;
  319. dev->rd_msg_hdr_count++;
  320. (*slots)--;
  321. dev_dbg(dev->dev, "extended header is %08x\n",
  322. ext_meta_hdr_u32);
  323. }
  324. meta_hdr = ((struct mei_ext_meta_hdr *)dev->rd_msg_hdr + 1);
  325. if (check_add_overflow((u32)sizeof(*meta_hdr),
  326. mei_slots2data(meta_hdr->size),
  327. &hdr_size_ext)) {
  328. dev_err(dev->dev, "extended message size too big %d\n",
  329. meta_hdr->size);
  330. return -EBADMSG;
  331. }
  332. if (hdr_size_left < hdr_size_ext) {
  333. dev_err(dev->dev, "corrupted message header len %d\n",
  334. mei_hdr->length);
  335. return -EBADMSG;
  336. }
  337. hdr_size_left -= hdr_size_ext;
  338. ext_hdr_end = meta_hdr->size + 2;
  339. for (i = dev->rd_msg_hdr_count; i < ext_hdr_end; i++) {
  340. dev->rd_msg_hdr[i] = mei_read_hdr(dev);
  341. dev_dbg(dev->dev, "extended header %d is %08x\n", i,
  342. dev->rd_msg_hdr[i]);
  343. dev->rd_msg_hdr_count++;
  344. (*slots)--;
  345. }
  346. }
  347. if (mei_hdr->dma_ring) {
  348. if (hdr_size_left != sizeof(dev->rd_msg_hdr[ext_hdr_end])) {
  349. dev_err(dev->dev, "corrupted message header len %d\n",
  350. mei_hdr->length);
  351. return -EBADMSG;
  352. }
  353. dev->rd_msg_hdr[ext_hdr_end] = mei_read_hdr(dev);
  354. dev->rd_msg_hdr_count++;
  355. (*slots)--;
  356. mei_hdr->length -= sizeof(dev->rd_msg_hdr[ext_hdr_end]);
  357. }
  358. /* HBM message */
  359. if (hdr_is_hbm(mei_hdr)) {
  360. ret = mei_hbm_dispatch(dev, mei_hdr);
  361. if (ret) {
  362. dev_dbg(dev->dev, "mei_hbm_dispatch failed ret = %d\n",
  363. ret);
  364. goto end;
  365. }
  366. goto reset_slots;
  367. }
  368. /* find recipient cl */
  369. list_for_each_entry(cl, &dev->file_list, link) {
  370. if (mei_cl_hbm_equal(cl, mei_hdr)) {
  371. cl_dbg(dev, cl, "got a message\n");
  372. ret = mei_cl_irq_read_msg(cl, mei_hdr, meta_hdr, cmpl_list);
  373. goto reset_slots;
  374. }
  375. }
  376. /* if no recipient cl was found we assume corrupted header */
  377. /* A message for not connected fixed address clients
  378. * should be silently discarded
  379. * On power down client may be force cleaned,
  380. * silently discard such messages
  381. */
  382. if (hdr_is_fixed(mei_hdr) ||
  383. dev->dev_state == MEI_DEV_POWER_DOWN) {
  384. mei_irq_discard_msg(dev, mei_hdr, mei_hdr->length);
  385. ret = 0;
  386. goto reset_slots;
  387. }
  388. dev_err(dev->dev, "no destination client found 0x%08X\n", dev->rd_msg_hdr[0]);
  389. ret = -EBADMSG;
  390. goto end;
  391. reset_slots:
  392. /* reset the number of slots and header */
  393. memset(dev->rd_msg_hdr, 0, sizeof(dev->rd_msg_hdr));
  394. dev->rd_msg_hdr_count = 0;
  395. *slots = mei_count_full_read_slots(dev);
  396. if (*slots == -EOVERFLOW) {
  397. /* overflow - reset */
  398. dev_err(dev->dev, "resetting due to slots overflow.\n");
  399. /* set the event since message has been read */
  400. ret = -ERANGE;
  401. goto end;
  402. }
  403. end:
  404. return ret;
  405. }
  406. EXPORT_SYMBOL_GPL(mei_irq_read_handler);
  407. /**
  408. * mei_irq_write_handler - dispatch write requests
  409. * after irq received
  410. *
  411. * @dev: the device structure
  412. * @cmpl_list: An instance of our list structure
  413. *
  414. * Return: 0 on success, <0 on failure.
  415. */
  416. int mei_irq_write_handler(struct mei_device *dev, struct list_head *cmpl_list)
  417. {
  418. struct mei_cl *cl;
  419. struct mei_cl_cb *cb, *next;
  420. s32 slots;
  421. int ret;
  422. if (!mei_hbuf_acquire(dev))
  423. return 0;
  424. slots = mei_hbuf_empty_slots(dev);
  425. if (slots < 0)
  426. return -EOVERFLOW;
  427. if (slots == 0)
  428. return -EMSGSIZE;
  429. /* complete all waiting for write CB */
  430. dev_dbg(dev->dev, "complete all waiting for write cb.\n");
  431. list_for_each_entry_safe(cb, next, &dev->write_waiting_list, list) {
  432. cl = cb->cl;
  433. cl->status = 0;
  434. cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
  435. cl->writing_state = MEI_WRITE_COMPLETE;
  436. list_move_tail(&cb->list, cmpl_list);
  437. }
  438. /* complete control write list CB */
  439. dev_dbg(dev->dev, "complete control write list cb.\n");
  440. list_for_each_entry_safe(cb, next, &dev->ctrl_wr_list, list) {
  441. cl = cb->cl;
  442. switch (cb->fop_type) {
  443. case MEI_FOP_DISCONNECT:
  444. /* send disconnect message */
  445. ret = mei_cl_irq_disconnect(cl, cb, cmpl_list);
  446. if (ret)
  447. return ret;
  448. break;
  449. case MEI_FOP_READ:
  450. /* send flow control message */
  451. ret = mei_cl_irq_read(cl, cb, cmpl_list);
  452. if (ret)
  453. return ret;
  454. break;
  455. case MEI_FOP_CONNECT:
  456. /* connect message */
  457. ret = mei_cl_irq_connect(cl, cb, cmpl_list);
  458. if (ret)
  459. return ret;
  460. break;
  461. case MEI_FOP_DISCONNECT_RSP:
  462. /* send disconnect resp */
  463. ret = mei_cl_irq_disconnect_rsp(cl, cb, cmpl_list);
  464. if (ret)
  465. return ret;
  466. break;
  467. case MEI_FOP_NOTIFY_START:
  468. case MEI_FOP_NOTIFY_STOP:
  469. ret = mei_cl_irq_notify(cl, cb, cmpl_list);
  470. if (ret)
  471. return ret;
  472. break;
  473. default:
  474. BUG();
  475. }
  476. }
  477. /* complete write list CB */
  478. dev_dbg(dev->dev, "complete write list cb.\n");
  479. list_for_each_entry_safe(cb, next, &dev->write_list, list) {
  480. cl = cb->cl;
  481. ret = mei_cl_irq_write(cl, cb, cmpl_list);
  482. if (ret)
  483. return ret;
  484. }
  485. return 0;
  486. }
  487. EXPORT_SYMBOL_GPL(mei_irq_write_handler);
  488. /**
  489. * mei_connect_timeout - connect/disconnect timeouts
  490. *
  491. * @cl: host client
  492. */
  493. static void mei_connect_timeout(struct mei_cl *cl)
  494. {
  495. struct mei_device *dev = cl->dev;
  496. if (cl->state == MEI_FILE_CONNECTING) {
  497. if (dev->hbm_f_dot_supported) {
  498. cl->state = MEI_FILE_DISCONNECT_REQUIRED;
  499. wake_up(&cl->wait);
  500. return;
  501. }
  502. }
  503. mei_reset(dev);
  504. }
  505. #define MEI_STALL_TIMER_FREQ (2 * HZ)
  506. /**
  507. * mei_schedule_stall_timer - re-arm stall_timer work
  508. *
  509. * Schedule stall timer
  510. *
  511. * @dev: the device structure
  512. */
  513. void mei_schedule_stall_timer(struct mei_device *dev)
  514. {
  515. schedule_delayed_work(&dev->timer_work, MEI_STALL_TIMER_FREQ);
  516. }
  517. /**
  518. * mei_timer - timer function.
  519. *
  520. * @work: pointer to the work_struct structure
  521. *
  522. */
  523. void mei_timer(struct work_struct *work)
  524. {
  525. struct mei_cl *cl;
  526. struct mei_device *dev = container_of(work,
  527. struct mei_device, timer_work.work);
  528. bool reschedule_timer = false;
  529. mutex_lock(&dev->device_lock);
  530. /* Catch interrupt stalls during HBM init handshake */
  531. if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
  532. dev->hbm_state != MEI_HBM_IDLE) {
  533. if (dev->init_clients_timer) {
  534. if (--dev->init_clients_timer == 0) {
  535. dev_err(dev->dev, "timer: init clients timeout hbm_state = %d.\n",
  536. dev->hbm_state);
  537. mei_reset(dev);
  538. goto out;
  539. }
  540. reschedule_timer = true;
  541. }
  542. }
  543. if (dev->dev_state != MEI_DEV_ENABLED)
  544. goto out;
  545. /*** connect/disconnect timeouts ***/
  546. list_for_each_entry(cl, &dev->file_list, link) {
  547. if (cl->timer_count) {
  548. if (--cl->timer_count == 0) {
  549. dev_err(dev->dev, "timer: connect/disconnect timeout.\n");
  550. mei_connect_timeout(cl);
  551. goto out;
  552. }
  553. reschedule_timer = true;
  554. }
  555. }
  556. out:
  557. if (dev->dev_state != MEI_DEV_DISABLED && reschedule_timer)
  558. mei_schedule_stall_timer(dev);
  559. mutex_unlock(&dev->device_lock);
  560. }