cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

ssp_spi.c (13979B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 *  Copyright (C) 2014, Samsung Electronics Co. Ltd. All Rights Reserved.
      4 */
      5
      6#include "ssp.h"
      7
      8#define SSP_DEV (&data->spi->dev)
      9#define SSP_GET_MESSAGE_TYPE(data) (data & (3 << SSP_RW))
     10
     11/*
     12 * SSP -> AP Instruction
     13 * They tell what packet type can be expected. In the future there will
     14 * be less of them. BYPASS means common sensor packets with accel, gyro,
     15 * hrm etc. data. LIBRARY and META are mock-up's for now.
     16 */
     17#define SSP_MSG2AP_INST_BYPASS_DATA		0x37
     18#define SSP_MSG2AP_INST_LIBRARY_DATA		0x01
     19#define SSP_MSG2AP_INST_DEBUG_DATA		0x03
     20#define SSP_MSG2AP_INST_BIG_DATA		0x04
     21#define SSP_MSG2AP_INST_META_DATA		0x05
     22#define SSP_MSG2AP_INST_TIME_SYNC		0x06
     23#define SSP_MSG2AP_INST_RESET			0x07
     24
     25#define SSP_UNIMPLEMENTED -1
     26
     27struct ssp_msg_header {
     28	u8 cmd;
     29	__le16 length;
     30	__le16 options;
     31	__le32 data;
     32} __attribute__((__packed__));
     33
     34struct ssp_msg {
     35	u16 length;
     36	u16 options;
     37	struct list_head list;
     38	struct completion *done;
     39	struct ssp_msg_header *h;
     40	char *buffer;
     41};
     42
     43static const int ssp_offset_map[SSP_SENSOR_MAX] = {
     44	[SSP_ACCELEROMETER_SENSOR] =		SSP_ACCELEROMETER_SIZE +
     45						SSP_TIME_SIZE,
     46	[SSP_GYROSCOPE_SENSOR] =		SSP_GYROSCOPE_SIZE +
     47						SSP_TIME_SIZE,
     48	[SSP_GEOMAGNETIC_UNCALIB_SENSOR] =	SSP_UNIMPLEMENTED,
     49	[SSP_GEOMAGNETIC_RAW] =			SSP_UNIMPLEMENTED,
     50	[SSP_GEOMAGNETIC_SENSOR] =		SSP_UNIMPLEMENTED,
     51	[SSP_PRESSURE_SENSOR] =			SSP_UNIMPLEMENTED,
     52	[SSP_GESTURE_SENSOR] =			SSP_UNIMPLEMENTED,
     53	[SSP_PROXIMITY_SENSOR] =		SSP_UNIMPLEMENTED,
     54	[SSP_TEMPERATURE_HUMIDITY_SENSOR] =	SSP_UNIMPLEMENTED,
     55	[SSP_LIGHT_SENSOR] =			SSP_UNIMPLEMENTED,
     56	[SSP_PROXIMITY_RAW] =			SSP_UNIMPLEMENTED,
     57	[SSP_ORIENTATION_SENSOR] =		SSP_UNIMPLEMENTED,
     58	[SSP_STEP_DETECTOR] =			SSP_UNIMPLEMENTED,
     59	[SSP_SIG_MOTION_SENSOR] =		SSP_UNIMPLEMENTED,
     60	[SSP_GYRO_UNCALIB_SENSOR] =		SSP_UNIMPLEMENTED,
     61	[SSP_GAME_ROTATION_VECTOR] =		SSP_UNIMPLEMENTED,
     62	[SSP_ROTATION_VECTOR] =			SSP_UNIMPLEMENTED,
     63	[SSP_STEP_COUNTER] =			SSP_UNIMPLEMENTED,
     64	[SSP_BIO_HRM_RAW] =			SSP_BIO_HRM_RAW_SIZE +
     65						SSP_TIME_SIZE,
     66	[SSP_BIO_HRM_RAW_FAC] =			SSP_BIO_HRM_RAW_FAC_SIZE +
     67						SSP_TIME_SIZE,
     68	[SSP_BIO_HRM_LIB] =			SSP_BIO_HRM_LIB_SIZE +
     69						SSP_TIME_SIZE,
     70};
     71
     72#define SSP_HEADER_SIZE		(sizeof(struct ssp_msg_header))
     73#define SSP_HEADER_SIZE_ALIGNED	(ALIGN(SSP_HEADER_SIZE, 4))
     74
     75static struct ssp_msg *ssp_create_msg(u8 cmd, u16 len, u16 opt, u32 data)
     76{
     77	struct ssp_msg_header h;
     78	struct ssp_msg *msg;
     79
     80	msg = kzalloc(sizeof(*msg), GFP_KERNEL);
     81	if (!msg)
     82		return NULL;
     83
     84	h.cmd = cmd;
     85	h.length = cpu_to_le16(len);
     86	h.options = cpu_to_le16(opt);
     87	h.data = cpu_to_le32(data);
     88
     89	msg->buffer = kzalloc(SSP_HEADER_SIZE_ALIGNED + len,
     90			      GFP_KERNEL | GFP_DMA);
     91	if (!msg->buffer) {
     92		kfree(msg);
     93		return NULL;
     94	}
     95
     96	msg->length = len;
     97	msg->options = opt;
     98
     99	memcpy(msg->buffer, &h, SSP_HEADER_SIZE);
    100
    101	return msg;
    102}
    103
    104/*
    105 * It is a bit heavy to do it this way but often the function is used to compose
    106 * the message from smaller chunks which are placed on the stack.  Often the
    107 * chunks are small so memcpy should be optimalized.
    108 */
    109static inline void ssp_fill_buffer(struct ssp_msg *m, unsigned int offset,
    110				   const void *src, unsigned int len)
    111{
    112	memcpy(&m->buffer[SSP_HEADER_SIZE_ALIGNED + offset], src, len);
    113}
    114
    115static inline void ssp_get_buffer(struct ssp_msg *m, unsigned int offset,
    116				  void *dest, unsigned int len)
    117{
    118	memcpy(dest, &m->buffer[SSP_HEADER_SIZE_ALIGNED + offset],  len);
    119}
    120
    121#define SSP_GET_BUFFER_AT_INDEX(m, index) \
    122	(m->buffer[SSP_HEADER_SIZE_ALIGNED + index])
    123#define SSP_SET_BUFFER_AT_INDEX(m, index, val) \
    124	(m->buffer[SSP_HEADER_SIZE_ALIGNED + index] = val)
    125
    126static void ssp_clean_msg(struct ssp_msg *m)
    127{
    128	kfree(m->buffer);
    129	kfree(m);
    130}
    131
    132static int ssp_print_mcu_debug(char *data_frame, int *data_index,
    133			       int received_len)
    134{
    135	int length = data_frame[(*data_index)++];
    136
    137	if (length > received_len - *data_index || length <= 0) {
    138		ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n",
    139			length, received_len);
    140		return -EPROTO;
    141	}
    142
    143	ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]);
    144
    145	*data_index += length;
    146
    147	return 0;
    148}
    149
    150/*
    151 * It was designed that way - additional lines to some kind of handshake,
    152 * please do not ask why - only the firmware guy can know it.
    153 */
    154static int ssp_check_lines(struct ssp_data *data, bool state)
    155{
    156	int delay_cnt = 0;
    157
    158	gpiod_set_value_cansleep(data->ap_mcu_gpiod, state);
    159
    160	while (gpiod_get_value_cansleep(data->mcu_ap_gpiod) != state) {
    161		usleep_range(3000, 3500);
    162
    163		if (data->shut_down || delay_cnt++ > 500) {
    164			dev_err(SSP_DEV, "%s:timeout, hw ack wait fail %d\n",
    165				__func__, state);
    166
    167			if (!state)
    168				gpiod_set_value_cansleep(data->ap_mcu_gpiod, 1);
    169
    170			return -ETIMEDOUT;
    171		}
    172	}
    173
    174	return 0;
    175}
    176
    177static int ssp_do_transfer(struct ssp_data *data, struct ssp_msg *msg,
    178			   struct completion *done, int timeout)
    179{
    180	int status;
    181	/*
    182	 * check if this is a short one way message or the whole transfer has
    183	 * second part after an interrupt
    184	 */
    185	const bool use_no_irq = msg->length == 0;
    186
    187	if (data->shut_down)
    188		return -EPERM;
    189
    190	msg->done = done;
    191
    192	mutex_lock(&data->comm_lock);
    193
    194	status = ssp_check_lines(data, false);
    195	if (status < 0)
    196		goto _error_locked;
    197
    198	status = spi_write(data->spi, msg->buffer, SSP_HEADER_SIZE);
    199	if (status < 0) {
    200		gpiod_set_value_cansleep(data->ap_mcu_gpiod, 1);
    201		dev_err(SSP_DEV, "%s spi_write fail\n", __func__);
    202		goto _error_locked;
    203	}
    204
    205	if (!use_no_irq) {
    206		mutex_lock(&data->pending_lock);
    207		list_add_tail(&msg->list, &data->pending_list);
    208		mutex_unlock(&data->pending_lock);
    209	}
    210
    211	status = ssp_check_lines(data, true);
    212	if (status < 0) {
    213		if (!use_no_irq) {
    214			mutex_lock(&data->pending_lock);
    215			list_del(&msg->list);
    216			mutex_unlock(&data->pending_lock);
    217		}
    218		goto _error_locked;
    219	}
    220
    221	mutex_unlock(&data->comm_lock);
    222
    223	if (!use_no_irq && done)
    224		if (wait_for_completion_timeout(done,
    225						msecs_to_jiffies(timeout)) ==
    226		    0) {
    227			mutex_lock(&data->pending_lock);
    228			list_del(&msg->list);
    229			mutex_unlock(&data->pending_lock);
    230
    231			data->timeout_cnt++;
    232			return -ETIMEDOUT;
    233		}
    234
    235	return 0;
    236
    237_error_locked:
    238	mutex_unlock(&data->comm_lock);
    239	data->timeout_cnt++;
    240	return status;
    241}
    242
    243static inline int ssp_spi_sync_command(struct ssp_data *data,
    244				       struct ssp_msg *msg)
    245{
    246	return ssp_do_transfer(data, msg, NULL, 0);
    247}
    248
    249static int ssp_spi_sync(struct ssp_data *data, struct ssp_msg *msg,
    250			int timeout)
    251{
    252	DECLARE_COMPLETION_ONSTACK(done);
    253
    254	if (WARN_ON(!msg->length))
    255		return -EPERM;
    256
    257	return ssp_do_transfer(data, msg, &done, timeout);
    258}
    259
    260static int ssp_handle_big_data(struct ssp_data *data, char *dataframe, int *idx)
    261{
    262	/* mock-up, it will be changed with adding another sensor types */
    263	*idx += 8;
    264	return 0;
    265}
    266
    267static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
    268{
    269	int idx, sd;
    270	struct ssp_sensor_data *spd;
    271	struct iio_dev **indio_devs = data->sensor_devs;
    272
    273	for (idx = 0; idx < len;) {
    274		switch (dataframe[idx++]) {
    275		case SSP_MSG2AP_INST_BYPASS_DATA:
    276			if (idx >= len)
    277				return -EPROTO;
    278			sd = dataframe[idx++];
    279			if (sd < 0 || sd >= SSP_SENSOR_MAX) {
    280				dev_err(SSP_DEV,
    281					"Mcu data frame1 error %d\n", sd);
    282				return -EPROTO;
    283			}
    284
    285			if (indio_devs[sd]) {
    286				spd = iio_priv(indio_devs[sd]);
    287				if (spd->process_data) {
    288					if (idx >= len)
    289						return -EPROTO;
    290					spd->process_data(indio_devs[sd],
    291							  &dataframe[idx],
    292							  data->timestamp);
    293				}
    294			} else {
    295				dev_err(SSP_DEV, "no client for frame\n");
    296			}
    297
    298			idx += ssp_offset_map[sd];
    299			break;
    300		case SSP_MSG2AP_INST_DEBUG_DATA:
    301			if (idx >= len)
    302				return -EPROTO;
    303			sd = ssp_print_mcu_debug(dataframe, &idx, len);
    304			if (sd) {
    305				dev_err(SSP_DEV,
    306					"Mcu data frame3 error %d\n", sd);
    307				return sd;
    308			}
    309			break;
    310		case SSP_MSG2AP_INST_LIBRARY_DATA:
    311			idx += len;
    312			break;
    313		case SSP_MSG2AP_INST_BIG_DATA:
    314			ssp_handle_big_data(data, dataframe, &idx);
    315			break;
    316		case SSP_MSG2AP_INST_TIME_SYNC:
    317			data->time_syncing = true;
    318			break;
    319		case SSP_MSG2AP_INST_RESET:
    320			ssp_queue_ssp_refresh_task(data, 0);
    321			break;
    322		}
    323	}
    324
    325	if (data->time_syncing)
    326		data->timestamp = ktime_get_real_ns();
    327
    328	return 0;
    329}
    330
    331/* threaded irq */
    332int ssp_irq_msg(struct ssp_data *data)
    333{
    334	char *buffer;
    335	u8 msg_type;
    336	int ret;
    337	u16 length, msg_options;
    338	struct ssp_msg *msg = NULL, *iter, *n;
    339
    340	ret = spi_read(data->spi, data->header_buffer, SSP_HEADER_BUFFER_SIZE);
    341	if (ret < 0) {
    342		dev_err(SSP_DEV, "header read fail\n");
    343		return ret;
    344	}
    345
    346	length = le16_to_cpu(data->header_buffer[1]);
    347	msg_options = le16_to_cpu(data->header_buffer[0]);
    348
    349	if (length == 0) {
    350		dev_err(SSP_DEV, "length received from mcu is 0\n");
    351		return -EINVAL;
    352	}
    353
    354	msg_type = SSP_GET_MESSAGE_TYPE(msg_options);
    355
    356	switch (msg_type) {
    357	case SSP_AP2HUB_READ:
    358	case SSP_AP2HUB_WRITE:
    359		/*
    360		 * this is a small list, a few elements - the packets can be
    361		 * received with no order
    362		 */
    363		mutex_lock(&data->pending_lock);
    364		list_for_each_entry_safe(iter, n, &data->pending_list, list) {
    365			if (iter->options == msg_options) {
    366				list_del(&iter->list);
    367				msg = iter;
    368				break;
    369			}
    370		}
    371
    372		if (!msg) {
    373			/*
    374			 * here can be implemented dead messages handling
    375			 * but the slave should not send such ones - it is to
    376			 * check but let's handle this
    377			 */
    378			buffer = kmalloc(length, GFP_KERNEL | GFP_DMA);
    379			if (!buffer) {
    380				ret = -ENOMEM;
    381				goto _unlock;
    382			}
    383
    384			/* got dead packet so it is always an error */
    385			ret = spi_read(data->spi, buffer, length);
    386			if (ret >= 0)
    387				ret = -EPROTO;
    388
    389			kfree(buffer);
    390
    391			dev_err(SSP_DEV, "No match error %x\n",
    392				msg_options);
    393
    394			goto _unlock;
    395		}
    396
    397		if (msg_type == SSP_AP2HUB_READ)
    398			ret = spi_read(data->spi,
    399				       &msg->buffer[SSP_HEADER_SIZE_ALIGNED],
    400				       msg->length);
    401
    402		if (msg_type == SSP_AP2HUB_WRITE) {
    403			ret = spi_write(data->spi,
    404					&msg->buffer[SSP_HEADER_SIZE_ALIGNED],
    405					msg->length);
    406			if (msg_options & SSP_AP2HUB_RETURN) {
    407				msg->options =
    408					SSP_AP2HUB_READ | SSP_AP2HUB_RETURN;
    409				msg->length = 1;
    410
    411				list_add_tail(&msg->list, &data->pending_list);
    412				goto _unlock;
    413			}
    414		}
    415
    416		if (msg->done)
    417			if (!completion_done(msg->done))
    418				complete(msg->done);
    419_unlock:
    420		mutex_unlock(&data->pending_lock);
    421		break;
    422	case SSP_HUB2AP_WRITE:
    423		buffer = kzalloc(length, GFP_KERNEL | GFP_DMA);
    424		if (!buffer)
    425			return -ENOMEM;
    426
    427		ret = spi_read(data->spi, buffer, length);
    428		if (ret < 0) {
    429			dev_err(SSP_DEV, "spi read fail\n");
    430			kfree(buffer);
    431			break;
    432		}
    433
    434		ret = ssp_parse_dataframe(data, buffer, length);
    435
    436		kfree(buffer);
    437		break;
    438
    439	default:
    440		dev_err(SSP_DEV, "unknown msg type\n");
    441		return -EPROTO;
    442	}
    443
    444	return ret;
    445}
    446
    447void ssp_clean_pending_list(struct ssp_data *data)
    448{
    449	struct ssp_msg *msg, *n;
    450
    451	mutex_lock(&data->pending_lock);
    452	list_for_each_entry_safe(msg, n, &data->pending_list, list) {
    453		list_del(&msg->list);
    454
    455		if (msg->done)
    456			if (!completion_done(msg->done))
    457				complete(msg->done);
    458	}
    459	mutex_unlock(&data->pending_lock);
    460}
    461
    462int ssp_command(struct ssp_data *data, char command, int arg)
    463{
    464	int ret;
    465	struct ssp_msg *msg;
    466
    467	msg = ssp_create_msg(command, 0, SSP_AP2HUB_WRITE, arg);
    468	if (!msg)
    469		return -ENOMEM;
    470
    471	ssp_dbg("%s - command 0x%x %d\n", __func__, command, arg);
    472
    473	ret = ssp_spi_sync_command(data, msg);
    474	ssp_clean_msg(msg);
    475
    476	return ret;
    477}
    478
    479int ssp_send_instruction(struct ssp_data *data, u8 inst, u8 sensor_type,
    480			 u8 *send_buf, u8 length)
    481{
    482	int ret;
    483	struct ssp_msg *msg;
    484
    485	if (data->fw_dl_state == SSP_FW_DL_STATE_DOWNLOADING) {
    486		dev_err(SSP_DEV, "%s - Skip Inst! DL state = %d\n",
    487			__func__, data->fw_dl_state);
    488		return -EBUSY;
    489	} else if (!(data->available_sensors & BIT(sensor_type)) &&
    490		   (inst <= SSP_MSG2SSP_INST_CHANGE_DELAY)) {
    491		dev_err(SSP_DEV, "%s - Bypass Inst Skip! - %u\n",
    492			__func__, sensor_type);
    493		return -EIO; /* just fail */
    494	}
    495
    496	msg = ssp_create_msg(inst, length + 2, SSP_AP2HUB_WRITE, 0);
    497	if (!msg)
    498		return -ENOMEM;
    499
    500	ssp_fill_buffer(msg, 0, &sensor_type, 1);
    501	ssp_fill_buffer(msg, 1, send_buf, length);
    502
    503	ssp_dbg("%s - Inst = 0x%x, Sensor Type = 0x%x, data = %u\n",
    504		__func__, inst, sensor_type, send_buf[1]);
    505
    506	ret = ssp_spi_sync(data, msg, 1000);
    507	ssp_clean_msg(msg);
    508
    509	return ret;
    510}
    511
    512int ssp_get_chipid(struct ssp_data *data)
    513{
    514	int ret;
    515	char buffer;
    516	struct ssp_msg *msg;
    517
    518	msg = ssp_create_msg(SSP_MSG2SSP_AP_WHOAMI, 1, SSP_AP2HUB_READ, 0);
    519	if (!msg)
    520		return -ENOMEM;
    521
    522	ret = ssp_spi_sync(data, msg, 1000);
    523
    524	buffer = SSP_GET_BUFFER_AT_INDEX(msg, 0);
    525
    526	ssp_clean_msg(msg);
    527
    528	return ret < 0 ? ret : buffer;
    529}
    530
    531int ssp_set_magnetic_matrix(struct ssp_data *data)
    532{
    533	int ret;
    534	struct ssp_msg *msg;
    535
    536	msg = ssp_create_msg(SSP_MSG2SSP_AP_SET_MAGNETIC_STATIC_MATRIX,
    537			     data->sensorhub_info->mag_length, SSP_AP2HUB_WRITE,
    538			     0);
    539	if (!msg)
    540		return -ENOMEM;
    541
    542	ssp_fill_buffer(msg, 0, data->sensorhub_info->mag_table,
    543			data->sensorhub_info->mag_length);
    544
    545	ret = ssp_spi_sync(data, msg, 1000);
    546	ssp_clean_msg(msg);
    547
    548	return ret;
    549}
    550
    551unsigned int ssp_get_sensor_scanning_info(struct ssp_data *data)
    552{
    553	int ret;
    554	__le32 result;
    555	u32 cpu_result = 0;
    556
    557	struct ssp_msg *msg = ssp_create_msg(SSP_MSG2SSP_AP_SENSOR_SCANNING, 4,
    558					     SSP_AP2HUB_READ, 0);
    559	if (!msg)
    560		return 0;
    561
    562	ret = ssp_spi_sync(data, msg, 1000);
    563	if (ret < 0) {
    564		dev_err(SSP_DEV, "%s - spi read fail %d\n", __func__, ret);
    565		goto _exit;
    566	}
    567
    568	ssp_get_buffer(msg, 0, &result, 4);
    569	cpu_result = le32_to_cpu(result);
    570
    571	dev_info(SSP_DEV, "%s state: 0x%08x\n", __func__, cpu_result);
    572
    573_exit:
    574	ssp_clean_msg(msg);
    575	return cpu_result;
    576}
    577
    578unsigned int ssp_get_firmware_rev(struct ssp_data *data)
    579{
    580	int ret;
    581	__le32 result;
    582
    583	struct ssp_msg *msg = ssp_create_msg(SSP_MSG2SSP_AP_FIRMWARE_REV, 4,
    584					     SSP_AP2HUB_READ, 0);
    585	if (!msg)
    586		return SSP_INVALID_REVISION;
    587
    588	ret = ssp_spi_sync(data, msg, 1000);
    589	if (ret < 0) {
    590		dev_err(SSP_DEV, "%s - transfer fail %d\n", __func__, ret);
    591		ret = SSP_INVALID_REVISION;
    592		goto _exit;
    593	}
    594
    595	ssp_get_buffer(msg, 0, &result, 4);
    596	ret = le32_to_cpu(result);
    597
    598_exit:
    599	ssp_clean_msg(msg);
    600	return ret;
    601}