cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

via-macii.c (14393B)


      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 * Device driver for the via ADB on (many) Mac II-class machines
      4 *
      5 * Based on the original ADB keyboard handler Copyright (c) 1997 Alan Cox
      6 * Also derived from code Copyright (C) 1996 Paul Mackerras.
      7 *
      8 * With various updates provided over the years by Michael Schmitz,
      9 * Guideo Koerber and others.
     10 *
     11 * Rewrite for Unified ADB by Joshua M. Thompson (funaho@jurai.org)
     12 *
     13 * 1999-08-02 (jmt) - Initial rewrite for Unified ADB.
     14 * 2000-03-29 Tony Mantler <tonym@mac.linux-m68k.org>
     15 *            - Big overhaul, should actually work now.
     16 * 2006-12-31 Finn Thain - Another overhaul.
     17 *
     18 * Suggested reading:
     19 *   Inside Macintosh, ch. 5 ADB Manager
     20 *   Guide to the Macinstosh Family Hardware, ch. 8 Apple Desktop Bus
     21 *   Rockwell R6522 VIA datasheet
     22 *
     23 * Apple's "ADB Analyzer" bus sniffer is invaluable:
     24 *   ftp://ftp.apple.com/developer/Tool_Chest/Devices_-_Hardware/Apple_Desktop_Bus/
     25 */
     26#include <linux/types.h>
     27#include <linux/errno.h>
     28#include <linux/kernel.h>
     29#include <linux/delay.h>
     30#include <linux/adb.h>
     31#include <linux/interrupt.h>
     32#include <linux/init.h>
     33#include <asm/macintosh.h>
     34#include <asm/macints.h>
     35#include <asm/mac_via.h>
     36
     37static volatile unsigned char *via;
     38
     39/* VIA registers - spaced 0x200 bytes apart */
     40#define RS		0x200		/* skip between registers */
     41#define B		0		/* B-side data */
     42#define A		RS		/* A-side data */
     43#define DIRB		(2*RS)		/* B-side direction (1=output) */
     44#define DIRA		(3*RS)		/* A-side direction (1=output) */
     45#define T1CL		(4*RS)		/* Timer 1 ctr/latch (low 8 bits) */
     46#define T1CH		(5*RS)		/* Timer 1 counter (high 8 bits) */
     47#define T1LL		(6*RS)		/* Timer 1 latch (low 8 bits) */
     48#define T1LH		(7*RS)		/* Timer 1 latch (high 8 bits) */
     49#define T2CL		(8*RS)		/* Timer 2 ctr/latch (low 8 bits) */
     50#define T2CH		(9*RS)		/* Timer 2 counter (high 8 bits) */
     51#define SR		(10*RS)		/* Shift register */
     52#define ACR		(11*RS)		/* Auxiliary control register */
     53#define PCR		(12*RS)		/* Peripheral control register */
     54#define IFR		(13*RS)		/* Interrupt flag register */
     55#define IER		(14*RS)		/* Interrupt enable register */
     56#define ANH		(15*RS)		/* A-side data, no handshake */
     57
     58/* Bits in B data register: all active low */
     59#define CTLR_IRQ	0x08		/* Controller rcv status (input) */
     60#define ST_MASK		0x30		/* mask for selecting ADB state bits */
     61
     62/* Bits in ACR */
     63#define SR_CTRL		0x1c		/* Shift register control bits */
     64#define SR_EXT		0x0c		/* Shift on external clock */
     65#define SR_OUT		0x10		/* Shift out if 1 */
     66
     67/* Bits in IFR and IER */
     68#define IER_SET		0x80		/* set bits in IER */
     69#define IER_CLR		0		/* clear bits in IER */
     70#define SR_INT		0x04		/* Shift register full/empty */
     71
     72/* ADB transaction states according to GMHW */
     73#define ST_CMD		0x00		/* ADB state: command byte */
     74#define ST_EVEN		0x10		/* ADB state: even data byte */
     75#define ST_ODD		0x20		/* ADB state: odd data byte */
     76#define ST_IDLE		0x30		/* ADB state: idle, nothing to send */
     77
     78/* ADB command byte structure */
     79#define ADDR_MASK	0xF0
     80#define CMD_MASK	0x0F
     81#define OP_MASK		0x0C
     82#define TALK		0x0C
     83
     84static int macii_init_via(void);
     85static void macii_start(void);
     86static irqreturn_t macii_interrupt(int irq, void *arg);
     87static void macii_queue_poll(void);
     88
     89static int macii_probe(void);
     90static int macii_init(void);
     91static int macii_send_request(struct adb_request *req, int sync);
     92static int macii_write(struct adb_request *req);
     93static int macii_autopoll(int devs);
     94static void macii_poll(void);
     95static int macii_reset_bus(void);
     96
     97struct adb_driver via_macii_driver = {
     98	.name         = "Mac II",
     99	.probe        = macii_probe,
    100	.init         = macii_init,
    101	.send_request = macii_send_request,
    102	.autopoll     = macii_autopoll,
    103	.poll         = macii_poll,
    104	.reset_bus    = macii_reset_bus,
    105};
    106
    107static enum macii_state {
    108	idle,
    109	sending,
    110	reading,
    111} macii_state;
    112
    113static struct adb_request *current_req; /* first request struct in the queue */
    114static struct adb_request *last_req;     /* last request struct in the queue */
    115static unsigned char reply_buf[16];        /* storage for autopolled replies */
    116static unsigned char *reply_ptr;     /* next byte in reply_buf or req->reply */
    117static bool reading_reply;       /* store reply in reply_buf else req->reply */
    118static int data_index;      /* index of the next byte to send from req->data */
    119static int reply_len; /* number of bytes received in reply_buf or req->reply */
    120static int status;          /* VIA's ADB status bits captured upon interrupt */
    121static bool bus_timeout;                   /* no data was sent by the device */
    122static bool srq_asserted;    /* have to poll for the device that asserted it */
    123static u8 last_cmd;              /* the most recent command byte transmitted */
    124static u8 last_talk_cmd;    /* the most recent Talk command byte transmitted */
    125static u8 last_poll_cmd; /* the most recent Talk R0 command byte transmitted */
    126static unsigned int autopoll_devs;  /* bits set are device addresses to poll */
    127
    128/* Check for MacII style ADB */
    129static int macii_probe(void)
    130{
    131	if (macintosh_config->adb_type != MAC_ADB_II)
    132		return -ENODEV;
    133
    134	via = via1;
    135
    136	pr_info("adb: Mac II ADB Driver v1.0 for Unified ADB\n");
    137	return 0;
    138}
    139
    140/* Initialize the driver */
    141static int macii_init(void)
    142{
    143	unsigned long flags;
    144	int err;
    145
    146	local_irq_save(flags);
    147
    148	err = macii_init_via();
    149	if (err)
    150		goto out;
    151
    152	err = request_irq(IRQ_MAC_ADB, macii_interrupt, 0, "ADB",
    153			  macii_interrupt);
    154	if (err)
    155		goto out;
    156
    157	macii_state = idle;
    158out:
    159	local_irq_restore(flags);
    160	return err;
    161}
    162
    163/* initialize the hardware */
    164static int macii_init_via(void)
    165{
    166	unsigned char x;
    167
    168	/* We want CTLR_IRQ as input and ST_EVEN | ST_ODD as output lines. */
    169	via[DIRB] = (via[DIRB] | ST_EVEN | ST_ODD) & ~CTLR_IRQ;
    170
    171	/* Set up state: idle */
    172	via[B] |= ST_IDLE;
    173
    174	/* Shift register on input */
    175	via[ACR] = (via[ACR] & ~SR_CTRL) | SR_EXT;
    176
    177	/* Wipe any pending data and int */
    178	x = via[SR];
    179
    180	return 0;
    181}
    182
    183/* Send an ADB poll (Talk Register 0 command prepended to the request queue) */
    184static void macii_queue_poll(void)
    185{
    186	static struct adb_request req;
    187	unsigned char poll_command;
    188	unsigned int poll_addr;
    189
    190	/* This only polls devices in the autopoll list, which assumes that
    191	 * unprobed devices never assert SRQ. That could happen if a device was
    192	 * plugged in after the adb bus scan. Unplugging it again will resolve
    193	 * the problem. This behaviour is similar to MacOS.
    194	 */
    195	if (!autopoll_devs)
    196		return;
    197
    198	/* The device most recently polled may not be the best device to poll
    199	 * right now. Some other device(s) may have signalled SRQ (the active
    200	 * device won't do that). Or the autopoll list may have been changed.
    201	 * Try polling the next higher address.
    202	 */
    203	poll_addr = (last_poll_cmd & ADDR_MASK) >> 4;
    204	if ((srq_asserted && last_cmd == last_poll_cmd) ||
    205	    !(autopoll_devs & (1 << poll_addr))) {
    206		unsigned int higher_devs;
    207
    208		higher_devs = autopoll_devs & -(1 << (poll_addr + 1));
    209		poll_addr = ffs(higher_devs ? higher_devs : autopoll_devs) - 1;
    210	}
    211
    212	/* Send a Talk Register 0 command */
    213	poll_command = ADB_READREG(poll_addr, 0);
    214
    215	/* No need to repeat this Talk command. The transceiver will do that
    216	 * as long as it is idle.
    217	 */
    218	if (poll_command == last_cmd)
    219		return;
    220
    221	adb_request(&req, NULL, ADBREQ_NOSEND, 1, poll_command);
    222
    223	req.sent = 0;
    224	req.complete = 0;
    225	req.reply_len = 0;
    226	req.next = current_req;
    227
    228	if (WARN_ON(current_req)) {
    229		current_req = &req;
    230	} else {
    231		current_req = &req;
    232		last_req = &req;
    233	}
    234}
    235
    236/* Send an ADB request; if sync, poll out the reply 'till it's done */
    237static int macii_send_request(struct adb_request *req, int sync)
    238{
    239	int err;
    240
    241	err = macii_write(req);
    242	if (err)
    243		return err;
    244
    245	if (sync)
    246		while (!req->complete)
    247			macii_poll();
    248
    249	return 0;
    250}
    251
    252/* Send an ADB request (append to request queue) */
    253static int macii_write(struct adb_request *req)
    254{
    255	unsigned long flags;
    256
    257	if (req->nbytes < 2 || req->data[0] != ADB_PACKET || req->nbytes > 15) {
    258		req->complete = 1;
    259		return -EINVAL;
    260	}
    261
    262	req->next = NULL;
    263	req->sent = 0;
    264	req->complete = 0;
    265	req->reply_len = 0;
    266
    267	local_irq_save(flags);
    268
    269	if (current_req != NULL) {
    270		last_req->next = req;
    271		last_req = req;
    272	} else {
    273		current_req = req;
    274		last_req = req;
    275		if (macii_state == idle)
    276			macii_start();
    277	}
    278
    279	local_irq_restore(flags);
    280
    281	return 0;
    282}
    283
    284/* Start auto-polling */
    285static int macii_autopoll(int devs)
    286{
    287	unsigned long flags;
    288
    289	local_irq_save(flags);
    290
    291	/* bit 1 == device 1, and so on. */
    292	autopoll_devs = (unsigned int)devs & 0xFFFE;
    293
    294	if (!current_req) {
    295		macii_queue_poll();
    296		if (current_req && macii_state == idle)
    297			macii_start();
    298	}
    299
    300	local_irq_restore(flags);
    301
    302	return 0;
    303}
    304
    305/* Prod the chip without interrupts */
    306static void macii_poll(void)
    307{
    308	macii_interrupt(0, NULL);
    309}
    310
    311/* Reset the bus */
    312static int macii_reset_bus(void)
    313{
    314	struct adb_request req;
    315
    316	/* Command = 0, Address = ignored */
    317	adb_request(&req, NULL, ADBREQ_NOSEND, 1, ADB_BUSRESET);
    318	macii_send_request(&req, 1);
    319
    320	/* Don't want any more requests during the Global Reset low time. */
    321	udelay(3000);
    322
    323	return 0;
    324}
    325
    326/* Start sending ADB packet */
    327static void macii_start(void)
    328{
    329	struct adb_request *req;
    330
    331	req = current_req;
    332
    333	/* Now send it. Be careful though, that first byte of the request
    334	 * is actually ADB_PACKET; the real data begins at index 1!
    335	 * And req->nbytes is the number of bytes of real data plus one.
    336	 */
    337
    338	/* Output mode */
    339	via[ACR] |= SR_OUT;
    340	/* Load data */
    341	via[SR] = req->data[1];
    342	/* set ADB state to 'command' */
    343	via[B] = (via[B] & ~ST_MASK) | ST_CMD;
    344
    345	macii_state = sending;
    346	data_index = 2;
    347
    348	bus_timeout = false;
    349	srq_asserted = false;
    350}
    351
    352/*
    353 * The notorious ADB interrupt handler - does all of the protocol handling.
    354 * Relies on the ADB controller sending and receiving data, thereby
    355 * generating shift register interrupts (SR_INT) for us. This means there has
    356 * to be activity on the ADB bus. The chip will poll to achieve this.
    357 *
    358 * The VIA Port B output signalling works as follows. After the ADB transceiver
    359 * sees a transition on the PB4 and PB5 lines it will crank over the VIA shift
    360 * register which eventually raises the SR_INT interrupt. The PB4/PB5 outputs
    361 * are toggled with each byte as the ADB transaction progresses.
    362 *
    363 * Request with no reply expected (and empty transceiver buffer):
    364 *     CMD -> IDLE
    365 * Request with expected reply packet (or with buffered autopoll packet):
    366 *     CMD -> EVEN -> ODD -> EVEN -> ... -> IDLE
    367 * Unsolicited packet:
    368 *     IDLE -> EVEN -> ODD -> EVEN -> ... -> IDLE
    369 */
    370static irqreturn_t macii_interrupt(int irq, void *arg)
    371{
    372	int x;
    373	struct adb_request *req;
    374	unsigned long flags;
    375
    376	local_irq_save(flags);
    377
    378	if (!arg) {
    379		/* Clear the SR IRQ flag when polling. */
    380		if (via[IFR] & SR_INT)
    381			via[IFR] = SR_INT;
    382		else {
    383			local_irq_restore(flags);
    384			return IRQ_NONE;
    385		}
    386	}
    387
    388	status = via[B] & (ST_MASK | CTLR_IRQ);
    389
    390	switch (macii_state) {
    391	case idle:
    392		WARN_ON((status & ST_MASK) != ST_IDLE);
    393
    394		reply_ptr = reply_buf;
    395		reading_reply = false;
    396
    397		bus_timeout = false;
    398		srq_asserted = false;
    399
    400		x = via[SR];
    401
    402		if (!(status & CTLR_IRQ)) {
    403			/* /CTLR_IRQ asserted in idle state means we must
    404			 * read an autopoll reply from the transceiver buffer.
    405			 */
    406			macii_state = reading;
    407			*reply_ptr = x;
    408			reply_len = 1;
    409		} else {
    410			/* bus timeout */
    411			reply_len = 0;
    412			break;
    413		}
    414
    415		/* set ADB state = even for first data byte */
    416		via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
    417		break;
    418
    419	case sending:
    420		req = current_req;
    421
    422		if (status == (ST_CMD | CTLR_IRQ)) {
    423			/* /CTLR_IRQ de-asserted after the command byte means
    424			 * the host can continue with the transaction.
    425			 */
    426
    427			/* Store command byte */
    428			last_cmd = req->data[1];
    429			if ((last_cmd & OP_MASK) == TALK) {
    430				last_talk_cmd = last_cmd;
    431				if ((last_cmd & CMD_MASK) == ADB_READREG(0, 0))
    432					last_poll_cmd = last_cmd;
    433			}
    434		}
    435
    436		if (status == ST_CMD) {
    437			/* /CTLR_IRQ asserted after the command byte means we
    438			 * must read an autopoll reply. The first byte was
    439			 * lost because the shift register was an output.
    440			 */
    441			macii_state = reading;
    442
    443			reading_reply = false;
    444			reply_ptr = reply_buf;
    445			*reply_ptr = last_talk_cmd;
    446			reply_len = 1;
    447
    448			/* reset to shift in */
    449			via[ACR] &= ~SR_OUT;
    450			x = via[SR];
    451		} else if (data_index >= req->nbytes) {
    452			req->sent = 1;
    453
    454			if (req->reply_expected) {
    455				macii_state = reading;
    456
    457				reading_reply = true;
    458				reply_ptr = req->reply;
    459				*reply_ptr = req->data[1];
    460				reply_len = 1;
    461
    462				via[ACR] &= ~SR_OUT;
    463				x = via[SR];
    464			} else if ((req->data[1] & OP_MASK) == TALK) {
    465				macii_state = reading;
    466
    467				reading_reply = false;
    468				reply_ptr = reply_buf;
    469				*reply_ptr = req->data[1];
    470				reply_len = 1;
    471
    472				via[ACR] &= ~SR_OUT;
    473				x = via[SR];
    474
    475				req->complete = 1;
    476				current_req = req->next;
    477				if (req->done)
    478					(*req->done)(req);
    479			} else {
    480				macii_state = idle;
    481
    482				req->complete = 1;
    483				current_req = req->next;
    484				if (req->done)
    485					(*req->done)(req);
    486				break;
    487			}
    488		} else {
    489			via[SR] = req->data[data_index++];
    490		}
    491
    492		if ((via[B] & ST_MASK) == ST_CMD) {
    493			/* just sent the command byte, set to EVEN */
    494			via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
    495		} else {
    496			/* invert state bits, toggle ODD/EVEN */
    497			via[B] ^= ST_MASK;
    498		}
    499		break;
    500
    501	case reading:
    502		x = via[SR];
    503		WARN_ON((status & ST_MASK) == ST_CMD ||
    504			(status & ST_MASK) == ST_IDLE);
    505
    506		if (!(status & CTLR_IRQ)) {
    507			if (status == ST_EVEN && reply_len == 1) {
    508				bus_timeout = true;
    509			} else if (status == ST_ODD && reply_len == 2) {
    510				srq_asserted = true;
    511			} else {
    512				macii_state = idle;
    513
    514				if (bus_timeout)
    515					reply_len = 0;
    516
    517				if (reading_reply) {
    518					struct adb_request *req = current_req;
    519
    520					req->reply_len = reply_len;
    521
    522					req->complete = 1;
    523					current_req = req->next;
    524					if (req->done)
    525						(*req->done)(req);
    526				} else if (reply_len && autopoll_devs &&
    527					   reply_buf[0] == last_poll_cmd) {
    528					adb_input(reply_buf, reply_len, 1);
    529				}
    530				break;
    531			}
    532		}
    533
    534		if (reply_len < ARRAY_SIZE(reply_buf)) {
    535			reply_ptr++;
    536			*reply_ptr = x;
    537			reply_len++;
    538		}
    539
    540		/* invert state bits, toggle ODD/EVEN */
    541		via[B] ^= ST_MASK;
    542		break;
    543
    544	default:
    545		break;
    546	}
    547
    548	if (macii_state == idle) {
    549		if (!current_req)
    550			macii_queue_poll();
    551
    552		if (current_req)
    553			macii_start();
    554
    555		if (macii_state == idle) {
    556			via[ACR] &= ~SR_OUT;
    557			x = via[SR];
    558			via[B] = (via[B] & ~ST_MASK) | ST_IDLE;
    559		}
    560	}
    561
    562	local_irq_restore(flags);
    563	return IRQ_HANDLED;
    564}