cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

ehci-dbgp.c (26530B)


      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 * Standalone EHCI usb debug driver
      4 *
      5 * Originally written by:
      6 *  Eric W. Biederman" <ebiederm@xmission.com> and
      7 *  Yinghai Lu <yhlu.kernel@gmail.com>
      8 *
      9 * Changes for early/late printk and HW errata:
     10 *  Jason Wessel <jason.wessel@windriver.com>
     11 *  Copyright (C) 2009 Wind River Systems, Inc.
     12 *
     13 */
     14
     15#include <linux/console.h>
     16#include <linux/errno.h>
     17#include <linux/init.h>
     18#include <linux/iopoll.h>
     19#include <linux/pci_regs.h>
     20#include <linux/pci_ids.h>
     21#include <linux/usb/ch9.h>
     22#include <linux/usb/ehci_def.h>
     23#include <linux/delay.h>
     24#include <linux/serial_core.h>
     25#include <linux/kgdb.h>
     26#include <linux/kthread.h>
     27#include <asm/io.h>
     28#include <asm/pci-direct.h>
     29#include <asm/fixmap.h>
     30
     31/* The code here is intended to talk directly to the EHCI debug port
     32 * and does not require that you have any kind of USB host controller
     33 * drivers or USB device drivers compiled into the kernel.
     34 *
     35 * If you make a change to anything in here, the following test cases
     36 * need to pass where a USB debug device works in the following
     37 * configurations.
     38 *
     39 * 1. boot args:  earlyprintk=dbgp
     40 *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
     41 *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
     42 * 2. boot args: earlyprintk=dbgp,keep
     43 *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
     44 *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
     45 * 3. boot args: earlyprintk=dbgp console=ttyUSB0
     46 *     o kernel has CONFIG_USB_EHCI_HCD=y and
     47 *       CONFIG_USB_SERIAL_DEBUG=y
     48 * 4. boot args: earlyprintk=vga,dbgp
     49 *     o kernel compiled with # CONFIG_USB_EHCI_HCD is not set
     50 *     o kernel compiled with CONFIG_USB_EHCI_HCD=y
     51 *
     52 * For the 4th configuration you can turn on or off the DBGP_DEBUG
     53 * such that you can debug the dbgp device's driver code.
     54 */
     55
     56static int dbgp_phys_port = 1;
     57
     58static struct ehci_caps __iomem *ehci_caps;
     59static struct ehci_regs __iomem *ehci_regs;
     60static struct ehci_dbg_port __iomem *ehci_debug;
     61static int dbgp_not_safe; /* Cannot use debug device during ehci reset */
     62static unsigned int dbgp_endpoint_out;
     63static unsigned int dbgp_endpoint_in;
     64
     65struct ehci_dev {
     66	u32 bus;
     67	u32 slot;
     68	u32 func;
     69};
     70
     71static struct ehci_dev ehci_dev;
     72
     73#define USB_DEBUG_DEVNUM 127
     74
     75#ifdef DBGP_DEBUG
     76#define dbgp_printk printk
     77static void dbgp_ehci_status(char *str)
     78{
     79	if (!ehci_debug)
     80		return;
     81	dbgp_printk("dbgp: %s\n", str);
     82	dbgp_printk("  Debug control: %08x", readl(&ehci_debug->control));
     83	dbgp_printk("  ehci cmd     : %08x", readl(&ehci_regs->command));
     84	dbgp_printk("  ehci conf flg: %08x\n",
     85		    readl(&ehci_regs->configured_flag));
     86	dbgp_printk("  ehci status  : %08x", readl(&ehci_regs->status));
     87	dbgp_printk("  ehci portsc  : %08x\n",
     88		    readl(&ehci_regs->port_status[dbgp_phys_port - 1]));
     89}
     90#else
     91static inline void dbgp_ehci_status(char *str) { }
     92static inline void dbgp_printk(const char *fmt, ...) { }
     93#endif
     94
     95static inline u32 dbgp_len_update(u32 x, u32 len)
     96{
     97	return (x & ~0x0f) | (len & 0x0f);
     98}
     99
    100#ifdef CONFIG_KGDB
    101static struct kgdb_io kgdbdbgp_io_ops;
    102#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
    103#else
    104#define dbgp_kgdb_mode (0)
    105#endif
    106
    107/* Local version of HC_LENGTH macro as ehci struct is not available here */
    108#define EARLY_HC_LENGTH(p)	(0x00ff & (p)) /* bits 7 : 0 */
    109
    110/*
    111 * USB Packet IDs (PIDs)
    112 */
    113
    114/* token */
    115#define USB_PID_OUT		0xe1
    116#define USB_PID_IN		0x69
    117#define USB_PID_SOF		0xa5
    118#define USB_PID_SETUP		0x2d
    119/* handshake */
    120#define USB_PID_ACK		0xd2
    121#define USB_PID_NAK		0x5a
    122#define USB_PID_STALL		0x1e
    123#define USB_PID_NYET		0x96
    124/* data */
    125#define USB_PID_DATA0		0xc3
    126#define USB_PID_DATA1		0x4b
    127#define USB_PID_DATA2		0x87
    128#define USB_PID_MDATA		0x0f
    129/* Special */
    130#define USB_PID_PREAMBLE	0x3c
    131#define USB_PID_ERR		0x3c
    132#define USB_PID_SPLIT		0x78
    133#define USB_PID_PING		0xb4
    134#define USB_PID_UNDEF_0		0xf0
    135
    136#define USB_PID_DATA_TOGGLE	0x88
    137#define DBGP_CLAIM (DBGP_OWNER | DBGP_ENABLED | DBGP_INUSE)
    138
    139#define PCI_CAP_ID_EHCI_DEBUG	0xa
    140
    141#define HUB_ROOT_RESET_TIME	50	/* times are in msec */
    142#define HUB_SHORT_RESET_TIME	10
    143#define HUB_LONG_RESET_TIME	200
    144#define HUB_RESET_TIMEOUT	500
    145
    146#define DBGP_MAX_PACKET		8
    147#define DBGP_TIMEOUT		(250 * 1000)
    148#define DBGP_LOOPS		1000
    149
    150static inline u32 dbgp_pid_write_update(u32 x, u32 tok)
    151{
    152	static int data0 = USB_PID_DATA1;
    153	data0 ^= USB_PID_DATA_TOGGLE;
    154	return (x & 0xffff0000) | (data0 << 8) | (tok & 0xff);
    155}
    156
    157static inline u32 dbgp_pid_read_update(u32 x, u32 tok)
    158{
    159	return (x & 0xffff0000) | (USB_PID_DATA0 << 8) | (tok & 0xff);
    160}
    161
    162static int dbgp_wait_until_complete(void)
    163{
    164	u32 ctrl;
    165	int ret;
    166
    167	ret = readl_poll_timeout_atomic(&ehci_debug->control, ctrl,
    168				(ctrl & DBGP_DONE), 1, DBGP_TIMEOUT);
    169	if (ret)
    170		return -DBGP_TIMEOUT;
    171
    172	/*
    173	 * Now that we have observed the completed transaction,
    174	 * clear the done bit.
    175	 */
    176	writel(ctrl | DBGP_DONE, &ehci_debug->control);
    177	return (ctrl & DBGP_ERROR) ? -DBGP_ERRCODE(ctrl) : DBGP_LEN(ctrl);
    178}
    179
    180static inline void dbgp_mdelay(int ms)
    181{
    182	int i;
    183
    184	while (ms--) {
    185		for (i = 0; i < 1000; i++)
    186			outb(0x1, 0x80);
    187	}
    188}
    189
    190static void dbgp_breath(void)
    191{
    192	/* Sleep to give the debug port a chance to breathe */
    193}
    194
    195static int dbgp_wait_until_done(unsigned ctrl, int loop)
    196{
    197	u32 pids, lpid;
    198	int ret;
    199
    200retry:
    201	writel(ctrl | DBGP_GO, &ehci_debug->control);
    202	ret = dbgp_wait_until_complete();
    203	pids = readl(&ehci_debug->pids);
    204	lpid = DBGP_PID_GET(pids);
    205
    206	if (ret < 0) {
    207		/* A -DBGP_TIMEOUT failure here means the device has
    208		 * failed, perhaps because it was unplugged, in which
    209		 * case we do not want to hang the system so the dbgp
    210		 * will be marked as unsafe to use.  EHCI reset is the
    211		 * only way to recover if you unplug the dbgp device.
    212		 */
    213		if (ret == -DBGP_TIMEOUT && !dbgp_not_safe)
    214			dbgp_not_safe = 1;
    215		if (ret == -DBGP_ERR_BAD && --loop > 0)
    216			goto retry;
    217		return ret;
    218	}
    219
    220	/*
    221	 * If the port is getting full or it has dropped data
    222	 * start pacing ourselves, not necessary but it's friendly.
    223	 */
    224	if ((lpid == USB_PID_NAK) || (lpid == USB_PID_NYET))
    225		dbgp_breath();
    226
    227	/* If I get a NACK reissue the transmission */
    228	if (lpid == USB_PID_NAK) {
    229		if (--loop > 0)
    230			goto retry;
    231	}
    232
    233	return ret;
    234}
    235
    236static inline void dbgp_set_data(const void *buf, int size)
    237{
    238	const unsigned char *bytes = buf;
    239	u32 lo, hi;
    240	int i;
    241
    242	lo = hi = 0;
    243	for (i = 0; i < 4 && i < size; i++)
    244		lo |= bytes[i] << (8*i);
    245	for (; i < 8 && i < size; i++)
    246		hi |= bytes[i] << (8*(i - 4));
    247	writel(lo, &ehci_debug->data03);
    248	writel(hi, &ehci_debug->data47);
    249}
    250
    251static inline void dbgp_get_data(void *buf, int size)
    252{
    253	unsigned char *bytes = buf;
    254	u32 lo, hi;
    255	int i;
    256
    257	lo = readl(&ehci_debug->data03);
    258	hi = readl(&ehci_debug->data47);
    259	for (i = 0; i < 4 && i < size; i++)
    260		bytes[i] = (lo >> (8*i)) & 0xff;
    261	for (; i < 8 && i < size; i++)
    262		bytes[i] = (hi >> (8*(i - 4))) & 0xff;
    263}
    264
    265static int dbgp_bulk_write(unsigned devnum, unsigned endpoint,
    266			 const char *bytes, int size)
    267{
    268	int ret;
    269	u32 addr;
    270	u32 pids, ctrl;
    271
    272	if (size > DBGP_MAX_PACKET)
    273		return -1;
    274
    275	addr = DBGP_EPADDR(devnum, endpoint);
    276
    277	pids = readl(&ehci_debug->pids);
    278	pids = dbgp_pid_write_update(pids, USB_PID_OUT);
    279
    280	ctrl = readl(&ehci_debug->control);
    281	ctrl = dbgp_len_update(ctrl, size);
    282	ctrl |= DBGP_OUT;
    283	ctrl |= DBGP_GO;
    284
    285	dbgp_set_data(bytes, size);
    286	writel(addr, &ehci_debug->address);
    287	writel(pids, &ehci_debug->pids);
    288	ret = dbgp_wait_until_done(ctrl, DBGP_LOOPS);
    289
    290	return ret;
    291}
    292
    293static int dbgp_bulk_read(unsigned devnum, unsigned endpoint, void *data,
    294			  int size, int loops)
    295{
    296	u32 pids, addr, ctrl;
    297	int ret;
    298
    299	if (size > DBGP_MAX_PACKET)
    300		return -1;
    301
    302	addr = DBGP_EPADDR(devnum, endpoint);
    303
    304	pids = readl(&ehci_debug->pids);
    305	pids = dbgp_pid_read_update(pids, USB_PID_IN);
    306
    307	ctrl = readl(&ehci_debug->control);
    308	ctrl = dbgp_len_update(ctrl, size);
    309	ctrl &= ~DBGP_OUT;
    310	ctrl |= DBGP_GO;
    311
    312	writel(addr, &ehci_debug->address);
    313	writel(pids, &ehci_debug->pids);
    314	ret = dbgp_wait_until_done(ctrl, loops);
    315	if (ret < 0)
    316		return ret;
    317
    318	if (size > ret)
    319		size = ret;
    320	dbgp_get_data(data, size);
    321	return ret;
    322}
    323
    324static int dbgp_control_msg(unsigned devnum, int requesttype,
    325	int request, int value, int index, void *data, int size)
    326{
    327	u32 pids, addr, ctrl;
    328	struct usb_ctrlrequest req;
    329	int read;
    330	int ret;
    331
    332	read = (requesttype & USB_DIR_IN) != 0;
    333	if (size > (read ? DBGP_MAX_PACKET : 0))
    334		return -1;
    335
    336	/* Compute the control message */
    337	req.bRequestType = requesttype;
    338	req.bRequest = request;
    339	req.wValue = cpu_to_le16(value);
    340	req.wIndex = cpu_to_le16(index);
    341	req.wLength = cpu_to_le16(size);
    342
    343	pids = DBGP_PID_SET(USB_PID_DATA0, USB_PID_SETUP);
    344	addr = DBGP_EPADDR(devnum, 0);
    345
    346	ctrl = readl(&ehci_debug->control);
    347	ctrl = dbgp_len_update(ctrl, sizeof(req));
    348	ctrl |= DBGP_OUT;
    349	ctrl |= DBGP_GO;
    350
    351	/* Send the setup message */
    352	dbgp_set_data(&req, sizeof(req));
    353	writel(addr, &ehci_debug->address);
    354	writel(pids, &ehci_debug->pids);
    355	ret = dbgp_wait_until_done(ctrl, DBGP_LOOPS);
    356	if (ret < 0)
    357		return ret;
    358
    359	/* Read the result */
    360	return dbgp_bulk_read(devnum, 0, data, size, DBGP_LOOPS);
    361}
    362
    363/* Find a PCI capability */
    364static u32 __init find_cap(u32 num, u32 slot, u32 func, int cap)
    365{
    366	u8 pos;
    367	int bytes;
    368
    369	if (!(read_pci_config_16(num, slot, func, PCI_STATUS) &
    370		PCI_STATUS_CAP_LIST))
    371		return 0;
    372
    373	pos = read_pci_config_byte(num, slot, func, PCI_CAPABILITY_LIST);
    374	for (bytes = 0; bytes < 48 && pos >= 0x40; bytes++) {
    375		u8 id;
    376
    377		pos &= ~3;
    378		id = read_pci_config_byte(num, slot, func, pos+PCI_CAP_LIST_ID);
    379		if (id == 0xff)
    380			break;
    381		if (id == cap)
    382			return pos;
    383
    384		pos = read_pci_config_byte(num, slot, func,
    385						 pos+PCI_CAP_LIST_NEXT);
    386	}
    387	return 0;
    388}
    389
    390static u32 __init __find_dbgp(u32 bus, u32 slot, u32 func)
    391{
    392	u32 class;
    393
    394	class = read_pci_config(bus, slot, func, PCI_CLASS_REVISION);
    395	if ((class >> 8) != PCI_CLASS_SERIAL_USB_EHCI)
    396		return 0;
    397
    398	return find_cap(bus, slot, func, PCI_CAP_ID_EHCI_DEBUG);
    399}
    400
    401static u32 __init find_dbgp(int ehci_num, u32 *rbus, u32 *rslot, u32 *rfunc)
    402{
    403	u32 bus, slot, func;
    404
    405	for (bus = 0; bus < 256; bus++) {
    406		for (slot = 0; slot < 32; slot++) {
    407			for (func = 0; func < 8; func++) {
    408				unsigned cap;
    409
    410				cap = __find_dbgp(bus, slot, func);
    411
    412				if (!cap)
    413					continue;
    414				if (ehci_num-- != 0)
    415					continue;
    416				*rbus = bus;
    417				*rslot = slot;
    418				*rfunc = func;
    419				return cap;
    420			}
    421		}
    422	}
    423	return 0;
    424}
    425
    426static int dbgp_ehci_startup(void)
    427{
    428	u32 ctrl, cmd, status;
    429	int loop;
    430
    431	/* Claim ownership, but do not enable yet */
    432	ctrl = readl(&ehci_debug->control);
    433	ctrl |= DBGP_OWNER;
    434	ctrl &= ~(DBGP_ENABLED | DBGP_INUSE);
    435	writel(ctrl, &ehci_debug->control);
    436	udelay(1);
    437
    438	dbgp_ehci_status("EHCI startup");
    439	/* Start the ehci running */
    440	cmd = readl(&ehci_regs->command);
    441	cmd &= ~(CMD_LRESET | CMD_IAAD | CMD_PSE | CMD_ASE | CMD_RESET);
    442	cmd |= CMD_RUN;
    443	writel(cmd, &ehci_regs->command);
    444
    445	/* Ensure everything is routed to the EHCI */
    446	writel(FLAG_CF, &ehci_regs->configured_flag);
    447
    448	/* Wait until the controller is no longer halted */
    449	loop = 1000;
    450	do {
    451		status = readl(&ehci_regs->status);
    452		if (!(status & STS_HALT))
    453			break;
    454		udelay(1);
    455	} while (--loop > 0);
    456
    457	if (!loop) {
    458		dbgp_printk("ehci can not be started\n");
    459		return -ENODEV;
    460	}
    461	dbgp_printk("ehci started\n");
    462	return 0;
    463}
    464
    465static int dbgp_ehci_controller_reset(void)
    466{
    467	int loop = 250 * 1000;
    468	u32 cmd;
    469
    470	/* Reset the EHCI controller */
    471	cmd = readl(&ehci_regs->command);
    472	cmd |= CMD_RESET;
    473	writel(cmd, &ehci_regs->command);
    474	do {
    475		cmd = readl(&ehci_regs->command);
    476	} while ((cmd & CMD_RESET) && (--loop > 0));
    477
    478	if (!loop) {
    479		dbgp_printk("can not reset ehci\n");
    480		return -1;
    481	}
    482	dbgp_ehci_status("ehci reset done");
    483	return 0;
    484}
    485static int ehci_wait_for_port(int port);
    486/* Return 0 on success
    487 * Return -ENODEV for any general failure
    488 * Return -EIO if wait for port fails
    489 */
    490static int _dbgp_external_startup(void)
    491{
    492	int devnum;
    493	struct usb_debug_descriptor dbgp_desc;
    494	int ret;
    495	u32 ctrl, portsc, cmd;
    496	int dbg_port = dbgp_phys_port;
    497	int tries = 3;
    498	int reset_port_tries = 1;
    499	int try_hard_once = 1;
    500
    501try_port_reset_again:
    502	ret = dbgp_ehci_startup();
    503	if (ret)
    504		return ret;
    505
    506	/* Wait for a device to show up in the debug port */
    507	ret = ehci_wait_for_port(dbg_port);
    508	if (ret < 0) {
    509		portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
    510		if (!(portsc & PORT_CONNECT) && try_hard_once) {
    511			/* Last ditch effort to try to force enable
    512			 * the debug device by using the packet test
    513			 * ehci command to try and wake it up. */
    514			try_hard_once = 0;
    515			cmd = readl(&ehci_regs->command);
    516			cmd &= ~CMD_RUN;
    517			writel(cmd, &ehci_regs->command);
    518			portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
    519			portsc |= PORT_TEST_PKT;
    520			writel(portsc, &ehci_regs->port_status[dbg_port - 1]);
    521			dbgp_ehci_status("Trying to force debug port online");
    522			mdelay(50);
    523			dbgp_ehci_controller_reset();
    524			goto try_port_reset_again;
    525		} else if (reset_port_tries--) {
    526			goto try_port_reset_again;
    527		}
    528		dbgp_printk("No device found in debug port\n");
    529		return -EIO;
    530	}
    531	dbgp_ehci_status("wait for port done");
    532
    533	/* Enable the debug port */
    534	ctrl = readl(&ehci_debug->control);
    535	ctrl |= DBGP_CLAIM;
    536	writel(ctrl, &ehci_debug->control);
    537	ctrl = readl(&ehci_debug->control);
    538	if ((ctrl & DBGP_CLAIM) != DBGP_CLAIM) {
    539		dbgp_printk("No device in debug port\n");
    540		writel(ctrl & ~DBGP_CLAIM, &ehci_debug->control);
    541		return -ENODEV;
    542	}
    543	dbgp_ehci_status("debug ported enabled");
    544
    545	/* Completely transfer the debug device to the debug controller */
    546	portsc = readl(&ehci_regs->port_status[dbg_port - 1]);
    547	portsc &= ~PORT_PE;
    548	writel(portsc, &ehci_regs->port_status[dbg_port - 1]);
    549
    550	dbgp_mdelay(100);
    551
    552try_again:
    553	/* Find the debug device and make it device number 127 */
    554	for (devnum = 0; devnum <= 127; devnum++) {
    555		ret = dbgp_control_msg(devnum,
    556			USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
    557			USB_REQ_GET_DESCRIPTOR, (USB_DT_DEBUG << 8), 0,
    558			&dbgp_desc, sizeof(dbgp_desc));
    559		if (ret > 0)
    560			break;
    561	}
    562	if (devnum > 127) {
    563		dbgp_printk("Could not find attached debug device\n");
    564		goto err;
    565	}
    566	dbgp_endpoint_out = dbgp_desc.bDebugOutEndpoint;
    567	dbgp_endpoint_in = dbgp_desc.bDebugInEndpoint;
    568
    569	/* Move the device to 127 if it isn't already there */
    570	if (devnum != USB_DEBUG_DEVNUM) {
    571		ret = dbgp_control_msg(devnum,
    572			USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
    573			USB_REQ_SET_ADDRESS, USB_DEBUG_DEVNUM, 0, NULL, 0);
    574		if (ret < 0) {
    575			dbgp_printk("Could not move attached device to %d\n",
    576				USB_DEBUG_DEVNUM);
    577			goto err;
    578		}
    579		dbgp_printk("debug device renamed to 127\n");
    580	}
    581
    582	/* Enable the debug interface */
    583	ret = dbgp_control_msg(USB_DEBUG_DEVNUM,
    584		USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
    585		USB_REQ_SET_FEATURE, USB_DEVICE_DEBUG_MODE, 0, NULL, 0);
    586	if (ret < 0) {
    587		dbgp_printk(" Could not enable the debug device\n");
    588		goto err;
    589	}
    590	dbgp_printk("debug interface enabled\n");
    591	/* Perform a small write to get the even/odd data state in sync
    592	 */
    593	ret = dbgp_bulk_write(USB_DEBUG_DEVNUM, dbgp_endpoint_out, " ", 1);
    594	if (ret < 0) {
    595		dbgp_printk("dbgp_bulk_write failed: %d\n", ret);
    596		goto err;
    597	}
    598	dbgp_printk("small write done\n");
    599	dbgp_not_safe = 0;
    600
    601	return 0;
    602err:
    603	if (tries--)
    604		goto try_again;
    605	return -ENODEV;
    606}
    607
    608static int ehci_reset_port(int port)
    609{
    610	u32 portsc;
    611	u32 delay_time, delay;
    612	int loop;
    613
    614	dbgp_ehci_status("reset port");
    615	/* Reset the usb debug port */
    616	portsc = readl(&ehci_regs->port_status[port - 1]);
    617	portsc &= ~PORT_PE;
    618	portsc |= PORT_RESET;
    619	writel(portsc, &ehci_regs->port_status[port - 1]);
    620
    621	delay = HUB_ROOT_RESET_TIME;
    622	for (delay_time = 0; delay_time < HUB_RESET_TIMEOUT;
    623	     delay_time += delay) {
    624		dbgp_mdelay(delay);
    625		portsc = readl(&ehci_regs->port_status[port - 1]);
    626		if (!(portsc & PORT_RESET))
    627			break;
    628	}
    629	if (portsc & PORT_RESET) {
    630		/* force reset to complete */
    631		loop = 100 * 1000;
    632		writel(portsc & ~(PORT_RWC_BITS | PORT_RESET),
    633			&ehci_regs->port_status[port - 1]);
    634		do {
    635			udelay(1);
    636			portsc = readl(&ehci_regs->port_status[port-1]);
    637		} while ((portsc & PORT_RESET) && (--loop > 0));
    638	}
    639
    640	/* Device went away? */
    641	if (!(portsc & PORT_CONNECT))
    642		return -ENOTCONN;
    643
    644	/* bomb out completely if something weird happened */
    645	if ((portsc & PORT_CSC))
    646		return -EINVAL;
    647
    648	/* If we've finished resetting, then break out of the loop */
    649	if (!(portsc & PORT_RESET) && (portsc & PORT_PE))
    650		return 0;
    651	return -EBUSY;
    652}
    653
    654static int ehci_wait_for_port(int port)
    655{
    656	u32 status;
    657	int ret, reps;
    658
    659	for (reps = 0; reps < 300; reps++) {
    660		status = readl(&ehci_regs->status);
    661		if (status & STS_PCD)
    662			break;
    663		dbgp_mdelay(1);
    664	}
    665	ret = ehci_reset_port(port);
    666	if (ret == 0)
    667		return 0;
    668	return -ENOTCONN;
    669}
    670
    671typedef void (*set_debug_port_t)(int port);
    672
    673static void __init default_set_debug_port(int port)
    674{
    675}
    676
    677static set_debug_port_t __initdata set_debug_port = default_set_debug_port;
    678
    679static void __init nvidia_set_debug_port(int port)
    680{
    681	u32 dword;
    682	dword = read_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
    683				 0x74);
    684	dword &= ~(0x0f<<12);
    685	dword |= ((port & 0x0f)<<12);
    686	write_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func, 0x74,
    687				 dword);
    688	dbgp_printk("set debug port to %d\n", port);
    689}
    690
    691static void __init detect_set_debug_port(void)
    692{
    693	u32 vendorid;
    694
    695	vendorid = read_pci_config(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
    696		 0x00);
    697
    698	if ((vendorid & 0xffff) == 0x10de) {
    699		dbgp_printk("using nvidia set_debug_port\n");
    700		set_debug_port = nvidia_set_debug_port;
    701	}
    702}
    703
    704/* The code in early_ehci_bios_handoff() is derived from the usb pci
    705 * quirk initialization, but altered so as to use the early PCI
    706 * routines. */
    707#define EHCI_USBLEGSUP_BIOS	(1 << 16)	/* BIOS semaphore */
    708#define EHCI_USBLEGCTLSTS	4		/* legacy control/status */
    709static void __init early_ehci_bios_handoff(void)
    710{
    711	u32 hcc_params = readl(&ehci_caps->hcc_params);
    712	int offset = (hcc_params >> 8) & 0xff;
    713	u32 cap;
    714	int msec;
    715
    716	if (!offset)
    717		return;
    718
    719	cap = read_pci_config(ehci_dev.bus, ehci_dev.slot,
    720			      ehci_dev.func, offset);
    721	dbgp_printk("dbgp: ehci BIOS state %08x\n", cap);
    722
    723	if ((cap & 0xff) == 1 && (cap & EHCI_USBLEGSUP_BIOS)) {
    724		dbgp_printk("dbgp: BIOS handoff\n");
    725		write_pci_config_byte(ehci_dev.bus, ehci_dev.slot,
    726				      ehci_dev.func, offset + 3, 1);
    727	}
    728
    729	/* if boot firmware now owns EHCI, spin till it hands it over. */
    730	msec = 1000;
    731	while ((cap & EHCI_USBLEGSUP_BIOS) && (msec > 0)) {
    732		mdelay(10);
    733		msec -= 10;
    734		cap = read_pci_config(ehci_dev.bus, ehci_dev.slot,
    735				      ehci_dev.func, offset);
    736	}
    737
    738	if (cap & EHCI_USBLEGSUP_BIOS) {
    739		/* well, possibly buggy BIOS... try to shut it down,
    740		 * and hope nothing goes too wrong */
    741		dbgp_printk("dbgp: BIOS handoff failed: %08x\n", cap);
    742		write_pci_config_byte(ehci_dev.bus, ehci_dev.slot,
    743				      ehci_dev.func, offset + 2, 0);
    744	}
    745
    746	/* just in case, always disable EHCI SMIs */
    747	write_pci_config_byte(ehci_dev.bus, ehci_dev.slot, ehci_dev.func,
    748			      offset + EHCI_USBLEGCTLSTS, 0);
    749}
    750
    751static int __init ehci_setup(void)
    752{
    753	u32 ctrl, portsc, hcs_params;
    754	u32 debug_port, new_debug_port = 0, n_ports;
    755	int ret, i;
    756	int port_map_tried;
    757	int playtimes = 3;
    758
    759	early_ehci_bios_handoff();
    760
    761try_next_time:
    762	port_map_tried = 0;
    763
    764try_next_port:
    765
    766	hcs_params = readl(&ehci_caps->hcs_params);
    767	debug_port = HCS_DEBUG_PORT(hcs_params);
    768	dbgp_phys_port = debug_port;
    769	n_ports    = HCS_N_PORTS(hcs_params);
    770
    771	dbgp_printk("debug_port: %d\n", debug_port);
    772	dbgp_printk("n_ports:    %d\n", n_ports);
    773	dbgp_ehci_status("");
    774
    775	for (i = 1; i <= n_ports; i++) {
    776		portsc = readl(&ehci_regs->port_status[i-1]);
    777		dbgp_printk("portstatus%d: %08x\n", i, portsc);
    778	}
    779
    780	if (port_map_tried && (new_debug_port != debug_port)) {
    781		if (--playtimes) {
    782			set_debug_port(new_debug_port);
    783			goto try_next_time;
    784		}
    785		return -1;
    786	}
    787
    788	/* Only reset the controller if it is not already in the
    789	 * configured state */
    790	if (!(readl(&ehci_regs->configured_flag) & FLAG_CF)) {
    791		if (dbgp_ehci_controller_reset() != 0)
    792			return -1;
    793	} else {
    794		dbgp_ehci_status("ehci skip - already configured");
    795	}
    796
    797	ret = _dbgp_external_startup();
    798	if (ret == -EIO)
    799		goto next_debug_port;
    800
    801	if (ret < 0) {
    802		/* Things didn't work so remove my claim */
    803		ctrl = readl(&ehci_debug->control);
    804		ctrl &= ~(DBGP_CLAIM | DBGP_OUT);
    805		writel(ctrl, &ehci_debug->control);
    806		return -1;
    807	}
    808	return 0;
    809
    810next_debug_port:
    811	port_map_tried |= (1<<(debug_port - 1));
    812	new_debug_port = ((debug_port-1+1)%n_ports) + 1;
    813	if (port_map_tried != ((1<<n_ports) - 1)) {
    814		set_debug_port(new_debug_port);
    815		goto try_next_port;
    816	}
    817	if (--playtimes) {
    818		set_debug_port(new_debug_port);
    819		goto try_next_time;
    820	}
    821
    822	return -1;
    823}
    824
    825int __init early_dbgp_init(char *s)
    826{
    827	u32 debug_port, bar, offset;
    828	u32 bus, slot, func, cap;
    829	void __iomem *ehci_bar;
    830	u32 dbgp_num;
    831	u32 bar_val;
    832	char *e;
    833	int ret;
    834	u8 byte;
    835
    836	if (!early_pci_allowed())
    837		return -1;
    838
    839	dbgp_num = 0;
    840	if (*s)
    841		dbgp_num = simple_strtoul(s, &e, 10);
    842	dbgp_printk("dbgp_num: %d\n", dbgp_num);
    843
    844	cap = find_dbgp(dbgp_num, &bus, &slot, &func);
    845	if (!cap)
    846		return -1;
    847
    848	dbgp_printk("Found EHCI debug port on %02x:%02x.%1x\n", bus, slot,
    849			 func);
    850
    851	debug_port = read_pci_config(bus, slot, func, cap);
    852	bar = (debug_port >> 29) & 0x7;
    853	bar = (bar * 4) + 0xc;
    854	offset = (debug_port >> 16) & 0xfff;
    855	dbgp_printk("bar: %02x offset: %03x\n", bar, offset);
    856	if (bar != PCI_BASE_ADDRESS_0) {
    857		dbgp_printk("only debug ports on bar 1 handled.\n");
    858
    859		return -1;
    860	}
    861
    862	bar_val = read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_0);
    863	dbgp_printk("bar_val: %02x offset: %03x\n", bar_val, offset);
    864	if (bar_val & ~PCI_BASE_ADDRESS_MEM_MASK) {
    865		dbgp_printk("only simple 32bit mmio bars supported\n");
    866
    867		return -1;
    868	}
    869
    870	/* double check if the mem space is enabled */
    871	byte = read_pci_config_byte(bus, slot, func, 0x04);
    872	if (!(byte & 0x2)) {
    873		byte  |= 0x02;
    874		write_pci_config_byte(bus, slot, func, 0x04, byte);
    875		dbgp_printk("mmio for ehci enabled\n");
    876	}
    877
    878	/*
    879	 * FIXME I don't have the bar size so just guess PAGE_SIZE is more
    880	 * than enough.  1K is the biggest I have seen.
    881	 */
    882	set_fixmap_nocache(FIX_DBGP_BASE, bar_val & PAGE_MASK);
    883	ehci_bar = (void __iomem *)__fix_to_virt(FIX_DBGP_BASE);
    884	ehci_bar += bar_val & ~PAGE_MASK;
    885	dbgp_printk("ehci_bar: %p\n", ehci_bar);
    886
    887	ehci_caps  = ehci_bar;
    888	ehci_regs  = ehci_bar + EARLY_HC_LENGTH(readl(&ehci_caps->hc_capbase));
    889	ehci_debug = ehci_bar + offset;
    890	ehci_dev.bus = bus;
    891	ehci_dev.slot = slot;
    892	ehci_dev.func = func;
    893
    894	detect_set_debug_port();
    895
    896	ret = ehci_setup();
    897	if (ret < 0) {
    898		dbgp_printk("ehci_setup failed\n");
    899		ehci_debug = NULL;
    900
    901		return -1;
    902	}
    903	dbgp_ehci_status("early_init_complete");
    904
    905	return 0;
    906}
    907
    908static void early_dbgp_write(struct console *con, const char *str, u32 n)
    909{
    910	int chunk;
    911	char buf[DBGP_MAX_PACKET];
    912	int use_cr = 0;
    913	u32 cmd, ctrl;
    914	int reset_run = 0;
    915
    916	if (!ehci_debug || dbgp_not_safe)
    917		return;
    918
    919	cmd = readl(&ehci_regs->command);
    920	if (unlikely(!(cmd & CMD_RUN))) {
    921		/* If the ehci controller is not in the run state do extended
    922		 * checks to see if the acpi or some other initialization also
    923		 * reset the ehci debug port */
    924		ctrl = readl(&ehci_debug->control);
    925		if (!(ctrl & DBGP_ENABLED)) {
    926			dbgp_not_safe = 1;
    927			_dbgp_external_startup();
    928		} else {
    929			cmd |= CMD_RUN;
    930			writel(cmd, &ehci_regs->command);
    931			reset_run = 1;
    932		}
    933	}
    934	while (n > 0) {
    935		for (chunk = 0; chunk < DBGP_MAX_PACKET && n > 0;
    936		     str++, chunk++, n--) {
    937			if (!use_cr && *str == '\n') {
    938				use_cr = 1;
    939				buf[chunk] = '\r';
    940				str--;
    941				n++;
    942				continue;
    943			}
    944			if (use_cr)
    945				use_cr = 0;
    946			buf[chunk] = *str;
    947		}
    948		if (chunk > 0) {
    949			dbgp_bulk_write(USB_DEBUG_DEVNUM,
    950					dbgp_endpoint_out, buf, chunk);
    951		}
    952	}
    953	if (unlikely(reset_run)) {
    954		cmd = readl(&ehci_regs->command);
    955		cmd &= ~CMD_RUN;
    956		writel(cmd, &ehci_regs->command);
    957	}
    958}
    959
    960struct console early_dbgp_console = {
    961	.name =		"earlydbg",
    962	.write =	early_dbgp_write,
    963	.flags =	CON_PRINTBUFFER,
    964	.index =	-1,
    965};
    966
    967#if IS_ENABLED(CONFIG_USB)
    968int dbgp_reset_prep(struct usb_hcd *hcd)
    969{
    970	int ret = xen_dbgp_reset_prep(hcd);
    971	u32 ctrl;
    972
    973	if (ret)
    974		return ret;
    975
    976	dbgp_not_safe = 1;
    977	if (!ehci_debug)
    978		return 0;
    979
    980	if ((early_dbgp_console.index != -1 &&
    981	     !(early_dbgp_console.flags & CON_BOOT)) ||
    982	    dbgp_kgdb_mode)
    983		return 1;
    984	/* This means the console is not initialized, or should get
    985	 * shutdown so as to allow for reuse of the usb device, which
    986	 * means it is time to shutdown the usb debug port. */
    987	ctrl = readl(&ehci_debug->control);
    988	if (ctrl & DBGP_ENABLED) {
    989		ctrl &= ~(DBGP_CLAIM);
    990		writel(ctrl, &ehci_debug->control);
    991	}
    992	return 0;
    993}
    994EXPORT_SYMBOL_GPL(dbgp_reset_prep);
    995
    996int dbgp_external_startup(struct usb_hcd *hcd)
    997{
    998	return xen_dbgp_external_startup(hcd) ?: _dbgp_external_startup();
    999}
   1000EXPORT_SYMBOL_GPL(dbgp_external_startup);
   1001#endif /* USB */
   1002
   1003#ifdef CONFIG_KGDB
   1004
   1005static char kgdbdbgp_buf[DBGP_MAX_PACKET];
   1006static int kgdbdbgp_buf_sz;
   1007static int kgdbdbgp_buf_idx;
   1008static int kgdbdbgp_loop_cnt = DBGP_LOOPS;
   1009
   1010static int kgdbdbgp_read_char(void)
   1011{
   1012	int ret;
   1013
   1014	if (kgdbdbgp_buf_idx < kgdbdbgp_buf_sz) {
   1015		char ch = kgdbdbgp_buf[kgdbdbgp_buf_idx++];
   1016		return ch;
   1017	}
   1018
   1019	ret = dbgp_bulk_read(USB_DEBUG_DEVNUM, dbgp_endpoint_in,
   1020			     &kgdbdbgp_buf, DBGP_MAX_PACKET,
   1021			     kgdbdbgp_loop_cnt);
   1022	if (ret <= 0)
   1023		return NO_POLL_CHAR;
   1024	kgdbdbgp_buf_sz = ret;
   1025	kgdbdbgp_buf_idx = 1;
   1026	return kgdbdbgp_buf[0];
   1027}
   1028
   1029static void kgdbdbgp_write_char(u8 chr)
   1030{
   1031	early_dbgp_write(NULL, &chr, 1);
   1032}
   1033
   1034static struct kgdb_io kgdbdbgp_io_ops = {
   1035	.name = "kgdbdbgp",
   1036	.read_char = kgdbdbgp_read_char,
   1037	.write_char = kgdbdbgp_write_char,
   1038};
   1039
   1040static int kgdbdbgp_wait_time;
   1041
   1042static int __init kgdbdbgp_parse_config(char *str)
   1043{
   1044	char *ptr;
   1045
   1046	if (!ehci_debug) {
   1047		if (early_dbgp_init(str))
   1048			return -1;
   1049	}
   1050	ptr = strchr(str, ',');
   1051	if (ptr) {
   1052		ptr++;
   1053		kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
   1054	}
   1055	kgdb_register_io_module(&kgdbdbgp_io_ops);
   1056	if (early_dbgp_console.index != -1)
   1057		kgdbdbgp_io_ops.cons = &early_dbgp_console;
   1058
   1059	return 0;
   1060}
   1061early_param("kgdbdbgp", kgdbdbgp_parse_config);
   1062
   1063static int kgdbdbgp_reader_thread(void *ptr)
   1064{
   1065	int ret;
   1066
   1067	while (readl(&ehci_debug->control) & DBGP_ENABLED) {
   1068		kgdbdbgp_loop_cnt = 1;
   1069		ret = kgdbdbgp_read_char();
   1070		kgdbdbgp_loop_cnt = DBGP_LOOPS;
   1071		if (ret != NO_POLL_CHAR) {
   1072			if (ret == 0x3 || ret == '$') {
   1073				if (ret == '$')
   1074					kgdbdbgp_buf_idx--;
   1075				kgdb_breakpoint();
   1076			}
   1077			continue;
   1078		}
   1079		schedule_timeout_interruptible(kgdbdbgp_wait_time * HZ);
   1080	}
   1081	return 0;
   1082}
   1083
   1084static int __init kgdbdbgp_start_thread(void)
   1085{
   1086	if (dbgp_kgdb_mode && kgdbdbgp_wait_time)
   1087		kthread_run(kgdbdbgp_reader_thread, NULL, "%s", "dbgp");
   1088
   1089	return 0;
   1090}
   1091device_initcall(kgdbdbgp_start_thread);
   1092#endif /* CONFIG_KGDB */