drivers/cxl/core/mbox.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* Copyright(c) 2020 Intel Corporation. All rights reserved. */
   3 #include <linux/io-64-nonatomic-lo-hi.h>
   4 #include <linux/security.h>
   5 #include <linux/debugfs.h>
   6 #include <linux/mutex.h>
   7 #include <cxlmem.h>
   8 #include <cxl.h>
   9
  10 #include "core.h"
  11
  12 static bool cxl_raw_allow_all;
  13
  14 /**
  15  * DOC: cxl mbox
  16  *
  17  * Core implementation of the CXL 2.0 Type-3 Memory Device Mailbox. The
  18  * implementation is used by the cxl_pci driver to initialize the device
  19  * and implement the cxl_mem.h IOCTL UAPI. It also implements the
  20  * backend of the cxl_pmem_ctl() transport for LIBNVDIMM.
  21  */
  22
  23 #define cxl_for_each_cmd(cmd)                                                  \
  24         for ((cmd) = &cxl_mem_commands[0];                                     \
  25              ((cmd) - cxl_mem_commands) < ARRAY_SIZE(cxl_mem_commands); (cmd)++)
  26
  27 #define CXL_CMD(_id, sin, sout, _flags)                                        \
  28         [CXL_MEM_COMMAND_ID_##_id] = {                                         \
  29         .info = {                                                              \
  30                         .id = CXL_MEM_COMMAND_ID_##_id,                        \
  31                         .size_in = sin,                                        \
  32                         .size_out = sout,                                      \
  33                 },                                                             \
  34         .opcode = CXL_MBOX_OP_##_id,                                           \
  35         .flags = _flags,                                                       \
  36         }
  37
  38 #define CXL_VARIABLE_PAYLOAD    ~0U
  39 /*
  40  * This table defines the supported mailbox commands for the driver. This table
  41  * is made up of a UAPI structure. Non-negative values as parameters in the
  42  * table will be validated against the user's input. For example, if size_in is
  43  * 0, and the user passed in 1, it is an error.
  44  */
  45 static struct cxl_mem_command cxl_mem_commands[CXL_MEM_COMMAND_ID_MAX] = {
  46         CXL_CMD(IDENTIFY, 0, 0x43, CXL_CMD_FLAG_FORCE_ENABLE),
  47 #ifdef CONFIG_CXL_MEM_RAW_COMMANDS
  48         CXL_CMD(RAW, CXL_VARIABLE_PAYLOAD, CXL_VARIABLE_PAYLOAD, 0),
  49 #endif
  50         CXL_CMD(GET_SUPPORTED_LOGS, 0, CXL_VARIABLE_PAYLOAD, CXL_CMD_FLAG_FORCE_ENABLE),
  51         CXL_CMD(GET_FW_INFO, 0, 0x50, 0),
  52         CXL_CMD(GET_PARTITION_INFO, 0, 0x20, 0),
  53         CXL_CMD(GET_LSA, 0x8, CXL_VARIABLE_PAYLOAD, 0),
  54         CXL_CMD(GET_HEALTH_INFO, 0, 0x12, 0),
  55         CXL_CMD(GET_LOG, 0x18, CXL_VARIABLE_PAYLOAD, CXL_CMD_FLAG_FORCE_ENABLE),
  56         CXL_CMD(SET_PARTITION_INFO, 0x0a, 0, 0),
  57         CXL_CMD(SET_LSA, CXL_VARIABLE_PAYLOAD, 0, 0),
  58         CXL_CMD(GET_ALERT_CONFIG, 0, 0x10, 0),
  59         CXL_CMD(SET_ALERT_CONFIG, 0xc, 0, 0),
  60         CXL_CMD(GET_SHUTDOWN_STATE, 0, 0x1, 0),
  61         CXL_CMD(SET_SHUTDOWN_STATE, 0x1, 0, 0),
  62         CXL_CMD(GET_POISON, 0x10, CXL_VARIABLE_PAYLOAD, 0),
  63         CXL_CMD(INJECT_POISON, 0x8, 0, 0),
  64         CXL_CMD(CLEAR_POISON, 0x48, 0, 0),
  65         CXL_CMD(GET_SCAN_MEDIA_CAPS, 0x10, 0x4, 0),
  66         CXL_CMD(SCAN_MEDIA, 0x11, 0, 0),
  67         CXL_CMD(GET_SCAN_MEDIA, 0, CXL_VARIABLE_PAYLOAD, 0),
  68 };
  69
  70 /*
  71  * Commands that RAW doesn't permit. The rationale for each:
  72  *
  73  * CXL_MBOX_OP_ACTIVATE_FW: Firmware activation requires adjustment /
  74  * coordination of transaction timeout values at the root bridge level.
  75  *
  76  * CXL_MBOX_OP_SET_PARTITION_INFO: The device memory map may change live
  77  * and needs to be coordinated with HDM updates.
  78  *
  79  * CXL_MBOX_OP_SET_LSA: The label storage area may be cached by the
  80  * driver and any writes from userspace invalidates those contents.
  81  *
  82  * CXL_MBOX_OP_SET_SHUTDOWN_STATE: Set shutdown state assumes no writes
  83  * to the device after it is marked clean, userspace can not make that
  84  * assertion.
  85  *
  86  * CXL_MBOX_OP_[GET_]SCAN_MEDIA: The kernel provides a native error list that
  87  * is kept up to date with patrol notifications and error management.
  88  */
  89 static u16 cxl_disabled_raw_commands[] = {
  90         CXL_MBOX_OP_ACTIVATE_FW,
  91         CXL_MBOX_OP_SET_PARTITION_INFO,
  92         CXL_MBOX_OP_SET_LSA,
  93         CXL_MBOX_OP_SET_SHUTDOWN_STATE,
  94         CXL_MBOX_OP_SCAN_MEDIA,
  95         CXL_MBOX_OP_GET_SCAN_MEDIA,
  96 };
  97
  98 /*
  99  * Command sets that RAW doesn't permit. All opcodes in this set are
 100  * disabled because they pass plain text security payloads over the
 101  * user/kernel boundary. This functionality is intended to be wrapped
 102  * behind the keys ABI which allows for encrypted payloads in the UAPI
 103  */
 104 static u8 security_command_sets[] = {
 105         0x44, /* Sanitize */
 106         0x45, /* Persistent Memory Data-at-rest Security */
 107         0x46, /* Security Passthrough */
 108 };
 109
 110 static bool cxl_is_security_command(u16 opcode)
 111 {
 112         int i;
 113
 114         for (i = 0; i < ARRAY_SIZE(security_command_sets); i++)
 115                 if (security_command_sets[i] == (opcode >> 8))
 116                         return true;
 117         return false;
 118 }
 119
 120 static struct cxl_mem_command *cxl_mem_find_command(u16 opcode)
 121 {
 122         struct cxl_mem_command *c;
 123
 124         cxl_for_each_cmd(c)
 125                 if (c->opcode == opcode)
 126                         return c;
 127
 128         return NULL;
 129 }
 130
 131 static const char *cxl_mem_opcode_to_name(u16 opcode)
 132 {
 133         struct cxl_mem_command *c;
 134
 135         c = cxl_mem_find_command(opcode);
 136         if (!c)
 137                 return NULL;
 138
 139         return cxl_command_names[c->info.id].name;
 140 }
 141
 142 /**
 143  * cxl_internal_send_cmd() - Kernel internal interface to send a mailbox command
 144  * @cxlds: The device data for the operation
 145  * @mbox_cmd: initialized command to execute
 146  *
 147  * Context: Any context.
 148  * Return:
 149  *  * %>=0      - Number of bytes returned in @out.
 150  *  * %-E2BIG   - Payload is too large for hardware.
 151  *  * %-EBUSY   - Couldn't acquire exclusive mailbox access.
 152  *  * %-EFAULT  - Hardware error occurred.
 153  *  * %-ENXIO   - Command completed, but device reported an error.
 154  *  * %-EIO     - Unexpected output size.
 155  *
 156  * Mailbox commands may execute successfully yet the device itself reported an
 157  * error. While this distinction can be useful for commands from userspace, the
 158  * kernel will only be able to use results when both are successful.
 159  */
 160 int cxl_internal_send_cmd(struct cxl_dev_state *cxlds,
 161                           struct cxl_mbox_cmd *mbox_cmd)
 162 {
 163         size_t out_size, min_out;
 164         int rc;
 165
 166         if (mbox_cmd->size_in > cxlds->payload_size ||
 167             mbox_cmd->size_out > cxlds->payload_size)
 168                 return -E2BIG;
 169
 170         out_size = mbox_cmd->size_out;
 171         min_out = mbox_cmd->min_out;
 172         rc = cxlds->mbox_send(cxlds, mbox_cmd);
 173         /*
 174          * EIO is reserved for a payload size mismatch and mbox_send()
 175          * may not return this error.
 176          */
 177         if (WARN_ONCE(rc == -EIO, "Bad return code: -EIO"))
 178                 return -ENXIO;
 179         if (rc)
 180                 return rc;
 181
 182         if (mbox_cmd->return_code != CXL_MBOX_CMD_RC_SUCCESS)
 183                 return cxl_mbox_cmd_rc2errno(mbox_cmd);
 184
 185         if (!out_size)
 186                 return 0;
 187
 188         /*
 189          * Variable sized output needs to at least satisfy the caller's
 190          * minimum if not the fully requested size.
 191          */
 192         if (min_out == 0)
 193                 min_out = out_size;
 194
 195         if (mbox_cmd->size_out < min_out)
 196                 return -EIO;
 197         return 0;
 198 }
 199 EXPORT_SYMBOL_NS_GPL(cxl_internal_send_cmd, CXL);
 200
 201 static bool cxl_mem_raw_command_allowed(u16 opcode)
 202 {
 203         int i;
 204
 205         if (!IS_ENABLED(CONFIG_CXL_MEM_RAW_COMMANDS))
 206                 return false;
 207
 208         if (security_locked_down(LOCKDOWN_PCI_ACCESS))
 209                 return false;
 210
 211         if (cxl_raw_allow_all)
 212                 return true;
 213
 214         if (cxl_is_security_command(opcode))
 215                 return false;
 216
 217         for (i = 0; i < ARRAY_SIZE(cxl_disabled_raw_commands); i++)
 218                 if (cxl_disabled_raw_commands[i] == opcode)
 219                         return false;
 220
 221         return true;
 222 }
 223
 224 /**
 225  * cxl_payload_from_user_allowed() - Check contents of in_payload.
 226  * @opcode: The mailbox command opcode.
 227  * @payload_in: Pointer to the input payload passed in from user space.
 228  *
 229  * Return:
 230  *  * true      - payload_in passes check for @opcode.
 231  *  * false     - payload_in contains invalid or unsupported values.
 232  *
 233  * The driver may inspect payload contents before sending a mailbox
 234  * command from user space to the device. The intent is to reject
 235  * commands with input payloads that are known to be unsafe. This
 236  * check is not intended to replace the users careful selection of
 237  * mailbox command parameters and makes no guarantee that the user
 238  * command will succeed, nor that it is appropriate.
 239  *
 240  * The specific checks are determined by the opcode.
 241  */
 242 static bool cxl_payload_from_user_allowed(u16 opcode, void *payload_in)
 243 {
 244         switch (opcode) {
 245         case CXL_MBOX_OP_SET_PARTITION_INFO: {
 246                 struct cxl_mbox_set_partition_info *pi = payload_in;
 247
 248                 if (pi->flags & CXL_SET_PARTITION_IMMEDIATE_FLAG)
 249                         return false;
 250                 break;
 251         }
 252         default:
 253                 break;
 254         }
 255         return true;
 256 }
 257
 258 static int cxl_mbox_cmd_ctor(struct cxl_mbox_cmd *mbox,
 259                              struct cxl_dev_state *cxlds, u16 opcode,
 260                              size_t in_size, size_t out_size, u64 in_payload)
 261 {
 262         *mbox = (struct cxl_mbox_cmd) {
 263                 .opcode = opcode,
 264                 .size_in = in_size,
 265         };
 266
 267         if (in_size) {
 268                 mbox->payload_in = vmemdup_user(u64_to_user_ptr(in_payload),
 269                                                 in_size);
 270                 if (IS_ERR(mbox->payload_in))
 271                         return PTR_ERR(mbox->payload_in);
 272
 273                 if (!cxl_payload_from_user_allowed(opcode, mbox->payload_in)) {
 274                         dev_dbg(cxlds->dev, "%s: input payload not allowed\n",
 275                                 cxl_mem_opcode_to_name(opcode));
 276                         kvfree(mbox->payload_in);
 277                         return -EBUSY;
 278                 }
 279         }
 280
 281         /* Prepare to handle a full payload for variable sized output */
 282         if (out_size == CXL_VARIABLE_PAYLOAD)
 283                 mbox->size_out = cxlds->payload_size;
 284         else
 285                 mbox->size_out = out_size;
 286
 287         if (mbox->size_out) {
 288                 mbox->payload_out = kvzalloc(mbox->size_out, GFP_KERNEL);
 289                 if (!mbox->payload_out) {
 290                         kvfree(mbox->payload_in);
 291                         return -ENOMEM;
 292                 }
 293         }
 294         return 0;
 295 }
 296
 297 static void cxl_mbox_cmd_dtor(struct cxl_mbox_cmd *mbox)
 298 {
 299         kvfree(mbox->payload_in);
 300         kvfree(mbox->payload_out);
 301 }
 302
 303 static int cxl_to_mem_cmd_raw(struct cxl_mem_command *mem_cmd,
 304                               const struct cxl_send_command *send_cmd,
 305                               struct cxl_dev_state *cxlds)
 306 {
 307         if (send_cmd->raw.rsvd)
 308                 return -EINVAL;
 309
 310         /*
 311          * Unlike supported commands, the output size of RAW commands
 312          * gets passed along without further checking, so it must be
 313          * validated here.
 314          */
 315         if (send_cmd->out.size > cxlds->payload_size)
 316                 return -EINVAL;
 317
 318         if (!cxl_mem_raw_command_allowed(send_cmd->raw.opcode))
 319                 return -EPERM;
 320
 321         dev_WARN_ONCE(cxlds->dev, true, "raw command path used\n");
 322
 323         *mem_cmd = (struct cxl_mem_command) {
 324                 .info = {
 325                         .id = CXL_MEM_COMMAND_ID_RAW,
 326                         .size_in = send_cmd->in.size,
 327                         .size_out = send_cmd->out.size,
 328                 },
 329                 .opcode = send_cmd->raw.opcode
 330         };
 331
 332         return 0;
 333 }
 334
 335 static int cxl_to_mem_cmd(struct cxl_mem_command *mem_cmd,
 336                           const struct cxl_send_command *send_cmd,
 337                           struct cxl_dev_state *cxlds)
 338 {
 339         struct cxl_mem_command *c = &cxl_mem_commands[send_cmd->id];
 340         const struct cxl_command_info *info = &c->info;
 341
 342         if (send_cmd->flags & ~CXL_MEM_COMMAND_FLAG_MASK)
 343                 return -EINVAL;
 344
 345         if (send_cmd->rsvd)
 346                 return -EINVAL;
 347
 348         if (send_cmd->in.rsvd || send_cmd->out.rsvd)
 349                 return -EINVAL;
 350
 351         /* Check that the command is enabled for hardware */
 352         if (!test_bit(info->id, cxlds->enabled_cmds))
 353                 return -ENOTTY;
 354
 355         /* Check that the command is not claimed for exclusive kernel use */
 356         if (test_bit(info->id, cxlds->exclusive_cmds))
 357                 return -EBUSY;
 358
 359         /* Check the input buffer is the expected size */
 360         if ((info->size_in != CXL_VARIABLE_PAYLOAD) &&
 361             (info->size_in != send_cmd->in.size))
 362                 return -ENOMEM;
 363
 364         /* Check the output buffer is at least large enough */
 365         if ((info->size_out != CXL_VARIABLE_PAYLOAD) &&
 366             (send_cmd->out.size < info->size_out))
 367                 return -ENOMEM;
 368
 369         *mem_cmd = (struct cxl_mem_command) {
 370                 .info = {
 371                         .id = info->id,
 372                         .flags = info->flags,
 373                         .size_in = send_cmd->in.size,
 374                         .size_out = send_cmd->out.size,
 375                 },
 376                 .opcode = c->opcode
 377         };
 378
 379         return 0;
 380 }
 381
 382 /**
 383  * cxl_validate_cmd_from_user() - Check fields for CXL_MEM_SEND_COMMAND.
 384  * @mbox_cmd: Sanitized and populated &struct cxl_mbox_cmd.
 385  * @cxlds: The device data for the operation
 386  * @send_cmd: &struct cxl_send_command copied in from userspace.
 387  *
 388  * Return:
 389  *  * %0        - @out_cmd is ready to send.
 390  *  * %-ENOTTY  - Invalid command specified.
 391  *  * %-EINVAL  - Reserved fields or invalid values were used.
 392  *  * %-ENOMEM  - Input or output buffer wasn't sized properly.
 393  *  * %-EPERM   - Attempted to use a protected command.
 394  *  * %-EBUSY   - Kernel has claimed exclusive access to this opcode
 395  *
 396  * The result of this command is a fully validated command in @mbox_cmd that is
 397  * safe to send to the hardware.
 398  */
 399 static int cxl_validate_cmd_from_user(struct cxl_mbox_cmd *mbox_cmd,
 400                                       struct cxl_dev_state *cxlds,
 401                                       const struct cxl_send_command *send_cmd)
 402 {
 403         struct cxl_mem_command mem_cmd;
 404         int rc;
 405
 406         if (send_cmd->id == 0 || send_cmd->id >= CXL_MEM_COMMAND_ID_MAX)
 407                 return -ENOTTY;
 408
 409         /*
 410          * The user can never specify an input payload larger than what hardware
 411          * supports, but output can be arbitrarily large (simply write out as
 412          * much data as the hardware provides).
 413          */
 414         if (send_cmd->in.size > cxlds->payload_size)
 415                 return -EINVAL;
 416
 417         /* Sanitize and construct a cxl_mem_command */
 418         if (send_cmd->id == CXL_MEM_COMMAND_ID_RAW)
 419                 rc = cxl_to_mem_cmd_raw(&mem_cmd, send_cmd, cxlds);
 420         else
 421                 rc = cxl_to_mem_cmd(&mem_cmd, send_cmd, cxlds);
 422
 423         if (rc)
 424                 return rc;
 425
 426         /* Sanitize and construct a cxl_mbox_cmd */
 427         return cxl_mbox_cmd_ctor(mbox_cmd, cxlds, mem_cmd.opcode,
 428                                  mem_cmd.info.size_in, mem_cmd.info.size_out,
 429                                  send_cmd->in.payload);
 430 }
 431
 432 int cxl_query_cmd(struct cxl_memdev *cxlmd,
 433                   struct cxl_mem_query_commands __user *q)
 434 {
 435         struct device *dev = &cxlmd->dev;
 436         struct cxl_mem_command *cmd;
 437         u32 n_commands;
 438         int j = 0;
 439
 440         dev_dbg(dev, "Query IOCTL\n");
 441
 442         if (get_user(n_commands, &q->n_commands))
 443                 return -EFAULT;
 444
 445         /* returns the total number if 0 elements are requested. */
 446         if (n_commands == 0)
 447                 return put_user(ARRAY_SIZE(cxl_mem_commands), &q->n_commands);
 448
 449         /*
 450          * otherwise, return max(n_commands, total commands) cxl_command_info
 451          * structures.
 452          */
 453         cxl_for_each_cmd(cmd) {
 454                 const struct cxl_command_info *info = &cmd->info;
 455
 456                 if (copy_to_user(&q->commands[j++], info, sizeof(*info)))
 457                         return -EFAULT;
 458
 459                 if (j == n_commands)
 460                         break;
 461         }
 462
 463         return 0;
 464 }
 465
 466 /**
 467  * handle_mailbox_cmd_from_user() - Dispatch a mailbox command for userspace.
 468  * @cxlds: The device data for the operation
 469  * @mbox_cmd: The validated mailbox command.
 470  * @out_payload: Pointer to userspace's output payload.
 471  * @size_out: (Input) Max payload size to copy out.
 472  *            (Output) Payload size hardware generated.
 473  * @retval: Hardware generated return code from the operation.
 474  *
 475  * Return:
 476  *  * %0        - Mailbox transaction succeeded. This implies the mailbox
 477  *                protocol completed successfully not that the operation itself
 478  *                was successful.
 479  *  * %-ENOMEM  - Couldn't allocate a bounce buffer.
 480  *  * %-EFAULT  - Something happened with copy_to/from_user.
 481  *  * %-EINTR   - Mailbox acquisition interrupted.
 482  *  * %-EXXX    - Transaction level failures.
 483  *
 484  * Dispatches a mailbox command on behalf of a userspace request.
 485  * The output payload is copied to userspace.
 486  *
 487  * See cxl_send_cmd().
 488  */
 489 static int handle_mailbox_cmd_from_user(struct cxl_dev_state *cxlds,
 490                                         struct cxl_mbox_cmd *mbox_cmd,
 491                                         u64 out_payload, s32 *size_out,
 492                                         u32 *retval)
 493 {
 494         struct device *dev = cxlds->dev;
 495         int rc;
 496
 497         dev_dbg(dev,
 498                 "Submitting %s command for user\n"
 499                 "\topcode: %x\n"
 500                 "\tsize: %zx\n",
 501                 cxl_mem_opcode_to_name(mbox_cmd->opcode),
 502                 mbox_cmd->opcode, mbox_cmd->size_in);
 503
 504         rc = cxlds->mbox_send(cxlds, mbox_cmd);
 505         if (rc)
 506                 goto out;
 507
 508         /*
 509          * @size_out contains the max size that's allowed to be written back out
 510          * to userspace. While the payload may have written more output than
 511          * this it will have to be ignored.
 512          */
 513         if (mbox_cmd->size_out) {
 514                 dev_WARN_ONCE(dev, mbox_cmd->size_out > *size_out,
 515                               "Invalid return size\n");
 516                 if (copy_to_user(u64_to_user_ptr(out_payload),
 517                                  mbox_cmd->payload_out, mbox_cmd->size_out)) {
 518                         rc = -EFAULT;
 519                         goto out;
 520                 }
 521         }
 522
 523         *size_out = mbox_cmd->size_out;
 524         *retval = mbox_cmd->return_code;
 525
 526 out:
 527         cxl_mbox_cmd_dtor(mbox_cmd);
 528         return rc;
 529 }
 530
 531 int cxl_send_cmd(struct cxl_memdev *cxlmd, struct cxl_send_command __user *s)
 532 {
 533         struct cxl_dev_state *cxlds = cxlmd->cxlds;
 534         struct device *dev = &cxlmd->dev;
 535         struct cxl_send_command send;
 536         struct cxl_mbox_cmd mbox_cmd;
 537         int rc;
 538
 539         dev_dbg(dev, "Send IOCTL\n");
 540
 541         if (copy_from_user(&send, s, sizeof(send)))
 542                 return -EFAULT;
 543
 544         rc = cxl_validate_cmd_from_user(&mbox_cmd, cxlmd->cxlds, &send);
 545         if (rc)
 546                 return rc;
 547
 548         rc = handle_mailbox_cmd_from_user(cxlds, &mbox_cmd, send.out.payload,
 549                                           &send.out.size, &send.retval);
 550         if (rc)
 551                 return rc;
 552
 553         if (copy_to_user(s, &send, sizeof(send)))
 554                 return -EFAULT;
 555
 556         return 0;
 557 }
 558
 559 static int cxl_xfer_log(struct cxl_dev_state *cxlds, uuid_t *uuid, u32 *size, u8 *out)
 560 {
 561         u32 remaining = *size;
 562         u32 offset = 0;
 563
 564         while (remaining) {
 565                 u32 xfer_size = min_t(u32, remaining, cxlds->payload_size);
 566                 struct cxl_mbox_cmd mbox_cmd;
 567                 struct cxl_mbox_get_log log;
 568                 int rc;
 569
 570                 log = (struct cxl_mbox_get_log) {
 571                         .uuid = *uuid,
 572                         .offset = cpu_to_le32(offset),
 573                         .length = cpu_to_le32(xfer_size),
 574                 };
 575
 576                 mbox_cmd = (struct cxl_mbox_cmd) {
 577                         .opcode = CXL_MBOX_OP_GET_LOG,
 578                         .size_in = sizeof(log),
 579                         .payload_in = &log,
 580                         .size_out = xfer_size,
 581                         .payload_out = out,
 582                 };
 583
 584                 rc = cxl_internal_send_cmd(cxlds, &mbox_cmd);
 585
 586                 /*
 587                  * The output payload length that indicates the number
 588                  * of valid bytes can be smaller than the Log buffer
 589                  * size.
 590                  */
 591                 if (rc == -EIO && mbox_cmd.size_out < xfer_size) {
 592                         offset += mbox_cmd.size_out;
 593                         break;
 594                 }
 595
 596                 if (rc < 0)
 597                         return rc;
 598
 599                 out += xfer_size;
 600                 remaining -= xfer_size;
 601                 offset += xfer_size;
 602         }
 603
 604         *size = offset;
 605
 606         return 0;
 607 }
 608
 609 /**
 610  * cxl_walk_cel() - Walk through the Command Effects Log.
 611  * @cxlds: The device data for the operation
 612  * @size: Length of the Command Effects Log.
 613  * @cel: CEL
 614  *
 615  * Iterate over each entry in the CEL and determine if the driver supports the
 616  * command. If so, the command is enabled for the device and can be used later.
 617  */
 618 static void cxl_walk_cel(struct cxl_dev_state *cxlds, size_t size, u8 *cel)
 619 {
 620         struct cxl_cel_entry *cel_entry;
 621         const int cel_entries = size / sizeof(*cel_entry);
 622         int i;
 623
 624         cel_entry = (struct cxl_cel_entry *) cel;
 625
 626         for (i = 0; i < cel_entries; i++) {
 627                 u16 opcode = le16_to_cpu(cel_entry[i].opcode);
 628                 struct cxl_mem_command *cmd = cxl_mem_find_command(opcode);
 629
 630                 if (!cmd) {
 631                         dev_dbg(cxlds->dev,
 632                                 "Opcode 0x%04x unsupported by driver\n", opcode);
 633                         continue;
 634                 }
 635
 636                 set_bit(cmd->info.id, cxlds->enabled_cmds);
 637                 dev_dbg(cxlds->dev, "Opcode 0x%04x enabled\n", opcode);
 638         }
 639 }
 640
 641 static struct cxl_mbox_get_supported_logs *cxl_get_gsl(struct cxl_dev_state *cxlds)
 642 {
 643         struct cxl_mbox_get_supported_logs *ret;
 644         struct cxl_mbox_cmd mbox_cmd;
 645         int rc;
 646
 647         ret = kvmalloc(cxlds->payload_size, GFP_KERNEL);
 648         if (!ret)
 649                 return ERR_PTR(-ENOMEM);
 650
 651         mbox_cmd = (struct cxl_mbox_cmd) {
 652                 .opcode = CXL_MBOX_OP_GET_SUPPORTED_LOGS,
 653                 .size_out = cxlds->payload_size,
 654                 .payload_out = ret,
 655                 /* At least the record number field must be valid */
 656                 .min_out = 2,
 657         };
 658         rc = cxl_internal_send_cmd(cxlds, &mbox_cmd);
 659         if (rc < 0) {
 660                 kvfree(ret);
 661                 return ERR_PTR(rc);
 662         }
 663
 664
 665         return ret;
 666 }
 667
 668 enum {
 669         CEL_UUID,
 670         VENDOR_DEBUG_UUID,
 671 };
 672
 673 /* See CXL 2.0 Table 170. Get Log Input Payload */
 674 static const uuid_t log_uuid[] = {
 675         [CEL_UUID] = DEFINE_CXL_CEL_UUID,
 676         [VENDOR_DEBUG_UUID] = DEFINE_CXL_VENDOR_DEBUG_UUID,
 677 };
 678
 679 /**
 680  * cxl_enumerate_cmds() - Enumerate commands for a device.
 681  * @cxlds: The device data for the operation
 682  *
 683  * Returns 0 if enumerate completed successfully.
 684  *
 685  * CXL devices have optional support for certain commands. This function will
 686  * determine the set of supported commands for the hardware and update the
 687  * enabled_cmds bitmap in the @cxlds.
 688  */
 689 int cxl_enumerate_cmds(struct cxl_dev_state *cxlds)
 690 {
 691         struct cxl_mbox_get_supported_logs *gsl;
 692         struct device *dev = cxlds->dev;
 693         struct cxl_mem_command *cmd;
 694         int i, rc;
 695
 696         gsl = cxl_get_gsl(cxlds);
 697         if (IS_ERR(gsl))
 698                 return PTR_ERR(gsl);
 699
 700         rc = -ENOENT;
 701         for (i = 0; i < le16_to_cpu(gsl->entries); i++) {
 702                 u32 size = le32_to_cpu(gsl->entry[i].size);
 703                 uuid_t uuid = gsl->entry[i].uuid;
 704                 u8 *log;
 705
 706                 dev_dbg(dev, "Found LOG type %pU of size %d", &uuid, size);
 707
 708                 if (!uuid_equal(&uuid, &log_uuid[CEL_UUID]))
 709                         continue;
 710
 711                 log = kvmalloc(size, GFP_KERNEL);
 712                 if (!log) {
 713                         rc = -ENOMEM;
 714                         goto out;
 715                 }
 716
 717                 rc = cxl_xfer_log(cxlds, &uuid, &size, log);
 718                 if (rc) {
 719                         kvfree(log);
 720                         goto out;
 721                 }
 722
 723                 cxl_walk_cel(cxlds, size, log);
 724                 kvfree(log);
 725
 726                 /* In case CEL was bogus, enable some default commands. */
 727                 cxl_for_each_cmd(cmd)
 728                         if (cmd->flags & CXL_CMD_FLAG_FORCE_ENABLE)
 729                                 set_bit(cmd->info.id, cxlds->enabled_cmds);
 730
 731                 /* Found the required CEL */
 732                 rc = 0;
 733         }
 734 out:
 735         kvfree(gsl);
 736         return rc;
 737 }
 738 EXPORT_SYMBOL_NS_GPL(cxl_enumerate_cmds, CXL);
 739
 740 /**
 741  * cxl_mem_get_partition_info - Get partition info
 742  * @cxlds: The device data for the operation
 743  *
 744  * Retrieve the current partition info for the device specified.  The active
 745  * values are the current capacity in bytes.  If not 0, the 'next' values are
 746  * the pending values, in bytes, which take affect on next cold reset.
 747  *
 748  * Return: 0 if no error: or the result of the mailbox command.
 749  *
 750  * See CXL @8.2.9.5.2.1 Get Partition Info
 751  */
 752 static int cxl_mem_get_partition_info(struct cxl_dev_state *cxlds)
 753 {
 754         struct cxl_mbox_get_partition_info pi;
 755         struct cxl_mbox_cmd mbox_cmd;
 756         int rc;
 757
 758         mbox_cmd = (struct cxl_mbox_cmd) {
 759                 .opcode = CXL_MBOX_OP_GET_PARTITION_INFO,
 760                 .size_out = sizeof(pi),
 761                 .payload_out = &pi,
 762         };
 763         rc = cxl_internal_send_cmd(cxlds, &mbox_cmd);
 764         if (rc)
 765                 return rc;
 766
 767         cxlds->active_volatile_bytes =
 768                 le64_to_cpu(pi.active_volatile_cap) * CXL_CAPACITY_MULTIPLIER;
 769         cxlds->active_persistent_bytes =
 770                 le64_to_cpu(pi.active_persistent_cap) * CXL_CAPACITY_MULTIPLIER;
 771         cxlds->next_volatile_bytes =
 772                 le64_to_cpu(pi.next_volatile_cap) * CXL_CAPACITY_MULTIPLIER;
 773         cxlds->next_persistent_bytes =
 774                 le64_to_cpu(pi.next_volatile_cap) * CXL_CAPACITY_MULTIPLIER;
 775
 776         return 0;
 777 }
 778
 779 /**
 780  * cxl_dev_state_identify() - Send the IDENTIFY command to the device.
 781  * @cxlds: The device data for the operation
 782  *
 783  * Return: 0 if identify was executed successfully.
 784  *
 785  * This will dispatch the identify command to the device and on success populate
 786  * structures to be exported to sysfs.
 787  */
 788 int cxl_dev_state_identify(struct cxl_dev_state *cxlds)
 789 {
 790         /* See CXL 2.0 Table 175 Identify Memory Device Output Payload */
 791         struct cxl_mbox_identify id;
 792         struct cxl_mbox_cmd mbox_cmd;
 793         int rc;
 794
 795         mbox_cmd = (struct cxl_mbox_cmd) {
 796                 .opcode = CXL_MBOX_OP_IDENTIFY,
 797                 .size_out = sizeof(id),
 798                 .payload_out = &id,
 799         };
 800         rc = cxl_internal_send_cmd(cxlds, &mbox_cmd);
 801         if (rc < 0)
 802                 return rc;
 803
 804         cxlds->total_bytes =
 805                 le64_to_cpu(id.total_capacity) * CXL_CAPACITY_MULTIPLIER;
 806         cxlds->volatile_only_bytes =
 807                 le64_to_cpu(id.volatile_capacity) * CXL_CAPACITY_MULTIPLIER;
 808         cxlds->persistent_only_bytes =
 809                 le64_to_cpu(id.persistent_capacity) * CXL_CAPACITY_MULTIPLIER;
 810         cxlds->partition_align_bytes =
 811                 le64_to_cpu(id.partition_align) * CXL_CAPACITY_MULTIPLIER;
 812
 813         cxlds->lsa_size = le32_to_cpu(id.lsa_size);
 814         memcpy(cxlds->firmware_version, id.fw_revision, sizeof(id.fw_revision));
 815
 816         return 0;
 817 }
 818 EXPORT_SYMBOL_NS_GPL(cxl_dev_state_identify, CXL);
 819
 820 static int add_dpa_res(struct device *dev, struct resource *parent,
 821                        struct resource *res, resource_size_t start,
 822                        resource_size_t size, const char *type)
 823 {
 824         int rc;
 825
 826         res->name = type;
 827         res->start = start;
 828         res->end = start + size - 1;
 829         res->flags = IORESOURCE_MEM;
 830         if (resource_size(res) == 0) {
 831                 dev_dbg(dev, "DPA(%s): no capacity\n", res->name);
 832                 return 0;
 833         }
 834         rc = request_resource(parent, res);
 835         if (rc) {
 836                 dev_err(dev, "DPA(%s): failed to track %pr (%d)\n", res->name,
 837                         res, rc);
 838                 return rc;
 839         }
 840
 841         dev_dbg(dev, "DPA(%s): %pr\n", res->name, res);
 842
 843         return 0;
 844 }
 845
 846 int cxl_mem_create_range_info(struct cxl_dev_state *cxlds)
 847 {
 848         struct device *dev = cxlds->dev;
 849         int rc;
 850
 851         cxlds->dpa_res =
 852                 (struct resource)DEFINE_RES_MEM(0, cxlds->total_bytes);
 853
 854         if (cxlds->partition_align_bytes == 0) {
 855                 rc = add_dpa_res(dev, &cxlds->dpa_res, &cxlds->ram_res, 0,
 856                                  cxlds->volatile_only_bytes, "ram");
 857                 if (rc)
 858                         return rc;
 859                 return add_dpa_res(dev, &cxlds->dpa_res, &cxlds->pmem_res,
 860                                    cxlds->volatile_only_bytes,
 861                                    cxlds->persistent_only_bytes, "pmem");
 862         }
 863
 864         rc = cxl_mem_get_partition_info(cxlds);
 865         if (rc) {
 866                 dev_err(dev, "Failed to query partition information\n");
 867                 return rc;
 868         }
 869
 870         rc = add_dpa_res(dev, &cxlds->dpa_res, &cxlds->ram_res, 0,
 871                          cxlds->active_volatile_bytes, "ram");
 872         if (rc)
 873                 return rc;
 874         return add_dpa_res(dev, &cxlds->dpa_res, &cxlds->pmem_res,
 875                            cxlds->active_volatile_bytes,
 876                            cxlds->active_persistent_bytes, "pmem");
 877 }
 878 EXPORT_SYMBOL_NS_GPL(cxl_mem_create_range_info, CXL);
 879
 880 struct cxl_dev_state *cxl_dev_state_create(struct device *dev)
 881 {
 882         struct cxl_dev_state *cxlds;
 883
 884         cxlds = devm_kzalloc(dev, sizeof(*cxlds), GFP_KERNEL);
 885         if (!cxlds) {
 886                 dev_err(dev, "No memory available\n");
 887                 return ERR_PTR(-ENOMEM);
 888         }
 889
 890         mutex_init(&cxlds->mbox_mutex);
 891         cxlds->dev = dev;
 892
 893         return cxlds;
 894 }
 895 EXPORT_SYMBOL_NS_GPL(cxl_dev_state_create, CXL);
 896
 897 void __init cxl_mbox_init(void)
 898 {
 899         struct dentry *mbox_debugfs;
 900
 901         mbox_debugfs = cxl_debugfs_create_dir("mbox");
 902         debugfs_create_bool("raw_allow_all", 0600, mbox_debugfs,
 903                             &cxl_raw_allow_all);
 904 }