blob: e536cd25fcb39938a20a5ce475b9a688180723cd [file] [log] [blame]
Cyril Burc85e34d2016-11-15 11:50:41 +11001/* Copyright 2016 IBM
2 *
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 *
15 */
16
17#include <assert.h>
18#include <errno.h>
19#include <fcntl.h>
20#include <getopt.h>
21#include <limits.h>
22#include <poll.h>
23#include <stdbool.h>
24#include <stdint.h>
25#include <stdio.h>
26#include <stdlib.h>
27#include <string.h>
28#include <syslog.h>
29#include <sys/ioctl.h>
30#include <sys/mman.h>
31#include <sys/stat.h>
32#include <sys/timerfd.h>
33#include <sys/types.h>
34#include <time.h>
35#include <unistd.h>
36
37#include <mtd/mtd-abi.h>
38
39#include <linux/aspeed-lpc-ctrl.h>
40
41#include "mbox.h"
42#include "common.h"
43
44#define LPC_CTRL_PATH "/dev/aspeed-lpc-ctrl"
45
46#define MBOX_FD 0
47#define LPC_CTRL_FD 1
48#define MTD_FD 2
49#define TOTAL_FDS 3
50
51#define ALIGN_UP(_v, _a) (((_v) + (_a) - 1) & ~((_a) - 1))
52
53#define MSG_OUT(f_, ...) do { if (verbosity != MBOX_LOG_NONE) { mbox_log(LOG_INFO, f_, ##__VA_ARGS__); } } while(0)
54#define MSG_ERR(f_, ...) do { if (verbosity != MBOX_LOG_NONE) { mbox_log(LOG_ERR, f_, ##__VA_ARGS__); } } while(0)
55
56#define BOOT_HICR7 0x30000e00U
57#define BOOT_HICR8 0xfe0001ffU
58
59struct mbox_context {
60 struct pollfd fds[TOTAL_FDS];
61 void *lpc_mem;
62 uint32_t base;
63 uint32_t size;
64 uint32_t pgsize;
65 bool dirty;
66 uint32_t dirtybase;
67 uint32_t dirtysize;
68 struct mtd_info_user mtd_info;
69};
70
71static int running = 1;
72
73static int point_to_flash(void)
74{
75 /*
76 * Point it to the real flash for sanity. Because hostboot has
77 * expectations as to where the flash is we can't use the kernel
78 * provided UNMAP ioctl().
79 *
80 * That that ioctl() does is detect the size of the flash and map it
81 * appropriately on the LPC bus on the host. The issue with this is that
82 * if a machine has a different flash size to what hostboot expects the
83 * mapping will be incorrect.
84 *
85 * For example 32MB of flash for a platform would mean that hostboot
86 * expects flash to be at 0x0e000000 - 0x0fffffff on the LPC bus. If
87 * the machine actually has 64MB of flash then the UNMAP ioctl() would
88 * map it 0x0c000000 - 0x0fffffff but hostboot will still read at
89 * 0x0e000000.
90 *
91 * Until hostboot learns how to talk to this daemon this hardcode will
92 * get hostboot going. Furthermore, when hostboot does learn to talk
93 * then this mapping is unnecessary and this code should be removed.
94 */
95
96 int r = 0, devmem_fd;
97 char *devmem_ptr;
98
99 MSG_OUT("Pointing HOST LPC bus at the actual flash\n");
100 MSG_OUT("Assuming 32MB of flash: HOST LPC 0x%08x -> BMC 0x%08x\n",
101 BOOT_HICR7 & 0xffff0000, BOOT_HICR7 << 16);
102 devmem_fd = open("/dev/mem", O_RDWR);
103 if (devmem_fd == -1) {
104 r = -errno;
105 MSG_ERR("Couldn't open /dev/mem: %s\n", strerror(-r));
106 goto out;
107 }
108 devmem_ptr = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED,
109 devmem_fd, 0x1e789000);
110 if (devmem_ptr == MAP_FAILED) {
111 r = -errno;
112 MSG_ERR("Couldn't mmap() /dev/mem at 0x1e789000 for 0x1000: %s\n",
113 strerror(-r));
114 goto out;
115 }
116 *(uint32_t *)&devmem_ptr[0x88] = BOOT_HICR7;
117 *(uint32_t *)&devmem_ptr[0x8c] = BOOT_HICR8;
118 munmap(devmem_ptr, 0x1000);
119 close(devmem_fd);
120 /* Sigh */
121
122out:
123 return r;
124}
125
126static int flash_write(struct mbox_context *context, uint32_t pos, uint32_t len)
127{
128 int rc;
129 struct erase_info_user erase_info = {
130 .start = pos,
131 };
132
133 assert(context);
134
135 erase_info.length = ALIGN_UP(len, context->mtd_info.erasesize);
136
137 MSG_OUT("Erasing 0x%08x for 0x%08x (aligned: 0x%08x)\n", pos, len, erase_info.length);
138 if (ioctl(-context->fds[MTD_FD].fd, MEMERASE, &erase_info) == -1) {
139 MSG_ERR("Couldn't MEMERASE ioctl, flash write lost: %s\n", strerror(errno));
140 return -1;
141 }
142
143 if (lseek(-context->fds[MTD_FD].fd, pos, SEEK_SET) == (off_t) -1) {
144 MSG_ERR("Couldn't seek to 0x%08x into MTD, flash write lost: %s\n", pos, strerror(errno));
145 return -1;
146 }
147
148 while (erase_info.length) {
149 rc = write(-context->fds[MTD_FD].fd, context->lpc_mem + pos, erase_info.length);
150 if (rc == -1) {
151 MSG_ERR("Couldn't write to flash! Flash write lost: %s\n", strerror(errno));
152 return -1;
153 }
154 erase_info.length -= rc;
155 pos += rc;
156 }
157
158 return 0;
159}
160
161/* TODO: Add come consistency around the daemon exiting and either
162 * way, ensuring it responds.
163 * I'm in favour of an approach where it does its best to stay alive
164 * and keep talking, the hacky prototype was written the other way.
165 * This function is now inconsistent
166 */
167static int dispatch_mbox(struct mbox_context *context)
168{
169 int r = 0;
170 int len;
171 off_t pos;
172 uint8_t byte;
173 union mbox_regs resp, req = { 0 };
174 uint16_t sizepg, basepg, dirtypg;
175 uint32_t dirtycount;
176 struct aspeed_lpc_ctrl_mapping map;
177
178 assert(context);
179
180 map.addr = context->base;
181 map.size = context->size;
182 map.offset = 0;
183 map.window_type = ASPEED_LPC_CTRL_WINDOW_MEMORY;
184 map.window_id = 0; /* Theres only one */
185
186 MSG_OUT("Dispatched to mbox\n");
187 r = read(context->fds[MBOX_FD].fd, &req, sizeof(req.raw));
188 if (r < 0) {
189 r = -errno;
190 MSG_ERR("Couldn't read: %s\n", strerror(errno));
191 goto out;
192 }
193 if (r < sizeof(req.msg)) {
194 MSG_ERR("Short read: %d expecting %zu\n", r, sizeof(req.msg));
195 r = -1;
196 goto out;
197 }
198
199 /* We are NOT going to update the last two 'status' bytes */
200 memcpy(&resp, &req, sizeof(req.msg));
201
202 sizepg = context->size >> context->pgsize;
203 basepg = context->base >> context->pgsize;
204 MSG_OUT("Got data in with command %d\n", req.msg.command);
205 switch (req.msg.command) {
206 case MBOX_C_RESET_STATE:
207 /* Called by early hostboot? TODO */
208 resp.msg.response = MBOX_R_SUCCESS;
209 r = point_to_flash();
210 if (r) {
211 resp.msg.response = MBOX_R_SYSTEM_ERROR;
212 MSG_ERR("Couldn't point the LPC BUS back to actual flash\n");
213 }
214 break;
215 case MBOX_C_GET_MBOX_INFO:
216 /* TODO Freak if data.data[0] isn't 1 */
217 resp.msg.data[0] = 1;
218 put_u16(&resp.msg.data[1], sizepg);
219 put_u16(&resp.msg.data[3], sizepg);
220 resp.msg.response = MBOX_R_SUCCESS;
221 /* Wow that can't stay negated thats horrible */
222 MSG_OUT("LPC_CTRL_IOCTL_MAP to 0x%08x for 0x%08x\n", map.addr, map.size);
223 r = ioctl(-context->fds[LPC_CTRL_FD].fd,
224 ASPEED_LPC_CTRL_IOCTL_MAP, &map);
225 if (r < 0) {
226 r = -errno;
227 resp.msg.response = MBOX_R_SYSTEM_ERROR;
228 MSG_ERR("Couldn't MAP ioctl(): %s\n", strerror(errno));
229 }
230 break;
231 case MBOX_C_GET_FLASH_INFO:
232 put_u32(&resp.msg.data[0], context->mtd_info.size);
233 put_u32(&resp.msg.data[4], context->mtd_info.erasesize);
234 resp.msg.response = MBOX_R_SUCCESS;
235 break;
236 case MBOX_C_READ_WINDOW:
237 /*
238 * We could probably play tricks with LPC mapping.
239 * That would require kernel involvement.
240 * We could also always copy the relevant flash part to
241 * context->base even if it turns out that offset is in
242 * the window...
243 * This approach is easiest.
244 */
245 if (context->dirty)
246 read(-context->fds[MTD_FD].fd, context->lpc_mem, context->size);
247 basepg += get_u16(&req.msg.data[0]);
248 put_u16(&resp.msg.data[0], basepg);
249 resp.msg.response = MBOX_R_SUCCESS;
250 context->dirty = false;
251 break;
252 case MBOX_C_CLOSE_WINDOW:
253 context->dirty = true;
254 break;
255 case MBOX_C_WRITE_WINDOW:
256 basepg += get_u16(&req.msg.data[0]);
257 put_u16(&resp.msg.data[0], basepg);
258 resp.msg.response = MBOX_R_SUCCESS;
259 context->dirtybase = basepg << context->pgsize;
260 break;
261 /* Optimise these later */
262 case MBOX_C_WRITE_DIRTY:
263 case MBOX_C_WRITE_FENCE:
264 dirtypg = get_u16(&req.msg.data[0]);
265 dirtycount = get_u32(&req.msg.data[2]);
266 if (dirtycount == 0) {
267 resp.msg.response = MBOX_R_PARAM_ERROR;
268 break;
269 }
270 /*
271 * dirtypg is actually offset within window so we probs
272 * need to know if the window isn't at zero
273 */
274 if (flash_write(context, dirtypg << context->pgsize, dirtycount) != 0) {
275 resp.msg.response = MBOX_R_WRITE_ERROR;
276 break;
277 }
278 resp.msg.response = MBOX_R_SUCCESS;
279 break;
280 case MBOX_C_ACK:
281 resp.msg.response = MBOX_R_SUCCESS;
282 pos = lseek(context->fds[MBOX_FD].fd, MBOX_BMC_BYTE, SEEK_SET);
283 if (pos != MBOX_BMC_BYTE) {
284 r = -errno;
285 MSG_ERR("Couldn't lseek() to byte %d: %s\n", MBOX_BMC_BYTE,
286 strerror(errno));
287 }
288 /*
289 * NAND what is in the hardware and the request.
290 * This prevents the host being able to SET bits, it can
291 * only request set ones be cleared.
292 */
293 byte = ~(req.msg.data[0] & req.raw[MBOX_BMC_BYTE]);
294 len = write(context->fds[MBOX_FD].fd, &byte, 1);
295 if (len != 1) {
296 r = -errno;
297 MSG_ERR("Couldn't write to BMC status reg: %s\n",
298 strerror(errno));
299 }
300 pos = lseek(context->fds[MBOX_FD].fd, 0, SEEK_SET);
301 if (pos != 0) {
302 r = -errno;
303 MSG_ERR("Couldn't reset MBOX offset to zero\n");
304 }
305 break;
306 case MBOX_C_COMPLETED_COMMANDS:
307 /* This implementation always completes before responding */
308 resp.msg.data[0] = 0;
309 resp.msg.response = MBOX_R_SUCCESS;
310 break;
311 default:
312 MSG_ERR("UNKNOWN MBOX COMMAND\n");
313 resp.msg.response = MBOX_R_PARAM_ERROR;
314 r = -1;
315 }
316
317 MSG_OUT("Writing response to MBOX regs\n");
318 len = write(context->fds[MBOX_FD].fd, &resp, sizeof(resp.msg));
319 if (len < sizeof(resp.msg)) {
320 r = -errno;
321 MSG_ERR("Didn't write the full response\n");
322 }
323
324out:
325 return r;
326}
327
328static void usage(const char *name)
329{
330 fprintf(stderr, "Usage %s [ -v[v] | --syslog ]\n", name);
331 fprintf(stderr, "\t--verbose\t Be [more] verbose\n");
332 fprintf(stderr, "\t--syslog\t Log output to syslog (pointless without -v)\n\n");
333}
334
335int main(int argc, char *argv[])
336{
337 struct mbox_context *context;
338 const char *name = argv[0];
339 char *pnor_filename = NULL;
340 int opt, polled, r, i;
341 struct aspeed_lpc_ctrl_mapping map;
342
343 static const struct option long_options[] = {
344 { "verbose", no_argument, 0, 'v' },
345 { "syslog", no_argument, 0, 's' },
346 { 0, 0, 0, 0 }
347 };
348
349 context = calloc(1, sizeof(*context));
350 for (i = 0; i < TOTAL_FDS; i++)
351 context->fds[i].fd = -1;
352
353 mbox_vlog = &mbox_log_console;
354 while ((opt = getopt_long(argc, argv, "v", long_options, NULL)) != -1) {
355 switch (opt) {
356 case 0:
357 break;
358 case 'v':
359 verbosity++;
360 break;
361 case 's':
362 /* Avoid a double openlog() */
363 if (mbox_vlog != &vsyslog) {
364 openlog(PREFIX, LOG_ODELAY, LOG_DAEMON);
365 mbox_vlog = &vsyslog;
366 }
367 break;
368 default:
369 usage(name);
370 exit(EXIT_FAILURE);
371 }
372 }
373
374 if (verbosity == MBOX_LOG_VERBOSE)
375 MSG_OUT("Verbose logging\n");
376
377 if (verbosity == MBOX_LOG_DEBUG)
378 MSG_OUT("Debug logging\n");
379
380 MSG_OUT("Starting\n");
381
382 MSG_OUT("Opening %s\n", MBOX_HOST_PATH);
383 context->fds[MBOX_FD].fd = open(MBOX_HOST_PATH, O_RDWR | O_NONBLOCK);
384 if (context->fds[MBOX_FD].fd < 0) {
385 r = -errno;
386 MSG_ERR("Couldn't open %s with flags O_RDWR: %s\n",
387 MBOX_HOST_PATH, strerror(errno));
388 goto finish;
389 }
390
391 MSG_OUT("Opening %s\n", LPC_CTRL_PATH);
392 context->fds[LPC_CTRL_FD].fd = open(LPC_CTRL_PATH, O_RDWR | O_SYNC);
393 if (context->fds[LPC_CTRL_FD].fd < 0) {
394 r = -errno;
395 MSG_ERR("Couldn't open %s with flags O_RDWR: %s\n",
396 LPC_CTRL_PATH, strerror(errno));
397 goto finish;
398 }
399
400 MSG_OUT("Getting buffer size...\n");
401 /* This may become more variable in the future */
402 context->pgsize = 12; /* 4K */
403 map.window_type = ASPEED_LPC_CTRL_WINDOW_MEMORY;
404 map.window_id = 0; /* Theres only one */
405 if (ioctl(context->fds[LPC_CTRL_FD].fd, ASPEED_LPC_CTRL_IOCTL_GET_SIZE,
406 &map) < 0) {
407 r = -errno;
408 MSG_OUT("fail\n");
409 MSG_ERR("Couldn't get lpc control buffer size: %s\n", strerror(-r));
410 goto finish;
411 }
412 /* And strip the first nibble, LPC access speciality */
413 context->size = map.size;
414 context->base = -context->size & 0x0FFFFFFF;
415
416 /* READ THE COMMENT AT THE START OF THIS FUNCTION! */
417 r = point_to_flash();
418 if (r) {
419 MSG_ERR("Failed to point the LPC BUS at the actual flash: %s\n",
420 strerror(-r));
421 goto finish;
422 }
423
424 MSG_OUT("Mapping %s for %u\n", LPC_CTRL_PATH, context->size);
425 context->lpc_mem = mmap(NULL, context->size, PROT_READ | PROT_WRITE, MAP_SHARED,
426 context->fds[LPC_CTRL_FD].fd, 0);
427 if (context->lpc_mem == MAP_FAILED) {
428 r = -errno;
429 MSG_ERR("Didn't manage to mmap %s: %s\n", LPC_CTRL_PATH, strerror(errno));
430 goto finish;
431 }
432
433 pnor_filename = get_dev_mtd();
434 if (!pnor_filename) {
435 MSG_ERR("Couldn't find the PNOR /dev/mtd partition\n");
436 r = -1;
437 goto finish;
438 }
439
440 MSG_OUT("Opening %s\n", pnor_filename);
441 context->fds[MTD_FD].fd = open(pnor_filename, O_RDWR);
442 if (context->fds[MTD_FD].fd < 0) {
443 r = -errno;
444 MSG_ERR("Couldn't open %s with flags O_RDWR: %s\n",
445 pnor_filename, strerror(errno));
446 goto finish;
447 }
448
449 if (ioctl(context->fds[MTD_FD].fd, MEMGETINFO, &context->mtd_info) == -1) {
450 MSG_ERR("Couldn't get information about MTD: %s\n", strerror(errno));
451 return -1;
452 }
453
454 /*
455 * Copy flash into RAM early, same time.
456 * The kernel has created the LPC->AHB mapping also, which means
457 * flash should work.
458 * Ideally we tell the kernel whats up and when to do stuff...
459 */
460 MSG_OUT("Loading flash into ram at %p for 0x%08x bytes\n",
461 context->lpc_mem, context->size);
462 r = read(context->fds[MTD_FD].fd, context->lpc_mem, context->size);
463 if (r != context->size) {
464 MSG_ERR("Couldn't copy mtd into ram: %d\n", r);
465 goto finish;
466 }
467
468 context->fds[MBOX_FD].events = POLLIN;
469 /* Ignore in poll() */
470 context->fds[LPC_CTRL_FD].fd = -context->fds[LPC_CTRL_FD].fd;
471 context->fds[MTD_FD].fd = -context->fds[MTD_FD].fd;
472
Cyril Burd8f6d7a2017-01-10 18:11:16 +1100473 /* Test the single write facility by setting all the regs to 0xFF */
474 MSG_OUT("Setting all MBOX regs to 0xff individually...\n");
475 for (i = 0; i < MBOX_REG_BYTES; i++) {
476 uint8_t byte = 0xff;
477 off_t pos;
478 int len;
479
480 pos = lseek(context->fds[MBOX_FD].fd, i, SEEK_SET);
481 if (pos != i) {
482 MSG_ERR("Couldn't lseek() to byte %d: %s\n", i,
483 strerror(errno));
484 break;
485 }
486 len = write(context->fds[MBOX_FD].fd, &byte, 1);
487 if (len != 1) {
488 MSG_ERR("Couldn't write MBOX reg %d: %s\n", i,
489 strerror(errno));
490 break;
491 }
492 }
493 if (lseek(context->fds[MBOX_FD].fd, 0, SEEK_SET) != 0) {
494 r = -errno;
495 MSG_ERR("Couldn't reset MBOX pos to zero\n");
496 goto finish;
497 }
498
Cyril Burc85e34d2016-11-15 11:50:41 +1100499 MSG_OUT("Entering polling loop\n");
500 while (running) {
501 polled = poll(context->fds, TOTAL_FDS, 1000);
502 if (polled == 0)
503 continue;
504 if (polled < 0) {
505 r = -errno;
506 MSG_ERR("Error from poll(): %s\n", strerror(errno));
507 break;
508 }
509 r = dispatch_mbox(context);
510 if (r < 0) {
511 MSG_ERR("Error handling MBOX event: %s\n", strerror(-r));
512 break;
513 }
514 }
515
516 MSG_OUT("Exiting\n");
517
518 /* Unnegate so we can close it */
519 context->fds[LPC_CTRL_FD].fd = -context->fds[LPC_CTRL_FD].fd;
520 context->fds[MTD_FD].fd = -context->fds[MTD_FD].fd;
521
522finish:
523 if (context->lpc_mem)
524 munmap(context->lpc_mem, context->size);
525
526 free(pnor_filename);
527 close(context->fds[MTD_FD].fd);
528 close(context->fds[LPC_CTRL_FD].fd);
529 close(context->fds[MBOX_FD].fd);
530 free(context);
531
532 return r;
533}
534