[char-misc-next 2/2] mei: lb: add late binding version 2

[Alexander Usyskin]

The second Late Binding version allows to send payload bigger
than client MTU by splitting it to chunks and uses separate
firmware client for transfer.

The component interface is unchanged and driver doing all splitting.

Only one Late Binding version is supported by firmware.
When Late binding version 2 is supported, the new client is advertised
by firmware and existing MKHI will have version 2.
This helps driver to select the right mode of work.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
Reviewed-by: Badal Nilawar <badal.nilawar@xxxxxxxxx>
Signed-off-by: Alexander Usyskin <alexander.usyskin@xxxxxxxxx>
---
 drivers/misc/mei/mei_lb.c                  | 252 ++++++++++++++++++---
 include/drm/intel/intel_lb_mei_interface.h |  51 ++++-
 2 files changed, 265 insertions(+), 38 deletions(-)

diff --git a/drivers/misc/mei/mei_lb.c b/drivers/misc/mei/mei_lb.c
index 78717ee8ac9a..f6a258c2b838 100644
--- a/drivers/misc/mei/mei_lb.c
+++ b/drivers/misc/mei/mei_lb.c
@@ -59,12 +59,17 @@
  * 5. Status is returned back to the host via MEI.
  */
 
+/* Late Binding version 1 */
+
 #define INTEL_LB_CMD	0x12
 #define INTEL_LB_RSP	(INTEL_LB_CMD | 0x80)
 
 #define INTEL_LB_SEND_TIMEOUT_MSEC 3000
 #define INTEL_LB_RECV_TIMEOUT_MSEC 3000
 
+#define MEI_GUID_MKHI UUID_LE(0xe2c2afa2, 0x3817, 0x4d19, \
+			      0x9d, 0x95, 0x6, 0xb1, 0x6b, 0x58, 0x8a, 0x5d)
+
 /**
  * struct mei_lb_req - Late Binding request structure
  * @header: MKHI message header (see struct mkhi_msg_hdr)
@@ -97,8 +102,74 @@ struct mei_lb_rsp {
 	__le32 status;
 } __packed;
 
-static bool mei_lb_check_response(const struct device *dev, ssize_t bytes,
-				  struct mei_lb_rsp *rsp)
+/* Late Binding version 2 */
+
+#define MEI_LB2_CMD 0x01
+
+#define MEI_LB2_HDR_FLAG_RSP 0x01
+
+#define MEI_GUID_LB UUID_LE(0x4ed87243, 0x3980, 0x4d8e, \
+			    0xb1, 0xf9, 0x6f, 0xb7, 0xc0, 0x14, 0x8c, 0x4d)
+
+/**
+ * struct mei_lb2_header - Late Binding2 header
+ * @command_id:
+ * @flags: Flags for transport layer (e.g. MEI_LB2_HDR_FLAG_RSP)
+ * @reserved: Reserved for future use by authentication firmware, must be set to 0
+ */
+struct mei_lb2_header {
+	__le32 command_id;
+	u8 flags;
+	u8 reserved[3];
+};
+
+/**
+ * struct mei_lb2_rsp_header - Late Binding2 response header
+ * @header: Common command header
+ * @status: Status returned by authentication firmware (see &enum intel_lb_status)
+ */
+struct mei_lb2_rsp_header {
+	struct mei_lb2_header header;
+	__le32 status;
+};
+
+#define MEI_LB2_FLAG_FST_CHUNK 0x02
+#define MEI_LB2_FLAG_LST_CHUNK 0x04
+
+/**
+ * struct mei_lb2_req - Late Binding2 request
+ * @header: Common command header
+ * @type: Type of the Late Binding payload (see &enum intel_lb_type)
+ * @flags: Flags to be passed to the authentication firmware (MEI_LB2_FLAG_*)
+ * @reserved: Reserved for future use by authentication firmware, must be set to 0
+ * @total_payload_size: Size of whole Late Binding package in bytes
+ * @payload_size: Size of the payload chunk in bytes
+ * @payload: Data chunk to be sent to the authentication firmware
+ */
+struct mei_lb2_req {
+	struct mei_lb2_header header;
+	__le32 type;
+	__le32 flags;
+	__le32 reserved;
+	__le32 total_payload_size;
+	__le32 payload_size;
+	u8 payload[] __counted_by(payload_size);
+};
+
+/**
+ * struct mei_lb2_rsp - Late Binding2 response
+ * @rheader: Common response header
+ * @type: Type of the Late Binding payload (see &enum intel_lb_type)
+ * @reserved: Reserved for future use by authentication firmware, must be set to 0
+ */
+struct mei_lb2_rsp {
+	struct mei_lb2_rsp_header rheader;
+	__le32 type;
+	__le32 reserved[2];
+};
+
+static bool mei_lb_check_response_v1(const struct device *dev, ssize_t bytes,
+				     struct mei_lb_rsp *rsp)
 {
 	/*
 	 * Received message size may be smaller than the full message size when
@@ -134,24 +205,15 @@ static bool mei_lb_check_response(const struct device *dev, ssize_t bytes,
 	return true;
 }
 
-static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
-			       const void *payload, size_t payload_size)
+static int mei_lb_push_payload_v1(struct device *dev, struct mei_cl_device *cldev,
+				  u32 type, u32 flags, const void *payload, size_t payload_size)
 {
-	struct mei_cl_device *cldev;
 	struct mei_lb_req *req = NULL;
 	struct mei_lb_rsp rsp;
 	size_t req_size;
 	ssize_t bytes;
 	int ret;
 
-	cldev = to_mei_cl_device(dev);
-
-	ret = mei_cldev_enable(cldev);
-	if (ret) {
-		dev_dbg(dev, "Failed to enable firmware client. %d\n", ret);
-		return ret;
-	}
-
 	req_size = struct_size(req, payload, payload_size);
 	if (req_size > mei_cldev_mtu(cldev)) {
 		dev_err(dev, "Payload is too big: %zu\n", payload_size);
@@ -190,7 +252,7 @@ static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
 		ret = bytes;
 		goto end;
 	}
-	if (!mei_lb_check_response(dev, bytes, &rsp)) {
+	if (!mei_lb_check_response_v1(dev, bytes, &rsp)) {
 		dev_err(dev, "Bad response from the firmware. header: %02x %02x %02x %02x\n",
 			rsp.header.group_id, rsp.header.command,
 			rsp.header.reserved, rsp.header.result);
@@ -201,11 +263,130 @@ static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
 	dev_dbg(dev, "status = %u\n", le32_to_cpu(rsp.status));
 	ret = (int)le32_to_cpu(rsp.status);
 end:
-	mei_cldev_disable(cldev);
 	kfree(req);
 	return ret;
 }
 
+static int mei_lb_check_response_v2(const struct device *dev, ssize_t bytes,
+				    struct mei_lb2_rsp *rsp)
+{
+	/*
+	 * Received message size may be smaller than the full message size when
+	 * reply contains only header with status field set to the error code.
+	 * Check the header size and content first to output exact error, if needed,
+	 * and then process to the whole message.
+	 */
+	if (bytes < sizeof(rsp->rheader)) {
+		dev_err(dev, "Received less than header size from the firmware: %zd < %zu\n",
+			bytes, sizeof(rsp->rheader));
+		return -ENOMSG;
+	}
+	if (rsp->rheader.header.command_id != MEI_LB2_CMD) {
+		dev_err(dev, "Mismatch command: 0x%x instead of 0x%x\n",
+			rsp->rheader.header.command_id, MEI_LB2_CMD);
+		return -EPROTO;
+	}
+	if (!(rsp->rheader.header.flags & MEI_LB2_HDR_FLAG_RSP)) {
+		dev_err(dev, "Not a response: 0x%x\n", rsp->rheader.header.flags);
+		return -EBADMSG;
+	}
+	if (rsp->rheader.status) {
+		dev_err(dev, "Error in result: 0x%x\n", rsp->rheader.status);
+		return (int)le32_to_cpu(rsp->rheader.status);
+	}
+	if (bytes < sizeof(*rsp)) {
+		dev_err(dev, "Received less than message size from the firmware: %zd < %zu\n",
+			bytes, sizeof(*rsp));
+		return -ENODATA;
+	}
+
+	return 0;
+}
+
+static int mei_lb_push_payload_v2(struct device *dev, struct mei_cl_device *cldev,
+				  u32 type, u32 flags, const void *payload, size_t payload_size)
+{
+	u32 first_chunk, last_chunk;
+	struct mei_lb2_rsp rsp;
+	size_t sent_data = 0;
+	size_t chunk_size;
+	size_t req_size;
+	ssize_t bytes;
+	int ret;
+
+	struct mei_lb2_req *req __free(kfree) = kzalloc(mei_cldev_mtu(cldev), GFP_KERNEL);
+	if (!req)
+		return -ENOMEM;
+
+	first_chunk = MEI_LB2_FLAG_FST_CHUNK;
+	last_chunk = 0;
+	do {
+		chunk_size = min(payload_size - sent_data, mei_cldev_mtu(cldev) - sizeof(*req));
+
+		req_size = struct_size(req, payload, chunk_size);
+		if (sent_data + chunk_size == payload_size)
+			last_chunk = MEI_LB2_FLAG_LST_CHUNK;
+
+		req->header.command_id = MEI_LB2_CMD;
+		req->type = cpu_to_le32(type);
+		req->flags = cpu_to_le32(flags | first_chunk | last_chunk);
+		req->reserved = 0;
+		req->total_payload_size = cpu_to_le32(payload_size);
+		req->payload_size = cpu_to_le32(chunk_size);
+		memcpy(req->payload, payload + sent_data, chunk_size);
+
+		dev_dbg(dev, "Sending %zu bytes from offset %zu of %zu%s%s\n",
+			chunk_size, sent_data, payload_size,
+			first_chunk ? " first" : "", last_chunk ? " last" : "");
+
+		bytes = mei_cldev_send_timeout(cldev, (u8 *)req, req_size,
+					       INTEL_LB_SEND_TIMEOUT_MSEC);
+		if (bytes < 0) {
+			dev_err(dev, "Failed to send late binding request to firmware. %zd\n",
+				bytes);
+			return bytes;
+		}
+
+		bytes = mei_cldev_recv_timeout(cldev, (u8 *)&rsp, sizeof(rsp),
+					       INTEL_LB_RECV_TIMEOUT_MSEC);
+		if (bytes < 0) {
+			dev_err(dev, "Failed to receive late binding reply from firmware. %zd\n",
+				bytes);
+			return bytes;
+		}
+		ret = mei_lb_check_response_v2(dev, bytes, &rsp);
+		if (ret)
+			return ret;
+
+		/* prepare for the next chunk */
+		sent_data += chunk_size;
+		first_chunk = 0;
+	} while (!last_chunk);
+
+	return 0;
+}
+
+static int mei_lb_push_payload(struct device *dev, u32 type, u32 flags,
+			       const void *payload, size_t payload_size)
+{
+	struct mei_cl_device *cldev = to_mei_cl_device(dev);
+	int ret;
+
+	ret = mei_cldev_enable(cldev);
+	if (ret) {
+		dev_dbg(dev, "Failed to enable firmware client. %d\n", ret);
+		return ret;
+	}
+
+	if (memcmp(&MEI_GUID_LB, mei_cldev_uuid(cldev), sizeof(uuid_le)) == 0)
+		ret = mei_lb_push_payload_v2(dev, cldev, type, flags, payload, payload_size);
+	else
+		ret = mei_lb_push_payload_v1(dev, cldev, type, flags, payload, payload_size);
+
+	mei_cldev_disable(cldev);
+	return ret;
+}
+
 static const struct intel_lb_component_ops mei_lb_ops = {
 	.push_payload = mei_lb_push_payload,
 };
@@ -229,11 +410,16 @@ static int mei_lb_component_match(struct device *dev, int subcomponent,
 				  void *data)
 {
 	/*
-	 * This function checks if requester is Intel %PCI_CLASS_DISPLAY_VGA or
-	 * %PCI_CLASS_DISPLAY_OTHER device, and checks if the requester is the
-	 * grand parent of mei_if i.e. late bind MEI device
+	 * This function checks if requester is Intel vendor,
+	 * determines if MEI is standalone PCI device or the auxiliary one
+	 * and checks the following:
+	 * 0) PCI parent: (e.g. /sys/class/mei/mei0/device -> ../../../0000:15:00.0)
+	 *  the requester and MEI device has the same grand parent
+	 * 1) Auxiliary parent: (e.g. /sys/class/mei/mei1/device -> ../../../xe.mei-gscfi.768)
+	 *  the requester is the parent of MEI device
 	 */
 	struct device *base = data;
+	struct device *basep = dev;
 	struct pci_dev *pdev;
 
 	if (!dev)
@@ -247,20 +433,30 @@ static int mei_lb_component_match(struct device *dev, int subcomponent,
 	if (pdev->vendor != PCI_VENDOR_ID_INTEL)
 		return 0;
 
-	if (pdev->class != (PCI_CLASS_DISPLAY_VGA << 8) &&
-	    pdev->class != (PCI_CLASS_DISPLAY_OTHER << 8))
-		return 0;
-
 	if (subcomponent != INTEL_COMPONENT_LB)
 		return 0;
 
 	base = base->parent;
-	if (!base) /* mei device */
+	if (!base) /* MEI device */
 		return 0;
 
-	base = base->parent; /* pci device */
+	if (dev_is_pci(base)) {
+		/* case 0) PCI parent */
+		base = base->parent; /* bridge 1 */
+		if (!base)
+			return 0;
+		base = base->parent; /* bridge 2 */
+
+		basep = basep->parent; /* bridge 1 */
+		if (!basep)
+			return 0;
+		basep = basep->parent; /* bridge 2 */
+	} else {
+		/* case 1) Auxiliary parent */
+		base = base->parent; /* PCI device */
+	}
 
-	return !!base && dev == base;
+	return !!base && !!basep && base == basep;
 }
 
 static int mei_lb_probe(struct mei_cl_device *cldev,
@@ -288,11 +484,9 @@ static void mei_lb_remove(struct mei_cl_device *cldev)
 	component_master_del(&cldev->dev, &mei_lb_component_master_ops);
 }
 
-#define MEI_GUID_MKHI UUID_LE(0xe2c2afa2, 0x3817, 0x4d19, \
-			      0x9d, 0x95, 0x6, 0xb1, 0x6b, 0x58, 0x8a, 0x5d)
-
 static const struct mei_cl_device_id mei_lb_tbl[] = {
-	{ .uuid = MEI_GUID_MKHI, .version = MEI_CL_VERSION_ANY },
+	{ .uuid = MEI_GUID_MKHI, .version = 1 },
+	{ .uuid = MEI_GUID_LB, .version = MEI_CL_VERSION_ANY },
 	{ }
 };
 MODULE_DEVICE_TABLE(mei, mei_lb_tbl);
diff --git a/include/drm/intel/intel_lb_mei_interface.h b/include/drm/intel/intel_lb_mei_interface.h
index 0850738a30fc..7f533ac7cc10 100644
--- a/include/drm/intel/intel_lb_mei_interface.h
+++ b/include/drm/intel/intel_lb_mei_interface.h
@@ -6,6 +6,7 @@
 #ifndef _INTEL_LB_MEI_INTERFACE_H_
 #define _INTEL_LB_MEI_INTERFACE_H_
 
+#include <linux/bits.h>
 #include <linux/types.h>
 
 struct device;
@@ -21,9 +22,11 @@ struct device;
 /**
  * enum intel_lb_type - enum to determine late binding payload type
  * @INTEL_LB_TYPE_FAN_CONTROL: Fan controller configuration
+ * @INTEL_LB_TYPE_OCODE: Ocode firmware
  */
 enum intel_lb_type {
 	INTEL_LB_TYPE_FAN_CONTROL = 1,
+	INTEL_LB_TYPE_OCODE = 3,
 };
 
 /**
@@ -36,16 +39,46 @@ enum intel_lb_type {
  * @INTEL_LB_STATUS_INVALID_SIGNATURE: Payload has an invalid or untrusted signature
  * @INTEL_LB_STATUS_INVALID_PAYLOAD: Payload contents are not accepted by firmware
  * @INTEL_LB_STATUS_TIMEOUT: Operation timed out before completion
+ * @INTEL_LB_STATUS_BUFFER_TOO_SMALL: Buffer provided is smaller when expected
+ * @INTEL_LB_STATUS_INTERNAL_ERROR: Internal firmware error
+ * @INTEL_LB_STATUS_INVALID_FPT_TABLE: Invalid firmware format table
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_VERIFICATION_ERROR: Error in signature verification
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_CPD: Invalid CPD
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_FW_VERSION_MISMATCH: Firmware version mismatch
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_MANIFEST: Invalid firmware manifest
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_HASH: Wrong hash in signature
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_BINDING_TYPE_MISMATCH: Wrong firmware type provided
+ * @INTEL_LB_STATUS_SIGNED_PAYLOAD_HANDLE_SVN_FAILED: SVN check failed
+ * @INTEL_LB_STATUS_DESTINATION_MBOX_FAILURE: Failed to send datat to destination
+ * @INTEL_LB_STATUS_MISSING_LOADING_PATCH: No loading patch found
+ * @INTEL_LB_STATUS_INVALID_COMMAND: Invalid command number
+ * @INTEL_LB_STATUS_INVALID_HECI_HEADER: Invalid transport header
+ * @INTEL_LB_STATUS_IP_ERROR_START: Base for internal errors
  */
 enum intel_lb_status {
-	INTEL_LB_STATUS_SUCCESS           = 0,
-	INTEL_LB_STATUS_4ID_MISMATCH      = 1,
-	INTEL_LB_STATUS_ARB_FAILURE       = 2,
-	INTEL_LB_STATUS_GENERAL_ERROR     = 3,
-	INTEL_LB_STATUS_INVALID_PARAMS    = 4,
-	INTEL_LB_STATUS_INVALID_SIGNATURE = 5,
-	INTEL_LB_STATUS_INVALID_PAYLOAD   = 6,
-	INTEL_LB_STATUS_TIMEOUT           = 7,
+	INTEL_LB_STATUS_SUCCESS                              = 0,
+	INTEL_LB_STATUS_4ID_MISMATCH                         = 1,
+	INTEL_LB_STATUS_ARB_FAILURE                          = 2,
+	INTEL_LB_STATUS_GENERAL_ERROR                        = 3,
+	INTEL_LB_STATUS_INVALID_PARAMS                       = 4,
+	INTEL_LB_STATUS_INVALID_SIGNATURE                    = 5,
+	INTEL_LB_STATUS_INVALID_PAYLOAD                      = 6,
+	INTEL_LB_STATUS_TIMEOUT                              = 7,
+	INTEL_LB_STATUS_BUFFER_TOO_SMALL                     = 8,
+	INTEL_LB_STATUS_INTERNAL_ERROR                       = 9,
+	INTEL_LB_STATUS_INVALID_FPT_TABLE                    = 10,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_VERIFICATION_ERROR    = 11,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_CPD           = 12,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_FW_VERSION_MISMATCH   = 13,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_MANIFEST      = 14,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_INVALID_HASH          = 15,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_BINDING_TYPE_MISMATCH = 16,
+	INTEL_LB_STATUS_SIGNED_PAYLOAD_HANDLE_SVN_FAILED     = 17,
+	INTEL_LB_STATUS_DESTINATION_MBOX_FAILURE             = 18,
+	INTEL_LB_STATUS_MISSING_LOADING_PATCH                = 19,
+	INTEL_LB_STATUS_INVALID_COMMAND                      = 20,
+	INTEL_LB_STATUS_INVALID_HECI_HEADER                  = 21,
+	INTEL_LB_STATUS_IP_ERROR_START                       = BIT(31),
 };
 
 /**
@@ -62,7 +95,7 @@ struct intel_lb_component_ops {
 	 * @payload_size: Payload buffer size in bytes
 	 *
 	 * Return: 0 success, negative errno value on transport failure,
-	 *         positive status returned by firmware
+	 *         positive error status returned by firmware
 	 */
 	int (*push_payload)(struct device *dev, u32 type, u32 flags,
 			    const void *payload, size_t payload_size);
-- 
2.43.0