mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-23 23:46:09 +07:00
f275a46594
The driver's interrupt handler checks whether a message is currently
being handled with the curr_msg pointer. When it is NULL, the interrupt
is considered to be unexpected. Similarly, the i2c_start_transfer
routine checks for the remaining number of messages to handle in
num_msgs.
However, these values are never cleared and always keep the message and
number relevant to the latest transfer (which might be done already and
the underlying message memory might have been freed).
When an unexpected interrupt hits with the DONE bit set, the isr will
then try to access the flags field of the curr_msg structure, leading
to a fatal page fault.
The msg_buf and msg_buf_remaining fields are also never cleared at the
end of the transfer, which can lead to similar pitfalls.
Fix these issues by introducing a cleanup function and always calling
it after a transfer is finished.
Fixes: e247454103 ("i2c: bcm2835: Fix hang for writing messages larger than 16 bytes")
Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
432 lines
11 KiB
C
432 lines
11 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* BCM2835 master mode driver
|
|
*/
|
|
|
|
#include <linux/clk.h>
|
|
#include <linux/completion.h>
|
|
#include <linux/err.h>
|
|
#include <linux/i2c.h>
|
|
#include <linux/interrupt.h>
|
|
#include <linux/io.h>
|
|
#include <linux/module.h>
|
|
#include <linux/platform_device.h>
|
|
#include <linux/slab.h>
|
|
|
|
#define BCM2835_I2C_C 0x0
|
|
#define BCM2835_I2C_S 0x4
|
|
#define BCM2835_I2C_DLEN 0x8
|
|
#define BCM2835_I2C_A 0xc
|
|
#define BCM2835_I2C_FIFO 0x10
|
|
#define BCM2835_I2C_DIV 0x14
|
|
#define BCM2835_I2C_DEL 0x18
|
|
#define BCM2835_I2C_CLKT 0x1c
|
|
|
|
#define BCM2835_I2C_C_READ BIT(0)
|
|
#define BCM2835_I2C_C_CLEAR BIT(4) /* bits 4 and 5 both clear */
|
|
#define BCM2835_I2C_C_ST BIT(7)
|
|
#define BCM2835_I2C_C_INTD BIT(8)
|
|
#define BCM2835_I2C_C_INTT BIT(9)
|
|
#define BCM2835_I2C_C_INTR BIT(10)
|
|
#define BCM2835_I2C_C_I2CEN BIT(15)
|
|
|
|
#define BCM2835_I2C_S_TA BIT(0)
|
|
#define BCM2835_I2C_S_DONE BIT(1)
|
|
#define BCM2835_I2C_S_TXW BIT(2)
|
|
#define BCM2835_I2C_S_RXR BIT(3)
|
|
#define BCM2835_I2C_S_TXD BIT(4)
|
|
#define BCM2835_I2C_S_RXD BIT(5)
|
|
#define BCM2835_I2C_S_TXE BIT(6)
|
|
#define BCM2835_I2C_S_RXF BIT(7)
|
|
#define BCM2835_I2C_S_ERR BIT(8)
|
|
#define BCM2835_I2C_S_CLKT BIT(9)
|
|
#define BCM2835_I2C_S_LEN BIT(10) /* Fake bit for SW error reporting */
|
|
|
|
#define BCM2835_I2C_FEDL_SHIFT 16
|
|
#define BCM2835_I2C_REDL_SHIFT 0
|
|
|
|
#define BCM2835_I2C_CDIV_MIN 0x0002
|
|
#define BCM2835_I2C_CDIV_MAX 0xFFFE
|
|
|
|
struct bcm2835_i2c_dev {
|
|
struct device *dev;
|
|
void __iomem *regs;
|
|
struct clk *clk;
|
|
int irq;
|
|
u32 bus_clk_rate;
|
|
struct i2c_adapter adapter;
|
|
struct completion completion;
|
|
struct i2c_msg *curr_msg;
|
|
int num_msgs;
|
|
u32 msg_err;
|
|
u8 *msg_buf;
|
|
size_t msg_buf_remaining;
|
|
};
|
|
|
|
static inline void bcm2835_i2c_writel(struct bcm2835_i2c_dev *i2c_dev,
|
|
u32 reg, u32 val)
|
|
{
|
|
writel(val, i2c_dev->regs + reg);
|
|
}
|
|
|
|
static inline u32 bcm2835_i2c_readl(struct bcm2835_i2c_dev *i2c_dev, u32 reg)
|
|
{
|
|
return readl(i2c_dev->regs + reg);
|
|
}
|
|
|
|
static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev)
|
|
{
|
|
u32 divider, redl, fedl;
|
|
|
|
divider = DIV_ROUND_UP(clk_get_rate(i2c_dev->clk),
|
|
i2c_dev->bus_clk_rate);
|
|
/*
|
|
* Per the datasheet, the register is always interpreted as an even
|
|
* number, by rounding down. In other words, the LSB is ignored. So,
|
|
* if the LSB is set, increment the divider to avoid any issue.
|
|
*/
|
|
if (divider & 1)
|
|
divider++;
|
|
if ((divider < BCM2835_I2C_CDIV_MIN) ||
|
|
(divider > BCM2835_I2C_CDIV_MAX)) {
|
|
dev_err_ratelimited(i2c_dev->dev, "Invalid clock-frequency\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DIV, divider);
|
|
|
|
/*
|
|
* Number of core clocks to wait after falling edge before
|
|
* outputting the next data bit. Note that both FEDL and REDL
|
|
* can't be greater than CDIV/2.
|
|
*/
|
|
fedl = max(divider / 16, 1u);
|
|
|
|
/*
|
|
* Number of core clocks to wait after rising edge before
|
|
* sampling the next incoming data bit.
|
|
*/
|
|
redl = max(divider / 4, 1u);
|
|
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DEL,
|
|
(fedl << BCM2835_I2C_FEDL_SHIFT) |
|
|
(redl << BCM2835_I2C_REDL_SHIFT));
|
|
return 0;
|
|
}
|
|
|
|
static void bcm2835_fill_txfifo(struct bcm2835_i2c_dev *i2c_dev)
|
|
{
|
|
u32 val;
|
|
|
|
while (i2c_dev->msg_buf_remaining) {
|
|
val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
|
|
if (!(val & BCM2835_I2C_S_TXD))
|
|
break;
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_FIFO,
|
|
*i2c_dev->msg_buf);
|
|
i2c_dev->msg_buf++;
|
|
i2c_dev->msg_buf_remaining--;
|
|
}
|
|
}
|
|
|
|
static void bcm2835_drain_rxfifo(struct bcm2835_i2c_dev *i2c_dev)
|
|
{
|
|
u32 val;
|
|
|
|
while (i2c_dev->msg_buf_remaining) {
|
|
val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
|
|
if (!(val & BCM2835_I2C_S_RXD))
|
|
break;
|
|
*i2c_dev->msg_buf = bcm2835_i2c_readl(i2c_dev,
|
|
BCM2835_I2C_FIFO);
|
|
i2c_dev->msg_buf++;
|
|
i2c_dev->msg_buf_remaining--;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Repeated Start Condition (Sr)
|
|
* The BCM2835 ARM Peripherals datasheet mentions a way to trigger a Sr when it
|
|
* talks about reading from a slave with 10 bit address. This is achieved by
|
|
* issuing a write, poll the I2CS.TA flag and wait for it to be set, and then
|
|
* issue a read.
|
|
* A comment in https://github.com/raspberrypi/linux/issues/254 shows how the
|
|
* firmware actually does it using polling and says that it's a workaround for
|
|
* a problem in the state machine.
|
|
* It turns out that it is possible to use the TXW interrupt to know when the
|
|
* transfer is active, provided the FIFO has not been prefilled.
|
|
*/
|
|
|
|
static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
|
|
{
|
|
u32 c = BCM2835_I2C_C_ST | BCM2835_I2C_C_I2CEN;
|
|
struct i2c_msg *msg = i2c_dev->curr_msg;
|
|
bool last_msg = (i2c_dev->num_msgs == 1);
|
|
|
|
if (!i2c_dev->num_msgs)
|
|
return;
|
|
|
|
i2c_dev->num_msgs--;
|
|
i2c_dev->msg_buf = msg->buf;
|
|
i2c_dev->msg_buf_remaining = msg->len;
|
|
|
|
if (msg->flags & I2C_M_RD)
|
|
c |= BCM2835_I2C_C_READ | BCM2835_I2C_C_INTR;
|
|
else
|
|
c |= BCM2835_I2C_C_INTT;
|
|
|
|
if (last_msg)
|
|
c |= BCM2835_I2C_C_INTD;
|
|
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_A, msg->addr);
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DLEN, msg->len);
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
|
|
}
|
|
|
|
static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
|
|
{
|
|
i2c_dev->curr_msg = NULL;
|
|
i2c_dev->num_msgs = 0;
|
|
|
|
i2c_dev->msg_buf = NULL;
|
|
i2c_dev->msg_buf_remaining = 0;
|
|
}
|
|
|
|
/*
|
|
* Note about I2C_C_CLEAR on error:
|
|
* The I2C_C_CLEAR on errors will take some time to resolve -- if you were in
|
|
* non-idle state and I2C_C_READ, it sets an abort_rx flag and runs through
|
|
* the state machine to send a NACK and a STOP. Since we're setting CLEAR
|
|
* without I2CEN, that NACK will be hanging around queued up for next time
|
|
* we start the engine.
|
|
*/
|
|
|
|
static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data)
|
|
{
|
|
struct bcm2835_i2c_dev *i2c_dev = data;
|
|
u32 val, err;
|
|
|
|
val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
|
|
|
|
err = val & (BCM2835_I2C_S_CLKT | BCM2835_I2C_S_ERR);
|
|
if (err) {
|
|
i2c_dev->msg_err = err;
|
|
goto complete;
|
|
}
|
|
|
|
if (val & BCM2835_I2C_S_DONE) {
|
|
if (!i2c_dev->curr_msg) {
|
|
dev_err(i2c_dev->dev, "Got unexpected interrupt (from firmware?)\n");
|
|
} else if (i2c_dev->curr_msg->flags & I2C_M_RD) {
|
|
bcm2835_drain_rxfifo(i2c_dev);
|
|
val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
|
|
}
|
|
|
|
if ((val & BCM2835_I2C_S_RXD) || i2c_dev->msg_buf_remaining)
|
|
i2c_dev->msg_err = BCM2835_I2C_S_LEN;
|
|
else
|
|
i2c_dev->msg_err = 0;
|
|
goto complete;
|
|
}
|
|
|
|
if (val & BCM2835_I2C_S_TXW) {
|
|
if (!i2c_dev->msg_buf_remaining) {
|
|
i2c_dev->msg_err = val | BCM2835_I2C_S_LEN;
|
|
goto complete;
|
|
}
|
|
|
|
bcm2835_fill_txfifo(i2c_dev);
|
|
|
|
if (i2c_dev->num_msgs && !i2c_dev->msg_buf_remaining) {
|
|
i2c_dev->curr_msg++;
|
|
bcm2835_i2c_start_transfer(i2c_dev);
|
|
}
|
|
|
|
return IRQ_HANDLED;
|
|
}
|
|
|
|
if (val & BCM2835_I2C_S_RXR) {
|
|
if (!i2c_dev->msg_buf_remaining) {
|
|
i2c_dev->msg_err = val | BCM2835_I2C_S_LEN;
|
|
goto complete;
|
|
}
|
|
|
|
bcm2835_drain_rxfifo(i2c_dev);
|
|
return IRQ_HANDLED;
|
|
}
|
|
|
|
return IRQ_NONE;
|
|
|
|
complete:
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, BCM2835_I2C_C_CLEAR);
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_S, BCM2835_I2C_S_CLKT |
|
|
BCM2835_I2C_S_ERR | BCM2835_I2C_S_DONE);
|
|
complete(&i2c_dev->completion);
|
|
|
|
return IRQ_HANDLED;
|
|
}
|
|
|
|
static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
|
|
int num)
|
|
{
|
|
struct bcm2835_i2c_dev *i2c_dev = i2c_get_adapdata(adap);
|
|
unsigned long time_left;
|
|
int i, ret;
|
|
|
|
for (i = 0; i < (num - 1); i++)
|
|
if (msgs[i].flags & I2C_M_RD) {
|
|
dev_warn_once(i2c_dev->dev,
|
|
"only one read message supported, has to be last\n");
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
ret = bcm2835_i2c_set_divider(i2c_dev);
|
|
if (ret)
|
|
return ret;
|
|
|
|
i2c_dev->curr_msg = msgs;
|
|
i2c_dev->num_msgs = num;
|
|
reinit_completion(&i2c_dev->completion);
|
|
|
|
bcm2835_i2c_start_transfer(i2c_dev);
|
|
|
|
time_left = wait_for_completion_timeout(&i2c_dev->completion,
|
|
adap->timeout);
|
|
|
|
bcm2835_i2c_finish_transfer(i2c_dev);
|
|
|
|
if (!time_left) {
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
|
|
BCM2835_I2C_C_CLEAR);
|
|
dev_err(i2c_dev->dev, "i2c transfer timed out\n");
|
|
return -ETIMEDOUT;
|
|
}
|
|
|
|
if (!i2c_dev->msg_err)
|
|
return num;
|
|
|
|
dev_dbg(i2c_dev->dev, "i2c transfer failed: %x\n", i2c_dev->msg_err);
|
|
|
|
if (i2c_dev->msg_err & BCM2835_I2C_S_ERR)
|
|
return -EREMOTEIO;
|
|
|
|
return -EIO;
|
|
}
|
|
|
|
static u32 bcm2835_i2c_func(struct i2c_adapter *adap)
|
|
{
|
|
return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
|
|
}
|
|
|
|
static const struct i2c_algorithm bcm2835_i2c_algo = {
|
|
.master_xfer = bcm2835_i2c_xfer,
|
|
.functionality = bcm2835_i2c_func,
|
|
};
|
|
|
|
/*
|
|
* This HW was reported to have problems with clock stretching:
|
|
* http://www.advamation.com/knowhow/raspberrypi/rpi-i2c-bug.html
|
|
* https://www.raspberrypi.org/forums/viewtopic.php?p=146272
|
|
*/
|
|
static const struct i2c_adapter_quirks bcm2835_i2c_quirks = {
|
|
.flags = I2C_AQ_NO_CLK_STRETCH,
|
|
};
|
|
|
|
static int bcm2835_i2c_probe(struct platform_device *pdev)
|
|
{
|
|
struct bcm2835_i2c_dev *i2c_dev;
|
|
struct resource *mem, *irq;
|
|
int ret;
|
|
struct i2c_adapter *adap;
|
|
|
|
i2c_dev = devm_kzalloc(&pdev->dev, sizeof(*i2c_dev), GFP_KERNEL);
|
|
if (!i2c_dev)
|
|
return -ENOMEM;
|
|
platform_set_drvdata(pdev, i2c_dev);
|
|
i2c_dev->dev = &pdev->dev;
|
|
init_completion(&i2c_dev->completion);
|
|
|
|
mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
|
|
i2c_dev->regs = devm_ioremap_resource(&pdev->dev, mem);
|
|
if (IS_ERR(i2c_dev->regs))
|
|
return PTR_ERR(i2c_dev->regs);
|
|
|
|
i2c_dev->clk = devm_clk_get(&pdev->dev, NULL);
|
|
if (IS_ERR(i2c_dev->clk)) {
|
|
if (PTR_ERR(i2c_dev->clk) != -EPROBE_DEFER)
|
|
dev_err(&pdev->dev, "Could not get clock\n");
|
|
return PTR_ERR(i2c_dev->clk);
|
|
}
|
|
|
|
ret = of_property_read_u32(pdev->dev.of_node, "clock-frequency",
|
|
&i2c_dev->bus_clk_rate);
|
|
if (ret < 0) {
|
|
dev_warn(&pdev->dev,
|
|
"Could not read clock-frequency property\n");
|
|
i2c_dev->bus_clk_rate = 100000;
|
|
}
|
|
|
|
irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
|
|
if (!irq) {
|
|
dev_err(&pdev->dev, "No IRQ resource\n");
|
|
return -ENODEV;
|
|
}
|
|
i2c_dev->irq = irq->start;
|
|
|
|
ret = request_irq(i2c_dev->irq, bcm2835_i2c_isr, IRQF_SHARED,
|
|
dev_name(&pdev->dev), i2c_dev);
|
|
if (ret) {
|
|
dev_err(&pdev->dev, "Could not request IRQ\n");
|
|
return -ENODEV;
|
|
}
|
|
|
|
adap = &i2c_dev->adapter;
|
|
i2c_set_adapdata(adap, i2c_dev);
|
|
adap->owner = THIS_MODULE;
|
|
adap->class = I2C_CLASS_DEPRECATED;
|
|
strlcpy(adap->name, "bcm2835 I2C adapter", sizeof(adap->name));
|
|
adap->algo = &bcm2835_i2c_algo;
|
|
adap->dev.parent = &pdev->dev;
|
|
adap->dev.of_node = pdev->dev.of_node;
|
|
adap->quirks = &bcm2835_i2c_quirks;
|
|
|
|
bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0);
|
|
|
|
ret = i2c_add_adapter(adap);
|
|
if (ret)
|
|
free_irq(i2c_dev->irq, i2c_dev);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int bcm2835_i2c_remove(struct platform_device *pdev)
|
|
{
|
|
struct bcm2835_i2c_dev *i2c_dev = platform_get_drvdata(pdev);
|
|
|
|
free_irq(i2c_dev->irq, i2c_dev);
|
|
i2c_del_adapter(&i2c_dev->adapter);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct of_device_id bcm2835_i2c_of_match[] = {
|
|
{ .compatible = "brcm,bcm2835-i2c" },
|
|
{},
|
|
};
|
|
MODULE_DEVICE_TABLE(of, bcm2835_i2c_of_match);
|
|
|
|
static struct platform_driver bcm2835_i2c_driver = {
|
|
.probe = bcm2835_i2c_probe,
|
|
.remove = bcm2835_i2c_remove,
|
|
.driver = {
|
|
.name = "i2c-bcm2835",
|
|
.of_match_table = bcm2835_i2c_of_match,
|
|
},
|
|
};
|
|
module_platform_driver(bcm2835_i2c_driver);
|
|
|
|
MODULE_AUTHOR("Stephen Warren <swarren@wwwdotorg.org>");
|
|
MODULE_DESCRIPTION("BCM2835 I2C bus adapter");
|
|
MODULE_LICENSE("GPL v2");
|
|
MODULE_ALIAS("platform:i2c-bcm2835");
|