system76-coreboot/util/intelmetool/me.c

/* SPDX-License-Identifier: GPL-2.0-only */

#include <pci/pci.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/io.h>
#include <assert.h>
#include <unistd.h>

#include "intelmetool.h"
#include "me.h"
#include "mmap.h"

#define read32(addr, off) ( *((uint32_t *) (addr + off)) )
#define write32(addr, off, val) ( *((uint32_t *) (addr + off)) = val)

/* Path that the BIOS should take based on ME state */
/*
static const char *me_bios_path_values[] = {
	[ME_NORMAL_BIOS_PATH]		= "Normal",
	[ME_S3WAKE_BIOS_PATH]		= "S3 Wake",
	[ME_ERROR_BIOS_PATH]		= "Error",
	[ME_RECOVERY_BIOS_PATH]		= "Recovery",
	[ME_DISABLE_BIOS_PATH]		= "Disable",
	[ME_FIRMWARE_UPDATE_BIOS_PATH]	= "Firmware Update",
};
*/

/* MMIO base address for MEI interface */
static uint32_t mei_base_address;
static uint8_t* mei_mmap;

static void mei_dump(void *ptr, int dword, int offset, const char *type)
{
	/* struct mei_csr *csr; */


	switch (offset) {
	case MEI_H_CSR:
	case MEI_ME_CSR_HA:
/*
		csr = ptr;
		if (!csr) {
		printf("%-9s[%02x] : ", type, offset);
			printf("ERROR: 0x%08x\n", dword);
			break;
		}
		printf("%-9s[%02x] : ", type, offset);
		printf("depth=%u read=%02u write=%02u ready=%u "
		       "reset=%u intgen=%u intstatus=%u intenable=%u\n",
		       csr->buffer_depth, csr->buffer_read_ptr,
		       csr->buffer_write_ptr, csr->ready, csr->reset,
		       csr->interrupt_generate, csr->interrupt_status,
		       csr->interrupt_enable);
*/
		break;
	case MEI_ME_CB_RW:
	case MEI_H_CB_WW:
		printf("%-9s[%02x] : ", type, offset);
		printf("CB: 0x%08x\n", dword);
		break;
	default:
		printf("%-9s[%02x] : ", type, offset);
		printf("0x%08x\n", offset);
		break;
	}
}

/*
 * ME/MEI access helpers using memcpy to avoid aliasing.
 */

static inline void mei_read_dword_ptr(void *ptr, uint32_t offset)
{
	uint32_t dword = read32(mei_mmap, offset);
	memcpy(ptr, &dword, sizeof(dword));

	if (debug) {
		mei_dump(ptr, dword, offset, "READ");
	}
}

static inline void mei_write_dword_ptr(void *ptr, uint32_t offset)
{
	uint32_t dword = 0;
	memcpy(&dword, ptr, sizeof(dword));
	write32(mei_mmap, offset, dword);

	if (debug) {
		mei_dump(ptr, dword, offset, "WRITE");
	}
}

static inline void pci_read_dword_ptr(struct pci_dev *dev, void *ptr, uint32_t offset)
{
	uint32_t dword = pci_read_long(dev, offset);
	memcpy(ptr, &dword, sizeof(dword));

	if (debug) {
		mei_dump(ptr, dword, offset, "PCI READ");
	}
}

static inline void read_host_csr(struct mei_csr *csr)
{
	mei_read_dword_ptr(csr, MEI_H_CSR);
}

static inline void write_host_csr(struct mei_csr *csr)
{
	mei_write_dword_ptr(csr, MEI_H_CSR);
}

static inline void read_me_csr(struct mei_csr *csr)
{
	mei_read_dword_ptr(csr, MEI_ME_CSR_HA);
}

static inline void write_cb(uint32_t dword)
{
	write32(mei_mmap, MEI_H_CB_WW, dword);

	if (debug) {
		mei_dump(NULL, dword, MEI_H_CB_WW, "WRITE");
	}
}

static inline uint32_t read_cb(void)
{
	uint32_t dword = read32(mei_mmap, MEI_ME_CB_RW);

	if (debug) {
		mei_dump(NULL, dword, MEI_ME_CB_RW, "READ");
	}

	return dword;
}

/* Wait for ME ready bit to be asserted */
static int mei_wait_for_me_ready(void)
{
	struct mei_csr me;
	unsigned try = ME_RETRY;

	while (try--) {
		read_me_csr(&me);
		if (me.ready)
			return 0;
		usleep(ME_DELAY);
	}

	printf("ME: failed to become ready\n");
	return -1;
}

void mei_reset(void)
{
	struct mei_csr host;

	if (mei_wait_for_me_ready() < 0)
		return;

	/* Reset host and ME circular buffers for next message */
	read_host_csr(&host);
	host.reset = 1;
	host.interrupt_generate = 1;
	write_host_csr(&host);

	if (mei_wait_for_me_ready() < 0)
		return;

	/* Re-init and indicate host is ready */
	read_host_csr(&host);
	host.interrupt_generate = 1;
	host.ready = 1;
	host.reset = 0;
	write_host_csr(&host);
}

static int mei_send_msg(struct mei_header *mei, struct mkhi_header *mkhi,
			void *req_data)
{
	struct mei_csr host;
	unsigned ndata , n;
	uint32_t *data;

	/* Number of dwords to write, ignoring MKHI */
	ndata = (mei->length) >> 2;

	/* Pad non-dword aligned request message length */
	if (mei->length & 3)
		ndata++;
	if (!ndata) {
		printf("ME: request does not include MKHI\n");
		return -1;
	}
	ndata++; /* Add MEI header */

	/*
	 * Make sure there is still room left in the circular buffer.
	 * Reset the buffer pointers if the requested message will not fit.
	 */
	read_host_csr(&host);
	if ((host.buffer_depth - host.buffer_write_ptr) < ndata) {
		printf("ME: circular buffer full, resetting...\n");
		mei_reset();
		read_host_csr(&host);
	}

	/*
	 * This implementation does not handle splitting large messages
	 * across multiple transactions.  Ensure the requested length
	 * will fit in the available circular buffer depth.
	 */
	if ((host.buffer_depth - host.buffer_write_ptr) < ndata) {
		printf("ME: message (%u) too large for buffer (%u)\n",
		       ndata + 2, host.buffer_depth);
		return -1;
	}

	/* Write MEI header */
	mei_write_dword_ptr(mei, MEI_H_CB_WW);
	ndata--;

	/* Write MKHI header */
	mei_write_dword_ptr(mkhi, MEI_H_CB_WW);
	ndata--;

	/* Write message data */
	data = req_data;
	for (n = 0; n < ndata; ++n)
		write_cb(*data++);

	/* Generate interrupt to the ME */
	read_host_csr(&host);
	host.interrupt_generate = 1;
	write_host_csr(&host);

	/* Make sure ME is ready after sending request data */
	return mei_wait_for_me_ready();
}

static int mei_recv_msg(struct mei_header *mei, struct mkhi_header *mkhi,
			void *rsp_data, uint32_t rsp_bytes)
{
	struct mei_header mei_rsp;
	struct mkhi_header mkhi_rsp;
	struct mei_csr me, host;
	unsigned ndata, n;
	unsigned expected;
	uint32_t *data;

	/* Total number of dwords to read from circular buffer */
	expected = (rsp_bytes + sizeof(mei_rsp) + sizeof(mkhi_rsp)) >> 2;
	if (rsp_bytes & 3)
		expected++;

	if (debug) {
		printf("expected u32 = %d\n", expected);
	}
	/*
	 * The interrupt status bit does not appear to indicate that the
	 * message has actually been received.  Instead we wait until the
	 * expected number of dwords are present in the circular buffer.
	 */
	for (n = ME_RETRY; n; --n) {
		read_me_csr(&me);
		if ((me.buffer_write_ptr - me.buffer_read_ptr) >= expected)
		//if (me.interrupt_generate && !me.interrupt_status)
		//if (me.interrupt_status)
			break;
		usleep(ME_DELAY);
	}
	if (!n) {
		printf("ME: timeout waiting for data: expected "
		       "%u, available %u\n", expected,
		       me.buffer_write_ptr - me.buffer_read_ptr);
		return -1;
	}
	/* Read and verify MEI response header from the ME */
	mei_read_dword_ptr(&mei_rsp, MEI_ME_CB_RW);
	if (!mei_rsp.is_complete) {
		printf("ME: response is not complete\n");
		return -1;
	}

	/* Handle non-dword responses and expect at least MKHI header */
	ndata = mei_rsp.length >> 2;
	if (mei_rsp.length & 3)
		ndata++;
	if (ndata != (expected - 1)) {  //XXX
		printf("ME: response is missing data\n");
		//return -1;
	}

	/* Read and verify MKHI response header from the ME */
	mei_read_dword_ptr(&mkhi_rsp, MEI_ME_CB_RW);
	if (!mkhi_rsp.is_response ||
	    mkhi->group_id != mkhi_rsp.group_id ||
	    mkhi->command != mkhi_rsp.command) {
		printf("ME: invalid response, group %u ?= %u, "
		       "command %u ?= %u, is_response %u\n", mkhi->group_id,
		       mkhi_rsp.group_id, mkhi->command, mkhi_rsp.command,
		       mkhi_rsp.is_response);
		//return -1;
	}
	ndata--; /* MKHI header has been read */

	/* Make sure caller passed a buffer with enough space */
	if (ndata != (rsp_bytes >> 2)) {
		printf("ME: not enough room in response buffer: "
		       "%u != %u\n", ndata, rsp_bytes >> 2);
		//return -1;
	}

	/* Read response data from the circular buffer */
	data = rsp_data;
	for (n = 0; n < ndata; ++n)
		*data++ = read_cb();

	/* Tell the ME that we have consumed the response */
	read_host_csr(&host);
	host.interrupt_status = 1;
	host.interrupt_generate = 1;
	write_host_csr(&host);

	return mei_wait_for_me_ready();
}

static inline int mei_sendrecv(struct mei_header *mei, struct mkhi_header *mkhi,
			       void *req_data, void *rsp_data, uint32_t rsp_bytes)
{
	if (mei_send_msg(mei, mkhi, req_data) < 0)
		return -1;
	if (mei_recv_msg(mei, mkhi, rsp_data, rsp_bytes) < 0)
		return -1;
	return 0;
}

/* Send END OF POST message to the ME */
/*
static int mkhi_end_of_post(void)
{
	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_GEN,
		.command	= MKHI_END_OF_POST,
	};
	struct mei_header mei = {
		.is_complete	= 1,
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_MKHI,
		.length		= sizeof(mkhi),
	};

	if (mei_sendrecv(&mei, &mkhi, NULL, NULL, 0) < 0) {
		printf("ME: END OF POST message failed\n");
		return -1;
	}

	printf("ME: END OF POST message successful\n");
	return 0;
}
*/

/* Get ME firmware version */
int mkhi_get_fw_version(int *major, int *minor)
{
	uint32_t data = 0;
	struct me_fw_version version = {0};

	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_GEN,
		.command	= GEN_GET_FW_VERSION,
		.is_response 	= 0,
	};

	struct mei_header mei = {
		.is_complete	= 1,
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_MKHI,
		.length		= sizeof(mkhi),
	};

#ifndef OLDARC
	/* Send request and wait for response */
	if (mei_sendrecv(&mei, &mkhi, &data, &version, sizeof(version) ) < 0) {
		printf("ME: GET FW VERSION message failed\n");
		return -1;
	}
	printf("ME: Firmware Version %u.%u.%u.%u (code) "
	       "%u.%u.%u.%u (recovery) "
	       "%u.%u.%u.%u (fitc)\n\n",
	       version.code_major, version.code_minor,
	       version.code_build_number, version.code_hot_fix,
	       version.recovery_major, version.recovery_minor,
	       version.recovery_build_number, version.recovery_hot_fix,
	       version.fitcmajor, version.fitcminor,
	       version.fitcbuildno, version.fitchotfix);
#else
	/* Send request and wait for response */
	if (mei_sendrecv(&mei, &mkhi, &data, &version, 2*sizeof(uint32_t) ) < 0) {
		printf("ME: GET FW VERSION message failed\n");
		return -1;
	}
	printf("ME: Firmware Version %u.%u (code)\n\n",
	       version.code_major, version.code_minor);
#endif
	if (major)
		*major = version.code_major;
	if (minor)
		*minor = version.code_minor;
	return 0;
}

static void print_cap(const char *name, int state)
{
	printf("ME Capability: %-30s : %s\n",
	       name, state ? CRED "ON" RESET : CGRN "OFF" RESET);
}

/* Get ME Firmware Capabilities */
int mkhi_get_fwcaps(void)
{
	struct {
		uint32_t rule_id;
		uint32_t rule_len;

		struct me_fwcaps cap;
	} fwcaps;

	fwcaps.rule_id = 0;
	fwcaps.rule_len = 0;

	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_FWCAPS,
		.command	= MKHI_FWCAPS_GET_RULE,
		.is_response	= 0,
	};
	struct mei_header mei = {
		.is_complete	= 1,
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_MKHI,
		.length		= sizeof(mkhi) + sizeof(fwcaps.rule_id),
	};

	/* Send request and wait for response */
	if (mei_sendrecv(&mei, &mkhi, &fwcaps.rule_id, &fwcaps.cap, sizeof(fwcaps.cap)) < 0) {
		printf("ME: GET FWCAPS message failed\n");
		return -1;
	}

	print_cap("Full Network manageability                ", fwcaps.cap.caps_sku.full_net);
	print_cap("Regular Network manageability             ", fwcaps.cap.caps_sku.std_net);
	print_cap("Manageability                             ", fwcaps.cap.caps_sku.manageability);
	print_cap("Small business technology                 ", fwcaps.cap.caps_sku.small_business);
	print_cap("Level III manageability                   ", fwcaps.cap.caps_sku.l3manageability);
	print_cap("IntelR Anti-Theft (AT)                    ", fwcaps.cap.caps_sku.intel_at);
	print_cap("IntelR Capability Licensing Service (CLS) ", fwcaps.cap.caps_sku.intel_cls);
	print_cap("IntelR Power Sharing Technology (MPC)     ", fwcaps.cap.caps_sku.intel_mpc);
	print_cap("ICC Over Clocking                         ", fwcaps.cap.caps_sku.icc_over_clocking);
	print_cap("Protected Audio Video Path (PAVP)         ", fwcaps.cap.caps_sku.pavp);
	print_cap("IPV6                                      ", fwcaps.cap.caps_sku.ipv6);
	print_cap("KVM Remote Control (KVM)                  ", fwcaps.cap.caps_sku.kvm);
	print_cap("Outbreak Containment Heuristic (OCH)      ", fwcaps.cap.caps_sku.och);
	print_cap("Virtual LAN (VLAN)                        ", fwcaps.cap.caps_sku.vlan);
	print_cap("TLS                                       ", fwcaps.cap.caps_sku.tls);
	print_cap("Wireless LAN (WLAN)                       ", fwcaps.cap.caps_sku.wlan);

	return 0;
}

/* Tell ME to issue a global reset */
uint32_t mkhi_global_reset(void)
{
	struct me_global_reset reset = {
		.request_origin	= GLOBAL_RESET_BIOS_POST,
		.reset_type	= CBM_RR_GLOBAL_RESET,
	};
	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_CBM,
		.command	= MKHI_GLOBAL_RESET,
	};
	struct mei_header mei = {
		.is_complete	= 1,
		.length		= sizeof(mkhi) + sizeof(reset),
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_MKHI,
	};

	printf("ME: Requesting global reset\n");

	/* Send request and wait for response */
	if (mei_sendrecv(&mei, &mkhi, &reset, NULL, 0) < 0) {
		/* No response means reset will happen shortly... */
		asm("hlt");
	}

	/* If the ME responded it rejected the reset request */
	printf("ME: Global Reset failed\n");
	return -1;
}

/* Tell ME thermal reporting parameters */
/*
void mkhi_thermal(void)
{
	struct me_thermal_reporting thermal = {
		.polling_timeout = 2,
		.smbus_ec_msglen = 1,
		.smbus_ec_msgpec = 0,
		.dimmnumber = 4,
	};
	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_CBM,
		.command	= MKHI_THERMAL_REPORTING,
	};
	struct mei_header mei = {
		.is_complete	= 1,
		.length		= sizeof(mkhi) + sizeof(thermal),
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_THERMAL,
	};

	printf("ME: Sending thermal reporting params\n");

	mei_sendrecv(&mei, &mkhi, &thermal, NULL, 0);
}
*/

/* Enable debug of internal ME memory */
int mkhi_debug_me_memory(void *physaddr)
{
	uint32_t data = 0;

	/* copy whole ME memory to a readable space */
	struct me_debug_mem memory = {
		.debug_phys = (uintptr_t)physaddr,
		.debug_size = 0x2000000,
		.me_phys = 0x20000000,
		.me_size = 0x2000000,
	};
	struct mkhi_header mkhi = {
		.group_id	= MKHI_GROUP_ID_GEN,
		.command	= GEN_SET_DEBUG_MEM,
		.is_response	= 0,
	};
	struct mei_header mei = {
		.is_complete	= 1,
		.length		= sizeof(mkhi) + sizeof(memory),
		.host_address	= MEI_HOST_ADDRESS,
		.client_address	= MEI_ADDRESS_MKHI,
	};

	printf("ME: Debug memory to 0x%zx ...", (size_t)physaddr);
	if (mei_sendrecv(&mei, &mkhi, &memory, &data, 0) < 0) {
		printf("failed\n");
		return -1;
	} else {
		printf("done\n");
	}
	return 0;
}

/* Prepare ME for MEI messages */
uint32_t intel_mei_setup(struct pci_dev *dev)
{
	struct mei_csr host;
	uint16_t reg16;
	uint32_t pagerounded;

	mei_base_address = dev->base_addr[0] & ~0xf;
	pagerounded = mei_base_address & ~0xfff;
	mei_mmap = map_physical(pagerounded, 0x2000);
	mei_mmap += mei_base_address - pagerounded;
	if (mei_mmap == NULL) {
		printf("Could not map ME setup memory.\n"
		       "Do you have kernel cmdline argument 'iomem=relaxed' set ?\n");
		return 1;
	}

	/* Ensure Memory and Bus Master bits are set */
	reg16 = pci_read_word(dev, PCI_COMMAND);
	reg16 |= PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY;
	pci_write_word(dev, PCI_COMMAND, reg16);

	/* Clean up status for next message */
	read_host_csr(&host);
	host.interrupt_generate = 1;
	host.ready = 1;
	host.reset = 0;
	write_host_csr(&host);

	return 0;
}

/* Read the Extend register hash of ME firmware */
int intel_me_extend_valid(struct pci_dev *dev)
{
	struct me_heres status;
	uint32_t extend[8] = {0};
	int i, count = 0;

	pci_read_dword_ptr(dev, &status, PCI_ME_HERES);
	if (!status.extend_feature_present) {
		printf("ME: Extend Feature not present\n");
		return -1;
	}

	if (!status.extend_reg_valid) {
		printf("ME: Extend Register not valid\n");
		return -1;
	}

	switch (status.extend_reg_algorithm) {
	case PCI_ME_EXT_SHA1:
		count = 5;
		printf("ME: Extend SHA-1: ");
		break;
	case PCI_ME_EXT_SHA256:
		count = 8;
		printf("ME: Extend SHA-256: ");
		break;
	default:
		printf("ME: Extend Algorithm %d unknown\n",
		       status.extend_reg_algorithm);
		return -1;
	}

	for (i = 0; i < count; ++i) {
		extend[i] = pci_read_long(dev, PCI_ME_HER(i));
		printf("%08x", extend[i]);
	}
	printf("\n");

	return 0;
}