| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230210044826.9834-7-orlandoch.dev@gmail.com>
Date: Fri, 10 Feb 2023 15:48:23 +1100
From: Orlando Chamberlain <orlandoch.dev@...il.com>
To: platform-driver-x86@...r.kernel.org, amd-gfx@...ts.freedesktop.org,
linux-kernel@...r.kernel.org, alsa-devel@...a-project.org
Cc: Alex Deucher <alexander.deucher@....com>,
Christian König <christian.koenig@....com>,
"Pan, Xinhui" <Xinhui.Pan@....com>,
David Airlie <airlied@...il.com>,
Daniel Vetter <daniel@...ll.ch>,
Hans de Goede <hdegoede@...hat.com>,
Mark Gross <markgross@...nel.org>,
Jaroslav Kysela <perex@...ex.cz>,
Takashi Iwai <tiwai@...e.com>,
Hawking Zhang <Hawking.Zhang@....com>,
Andrey Grodzovsky <andrey.grodzovsky@....com>,
Lijo Lazar <lijo.lazar@....com>,
YiPeng Chai <YiPeng.Chai@....com>,
Somalapuram Amaranath <Amaranath.Somalapuram@....com>,
Mario Limonciello <mario.limonciello@....com>,
Bokun Zhang <Bokun.Zhang@....com>,
Jack Xiao <Jack.Xiao@....com>,
Kai Vehmanen <kai.vehmanen@...ux.intel.com>,
Pierre-Louis Bossart <pierre-louis.bossart@...ux.intel.com>,
Rander Wang <rander.wang@...el.com>,
Ranjani Sridharan <ranjani.sridharan@...ux.intel.com>,
Amadeusz Sławiński
<amadeuszx.slawinski@...ux.intel.com>,
Yong Zhi <yong.zhi@...el.com>, Evan Quan <evan.quan@....com>,
Kerem Karabay <kekrby@...il.com>,
Aditya Garg <gargaditya08@...e.com>,
Aun-Ali Zaidi <admin@...eit.net>,
Orlando Chamberlain <orlandoch.dev@...il.com>
Subject: [RFC PATCH 6/9] apple-gmux: support MMIO gmux on T2 Macs
In some newer dual gpu MacBooks, gmux is controlled by the T2 security
chip, and acessed with MMIO. Add support for these gmux controllers
Interestingly, the ACPI table only allocates 8 bytes for GMUX, but we
actually need 16, and as such we request 16 with request_mem_region.
Reading and writing from ports:
16 bytes from 0xfe0b0200 are used. 0x0 to 0x4 are where data
to read appears, and where data to write goes. Writing to 0xe
sets the gmux port being accessed, and writing to 0xf sends commands.
These commands are 0x40 & data_length for write, and data_length for
read, where data_length is 1, 2 or 4. Once byte base+0xf is 0, the
command is done.
Interrupts:
Clearing interrupts on T2 macs seems different to older models,
0 has to be written for them to stop, but this isn't what macOS
does and further investigation may be needed.
Issues:
As with other retina models, we can't switch DDC lines so
switching at runtime doesn't work if the inactive gpu driver
already disabled eDP due to it not being connected when that
driver loaded.
Additionally, turning on the dgpu back on T2 macs doesn't work,
and it fails in amdgpu's code for bringing the gpu back online.
Signed-off-by: Orlando Chamberlain <orlandoch.dev@...il.com>
---
drivers/platform/x86/apple-gmux.c | 134 ++++++++++++++++++++++++++++--
include/linux/apple-gmux.h | 34 +++++---
2 files changed, 149 insertions(+), 19 deletions(-)
diff --git a/drivers/platform/x86/apple-gmux.c b/drivers/platform/x86/apple-gmux.c
index c605f036ea0b..c38d6ef0c15a 100644
--- a/drivers/platform/x86/apple-gmux.c
+++ b/drivers/platform/x86/apple-gmux.c
@@ -28,15 +28,17 @@
* DOC: Overview
*
* gmux is a microcontroller built into the MacBook Pro to support dual GPUs:
- * A `Lattice XP2`_ on pre-retinas, a `Renesas R4F2113`_ on retinas.
+ * A `Lattice XP2`_ on pre-retinas, a `Renesas R4F2113`_ on pre-T2 retinas.
+ * The chip used on T2 Macs is not known.
*
* (The MacPro6,1 2013 also has a gmux, however it is unclear why since it has
* dual GPUs but no built-in display.)
*
* gmux is connected to the LPC bus of the southbridge. Its I/O ports are
* accessed differently depending on the microcontroller: Driver functions
- * to access a pre-retina gmux are infixed ``_pio_``, those for a retina gmux
- * are infixed ``_index_``.
+ * to access a pre-retina gmux are infixed ``_pio_``, those for a pre-T2
+ * retina gmux are infixed ``_index_``, and those on T2 Macs are infixed
+ * with ``_mmio_``.
*
* .. _Lattice XP2:
* http://www.latticesemi.com/en/Products/FPGAandCPLD/LatticeXP2.aspx
@@ -47,6 +49,7 @@
struct apple_gmux_config;
struct apple_gmux_data {
+ u8 *__iomem iomem_base;
unsigned long iostart;
unsigned long iolen;
const struct apple_gmux_config *config;
@@ -193,6 +196,79 @@ static void gmux_index_write32(struct apple_gmux_data *gmux_data, int port,
mutex_unlock(&gmux_data->index_lock);
}
+static int gmux_mmio_wait(struct apple_gmux_data *gmux_data)
+{
+ int i = 200;
+ u8 gwr = ioread8(gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+
+ while (i && gwr) {
+ gwr = ioread8(gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+ udelay(100);
+ i--;
+ }
+
+ return !!i;
+}
+
+static u8 gmux_mmio_read8(struct apple_gmux_data *gmux_data, int port)
+{
+ u8 val;
+
+ mutex_lock(&gmux_data->index_lock);
+ gmux_mmio_wait(gmux_data);
+ iowrite8((port & 0xff), gmux_data->iomem_base + GMUX_MMIO_PORT_SELECT);
+ iowrite8(GMUX_MMIO_READ | sizeof(val),
+ gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+ gmux_mmio_wait(gmux_data);
+ val = ioread8(gmux_data->iomem_base);
+ mutex_unlock(&gmux_data->index_lock);
+
+ return val;
+}
+
+static void gmux_mmio_write8(struct apple_gmux_data *gmux_data, int port,
+ u8 val)
+{
+ mutex_lock(&gmux_data->index_lock);
+ gmux_mmio_wait(gmux_data);
+ iowrite8(val, gmux_data->iomem_base);
+
+ iowrite8(port & 0xff, gmux_data->iomem_base + GMUX_MMIO_PORT_SELECT);
+ iowrite8(GMUX_MMIO_WRITE | sizeof(val),
+ gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+
+ gmux_mmio_wait(gmux_data);
+ mutex_unlock(&gmux_data->index_lock);
+}
+
+static u32 gmux_mmio_read32(struct apple_gmux_data *gmux_data, int port)
+{
+ u32 val;
+
+ mutex_lock(&gmux_data->index_lock);
+ gmux_mmio_wait(gmux_data);
+ iowrite8((port & 0xff), gmux_data->iomem_base + GMUX_MMIO_PORT_SELECT);
+ iowrite8(GMUX_MMIO_READ | sizeof(val),
+ gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+ gmux_mmio_wait(gmux_data);
+ val = be32_to_cpu(ioread32(gmux_data->iomem_base));
+ mutex_unlock(&gmux_data->index_lock);
+
+ return val;
+}
+
+static void gmux_mmio_write32(struct apple_gmux_data *gmux_data, int port,
+ u32 val)
+{
+ mutex_lock(&gmux_data->index_lock);
+ iowrite32(cpu_to_be32(val), gmux_data->iomem_base);
+ iowrite8(port & 0xff, gmux_data->iomem_base + GMUX_MMIO_PORT_SELECT);
+ iowrite8(GMUX_MMIO_WRITE | sizeof(val),
+ gmux_data->iomem_base + GMUX_MMIO_COMMAND_SEND);
+ gmux_mmio_wait(gmux_data);
+ mutex_unlock(&gmux_data->index_lock);
+}
+
static u8 gmux_read8(struct apple_gmux_data *gmux_data, int port)
{
return gmux_data->config->read8(gmux_data, port);
@@ -486,6 +562,18 @@ static const struct apple_gmux_config apple_gmux_index = {
.name = "indexed"
};
+static const struct apple_gmux_config apple_gmux_mmio = {
+ .read8 = &gmux_mmio_read8,
+ .write8 = &gmux_mmio_write8,
+ .read32 = &gmux_mmio_read32,
+ .write32 = &gmux_mmio_write32,
+ .gmux_handler = &gmux_handler_no_ddc,
+ .handler_flags = VGA_SWITCHEROO_NEEDS_EDP_CONFIG,
+ .resource_type = IORESOURCE_MEM,
+ .name = "T2"
+};
+
+
/**
* DOC: Interrupt
*
@@ -538,7 +626,7 @@ static void gmux_clear_interrupts(struct apple_gmux_data *gmux_data)
{
u8 status;
- /* to clear interrupts write back current status */
+ /* to clear interrupts write back current status. */
status = gmux_interrupt_get_status(gmux_data);
if (status) {
gmux_write8(gmux_data, GMUX_PORT_INTERRUPT_STATUS, status);
@@ -616,6 +704,25 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
pnp_set_drvdata(pnp, gmux_data);
switch (type) {
+ case APPLE_GMUX_TYPE_MMIO:
+ gmux_data->config = &apple_gmux_mmio;
+ mutex_init(&gmux_data->index_lock);
+
+ res = pnp_get_resource(pnp, IORESOURCE_MEM, 0);
+ gmux_data->iostart = res->start;
+ /* Although the ACPI table only allocates 8 bytes, we need 16. */
+ gmux_data->iolen = 16;
+ if (!request_mem_region(gmux_data->iostart, gmux_data->iolen,
+ "Apple gmux")) {
+ pr_err("gmux I/O already in use\n");
+ goto err_free;
+ }
+ gmux_data->iomem_base = ioremap(gmux_data->iostart, gmux_data->iolen);
+ if (!gmux_data->iomem_base) {
+ pr_err("couldn't remap gmux mmio region");
+ goto err_release;
+ }
+ goto get_version;
case APPLE_GMUX_TYPE_INDEXED:
gmux_data->config = &apple_gmux_index;
mutex_init(&gmux_data->index_lock);
@@ -635,6 +742,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
goto err_free;
}
+get_version:
version = gmux_read32(gmux_data, GMUX_PORT_VERSION_MAJOR);
ver_major = (version >> 24) & 0xff;
ver_minor = (version >> 16) & 0xff;
@@ -660,7 +768,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
gmux_data, &gmux_bl_ops, &props);
if (IS_ERR(bdev)) {
ret = PTR_ERR(bdev);
- goto err_release;
+ goto err_unmap;
}
gmux_data->bdev = bdev;
@@ -727,7 +835,7 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
/*
* Retina MacBook Pros cannot switch the panel's AUX separately
* and need eDP pre-calibration. They are distinguishable from
- * pre-retinas by having an "indexed" gmux.
+ * pre-retinas by having an "indexed" or "T2" gmux.
*
* Pre-retina MacBook Pros can switch the panel's DDC separately.
*/
@@ -752,8 +860,14 @@ static int gmux_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
&gmux_notify_handler);
err_notify:
backlight_device_unregister(bdev);
+err_unmap:
+ if (gmux_data->iomem_base)
+ iounmap(gmux_data->iomem_base);
err_release:
- release_region(gmux_data->iostart, gmux_data->iolen);
+ if (gmux_data->config->resource_type == IORESOURCE_MEM)
+ release_mem_region(gmux_data->iostart, gmux_data->iolen);
+ else
+ release_region(gmux_data->iostart, gmux_data->iolen);
err_free:
kfree(gmux_data);
return ret;
@@ -774,7 +888,11 @@ static void gmux_remove(struct pnp_dev *pnp)
backlight_device_unregister(gmux_data->bdev);
- release_region(gmux_data->iostart, gmux_data->iolen);
+ if (gmux_data->iomem_base) {
+ iounmap(gmux_data->iomem_base);
+ release_mem_region(gmux_data->iostart, gmux_data->iolen);
+ } else
+ release_region(gmux_data->iostart, gmux_data->iolen);
apple_gmux_data = NULL;
kfree(gmux_data);
diff --git a/include/linux/apple-gmux.h b/include/linux/apple-gmux.h
index 25c1de4a716e..55b18f0f320d 100644
--- a/include/linux/apple-gmux.h
+++ b/include/linux/apple-gmux.h
@@ -34,11 +34,18 @@
#define GMUX_PORT_READ 0xd0
#define GMUX_PORT_WRITE 0xd4
+#define GMUX_MMIO_PORT_SELECT 0x0e
+#define GMUX_MMIO_COMMAND_SEND 0x0f
+
+#define GMUX_MMIO_READ 0x00
+#define GMUX_MMIO_WRITE 0x40
+
#define GMUX_MIN_IO_LEN (GMUX_PORT_BRIGHTNESS + 4)
enum apple_gmux_type {
APPLE_GMUX_TYPE_PIO,
- APPLE_GMUX_TYPE_INDEXED
+ APPLE_GMUX_TYPE_INDEXED,
+ APPLE_GMUX_TYPE_MMIO
};
#if IS_ENABLED(CONFIG_APPLE_GMUX)
@@ -92,16 +99,21 @@ static inline bool apple_gmux_detect(struct pnp_dev *pnp_dev, enum apple_gmux_ty
}
res = pnp_get_resource(pnp_dev, IORESOURCE_IO, 0);
- if (!res || resource_size(res) < GMUX_MIN_IO_LEN)
- goto out;
-
- /*
- * Invalid version information may indicate either that the gmux
- * device isn't present or that it's a new one that uses indexed io.
- */
- if (!(~inl(res->start + GMUX_PORT_VERSION_MAJOR))) {
- if (apple_gmux_is_indexed(res->start))
- type = APPLE_GMUX_TYPE_INDEXED;
+ if (res && resource_size(res) >= GMUX_MIN_IO_LEN) {
+ /*
+ * Invalid version information may indicate either that the gmux
+ * device isn't present or that it's a new one that uses indexed io.
+ */
+ if (!(~inl(res->start + GMUX_PORT_VERSION_MAJOR))) {
+ if (apple_gmux_is_indexed(res->start))
+ type = APPLE_GMUX_TYPE_INDEXED;
+ else
+ goto out;
+ }
+ } else {
+ res = pnp_get_resource(pnp_dev, IORESOURCE_MEM, 0);
+ if (res)
+ type = APPLE_GMUX_TYPE_MMIO;
else
goto out;
}
--
2.39.1
Powered by blists - more mailing lists