tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Firmware loading.
4 *
5 * Copyright (c) 2017-2019, Silicon Laboratories, Inc.
6 * Copyright (c) 2010, ST-Ericsson
7 */
8#include <linux/firmware.h>
9#include <linux/slab.h>
10#include <linux/mm.h>
11#include <linux/bitfield.h>
12
13#include "fwio.h"
14#include "wfx.h"
15#include "hwio.h"
16
17// Addresses below are in SRAM area
18#define WFX_DNLD_FIFO 0x09004000
19#define DNLD_BLOCK_SIZE 0x0400
20#define DNLD_FIFO_SIZE 0x8000 // (32 * DNLD_BLOCK_SIZE)
21// Download Control Area (DCA)
22#define WFX_DCA_IMAGE_SIZE 0x0900C000
23#define WFX_DCA_PUT 0x0900C004
24#define WFX_DCA_GET 0x0900C008
25#define WFX_DCA_HOST_STATUS 0x0900C00C
26#define HOST_READY 0x87654321
27#define HOST_INFO_READ 0xA753BD99
28#define HOST_UPLOAD_PENDING 0xABCDDCBA
29#define HOST_UPLOAD_COMPLETE 0xD4C64A99
30#define HOST_OK_TO_JUMP 0x174FC882
31#define WFX_DCA_NCP_STATUS 0x0900C010
32#define NCP_NOT_READY 0x12345678
33#define NCP_READY 0x87654321
34#define NCP_INFO_READY 0xBD53EF99
35#define NCP_DOWNLOAD_PENDING 0xABCDDCBA
36#define NCP_DOWNLOAD_COMPLETE 0xCAFEFECA
37#define NCP_AUTH_OK 0xD4C64A99
38#define NCP_AUTH_FAIL 0x174FC882
39#define NCP_PUB_KEY_RDY 0x7AB41D19
40#define WFX_DCA_FW_SIGNATURE 0x0900C014
41#define FW_SIGNATURE_SIZE 0x40
42#define WFX_DCA_FW_HASH 0x0900C054
43#define FW_HASH_SIZE 0x08
44#define WFX_DCA_FW_VERSION 0x0900C05C
45#define FW_VERSION_SIZE 0x04
46#define WFX_DCA_RESERVED 0x0900C060
47#define DCA_RESERVED_SIZE 0x20
48#define WFX_STATUS_INFO 0x0900C080
49#define WFX_BOOTLOADER_LABEL 0x0900C084
50#define BOOTLOADER_LABEL_SIZE 0x3C
51#define WFX_PTE_INFO 0x0900C0C0
52#define PTE_INFO_KEYSET_IDX 0x0D
53#define PTE_INFO_SIZE 0x10
54#define WFX_ERR_INFO 0x0900C0D0
55#define ERR_INVALID_SEC_TYPE 0x05
56#define ERR_SIG_VERIF_FAILED 0x0F
57#define ERR_AES_CTRL_KEY 0x10
58#define ERR_ECC_PUB_KEY 0x11
59#define ERR_MAC_KEY 0x18
60
61#define DCA_TIMEOUT 50 // milliseconds
62#define WAKEUP_TIMEOUT 200 // milliseconds
63
64static const char * const fwio_error_strings[] = {
65 [ERR_INVALID_SEC_TYPE] = "Invalid section type or wrong encryption",
66 [ERR_SIG_VERIF_FAILED] = "Signature verification failed",
67 [ERR_AES_CTRL_KEY] = "AES control key not initialized",
68 [ERR_ECC_PUB_KEY] = "ECC public key not initialized",
69 [ERR_MAC_KEY] = "MAC key not initialized",
70};
71
72/*
73 * request_firmware() allocate data using vmalloc(). It is not compatible with
74 * underlying hardware that use DMA. Function below detect this case and
75 * allocate a bounce buffer if necessary.
76 *
77 * Notice that, in doubt, you can enable CONFIG_DEBUG_SG to ask kernel to
78 * detect this problem at runtime (else, kernel silently fail).
79 *
80 * NOTE: it may also be possible to use 'pages' from struct firmware and avoid
81 * bounce buffer
82 */
83static int sram_write_dma_safe(struct wfx_dev *wdev, u32 addr, const u8 *buf,
84 size_t len)
85{
86 int ret;
87 const u8 *tmp;
88
89 if (!virt_addr_valid(buf)) {
90 tmp = kmemdup(buf, len, GFP_KERNEL);
91 if (!tmp)
92 return -ENOMEM;
93 } else {
94 tmp = buf;
95 }
96 ret = sram_buf_write(wdev, addr, tmp, len);
97 if (!virt_addr_valid(buf))
98 kfree(tmp);
99 return ret;
100}
101
102int get_firmware(struct wfx_dev *wdev, u32 keyset_chip,
103 const struct firmware **fw, int *file_offset)
104{
105 int keyset_file;
106 char filename[256];
107 const char *data;
108 int ret;
109
110 snprintf(filename, sizeof(filename), "%s_%02X.sec", wdev->pdata.file_fw,
111 keyset_chip);
112 ret = firmware_request_nowarn(fw, filename, wdev->dev);
113 if (ret) {
114 dev_info(wdev->dev, "can't load %s, falling back to %s.sec\n",
115 filename, wdev->pdata.file_fw);
116 snprintf(filename, sizeof(filename), "%s.sec",
117 wdev->pdata.file_fw);
118 ret = request_firmware(fw, filename, wdev->dev);
119 if (ret) {
120 dev_err(wdev->dev, "can't load %s\n", filename);
121 *fw = NULL;
122 return ret;
123 }
124 }
125
126 data = (*fw)->data;
127 if (memcmp(data, "KEYSET", 6) != 0) {
128 // Legacy firmware format
129 *file_offset = 0;
130 keyset_file = 0x90;
131 } else {
132 *file_offset = 8;
133 keyset_file = (hex_to_bin(data[6]) * 16) | hex_to_bin(data[7]);
134 if (keyset_file < 0) {
135 dev_err(wdev->dev, "%s corrupted\n", filename);
136 release_firmware(*fw);
137 *fw = NULL;
138 return -EINVAL;
139 }
140 }
141 if (keyset_file != keyset_chip) {
142 dev_err(wdev->dev, "firmware keyset is incompatible with chip (file: 0x%02X, chip: 0x%02X)\n",
143 keyset_file, keyset_chip);
144 release_firmware(*fw);
145 *fw = NULL;
146 return -ENODEV;
147 }
148 wdev->keyset = keyset_file;
149 return 0;
150}
151
152static int wait_ncp_status(struct wfx_dev *wdev, u32 status)
153{
154 ktime_t now, start;
155 u32 reg;
156 int ret;
157
158 start = ktime_get();
159 for (;;) {
160 ret = sram_reg_read(wdev, WFX_DCA_NCP_STATUS, ®);
161 if (ret < 0)
162 return -EIO;
163 now = ktime_get();
164 if (reg == status)
165 break;
166 if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
167 return -ETIMEDOUT;
168 }
169 if (ktime_compare(now, start))
170 dev_dbg(wdev->dev, "chip answer after %lldus\n",
171 ktime_us_delta(now, start));
172 else
173 dev_dbg(wdev->dev, "chip answer immediately\n");
174 return 0;
175}
176
177static int upload_firmware(struct wfx_dev *wdev, const u8 *data, size_t len)
178{
179 int ret;
180 u32 offs, bytes_done;
181 ktime_t now, start;
182
183 if (len % DNLD_BLOCK_SIZE) {
184 dev_err(wdev->dev, "firmware size is not aligned. Buffer overrun will occur\n");
185 return -EIO;
186 }
187 offs = 0;
188 while (offs < len) {
189 start = ktime_get();
190 for (;;) {
191 ret = sram_reg_read(wdev, WFX_DCA_GET, &bytes_done);
192 if (ret < 0)
193 return ret;
194 now = ktime_get();
195 if (offs +
196 DNLD_BLOCK_SIZE - bytes_done < DNLD_FIFO_SIZE)
197 break;
198 if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
199 return -ETIMEDOUT;
200 }
201 if (ktime_compare(now, start))
202 dev_dbg(wdev->dev, "answer after %lldus\n",
203 ktime_us_delta(now, start));
204
205 ret = sram_write_dma_safe(wdev, WFX_DNLD_FIFO +
206 (offs % DNLD_FIFO_SIZE),
207 data + offs, DNLD_BLOCK_SIZE);
208 if (ret < 0)
209 return ret;
210
211 // WFx seems to not support writing 0 in this register during
212 // first loop
213 offs += DNLD_BLOCK_SIZE;
214 ret = sram_reg_write(wdev, WFX_DCA_PUT, offs);
215 if (ret < 0)
216 return ret;
217 }
218 return 0;
219}
220
221static void print_boot_status(struct wfx_dev *wdev)
222{
223 u32 val32;
224
225 sram_reg_read(wdev, WFX_STATUS_INFO, &val32);
226 if (val32 == 0x12345678) {
227 dev_info(wdev->dev, "no error reported by secure boot\n");
228 } else {
229 sram_reg_read(wdev, WFX_ERR_INFO, &val32);
230 if (val32 < ARRAY_SIZE(fwio_error_strings) &&
231 fwio_error_strings[val32])
232 dev_info(wdev->dev, "secure boot error: %s\n",
233 fwio_error_strings[val32]);
234 else
235 dev_info(wdev->dev,
236 "secure boot error: Unknown (0x%02x)\n",
237 val32);
238 }
239}
240
241static int load_firmware_secure(struct wfx_dev *wdev)
242{
243 const struct firmware *fw = NULL;
244 int header_size;
245 int fw_offset;
246 ktime_t start;
247 u8 *buf;
248 int ret;
249
250 BUILD_BUG_ON(PTE_INFO_SIZE > BOOTLOADER_LABEL_SIZE);
251 buf = kmalloc(BOOTLOADER_LABEL_SIZE + 1, GFP_KERNEL);
252 if (!buf)
253 return -ENOMEM;
254
255 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_READY);
256 ret = wait_ncp_status(wdev, NCP_INFO_READY);
257 if (ret)
258 goto error;
259
260 sram_buf_read(wdev, WFX_BOOTLOADER_LABEL, buf, BOOTLOADER_LABEL_SIZE);
261 buf[BOOTLOADER_LABEL_SIZE] = 0;
262 dev_dbg(wdev->dev, "bootloader: \"%s\"\n", buf);
263
264 sram_buf_read(wdev, WFX_PTE_INFO, buf, PTE_INFO_SIZE);
265 ret = get_firmware(wdev, buf[PTE_INFO_KEYSET_IDX], &fw, &fw_offset);
266 if (ret)
267 goto error;
268 header_size = fw_offset + FW_SIGNATURE_SIZE + FW_HASH_SIZE;
269
270 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_INFO_READ);
271 ret = wait_ncp_status(wdev, NCP_READY);
272 if (ret)
273 goto error;
274
275 sram_reg_write(wdev, WFX_DNLD_FIFO, 0xFFFFFFFF); // Fifo init
276 sram_write_dma_safe(wdev, WFX_DCA_FW_VERSION, "\x01\x00\x00\x00",
277 FW_VERSION_SIZE);
278 sram_write_dma_safe(wdev, WFX_DCA_FW_SIGNATURE, fw->data + fw_offset,
279 FW_SIGNATURE_SIZE);
280 sram_write_dma_safe(wdev, WFX_DCA_FW_HASH,
281 fw->data + fw_offset + FW_SIGNATURE_SIZE,
282 FW_HASH_SIZE);
283 sram_reg_write(wdev, WFX_DCA_IMAGE_SIZE, fw->size - header_size);
284 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_PENDING);
285 ret = wait_ncp_status(wdev, NCP_DOWNLOAD_PENDING);
286 if (ret)
287 goto error;
288
289 start = ktime_get();
290 ret = upload_firmware(wdev, fw->data + header_size,
291 fw->size - header_size);
292 if (ret)
293 goto error;
294 dev_dbg(wdev->dev, "firmware load after %lldus\n",
295 ktime_us_delta(ktime_get(), start));
296
297 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_COMPLETE);
298 ret = wait_ncp_status(wdev, NCP_AUTH_OK);
299 // Legacy ROM support
300 if (ret < 0)
301 ret = wait_ncp_status(wdev, NCP_PUB_KEY_RDY);
302 if (ret < 0)
303 goto error;
304 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_OK_TO_JUMP);
305
306error:
307 kfree(buf);
308 if (fw)
309 release_firmware(fw);
310 if (ret)
311 print_boot_status(wdev);
312 return ret;
313}
314
315static int init_gpr(struct wfx_dev *wdev)
316{
317 int ret, i;
318 static const struct {
319 int index;
320 u32 value;
321 } gpr_init[] = {
322 { 0x07, 0x208775 },
323 { 0x08, 0x2EC020 },
324 { 0x09, 0x3C3C3C },
325 { 0x0B, 0x322C44 },
326 { 0x0C, 0xA06497 },
327 };
328
329 for (i = 0; i < ARRAY_SIZE(gpr_init); i++) {
330 ret = igpr_reg_write(wdev, gpr_init[i].index,
331 gpr_init[i].value);
332 if (ret < 0)
333 return ret;
334 dev_dbg(wdev->dev, " index %02x: %08x\n", gpr_init[i].index,
335 gpr_init[i].value);
336 }
337 return 0;
338}
339
340int wfx_init_device(struct wfx_dev *wdev)
341{
342 int ret;
343 int hw_revision, hw_type;
344 int wakeup_timeout = 50; // ms
345 ktime_t now, start;
346 u32 reg;
347
348 reg = CFG_DIRECT_ACCESS_MODE | CFG_CPU_RESET | CFG_WORD_MODE2;
349 if (wdev->pdata.use_rising_clk)
350 reg |= CFG_CLK_RISE_EDGE;
351 ret = config_reg_write(wdev, reg);
352 if (ret < 0) {
353 dev_err(wdev->dev, "bus returned an error during first write access. Host configuration error?\n");
354 return -EIO;
355 }
356
357 ret = config_reg_read(wdev, ®);
358 if (ret < 0) {
359 dev_err(wdev->dev, "bus returned an error during first read access. Bus configuration error?\n");
360 return -EIO;
361 }
362 if (reg == 0 || reg == ~0) {
363 dev_err(wdev->dev, "chip mute. Bus configuration error or chip wasn't reset?\n");
364 return -EIO;
365 }
366 dev_dbg(wdev->dev, "initial config register value: %08x\n", reg);
367
368 hw_revision = FIELD_GET(CFG_DEVICE_ID_MAJOR, reg);
369 if (hw_revision == 0 || hw_revision > 2) {
370 dev_err(wdev->dev, "bad hardware revision number: %d\n",
371 hw_revision);
372 return -ENODEV;
373 }
374 hw_type = FIELD_GET(CFG_DEVICE_ID_TYPE, reg);
375 if (hw_type == 1) {
376 dev_notice(wdev->dev, "development hardware detected\n");
377 wakeup_timeout = 2000;
378 }
379
380 ret = init_gpr(wdev);
381 if (ret < 0)
382 return ret;
383
384 ret = control_reg_write(wdev, CTRL_WLAN_WAKEUP);
385 if (ret < 0)
386 return -EIO;
387 start = ktime_get();
388 for (;;) {
389 ret = control_reg_read(wdev, ®);
390 now = ktime_get();
391 if (reg & CTRL_WLAN_READY)
392 break;
393 if (ktime_after(now, ktime_add_ms(start, wakeup_timeout))) {
394 dev_err(wdev->dev, "chip didn't wake up. Chip wasn't reset?\n");
395 return -ETIMEDOUT;
396 }
397 }
398 dev_dbg(wdev->dev, "chip wake up after %lldus\n",
399 ktime_us_delta(now, start));
400
401 ret = config_reg_write_bits(wdev, CFG_CPU_RESET, 0);
402 if (ret < 0)
403 return ret;
404 ret = load_firmware_secure(wdev);
405 if (ret < 0)
406 return ret;
407 ret = config_reg_write_bits(wdev,
408 CFG_DIRECT_ACCESS_MODE |
409 CFG_IRQ_ENABLE_DATA |
410 CFG_IRQ_ENABLE_WRDY,
411 CFG_IRQ_ENABLE_DATA);
412 return ret;
413}