tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Firmware loading.
4 *
5 * Copyright (c) 2017-2019, Silicon Laboratories, Inc.
6 * Copyright (c) 2010, ST-Ericsson
7 */
8#include <linux/firmware.h>
9#include <linux/slab.h>
10#include <linux/mm.h>
11#include <linux/bitfield.h>
12
13#include "fwio.h"
14#include "wfx.h"
15#include "hwio.h"
16
17// Addresses below are in SRAM area
18#define WFX_DNLD_FIFO 0x09004000
19#define DNLD_BLOCK_SIZE 0x0400
20#define DNLD_FIFO_SIZE 0x8000 // (32 * DNLD_BLOCK_SIZE)
21// Download Control Area (DCA)
22#define WFX_DCA_IMAGE_SIZE 0x0900C000
23#define WFX_DCA_PUT 0x0900C004
24#define WFX_DCA_GET 0x0900C008
25#define WFX_DCA_HOST_STATUS 0x0900C00C
26#define HOST_READY 0x87654321
27#define HOST_INFO_READ 0xA753BD99
28#define HOST_UPLOAD_PENDING 0xABCDDCBA
29#define HOST_UPLOAD_COMPLETE 0xD4C64A99
30#define HOST_OK_TO_JUMP 0x174FC882
31#define WFX_DCA_NCP_STATUS 0x0900C010
32#define NCP_NOT_READY 0x12345678
33#define NCP_READY 0x87654321
34#define NCP_INFO_READY 0xBD53EF99
35#define NCP_DOWNLOAD_PENDING 0xABCDDCBA
36#define NCP_DOWNLOAD_COMPLETE 0xCAFEFECA
37#define NCP_AUTH_OK 0xD4C64A99
38#define NCP_AUTH_FAIL 0x174FC882
39#define NCP_PUB_KEY_RDY 0x7AB41D19
40#define WFX_DCA_FW_SIGNATURE 0x0900C014
41#define FW_SIGNATURE_SIZE 0x40
42#define WFX_DCA_FW_HASH 0x0900C054
43#define FW_HASH_SIZE 0x08
44#define WFX_DCA_FW_VERSION 0x0900C05C
45#define FW_VERSION_SIZE 0x04
46#define WFX_DCA_RESERVED 0x0900C060
47#define DCA_RESERVED_SIZE 0x20
48#define WFX_STATUS_INFO 0x0900C080
49#define WFX_BOOTLOADER_LABEL 0x0900C084
50#define BOOTLOADER_LABEL_SIZE 0x3C
51#define WFX_PTE_INFO 0x0900C0C0
52#define PTE_INFO_KEYSET_IDX 0x0D
53#define PTE_INFO_SIZE 0x10
54#define WFX_ERR_INFO 0x0900C0D0
55#define ERR_INVALID_SEC_TYPE 0x05
56#define ERR_SIG_VERIF_FAILED 0x0F
57#define ERR_AES_CTRL_KEY 0x10
58#define ERR_ECC_PUB_KEY 0x11
59#define ERR_MAC_KEY 0x18
60
61#define DCA_TIMEOUT 50 // milliseconds
62#define WAKEUP_TIMEOUT 200 // milliseconds
63
64static const char * const fwio_errors[] = {
65 [ERR_INVALID_SEC_TYPE] = "Invalid section type or wrong encryption",
66 [ERR_SIG_VERIF_FAILED] = "Signature verification failed",
67 [ERR_AES_CTRL_KEY] = "AES control key not initialized",
68 [ERR_ECC_PUB_KEY] = "ECC public key not initialized",
69 [ERR_MAC_KEY] = "MAC key not initialized",
70};
71
72/*
73 * request_firmware() allocate data using vmalloc(). It is not compatible with
74 * underlying hardware that use DMA. Function below detect this case and
75 * allocate a bounce buffer if necessary.
76 *
77 * Notice that, in doubt, you can enable CONFIG_DEBUG_SG to ask kernel to
78 * detect this problem at runtime (else, kernel silently fail).
79 *
80 * NOTE: it may also be possible to use 'pages' from struct firmware and avoid
81 * bounce buffer
82 */
83static int sram_write_dma_safe(struct wfx_dev *wdev, u32 addr, const u8 *buf,
84 size_t len)
85{
86 int ret;
87 const u8 *tmp;
88
89 if (!virt_addr_valid(buf)) {
90 tmp = kmemdup(buf, len, GFP_KERNEL);
91 if (!tmp)
92 return -ENOMEM;
93 } else {
94 tmp = buf;
95 }
96 ret = sram_buf_write(wdev, addr, tmp, len);
97 if (!virt_addr_valid(buf))
98 kfree(tmp);
99 return ret;
100}
101
102int get_firmware(struct wfx_dev *wdev, u32 keyset_chip,
103 const struct firmware **fw, int *file_offset)
104{
105 int keyset_file;
106 char filename[256];
107 const char *data;
108 int ret;
109
110 snprintf(filename, sizeof(filename), "%s_%02X.sec", wdev->pdata.file_fw,
111 keyset_chip);
112 ret = firmware_request_nowarn(fw, filename, wdev->dev);
113 if (ret) {
114 dev_info(wdev->dev, "can't load %s, falling back to %s.sec\n",
115 filename, wdev->pdata.file_fw);
116 snprintf(filename, sizeof(filename), "%s.sec",
117 wdev->pdata.file_fw);
118 ret = request_firmware(fw, filename, wdev->dev);
119 if (ret) {
120 dev_err(wdev->dev, "can't load %s\n", filename);
121 *fw = NULL;
122 return ret;
123 }
124 }
125
126 data = (*fw)->data;
127 if (memcmp(data, "KEYSET", 6) != 0) {
128 // Legacy firmware format
129 *file_offset = 0;
130 keyset_file = 0x90;
131 } else {
132 *file_offset = 8;
133 keyset_file = (hex_to_bin(data[6]) * 16) | hex_to_bin(data[7]);
134 if (keyset_file < 0) {
135 dev_err(wdev->dev, "%s corrupted\n", filename);
136 release_firmware(*fw);
137 *fw = NULL;
138 return -EINVAL;
139 }
140 }
141 if (keyset_file != keyset_chip) {
142 dev_err(wdev->dev, "firmware keyset is incompatible with chip (file: 0x%02X, chip: 0x%02X)\n",
143 keyset_file, keyset_chip);
144 release_firmware(*fw);
145 *fw = NULL;
146 return -ENODEV;
147 }
148 wdev->keyset = keyset_file;
149 return 0;
150}
151
152static int wait_ncp_status(struct wfx_dev *wdev, u32 status)
153{
154 ktime_t now, start;
155 u32 reg;
156 int ret;
157
158 start = ktime_get();
159 for (;;) {
160 ret = sram_reg_read(wdev, WFX_DCA_NCP_STATUS, ®);
161 if (ret < 0)
162 return -EIO;
163 now = ktime_get();
164 if (reg == status)
165 break;
166 if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
167 return -ETIMEDOUT;
168 }
169 if (ktime_compare(now, start))
170 dev_dbg(wdev->dev, "chip answer after %lldus\n",
171 ktime_us_delta(now, start));
172 else
173 dev_dbg(wdev->dev, "chip answer immediately\n");
174 return 0;
175}
176
177static int upload_firmware(struct wfx_dev *wdev, const u8 *data, size_t len)
178{
179 int ret;
180 u32 offs, bytes_done;
181 ktime_t now, start;
182
183 if (len % DNLD_BLOCK_SIZE) {
184 dev_err(wdev->dev, "firmware size is not aligned. Buffer overrun will occur\n");
185 return -EIO;
186 }
187 offs = 0;
188 while (offs < len) {
189 start = ktime_get();
190 for (;;) {
191 ret = sram_reg_read(wdev, WFX_DCA_GET, &bytes_done);
192 if (ret < 0)
193 return ret;
194 now = ktime_get();
195 if (offs +
196 DNLD_BLOCK_SIZE - bytes_done < DNLD_FIFO_SIZE)
197 break;
198 if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
199 return -ETIMEDOUT;
200 }
201 if (ktime_compare(now, start))
202 dev_dbg(wdev->dev, "answer after %lldus\n",
203 ktime_us_delta(now, start));
204
205 ret = sram_write_dma_safe(wdev, WFX_DNLD_FIFO +
206 (offs % DNLD_FIFO_SIZE),
207 data + offs, DNLD_BLOCK_SIZE);
208 if (ret < 0)
209 return ret;
210
211 // WFx seems to not support writing 0 in this register during
212 // first loop
213 offs += DNLD_BLOCK_SIZE;
214 ret = sram_reg_write(wdev, WFX_DCA_PUT, offs);
215 if (ret < 0)
216 return ret;
217 }
218 return 0;
219}
220
221static void print_boot_status(struct wfx_dev *wdev)
222{
223 u32 reg;
224
225 sram_reg_read(wdev, WFX_STATUS_INFO, ®);
226 if (reg == 0x12345678)
227 return;
228 sram_reg_read(wdev, WFX_ERR_INFO, ®);
229 if (reg < ARRAY_SIZE(fwio_errors) && fwio_errors[reg])
230 dev_info(wdev->dev, "secure boot: %s\n", fwio_errors[reg]);
231 else
232 dev_info(wdev->dev, "secure boot: Error %#02x\n", reg);
233}
234
235static int load_firmware_secure(struct wfx_dev *wdev)
236{
237 const struct firmware *fw = NULL;
238 int header_size;
239 int fw_offset;
240 ktime_t start;
241 u8 *buf;
242 int ret;
243
244 BUILD_BUG_ON(PTE_INFO_SIZE > BOOTLOADER_LABEL_SIZE);
245 buf = kmalloc(BOOTLOADER_LABEL_SIZE + 1, GFP_KERNEL);
246 if (!buf)
247 return -ENOMEM;
248
249 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_READY);
250 ret = wait_ncp_status(wdev, NCP_INFO_READY);
251 if (ret)
252 goto error;
253
254 sram_buf_read(wdev, WFX_BOOTLOADER_LABEL, buf, BOOTLOADER_LABEL_SIZE);
255 buf[BOOTLOADER_LABEL_SIZE] = 0;
256 dev_dbg(wdev->dev, "bootloader: \"%s\"\n", buf);
257
258 sram_buf_read(wdev, WFX_PTE_INFO, buf, PTE_INFO_SIZE);
259 ret = get_firmware(wdev, buf[PTE_INFO_KEYSET_IDX], &fw, &fw_offset);
260 if (ret)
261 goto error;
262 header_size = fw_offset + FW_SIGNATURE_SIZE + FW_HASH_SIZE;
263
264 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_INFO_READ);
265 ret = wait_ncp_status(wdev, NCP_READY);
266 if (ret)
267 goto error;
268
269 sram_reg_write(wdev, WFX_DNLD_FIFO, 0xFFFFFFFF); // Fifo init
270 sram_write_dma_safe(wdev, WFX_DCA_FW_VERSION, "\x01\x00\x00\x00",
271 FW_VERSION_SIZE);
272 sram_write_dma_safe(wdev, WFX_DCA_FW_SIGNATURE, fw->data + fw_offset,
273 FW_SIGNATURE_SIZE);
274 sram_write_dma_safe(wdev, WFX_DCA_FW_HASH,
275 fw->data + fw_offset + FW_SIGNATURE_SIZE,
276 FW_HASH_SIZE);
277 sram_reg_write(wdev, WFX_DCA_IMAGE_SIZE, fw->size - header_size);
278 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_PENDING);
279 ret = wait_ncp_status(wdev, NCP_DOWNLOAD_PENDING);
280 if (ret)
281 goto error;
282
283 start = ktime_get();
284 ret = upload_firmware(wdev, fw->data + header_size,
285 fw->size - header_size);
286 if (ret)
287 goto error;
288 dev_dbg(wdev->dev, "firmware load after %lldus\n",
289 ktime_us_delta(ktime_get(), start));
290
291 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_COMPLETE);
292 ret = wait_ncp_status(wdev, NCP_AUTH_OK);
293 // Legacy ROM support
294 if (ret < 0)
295 ret = wait_ncp_status(wdev, NCP_PUB_KEY_RDY);
296 if (ret < 0)
297 goto error;
298 sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_OK_TO_JUMP);
299
300error:
301 kfree(buf);
302 if (fw)
303 release_firmware(fw);
304 if (ret)
305 print_boot_status(wdev);
306 return ret;
307}
308
309static int init_gpr(struct wfx_dev *wdev)
310{
311 int ret, i;
312 static const struct {
313 int index;
314 u32 value;
315 } gpr_init[] = {
316 { 0x07, 0x208775 },
317 { 0x08, 0x2EC020 },
318 { 0x09, 0x3C3C3C },
319 { 0x0B, 0x322C44 },
320 { 0x0C, 0xA06497 },
321 };
322
323 for (i = 0; i < ARRAY_SIZE(gpr_init); i++) {
324 ret = igpr_reg_write(wdev, gpr_init[i].index,
325 gpr_init[i].value);
326 if (ret < 0)
327 return ret;
328 dev_dbg(wdev->dev, " index %02x: %08x\n", gpr_init[i].index,
329 gpr_init[i].value);
330 }
331 return 0;
332}
333
334int wfx_init_device(struct wfx_dev *wdev)
335{
336 int ret;
337 int hw_revision, hw_type;
338 int wakeup_timeout = 50; // ms
339 ktime_t now, start;
340 u32 reg;
341
342 reg = CFG_DIRECT_ACCESS_MODE | CFG_CPU_RESET | CFG_BYTE_ORDER_ABCD;
343 if (wdev->pdata.use_rising_clk)
344 reg |= CFG_CLK_RISE_EDGE;
345 ret = config_reg_write(wdev, reg);
346 if (ret < 0) {
347 dev_err(wdev->dev, "bus returned an error during first write access. Host configuration error?\n");
348 return -EIO;
349 }
350
351 ret = config_reg_read(wdev, ®);
352 if (ret < 0) {
353 dev_err(wdev->dev, "bus returned an error during first read access. Bus configuration error?\n");
354 return -EIO;
355 }
356 if (reg == 0 || reg == ~0) {
357 dev_err(wdev->dev, "chip mute. Bus configuration error or chip wasn't reset?\n");
358 return -EIO;
359 }
360 dev_dbg(wdev->dev, "initial config register value: %08x\n", reg);
361
362 hw_revision = FIELD_GET(CFG_DEVICE_ID_MAJOR, reg);
363 if (hw_revision == 0 || hw_revision > 2) {
364 dev_err(wdev->dev, "bad hardware revision number: %d\n",
365 hw_revision);
366 return -ENODEV;
367 }
368 hw_type = FIELD_GET(CFG_DEVICE_ID_TYPE, reg);
369 if (hw_type == 1) {
370 dev_notice(wdev->dev, "development hardware detected\n");
371 wakeup_timeout = 2000;
372 }
373
374 ret = init_gpr(wdev);
375 if (ret < 0)
376 return ret;
377
378 ret = control_reg_write(wdev, CTRL_WLAN_WAKEUP);
379 if (ret < 0)
380 return -EIO;
381 start = ktime_get();
382 for (;;) {
383 ret = control_reg_read(wdev, ®);
384 now = ktime_get();
385 if (reg & CTRL_WLAN_READY)
386 break;
387 if (ktime_after(now, ktime_add_ms(start, wakeup_timeout))) {
388 dev_err(wdev->dev, "chip didn't wake up. Chip wasn't reset?\n");
389 return -ETIMEDOUT;
390 }
391 }
392 dev_dbg(wdev->dev, "chip wake up after %lldus\n",
393 ktime_us_delta(now, start));
394
395 ret = config_reg_write_bits(wdev, CFG_CPU_RESET, 0);
396 if (ret < 0)
397 return ret;
398 ret = load_firmware_secure(wdev);
399 if (ret < 0)
400 return ret;
401 ret = config_reg_write_bits(wdev,
402 CFG_DIRECT_ACCESS_MODE |
403 CFG_IRQ_ENABLE_DATA |
404 CFG_IRQ_ENABLE_WRDY,
405 CFG_IRQ_ENABLE_DATA);
406 return ret;
407}