drivers/staging/wfx/fwio.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Firmware loading.
   4  *
   5  * Copyright (c) 2017-2019, Silicon Laboratories, Inc.
   6  * Copyright (c) 2010, ST-Ericsson
   7  */
   8 #include <linux/firmware.h>
   9 #include <linux/slab.h>
  10 #include <linux/mm.h>
  11 #include <linux/bitfield.h>
  12
  13 #include "fwio.h"
  14 #include "wfx.h"
  15 #include "hwio.h"
  16
  17 // Addresses below are in SRAM area
  18 #define WFX_DNLD_FIFO             0x09004000
  19 #define     DNLD_BLOCK_SIZE           0x0400
  20 #define     DNLD_FIFO_SIZE            0x8000 // (32 * DNLD_BLOCK_SIZE)
  21 // Download Control Area (DCA)
  22 #define WFX_DCA_IMAGE_SIZE        0x0900C000
  23 #define WFX_DCA_PUT               0x0900C004
  24 #define WFX_DCA_GET               0x0900C008
  25 #define WFX_DCA_HOST_STATUS       0x0900C00C
  26 #define     HOST_READY                0x87654321
  27 #define     HOST_INFO_READ            0xA753BD99
  28 #define     HOST_UPLOAD_PENDING       0xABCDDCBA
  29 #define     HOST_UPLOAD_COMPLETE      0xD4C64A99
  30 #define     HOST_OK_TO_JUMP           0x174FC882
  31 #define WFX_DCA_NCP_STATUS        0x0900C010
  32 #define     NCP_NOT_READY             0x12345678
  33 #define     NCP_READY                 0x87654321
  34 #define     NCP_INFO_READY            0xBD53EF99
  35 #define     NCP_DOWNLOAD_PENDING      0xABCDDCBA
  36 #define     NCP_DOWNLOAD_COMPLETE     0xCAFEFECA
  37 #define     NCP_AUTH_OK               0xD4C64A99
  38 #define     NCP_AUTH_FAIL             0x174FC882
  39 #define     NCP_PUB_KEY_RDY           0x7AB41D19
  40 #define WFX_DCA_FW_SIGNATURE      0x0900C014
  41 #define     FW_SIGNATURE_SIZE         0x40
  42 #define WFX_DCA_FW_HASH           0x0900C054
  43 #define     FW_HASH_SIZE              0x08
  44 #define WFX_DCA_FW_VERSION        0x0900C05C
  45 #define     FW_VERSION_SIZE           0x04
  46 #define WFX_DCA_RESERVED          0x0900C060
  47 #define     DCA_RESERVED_SIZE         0x20
  48 #define WFX_STATUS_INFO           0x0900C080
  49 #define WFX_BOOTLOADER_LABEL      0x0900C084
  50 #define     BOOTLOADER_LABEL_SIZE     0x3C
  51 #define WFX_PTE_INFO              0x0900C0C0
  52 #define     PTE_INFO_KEYSET_IDX       0x0D
  53 #define     PTE_INFO_SIZE             0x10
  54 #define WFX_ERR_INFO              0x0900C0D0
  55 #define     ERR_INVALID_SEC_TYPE      0x05
  56 #define     ERR_SIG_VERIF_FAILED      0x0F
  57 #define     ERR_AES_CTRL_KEY          0x10
  58 #define     ERR_ECC_PUB_KEY           0x11
  59 #define     ERR_MAC_KEY               0x18
  60
  61 #define DCA_TIMEOUT  50 // milliseconds
  62 #define WAKEUP_TIMEOUT 200 // milliseconds
  63
  64 static const char * const fwio_error_strings[] = {
  65         [ERR_INVALID_SEC_TYPE] = "Invalid section type or wrong encryption",
  66         [ERR_SIG_VERIF_FAILED] = "Signature verification failed",
  67         [ERR_AES_CTRL_KEY] = "AES control key not initialized",
  68         [ERR_ECC_PUB_KEY] = "ECC public key not initialized",
  69         [ERR_MAC_KEY] = "MAC key not initialized",
  70 };
  71
  72 /*
  73  * request_firmware() allocate data using vmalloc(). It is not compatible with
  74  * underlying hardware that use DMA. Function below detect this case and
  75  * allocate a bounce buffer if necessary.
  76  *
  77  * Notice that, in doubt, you can enable CONFIG_DEBUG_SG to ask kernel to
  78  * detect this problem at runtime  (else, kernel silently fail).
  79  *
  80  * NOTE: it may also be possible to use 'pages' from struct firmware and avoid
  81  * bounce buffer
  82  */
  83 static int sram_write_dma_safe(struct wfx_dev *wdev, u32 addr, const u8 *buf,
  84                                size_t len)
  85 {
  86         int ret;
  87         const u8 *tmp;
  88
  89         if (!virt_addr_valid(buf)) {
  90                 tmp = kmemdup(buf, len, GFP_KERNEL);
  91                 if (!tmp)
  92                         return -ENOMEM;
  93         } else {
  94                 tmp = buf;
  95         }
  96         ret = sram_buf_write(wdev, addr, tmp, len);
  97         if (!virt_addr_valid(buf))
  98                 kfree(tmp);
  99         return ret;
 100 }
 101
 102 int get_firmware(struct wfx_dev *wdev, u32 keyset_chip,
 103                  const struct firmware **fw, int *file_offset)
 104 {
 105         int keyset_file;
 106         char filename[256];
 107         const char *data;
 108         int ret;
 109
 110         snprintf(filename, sizeof(filename), "%s_%02X.sec", wdev->pdata.file_fw,
 111                  keyset_chip);
 112         ret = firmware_request_nowarn(fw, filename, wdev->dev);
 113         if (ret) {
 114                 dev_info(wdev->dev, "can't load %s, falling back to %s.sec\n",
 115                          filename, wdev->pdata.file_fw);
 116                 snprintf(filename, sizeof(filename), "%s.sec",
 117                          wdev->pdata.file_fw);
 118                 ret = request_firmware(fw, filename, wdev->dev);
 119                 if (ret) {
 120                         dev_err(wdev->dev, "can't load %s\n", filename);
 121                         *fw = NULL;
 122                         return ret;
 123                 }
 124         }
 125
 126         data = (*fw)->data;
 127         if (memcmp(data, "KEYSET", 6) != 0) {
 128                 // Legacy firmware format
 129                 *file_offset = 0;
 130                 keyset_file = 0x90;
 131         } else {
 132                 *file_offset = 8;
 133                 keyset_file = (hex_to_bin(data[6]) * 16) | hex_to_bin(data[7]);
 134                 if (keyset_file < 0) {
 135                         dev_err(wdev->dev, "%s corrupted\n", filename);
 136                         release_firmware(*fw);
 137                         *fw = NULL;
 138                         return -EINVAL;
 139                 }
 140         }
 141         if (keyset_file != keyset_chip) {
 142                 dev_err(wdev->dev, "firmware keyset is incompatible with chip (file: 0x%02X, chip: 0x%02X)\n",
 143                         keyset_file, keyset_chip);
 144                 release_firmware(*fw);
 145                 *fw = NULL;
 146                 return -ENODEV;
 147         }
 148         wdev->keyset = keyset_file;
 149         return 0;
 150 }
 151
 152 static int wait_ncp_status(struct wfx_dev *wdev, u32 status)
 153 {
 154         ktime_t now, start;
 155         u32 reg;
 156         int ret;
 157
 158         start = ktime_get();
 159         for (;;) {
 160                 ret = sram_reg_read(wdev, WFX_DCA_NCP_STATUS, &reg);
 161                 if (ret < 0)
 162                         return -EIO;
 163                 now = ktime_get();
 164                 if (reg == status)
 165                         break;
 166                 if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
 167                         return -ETIMEDOUT;
 168         }
 169         if (ktime_compare(now, start))
 170                 dev_dbg(wdev->dev, "chip answer after %lldus\n",
 171                         ktime_us_delta(now, start));
 172         else
 173                 dev_dbg(wdev->dev, "chip answer immediately\n");
 174         return 0;
 175 }
 176
 177 static int upload_firmware(struct wfx_dev *wdev, const u8 *data, size_t len)
 178 {
 179         int ret;
 180         u32 offs, bytes_done;
 181         ktime_t now, start;
 182
 183         if (len % DNLD_BLOCK_SIZE) {
 184                 dev_err(wdev->dev, "firmware size is not aligned. Buffer overrun will occur\n");
 185                 return -EIO;
 186         }
 187         offs = 0;
 188         while (offs < len) {
 189                 start = ktime_get();
 190                 for (;;) {
 191                         ret = sram_reg_read(wdev, WFX_DCA_GET, &bytes_done);
 192                         if (ret < 0)
 193                                 return ret;
 194                         now = ktime_get();
 195                         if (offs +
 196                             DNLD_BLOCK_SIZE - bytes_done < DNLD_FIFO_SIZE)
 197                                 break;
 198                         if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
 199                                 return -ETIMEDOUT;
 200                 }
 201                 if (ktime_compare(now, start))
 202                         dev_dbg(wdev->dev, "answer after %lldus\n",
 203                                 ktime_us_delta(now, start));
 204
 205                 ret = sram_write_dma_safe(wdev, WFX_DNLD_FIFO +
 206                                           (offs % DNLD_FIFO_SIZE),
 207                                           data + offs, DNLD_BLOCK_SIZE);
 208                 if (ret < 0)
 209                         return ret;
 210
 211                 // WFx seems to not support writing 0 in this register during
 212                 // first loop
 213                 offs += DNLD_BLOCK_SIZE;
 214                 ret = sram_reg_write(wdev, WFX_DCA_PUT, offs);
 215                 if (ret < 0)
 216                         return ret;
 217         }
 218         return 0;
 219 }
 220
 221 static void print_boot_status(struct wfx_dev *wdev)
 222 {
 223         u32 val32;
 224
 225         sram_reg_read(wdev, WFX_STATUS_INFO, &val32);
 226         if (val32 == 0x12345678) {
 227                 dev_info(wdev->dev, "no error reported by secure boot\n");
 228         } else {
 229                 sram_reg_read(wdev, WFX_ERR_INFO, &val32);
 230                 if (val32 < ARRAY_SIZE(fwio_error_strings) &&
 231                     fwio_error_strings[val32])
 232                         dev_info(wdev->dev, "secure boot error: %s\n",
 233                                  fwio_error_strings[val32]);
 234                 else
 235                         dev_info(wdev->dev,
 236                                  "secure boot error: Unknown (0x%02x)\n",
 237                                  val32);
 238         }
 239 }
 240
 241 static int load_firmware_secure(struct wfx_dev *wdev)
 242 {
 243         const struct firmware *fw = NULL;
 244         int header_size;
 245         int fw_offset;
 246         ktime_t start;
 247         u8 *buf;
 248         int ret;
 249
 250         BUILD_BUG_ON(PTE_INFO_SIZE > BOOTLOADER_LABEL_SIZE);
 251         buf = kmalloc(BOOTLOADER_LABEL_SIZE + 1, GFP_KERNEL);
 252         if (!buf)
 253                 return -ENOMEM;
 254
 255         sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_READY);
 256         ret = wait_ncp_status(wdev, NCP_INFO_READY);
 257         if (ret)
 258                 goto error;
 259
 260         sram_buf_read(wdev, WFX_BOOTLOADER_LABEL, buf, BOOTLOADER_LABEL_SIZE);
 261         buf[BOOTLOADER_LABEL_SIZE] = 0;
 262         dev_dbg(wdev->dev, "bootloader: \"%s\"\n", buf);
 263
 264         sram_buf_read(wdev, WFX_PTE_INFO, buf, PTE_INFO_SIZE);
 265         ret = get_firmware(wdev, buf[PTE_INFO_KEYSET_IDX], &fw, &fw_offset);
 266         if (ret)
 267                 goto error;
 268         header_size = fw_offset + FW_SIGNATURE_SIZE + FW_HASH_SIZE;
 269
 270         sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_INFO_READ);
 271         ret = wait_ncp_status(wdev, NCP_READY);
 272         if (ret)
 273                 goto error;
 274
 275         sram_reg_write(wdev, WFX_DNLD_FIFO, 0xFFFFFFFF); // Fifo init
 276         sram_write_dma_safe(wdev, WFX_DCA_FW_VERSION, "\x01\x00\x00\x00",
 277                             FW_VERSION_SIZE);
 278         sram_write_dma_safe(wdev, WFX_DCA_FW_SIGNATURE, fw->data + fw_offset,
 279                             FW_SIGNATURE_SIZE);
 280         sram_write_dma_safe(wdev, WFX_DCA_FW_HASH,
 281                             fw->data + fw_offset + FW_SIGNATURE_SIZE,
 282                             FW_HASH_SIZE);
 283         sram_reg_write(wdev, WFX_DCA_IMAGE_SIZE, fw->size - header_size);
 284         sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_PENDING);
 285         ret = wait_ncp_status(wdev, NCP_DOWNLOAD_PENDING);
 286         if (ret)
 287                 goto error;
 288
 289         start = ktime_get();
 290         ret = upload_firmware(wdev, fw->data + header_size,
 291                               fw->size - header_size);
 292         if (ret)
 293                 goto error;
 294         dev_dbg(wdev->dev, "firmware load after %lldus\n",
 295                 ktime_us_delta(ktime_get(), start));
 296
 297         sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_COMPLETE);
 298         ret = wait_ncp_status(wdev, NCP_AUTH_OK);
 299         // Legacy ROM support
 300         if (ret < 0)
 301                 ret = wait_ncp_status(wdev, NCP_PUB_KEY_RDY);
 302         if (ret < 0)
 303                 goto error;
 304         sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_OK_TO_JUMP);
 305
 306 error:
 307         kfree(buf);
 308         if (fw)
 309                 release_firmware(fw);
 310         if (ret)
 311                 print_boot_status(wdev);
 312         return ret;
 313 }
 314
 315 static int init_gpr(struct wfx_dev *wdev)
 316 {
 317         int ret, i;
 318         static const struct {
 319                 int index;
 320                 u32 value;
 321         } gpr_init[] = {
 322                 { 0x07, 0x208775 },
 323                 { 0x08, 0x2EC020 },
 324                 { 0x09, 0x3C3C3C },
 325                 { 0x0B, 0x322C44 },
 326                 { 0x0C, 0xA06497 },
 327         };
 328
 329         for (i = 0; i < ARRAY_SIZE(gpr_init); i++) {
 330                 ret = igpr_reg_write(wdev, gpr_init[i].index,
 331                                      gpr_init[i].value);
 332                 if (ret < 0)
 333                         return ret;
 334                 dev_dbg(wdev->dev, "  index %02x: %08x\n", gpr_init[i].index,
 335                         gpr_init[i].value);
 336         }
 337         return 0;
 338 }
 339
 340 int wfx_init_device(struct wfx_dev *wdev)
 341 {
 342         int ret;
 343         int hw_revision, hw_type;
 344         int wakeup_timeout = 50; // ms
 345         ktime_t now, start;
 346         u32 reg;
 347
 348         reg = CFG_DIRECT_ACCESS_MODE | CFG_CPU_RESET | CFG_WORD_MODE2;
 349         if (wdev->pdata.use_rising_clk)
 350                 reg |= CFG_CLK_RISE_EDGE;
 351         ret = config_reg_write(wdev, reg);
 352         if (ret < 0) {
 353                 dev_err(wdev->dev, "bus returned an error during first write access. Host configuration error?\n");
 354                 return -EIO;
 355         }
 356
 357         ret = config_reg_read(wdev, &reg);
 358         if (ret < 0) {
 359                 dev_err(wdev->dev, "bus returned an error during first read access. Bus configuration error?\n");
 360                 return -EIO;
 361         }
 362         if (reg == 0 || reg == ~0) {
 363                 dev_err(wdev->dev, "chip mute. Bus configuration error or chip wasn't reset?\n");
 364                 return -EIO;
 365         }
 366         dev_dbg(wdev->dev, "initial config register value: %08x\n", reg);
 367
 368         hw_revision = FIELD_GET(CFG_DEVICE_ID_MAJOR, reg);
 369         if (hw_revision == 0 || hw_revision > 2) {
 370                 dev_err(wdev->dev, "bad hardware revision number: %d\n",
 371                         hw_revision);
 372                 return -ENODEV;
 373         }
 374         hw_type = FIELD_GET(CFG_DEVICE_ID_TYPE, reg);
 375         if (hw_type == 1) {
 376                 dev_notice(wdev->dev, "development hardware detected\n");
 377                 wakeup_timeout = 2000;
 378         }
 379
 380         ret = init_gpr(wdev);
 381         if (ret < 0)
 382                 return ret;
 383
 384         ret = control_reg_write(wdev, CTRL_WLAN_WAKEUP);
 385         if (ret < 0)
 386                 return -EIO;
 387         start = ktime_get();
 388         for (;;) {
 389                 ret = control_reg_read(wdev, &reg);
 390                 now = ktime_get();
 391                 if (reg & CTRL_WLAN_READY)
 392                         break;
 393                 if (ktime_after(now, ktime_add_ms(start, wakeup_timeout))) {
 394                         dev_err(wdev->dev, "chip didn't wake up. Chip wasn't reset?\n");
 395                         return -ETIMEDOUT;
 396                 }
 397         }
 398         dev_dbg(wdev->dev, "chip wake up after %lldus\n",
 399                 ktime_us_delta(now, start));
 400
 401         ret = config_reg_write_bits(wdev, CFG_CPU_RESET, 0);
 402         if (ret < 0)
 403                 return ret;
 404         ret = load_firmware_secure(wdev);
 405         if (ret < 0)
 406                 return ret;
 407         ret = config_reg_write_bits(wdev,
 408                                     CFG_DIRECT_ACCESS_MODE |
 409                                     CFG_IRQ_ENABLE_DATA |
 410                                     CFG_IRQ_ENABLE_WRDY,
 411                                     CFG_IRQ_ENABLE_DATA);
 412         return ret;
 413 }