1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * ISH-TP client driver for ISH firmware loading
4  *
5  * Copyright (c) 2019, Intel Corporation.
6  */
7 
8 #include <linux/firmware.h>
9 #include <linux/module.h>
10 #include <linux/pci.h>
11 #include <linux/intel-ish-client-if.h>
12 #include <linux/property.h>
13 #include <asm/cacheflush.h>
14 
15 /* Number of times we attempt to load the firmware before giving up */
16 #define MAX_LOAD_ATTEMPTS			3
17 
18 /* ISH TX/RX ring buffer pool size */
19 #define LOADER_CL_RX_RING_SIZE			1
20 #define LOADER_CL_TX_RING_SIZE			1
21 
22 /*
23  * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
24  * used to temporarily hold the data transferred from host to Shim
25  * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
26  * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
27  * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
28  * have a max payload of 3968 bytes (= 32 x 124 payload).
29  */
30 #define LOADER_SHIM_IPC_BUF_SIZE		3968
31 
32 /**
33  * enum ish_loader_commands -	ISH loader host commands.
34  * @LOADER_CMD_XFER_QUERY:	Query the Shim firmware loader for
35  *				capabilities
36  * @LOADER_CMD_XFER_FRAGMENT:	Transfer one firmware image fragment at a
37  *				time. The command may be executed
38  *				multiple times until the entire firmware
39  *				image is downloaded to SRAM.
40  * @LOADER_CMD_START:		Start executing the main firmware.
41  */
42 enum ish_loader_commands {
43 	LOADER_CMD_XFER_QUERY = 0,
44 	LOADER_CMD_XFER_FRAGMENT,
45 	LOADER_CMD_START,
46 };
47 
48 /* Command bit mask */
49 #define	CMD_MASK				GENMASK(6, 0)
50 #define	IS_RESPONSE				BIT(7)
51 
52 /*
53  * ISH firmware max delay for one transmit failure is 1 Hz,
54  * and firmware will retry 2 times, so 3 Hz is used for timeout.
55  */
56 #define ISHTP_SEND_TIMEOUT			(3 * HZ)
57 
58 /*
59  * Loader transfer modes:
60  *
61  * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
62  * transfer data. This may use IPC or DMA if supported in firmware.
63  * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
64  * both IPC & DMA (legacy).
65  *
66  * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
67  * from the sensor data streaming. Here we download a large (300+ Kb)
68  * image directly to ISH SRAM memory. There is limited benefit of
69  * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
70  * this "direct dma" mode, where we do not use ISH-TP for DMA, but
71  * instead manage the DMA directly in kernel driver and Shim firmware
72  * loader (allocate buffer, break in chucks and transfer). This allows
73  * to overcome 4 Kb limit, and optimize the data flow path in firmware.
74  */
75 #define LOADER_XFER_MODE_DIRECT_DMA		BIT(0)
76 #define LOADER_XFER_MODE_ISHTP			BIT(1)
77 
78 /* ISH Transport Loader client unique GUID */
79 static const struct ishtp_device_id loader_ishtp_id_table[] = {
80 	{ .guid = GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
81 		  0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc) },
82 	{ }
83 };
84 MODULE_DEVICE_TABLE(ishtp, loader_ishtp_id_table);
85 
86 #define FILENAME_SIZE				256
87 
88 /*
89  * The firmware loading latency will be minimum if we can DMA the
90  * entire ISH firmware image in one go. This requires that we allocate
91  * a large DMA buffer in kernel, which could be problematic on some
92  * platforms. So here we limit the DMA buffer size via a module_param.
93  * We default to 4 pages, but a customer can set it to higher limit if
94  * deemed appropriate for his platform.
95  */
96 static int dma_buf_size_limit = 4 * PAGE_SIZE;
97 
98 /**
99  * struct loader_msg_hdr - Header for ISH Loader commands.
100  * @command:		LOADER_CMD* commands. Bit 7 is the response.
101  * @reserved:		Reserved space
102  * @status:		Command response status. Non 0, is error
103  *			condition.
104  *
105  * This structure is used as header for every command/data sent/received
106  * between Host driver and ISH Shim firmware loader.
107  */
108 struct loader_msg_hdr {
109 	u8 command;
110 	u8 reserved[2];
111 	u8 status;
112 } __packed;
113 
114 struct loader_xfer_query {
115 	struct loader_msg_hdr hdr;
116 	u32 image_size;
117 } __packed;
118 
119 struct ish_fw_version {
120 	u16 major;
121 	u16 minor;
122 	u16 hotfix;
123 	u16 build;
124 } __packed;
125 
126 union loader_version {
127 	u32 value;
128 	struct {
129 		u8 major;
130 		u8 minor;
131 		u8 hotfix;
132 		u8 build;
133 	};
134 } __packed;
135 
136 struct loader_capability {
137 	u32 max_fw_image_size;
138 	u32 xfer_mode;
139 	u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
140 } __packed;
141 
142 struct shim_fw_info {
143 	struct ish_fw_version ish_fw_version;
144 	u32 protocol_version;
145 	union loader_version ldr_version;
146 	struct loader_capability ldr_capability;
147 } __packed;
148 
149 struct loader_xfer_query_response {
150 	struct loader_msg_hdr hdr;
151 	struct shim_fw_info fw_info;
152 } __packed;
153 
154 struct loader_xfer_fragment {
155 	struct loader_msg_hdr hdr;
156 	u32 xfer_mode;
157 	u32 offset;
158 	u32 size;
159 	u32 is_last;
160 } __packed;
161 
162 struct loader_xfer_ipc_fragment {
163 	struct loader_xfer_fragment fragment;
164 	u8 data[] ____cacheline_aligned; /* variable length payload here */
165 } __packed;
166 
167 struct loader_xfer_dma_fragment {
168 	struct loader_xfer_fragment fragment;
169 	u64 ddr_phys_addr;
170 } __packed;
171 
172 struct loader_start {
173 	struct loader_msg_hdr hdr;
174 } __packed;
175 
176 /**
177  * struct response_info - Encapsulate firmware response related
178  *			information for passing between function
179  *			loader_cl_send() and process_recv() callback.
180  * @data:		Copy the data received from firmware here.
181  * @max_size:		Max size allocated for the @data buffer. If the
182  *			received data exceeds this value, we log an
183  *			error.
184  * @size:		Actual size of data received from firmware.
185  * @error:		Returns 0 for success, negative error code for a
186  *			failure in function process_recv().
187  * @received:		Set to true on receiving a valid firmware
188  *			response to host command
189  * @wait_queue:		Wait queue for Host firmware loading where the
190  *			client sends message to ISH firmware and waits
191  *			for response
192  */
193 struct response_info {
194 	void *data;
195 	size_t max_size;
196 	size_t size;
197 	int error;
198 	bool received;
199 	wait_queue_head_t wait_queue;
200 };
201 
202 /*
203  * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
204  * @work_ishtp_reset:	Work queue for reset handling.
205  * @work_fw_load:	Work queue for host firmware loading.
206  * @flag_retry:		Flag for indicating host firmware loading should
207  *			be retried.
208  * @retry_count:	Count the number of retries.
209  *
210  * This structure is used to store data per client.
211  */
212 struct ishtp_cl_data {
213 	struct ishtp_cl *loader_ishtp_cl;
214 	struct ishtp_cl_device *cl_device;
215 
216 	/*
217 	 * Used for passing firmware response information between
218 	 * loader_cl_send() and process_recv() callback.
219 	 */
220 	struct response_info response;
221 
222 	struct work_struct work_ishtp_reset;
223 	struct work_struct work_fw_load;
224 
225 	/*
226 	 * In certain failure scenrios, it makes sense to reset the ISH
227 	 * subsystem and retry Host firmware loading (e.g. bad message
228 	 * packet, ENOMEM, etc.). On the other hand, failures due to
229 	 * protocol mismatch, etc., are not recoverable. We do not
230 	 * retry them.
231 	 *
232 	 * If set, the flag indicates that we should re-try the
233 	 * particular failure.
234 	 */
235 	bool flag_retry;
236 	int retry_count;
237 };
238 
239 #define IPC_FRAGMENT_DATA_PREAMBLE				\
240 	offsetof(struct loader_xfer_ipc_fragment, data)
241 
242 #define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
243 
244 /**
245  * get_firmware_variant() - Gets the filename of firmware image to be
246  *			loaded based on platform variant.
247  * @client_data:	Client data instance.
248  * @filename:		Returns firmware filename.
249  *
250  * Queries the firmware-name device property string.
251  *
252  * Return: 0 for success, negative error code for failure.
253  */
254 static int get_firmware_variant(struct ishtp_cl_data *client_data,
255 				char *filename)
256 {
257 	int rv;
258 	const char *val;
259 	struct device *devc = ishtp_get_pci_device(client_data->cl_device);
260 
261 	rv = device_property_read_string(devc, "firmware-name", &val);
262 	if (rv < 0) {
263 		dev_err(devc,
264 			"Error: ISH firmware-name device property required\n");
265 		return rv;
266 	}
267 	return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
268 }
269 
270 /**
271  * loader_cl_send() - Send message from host to firmware
272  *
273  * @client_data:	Client data instance
274  * @out_msg:		Message buffer to be sent to firmware
275  * @out_size:		Size of out going message
276  * @in_msg:		Message buffer where the incoming data copied.
277  *			This buffer is allocated by calling
278  * @in_size:		Max size of incoming message
279  *
280  * Return: Number of bytes copied in the in_msg on success, negative
281  * error code on failure.
282  */
283 static int loader_cl_send(struct ishtp_cl_data *client_data,
284 			  u8 *out_msg, size_t out_size,
285 			  u8 *in_msg, size_t in_size)
286 {
287 	int rv;
288 	struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
289 	struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
290 
291 	dev_dbg(cl_data_to_dev(client_data),
292 		"%s: command=%02lx is_response=%u status=%02x\n",
293 		__func__,
294 		out_hdr->command & CMD_MASK,
295 		out_hdr->command & IS_RESPONSE ? 1 : 0,
296 		out_hdr->status);
297 
298 	/* Setup in coming buffer & size */
299 	client_data->response.data = in_msg;
300 	client_data->response.max_size = in_size;
301 	client_data->response.error = 0;
302 	client_data->response.received = false;
303 
304 	rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
305 	if (rv < 0) {
306 		dev_err(cl_data_to_dev(client_data),
307 			"ishtp_cl_send error %d\n", rv);
308 		return rv;
309 	}
310 
311 	wait_event_interruptible_timeout(client_data->response.wait_queue,
312 					 client_data->response.received,
313 					 ISHTP_SEND_TIMEOUT);
314 	if (!client_data->response.received) {
315 		dev_err(cl_data_to_dev(client_data),
316 			"Timed out for response to command=%02lx",
317 			out_hdr->command & CMD_MASK);
318 		return -ETIMEDOUT;
319 	}
320 
321 	if (client_data->response.error < 0)
322 		return client_data->response.error;
323 
324 	return client_data->response.size;
325 }
326 
327 /**
328  * process_recv() -	Receive and parse incoming packet
329  * @loader_ishtp_cl:	Client instance to get stats
330  * @rb_in_proc:		ISH received message buffer
331  *
332  * Parse the incoming packet. If it is a response packet then it will
333  * update received and wake up the caller waiting to for the response.
334  */
335 static void process_recv(struct ishtp_cl *loader_ishtp_cl,
336 			 struct ishtp_cl_rb *rb_in_proc)
337 {
338 	struct loader_msg_hdr *hdr;
339 	size_t data_len = rb_in_proc->buf_idx;
340 	struct ishtp_cl_data *client_data =
341 		ishtp_get_client_data(loader_ishtp_cl);
342 
343 	/* Sanity check */
344 	if (!client_data->response.data) {
345 		dev_err(cl_data_to_dev(client_data),
346 			"Receiving buffer is null. Should be allocated by calling function\n");
347 		client_data->response.error = -EINVAL;
348 		goto end;
349 	}
350 
351 	if (client_data->response.received) {
352 		dev_err(cl_data_to_dev(client_data),
353 			"Previous firmware message not yet processed\n");
354 		client_data->response.error = -EINVAL;
355 		goto end;
356 	}
357 	/*
358 	 * All firmware messages have a header. Check buffer size
359 	 * before accessing elements inside.
360 	 */
361 	if (!rb_in_proc->buffer.data) {
362 		dev_warn(cl_data_to_dev(client_data),
363 			 "rb_in_proc->buffer.data returned null");
364 		client_data->response.error = -EBADMSG;
365 		goto end;
366 	}
367 
368 	if (data_len < sizeof(struct loader_msg_hdr)) {
369 		dev_err(cl_data_to_dev(client_data),
370 			"data size %zu is less than header %zu\n",
371 			data_len, sizeof(struct loader_msg_hdr));
372 		client_data->response.error = -EMSGSIZE;
373 		goto end;
374 	}
375 
376 	hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
377 
378 	dev_dbg(cl_data_to_dev(client_data),
379 		"%s: command=%02lx is_response=%u status=%02x\n",
380 		__func__,
381 		hdr->command & CMD_MASK,
382 		hdr->command & IS_RESPONSE ? 1 : 0,
383 		hdr->status);
384 
385 	if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
386 	    ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
387 	    ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
388 		dev_err(cl_data_to_dev(client_data),
389 			"Invalid command=%02lx\n",
390 			hdr->command & CMD_MASK);
391 		client_data->response.error = -EPROTO;
392 		goto end;
393 	}
394 
395 	if (data_len > client_data->response.max_size) {
396 		dev_err(cl_data_to_dev(client_data),
397 			"Received buffer size %zu is larger than allocated buffer %zu\n",
398 			data_len, client_data->response.max_size);
399 		client_data->response.error = -EMSGSIZE;
400 		goto end;
401 	}
402 
403 	/* We expect only "response" messages from firmware */
404 	if (!(hdr->command & IS_RESPONSE)) {
405 		dev_err(cl_data_to_dev(client_data),
406 			"Invalid response to command\n");
407 		client_data->response.error = -EIO;
408 		goto end;
409 	}
410 
411 	if (hdr->status) {
412 		dev_err(cl_data_to_dev(client_data),
413 			"Loader returned status %d\n",
414 			hdr->status);
415 		client_data->response.error = -EIO;
416 		goto end;
417 	}
418 
419 	/* Update the actual received buffer size */
420 	client_data->response.size = data_len;
421 
422 	/*
423 	 * Copy the buffer received in firmware response for the
424 	 * calling thread.
425 	 */
426 	memcpy(client_data->response.data,
427 	       rb_in_proc->buffer.data, data_len);
428 
429 	/* Set flag before waking up the caller */
430 	client_data->response.received = true;
431 
432 end:
433 	/* Free the buffer */
434 	ishtp_cl_io_rb_recycle(rb_in_proc);
435 	rb_in_proc = NULL;
436 
437 	/* Wake the calling thread */
438 	wake_up_interruptible(&client_data->response.wait_queue);
439 }
440 
441 /**
442  * loader_cl_event_cb() - bus driver callback for incoming message
443  * @cl_device:		Pointer to the ishtp client device for which this
444  *			message is targeted
445  *
446  * Remove the packet from the list and process the message by calling
447  * process_recv
448  */
449 static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
450 {
451 	struct ishtp_cl_rb *rb_in_proc;
452 	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
453 
454 	while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
455 		/* Process the data packet from firmware */
456 		process_recv(loader_ishtp_cl, rb_in_proc);
457 	}
458 }
459 
460 /**
461  * ish_query_loader_prop() -  Query ISH Shim firmware loader
462  * @client_data:	Client data instance
463  * @fw:			Pointer to firmware data struct in host memory
464  * @fw_info:		Loader firmware properties
465  *
466  * This function queries the ISH Shim firmware loader for capabilities.
467  *
468  * Return: 0 for success, negative error code for failure.
469  */
470 static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
471 				 const struct firmware *fw,
472 				 struct shim_fw_info *fw_info)
473 {
474 	int rv;
475 	struct loader_xfer_query ldr_xfer_query;
476 	struct loader_xfer_query_response ldr_xfer_query_resp;
477 
478 	memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
479 	ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
480 	ldr_xfer_query.image_size = fw->size;
481 	rv = loader_cl_send(client_data,
482 			    (u8 *)&ldr_xfer_query,
483 			    sizeof(ldr_xfer_query),
484 			    (u8 *)&ldr_xfer_query_resp,
485 			    sizeof(ldr_xfer_query_resp));
486 	if (rv < 0) {
487 		client_data->flag_retry = true;
488 		*fw_info = (struct shim_fw_info){};
489 		return rv;
490 	}
491 
492 	/* On success, the return value is the received buffer size */
493 	if (rv != sizeof(struct loader_xfer_query_response)) {
494 		dev_err(cl_data_to_dev(client_data),
495 			"data size %d is not equal to size of loader_xfer_query_response %zu\n",
496 			rv, sizeof(struct loader_xfer_query_response));
497 		client_data->flag_retry = true;
498 		*fw_info = (struct shim_fw_info){};
499 		return -EMSGSIZE;
500 	}
501 
502 	/* Save fw_info for use outside this function */
503 	*fw_info = ldr_xfer_query_resp.fw_info;
504 
505 	/* Loader firmware properties */
506 	dev_dbg(cl_data_to_dev(client_data),
507 		"ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
508 		fw_info->ish_fw_version.major,
509 		fw_info->ish_fw_version.minor,
510 		fw_info->ish_fw_version.hotfix,
511 		fw_info->ish_fw_version.build,
512 		fw_info->protocol_version,
513 		fw_info->ldr_version.value);
514 
515 	dev_dbg(cl_data_to_dev(client_data),
516 		"loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
517 		fw_info->ldr_capability.max_fw_image_size,
518 		fw_info->ldr_capability.xfer_mode,
519 		fw_info->ldr_capability.max_dma_buf_size,
520 		dma_buf_size_limit);
521 
522 	/* Sanity checks */
523 	if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
524 		dev_err(cl_data_to_dev(client_data),
525 			"ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
526 			fw->size,
527 			fw_info->ldr_capability.max_fw_image_size);
528 		return -ENOSPC;
529 	}
530 
531 	/* For DMA the buffer size should be multiple of cacheline size */
532 	if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
533 	    (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
534 		dev_err(cl_data_to_dev(client_data),
535 			"Shim firmware loader buffer size %d should be multiple of cacheline\n",
536 			fw_info->ldr_capability.max_dma_buf_size);
537 		return -EINVAL;
538 	}
539 
540 	return 0;
541 }
542 
543 /**
544  * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface
545  * @client_data:	Client data instance
546  * @fw:			Pointer to firmware data struct in host memory
547  *
548  * This function uses ISH-TP to transfer ISH firmware from host to
549  * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
550  * support.
551  *
552  * Return: 0 for success, negative error code for failure.
553  */
554 static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
555 			     const struct firmware *fw)
556 {
557 	int rv;
558 	u32 fragment_offset, fragment_size, payload_max_size;
559 	struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
560 	struct loader_msg_hdr ldr_xfer_ipc_ack;
561 
562 	payload_max_size =
563 		LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
564 
565 	ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
566 	if (!ldr_xfer_ipc_frag) {
567 		client_data->flag_retry = true;
568 		return -ENOMEM;
569 	}
570 
571 	ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
572 	ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
573 
574 	/* Break the firmware image into fragments and send as ISH-TP payload */
575 	fragment_offset = 0;
576 	while (fragment_offset < fw->size) {
577 		if (fragment_offset + payload_max_size < fw->size) {
578 			fragment_size = payload_max_size;
579 			ldr_xfer_ipc_frag->fragment.is_last = 0;
580 		} else {
581 			fragment_size = fw->size - fragment_offset;
582 			ldr_xfer_ipc_frag->fragment.is_last = 1;
583 		}
584 
585 		ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
586 		ldr_xfer_ipc_frag->fragment.size = fragment_size;
587 		memcpy(ldr_xfer_ipc_frag->data,
588 		       &fw->data[fragment_offset],
589 		       fragment_size);
590 
591 		dev_dbg(cl_data_to_dev(client_data),
592 			"xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
593 			ldr_xfer_ipc_frag->fragment.offset,
594 			ldr_xfer_ipc_frag->fragment.size,
595 			ldr_xfer_ipc_frag->fragment.is_last);
596 
597 		rv = loader_cl_send(client_data,
598 				    (u8 *)ldr_xfer_ipc_frag,
599 				    IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
600 				    (u8 *)&ldr_xfer_ipc_ack,
601 				    sizeof(ldr_xfer_ipc_ack));
602 		if (rv < 0) {
603 			client_data->flag_retry = true;
604 			goto end_err_resp_buf_release;
605 		}
606 
607 		fragment_offset += fragment_size;
608 	}
609 
610 	kfree(ldr_xfer_ipc_frag);
611 	return 0;
612 
613 end_err_resp_buf_release:
614 	/* Free ISH buffer if not done already, in error case */
615 	kfree(ldr_xfer_ipc_frag);
616 	return rv;
617 }
618 
619 /**
620  * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
621  * @client_data:	Client data instance
622  * @fw:			Pointer to firmware data struct in host memory
623  * @fw_info:		Loader firmware properties
624  *
625  * Host firmware load is a unique case where we need to download
626  * a large firmware image (200+ Kb). This function implements
627  * direct DMA transfer in kernel and ISH firmware. This allows
628  * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
629  * directly to ISH UMA at location of choice.
630  * Function depends on corresponding support in ISH firmware.
631  *
632  * Return: 0 for success, negative error code for failure.
633  */
634 static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
635 				  const struct firmware *fw,
636 				  const struct shim_fw_info fw_info)
637 {
638 	int rv;
639 	void *dma_buf;
640 	dma_addr_t dma_buf_phy;
641 	u32 fragment_offset, fragment_size, payload_max_size;
642 	struct loader_msg_hdr ldr_xfer_dma_frag_ack;
643 	struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
644 	struct device *devc = ishtp_get_pci_device(client_data->cl_device);
645 	u32 shim_fw_buf_size =
646 		fw_info.ldr_capability.max_dma_buf_size;
647 
648 	/*
649 	 * payload_max_size should be set to minimum of
650 	 *  (1) Size of firmware to be loaded,
651 	 *  (2) Max DMA buffer size supported by Shim firmware,
652 	 *  (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
653 	 */
654 	payload_max_size = min3(fw->size,
655 				(size_t)shim_fw_buf_size,
656 				(size_t)dma_buf_size_limit);
657 
658 	/*
659 	 * Buffer size should be multiple of cacheline size
660 	 * if it's not, select the previous cacheline boundary.
661 	 */
662 	payload_max_size &= ~(L1_CACHE_BYTES - 1);
663 
664 	dma_buf = dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_KERNEL);
665 	if (!dma_buf) {
666 		client_data->flag_retry = true;
667 		return -ENOMEM;
668 	}
669 
670 	ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
671 	ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
672 	ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
673 
674 	/* Send the firmware image in chucks of payload_max_size */
675 	fragment_offset = 0;
676 	while (fragment_offset < fw->size) {
677 		if (fragment_offset + payload_max_size < fw->size) {
678 			fragment_size = payload_max_size;
679 			ldr_xfer_dma_frag.fragment.is_last = 0;
680 		} else {
681 			fragment_size = fw->size - fragment_offset;
682 			ldr_xfer_dma_frag.fragment.is_last = 1;
683 		}
684 
685 		ldr_xfer_dma_frag.fragment.offset = fragment_offset;
686 		ldr_xfer_dma_frag.fragment.size = fragment_size;
687 		memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
688 
689 		/* Flush cache to be sure the data is in main memory. */
690 		clflush_cache_range(dma_buf, payload_max_size);
691 
692 		dev_dbg(cl_data_to_dev(client_data),
693 			"xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
694 			ldr_xfer_dma_frag.fragment.offset,
695 			ldr_xfer_dma_frag.fragment.size,
696 			ldr_xfer_dma_frag.fragment.is_last,
697 			ldr_xfer_dma_frag.ddr_phys_addr);
698 
699 		rv = loader_cl_send(client_data,
700 				    (u8 *)&ldr_xfer_dma_frag,
701 				    sizeof(ldr_xfer_dma_frag),
702 				    (u8 *)&ldr_xfer_dma_frag_ack,
703 				    sizeof(ldr_xfer_dma_frag_ack));
704 		if (rv < 0) {
705 			client_data->flag_retry = true;
706 			goto end_err_resp_buf_release;
707 		}
708 
709 		fragment_offset += fragment_size;
710 	}
711 
712 end_err_resp_buf_release:
713 	dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy);
714 	return rv;
715 }
716 
717 /**
718  * ish_fw_start() -	Start executing ISH main firmware
719  * @client_data:	client data instance
720  *
721  * This function sends message to Shim firmware loader to start
722  * the execution of ISH main firmware.
723  *
724  * Return: 0 for success, negative error code for failure.
725  */
726 static int ish_fw_start(struct ishtp_cl_data *client_data)
727 {
728 	struct loader_start ldr_start;
729 	struct loader_msg_hdr ldr_start_ack;
730 
731 	memset(&ldr_start, 0, sizeof(ldr_start));
732 	ldr_start.hdr.command = LOADER_CMD_START;
733 	return loader_cl_send(client_data,
734 			    (u8 *)&ldr_start,
735 			    sizeof(ldr_start),
736 			    (u8 *)&ldr_start_ack,
737 			    sizeof(ldr_start_ack));
738 }
739 
740 /**
741  * load_fw_from_host() - Loads ISH firmware from host
742  * @client_data:	Client data instance
743  *
744  * This function loads the ISH firmware to ISH SRAM and starts execution
745  *
746  * Return: 0 for success, negative error code for failure.
747  */
748 static int load_fw_from_host(struct ishtp_cl_data *client_data)
749 {
750 	int rv;
751 	u32 xfer_mode;
752 	char *filename;
753 	const struct firmware *fw;
754 	struct shim_fw_info fw_info;
755 	struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
756 
757 	client_data->flag_retry = false;
758 
759 	filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
760 	if (!filename) {
761 		client_data->flag_retry = true;
762 		rv = -ENOMEM;
763 		goto end_error;
764 	}
765 
766 	/* Get filename of the ISH firmware to be loaded */
767 	rv = get_firmware_variant(client_data, filename);
768 	if (rv < 0)
769 		goto end_err_filename_buf_release;
770 
771 	rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
772 	if (rv < 0)
773 		goto end_err_filename_buf_release;
774 
775 	/* Step 1: Query Shim firmware loader properties */
776 
777 	rv = ish_query_loader_prop(client_data, fw, &fw_info);
778 	if (rv < 0)
779 		goto end_err_fw_release;
780 
781 	/* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
782 
783 	xfer_mode = fw_info.ldr_capability.xfer_mode;
784 	if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
785 		rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
786 	} else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
787 		rv = ish_fw_xfer_ishtp(client_data, fw);
788 	} else {
789 		dev_err(cl_data_to_dev(client_data),
790 			"No transfer mode selected in firmware\n");
791 		rv = -EINVAL;
792 	}
793 	if (rv < 0)
794 		goto end_err_fw_release;
795 
796 	/* Step 3: Start ISH main firmware exeuction */
797 
798 	rv = ish_fw_start(client_data);
799 	if (rv < 0)
800 		goto end_err_fw_release;
801 
802 	release_firmware(fw);
803 	dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
804 		 filename);
805 	kfree(filename);
806 	return 0;
807 
808 end_err_fw_release:
809 	release_firmware(fw);
810 end_err_filename_buf_release:
811 	kfree(filename);
812 end_error:
813 	/* Keep a count of retries, and give up after 3 attempts */
814 	if (client_data->flag_retry &&
815 	    client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
816 		dev_warn(cl_data_to_dev(client_data),
817 			 "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
818 			 rv);
819 		ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
820 	} else {
821 		dev_err(cl_data_to_dev(client_data),
822 			"ISH host firmware load failed %d\n", rv);
823 	}
824 	return rv;
825 }
826 
827 static void load_fw_from_host_handler(struct work_struct *work)
828 {
829 	struct ishtp_cl_data *client_data;
830 
831 	client_data = container_of(work, struct ishtp_cl_data,
832 				   work_fw_load);
833 	load_fw_from_host(client_data);
834 }
835 
836 /**
837  * loader_init() -	Init function for ISH-TP client
838  * @loader_ishtp_cl:	ISH-TP client instance
839  * @reset:		true if called for init after reset
840  *
841  * Return: 0 for success, negative error code for failure
842  */
843 static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
844 {
845 	int rv;
846 	struct ishtp_fw_client *fw_client;
847 	struct ishtp_cl_data *client_data =
848 		ishtp_get_client_data(loader_ishtp_cl);
849 
850 	dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
851 
852 	rv = ishtp_cl_link(loader_ishtp_cl);
853 	if (rv < 0) {
854 		dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
855 		return rv;
856 	}
857 
858 	/* Connect to firmware client */
859 	ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
860 	ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
861 
862 	fw_client =
863 		ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl),
864 				       &loader_ishtp_id_table[0].guid);
865 	if (!fw_client) {
866 		dev_err(cl_data_to_dev(client_data),
867 			"ISH client uuid not found\n");
868 		rv = -ENOENT;
869 		goto err_cl_unlink;
870 	}
871 
872 	ishtp_cl_set_fw_client_id(loader_ishtp_cl,
873 				  ishtp_get_fw_client_id(fw_client));
874 	ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING);
875 
876 	rv = ishtp_cl_connect(loader_ishtp_cl);
877 	if (rv < 0) {
878 		dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
879 		goto err_cl_unlink;
880 	}
881 
882 	dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
883 
884 	ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
885 
886 	return 0;
887 
888 err_cl_unlink:
889 	ishtp_cl_unlink(loader_ishtp_cl);
890 	return rv;
891 }
892 
893 static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
894 {
895 	ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING);
896 	ishtp_cl_disconnect(loader_ishtp_cl);
897 	ishtp_cl_unlink(loader_ishtp_cl);
898 	ishtp_cl_flush_queues(loader_ishtp_cl);
899 
900 	/* Disband and free all Tx and Rx client-level rings */
901 	ishtp_cl_free(loader_ishtp_cl);
902 }
903 
904 static void reset_handler(struct work_struct *work)
905 {
906 	int rv;
907 	struct ishtp_cl_data *client_data;
908 	struct ishtp_cl *loader_ishtp_cl;
909 	struct ishtp_cl_device *cl_device;
910 
911 	client_data = container_of(work, struct ishtp_cl_data,
912 				   work_ishtp_reset);
913 
914 	loader_ishtp_cl = client_data->loader_ishtp_cl;
915 	cl_device = client_data->cl_device;
916 
917 	/* Unlink, flush queues & start again */
918 	ishtp_cl_unlink(loader_ishtp_cl);
919 	ishtp_cl_flush_queues(loader_ishtp_cl);
920 	ishtp_cl_free(loader_ishtp_cl);
921 
922 	loader_ishtp_cl = ishtp_cl_allocate(cl_device);
923 	if (!loader_ishtp_cl)
924 		return;
925 
926 	ishtp_set_drvdata(cl_device, loader_ishtp_cl);
927 	ishtp_set_client_data(loader_ishtp_cl, client_data);
928 	client_data->loader_ishtp_cl = loader_ishtp_cl;
929 	client_data->cl_device = cl_device;
930 
931 	rv = loader_init(loader_ishtp_cl, 1);
932 	if (rv < 0) {
933 		dev_err(ishtp_device(cl_device), "Reset Failed\n");
934 		return;
935 	}
936 
937 	/* ISH firmware loading from host */
938 	load_fw_from_host(client_data);
939 }
940 
941 /**
942  * loader_ishtp_cl_probe() - ISH-TP client driver probe
943  * @cl_device:		ISH-TP client device instance
944  *
945  * This function gets called on device create on ISH-TP bus
946  *
947  * Return: 0 for success, negative error code for failure
948  */
949 static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
950 {
951 	struct ishtp_cl *loader_ishtp_cl;
952 	struct ishtp_cl_data *client_data;
953 	int rv;
954 
955 	client_data = devm_kzalloc(ishtp_device(cl_device),
956 				   sizeof(*client_data),
957 				   GFP_KERNEL);
958 	if (!client_data)
959 		return -ENOMEM;
960 
961 	loader_ishtp_cl = ishtp_cl_allocate(cl_device);
962 	if (!loader_ishtp_cl)
963 		return -ENOMEM;
964 
965 	ishtp_set_drvdata(cl_device, loader_ishtp_cl);
966 	ishtp_set_client_data(loader_ishtp_cl, client_data);
967 	client_data->loader_ishtp_cl = loader_ishtp_cl;
968 	client_data->cl_device = cl_device;
969 
970 	init_waitqueue_head(&client_data->response.wait_queue);
971 
972 	INIT_WORK(&client_data->work_ishtp_reset,
973 		  reset_handler);
974 	INIT_WORK(&client_data->work_fw_load,
975 		  load_fw_from_host_handler);
976 
977 	rv = loader_init(loader_ishtp_cl, 0);
978 	if (rv < 0) {
979 		ishtp_cl_free(loader_ishtp_cl);
980 		return rv;
981 	}
982 	ishtp_get_device(cl_device);
983 
984 	client_data->retry_count = 0;
985 
986 	/* ISH firmware loading from host */
987 	schedule_work(&client_data->work_fw_load);
988 
989 	return 0;
990 }
991 
992 /**
993  * loader_ishtp_cl_remove() - ISH-TP client driver remove
994  * @cl_device:		ISH-TP client device instance
995  *
996  * This function gets called on device remove on ISH-TP bus
997  *
998  * Return: 0
999  */
1000 static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
1001 {
1002 	struct ishtp_cl_data *client_data;
1003 	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1004 
1005 	client_data = ishtp_get_client_data(loader_ishtp_cl);
1006 
1007 	/*
1008 	 * The sequence of the following two cancel_work_sync() is
1009 	 * important. The work_fw_load can in turn schedue
1010 	 * work_ishtp_reset, so first cancel work_fw_load then
1011 	 * cancel work_ishtp_reset.
1012 	 */
1013 	cancel_work_sync(&client_data->work_fw_load);
1014 	cancel_work_sync(&client_data->work_ishtp_reset);
1015 	loader_deinit(loader_ishtp_cl);
1016 	ishtp_put_device(cl_device);
1017 }
1018 
1019 /**
1020  * loader_ishtp_cl_reset() - ISH-TP client driver reset
1021  * @cl_device:		ISH-TP client device instance
1022  *
1023  * This function gets called on device reset on ISH-TP bus
1024  *
1025  * Return: 0
1026  */
1027 static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
1028 {
1029 	struct ishtp_cl_data *client_data;
1030 	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1031 
1032 	client_data = ishtp_get_client_data(loader_ishtp_cl);
1033 
1034 	schedule_work(&client_data->work_ishtp_reset);
1035 
1036 	return 0;
1037 }
1038 
1039 static struct ishtp_cl_driver	loader_ishtp_cl_driver = {
1040 	.name = "ish-loader",
1041 	.id = loader_ishtp_id_table,
1042 	.probe = loader_ishtp_cl_probe,
1043 	.remove = loader_ishtp_cl_remove,
1044 	.reset = loader_ishtp_cl_reset,
1045 };
1046 
1047 static int __init ish_loader_init(void)
1048 {
1049 	return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
1050 }
1051 
1052 static void __exit ish_loader_exit(void)
1053 {
1054 	ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
1055 }
1056 
1057 late_initcall(ish_loader_init);
1058 module_exit(ish_loader_exit);
1059 
1060 module_param(dma_buf_size_limit, int, 0644);
1061 MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
1062 
1063 MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
1064 MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
1065 
1066 MODULE_LICENSE("GPL v2");
1067