1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * ISH-TP client driver for ISH firmware loading 4 * 5 * Copyright (c) 2019, Intel Corporation. 6 */ 7 8 #include <linux/firmware.h> 9 #include <linux/module.h> 10 #include <linux/pci.h> 11 #include <linux/intel-ish-client-if.h> 12 #include <linux/property.h> 13 #include <asm/cacheflush.h> 14 15 /* Number of times we attempt to load the firmware before giving up */ 16 #define MAX_LOAD_ATTEMPTS 3 17 18 /* ISH TX/RX ring buffer pool size */ 19 #define LOADER_CL_RX_RING_SIZE 1 20 #define LOADER_CL_TX_RING_SIZE 1 21 22 /* 23 * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is 24 * used to temporarily hold the data transferred from host to Shim 25 * firmware loader. Reason for the odd size of 3968 bytes? Each IPC 26 * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the 27 * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can 28 * have a max payload of 3968 bytes (= 32 x 124 payload). 29 */ 30 #define LOADER_SHIM_IPC_BUF_SIZE 3968 31 32 /** 33 * enum ish_loader_commands - ISH loader host commands. 34 * @LOADER_CMD_XFER_QUERY: Query the Shim firmware loader for 35 * capabilities 36 * @LOADER_CMD_XFER_FRAGMENT: Transfer one firmware image fragment at a 37 * time. The command may be executed 38 * multiple times until the entire firmware 39 * image is downloaded to SRAM. 40 * @LOADER_CMD_START: Start executing the main firmware. 41 */ 42 enum ish_loader_commands { 43 LOADER_CMD_XFER_QUERY = 0, 44 LOADER_CMD_XFER_FRAGMENT, 45 LOADER_CMD_START, 46 }; 47 48 /* Command bit mask */ 49 #define CMD_MASK GENMASK(6, 0) 50 #define IS_RESPONSE BIT(7) 51 52 /* 53 * ISH firmware max delay for one transmit failure is 1 Hz, 54 * and firmware will retry 2 times, so 3 Hz is used for timeout. 55 */ 56 #define ISHTP_SEND_TIMEOUT (3 * HZ) 57 58 /* 59 * Loader transfer modes: 60 * 61 * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to 62 * transfer data. This may use IPC or DMA if supported in firmware. 63 * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for 64 * both IPC & DMA (legacy). 65 * 66 * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different 67 * from the sensor data streaming. Here we download a large (300+ Kb) 68 * image directly to ISH SRAM memory. There is limited benefit of 69 * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce 70 * this "direct dma" mode, where we do not use ISH-TP for DMA, but 71 * instead manage the DMA directly in kernel driver and Shim firmware 72 * loader (allocate buffer, break in chucks and transfer). This allows 73 * to overcome 4 Kb limit, and optimize the data flow path in firmware. 74 */ 75 #define LOADER_XFER_MODE_DIRECT_DMA BIT(0) 76 #define LOADER_XFER_MODE_ISHTP BIT(1) 77 78 /* ISH Transport Loader client unique GUID */ 79 static const guid_t loader_ishtp_guid = 80 GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7, 81 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc); 82 83 #define FILENAME_SIZE 256 84 85 /* 86 * The firmware loading latency will be minimum if we can DMA the 87 * entire ISH firmware image in one go. This requires that we allocate 88 * a large DMA buffer in kernel, which could be problematic on some 89 * platforms. So here we limit the DMA buffer size via a module_param. 90 * We default to 4 pages, but a customer can set it to higher limit if 91 * deemed appropriate for his platform. 92 */ 93 static int dma_buf_size_limit = 4 * PAGE_SIZE; 94 95 /** 96 * struct loader_msg_hdr - Header for ISH Loader commands. 97 * @command: LOADER_CMD* commands. Bit 7 is the response. 98 * @reserved: Reserved space 99 * @status: Command response status. Non 0, is error 100 * condition. 101 * 102 * This structure is used as header for every command/data sent/received 103 * between Host driver and ISH Shim firmware loader. 104 */ 105 struct loader_msg_hdr { 106 u8 command; 107 u8 reserved[2]; 108 u8 status; 109 } __packed; 110 111 struct loader_xfer_query { 112 struct loader_msg_hdr hdr; 113 u32 image_size; 114 } __packed; 115 116 struct ish_fw_version { 117 u16 major; 118 u16 minor; 119 u16 hotfix; 120 u16 build; 121 } __packed; 122 123 union loader_version { 124 u32 value; 125 struct { 126 u8 major; 127 u8 minor; 128 u8 hotfix; 129 u8 build; 130 }; 131 } __packed; 132 133 struct loader_capability { 134 u32 max_fw_image_size; 135 u32 xfer_mode; 136 u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */ 137 } __packed; 138 139 struct shim_fw_info { 140 struct ish_fw_version ish_fw_version; 141 u32 protocol_version; 142 union loader_version ldr_version; 143 struct loader_capability ldr_capability; 144 } __packed; 145 146 struct loader_xfer_query_response { 147 struct loader_msg_hdr hdr; 148 struct shim_fw_info fw_info; 149 } __packed; 150 151 struct loader_xfer_fragment { 152 struct loader_msg_hdr hdr; 153 u32 xfer_mode; 154 u32 offset; 155 u32 size; 156 u32 is_last; 157 } __packed; 158 159 struct loader_xfer_ipc_fragment { 160 struct loader_xfer_fragment fragment; 161 u8 data[] ____cacheline_aligned; /* variable length payload here */ 162 } __packed; 163 164 struct loader_xfer_dma_fragment { 165 struct loader_xfer_fragment fragment; 166 u64 ddr_phys_addr; 167 } __packed; 168 169 struct loader_start { 170 struct loader_msg_hdr hdr; 171 } __packed; 172 173 /** 174 * struct response_info - Encapsulate firmware response related 175 * information for passing between function 176 * loader_cl_send() and process_recv() callback. 177 * @data: Copy the data received from firmware here. 178 * @max_size: Max size allocated for the @data buffer. If the 179 * received data exceeds this value, we log an 180 * error. 181 * @size: Actual size of data received from firmware. 182 * @error: Returns 0 for success, negative error code for a 183 * failure in function process_recv(). 184 * @received: Set to true on receiving a valid firmware 185 * response to host command 186 * @wait_queue: Wait queue for Host firmware loading where the 187 * client sends message to ISH firmware and waits 188 * for response 189 */ 190 struct response_info { 191 void *data; 192 size_t max_size; 193 size_t size; 194 int error; 195 bool received; 196 wait_queue_head_t wait_queue; 197 }; 198 199 /* 200 * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data. 201 * @work_ishtp_reset: Work queue for reset handling. 202 * @work_fw_load: Work queue for host firmware loading. 203 * @flag_retry: Flag for indicating host firmware loading should 204 * be retried. 205 * @retry_count: Count the number of retries. 206 * 207 * This structure is used to store data per client. 208 */ 209 struct ishtp_cl_data { 210 struct ishtp_cl *loader_ishtp_cl; 211 struct ishtp_cl_device *cl_device; 212 213 /* 214 * Used for passing firmware response information between 215 * loader_cl_send() and process_recv() callback. 216 */ 217 struct response_info response; 218 219 struct work_struct work_ishtp_reset; 220 struct work_struct work_fw_load; 221 222 /* 223 * In certain failure scenrios, it makes sense to reset the ISH 224 * subsystem and retry Host firmware loading (e.g. bad message 225 * packet, ENOMEM, etc.). On the other hand, failures due to 226 * protocol mismatch, etc., are not recoverable. We do not 227 * retry them. 228 * 229 * If set, the flag indicates that we should re-try the 230 * particular failure. 231 */ 232 bool flag_retry; 233 int retry_count; 234 }; 235 236 #define IPC_FRAGMENT_DATA_PREAMBLE \ 237 offsetof(struct loader_xfer_ipc_fragment, data) 238 239 #define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device) 240 241 /** 242 * get_firmware_variant() - Gets the filename of firmware image to be 243 * loaded based on platform variant. 244 * @client_data: Client data instance. 245 * @filename: Returns firmware filename. 246 * 247 * Queries the firmware-name device property string. 248 * 249 * Return: 0 for success, negative error code for failure. 250 */ 251 static int get_firmware_variant(struct ishtp_cl_data *client_data, 252 char *filename) 253 { 254 int rv; 255 const char *val; 256 struct device *devc = ishtp_get_pci_device(client_data->cl_device); 257 258 rv = device_property_read_string(devc, "firmware-name", &val); 259 if (rv < 0) { 260 dev_err(devc, 261 "Error: ISH firmware-name device property required\n"); 262 return rv; 263 } 264 return snprintf(filename, FILENAME_SIZE, "intel/%s", val); 265 } 266 267 /** 268 * loader_cl_send() Send message from host to firmware 269 * @client_data: Client data instance 270 * @out_msg: Message buffer to be sent to firmware 271 * @out_size: Size of out going message 272 * @in_msg: Message buffer where the incoming data copied. 273 * This buffer is allocated by calling 274 * @in_size: Max size of incoming message 275 * 276 * Return: Number of bytes copied in the in_msg on success, negative 277 * error code on failure. 278 */ 279 static int loader_cl_send(struct ishtp_cl_data *client_data, 280 u8 *out_msg, size_t out_size, 281 u8 *in_msg, size_t in_size) 282 { 283 int rv; 284 struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg; 285 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl; 286 287 dev_dbg(cl_data_to_dev(client_data), 288 "%s: command=%02lx is_response=%u status=%02x\n", 289 __func__, 290 out_hdr->command & CMD_MASK, 291 out_hdr->command & IS_RESPONSE ? 1 : 0, 292 out_hdr->status); 293 294 /* Setup in coming buffer & size */ 295 client_data->response.data = in_msg; 296 client_data->response.max_size = in_size; 297 client_data->response.error = 0; 298 client_data->response.received = false; 299 300 rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size); 301 if (rv < 0) { 302 dev_err(cl_data_to_dev(client_data), 303 "ishtp_cl_send error %d\n", rv); 304 return rv; 305 } 306 307 wait_event_interruptible_timeout(client_data->response.wait_queue, 308 client_data->response.received, 309 ISHTP_SEND_TIMEOUT); 310 if (!client_data->response.received) { 311 dev_err(cl_data_to_dev(client_data), 312 "Timed out for response to command=%02lx", 313 out_hdr->command & CMD_MASK); 314 return -ETIMEDOUT; 315 } 316 317 if (client_data->response.error < 0) 318 return client_data->response.error; 319 320 return client_data->response.size; 321 } 322 323 /** 324 * process_recv() - Receive and parse incoming packet 325 * @loader_ishtp_cl: Client instance to get stats 326 * @rb_in_proc: ISH received message buffer 327 * 328 * Parse the incoming packet. If it is a response packet then it will 329 * update received and wake up the caller waiting to for the response. 330 */ 331 static void process_recv(struct ishtp_cl *loader_ishtp_cl, 332 struct ishtp_cl_rb *rb_in_proc) 333 { 334 struct loader_msg_hdr *hdr; 335 size_t data_len = rb_in_proc->buf_idx; 336 struct ishtp_cl_data *client_data = 337 ishtp_get_client_data(loader_ishtp_cl); 338 339 /* Sanity check */ 340 if (!client_data->response.data) { 341 dev_err(cl_data_to_dev(client_data), 342 "Receiving buffer is null. Should be allocated by calling function\n"); 343 client_data->response.error = -EINVAL; 344 goto end; 345 } 346 347 if (client_data->response.received) { 348 dev_err(cl_data_to_dev(client_data), 349 "Previous firmware message not yet processed\n"); 350 client_data->response.error = -EINVAL; 351 goto end; 352 } 353 /* 354 * All firmware messages have a header. Check buffer size 355 * before accessing elements inside. 356 */ 357 if (!rb_in_proc->buffer.data) { 358 dev_warn(cl_data_to_dev(client_data), 359 "rb_in_proc->buffer.data returned null"); 360 client_data->response.error = -EBADMSG; 361 goto end; 362 } 363 364 if (data_len < sizeof(struct loader_msg_hdr)) { 365 dev_err(cl_data_to_dev(client_data), 366 "data size %zu is less than header %zu\n", 367 data_len, sizeof(struct loader_msg_hdr)); 368 client_data->response.error = -EMSGSIZE; 369 goto end; 370 } 371 372 hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data; 373 374 dev_dbg(cl_data_to_dev(client_data), 375 "%s: command=%02lx is_response=%u status=%02x\n", 376 __func__, 377 hdr->command & CMD_MASK, 378 hdr->command & IS_RESPONSE ? 1 : 0, 379 hdr->status); 380 381 if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) && 382 ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) && 383 ((hdr->command & CMD_MASK) != LOADER_CMD_START)) { 384 dev_err(cl_data_to_dev(client_data), 385 "Invalid command=%02lx\n", 386 hdr->command & CMD_MASK); 387 client_data->response.error = -EPROTO; 388 goto end; 389 } 390 391 if (data_len > client_data->response.max_size) { 392 dev_err(cl_data_to_dev(client_data), 393 "Received buffer size %zu is larger than allocated buffer %zu\n", 394 data_len, client_data->response.max_size); 395 client_data->response.error = -EMSGSIZE; 396 goto end; 397 } 398 399 /* We expect only "response" messages from firmware */ 400 if (!(hdr->command & IS_RESPONSE)) { 401 dev_err(cl_data_to_dev(client_data), 402 "Invalid response to command\n"); 403 client_data->response.error = -EIO; 404 goto end; 405 } 406 407 if (hdr->status) { 408 dev_err(cl_data_to_dev(client_data), 409 "Loader returned status %d\n", 410 hdr->status); 411 client_data->response.error = -EIO; 412 goto end; 413 } 414 415 /* Update the actual received buffer size */ 416 client_data->response.size = data_len; 417 418 /* 419 * Copy the buffer received in firmware response for the 420 * calling thread. 421 */ 422 memcpy(client_data->response.data, 423 rb_in_proc->buffer.data, data_len); 424 425 /* Set flag before waking up the caller */ 426 client_data->response.received = true; 427 428 end: 429 /* Free the buffer */ 430 ishtp_cl_io_rb_recycle(rb_in_proc); 431 rb_in_proc = NULL; 432 433 /* Wake the calling thread */ 434 wake_up_interruptible(&client_data->response.wait_queue); 435 } 436 437 /** 438 * loader_cl_event_cb() - bus driver callback for incoming message 439 * @cl_device: Pointer to the ishtp client device for which this 440 * message is targeted 441 * 442 * Remove the packet from the list and process the message by calling 443 * process_recv 444 */ 445 static void loader_cl_event_cb(struct ishtp_cl_device *cl_device) 446 { 447 struct ishtp_cl_rb *rb_in_proc; 448 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device); 449 450 while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) { 451 /* Process the data packet from firmware */ 452 process_recv(loader_ishtp_cl, rb_in_proc); 453 } 454 } 455 456 /** 457 * ish_query_loader_prop() - Query ISH Shim firmware loader 458 * @client_data: Client data instance 459 * @fw: Pointer to firmware data struct in host memory 460 * @fw_info: Loader firmware properties 461 * 462 * This function queries the ISH Shim firmware loader for capabilities. 463 * 464 * Return: 0 for success, negative error code for failure. 465 */ 466 static int ish_query_loader_prop(struct ishtp_cl_data *client_data, 467 const struct firmware *fw, 468 struct shim_fw_info *fw_info) 469 { 470 int rv; 471 struct loader_xfer_query ldr_xfer_query; 472 struct loader_xfer_query_response ldr_xfer_query_resp; 473 474 memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query)); 475 ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY; 476 ldr_xfer_query.image_size = fw->size; 477 rv = loader_cl_send(client_data, 478 (u8 *)&ldr_xfer_query, 479 sizeof(ldr_xfer_query), 480 (u8 *)&ldr_xfer_query_resp, 481 sizeof(ldr_xfer_query_resp)); 482 if (rv < 0) { 483 client_data->flag_retry = true; 484 *fw_info = (struct shim_fw_info){}; 485 return rv; 486 } 487 488 /* On success, the return value is the received buffer size */ 489 if (rv != sizeof(struct loader_xfer_query_response)) { 490 dev_err(cl_data_to_dev(client_data), 491 "data size %d is not equal to size of loader_xfer_query_response %zu\n", 492 rv, sizeof(struct loader_xfer_query_response)); 493 client_data->flag_retry = true; 494 *fw_info = (struct shim_fw_info){}; 495 return -EMSGSIZE; 496 } 497 498 /* Save fw_info for use outside this function */ 499 *fw_info = ldr_xfer_query_resp.fw_info; 500 501 /* Loader firmware properties */ 502 dev_dbg(cl_data_to_dev(client_data), 503 "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n", 504 fw_info->ish_fw_version.major, 505 fw_info->ish_fw_version.minor, 506 fw_info->ish_fw_version.hotfix, 507 fw_info->ish_fw_version.build, 508 fw_info->protocol_version, 509 fw_info->ldr_version.value); 510 511 dev_dbg(cl_data_to_dev(client_data), 512 "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n", 513 fw_info->ldr_capability.max_fw_image_size, 514 fw_info->ldr_capability.xfer_mode, 515 fw_info->ldr_capability.max_dma_buf_size, 516 dma_buf_size_limit); 517 518 /* Sanity checks */ 519 if (fw_info->ldr_capability.max_fw_image_size < fw->size) { 520 dev_err(cl_data_to_dev(client_data), 521 "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n", 522 fw->size, 523 fw_info->ldr_capability.max_fw_image_size); 524 return -ENOSPC; 525 } 526 527 /* For DMA the buffer size should be multiple of cacheline size */ 528 if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) && 529 (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) { 530 dev_err(cl_data_to_dev(client_data), 531 "Shim firmware loader buffer size %d should be multiple of cacheline\n", 532 fw_info->ldr_capability.max_dma_buf_size); 533 return -EINVAL; 534 } 535 536 return 0; 537 } 538 539 /** 540 * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface 541 * @client_data: Client data instance 542 * @fw: Pointer to firmware data struct in host memory 543 * 544 * This function uses ISH-TP to transfer ISH firmware from host to 545 * ISH SRAM. Lower layers may use IPC or DMA depending on firmware 546 * support. 547 * 548 * Return: 0 for success, negative error code for failure. 549 */ 550 static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data, 551 const struct firmware *fw) 552 { 553 int rv; 554 u32 fragment_offset, fragment_size, payload_max_size; 555 struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag; 556 struct loader_msg_hdr ldr_xfer_ipc_ack; 557 558 payload_max_size = 559 LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE; 560 561 ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL); 562 if (!ldr_xfer_ipc_frag) { 563 client_data->flag_retry = true; 564 return -ENOMEM; 565 } 566 567 ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT; 568 ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP; 569 570 /* Break the firmware image into fragments and send as ISH-TP payload */ 571 fragment_offset = 0; 572 while (fragment_offset < fw->size) { 573 if (fragment_offset + payload_max_size < fw->size) { 574 fragment_size = payload_max_size; 575 ldr_xfer_ipc_frag->fragment.is_last = 0; 576 } else { 577 fragment_size = fw->size - fragment_offset; 578 ldr_xfer_ipc_frag->fragment.is_last = 1; 579 } 580 581 ldr_xfer_ipc_frag->fragment.offset = fragment_offset; 582 ldr_xfer_ipc_frag->fragment.size = fragment_size; 583 memcpy(ldr_xfer_ipc_frag->data, 584 &fw->data[fragment_offset], 585 fragment_size); 586 587 dev_dbg(cl_data_to_dev(client_data), 588 "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n", 589 ldr_xfer_ipc_frag->fragment.offset, 590 ldr_xfer_ipc_frag->fragment.size, 591 ldr_xfer_ipc_frag->fragment.is_last); 592 593 rv = loader_cl_send(client_data, 594 (u8 *)ldr_xfer_ipc_frag, 595 IPC_FRAGMENT_DATA_PREAMBLE + fragment_size, 596 (u8 *)&ldr_xfer_ipc_ack, 597 sizeof(ldr_xfer_ipc_ack)); 598 if (rv < 0) { 599 client_data->flag_retry = true; 600 goto end_err_resp_buf_release; 601 } 602 603 fragment_offset += fragment_size; 604 } 605 606 kfree(ldr_xfer_ipc_frag); 607 return 0; 608 609 end_err_resp_buf_release: 610 /* Free ISH buffer if not done already, in error case */ 611 kfree(ldr_xfer_ipc_frag); 612 return rv; 613 } 614 615 /** 616 * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma 617 * @client_data: Client data instance 618 * @fw: Pointer to firmware data struct in host memory 619 * @fw_info: Loader firmware properties 620 * 621 * Host firmware load is a unique case where we need to download 622 * a large firmware image (200+ Kb). This function implements 623 * direct DMA transfer in kernel and ISH firmware. This allows 624 * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA 625 * directly to ISH UMA at location of choice. 626 * Function depends on corresponding support in ISH firmware. 627 * 628 * Return: 0 for success, negative error code for failure. 629 */ 630 static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, 631 const struct firmware *fw, 632 const struct shim_fw_info fw_info) 633 { 634 int rv; 635 void *dma_buf; 636 dma_addr_t dma_buf_phy; 637 u32 fragment_offset, fragment_size, payload_max_size; 638 struct loader_msg_hdr ldr_xfer_dma_frag_ack; 639 struct loader_xfer_dma_fragment ldr_xfer_dma_frag; 640 struct device *devc = ishtp_get_pci_device(client_data->cl_device); 641 u32 shim_fw_buf_size = 642 fw_info.ldr_capability.max_dma_buf_size; 643 644 /* 645 * payload_max_size should be set to minimum of 646 * (1) Size of firmware to be loaded, 647 * (2) Max DMA buffer size supported by Shim firmware, 648 * (3) DMA buffer size limit set by boot_param dma_buf_size_limit. 649 */ 650 payload_max_size = min3(fw->size, 651 (size_t)shim_fw_buf_size, 652 (size_t)dma_buf_size_limit); 653 654 /* 655 * Buffer size should be multiple of cacheline size 656 * if it's not, select the previous cacheline boundary. 657 */ 658 payload_max_size &= ~(L1_CACHE_BYTES - 1); 659 660 dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32); 661 if (!dma_buf) { 662 client_data->flag_retry = true; 663 return -ENOMEM; 664 } 665 666 dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size, 667 DMA_TO_DEVICE); 668 if (dma_mapping_error(devc, dma_buf_phy)) { 669 dev_err(cl_data_to_dev(client_data), "DMA map failed\n"); 670 client_data->flag_retry = true; 671 rv = -ENOMEM; 672 goto end_err_dma_buf_release; 673 } 674 675 ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT; 676 ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA; 677 ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy; 678 679 /* Send the firmware image in chucks of payload_max_size */ 680 fragment_offset = 0; 681 while (fragment_offset < fw->size) { 682 if (fragment_offset + payload_max_size < fw->size) { 683 fragment_size = payload_max_size; 684 ldr_xfer_dma_frag.fragment.is_last = 0; 685 } else { 686 fragment_size = fw->size - fragment_offset; 687 ldr_xfer_dma_frag.fragment.is_last = 1; 688 } 689 690 ldr_xfer_dma_frag.fragment.offset = fragment_offset; 691 ldr_xfer_dma_frag.fragment.size = fragment_size; 692 memcpy(dma_buf, &fw->data[fragment_offset], fragment_size); 693 694 dma_sync_single_for_device(devc, dma_buf_phy, 695 payload_max_size, 696 DMA_TO_DEVICE); 697 698 /* 699 * Flush cache here because the dma_sync_single_for_device() 700 * does not do for x86. 701 */ 702 clflush_cache_range(dma_buf, payload_max_size); 703 704 dev_dbg(cl_data_to_dev(client_data), 705 "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n", 706 ldr_xfer_dma_frag.fragment.offset, 707 ldr_xfer_dma_frag.fragment.size, 708 ldr_xfer_dma_frag.fragment.is_last, 709 ldr_xfer_dma_frag.ddr_phys_addr); 710 711 rv = loader_cl_send(client_data, 712 (u8 *)&ldr_xfer_dma_frag, 713 sizeof(ldr_xfer_dma_frag), 714 (u8 *)&ldr_xfer_dma_frag_ack, 715 sizeof(ldr_xfer_dma_frag_ack)); 716 if (rv < 0) { 717 client_data->flag_retry = true; 718 goto end_err_resp_buf_release; 719 } 720 721 fragment_offset += fragment_size; 722 } 723 724 dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); 725 kfree(dma_buf); 726 return 0; 727 728 end_err_resp_buf_release: 729 /* Free ISH buffer if not done already, in error case */ 730 dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); 731 end_err_dma_buf_release: 732 kfree(dma_buf); 733 return rv; 734 } 735 736 /** 737 * ish_fw_start() - Start executing ISH main firmware 738 * @client_data: client data instance 739 * 740 * This function sends message to Shim firmware loader to start 741 * the execution of ISH main firmware. 742 * 743 * Return: 0 for success, negative error code for failure. 744 */ 745 static int ish_fw_start(struct ishtp_cl_data *client_data) 746 { 747 struct loader_start ldr_start; 748 struct loader_msg_hdr ldr_start_ack; 749 750 memset(&ldr_start, 0, sizeof(ldr_start)); 751 ldr_start.hdr.command = LOADER_CMD_START; 752 return loader_cl_send(client_data, 753 (u8 *)&ldr_start, 754 sizeof(ldr_start), 755 (u8 *)&ldr_start_ack, 756 sizeof(ldr_start_ack)); 757 } 758 759 /** 760 * load_fw_from_host() - Loads ISH firmware from host 761 * @client_data: Client data instance 762 * 763 * This function loads the ISH firmware to ISH SRAM and starts execution 764 * 765 * Return: 0 for success, negative error code for failure. 766 */ 767 static int load_fw_from_host(struct ishtp_cl_data *client_data) 768 { 769 int rv; 770 u32 xfer_mode; 771 char *filename; 772 const struct firmware *fw; 773 struct shim_fw_info fw_info; 774 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl; 775 776 client_data->flag_retry = false; 777 778 filename = kzalloc(FILENAME_SIZE, GFP_KERNEL); 779 if (!filename) { 780 client_data->flag_retry = true; 781 rv = -ENOMEM; 782 goto end_error; 783 } 784 785 /* Get filename of the ISH firmware to be loaded */ 786 rv = get_firmware_variant(client_data, filename); 787 if (rv < 0) 788 goto end_err_filename_buf_release; 789 790 rv = request_firmware(&fw, filename, cl_data_to_dev(client_data)); 791 if (rv < 0) 792 goto end_err_filename_buf_release; 793 794 /* Step 1: Query Shim firmware loader properties */ 795 796 rv = ish_query_loader_prop(client_data, fw, &fw_info); 797 if (rv < 0) 798 goto end_err_fw_release; 799 800 /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */ 801 802 xfer_mode = fw_info.ldr_capability.xfer_mode; 803 if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) { 804 rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info); 805 } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) { 806 rv = ish_fw_xfer_ishtp(client_data, fw); 807 } else { 808 dev_err(cl_data_to_dev(client_data), 809 "No transfer mode selected in firmware\n"); 810 rv = -EINVAL; 811 } 812 if (rv < 0) 813 goto end_err_fw_release; 814 815 /* Step 3: Start ISH main firmware exeuction */ 816 817 rv = ish_fw_start(client_data); 818 if (rv < 0) 819 goto end_err_fw_release; 820 821 release_firmware(fw); 822 dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n", 823 filename); 824 kfree(filename); 825 return 0; 826 827 end_err_fw_release: 828 release_firmware(fw); 829 end_err_filename_buf_release: 830 kfree(filename); 831 end_error: 832 /* Keep a count of retries, and give up after 3 attempts */ 833 if (client_data->flag_retry && 834 client_data->retry_count++ < MAX_LOAD_ATTEMPTS) { 835 dev_warn(cl_data_to_dev(client_data), 836 "ISH host firmware load failed %d. Resetting ISH, and trying again..\n", 837 rv); 838 ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl)); 839 } else { 840 dev_err(cl_data_to_dev(client_data), 841 "ISH host firmware load failed %d\n", rv); 842 } 843 return rv; 844 } 845 846 static void load_fw_from_host_handler(struct work_struct *work) 847 { 848 struct ishtp_cl_data *client_data; 849 850 client_data = container_of(work, struct ishtp_cl_data, 851 work_fw_load); 852 load_fw_from_host(client_data); 853 } 854 855 /** 856 * loader_init() - Init function for ISH-TP client 857 * @loader_ishtp_cl: ISH-TP client instance 858 * @reset: true if called for init after reset 859 * 860 * Return: 0 for success, negative error code for failure 861 */ 862 static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset) 863 { 864 int rv; 865 struct ishtp_fw_client *fw_client; 866 struct ishtp_cl_data *client_data = 867 ishtp_get_client_data(loader_ishtp_cl); 868 869 dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset); 870 871 rv = ishtp_cl_link(loader_ishtp_cl); 872 if (rv < 0) { 873 dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n"); 874 return rv; 875 } 876 877 /* Connect to firmware client */ 878 ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE); 879 ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE); 880 881 fw_client = 882 ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl), 883 &loader_ishtp_guid); 884 if (!fw_client) { 885 dev_err(cl_data_to_dev(client_data), 886 "ISH client uuid not found\n"); 887 rv = -ENOENT; 888 goto err_cl_unlink; 889 } 890 891 ishtp_cl_set_fw_client_id(loader_ishtp_cl, 892 ishtp_get_fw_client_id(fw_client)); 893 ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING); 894 895 rv = ishtp_cl_connect(loader_ishtp_cl); 896 if (rv < 0) { 897 dev_err(cl_data_to_dev(client_data), "Client connect fail\n"); 898 goto err_cl_unlink; 899 } 900 901 dev_dbg(cl_data_to_dev(client_data), "Client connected\n"); 902 903 ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb); 904 905 return 0; 906 907 err_cl_unlink: 908 ishtp_cl_unlink(loader_ishtp_cl); 909 return rv; 910 } 911 912 static void loader_deinit(struct ishtp_cl *loader_ishtp_cl) 913 { 914 ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING); 915 ishtp_cl_disconnect(loader_ishtp_cl); 916 ishtp_cl_unlink(loader_ishtp_cl); 917 ishtp_cl_flush_queues(loader_ishtp_cl); 918 919 /* Disband and free all Tx and Rx client-level rings */ 920 ishtp_cl_free(loader_ishtp_cl); 921 } 922 923 static void reset_handler(struct work_struct *work) 924 { 925 int rv; 926 struct ishtp_cl_data *client_data; 927 struct ishtp_cl *loader_ishtp_cl; 928 struct ishtp_cl_device *cl_device; 929 930 client_data = container_of(work, struct ishtp_cl_data, 931 work_ishtp_reset); 932 933 loader_ishtp_cl = client_data->loader_ishtp_cl; 934 cl_device = client_data->cl_device; 935 936 /* Unlink, flush queues & start again */ 937 ishtp_cl_unlink(loader_ishtp_cl); 938 ishtp_cl_flush_queues(loader_ishtp_cl); 939 ishtp_cl_free(loader_ishtp_cl); 940 941 loader_ishtp_cl = ishtp_cl_allocate(cl_device); 942 if (!loader_ishtp_cl) 943 return; 944 945 ishtp_set_drvdata(cl_device, loader_ishtp_cl); 946 ishtp_set_client_data(loader_ishtp_cl, client_data); 947 client_data->loader_ishtp_cl = loader_ishtp_cl; 948 client_data->cl_device = cl_device; 949 950 rv = loader_init(loader_ishtp_cl, 1); 951 if (rv < 0) { 952 dev_err(ishtp_device(cl_device), "Reset Failed\n"); 953 return; 954 } 955 956 /* ISH firmware loading from host */ 957 load_fw_from_host(client_data); 958 } 959 960 /** 961 * loader_ishtp_cl_probe() - ISH-TP client driver probe 962 * @cl_device: ISH-TP client device instance 963 * 964 * This function gets called on device create on ISH-TP bus 965 * 966 * Return: 0 for success, negative error code for failure 967 */ 968 static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device) 969 { 970 struct ishtp_cl *loader_ishtp_cl; 971 struct ishtp_cl_data *client_data; 972 int rv; 973 974 client_data = devm_kzalloc(ishtp_device(cl_device), 975 sizeof(*client_data), 976 GFP_KERNEL); 977 if (!client_data) 978 return -ENOMEM; 979 980 loader_ishtp_cl = ishtp_cl_allocate(cl_device); 981 if (!loader_ishtp_cl) 982 return -ENOMEM; 983 984 ishtp_set_drvdata(cl_device, loader_ishtp_cl); 985 ishtp_set_client_data(loader_ishtp_cl, client_data); 986 client_data->loader_ishtp_cl = loader_ishtp_cl; 987 client_data->cl_device = cl_device; 988 989 init_waitqueue_head(&client_data->response.wait_queue); 990 991 INIT_WORK(&client_data->work_ishtp_reset, 992 reset_handler); 993 INIT_WORK(&client_data->work_fw_load, 994 load_fw_from_host_handler); 995 996 rv = loader_init(loader_ishtp_cl, 0); 997 if (rv < 0) { 998 ishtp_cl_free(loader_ishtp_cl); 999 return rv; 1000 } 1001 ishtp_get_device(cl_device); 1002 1003 client_data->retry_count = 0; 1004 1005 /* ISH firmware loading from host */ 1006 schedule_work(&client_data->work_fw_load); 1007 1008 return 0; 1009 } 1010 1011 /** 1012 * loader_ishtp_cl_remove() - ISH-TP client driver remove 1013 * @cl_device: ISH-TP client device instance 1014 * 1015 * This function gets called on device remove on ISH-TP bus 1016 * 1017 * Return: 0 1018 */ 1019 static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device) 1020 { 1021 struct ishtp_cl_data *client_data; 1022 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device); 1023 1024 client_data = ishtp_get_client_data(loader_ishtp_cl); 1025 1026 /* 1027 * The sequence of the following two cancel_work_sync() is 1028 * important. The work_fw_load can in turn schedue 1029 * work_ishtp_reset, so first cancel work_fw_load then 1030 * cancel work_ishtp_reset. 1031 */ 1032 cancel_work_sync(&client_data->work_fw_load); 1033 cancel_work_sync(&client_data->work_ishtp_reset); 1034 loader_deinit(loader_ishtp_cl); 1035 ishtp_put_device(cl_device); 1036 } 1037 1038 /** 1039 * loader_ishtp_cl_reset() - ISH-TP client driver reset 1040 * @cl_device: ISH-TP client device instance 1041 * 1042 * This function gets called on device reset on ISH-TP bus 1043 * 1044 * Return: 0 1045 */ 1046 static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device) 1047 { 1048 struct ishtp_cl_data *client_data; 1049 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device); 1050 1051 client_data = ishtp_get_client_data(loader_ishtp_cl); 1052 1053 schedule_work(&client_data->work_ishtp_reset); 1054 1055 return 0; 1056 } 1057 1058 static struct ishtp_cl_driver loader_ishtp_cl_driver = { 1059 .name = "ish-loader", 1060 .guid = &loader_ishtp_guid, 1061 .probe = loader_ishtp_cl_probe, 1062 .remove = loader_ishtp_cl_remove, 1063 .reset = loader_ishtp_cl_reset, 1064 }; 1065 1066 static int __init ish_loader_init(void) 1067 { 1068 return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE); 1069 } 1070 1071 static void __exit ish_loader_exit(void) 1072 { 1073 ishtp_cl_driver_unregister(&loader_ishtp_cl_driver); 1074 } 1075 1076 late_initcall(ish_loader_init); 1077 module_exit(ish_loader_exit); 1078 1079 module_param(dma_buf_size_limit, int, 0644); 1080 MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes"); 1081 1082 MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver"); 1083 MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>"); 1084 1085 MODULE_LICENSE("GPL v2"); 1086 MODULE_ALIAS("ishtp:*"); 1087