1 // SPDX-License-Identifier: GPL-2.0-only
2 /* r8169_firmware.c: RealTek 8169/8168/8101 ethernet driver.
3  *
4  * Copyright (c) 2002 ShuChen <shuchen@realtek.com.tw>
5  * Copyright (c) 2003 - 2007 Francois Romieu <romieu@fr.zoreil.com>
6  * Copyright (c) a lot of people too. Please respect their work.
7  *
8  * See MAINTAINERS file for support contact information.
9  */
10 
11 #include <linux/delay.h>
12 #include <linux/firmware.h>
13 
14 #include "r8169_firmware.h"
15 
16 enum rtl_fw_opcode {
17 	PHY_READ		= 0x0,
18 	PHY_DATA_OR		= 0x1,
19 	PHY_DATA_AND		= 0x2,
20 	PHY_BJMPN		= 0x3,
21 	PHY_MDIO_CHG		= 0x4,
22 	PHY_CLEAR_READCOUNT	= 0x7,
23 	PHY_WRITE		= 0x8,
24 	PHY_READCOUNT_EQ_SKIP	= 0x9,
25 	PHY_COMP_EQ_SKIPN	= 0xa,
26 	PHY_COMP_NEQ_SKIPN	= 0xb,
27 	PHY_WRITE_PREVIOUS	= 0xc,
28 	PHY_SKIPN		= 0xd,
29 	PHY_DELAY_MS		= 0xe,
30 };
31 
32 struct fw_info {
33 	u32	magic;
34 	char	version[RTL_VER_SIZE];
35 	__le32	fw_start;
36 	__le32	fw_len;
37 	u8	chksum;
38 } __packed;
39 
40 #define FW_OPCODE_SIZE sizeof_field(struct rtl_fw_phy_action, code[0])
41 
42 static bool rtl_fw_format_ok(struct rtl_fw *rtl_fw)
43 {
44 	const struct firmware *fw = rtl_fw->fw;
45 	struct fw_info *fw_info = (struct fw_info *)fw->data;
46 	struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
47 
48 	if (fw->size < FW_OPCODE_SIZE)
49 		return false;
50 
51 	if (!fw_info->magic) {
52 		size_t i, size, start;
53 		u8 checksum = 0;
54 
55 		if (fw->size < sizeof(*fw_info))
56 			return false;
57 
58 		for (i = 0; i < fw->size; i++)
59 			checksum += fw->data[i];
60 		if (checksum != 0)
61 			return false;
62 
63 		start = le32_to_cpu(fw_info->fw_start);
64 		if (start > fw->size)
65 			return false;
66 
67 		size = le32_to_cpu(fw_info->fw_len);
68 		if (size > (fw->size - start) / FW_OPCODE_SIZE)
69 			return false;
70 
71 		strscpy(rtl_fw->version, fw_info->version, RTL_VER_SIZE);
72 
73 		pa->code = (__le32 *)(fw->data + start);
74 		pa->size = size;
75 	} else {
76 		if (fw->size % FW_OPCODE_SIZE)
77 			return false;
78 
79 		strscpy(rtl_fw->version, rtl_fw->fw_name, RTL_VER_SIZE);
80 
81 		pa->code = (__le32 *)fw->data;
82 		pa->size = fw->size / FW_OPCODE_SIZE;
83 	}
84 
85 	return true;
86 }
87 
88 static bool rtl_fw_data_ok(struct rtl_fw *rtl_fw)
89 {
90 	struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
91 	size_t index;
92 
93 	for (index = 0; index < pa->size; index++) {
94 		u32 action = le32_to_cpu(pa->code[index]);
95 		u32 val = action & 0x0000ffff;
96 		u32 regno = (action & 0x0fff0000) >> 16;
97 
98 		switch (action >> 28) {
99 		case PHY_READ:
100 		case PHY_DATA_OR:
101 		case PHY_DATA_AND:
102 		case PHY_CLEAR_READCOUNT:
103 		case PHY_WRITE:
104 		case PHY_WRITE_PREVIOUS:
105 		case PHY_DELAY_MS:
106 			break;
107 
108 		case PHY_MDIO_CHG:
109 			if (val > 1)
110 				goto out;
111 			break;
112 
113 		case PHY_BJMPN:
114 			if (regno > index)
115 				goto out;
116 			break;
117 		case PHY_READCOUNT_EQ_SKIP:
118 			if (index + 2 >= pa->size)
119 				goto out;
120 			break;
121 		case PHY_COMP_EQ_SKIPN:
122 		case PHY_COMP_NEQ_SKIPN:
123 		case PHY_SKIPN:
124 			if (index + 1 + regno >= pa->size)
125 				goto out;
126 			break;
127 
128 		default:
129 			dev_err(rtl_fw->dev, "Invalid action 0x%08x\n", action);
130 			return false;
131 		}
132 	}
133 
134 	return true;
135 out:
136 	dev_err(rtl_fw->dev, "Out of range of firmware\n");
137 	return false;
138 }
139 
140 void rtl_fw_write_firmware(struct rtl8169_private *tp, struct rtl_fw *rtl_fw)
141 {
142 	struct rtl_fw_phy_action *pa = &rtl_fw->phy_action;
143 	rtl_fw_write_t fw_write = rtl_fw->phy_write;
144 	rtl_fw_read_t fw_read = rtl_fw->phy_read;
145 	int predata = 0, count = 0;
146 	size_t index;
147 
148 	for (index = 0; index < pa->size; index++) {
149 		u32 action = le32_to_cpu(pa->code[index]);
150 		u32 data = action & 0x0000ffff;
151 		u32 regno = (action & 0x0fff0000) >> 16;
152 		enum rtl_fw_opcode opcode = action >> 28;
153 
154 		if (!action)
155 			break;
156 
157 		switch (opcode) {
158 		case PHY_READ:
159 			predata = fw_read(tp, regno);
160 			count++;
161 			break;
162 		case PHY_DATA_OR:
163 			predata |= data;
164 			break;
165 		case PHY_DATA_AND:
166 			predata &= data;
167 			break;
168 		case PHY_BJMPN:
169 			index -= (regno + 1);
170 			break;
171 		case PHY_MDIO_CHG:
172 			if (data) {
173 				fw_write = rtl_fw->mac_mcu_write;
174 				fw_read = rtl_fw->mac_mcu_read;
175 			} else {
176 				fw_write = rtl_fw->phy_write;
177 				fw_read = rtl_fw->phy_read;
178 			}
179 
180 			break;
181 		case PHY_CLEAR_READCOUNT:
182 			count = 0;
183 			break;
184 		case PHY_WRITE:
185 			fw_write(tp, regno, data);
186 			break;
187 		case PHY_READCOUNT_EQ_SKIP:
188 			if (count == data)
189 				index++;
190 			break;
191 		case PHY_COMP_EQ_SKIPN:
192 			if (predata == data)
193 				index += regno;
194 			break;
195 		case PHY_COMP_NEQ_SKIPN:
196 			if (predata != data)
197 				index += regno;
198 			break;
199 		case PHY_WRITE_PREVIOUS:
200 			fw_write(tp, regno, predata);
201 			break;
202 		case PHY_SKIPN:
203 			index += regno;
204 			break;
205 		case PHY_DELAY_MS:
206 			msleep(data);
207 			break;
208 		}
209 	}
210 }
211 
212 void rtl_fw_release_firmware(struct rtl_fw *rtl_fw)
213 {
214 	release_firmware(rtl_fw->fw);
215 }
216 
217 int rtl_fw_request_firmware(struct rtl_fw *rtl_fw)
218 {
219 	int rc;
220 
221 	rc = request_firmware(&rtl_fw->fw, rtl_fw->fw_name, rtl_fw->dev);
222 	if (rc < 0)
223 		goto out;
224 
225 	if (!rtl_fw_format_ok(rtl_fw) || !rtl_fw_data_ok(rtl_fw)) {
226 		release_firmware(rtl_fw->fw);
227 		rc = -EINVAL;
228 		goto out;
229 	}
230 
231 	return 0;
232 out:
233 	dev_err(rtl_fw->dev, "Unable to load firmware %s (%d)\n",
234 		rtl_fw->fw_name, rc);
235 	return rc;
236 }
237