1 /* 2 * Copyright (c) 2014-2017 Qualcomm Atheros, Inc. 3 * 4 * Permission to use, copy, modify, and/or distribute this software for any 5 * purpose with or without fee is hereby granted, provided that the above 6 * copyright notice and this permission notice appear in all copies. 7 * 8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 */ 16 17 /* Algorithmic part of the firmware download. 18 * To be included in the container file providing framework 19 */ 20 21 #define wil_err_fw(wil, fmt, arg...) wil_err(wil, "ERR[ FW ]" fmt, ##arg) 22 #define wil_dbg_fw(wil, fmt, arg...) wil_dbg(wil, "DBG[ FW ]" fmt, ##arg) 23 #define wil_hex_dump_fw(prefix_str, prefix_type, rowsize, \ 24 groupsize, buf, len, ascii) \ 25 print_hex_dump_debug("DBG[ FW ]" prefix_str, \ 26 prefix_type, rowsize, \ 27 groupsize, buf, len, ascii) 28 29 static bool wil_fw_addr_check(struct wil6210_priv *wil, 30 void __iomem **ioaddr, __le32 val, 31 u32 size, const char *msg) 32 { 33 *ioaddr = wmi_buffer_block(wil, val, size); 34 if (!(*ioaddr)) { 35 wil_err_fw(wil, "bad %s: 0x%08x\n", msg, le32_to_cpu(val)); 36 return false; 37 } 38 return true; 39 } 40 41 /** 42 * wil_fw_verify - verify firmware file validity 43 * 44 * perform various checks for the firmware file header. 45 * records are not validated. 46 * 47 * Return file size or negative error 48 */ 49 static int wil_fw_verify(struct wil6210_priv *wil, const u8 *data, size_t size) 50 { 51 const struct wil_fw_record_head *hdr = (const void *)data; 52 struct wil_fw_record_file_header fh; 53 const struct wil_fw_record_file_header *fh_; 54 u32 crc; 55 u32 dlen; 56 57 if (size % 4) { 58 wil_err_fw(wil, "image size not aligned: %zu\n", size); 59 return -EINVAL; 60 } 61 /* have enough data for the file header? */ 62 if (size < sizeof(*hdr) + sizeof(fh)) { 63 wil_err_fw(wil, "file too short: %zu bytes\n", size); 64 return -EINVAL; 65 } 66 67 /* start with the file header? */ 68 if (le16_to_cpu(hdr->type) != wil_fw_type_file_header) { 69 wil_err_fw(wil, "no file header\n"); 70 return -EINVAL; 71 } 72 73 /* data_len */ 74 fh_ = (struct wil_fw_record_file_header *)&hdr[1]; 75 dlen = le32_to_cpu(fh_->data_len); 76 if (dlen % 4) { 77 wil_err_fw(wil, "data length not aligned: %lu\n", (ulong)dlen); 78 return -EINVAL; 79 } 80 if (size < dlen) { 81 wil_err_fw(wil, "file truncated at %zu/%lu\n", 82 size, (ulong)dlen); 83 return -EINVAL; 84 } 85 if (dlen < sizeof(*hdr) + sizeof(fh)) { 86 wil_err_fw(wil, "data length too short: %lu\n", (ulong)dlen); 87 return -EINVAL; 88 } 89 90 /* signature */ 91 if (le32_to_cpu(fh_->signature) != WIL_FW_SIGNATURE) { 92 wil_err_fw(wil, "bad header signature: 0x%08x\n", 93 le32_to_cpu(fh_->signature)); 94 return -EINVAL; 95 } 96 97 /* version */ 98 if (le32_to_cpu(fh_->version) > WIL_FW_FMT_VERSION) { 99 wil_err_fw(wil, "unsupported header version: %d\n", 100 le32_to_cpu(fh_->version)); 101 return -EINVAL; 102 } 103 104 /* checksum. ~crc32(~0, data, size) when fh.crc set to 0*/ 105 fh = *fh_; 106 fh.crc = 0; 107 108 crc = crc32_le(~0, (unsigned char const *)hdr, sizeof(*hdr)); 109 crc = crc32_le(crc, (unsigned char const *)&fh, sizeof(fh)); 110 crc = crc32_le(crc, (unsigned char const *)&fh_[1], 111 dlen - sizeof(*hdr) - sizeof(fh)); 112 crc = ~crc; 113 114 if (crc != le32_to_cpu(fh_->crc)) { 115 wil_err_fw(wil, "checksum mismatch:" 116 " calculated for %lu bytes 0x%08x != 0x%08x\n", 117 (ulong)dlen, crc, le32_to_cpu(fh_->crc)); 118 return -EINVAL; 119 } 120 121 return (int)dlen; 122 } 123 124 static int fw_ignore_section(struct wil6210_priv *wil, const void *data, 125 size_t size) 126 { 127 return 0; 128 } 129 130 static int 131 fw_handle_comment(struct wil6210_priv *wil, const void *data, 132 size_t size) 133 { 134 const struct wil_fw_record_capabilities *rec = data; 135 size_t capa_size; 136 137 if (size < sizeof(*rec) || 138 le32_to_cpu(rec->magic) != WIL_FW_CAPABILITIES_MAGIC) { 139 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, 140 data, size, true); 141 return 0; 142 } 143 144 capa_size = size - offsetof(struct wil_fw_record_capabilities, 145 capabilities); 146 bitmap_zero(wil->fw_capabilities, WMI_FW_CAPABILITY_MAX); 147 memcpy(wil->fw_capabilities, rec->capabilities, 148 min(sizeof(wil->fw_capabilities), capa_size)); 149 wil_hex_dump_fw("CAPA", DUMP_PREFIX_OFFSET, 16, 1, 150 rec->capabilities, capa_size, false); 151 return 0; 152 } 153 154 static int fw_handle_data(struct wil6210_priv *wil, const void *data, 155 size_t size) 156 { 157 const struct wil_fw_record_data *d = data; 158 void __iomem *dst; 159 size_t s = size - sizeof(*d); 160 161 if (size < sizeof(*d) + sizeof(u32)) { 162 wil_err_fw(wil, "data record too short: %zu\n", size); 163 return -EINVAL; 164 } 165 166 if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address")) 167 return -EINVAL; 168 wil_dbg_fw(wil, "write [0x%08x] <== %zu bytes\n", le32_to_cpu(d->addr), 169 s); 170 wil_memcpy_toio_32(dst, d->data, s); 171 wmb(); /* finish before processing next record */ 172 173 return 0; 174 } 175 176 static int fw_handle_fill(struct wil6210_priv *wil, const void *data, 177 size_t size) 178 { 179 const struct wil_fw_record_fill *d = data; 180 void __iomem *dst; 181 u32 v; 182 size_t s = (size_t)le32_to_cpu(d->size); 183 184 if (size != sizeof(*d)) { 185 wil_err_fw(wil, "bad size for fill record: %zu\n", size); 186 return -EINVAL; 187 } 188 189 if (s < sizeof(u32)) { 190 wil_err_fw(wil, "fill size too short: %zu\n", s); 191 return -EINVAL; 192 } 193 194 if (s % sizeof(u32)) { 195 wil_err_fw(wil, "fill size not aligned: %zu\n", s); 196 return -EINVAL; 197 } 198 199 if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address")) 200 return -EINVAL; 201 202 v = le32_to_cpu(d->value); 203 wil_dbg_fw(wil, "fill [0x%08x] <== 0x%08x, %zu bytes\n", 204 le32_to_cpu(d->addr), v, s); 205 wil_memset_toio_32(dst, v, s); 206 wmb(); /* finish before processing next record */ 207 208 return 0; 209 } 210 211 static int fw_handle_file_header(struct wil6210_priv *wil, const void *data, 212 size_t size) 213 { 214 const struct wil_fw_record_file_header *d = data; 215 216 if (size != sizeof(*d)) { 217 wil_err_fw(wil, "file header length incorrect: %zu\n", size); 218 return -EINVAL; 219 } 220 221 wil_dbg_fw(wil, "new file, ver. %d, %i bytes\n", 222 d->version, d->data_len); 223 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, d->comment, 224 sizeof(d->comment), true); 225 226 if (!memcmp(d->comment, WIL_FW_VERSION_PREFIX, 227 WIL_FW_VERSION_PREFIX_LEN)) 228 memcpy(wil->fw_version, 229 d->comment + WIL_FW_VERSION_PREFIX_LEN, 230 min(sizeof(d->comment) - WIL_FW_VERSION_PREFIX_LEN, 231 sizeof(wil->fw_version) - 1)); 232 233 return 0; 234 } 235 236 static int fw_handle_direct_write(struct wil6210_priv *wil, const void *data, 237 size_t size) 238 { 239 const struct wil_fw_record_direct_write *d = data; 240 const struct wil_fw_data_dwrite *block = d->data; 241 int n, i; 242 243 if (size % sizeof(*block)) { 244 wil_err_fw(wil, "record size not aligned on %zu: %zu\n", 245 sizeof(*block), size); 246 return -EINVAL; 247 } 248 n = size / sizeof(*block); 249 250 for (i = 0; i < n; i++) { 251 void __iomem *dst; 252 u32 m = le32_to_cpu(block[i].mask); 253 u32 v = le32_to_cpu(block[i].value); 254 u32 x, y; 255 256 if (!wil_fw_addr_check(wil, &dst, block[i].addr, 0, "address")) 257 return -EINVAL; 258 259 x = readl(dst); 260 y = (x & m) | (v & ~m); 261 wil_dbg_fw(wil, "write [0x%08x] <== 0x%08x " 262 "(old 0x%08x val 0x%08x mask 0x%08x)\n", 263 le32_to_cpu(block[i].addr), y, x, v, m); 264 writel(y, dst); 265 wmb(); /* finish before processing next record */ 266 } 267 268 return 0; 269 } 270 271 static int gw_write(struct wil6210_priv *wil, void __iomem *gwa_addr, 272 void __iomem *gwa_cmd, void __iomem *gwa_ctl, u32 gw_cmd, 273 u32 a) 274 { 275 unsigned delay = 0; 276 277 writel(a, gwa_addr); 278 writel(gw_cmd, gwa_cmd); 279 wmb(); /* finish before activate gw */ 280 281 writel(WIL_FW_GW_CTL_RUN, gwa_ctl); /* activate gw */ 282 do { 283 udelay(1); /* typical time is few usec */ 284 if (delay++ > 100) { 285 wil_err_fw(wil, "gw timeout\n"); 286 return -EINVAL; 287 } 288 } while (readl(gwa_ctl) & WIL_FW_GW_CTL_BUSY); /* gw done? */ 289 290 return 0; 291 } 292 293 static int fw_handle_gateway_data(struct wil6210_priv *wil, const void *data, 294 size_t size) 295 { 296 const struct wil_fw_record_gateway_data *d = data; 297 const struct wil_fw_data_gw *block = d->data; 298 void __iomem *gwa_addr; 299 void __iomem *gwa_val; 300 void __iomem *gwa_cmd; 301 void __iomem *gwa_ctl; 302 u32 gw_cmd; 303 int n, i; 304 305 if (size < sizeof(*d) + sizeof(*block)) { 306 wil_err_fw(wil, "gateway record too short: %zu\n", size); 307 return -EINVAL; 308 } 309 310 if ((size - sizeof(*d)) % sizeof(*block)) { 311 wil_err_fw(wil, "gateway record data size" 312 " not aligned on %zu: %zu\n", 313 sizeof(*block), size - sizeof(*d)); 314 return -EINVAL; 315 } 316 n = (size - sizeof(*d)) / sizeof(*block); 317 318 gw_cmd = le32_to_cpu(d->command); 319 320 wil_dbg_fw(wil, "gw write record [%3d] blocks, cmd 0x%08x\n", 321 n, gw_cmd); 322 323 if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0, 324 "gateway_addr_addr") || 325 !wil_fw_addr_check(wil, &gwa_val, d->gateway_value_addr, 0, 326 "gateway_value_addr") || 327 !wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0, 328 "gateway_cmd_addr") || 329 !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0, 330 "gateway_ctrl_address")) 331 return -EINVAL; 332 333 wil_dbg_fw(wil, "gw addresses: addr 0x%08x val 0x%08x" 334 " cmd 0x%08x ctl 0x%08x\n", 335 le32_to_cpu(d->gateway_addr_addr), 336 le32_to_cpu(d->gateway_value_addr), 337 le32_to_cpu(d->gateway_cmd_addr), 338 le32_to_cpu(d->gateway_ctrl_address)); 339 340 for (i = 0; i < n; i++) { 341 int rc; 342 u32 a = le32_to_cpu(block[i].addr); 343 u32 v = le32_to_cpu(block[i].value); 344 345 wil_dbg_fw(wil, " gw write[%3d] [0x%08x] <== 0x%08x\n", 346 i, a, v); 347 348 writel(v, gwa_val); 349 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a); 350 if (rc) 351 return rc; 352 } 353 354 return 0; 355 } 356 357 static int fw_handle_gateway_data4(struct wil6210_priv *wil, const void *data, 358 size_t size) 359 { 360 const struct wil_fw_record_gateway_data4 *d = data; 361 const struct wil_fw_data_gw4 *block = d->data; 362 void __iomem *gwa_addr; 363 void __iomem *gwa_val[ARRAY_SIZE(block->value)]; 364 void __iomem *gwa_cmd; 365 void __iomem *gwa_ctl; 366 u32 gw_cmd; 367 int n, i, k; 368 369 if (size < sizeof(*d) + sizeof(*block)) { 370 wil_err_fw(wil, "gateway4 record too short: %zu\n", size); 371 return -EINVAL; 372 } 373 374 if ((size - sizeof(*d)) % sizeof(*block)) { 375 wil_err_fw(wil, "gateway4 record data size" 376 " not aligned on %zu: %zu\n", 377 sizeof(*block), size - sizeof(*d)); 378 return -EINVAL; 379 } 380 n = (size - sizeof(*d)) / sizeof(*block); 381 382 gw_cmd = le32_to_cpu(d->command); 383 384 wil_dbg_fw(wil, "gw4 write record [%3d] blocks, cmd 0x%08x\n", 385 n, gw_cmd); 386 387 if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0, 388 "gateway_addr_addr")) 389 return -EINVAL; 390 for (k = 0; k < ARRAY_SIZE(block->value); k++) 391 if (!wil_fw_addr_check(wil, &gwa_val[k], 392 d->gateway_value_addr[k], 393 0, "gateway_value_addr")) 394 return -EINVAL; 395 if (!wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0, 396 "gateway_cmd_addr") || 397 !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0, 398 "gateway_ctrl_address")) 399 return -EINVAL; 400 401 wil_dbg_fw(wil, "gw4 addresses: addr 0x%08x cmd 0x%08x ctl 0x%08x\n", 402 le32_to_cpu(d->gateway_addr_addr), 403 le32_to_cpu(d->gateway_cmd_addr), 404 le32_to_cpu(d->gateway_ctrl_address)); 405 wil_hex_dump_fw("val addresses: ", DUMP_PREFIX_NONE, 16, 4, 406 d->gateway_value_addr, sizeof(d->gateway_value_addr), 407 false); 408 409 for (i = 0; i < n; i++) { 410 int rc; 411 u32 a = le32_to_cpu(block[i].addr); 412 u32 v[ARRAY_SIZE(block->value)]; 413 414 for (k = 0; k < ARRAY_SIZE(block->value); k++) 415 v[k] = le32_to_cpu(block[i].value[k]); 416 417 wil_dbg_fw(wil, " gw4 write[%3d] [0x%08x] <==\n", i, a); 418 wil_hex_dump_fw(" val ", DUMP_PREFIX_NONE, 16, 4, v, 419 sizeof(v), false); 420 421 for (k = 0; k < ARRAY_SIZE(block->value); k++) 422 writel(v[k], gwa_val[k]); 423 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a); 424 if (rc) 425 return rc; 426 } 427 428 return 0; 429 } 430 431 static const struct { 432 int type; 433 int (*load_handler)(struct wil6210_priv *wil, const void *data, 434 size_t size); 435 int (*parse_handler)(struct wil6210_priv *wil, const void *data, 436 size_t size); 437 } wil_fw_handlers[] = { 438 {wil_fw_type_comment, fw_handle_comment, fw_handle_comment}, 439 {wil_fw_type_data, fw_handle_data, fw_ignore_section}, 440 {wil_fw_type_fill, fw_handle_fill, fw_ignore_section}, 441 /* wil_fw_type_action */ 442 /* wil_fw_type_verify */ 443 {wil_fw_type_file_header, fw_handle_file_header, 444 fw_handle_file_header}, 445 {wil_fw_type_direct_write, fw_handle_direct_write, fw_ignore_section}, 446 {wil_fw_type_gateway_data, fw_handle_gateway_data, fw_ignore_section}, 447 {wil_fw_type_gateway_data4, fw_handle_gateway_data4, 448 fw_ignore_section}, 449 }; 450 451 static int wil_fw_handle_record(struct wil6210_priv *wil, int type, 452 const void *data, size_t size, bool load) 453 { 454 int i; 455 456 for (i = 0; i < ARRAY_SIZE(wil_fw_handlers); i++) 457 if (wil_fw_handlers[i].type == type) 458 return load ? 459 wil_fw_handlers[i].load_handler( 460 wil, data, size) : 461 wil_fw_handlers[i].parse_handler( 462 wil, data, size); 463 464 wil_err_fw(wil, "unknown record type: %d\n", type); 465 return -EINVAL; 466 } 467 468 /** 469 * wil_fw_process - process section from FW file 470 * if load is true: Load the FW and uCode code and data to the 471 * corresponding device memory regions, 472 * otherwise only parse and look for capabilities 473 * 474 * Return error code 475 */ 476 static int wil_fw_process(struct wil6210_priv *wil, const void *data, 477 size_t size, bool load) 478 { 479 int rc = 0; 480 const struct wil_fw_record_head *hdr; 481 size_t s, hdr_sz; 482 483 for (hdr = data;; hdr = (const void *)hdr + s, size -= s) { 484 if (size < sizeof(*hdr)) 485 break; 486 hdr_sz = le32_to_cpu(hdr->size); 487 s = sizeof(*hdr) + hdr_sz; 488 if (s > size) 489 break; 490 if (hdr_sz % 4) { 491 wil_err_fw(wil, "unaligned record size: %zu\n", 492 hdr_sz); 493 return -EINVAL; 494 } 495 rc = wil_fw_handle_record(wil, le16_to_cpu(hdr->type), 496 &hdr[1], hdr_sz, load); 497 if (rc) 498 return rc; 499 } 500 if (size) { 501 wil_err_fw(wil, "unprocessed bytes: %zu\n", size); 502 if (size >= sizeof(*hdr)) { 503 wil_err_fw(wil, "Stop at offset %ld" 504 " record type %d [%zd bytes]\n", 505 (long)((const void *)hdr - data), 506 le16_to_cpu(hdr->type), hdr_sz); 507 } 508 return -EINVAL; 509 } 510 511 return rc; 512 } 513 514 /** 515 * wil_request_firmware - Request firmware 516 * 517 * Request firmware image from the file 518 * If load is true, load firmware to device, otherwise 519 * only parse and extract capabilities 520 * 521 * Return error code 522 */ 523 int wil_request_firmware(struct wil6210_priv *wil, const char *name, 524 bool load) 525 { 526 int rc, rc1; 527 const struct firmware *fw; 528 size_t sz; 529 const void *d; 530 531 rc = request_firmware(&fw, name, wil_to_dev(wil)); 532 if (rc) { 533 wil_err_fw(wil, "Failed to load firmware %s rc %d\n", name, rc); 534 return rc; 535 } 536 wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, fw->size); 537 538 for (sz = fw->size, d = fw->data; sz; sz -= rc1, d += rc1) { 539 rc1 = wil_fw_verify(wil, d, sz); 540 if (rc1 < 0) { 541 rc = rc1; 542 goto out; 543 } 544 rc = wil_fw_process(wil, d, rc1, load); 545 if (rc < 0) 546 goto out; 547 } 548 549 out: 550 release_firmware(fw); 551 return rc; 552 } 553 554 /** 555 * wil_fw_verify_file_exists - checks if firmware file exist 556 * 557 * @wil: driver context 558 * @name: firmware file name 559 * 560 * return value - boolean, true for success, false for failure 561 */ 562 bool wil_fw_verify_file_exists(struct wil6210_priv *wil, const char *name) 563 { 564 const struct firmware *fw; 565 int rc; 566 567 rc = request_firmware(&fw, name, wil_to_dev(wil)); 568 if (!rc) 569 release_firmware(fw); 570 else 571 wil_dbg_fw(wil, "<%s> not available: %d\n", name, rc); 572 return !rc; 573 } 574