1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2 /*
3  * Copyright(c) 2020-2021 Intel Corporation
4  */
5 
6 #include "iwl-drv.h"
7 #include "pnvm.h"
8 #include "iwl-prph.h"
9 #include "iwl-io.h"
10 #include "fw/api/commands.h"
11 #include "fw/api/nvm-reg.h"
12 #include "fw/api/alive.h"
13 #include <linux/efi.h>
14 
15 struct iwl_pnvm_section {
16 	__le32 offset;
17 	const u8 data[];
18 } __packed;
19 
20 static bool iwl_pnvm_complete_fn(struct iwl_notif_wait_data *notif_wait,
21 				 struct iwl_rx_packet *pkt, void *data)
22 {
23 	struct iwl_trans *trans = (struct iwl_trans *)data;
24 	struct iwl_pnvm_init_complete_ntfy *pnvm_ntf = (void *)pkt->data;
25 
26 	IWL_DEBUG_FW(trans,
27 		     "PNVM complete notification received with status %d\n",
28 		     le32_to_cpu(pnvm_ntf->status));
29 
30 	return true;
31 }
32 
33 static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data,
34 				   size_t len)
35 {
36 	struct iwl_ucode_tlv *tlv;
37 	u32 sha1 = 0;
38 	u16 mac_type = 0, rf_id = 0;
39 	u8 *pnvm_data = NULL, *tmp;
40 	u32 size = 0;
41 	int ret;
42 
43 	IWL_DEBUG_FW(trans, "Handling PNVM section\n");
44 
45 	while (len >= sizeof(*tlv)) {
46 		u32 tlv_len, tlv_type;
47 
48 		len -= sizeof(*tlv);
49 		tlv = (void *)data;
50 
51 		tlv_len = le32_to_cpu(tlv->length);
52 		tlv_type = le32_to_cpu(tlv->type);
53 
54 		if (len < tlv_len) {
55 			IWL_ERR(trans, "invalid TLV len: %zd/%u\n",
56 				len, tlv_len);
57 			ret = -EINVAL;
58 			goto out;
59 		}
60 
61 		data += sizeof(*tlv);
62 
63 		switch (tlv_type) {
64 		case IWL_UCODE_TLV_PNVM_VERSION:
65 			if (tlv_len < sizeof(__le32)) {
66 				IWL_DEBUG_FW(trans,
67 					     "Invalid size for IWL_UCODE_TLV_PNVM_VERSION (expected %zd, got %d)\n",
68 					     sizeof(__le32), tlv_len);
69 				break;
70 			}
71 
72 			sha1 = le32_to_cpup((__le32 *)data);
73 
74 			IWL_DEBUG_FW(trans,
75 				     "Got IWL_UCODE_TLV_PNVM_VERSION %0x\n",
76 				     sha1);
77 			break;
78 		case IWL_UCODE_TLV_HW_TYPE:
79 			if (tlv_len < 2 * sizeof(__le16)) {
80 				IWL_DEBUG_FW(trans,
81 					     "Invalid size for IWL_UCODE_TLV_HW_TYPE (expected %zd, got %d)\n",
82 					     2 * sizeof(__le16), tlv_len);
83 				break;
84 			}
85 
86 			mac_type = le16_to_cpup((__le16 *)data);
87 			rf_id = le16_to_cpup((__le16 *)(data + sizeof(__le16)));
88 
89 			IWL_DEBUG_FW(trans,
90 				     "Got IWL_UCODE_TLV_HW_TYPE mac_type 0x%0x rf_id 0x%0x\n",
91 				     mac_type, rf_id);
92 
93 			if (mac_type != CSR_HW_REV_TYPE(trans->hw_rev) ||
94 			    rf_id != CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
95 				IWL_DEBUG_FW(trans,
96 					     "HW mismatch, skipping PNVM section, mac_type 0x%0x, rf_id 0x%0x.\n",
97 					     CSR_HW_REV_TYPE(trans->hw_rev), trans->hw_rf_id);
98 				ret = -ENOENT;
99 				goto out;
100 			}
101 
102 			break;
103 		case IWL_UCODE_TLV_SEC_RT: {
104 			struct iwl_pnvm_section *section = (void *)data;
105 			u32 data_len = tlv_len - sizeof(*section);
106 
107 			IWL_DEBUG_FW(trans,
108 				     "Got IWL_UCODE_TLV_SEC_RT len %d\n",
109 				     tlv_len);
110 
111 			/* TODO: remove, this is a deprecated separator */
112 			if (le32_to_cpup((__le32 *)data) == 0xddddeeee) {
113 				IWL_DEBUG_FW(trans, "Ignoring separator.\n");
114 				break;
115 			}
116 
117 			IWL_DEBUG_FW(trans, "Adding data (size %d)\n",
118 				     data_len);
119 
120 			tmp = krealloc(pnvm_data, size + data_len, GFP_KERNEL);
121 			if (!tmp) {
122 				IWL_DEBUG_FW(trans,
123 					     "Couldn't allocate (more) pnvm_data\n");
124 
125 				ret = -ENOMEM;
126 				goto out;
127 			}
128 
129 			pnvm_data = tmp;
130 
131 			memcpy(pnvm_data + size, section->data, data_len);
132 
133 			size += data_len;
134 
135 			break;
136 		}
137 		case IWL_UCODE_TLV_PNVM_SKU:
138 			IWL_DEBUG_FW(trans,
139 				     "New PNVM section started, stop parsing.\n");
140 			goto done;
141 		default:
142 			IWL_DEBUG_FW(trans, "Found TLV 0x%0x, len %d\n",
143 				     tlv_type, tlv_len);
144 			break;
145 		}
146 
147 		len -= ALIGN(tlv_len, 4);
148 		data += ALIGN(tlv_len, 4);
149 	}
150 
151 done:
152 	if (!size) {
153 		IWL_DEBUG_FW(trans, "Empty PNVM, skipping.\n");
154 		ret = -ENOENT;
155 		goto out;
156 	}
157 
158 	IWL_INFO(trans, "loaded PNVM version 0x%0x\n", sha1);
159 
160 	ret = iwl_trans_set_pnvm(trans, pnvm_data, size);
161 out:
162 	kfree(pnvm_data);
163 	return ret;
164 }
165 
166 static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
167 			  size_t len)
168 {
169 	struct iwl_ucode_tlv *tlv;
170 
171 	IWL_DEBUG_FW(trans, "Parsing PNVM file\n");
172 
173 	while (len >= sizeof(*tlv)) {
174 		u32 tlv_len, tlv_type;
175 
176 		len -= sizeof(*tlv);
177 		tlv = (void *)data;
178 
179 		tlv_len = le32_to_cpu(tlv->length);
180 		tlv_type = le32_to_cpu(tlv->type);
181 
182 		if (len < tlv_len) {
183 			IWL_ERR(trans, "invalid TLV len: %zd/%u\n",
184 				len, tlv_len);
185 			return -EINVAL;
186 		}
187 
188 		if (tlv_type == IWL_UCODE_TLV_PNVM_SKU) {
189 			struct iwl_sku_id *sku_id =
190 				(void *)(data + sizeof(*tlv));
191 
192 			IWL_DEBUG_FW(trans,
193 				     "Got IWL_UCODE_TLV_PNVM_SKU len %d\n",
194 				     tlv_len);
195 			IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n",
196 				     le32_to_cpu(sku_id->data[0]),
197 				     le32_to_cpu(sku_id->data[1]),
198 				     le32_to_cpu(sku_id->data[2]));
199 
200 			data += sizeof(*tlv) + ALIGN(tlv_len, 4);
201 			len -= ALIGN(tlv_len, 4);
202 
203 			if (trans->sku_id[0] == le32_to_cpu(sku_id->data[0]) &&
204 			    trans->sku_id[1] == le32_to_cpu(sku_id->data[1]) &&
205 			    trans->sku_id[2] == le32_to_cpu(sku_id->data[2])) {
206 				int ret;
207 
208 				ret = iwl_pnvm_handle_section(trans, data, len);
209 				if (!ret)
210 					return 0;
211 			} else {
212 				IWL_DEBUG_FW(trans, "SKU ID didn't match!\n");
213 			}
214 		} else {
215 			data += sizeof(*tlv) + ALIGN(tlv_len, 4);
216 			len -= ALIGN(tlv_len, 4);
217 		}
218 	}
219 
220 	return -ENOENT;
221 }
222 
223 #if defined(CONFIG_EFI)
224 
225 #define IWL_EFI_VAR_GUID EFI_GUID(0x92daaf2f, 0xc02b, 0x455b,	\
226 				  0xb2, 0xec, 0xf5, 0xa3,	\
227 				  0x59, 0x4f, 0x4a, 0xea)
228 
229 #define IWL_UEFI_OEM_PNVM_NAME	L"UefiCnvWlanOemSignedPnvm"
230 
231 #define IWL_HARDCODED_PNVM_SIZE 4096
232 
233 struct pnvm_sku_package {
234 	u8 rev;
235 	u8 reserved1[3];
236 	u32 total_size;
237 	u8 n_skus;
238 	u8 reserved2[11];
239 	u8 data[];
240 };
241 
242 static int iwl_pnvm_get_from_efi(struct iwl_trans *trans,
243 				 u8 **data, size_t *len)
244 {
245 	struct efivar_entry *pnvm_efivar;
246 	struct pnvm_sku_package *package;
247 	unsigned long package_size;
248 	int err;
249 
250 	pnvm_efivar = kzalloc(sizeof(*pnvm_efivar), GFP_KERNEL);
251 	if (!pnvm_efivar)
252 		return -ENOMEM;
253 
254 	memcpy(&pnvm_efivar->var.VariableName, IWL_UEFI_OEM_PNVM_NAME,
255 	       sizeof(IWL_UEFI_OEM_PNVM_NAME));
256 	pnvm_efivar->var.VendorGuid = IWL_EFI_VAR_GUID;
257 
258 	/*
259 	 * TODO: we hardcode a maximum length here, because reading
260 	 * from the UEFI is not working.  To implement this properly,
261 	 * we have to call efivar_entry_size().
262 	 */
263 	package_size = IWL_HARDCODED_PNVM_SIZE;
264 
265 	package = kmalloc(package_size, GFP_KERNEL);
266 	if (!package) {
267 		err = -ENOMEM;
268 		goto out;
269 	}
270 
271 	err = efivar_entry_get(pnvm_efivar, NULL, &package_size, package);
272 	if (err) {
273 		IWL_DEBUG_FW(trans,
274 			     "PNVM UEFI variable not found %d (len %zd)\n",
275 			     err, package_size);
276 		goto out;
277 	}
278 
279 	IWL_DEBUG_FW(trans, "Read PNVM fro UEFI with size %zd\n", package_size);
280 
281 	*data = kmemdup(package->data, *len, GFP_KERNEL);
282 	if (!*data)
283 		err = -ENOMEM;
284 	*len = package_size - sizeof(*package);
285 
286 out:
287 	kfree(package);
288 	kfree(pnvm_efivar);
289 
290 	return err;
291 }
292 #else /* CONFIG_EFI */
293 static inline int iwl_pnvm_get_from_efi(struct iwl_trans *trans,
294 					u8 **data, size_t *len)
295 {
296 	return -EOPNOTSUPP;
297 }
298 #endif /* CONFIG_EFI */
299 
300 static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len)
301 {
302 	const struct firmware *pnvm;
303 	char pnvm_name[64];
304 	int ret;
305 
306 	/*
307 	 * The prefix unfortunately includes a hyphen at the end, so
308 	 * don't add the dot here...
309 	 */
310 	snprintf(pnvm_name, sizeof(pnvm_name), "%spnvm",
311 		 trans->cfg->fw_name_pre);
312 
313 	/* ...but replace the hyphen with the dot here. */
314 	if (strlen(trans->cfg->fw_name_pre) < sizeof(pnvm_name))
315 		pnvm_name[strlen(trans->cfg->fw_name_pre) - 1] = '.';
316 
317 	ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev);
318 	if (ret) {
319 		IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n",
320 			     pnvm_name, ret);
321 		return ret;
322 	}
323 
324 	*data = kmemdup(pnvm->data, pnvm->size, GFP_KERNEL);
325 	if (!*data)
326 		return -ENOMEM;
327 
328 	*len = pnvm->size;
329 
330 	return 0;
331 }
332 
333 int iwl_pnvm_load(struct iwl_trans *trans,
334 		  struct iwl_notif_wait_data *notif_wait)
335 {
336 	u8 *data;
337 	size_t len;
338 	struct iwl_notification_wait pnvm_wait;
339 	static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP,
340 						PNVM_INIT_COMPLETE_NTFY) };
341 	int ret;
342 
343 	/* if the SKU_ID is empty, there's nothing to do */
344 	if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
345 		return 0;
346 
347 	/*
348 	 * If we already loaded (or tried to load) it before, we just
349 	 * need to set it again.
350 	 */
351 	if (trans->pnvm_loaded) {
352 		ret = iwl_trans_set_pnvm(trans, NULL, 0);
353 		if (ret)
354 			return ret;
355 		goto skip_parse;
356 	}
357 
358 	/* First attempt to get the PNVM from BIOS */
359 	ret = iwl_pnvm_get_from_efi(trans, &data, &len);
360 	if (!ret)
361 		goto parse;
362 
363 	/* If it's not available, try from the filesystem */
364 	ret = iwl_pnvm_get_from_fs(trans, &data, &len);
365 	if (ret) {
366 		/*
367 		 * Pretend we've loaded it - at least we've tried and
368 		 * couldn't load it at all, so there's no point in
369 		 * trying again over and over.
370 		 */
371 		trans->pnvm_loaded = true;
372 
373 		goto skip_parse;
374 	}
375 
376 parse:
377 	iwl_pnvm_parse(trans, data, len);
378 
379 	kfree(data);
380 
381 skip_parse:
382 	iwl_init_notification_wait(notif_wait, &pnvm_wait,
383 				   ntf_cmds, ARRAY_SIZE(ntf_cmds),
384 				   iwl_pnvm_complete_fn, trans);
385 
386 	/* kick the doorbell */
387 	iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6,
388 			    UREG_DOORBELL_TO_ISR6_PNVM);
389 
390 	return iwl_wait_notification(notif_wait, &pnvm_wait,
391 				     MVM_UCODE_PNVM_TIMEOUT);
392 }
393 IWL_EXPORT_SYMBOL(iwl_pnvm_load);
394