1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (C) 2019-2020 Linaro Limited */ 3 4 #include <linux/acpi.h> 5 #include <linux/firmware.h> 6 #include <linux/module.h> 7 #include <linux/pci.h> 8 #include <linux/slab.h> 9 #include <linux/unaligned/access_ok.h> 10 11 #include "xhci.h" 12 #include "xhci-trace.h" 13 #include "xhci-pci.h" 14 15 #define RENESAS_FW_VERSION 0x6C 16 #define RENESAS_ROM_CONFIG 0xF0 17 #define RENESAS_FW_STATUS 0xF4 18 #define RENESAS_FW_STATUS_MSB 0xF5 19 #define RENESAS_ROM_STATUS 0xF6 20 #define RENESAS_ROM_STATUS_MSB 0xF7 21 #define RENESAS_DATA0 0xF8 22 #define RENESAS_DATA1 0xFC 23 24 #define RENESAS_FW_VERSION_FIELD GENMASK(23, 7) 25 #define RENESAS_FW_VERSION_OFFSET 8 26 27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE BIT(0) 28 #define RENESAS_FW_STATUS_LOCK BIT(1) 29 #define RENESAS_FW_STATUS_RESULT GENMASK(6, 4) 30 #define RENESAS_FW_STATUS_INVALID 0 31 #define RENESAS_FW_STATUS_SUCCESS BIT(4) 32 #define RENESAS_FW_STATUS_ERROR BIT(5) 33 #define RENESAS_FW_STATUS_SET_DATA0 BIT(8) 34 #define RENESAS_FW_STATUS_SET_DATA1 BIT(9) 35 36 #define RENESAS_ROM_STATUS_ACCESS BIT(0) 37 #define RENESAS_ROM_STATUS_ERASE BIT(1) 38 #define RENESAS_ROM_STATUS_RELOAD BIT(2) 39 #define RENESAS_ROM_STATUS_RESULT GENMASK(6, 4) 40 #define RENESAS_ROM_STATUS_NO_RESULT 0 41 #define RENESAS_ROM_STATUS_SUCCESS BIT(4) 42 #define RENESAS_ROM_STATUS_ERROR BIT(5) 43 #define RENESAS_ROM_STATUS_SET_DATA0 BIT(8) 44 #define RENESAS_ROM_STATUS_SET_DATA1 BIT(9) 45 #define RENESAS_ROM_STATUS_ROM_EXISTS BIT(15) 46 47 #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F 48 #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D 49 50 #define RENESAS_RETRY 10000 51 #define RENESAS_DELAY 10 52 53 #define ROM_VALID_01 0x2013 54 #define ROM_VALID_02 0x2026 55 56 static int renesas_verify_fw_version(struct pci_dev *pdev, u32 version) 57 { 58 switch (version) { 59 case ROM_VALID_01: 60 case ROM_VALID_02: 61 return 0; 62 } 63 dev_err(&pdev->dev, "FW has invalid version :%d\n", version); 64 return -EINVAL; 65 } 66 67 static int renesas_fw_download_image(struct pci_dev *dev, 68 const u32 *fw, size_t step, bool rom) 69 { 70 size_t i; 71 int err; 72 u8 fw_status; 73 bool data0_or_data1; 74 u32 status_reg; 75 76 if (rom) 77 status_reg = RENESAS_ROM_STATUS_MSB; 78 else 79 status_reg = RENESAS_FW_STATUS_MSB; 80 81 /* 82 * The hardware does alternate between two 32-bit pages. 83 * (This is because each row of the firmware is 8 bytes). 84 * 85 * for even steps we use DATA0, for odd steps DATA1. 86 */ 87 data0_or_data1 = (step & 1) == 1; 88 89 /* step+1. Read "Set DATAX" and confirm it is cleared. */ 90 for (i = 0; i < RENESAS_RETRY; i++) { 91 err = pci_read_config_byte(dev, status_reg, &fw_status); 92 if (err) { 93 dev_err(&dev->dev, "Read Status failed: %d\n", 94 pcibios_err_to_errno(err)); 95 return pcibios_err_to_errno(err); 96 } 97 if (!(fw_status & BIT(data0_or_data1))) 98 break; 99 100 udelay(RENESAS_DELAY); 101 } 102 if (i == RENESAS_RETRY) { 103 dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step); 104 return -ETIMEDOUT; 105 } 106 107 /* 108 * step+2. Write FW data to "DATAX". 109 * "LSB is left" => force little endian 110 */ 111 err = pci_write_config_dword(dev, data0_or_data1 ? 112 RENESAS_DATA1 : RENESAS_DATA0, 113 (__force u32)cpu_to_le32(fw[step])); 114 if (err) { 115 dev_err(&dev->dev, "Write to DATAX failed: %d\n", 116 pcibios_err_to_errno(err)); 117 return pcibios_err_to_errno(err); 118 } 119 120 udelay(100); 121 122 /* step+3. Set "Set DATAX". */ 123 err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1)); 124 if (err) { 125 dev_err(&dev->dev, "Write config for DATAX failed: %d\n", 126 pcibios_err_to_errno(err)); 127 return pcibios_err_to_errno(err); 128 } 129 130 return 0; 131 } 132 133 static int renesas_fw_verify(const void *fw_data, 134 size_t length) 135 { 136 u16 fw_version_pointer; 137 u16 fw_version; 138 139 /* 140 * The Firmware's Data Format is describe in 141 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124 142 */ 143 144 /* 145 * The bootrom chips of the big brother have sizes up to 64k, let's 146 * assume that's the biggest the firmware can get. 147 */ 148 if (length < 0x1000 || length >= 0x10000) { 149 pr_err("firmware is size %zd is not (4k - 64k).", 150 length); 151 return -EINVAL; 152 } 153 154 /* The First 2 bytes are fixed value (55aa). "LSB on Left" */ 155 if (get_unaligned_le16(fw_data) != 0x55aa) { 156 pr_err("no valid firmware header found."); 157 return -EINVAL; 158 } 159 160 /* verify the firmware version position and print it. */ 161 fw_version_pointer = get_unaligned_le16(fw_data + 4); 162 if (fw_version_pointer + 2 >= length) { 163 pr_err("fw ver pointer is outside of the firmware image"); 164 return -EINVAL; 165 } 166 167 fw_version = get_unaligned_le16(fw_data + fw_version_pointer); 168 pr_err("got firmware version: %02x.", fw_version); 169 170 return 0; 171 } 172 173 static bool renesas_check_rom(struct pci_dev *pdev) 174 { 175 u16 rom_status; 176 int retval; 177 178 /* Check if external ROM exists */ 179 retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status); 180 if (retval) 181 return false; 182 183 rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS; 184 if (rom_status) { 185 dev_dbg(&pdev->dev, "External ROM exists\n"); 186 return true; /* External ROM exists */ 187 } 188 189 return false; 190 } 191 192 static int renesas_check_rom_state(struct pci_dev *pdev) 193 { 194 u16 rom_state; 195 u32 version; 196 int err; 197 198 /* check FW version */ 199 err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version); 200 if (err) 201 return pcibios_err_to_errno(err); 202 203 version &= RENESAS_FW_VERSION_FIELD; 204 version = version >> RENESAS_FW_VERSION_OFFSET; 205 206 err = renesas_verify_fw_version(pdev, version); 207 if (err) 208 return err; 209 210 /* 211 * Test if ROM is present and loaded, if so we can skip everything 212 */ 213 err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state); 214 if (err) 215 return pcibios_err_to_errno(err); 216 217 if (rom_state & BIT(15)) { 218 /* ROM exists */ 219 dev_dbg(&pdev->dev, "ROM exists\n"); 220 221 /* Check the "Result Code" Bits (6:4) and act accordingly */ 222 switch (rom_state & RENESAS_ROM_STATUS_RESULT) { 223 case RENESAS_ROM_STATUS_SUCCESS: 224 return 0; 225 226 case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */ 227 return 0; 228 229 case RENESAS_ROM_STATUS_ERROR: /* Error State */ 230 default: /* All other states are marked as "Reserved states" */ 231 dev_err(&pdev->dev, "Invalid ROM.."); 232 break; 233 } 234 } 235 236 return -EIO; 237 } 238 239 static int renesas_fw_check_running(struct pci_dev *pdev) 240 { 241 u8 fw_state; 242 int err; 243 244 /* Check if device has ROM and loaded, if so skip everything */ 245 err = renesas_check_rom(pdev); 246 if (err) { /* we have rom */ 247 err = renesas_check_rom_state(pdev); 248 if (!err) 249 return err; 250 } 251 252 /* 253 * Test if the device is actually needing the firmware. As most 254 * BIOSes will initialize the device for us. If the device is 255 * initialized. 256 */ 257 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state); 258 if (err) 259 return pcibios_err_to_errno(err); 260 261 /* 262 * Check if "FW Download Lock" is locked. If it is and the FW is 263 * ready we can simply continue. If the FW is not ready, we have 264 * to give up. 265 */ 266 if (fw_state & RENESAS_FW_STATUS_LOCK) { 267 dev_dbg(&pdev->dev, "FW Download Lock is engaged."); 268 269 if (fw_state & RENESAS_FW_STATUS_SUCCESS) 270 return 0; 271 272 dev_err(&pdev->dev, 273 "FW Download Lock is set and FW is not ready. Giving Up."); 274 return -EIO; 275 } 276 277 /* 278 * Check if "FW Download Enable" is set. If someone (us?) tampered 279 * with it and it can't be reset, we have to give up too... and 280 * ask for a forgiveness and a reboot. 281 */ 282 if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) { 283 dev_err(&pdev->dev, 284 "FW Download Enable is stale. Giving Up (poweroff/reboot needed)."); 285 return -EIO; 286 } 287 288 /* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */ 289 switch (fw_state & RENESAS_FW_STATUS_RESULT) { 290 case 0: /* No result yet */ 291 dev_dbg(&pdev->dev, "FW is not ready/loaded yet."); 292 293 /* tell the caller, that this device needs the firmware. */ 294 return 1; 295 296 case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */ 297 dev_dbg(&pdev->dev, "FW is ready."); 298 return 0; 299 300 case RENESAS_FW_STATUS_ERROR: /* Error State */ 301 dev_err(&pdev->dev, 302 "hardware is in an error state. Giving up (poweroff/reboot needed)."); 303 return -ENODEV; 304 305 default: /* All other states are marked as "Reserved states" */ 306 dev_err(&pdev->dev, 307 "hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).", 308 (fw_state & RENESAS_FW_STATUS_RESULT) >> 4); 309 return -EINVAL; 310 } 311 } 312 313 static int renesas_fw_download(struct pci_dev *pdev, 314 const struct firmware *fw) 315 { 316 const u32 *fw_data = (const u32 *)fw->data; 317 size_t i; 318 int err; 319 u8 fw_status; 320 321 /* 322 * For more information and the big picture: please look at the 323 * "Firmware Download Sequence" in "7.1 FW Download Interface" 324 * of R19UH0078EJ0500 Rev.5.00 page 131 325 */ 326 327 /* 328 * 0. Set "FW Download Enable" bit in the 329 * "FW Download Control & Status Register" at 0xF4 330 */ 331 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 332 RENESAS_FW_STATUS_DOWNLOAD_ENABLE); 333 if (err) 334 return pcibios_err_to_errno(err); 335 336 /* 1 - 10 follow one step after the other. */ 337 for (i = 0; i < fw->size / 4; i++) { 338 err = renesas_fw_download_image(pdev, fw_data, i, false); 339 if (err) { 340 dev_err(&pdev->dev, 341 "Firmware Download Step %zd failed at position %zd bytes with (%d).", 342 i, i * 4, err); 343 return err; 344 } 345 } 346 347 /* 348 * This sequence continues until the last data is written to 349 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1" 350 * is cleared by the hardware beforehand. 351 */ 352 for (i = 0; i < RENESAS_RETRY; i++) { 353 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB, 354 &fw_status); 355 if (err) 356 return pcibios_err_to_errno(err); 357 if (!(fw_status & (BIT(0) | BIT(1)))) 358 break; 359 360 udelay(RENESAS_DELAY); 361 } 362 if (i == RENESAS_RETRY) 363 dev_warn(&pdev->dev, "Final Firmware Download step timed out."); 364 365 /* 366 * 11. After finishing writing the last data of FW, the 367 * System Software must clear "FW Download Enable" 368 */ 369 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0); 370 if (err) 371 return pcibios_err_to_errno(err); 372 373 /* 12. Read "Result Code" and confirm it is good. */ 374 for (i = 0; i < RENESAS_RETRY; i++) { 375 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status); 376 if (err) 377 return pcibios_err_to_errno(err); 378 if (fw_status & RENESAS_FW_STATUS_SUCCESS) 379 break; 380 381 udelay(RENESAS_DELAY); 382 } 383 if (i == RENESAS_RETRY) { 384 /* Timed out / Error - let's see if we can fix this */ 385 err = renesas_fw_check_running(pdev); 386 switch (err) { 387 case 0: /* 388 * we shouldn't end up here. 389 * maybe it took a little bit longer. 390 * But all should be well? 391 */ 392 break; 393 394 case 1: /* (No result yet! */ 395 dev_err(&pdev->dev, "FW Load timedout"); 396 return -ETIMEDOUT; 397 398 default: 399 return err; 400 } 401 } 402 403 return 0; 404 } 405 406 static void renesas_rom_erase(struct pci_dev *pdev) 407 { 408 int retval, i; 409 u8 status; 410 411 dev_dbg(&pdev->dev, "Performing ROM Erase...\n"); 412 retval = pci_write_config_dword(pdev, RENESAS_DATA0, 413 RENESAS_ROM_ERASE_MAGIC); 414 if (retval) { 415 dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n", 416 pcibios_err_to_errno(retval)); 417 return; 418 } 419 420 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 421 if (retval) { 422 dev_err(&pdev->dev, "ROM status read failed: %d\n", 423 pcibios_err_to_errno(retval)); 424 return; 425 } 426 status |= RENESAS_ROM_STATUS_ERASE; 427 retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status); 428 if (retval) { 429 dev_err(&pdev->dev, "ROM erase set word write failed\n"); 430 return; 431 } 432 433 /* sleep a bit while ROM is erased */ 434 msleep(20); 435 436 for (i = 0; i < RENESAS_RETRY; i++) { 437 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, 438 &status); 439 status &= RENESAS_ROM_STATUS_ERASE; 440 if (!status) 441 break; 442 443 mdelay(RENESAS_DELAY); 444 } 445 446 if (i == RENESAS_RETRY) 447 dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status); 448 449 dev_dbg(&pdev->dev, "ROM Erase... Done success\n"); 450 } 451 452 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw) 453 { 454 const u32 *fw_data = (const u32 *)fw->data; 455 int err, i; 456 u8 status; 457 458 /* 2. Write magic word to Data0 */ 459 err = pci_write_config_dword(pdev, RENESAS_DATA0, 460 RENESAS_ROM_WRITE_MAGIC); 461 if (err) 462 return false; 463 464 /* 3. Set External ROM access */ 465 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 466 RENESAS_ROM_STATUS_ACCESS); 467 if (err) 468 goto remove_bypass; 469 470 /* 4. Check the result */ 471 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 472 if (err) 473 goto remove_bypass; 474 status &= GENMASK(6, 4); 475 if (status) { 476 dev_err(&pdev->dev, 477 "setting external rom failed: %x\n", status); 478 goto remove_bypass; 479 } 480 481 /* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */ 482 for (i = 0; i < fw->size / 4; i++) { 483 err = renesas_fw_download_image(pdev, fw_data, i, true); 484 if (err) { 485 dev_err(&pdev->dev, 486 "ROM Download Step %d failed at position %d bytes with (%d)\n", 487 i, i * 4, err); 488 goto remove_bypass; 489 } 490 } 491 492 /* 493 * wait till DATA0/1 is cleared 494 */ 495 for (i = 0; i < RENESAS_RETRY; i++) { 496 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB, 497 &status); 498 if (err) 499 goto remove_bypass; 500 if (!(status & (BIT(0) | BIT(1)))) 501 break; 502 503 udelay(RENESAS_DELAY); 504 } 505 if (i == RENESAS_RETRY) { 506 dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n"); 507 goto remove_bypass; 508 } 509 510 /* 17. Remove bypass */ 511 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 512 if (err) 513 return false; 514 515 udelay(10); 516 517 /* 18. check result */ 518 for (i = 0; i < RENESAS_RETRY; i++) { 519 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 520 if (err) { 521 dev_err(&pdev->dev, "Read ROM status failed:%d\n", 522 pcibios_err_to_errno(err)); 523 return false; 524 } 525 status &= RENESAS_ROM_STATUS_RESULT; 526 if (status == RENESAS_ROM_STATUS_SUCCESS) { 527 dev_dbg(&pdev->dev, "Download ROM success\n"); 528 break; 529 } 530 udelay(RENESAS_DELAY); 531 } 532 if (i == RENESAS_RETRY) { /* Timed out */ 533 dev_err(&pdev->dev, 534 "Download to external ROM TO: %x\n", status); 535 return false; 536 } 537 538 dev_dbg(&pdev->dev, "Download to external ROM succeeded\n"); 539 540 /* Last step set Reload */ 541 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 542 RENESAS_ROM_STATUS_RELOAD); 543 if (err) { 544 dev_err(&pdev->dev, "Set ROM execute failed: %d\n", 545 pcibios_err_to_errno(err)); 546 return false; 547 } 548 549 /* 550 * wait till Reload is cleared 551 */ 552 for (i = 0; i < RENESAS_RETRY; i++) { 553 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 554 if (err) 555 return false; 556 if (!(status & RENESAS_ROM_STATUS_RELOAD)) 557 break; 558 559 udelay(RENESAS_DELAY); 560 } 561 if (i == RENESAS_RETRY) { 562 dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status); 563 return false; 564 } 565 566 return true; 567 568 remove_bypass: 569 pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 570 return false; 571 } 572 573 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw) 574 { 575 int err = 0; 576 bool rom; 577 578 /* Check if the device has external ROM */ 579 rom = renesas_check_rom(pdev); 580 if (rom) { 581 /* perform chip erase first */ 582 renesas_rom_erase(pdev); 583 584 /* lets try loading fw on ROM first */ 585 rom = renesas_setup_rom(pdev, fw); 586 if (!rom) { 587 dev_dbg(&pdev->dev, 588 "ROM load failed, falling back on FW load\n"); 589 } else { 590 dev_dbg(&pdev->dev, 591 "ROM load success\n"); 592 goto exit; 593 } 594 } 595 596 err = renesas_fw_download(pdev, fw); 597 598 exit: 599 if (err) 600 dev_err(&pdev->dev, "firmware failed to download (%d).", err); 601 return err; 602 } 603 604 int renesas_xhci_check_request_fw(struct pci_dev *pdev, 605 const struct pci_device_id *id) 606 { 607 struct xhci_driver_data *driver_data = 608 (struct xhci_driver_data *)id->driver_data; 609 const char *fw_name = driver_data->firmware; 610 const struct firmware *fw; 611 int err; 612 613 err = renesas_fw_check_running(pdev); 614 /* Continue ahead, if the firmware is already running. */ 615 if (err == 0) 616 return 0; 617 618 if (err != 1) 619 return err; 620 621 pci_dev_get(pdev); 622 err = request_firmware(&fw, fw_name, &pdev->dev); 623 pci_dev_put(pdev); 624 if (err) { 625 dev_err(&pdev->dev, "request_firmware failed: %d\n", err); 626 return err; 627 } 628 629 err = renesas_fw_verify(fw->data, fw->size); 630 if (err) 631 goto exit; 632 633 err = renesas_load_fw(pdev, fw); 634 exit: 635 release_firmware(fw); 636 return err; 637 } 638 EXPORT_SYMBOL_GPL(renesas_xhci_check_request_fw); 639 640 void renesas_xhci_pci_exit(struct pci_dev *dev) 641 { 642 } 643 EXPORT_SYMBOL_GPL(renesas_xhci_pci_exit); 644 645 MODULE_LICENSE("GPL v2"); 646