1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2019-2020 Linaro Limited */
3 
4 #include <linux/acpi.h>
5 #include <linux/firmware.h>
6 #include <linux/module.h>
7 #include <linux/pci.h>
8 #include <linux/slab.h>
9 #include <asm/unaligned.h>
10 
11 #include "xhci.h"
12 #include "xhci-trace.h"
13 #include "xhci-pci.h"
14 
15 #define RENESAS_FW_VERSION				0x6C
16 #define RENESAS_ROM_CONFIG				0xF0
17 #define RENESAS_FW_STATUS				0xF4
18 #define RENESAS_FW_STATUS_MSB				0xF5
19 #define RENESAS_ROM_STATUS				0xF6
20 #define RENESAS_ROM_STATUS_MSB				0xF7
21 #define RENESAS_DATA0					0xF8
22 #define RENESAS_DATA1					0xFC
23 
24 #define RENESAS_FW_VERSION_FIELD			GENMASK(23, 7)
25 #define RENESAS_FW_VERSION_OFFSET			8
26 
27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE		BIT(0)
28 #define RENESAS_FW_STATUS_LOCK				BIT(1)
29 #define RENESAS_FW_STATUS_RESULT			GENMASK(6, 4)
30   #define RENESAS_FW_STATUS_INVALID			0
31   #define RENESAS_FW_STATUS_SUCCESS			BIT(4)
32   #define RENESAS_FW_STATUS_ERROR			BIT(5)
33 #define RENESAS_FW_STATUS_SET_DATA0			BIT(8)
34 #define RENESAS_FW_STATUS_SET_DATA1			BIT(9)
35 
36 #define RENESAS_ROM_STATUS_ACCESS			BIT(0)
37 #define RENESAS_ROM_STATUS_ERASE			BIT(1)
38 #define RENESAS_ROM_STATUS_RELOAD			BIT(2)
39 #define RENESAS_ROM_STATUS_RESULT			GENMASK(6, 4)
40   #define RENESAS_ROM_STATUS_NO_RESULT			0
41   #define RENESAS_ROM_STATUS_SUCCESS			BIT(4)
42   #define RENESAS_ROM_STATUS_ERROR			BIT(5)
43 #define RENESAS_ROM_STATUS_SET_DATA0			BIT(8)
44 #define RENESAS_ROM_STATUS_SET_DATA1			BIT(9)
45 #define RENESAS_ROM_STATUS_ROM_EXISTS			BIT(15)
46 
47 #define RENESAS_ROM_ERASE_MAGIC				0x5A65726F
48 #define RENESAS_ROM_WRITE_MAGIC				0x53524F4D
49 
50 #define RENESAS_RETRY	10000
51 #define RENESAS_DELAY	10
52 
53 static int renesas_fw_download_image(struct pci_dev *dev,
54 				     const u32 *fw, size_t step, bool rom)
55 {
56 	size_t i;
57 	int err;
58 	u8 fw_status;
59 	bool data0_or_data1;
60 	u32 status_reg;
61 
62 	if (rom)
63 		status_reg = RENESAS_ROM_STATUS_MSB;
64 	else
65 		status_reg = RENESAS_FW_STATUS_MSB;
66 
67 	/*
68 	 * The hardware does alternate between two 32-bit pages.
69 	 * (This is because each row of the firmware is 8 bytes).
70 	 *
71 	 * for even steps we use DATA0, for odd steps DATA1.
72 	 */
73 	data0_or_data1 = (step & 1) == 1;
74 
75 	/* step+1. Read "Set DATAX" and confirm it is cleared. */
76 	for (i = 0; i < RENESAS_RETRY; i++) {
77 		err = pci_read_config_byte(dev, status_reg, &fw_status);
78 		if (err) {
79 			dev_err(&dev->dev, "Read Status failed: %d\n",
80 				pcibios_err_to_errno(err));
81 			return pcibios_err_to_errno(err);
82 		}
83 		if (!(fw_status & BIT(data0_or_data1)))
84 			break;
85 
86 		udelay(RENESAS_DELAY);
87 	}
88 	if (i == RENESAS_RETRY) {
89 		dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step);
90 		return -ETIMEDOUT;
91 	}
92 
93 	/*
94 	 * step+2. Write FW data to "DATAX".
95 	 * "LSB is left" => force little endian
96 	 */
97 	err = pci_write_config_dword(dev, data0_or_data1 ?
98 				     RENESAS_DATA1 : RENESAS_DATA0,
99 				     (__force u32)cpu_to_le32(fw[step]));
100 	if (err) {
101 		dev_err(&dev->dev, "Write to DATAX failed: %d\n",
102 			pcibios_err_to_errno(err));
103 		return pcibios_err_to_errno(err);
104 	}
105 
106 	udelay(100);
107 
108 	/* step+3. Set "Set DATAX". */
109 	err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1));
110 	if (err) {
111 		dev_err(&dev->dev, "Write config for DATAX failed: %d\n",
112 			pcibios_err_to_errno(err));
113 		return pcibios_err_to_errno(err);
114 	}
115 
116 	return 0;
117 }
118 
119 static int renesas_fw_verify(const void *fw_data,
120 			     size_t length)
121 {
122 	u16 fw_version_pointer;
123 
124 	/*
125 	 * The Firmware's Data Format is describe in
126 	 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124
127 	 */
128 
129 	/*
130 	 * The bootrom chips of the big brother have sizes up to 64k, let's
131 	 * assume that's the biggest the firmware can get.
132 	 */
133 	if (length < 0x1000 || length >= 0x10000) {
134 		pr_err("firmware is size %zd is not (4k - 64k).",
135 			length);
136 		return -EINVAL;
137 	}
138 
139 	/* The First 2 bytes are fixed value (55aa). "LSB on Left" */
140 	if (get_unaligned_le16(fw_data) != 0x55aa) {
141 		pr_err("no valid firmware header found.");
142 		return -EINVAL;
143 	}
144 
145 	/* verify the firmware version position and print it. */
146 	fw_version_pointer = get_unaligned_le16(fw_data + 4);
147 	if (fw_version_pointer + 2 >= length) {
148 		pr_err("fw ver pointer is outside of the firmware image");
149 		return -EINVAL;
150 	}
151 
152 	return 0;
153 }
154 
155 static bool renesas_check_rom(struct pci_dev *pdev)
156 {
157 	u16 rom_status;
158 	int retval;
159 
160 	/* Check if external ROM exists */
161 	retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status);
162 	if (retval)
163 		return false;
164 
165 	rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS;
166 	if (rom_status) {
167 		dev_dbg(&pdev->dev, "External ROM exists\n");
168 		return true; /* External ROM exists */
169 	}
170 
171 	return false;
172 }
173 
174 static int renesas_check_rom_state(struct pci_dev *pdev)
175 {
176 	u16 rom_state;
177 	u32 version;
178 	int err;
179 
180 	/* check FW version */
181 	err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version);
182 	if (err)
183 		return pcibios_err_to_errno(err);
184 
185 	version &= RENESAS_FW_VERSION_FIELD;
186 	version = version >> RENESAS_FW_VERSION_OFFSET;
187 	dev_dbg(&pdev->dev, "Found ROM version: %x\n", version);
188 
189 	/*
190 	 * Test if ROM is present and loaded, if so we can skip everything
191 	 */
192 	err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state);
193 	if (err)
194 		return pcibios_err_to_errno(err);
195 
196 	if (rom_state & RENESAS_ROM_STATUS_ROM_EXISTS) {
197 		/* ROM exists */
198 		dev_dbg(&pdev->dev, "ROM exists\n");
199 
200 		/* Check the "Result Code" Bits (6:4) and act accordingly */
201 		switch (rom_state & RENESAS_ROM_STATUS_RESULT) {
202 		case RENESAS_ROM_STATUS_SUCCESS:
203 			return 0;
204 
205 		case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */
206 			dev_dbg(&pdev->dev, "Unknown ROM status ...\n");
207 			return -ENOENT;
208 
209 		case RENESAS_ROM_STATUS_ERROR: /* Error State */
210 		default: /* All other states are marked as "Reserved states" */
211 			dev_err(&pdev->dev, "Invalid ROM..");
212 			break;
213 		}
214 	}
215 
216 	return -EIO;
217 }
218 
219 static int renesas_fw_check_running(struct pci_dev *pdev)
220 {
221 	u8 fw_state;
222 	int err;
223 
224 	/*
225 	 * Test if the device is actually needing the firmware. As most
226 	 * BIOSes will initialize the device for us. If the device is
227 	 * initialized.
228 	 */
229 	err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state);
230 	if (err)
231 		return pcibios_err_to_errno(err);
232 
233 	/*
234 	 * Check if "FW Download Lock" is locked. If it is and the FW is
235 	 * ready we can simply continue. If the FW is not ready, we have
236 	 * to give up.
237 	 */
238 	if (fw_state & RENESAS_FW_STATUS_LOCK) {
239 		dev_dbg(&pdev->dev, "FW Download Lock is engaged.");
240 
241 		if (fw_state & RENESAS_FW_STATUS_SUCCESS)
242 			return 0;
243 
244 		dev_err(&pdev->dev,
245 			"FW Download Lock is set and FW is not ready. Giving Up.");
246 		return -EIO;
247 	}
248 
249 	/*
250 	 * Check if "FW Download Enable" is set. If someone (us?) tampered
251 	 * with it and it can't be reset, we have to give up too... and
252 	 * ask for a forgiveness and a reboot.
253 	 */
254 	if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) {
255 		dev_err(&pdev->dev,
256 			"FW Download Enable is stale. Giving Up (poweroff/reboot needed).");
257 		return -EIO;
258 	}
259 
260 	/* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */
261 	switch (fw_state & RENESAS_FW_STATUS_RESULT) {
262 	case 0: /* No result yet */
263 		dev_dbg(&pdev->dev, "FW is not ready/loaded yet.");
264 
265 		/* tell the caller, that this device needs the firmware. */
266 		return 1;
267 
268 	case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */
269 		dev_dbg(&pdev->dev, "FW is ready.");
270 		return 0;
271 
272 	case RENESAS_FW_STATUS_ERROR: /* Error State */
273 		dev_err(&pdev->dev,
274 			"hardware is in an error state. Giving up (poweroff/reboot needed).");
275 		return -ENODEV;
276 
277 	default: /* All other states are marked as "Reserved states" */
278 		dev_err(&pdev->dev,
279 			"hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).",
280 			(fw_state & RENESAS_FW_STATUS_RESULT) >> 4);
281 		return -EINVAL;
282 	}
283 }
284 
285 static int renesas_fw_download(struct pci_dev *pdev,
286 			       const struct firmware *fw)
287 {
288 	const u32 *fw_data = (const u32 *)fw->data;
289 	size_t i;
290 	int err;
291 	u8 fw_status;
292 
293 	/*
294 	 * For more information and the big picture: please look at the
295 	 * "Firmware Download Sequence" in "7.1 FW Download Interface"
296 	 * of R19UH0078EJ0500 Rev.5.00 page 131
297 	 */
298 
299 	/*
300 	 * 0. Set "FW Download Enable" bit in the
301 	 * "FW Download Control & Status Register" at 0xF4
302 	 */
303 	err = pci_write_config_byte(pdev, RENESAS_FW_STATUS,
304 				    RENESAS_FW_STATUS_DOWNLOAD_ENABLE);
305 	if (err)
306 		return pcibios_err_to_errno(err);
307 
308 	/* 1 - 10 follow one step after the other. */
309 	for (i = 0; i < fw->size / 4; i++) {
310 		err = renesas_fw_download_image(pdev, fw_data, i, false);
311 		if (err) {
312 			dev_err(&pdev->dev,
313 				"Firmware Download Step %zd failed at position %zd bytes with (%d).",
314 				i, i * 4, err);
315 			return err;
316 		}
317 	}
318 
319 	/*
320 	 * This sequence continues until the last data is written to
321 	 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1"
322 	 * is cleared by the hardware beforehand.
323 	 */
324 	for (i = 0; i < RENESAS_RETRY; i++) {
325 		err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB,
326 					   &fw_status);
327 		if (err)
328 			return pcibios_err_to_errno(err);
329 		if (!(fw_status & (BIT(0) | BIT(1))))
330 			break;
331 
332 		udelay(RENESAS_DELAY);
333 	}
334 	if (i == RENESAS_RETRY)
335 		dev_warn(&pdev->dev, "Final Firmware Download step timed out.");
336 
337 	/*
338 	 * 11. After finishing writing the last data of FW, the
339 	 * System Software must clear "FW Download Enable"
340 	 */
341 	err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0);
342 	if (err)
343 		return pcibios_err_to_errno(err);
344 
345 	/* 12. Read "Result Code" and confirm it is good. */
346 	for (i = 0; i < RENESAS_RETRY; i++) {
347 		err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status);
348 		if (err)
349 			return pcibios_err_to_errno(err);
350 		if (fw_status & RENESAS_FW_STATUS_SUCCESS)
351 			break;
352 
353 		udelay(RENESAS_DELAY);
354 	}
355 	if (i == RENESAS_RETRY) {
356 		/* Timed out / Error - let's see if we can fix this */
357 		err = renesas_fw_check_running(pdev);
358 		switch (err) {
359 		case 0: /*
360 			 * we shouldn't end up here.
361 			 * maybe it took a little bit longer.
362 			 * But all should be well?
363 			 */
364 			break;
365 
366 		case 1: /* (No result yet! */
367 			dev_err(&pdev->dev, "FW Load timedout");
368 			return -ETIMEDOUT;
369 
370 		default:
371 			return err;
372 		}
373 	}
374 
375 	return 0;
376 }
377 
378 static void renesas_rom_erase(struct pci_dev *pdev)
379 {
380 	int retval, i;
381 	u8 status;
382 
383 	dev_dbg(&pdev->dev, "Performing ROM Erase...\n");
384 	retval = pci_write_config_dword(pdev, RENESAS_DATA0,
385 					RENESAS_ROM_ERASE_MAGIC);
386 	if (retval) {
387 		dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n",
388 			pcibios_err_to_errno(retval));
389 		return;
390 	}
391 
392 	retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
393 	if (retval) {
394 		dev_err(&pdev->dev, "ROM status read failed: %d\n",
395 			pcibios_err_to_errno(retval));
396 		return;
397 	}
398 	status |= RENESAS_ROM_STATUS_ERASE;
399 	retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status);
400 	if (retval) {
401 		dev_err(&pdev->dev, "ROM erase set word write failed\n");
402 		return;
403 	}
404 
405 	/* sleep a bit while ROM is erased */
406 	msleep(20);
407 
408 	for (i = 0; i < RENESAS_RETRY; i++) {
409 		retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS,
410 					      &status);
411 		status &= RENESAS_ROM_STATUS_ERASE;
412 		if (!status)
413 			break;
414 
415 		mdelay(RENESAS_DELAY);
416 	}
417 
418 	if (i == RENESAS_RETRY)
419 		dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status);
420 
421 	dev_dbg(&pdev->dev, "ROM Erase... Done success\n");
422 }
423 
424 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw)
425 {
426 	const u32 *fw_data = (const u32 *)fw->data;
427 	int err, i;
428 	u8 status;
429 
430 	/* 2. Write magic word to Data0 */
431 	err = pci_write_config_dword(pdev, RENESAS_DATA0,
432 				     RENESAS_ROM_WRITE_MAGIC);
433 	if (err)
434 		return false;
435 
436 	/* 3. Set External ROM access */
437 	err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
438 				    RENESAS_ROM_STATUS_ACCESS);
439 	if (err)
440 		goto remove_bypass;
441 
442 	/* 4. Check the result */
443 	err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
444 	if (err)
445 		goto remove_bypass;
446 	status &= GENMASK(6, 4);
447 	if (status) {
448 		dev_err(&pdev->dev,
449 			"setting external rom failed: %x\n", status);
450 		goto remove_bypass;
451 	}
452 
453 	/* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */
454 	for (i = 0; i < fw->size / 4; i++) {
455 		err = renesas_fw_download_image(pdev, fw_data, i, true);
456 		if (err) {
457 			dev_err(&pdev->dev,
458 				"ROM Download Step %d failed at position %d bytes with (%d)\n",
459 				 i, i * 4, err);
460 			goto remove_bypass;
461 		}
462 	}
463 
464 	/*
465 	 * wait till DATA0/1 is cleared
466 	 */
467 	for (i = 0; i < RENESAS_RETRY; i++) {
468 		err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB,
469 					   &status);
470 		if (err)
471 			goto remove_bypass;
472 		if (!(status & (BIT(0) | BIT(1))))
473 			break;
474 
475 		udelay(RENESAS_DELAY);
476 	}
477 	if (i == RENESAS_RETRY) {
478 		dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n");
479 		goto remove_bypass;
480 	}
481 
482 	/* 17. Remove bypass */
483 	err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
484 	if (err)
485 		return false;
486 
487 	udelay(10);
488 
489 	/* 18. check result */
490 	for (i = 0; i < RENESAS_RETRY; i++) {
491 		err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
492 		if (err) {
493 			dev_err(&pdev->dev, "Read ROM status failed:%d\n",
494 				pcibios_err_to_errno(err));
495 			return false;
496 		}
497 		status &= RENESAS_ROM_STATUS_RESULT;
498 		if (status ==  RENESAS_ROM_STATUS_SUCCESS) {
499 			dev_dbg(&pdev->dev, "Download ROM success\n");
500 			break;
501 		}
502 		udelay(RENESAS_DELAY);
503 	}
504 	if (i == RENESAS_RETRY) { /* Timed out */
505 		dev_err(&pdev->dev,
506 			"Download to external ROM TO: %x\n", status);
507 		return false;
508 	}
509 
510 	dev_dbg(&pdev->dev, "Download to external ROM succeeded\n");
511 
512 	/* Last step set Reload */
513 	err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
514 				    RENESAS_ROM_STATUS_RELOAD);
515 	if (err) {
516 		dev_err(&pdev->dev, "Set ROM execute failed: %d\n",
517 			pcibios_err_to_errno(err));
518 		return false;
519 	}
520 
521 	/*
522 	 * wait till Reload is cleared
523 	 */
524 	for (i = 0; i < RENESAS_RETRY; i++) {
525 		err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
526 		if (err)
527 			return false;
528 		if (!(status & RENESAS_ROM_STATUS_RELOAD))
529 			break;
530 
531 		udelay(RENESAS_DELAY);
532 	}
533 	if (i == RENESAS_RETRY) {
534 		dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status);
535 		return false;
536 	}
537 
538 	return true;
539 
540 remove_bypass:
541 	pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
542 	return false;
543 }
544 
545 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw)
546 {
547 	int err = 0;
548 	bool rom;
549 
550 	/* Check if the device has external ROM */
551 	rom = renesas_check_rom(pdev);
552 	if (rom) {
553 		/* perform chip erase first */
554 		renesas_rom_erase(pdev);
555 
556 		/* lets try loading fw on ROM first */
557 		rom = renesas_setup_rom(pdev, fw);
558 		if (!rom) {
559 			dev_dbg(&pdev->dev,
560 				"ROM load failed, falling back on FW load\n");
561 		} else {
562 			dev_dbg(&pdev->dev,
563 				"ROM load success\n");
564 			goto exit;
565 		}
566 	}
567 
568 	err = renesas_fw_download(pdev, fw);
569 
570 exit:
571 	if (err)
572 		dev_err(&pdev->dev, "firmware failed to download (%d).", err);
573 	return err;
574 }
575 
576 int renesas_xhci_check_request_fw(struct pci_dev *pdev,
577 				  const struct pci_device_id *id)
578 {
579 	struct xhci_driver_data *driver_data =
580 			(struct xhci_driver_data *)id->driver_data;
581 	const char *fw_name = driver_data->firmware;
582 	const struct firmware *fw;
583 	bool has_rom;
584 	int err;
585 
586 	/* Check if device has ROM and loaded, if so skip everything */
587 	has_rom = renesas_check_rom(pdev);
588 	if (has_rom) {
589 		err = renesas_check_rom_state(pdev);
590 		if (!err)
591 			return 0;
592 		else if (err != -ENOENT)
593 			has_rom = false;
594 	}
595 
596 	err = renesas_fw_check_running(pdev);
597 	/* Continue ahead, if the firmware is already running. */
598 	if (!err)
599 		return 0;
600 
601 	/* no firmware interface available */
602 	if (err != 1)
603 		return has_rom ? 0 : err;
604 
605 	pci_dev_get(pdev);
606 	err = firmware_request_nowarn(&fw, fw_name, &pdev->dev);
607 	pci_dev_put(pdev);
608 	if (err) {
609 		if (has_rom) {
610 			dev_info(&pdev->dev, "failed to load firmware %s, fallback to ROM\n",
611 				 fw_name);
612 			return 0;
613 		}
614 		dev_err(&pdev->dev, "failed to load firmware %s: %d\n",
615 			fw_name, err);
616 		return err;
617 	}
618 
619 	err = renesas_fw_verify(fw->data, fw->size);
620 	if (err)
621 		goto exit;
622 
623 	err = renesas_load_fw(pdev, fw);
624 exit:
625 	release_firmware(fw);
626 	return err;
627 }
628 EXPORT_SYMBOL_GPL(renesas_xhci_check_request_fw);
629 
630 MODULE_LICENSE("GPL v2");
631