firmware.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NCI based driver for Samsung S3FWRN5 NFC chip
  4. *
  5. * Copyright (C) 2015 Samsung Electrnoics
  6. * Robert Baldyga <r.baldyga@samsung.com>
  7. */
  8. #include <linux/completion.h>
  9. #include <linux/firmware.h>
  10. #include <crypto/hash.h>
  11. #include <crypto/sha.h>
  12. #include "s3fwrn5.h"
  13. #include "firmware.h"
  14. struct s3fwrn5_fw_version {
  15. __u8 major;
  16. __u8 build1;
  17. __u8 build2;
  18. __u8 target;
  19. };
  20. static int s3fwrn5_fw_send_msg(struct s3fwrn5_fw_info *fw_info,
  21. struct sk_buff *msg, struct sk_buff **rsp)
  22. {
  23. struct s3fwrn5_info *info =
  24. container_of(fw_info, struct s3fwrn5_info, fw_info);
  25. long ret;
  26. reinit_completion(&fw_info->completion);
  27. ret = s3fwrn5_write(info, msg);
  28. if (ret < 0)
  29. return ret;
  30. ret = wait_for_completion_interruptible_timeout(
  31. &fw_info->completion, msecs_to_jiffies(1000));
  32. if (ret < 0)
  33. return ret;
  34. else if (ret == 0)
  35. return -ENXIO;
  36. if (!fw_info->rsp)
  37. return -EINVAL;
  38. *rsp = fw_info->rsp;
  39. fw_info->rsp = NULL;
  40. return 0;
  41. }
  42. static int s3fwrn5_fw_prep_msg(struct s3fwrn5_fw_info *fw_info,
  43. struct sk_buff **msg, u8 type, u8 code, const void *data, u16 len)
  44. {
  45. struct s3fwrn5_fw_header hdr;
  46. struct sk_buff *skb;
  47. hdr.type = type | fw_info->parity;
  48. fw_info->parity ^= 0x80;
  49. hdr.code = code;
  50. hdr.len = len;
  51. skb = alloc_skb(S3FWRN5_FW_HDR_SIZE + len, GFP_KERNEL);
  52. if (!skb)
  53. return -ENOMEM;
  54. skb_put_data(skb, &hdr, S3FWRN5_FW_HDR_SIZE);
  55. if (len)
  56. skb_put_data(skb, data, len);
  57. *msg = skb;
  58. return 0;
  59. }
  60. static int s3fwrn5_fw_get_bootinfo(struct s3fwrn5_fw_info *fw_info,
  61. struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo)
  62. {
  63. struct sk_buff *msg, *rsp = NULL;
  64. struct s3fwrn5_fw_header *hdr;
  65. int ret;
  66. /* Send GET_BOOTINFO command */
  67. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
  68. S3FWRN5_FW_CMD_GET_BOOTINFO, NULL, 0);
  69. if (ret < 0)
  70. return ret;
  71. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  72. kfree_skb(msg);
  73. if (ret < 0)
  74. return ret;
  75. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  76. if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
  77. ret = -EINVAL;
  78. goto out;
  79. }
  80. memcpy(bootinfo, rsp->data + S3FWRN5_FW_HDR_SIZE, 10);
  81. out:
  82. kfree_skb(rsp);
  83. return ret;
  84. }
  85. static int s3fwrn5_fw_enter_update_mode(struct s3fwrn5_fw_info *fw_info,
  86. const void *hash_data, u16 hash_size,
  87. const void *sig_data, u16 sig_size)
  88. {
  89. struct s3fwrn5_fw_cmd_enter_updatemode args;
  90. struct sk_buff *msg, *rsp = NULL;
  91. struct s3fwrn5_fw_header *hdr;
  92. int ret;
  93. /* Send ENTER_UPDATE_MODE command */
  94. args.hashcode_size = hash_size;
  95. args.signature_size = sig_size;
  96. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
  97. S3FWRN5_FW_CMD_ENTER_UPDATE_MODE, &args, sizeof(args));
  98. if (ret < 0)
  99. return ret;
  100. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  101. kfree_skb(msg);
  102. if (ret < 0)
  103. return ret;
  104. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  105. if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
  106. ret = -EPROTO;
  107. goto out;
  108. }
  109. kfree_skb(rsp);
  110. /* Send hashcode data */
  111. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_DATA, 0,
  112. hash_data, hash_size);
  113. if (ret < 0)
  114. return ret;
  115. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  116. kfree_skb(msg);
  117. if (ret < 0)
  118. return ret;
  119. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  120. if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
  121. ret = -EPROTO;
  122. goto out;
  123. }
  124. kfree_skb(rsp);
  125. /* Send signature data */
  126. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_DATA, 0,
  127. sig_data, sig_size);
  128. if (ret < 0)
  129. return ret;
  130. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  131. kfree_skb(msg);
  132. if (ret < 0)
  133. return ret;
  134. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  135. if (hdr->code != S3FWRN5_FW_RET_SUCCESS)
  136. ret = -EPROTO;
  137. out:
  138. kfree_skb(rsp);
  139. return ret;
  140. }
  141. static int s3fwrn5_fw_update_sector(struct s3fwrn5_fw_info *fw_info,
  142. u32 base_addr, const void *data)
  143. {
  144. struct s3fwrn5_fw_cmd_update_sector args;
  145. struct sk_buff *msg, *rsp = NULL;
  146. struct s3fwrn5_fw_header *hdr;
  147. int ret, i;
  148. /* Send UPDATE_SECTOR command */
  149. args.base_address = base_addr;
  150. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
  151. S3FWRN5_FW_CMD_UPDATE_SECTOR, &args, sizeof(args));
  152. if (ret < 0)
  153. return ret;
  154. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  155. kfree_skb(msg);
  156. if (ret < 0)
  157. return ret;
  158. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  159. if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
  160. ret = -EPROTO;
  161. goto err;
  162. }
  163. kfree_skb(rsp);
  164. /* Send data split into 256-byte packets */
  165. for (i = 0; i < 16; ++i) {
  166. ret = s3fwrn5_fw_prep_msg(fw_info, &msg,
  167. S3FWRN5_FW_MSG_DATA, 0, data+256*i, 256);
  168. if (ret < 0)
  169. break;
  170. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  171. kfree_skb(msg);
  172. if (ret < 0)
  173. break;
  174. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  175. if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
  176. ret = -EPROTO;
  177. goto err;
  178. }
  179. kfree_skb(rsp);
  180. }
  181. return ret;
  182. err:
  183. kfree_skb(rsp);
  184. return ret;
  185. }
  186. static int s3fwrn5_fw_complete_update_mode(struct s3fwrn5_fw_info *fw_info)
  187. {
  188. struct sk_buff *msg, *rsp = NULL;
  189. struct s3fwrn5_fw_header *hdr;
  190. int ret;
  191. /* Send COMPLETE_UPDATE_MODE command */
  192. ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
  193. S3FWRN5_FW_CMD_COMPLETE_UPDATE_MODE, NULL, 0);
  194. if (ret < 0)
  195. return ret;
  196. ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
  197. kfree_skb(msg);
  198. if (ret < 0)
  199. return ret;
  200. hdr = (struct s3fwrn5_fw_header *) rsp->data;
  201. if (hdr->code != S3FWRN5_FW_RET_SUCCESS)
  202. ret = -EPROTO;
  203. kfree_skb(rsp);
  204. return ret;
  205. }
  206. /*
  207. * Firmware header stucture:
  208. *
  209. * 0x00 - 0x0B : Date and time string (w/o NUL termination)
  210. * 0x10 - 0x13 : Firmware version
  211. * 0x14 - 0x17 : Signature address
  212. * 0x18 - 0x1B : Signature size
  213. * 0x1C - 0x1F : Firmware image address
  214. * 0x20 - 0x23 : Firmware sectors count
  215. * 0x24 - 0x27 : Custom signature address
  216. * 0x28 - 0x2B : Custom signature size
  217. */
  218. #define S3FWRN5_FW_IMAGE_HEADER_SIZE 44
  219. static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
  220. {
  221. struct s3fwrn5_fw_image *fw = &fw_info->fw;
  222. u32 sig_off;
  223. u32 image_off;
  224. u32 custom_sig_off;
  225. int ret;
  226. ret = request_firmware(&fw->fw, fw_info->fw_name,
  227. &fw_info->ndev->nfc_dev->dev);
  228. if (ret < 0)
  229. return ret;
  230. if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
  231. release_firmware(fw->fw);
  232. return -EINVAL;
  233. }
  234. memcpy(fw->date, fw->fw->data + 0x00, 12);
  235. fw->date[12] = '\0';
  236. memcpy(&fw->version, fw->fw->data + 0x10, 4);
  237. memcpy(&sig_off, fw->fw->data + 0x14, 4);
  238. fw->sig = fw->fw->data + sig_off;
  239. memcpy(&fw->sig_size, fw->fw->data + 0x18, 4);
  240. memcpy(&image_off, fw->fw->data + 0x1C, 4);
  241. fw->image = fw->fw->data + image_off;
  242. memcpy(&fw->image_sectors, fw->fw->data + 0x20, 4);
  243. memcpy(&custom_sig_off, fw->fw->data + 0x24, 4);
  244. fw->custom_sig = fw->fw->data + custom_sig_off;
  245. memcpy(&fw->custom_sig_size, fw->fw->data + 0x28, 4);
  246. return 0;
  247. }
  248. static void s3fwrn5_fw_release_firmware(struct s3fwrn5_fw_info *fw_info)
  249. {
  250. release_firmware(fw_info->fw.fw);
  251. }
  252. static int s3fwrn5_fw_get_base_addr(
  253. struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo, u32 *base_addr)
  254. {
  255. int i;
  256. static const struct {
  257. u8 version[4];
  258. u32 base_addr;
  259. } match[] = {
  260. {{0x05, 0x00, 0x00, 0x00}, 0x00005000},
  261. {{0x05, 0x00, 0x00, 0x01}, 0x00003000},
  262. {{0x05, 0x00, 0x00, 0x02}, 0x00003000},
  263. {{0x05, 0x00, 0x00, 0x03}, 0x00003000},
  264. {{0x05, 0x00, 0x00, 0x05}, 0x00003000}
  265. };
  266. for (i = 0; i < ARRAY_SIZE(match); ++i)
  267. if (bootinfo->hw_version[0] == match[i].version[0] &&
  268. bootinfo->hw_version[1] == match[i].version[1] &&
  269. bootinfo->hw_version[3] == match[i].version[3]) {
  270. *base_addr = match[i].base_addr;
  271. return 0;
  272. }
  273. return -EINVAL;
  274. }
  275. static inline bool
  276. s3fwrn5_fw_is_custom(const struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo)
  277. {
  278. return !!bootinfo->hw_version[2];
  279. }
  280. int s3fwrn5_fw_setup(struct s3fwrn5_fw_info *fw_info)
  281. {
  282. struct s3fwrn5_fw_cmd_get_bootinfo_rsp bootinfo;
  283. int ret;
  284. /* Get firmware data */
  285. ret = s3fwrn5_fw_request_firmware(fw_info);
  286. if (ret < 0) {
  287. dev_err(&fw_info->ndev->nfc_dev->dev,
  288. "Failed to get fw file, ret=%02x\n", ret);
  289. return ret;
  290. }
  291. /* Get bootloader info */
  292. ret = s3fwrn5_fw_get_bootinfo(fw_info, &bootinfo);
  293. if (ret < 0) {
  294. dev_err(&fw_info->ndev->nfc_dev->dev,
  295. "Failed to get bootinfo, ret=%02x\n", ret);
  296. goto err;
  297. }
  298. /* Match hardware version to obtain firmware base address */
  299. ret = s3fwrn5_fw_get_base_addr(&bootinfo, &fw_info->base_addr);
  300. if (ret < 0) {
  301. dev_err(&fw_info->ndev->nfc_dev->dev,
  302. "Unknown hardware version\n");
  303. goto err;
  304. }
  305. fw_info->sector_size = bootinfo.sector_size;
  306. fw_info->sig_size = s3fwrn5_fw_is_custom(&bootinfo) ?
  307. fw_info->fw.custom_sig_size : fw_info->fw.sig_size;
  308. fw_info->sig = s3fwrn5_fw_is_custom(&bootinfo) ?
  309. fw_info->fw.custom_sig : fw_info->fw.sig;
  310. return 0;
  311. err:
  312. s3fwrn5_fw_release_firmware(fw_info);
  313. return ret;
  314. }
  315. bool s3fwrn5_fw_check_version(const struct s3fwrn5_fw_info *fw_info, u32 version)
  316. {
  317. struct s3fwrn5_fw_version *new = (void *) &fw_info->fw.version;
  318. struct s3fwrn5_fw_version *old = (void *) &version;
  319. if (new->major > old->major)
  320. return true;
  321. if (new->build1 > old->build1)
  322. return true;
  323. if (new->build2 > old->build2)
  324. return true;
  325. return false;
  326. }
  327. int s3fwrn5_fw_download(struct s3fwrn5_fw_info *fw_info)
  328. {
  329. struct s3fwrn5_fw_image *fw = &fw_info->fw;
  330. u8 hash_data[SHA1_DIGEST_SIZE];
  331. struct crypto_shash *tfm;
  332. u32 image_size, off;
  333. int ret;
  334. image_size = fw_info->sector_size * fw->image_sectors;
  335. /* Compute SHA of firmware data */
  336. tfm = crypto_alloc_shash("sha1", 0, 0);
  337. if (IS_ERR(tfm)) {
  338. ret = PTR_ERR(tfm);
  339. dev_err(&fw_info->ndev->nfc_dev->dev,
  340. "Cannot allocate shash (code=%d)\n", ret);
  341. goto out;
  342. }
  343. ret = crypto_shash_tfm_digest(tfm, fw->image, image_size, hash_data);
  344. crypto_free_shash(tfm);
  345. if (ret) {
  346. dev_err(&fw_info->ndev->nfc_dev->dev,
  347. "Cannot compute hash (code=%d)\n", ret);
  348. goto out;
  349. }
  350. /* Firmware update process */
  351. dev_info(&fw_info->ndev->nfc_dev->dev,
  352. "Firmware update: %s\n", fw_info->fw_name);
  353. ret = s3fwrn5_fw_enter_update_mode(fw_info, hash_data,
  354. SHA1_DIGEST_SIZE, fw_info->sig, fw_info->sig_size);
  355. if (ret < 0) {
  356. dev_err(&fw_info->ndev->nfc_dev->dev,
  357. "Unable to enter update mode\n");
  358. goto out;
  359. }
  360. for (off = 0; off < image_size; off += fw_info->sector_size) {
  361. ret = s3fwrn5_fw_update_sector(fw_info,
  362. fw_info->base_addr + off, fw->image + off);
  363. if (ret < 0) {
  364. dev_err(&fw_info->ndev->nfc_dev->dev,
  365. "Firmware update error (code=%d)\n", ret);
  366. goto out;
  367. }
  368. }
  369. ret = s3fwrn5_fw_complete_update_mode(fw_info);
  370. if (ret < 0) {
  371. dev_err(&fw_info->ndev->nfc_dev->dev,
  372. "Unable to complete update mode\n");
  373. goto out;
  374. }
  375. dev_info(&fw_info->ndev->nfc_dev->dev,
  376. "Firmware update: success\n");
  377. out:
  378. return ret;
  379. }
  380. void s3fwrn5_fw_init(struct s3fwrn5_fw_info *fw_info, const char *fw_name)
  381. {
  382. fw_info->parity = 0x00;
  383. fw_info->rsp = NULL;
  384. fw_info->fw.fw = NULL;
  385. strcpy(fw_info->fw_name, fw_name);
  386. init_completion(&fw_info->completion);
  387. }
  388. void s3fwrn5_fw_cleanup(struct s3fwrn5_fw_info *fw_info)
  389. {
  390. s3fwrn5_fw_release_firmware(fw_info);
  391. }
  392. int s3fwrn5_fw_recv_frame(struct nci_dev *ndev, struct sk_buff *skb)
  393. {
  394. struct s3fwrn5_info *info = nci_get_drvdata(ndev);
  395. struct s3fwrn5_fw_info *fw_info = &info->fw_info;
  396. if (WARN_ON(fw_info->rsp)) {
  397. kfree_skb(skb);
  398. return -EINVAL;
  399. }
  400. fw_info->rsp = skb;
  401. complete(&fw_info->completion);
  402. return 0;
  403. }