fwio.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Firmware loading.
  4. *
  5. * Copyright (c) 2017-2020, Silicon Laboratories, Inc.
  6. * Copyright (c) 2010, ST-Ericsson
  7. */
  8. #include <linux/firmware.h>
  9. #include <linux/slab.h>
  10. #include <linux/mm.h>
  11. #include <linux/bitfield.h>
  12. #include "fwio.h"
  13. #include "wfx.h"
  14. #include "hwio.h"
  15. // Addresses below are in SRAM area
  16. #define WFX_DNLD_FIFO 0x09004000
  17. #define DNLD_BLOCK_SIZE 0x0400
  18. #define DNLD_FIFO_SIZE 0x8000 // (32 * DNLD_BLOCK_SIZE)
  19. // Download Control Area (DCA)
  20. #define WFX_DCA_IMAGE_SIZE 0x0900C000
  21. #define WFX_DCA_PUT 0x0900C004
  22. #define WFX_DCA_GET 0x0900C008
  23. #define WFX_DCA_HOST_STATUS 0x0900C00C
  24. #define HOST_READY 0x87654321
  25. #define HOST_INFO_READ 0xA753BD99
  26. #define HOST_UPLOAD_PENDING 0xABCDDCBA
  27. #define HOST_UPLOAD_COMPLETE 0xD4C64A99
  28. #define HOST_OK_TO_JUMP 0x174FC882
  29. #define WFX_DCA_NCP_STATUS 0x0900C010
  30. #define NCP_NOT_READY 0x12345678
  31. #define NCP_READY 0x87654321
  32. #define NCP_INFO_READY 0xBD53EF99
  33. #define NCP_DOWNLOAD_PENDING 0xABCDDCBA
  34. #define NCP_DOWNLOAD_COMPLETE 0xCAFEFECA
  35. #define NCP_AUTH_OK 0xD4C64A99
  36. #define NCP_AUTH_FAIL 0x174FC882
  37. #define NCP_PUB_KEY_RDY 0x7AB41D19
  38. #define WFX_DCA_FW_SIGNATURE 0x0900C014
  39. #define FW_SIGNATURE_SIZE 0x40
  40. #define WFX_DCA_FW_HASH 0x0900C054
  41. #define FW_HASH_SIZE 0x08
  42. #define WFX_DCA_FW_VERSION 0x0900C05C
  43. #define FW_VERSION_SIZE 0x04
  44. #define WFX_DCA_RESERVED 0x0900C060
  45. #define DCA_RESERVED_SIZE 0x20
  46. #define WFX_STATUS_INFO 0x0900C080
  47. #define WFX_BOOTLOADER_LABEL 0x0900C084
  48. #define BOOTLOADER_LABEL_SIZE 0x3C
  49. #define WFX_PTE_INFO 0x0900C0C0
  50. #define PTE_INFO_KEYSET_IDX 0x0D
  51. #define PTE_INFO_SIZE 0x10
  52. #define WFX_ERR_INFO 0x0900C0D0
  53. #define ERR_INVALID_SEC_TYPE 0x05
  54. #define ERR_SIG_VERIF_FAILED 0x0F
  55. #define ERR_AES_CTRL_KEY 0x10
  56. #define ERR_ECC_PUB_KEY 0x11
  57. #define ERR_MAC_KEY 0x18
  58. #define DCA_TIMEOUT 50 // milliseconds
  59. #define WAKEUP_TIMEOUT 200 // milliseconds
  60. static const char * const fwio_errors[] = {
  61. [ERR_INVALID_SEC_TYPE] = "Invalid section type or wrong encryption",
  62. [ERR_SIG_VERIF_FAILED] = "Signature verification failed",
  63. [ERR_AES_CTRL_KEY] = "AES control key not initialized",
  64. [ERR_ECC_PUB_KEY] = "ECC public key not initialized",
  65. [ERR_MAC_KEY] = "MAC key not initialized",
  66. };
  67. /*
  68. * request_firmware() allocate data using vmalloc(). It is not compatible with
  69. * underlying hardware that use DMA. Function below detect this case and
  70. * allocate a bounce buffer if necessary.
  71. *
  72. * Notice that, in doubt, you can enable CONFIG_DEBUG_SG to ask kernel to
  73. * detect this problem at runtime (else, kernel silently fail).
  74. *
  75. * NOTE: it may also be possible to use 'pages' from struct firmware and avoid
  76. * bounce buffer
  77. */
  78. static int sram_write_dma_safe(struct wfx_dev *wdev, u32 addr, const u8 *buf,
  79. size_t len)
  80. {
  81. int ret;
  82. const u8 *tmp;
  83. if (!virt_addr_valid(buf)) {
  84. tmp = kmemdup(buf, len, GFP_KERNEL);
  85. if (!tmp)
  86. return -ENOMEM;
  87. } else {
  88. tmp = buf;
  89. }
  90. ret = sram_buf_write(wdev, addr, tmp, len);
  91. if (tmp != buf)
  92. kfree(tmp);
  93. return ret;
  94. }
  95. static int get_firmware(struct wfx_dev *wdev, u32 keyset_chip,
  96. const struct firmware **fw, int *file_offset)
  97. {
  98. int keyset_file;
  99. char filename[256];
  100. const char *data;
  101. int ret;
  102. snprintf(filename, sizeof(filename), "%s_%02X.sec",
  103. wdev->pdata.file_fw, keyset_chip);
  104. ret = firmware_request_nowarn(fw, filename, wdev->dev);
  105. if (ret) {
  106. dev_info(wdev->dev, "can't load %s, falling back to %s.sec\n",
  107. filename, wdev->pdata.file_fw);
  108. snprintf(filename, sizeof(filename), "%s.sec",
  109. wdev->pdata.file_fw);
  110. ret = request_firmware(fw, filename, wdev->dev);
  111. if (ret) {
  112. dev_err(wdev->dev, "can't load %s\n", filename);
  113. *fw = NULL;
  114. return ret;
  115. }
  116. }
  117. data = (*fw)->data;
  118. if (memcmp(data, "KEYSET", 6) != 0) {
  119. // Legacy firmware format
  120. *file_offset = 0;
  121. keyset_file = 0x90;
  122. } else {
  123. *file_offset = 8;
  124. keyset_file = (hex_to_bin(data[6]) * 16) | hex_to_bin(data[7]);
  125. if (keyset_file < 0) {
  126. dev_err(wdev->dev, "%s corrupted\n", filename);
  127. release_firmware(*fw);
  128. *fw = NULL;
  129. return -EINVAL;
  130. }
  131. }
  132. if (keyset_file != keyset_chip) {
  133. dev_err(wdev->dev, "firmware keyset is incompatible with chip (file: 0x%02X, chip: 0x%02X)\n",
  134. keyset_file, keyset_chip);
  135. release_firmware(*fw);
  136. *fw = NULL;
  137. return -ENODEV;
  138. }
  139. wdev->keyset = keyset_file;
  140. return 0;
  141. }
  142. static int wait_ncp_status(struct wfx_dev *wdev, u32 status)
  143. {
  144. ktime_t now, start;
  145. u32 reg;
  146. int ret;
  147. start = ktime_get();
  148. for (;;) {
  149. ret = sram_reg_read(wdev, WFX_DCA_NCP_STATUS, &reg);
  150. if (ret < 0)
  151. return -EIO;
  152. now = ktime_get();
  153. if (reg == status)
  154. break;
  155. if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
  156. return -ETIMEDOUT;
  157. }
  158. if (ktime_compare(now, start))
  159. dev_dbg(wdev->dev, "chip answer after %lldus\n",
  160. ktime_us_delta(now, start));
  161. else
  162. dev_dbg(wdev->dev, "chip answer immediately\n");
  163. return 0;
  164. }
  165. static int upload_firmware(struct wfx_dev *wdev, const u8 *data, size_t len)
  166. {
  167. int ret;
  168. u32 offs, bytes_done = 0;
  169. ktime_t now, start;
  170. if (len % DNLD_BLOCK_SIZE) {
  171. dev_err(wdev->dev, "firmware size is not aligned. Buffer overrun will occur\n");
  172. return -EIO;
  173. }
  174. offs = 0;
  175. while (offs < len) {
  176. start = ktime_get();
  177. for (;;) {
  178. now = ktime_get();
  179. if (offs + DNLD_BLOCK_SIZE - bytes_done < DNLD_FIFO_SIZE)
  180. break;
  181. if (ktime_after(now, ktime_add_ms(start, DCA_TIMEOUT)))
  182. return -ETIMEDOUT;
  183. ret = sram_reg_read(wdev, WFX_DCA_GET, &bytes_done);
  184. if (ret < 0)
  185. return ret;
  186. }
  187. if (ktime_compare(now, start))
  188. dev_dbg(wdev->dev, "answer after %lldus\n",
  189. ktime_us_delta(now, start));
  190. ret = sram_write_dma_safe(wdev, WFX_DNLD_FIFO +
  191. (offs % DNLD_FIFO_SIZE),
  192. data + offs, DNLD_BLOCK_SIZE);
  193. if (ret < 0)
  194. return ret;
  195. // WFx seems to not support writing 0 in this register during
  196. // first loop
  197. offs += DNLD_BLOCK_SIZE;
  198. ret = sram_reg_write(wdev, WFX_DCA_PUT, offs);
  199. if (ret < 0)
  200. return ret;
  201. }
  202. return 0;
  203. }
  204. static void print_boot_status(struct wfx_dev *wdev)
  205. {
  206. u32 reg;
  207. sram_reg_read(wdev, WFX_STATUS_INFO, &reg);
  208. if (reg == 0x12345678)
  209. return;
  210. sram_reg_read(wdev, WFX_ERR_INFO, &reg);
  211. if (reg < ARRAY_SIZE(fwio_errors) && fwio_errors[reg])
  212. dev_info(wdev->dev, "secure boot: %s\n", fwio_errors[reg]);
  213. else
  214. dev_info(wdev->dev, "secure boot: Error %#02x\n", reg);
  215. }
  216. static int load_firmware_secure(struct wfx_dev *wdev)
  217. {
  218. const struct firmware *fw = NULL;
  219. int header_size;
  220. int fw_offset;
  221. ktime_t start;
  222. u8 *buf;
  223. int ret;
  224. BUILD_BUG_ON(PTE_INFO_SIZE > BOOTLOADER_LABEL_SIZE);
  225. buf = kmalloc(BOOTLOADER_LABEL_SIZE + 1, GFP_KERNEL);
  226. if (!buf)
  227. return -ENOMEM;
  228. sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_READY);
  229. ret = wait_ncp_status(wdev, NCP_INFO_READY);
  230. if (ret)
  231. goto error;
  232. sram_buf_read(wdev, WFX_BOOTLOADER_LABEL, buf, BOOTLOADER_LABEL_SIZE);
  233. buf[BOOTLOADER_LABEL_SIZE] = 0;
  234. dev_dbg(wdev->dev, "bootloader: \"%s\"\n", buf);
  235. sram_buf_read(wdev, WFX_PTE_INFO, buf, PTE_INFO_SIZE);
  236. ret = get_firmware(wdev, buf[PTE_INFO_KEYSET_IDX], &fw, &fw_offset);
  237. if (ret)
  238. goto error;
  239. header_size = fw_offset + FW_SIGNATURE_SIZE + FW_HASH_SIZE;
  240. sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_INFO_READ);
  241. ret = wait_ncp_status(wdev, NCP_READY);
  242. if (ret)
  243. goto error;
  244. sram_reg_write(wdev, WFX_DNLD_FIFO, 0xFFFFFFFF); // Fifo init
  245. sram_write_dma_safe(wdev, WFX_DCA_FW_VERSION, "\x01\x00\x00\x00",
  246. FW_VERSION_SIZE);
  247. sram_write_dma_safe(wdev, WFX_DCA_FW_SIGNATURE, fw->data + fw_offset,
  248. FW_SIGNATURE_SIZE);
  249. sram_write_dma_safe(wdev, WFX_DCA_FW_HASH,
  250. fw->data + fw_offset + FW_SIGNATURE_SIZE,
  251. FW_HASH_SIZE);
  252. sram_reg_write(wdev, WFX_DCA_IMAGE_SIZE, fw->size - header_size);
  253. sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_PENDING);
  254. ret = wait_ncp_status(wdev, NCP_DOWNLOAD_PENDING);
  255. if (ret)
  256. goto error;
  257. start = ktime_get();
  258. ret = upload_firmware(wdev, fw->data + header_size,
  259. fw->size - header_size);
  260. if (ret)
  261. goto error;
  262. dev_dbg(wdev->dev, "firmware load after %lldus\n",
  263. ktime_us_delta(ktime_get(), start));
  264. sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_UPLOAD_COMPLETE);
  265. ret = wait_ncp_status(wdev, NCP_AUTH_OK);
  266. // Legacy ROM support
  267. if (ret < 0)
  268. ret = wait_ncp_status(wdev, NCP_PUB_KEY_RDY);
  269. if (ret < 0)
  270. goto error;
  271. sram_reg_write(wdev, WFX_DCA_HOST_STATUS, HOST_OK_TO_JUMP);
  272. error:
  273. kfree(buf);
  274. if (fw)
  275. release_firmware(fw);
  276. if (ret)
  277. print_boot_status(wdev);
  278. return ret;
  279. }
  280. static int init_gpr(struct wfx_dev *wdev)
  281. {
  282. int ret, i;
  283. static const struct {
  284. int index;
  285. u32 value;
  286. } gpr_init[] = {
  287. { 0x07, 0x208775 },
  288. { 0x08, 0x2EC020 },
  289. { 0x09, 0x3C3C3C },
  290. { 0x0B, 0x322C44 },
  291. { 0x0C, 0xA06497 },
  292. };
  293. for (i = 0; i < ARRAY_SIZE(gpr_init); i++) {
  294. ret = igpr_reg_write(wdev, gpr_init[i].index,
  295. gpr_init[i].value);
  296. if (ret < 0)
  297. return ret;
  298. dev_dbg(wdev->dev, " index %02x: %08x\n",
  299. gpr_init[i].index, gpr_init[i].value);
  300. }
  301. return 0;
  302. }
  303. int wfx_init_device(struct wfx_dev *wdev)
  304. {
  305. int ret;
  306. int hw_revision, hw_type;
  307. int wakeup_timeout = 50; // ms
  308. ktime_t now, start;
  309. u32 reg;
  310. reg = CFG_DIRECT_ACCESS_MODE | CFG_CPU_RESET | CFG_BYTE_ORDER_ABCD;
  311. if (wdev->pdata.use_rising_clk)
  312. reg |= CFG_CLK_RISE_EDGE;
  313. ret = config_reg_write(wdev, reg);
  314. if (ret < 0) {
  315. dev_err(wdev->dev, "bus returned an error during first write access. Host configuration error?\n");
  316. return -EIO;
  317. }
  318. ret = config_reg_read(wdev, &reg);
  319. if (ret < 0) {
  320. dev_err(wdev->dev, "bus returned an error during first read access. Bus configuration error?\n");
  321. return -EIO;
  322. }
  323. if (reg == 0 || reg == ~0) {
  324. dev_err(wdev->dev, "chip mute. Bus configuration error or chip wasn't reset?\n");
  325. return -EIO;
  326. }
  327. dev_dbg(wdev->dev, "initial config register value: %08x\n", reg);
  328. hw_revision = FIELD_GET(CFG_DEVICE_ID_MAJOR, reg);
  329. if (hw_revision == 0) {
  330. dev_err(wdev->dev, "bad hardware revision number: %d\n",
  331. hw_revision);
  332. return -ENODEV;
  333. }
  334. hw_type = FIELD_GET(CFG_DEVICE_ID_TYPE, reg);
  335. if (hw_type == 1) {
  336. dev_notice(wdev->dev, "development hardware detected\n");
  337. wakeup_timeout = 2000;
  338. }
  339. ret = init_gpr(wdev);
  340. if (ret < 0)
  341. return ret;
  342. ret = control_reg_write(wdev, CTRL_WLAN_WAKEUP);
  343. if (ret < 0)
  344. return -EIO;
  345. start = ktime_get();
  346. for (;;) {
  347. ret = control_reg_read(wdev, &reg);
  348. now = ktime_get();
  349. if (reg & CTRL_WLAN_READY)
  350. break;
  351. if (ktime_after(now, ktime_add_ms(start, wakeup_timeout))) {
  352. dev_err(wdev->dev, "chip didn't wake up. Chip wasn't reset?\n");
  353. return -ETIMEDOUT;
  354. }
  355. }
  356. dev_dbg(wdev->dev, "chip wake up after %lldus\n",
  357. ktime_us_delta(now, start));
  358. ret = config_reg_write_bits(wdev, CFG_CPU_RESET, 0);
  359. if (ret < 0)
  360. return ret;
  361. ret = load_firmware_secure(wdev);
  362. if (ret < 0)
  363. return ret;
  364. return config_reg_write_bits(wdev,
  365. CFG_DIRECT_ACCESS_MODE |
  366. CFG_IRQ_ENABLE_DATA |
  367. CFG_IRQ_ENABLE_WRDY,
  368. CFG_IRQ_ENABLE_DATA);
  369. }