• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *
3  * This file is provided under a dual BSD/GPLv2 license.  When using or
4  * redistributing this file, you may do so under either license.
5  *
6  * GPL LICENSE SUMMARY
7  *
8  * Copyright(c) 2015 Intel Corporation.
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of version 2 of the GNU General Public License as
12  * published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful, but
15  * WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
17  * General Public License for more details.
18  *
19  * BSD LICENSE
20  *
21  * Copyright(c) 2015 Intel Corporation.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  *
27  *  - Redistributions of source code must retain the above copyright
28  *    notice, this list of conditions and the following disclaimer.
29  *  - Redistributions in binary form must reproduce the above copyright
30  *    notice, this list of conditions and the following disclaimer in
31  *    the documentation and/or other materials provided with the
32  *    distribution.
33  *  - Neither the name of Intel Corporation nor the names of its
34  *    contributors may be used to endorse or promote products derived
35  *    from this software without specific prior written permission.
36  *
37  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
38  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
39  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
40  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
41  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
42  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
43  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
44  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
45  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
46  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
47  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
48  *
49  */
50 
51 #include <linux/firmware.h>
52 #include <linux/mutex.h>
53 #include <linux/module.h>
54 #include <linux/delay.h>
55 #include <linux/crc32.h>
56 
57 #include "hfi.h"
58 #include "trace.h"
59 
60 /*
61  * Make it easy to toggle firmware file name and if it gets loaded by
62  * editing the following. This may be something we do while in development
63  * but not necessarily something a user would ever need to use.
64  */
65 #define DEFAULT_FW_8051_NAME_FPGA "hfi_dc8051.bin"
66 #define DEFAULT_FW_8051_NAME_ASIC "hfi1_dc8051.fw"
67 #define DEFAULT_FW_FABRIC_NAME "hfi1_fabric.fw"
68 #define DEFAULT_FW_SBUS_NAME "hfi1_sbus.fw"
69 #define DEFAULT_FW_PCIE_NAME "hfi1_pcie.fw"
70 #define DEFAULT_PLATFORM_CONFIG_NAME "hfi1_platform.dat"
71 
72 static uint fw_8051_load = 1;
73 static uint fw_fabric_serdes_load = 1;
74 static uint fw_pcie_serdes_load = 1;
75 static uint fw_sbus_load = 1;
76 static uint platform_config_load = 1;
77 
78 /* Firmware file names get set in hfi1_firmware_init() based on the above */
79 static char *fw_8051_name;
80 static char *fw_fabric_serdes_name;
81 static char *fw_sbus_name;
82 static char *fw_pcie_serdes_name;
83 static char *platform_config_name;
84 
85 #define SBUS_MAX_POLL_COUNT 100
86 #define SBUS_COUNTER(reg, name) \
87 	(((reg) >> ASIC_STS_SBUS_COUNTERS_##name##_CNT_SHIFT) & \
88 	 ASIC_STS_SBUS_COUNTERS_##name##_CNT_MASK)
89 
90 /*
91  * Firmware security header.
92  */
93 struct css_header {
94 	u32 module_type;
95 	u32 header_len;
96 	u32 header_version;
97 	u32 module_id;
98 	u32 module_vendor;
99 	u32 date;		/* BCD yyyymmdd */
100 	u32 size;		/* in DWORDs */
101 	u32 key_size;		/* in DWORDs */
102 	u32 modulus_size;	/* in DWORDs */
103 	u32 exponent_size;	/* in DWORDs */
104 	u32 reserved[22];
105 };
106 /* expected field values */
107 #define CSS_MODULE_TYPE	   0x00000006
108 #define CSS_HEADER_LEN	   0x000000a1
109 #define CSS_HEADER_VERSION 0x00010000
110 #define CSS_MODULE_VENDOR  0x00008086
111 
112 #define KEY_SIZE      256
113 #define MU_SIZE		8
114 #define EXPONENT_SIZE	4
115 
116 /* the file itself */
117 struct firmware_file {
118 	struct css_header css_header;
119 	u8 modulus[KEY_SIZE];
120 	u8 exponent[EXPONENT_SIZE];
121 	u8 signature[KEY_SIZE];
122 	u8 firmware[];
123 };
124 
125 struct augmented_firmware_file {
126 	struct css_header css_header;
127 	u8 modulus[KEY_SIZE];
128 	u8 exponent[EXPONENT_SIZE];
129 	u8 signature[KEY_SIZE];
130 	u8 r2[KEY_SIZE];
131 	u8 mu[MU_SIZE];
132 	u8 firmware[];
133 };
134 
135 /* augmented file size difference */
136 #define AUGMENT_SIZE (sizeof(struct augmented_firmware_file) - \
137 						sizeof(struct firmware_file))
138 
139 struct firmware_details {
140 	/* Linux core piece */
141 	const struct firmware *fw;
142 
143 	struct css_header *css_header;
144 	u8 *firmware_ptr;		/* pointer to binary data */
145 	u32 firmware_len;		/* length in bytes */
146 	u8 *modulus;			/* pointer to the modulus */
147 	u8 *exponent;			/* pointer to the exponent */
148 	u8 *signature;			/* pointer to the signature */
149 	u8 *r2;				/* pointer to r2 */
150 	u8 *mu;				/* pointer to mu */
151 	struct augmented_firmware_file dummy_header;
152 };
153 
154 /*
155  * The mutex protects fw_state, fw_err, and all of the firmware_details
156  * variables.
157  */
158 static DEFINE_MUTEX(fw_mutex);
159 enum fw_state {
160 	FW_EMPTY,
161 	FW_ACQUIRED,
162 	FW_ERR
163 };
164 static enum fw_state fw_state = FW_EMPTY;
165 static int fw_err;
166 static struct firmware_details fw_8051;
167 static struct firmware_details fw_fabric;
168 static struct firmware_details fw_pcie;
169 static struct firmware_details fw_sbus;
170 static const struct firmware *platform_config;
171 
172 /* flags for turn_off_spicos() */
173 #define SPICO_SBUS   0x1
174 #define SPICO_FABRIC 0x2
175 #define ENABLE_SPICO_SMASK 0x1
176 
177 /* security block commands */
178 #define RSA_CMD_INIT  0x1
179 #define RSA_CMD_START 0x2
180 
181 /* security block status */
182 #define RSA_STATUS_IDLE   0x0
183 #define RSA_STATUS_ACTIVE 0x1
184 #define RSA_STATUS_DONE   0x2
185 #define RSA_STATUS_FAILED 0x3
186 
187 /* RSA engine timeout, in ms */
188 #define RSA_ENGINE_TIMEOUT 100 /* ms */
189 
190 /* hardware mutex timeout, in ms */
191 #define HM_TIMEOUT 4000 /* 4 s */
192 
193 /* 8051 memory access timeout, in us */
194 #define DC8051_ACCESS_TIMEOUT 100 /* us */
195 
196 /* the number of fabric SerDes on the SBus */
197 #define NUM_FABRIC_SERDES 4
198 
199 /* SBus fabric SerDes addresses, one set per HFI */
200 static const u8 fabric_serdes_addrs[2][NUM_FABRIC_SERDES] = {
201 	{ 0x01, 0x02, 0x03, 0x04 },
202 	{ 0x28, 0x29, 0x2a, 0x2b }
203 };
204 
205 /* SBus PCIe SerDes addresses, one set per HFI */
206 static const u8 pcie_serdes_addrs[2][NUM_PCIE_SERDES] = {
207 	{ 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16,
208 	  0x18, 0x1a, 0x1c, 0x1e, 0x20, 0x22, 0x24, 0x26 },
209 	{ 0x2f, 0x31, 0x33, 0x35, 0x37, 0x39, 0x3b, 0x3d,
210 	  0x3f, 0x41, 0x43, 0x45, 0x47, 0x49, 0x4b, 0x4d }
211 };
212 
213 /* SBus PCIe PCS addresses, one set per HFI */
214 const u8 pcie_pcs_addrs[2][NUM_PCIE_SERDES] = {
215 	{ 0x09, 0x0b, 0x0d, 0x0f, 0x11, 0x13, 0x15, 0x17,
216 	  0x19, 0x1b, 0x1d, 0x1f, 0x21, 0x23, 0x25, 0x27 },
217 	{ 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,
218 	  0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e }
219 };
220 
221 /* SBus fabric SerDes broadcast addresses, one per HFI */
222 static const u8 fabric_serdes_broadcast[2] = { 0xe4, 0xe5 };
223 static const u8 all_fabric_serdes_broadcast = 0xe1;
224 
225 /* SBus PCIe SerDes broadcast addresses, one per HFI */
226 const u8 pcie_serdes_broadcast[2] = { 0xe2, 0xe3 };
227 static const u8 all_pcie_serdes_broadcast = 0xe0;
228 
229 /* forwards */
230 static void dispose_one_firmware(struct firmware_details *fdet);
231 
232 /*
233  * Read a single 64-bit value from 8051 data memory.
234  *
235  * Expects:
236  * o caller to have already set up data read, no auto increment
237  * o caller to turn off read enable when finished
238  *
239  * The address argument is a byte offset.  Bits 0:2 in the address are
240  * ignored - i.e. the hardware will always do aligned 8-byte reads as if
241  * the lower bits are zero.
242  *
243  * Return 0 on success, -ENXIO on a read error (timeout).
244  */
__read_8051_data(struct hfi1_devdata * dd,u32 addr,u64 * result)245 static int __read_8051_data(struct hfi1_devdata *dd, u32 addr, u64 *result)
246 {
247 	u64 reg;
248 	int count;
249 
250 	/* start the read at the given address */
251 	reg = ((addr & DC_DC8051_CFG_RAM_ACCESS_CTRL_ADDRESS_MASK)
252 			<< DC_DC8051_CFG_RAM_ACCESS_CTRL_ADDRESS_SHIFT)
253 		| DC_DC8051_CFG_RAM_ACCESS_CTRL_READ_ENA_SMASK;
254 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_CTRL, reg);
255 
256 	/* wait until ACCESS_COMPLETED is set */
257 	count = 0;
258 	while ((read_csr(dd, DC_DC8051_CFG_RAM_ACCESS_STATUS)
259 		    & DC_DC8051_CFG_RAM_ACCESS_STATUS_ACCESS_COMPLETED_SMASK)
260 		    == 0) {
261 		count++;
262 		if (count > DC8051_ACCESS_TIMEOUT) {
263 			dd_dev_err(dd, "timeout reading 8051 data\n");
264 			return -ENXIO;
265 		}
266 		ndelay(10);
267 	}
268 
269 	/* gather the data */
270 	*result = read_csr(dd, DC_DC8051_CFG_RAM_ACCESS_RD_DATA);
271 
272 	return 0;
273 }
274 
275 /*
276  * Read 8051 data starting at addr, for len bytes.  Will read in 8-byte chunks.
277  * Return 0 on success, -errno on error.
278  */
read_8051_data(struct hfi1_devdata * dd,u32 addr,u32 len,u64 * result)279 int read_8051_data(struct hfi1_devdata *dd, u32 addr, u32 len, u64 *result)
280 {
281 	unsigned long flags;
282 	u32 done;
283 	int ret = 0;
284 
285 	spin_lock_irqsave(&dd->dc8051_memlock, flags);
286 
287 	/* data read set-up, no auto-increment */
288 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_SETUP, 0);
289 
290 	for (done = 0; done < len; addr += 8, done += 8, result++) {
291 		ret = __read_8051_data(dd, addr, result);
292 		if (ret)
293 			break;
294 	}
295 
296 	/* turn off read enable */
297 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_CTRL, 0);
298 
299 	spin_unlock_irqrestore(&dd->dc8051_memlock, flags);
300 
301 	return ret;
302 }
303 
304 /*
305  * Write data or code to the 8051 code or data RAM.
306  */
write_8051(struct hfi1_devdata * dd,int code,u32 start,const u8 * data,u32 len)307 static int write_8051(struct hfi1_devdata *dd, int code, u32 start,
308 		      const u8 *data, u32 len)
309 {
310 	u64 reg;
311 	u32 offset;
312 	int aligned, count;
313 
314 	/* check alignment */
315 	aligned = ((unsigned long)data & 0x7) == 0;
316 
317 	/* write set-up */
318 	reg = (code ? DC_DC8051_CFG_RAM_ACCESS_SETUP_RAM_SEL_SMASK : 0ull)
319 		| DC_DC8051_CFG_RAM_ACCESS_SETUP_AUTO_INCR_ADDR_SMASK;
320 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_SETUP, reg);
321 
322 	reg = ((start & DC_DC8051_CFG_RAM_ACCESS_CTRL_ADDRESS_MASK)
323 			<< DC_DC8051_CFG_RAM_ACCESS_CTRL_ADDRESS_SHIFT)
324 		| DC_DC8051_CFG_RAM_ACCESS_CTRL_WRITE_ENA_SMASK;
325 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_CTRL, reg);
326 
327 	/* write */
328 	for (offset = 0; offset < len; offset += 8) {
329 		int bytes = len - offset;
330 
331 		if (bytes < 8) {
332 			reg = 0;
333 			memcpy(&reg, &data[offset], bytes);
334 		} else if (aligned) {
335 			reg = *(u64 *)&data[offset];
336 		} else {
337 			memcpy(&reg, &data[offset], 8);
338 		}
339 		write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_WR_DATA, reg);
340 
341 		/* wait until ACCESS_COMPLETED is set */
342 		count = 0;
343 		while ((read_csr(dd, DC_DC8051_CFG_RAM_ACCESS_STATUS)
344 		    & DC_DC8051_CFG_RAM_ACCESS_STATUS_ACCESS_COMPLETED_SMASK)
345 		    == 0) {
346 			count++;
347 			if (count > DC8051_ACCESS_TIMEOUT) {
348 				dd_dev_err(dd, "timeout writing 8051 data\n");
349 				return -ENXIO;
350 			}
351 			udelay(1);
352 		}
353 	}
354 
355 	/* turn off write access, auto increment (also sets to data access) */
356 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_CTRL, 0);
357 	write_csr(dd, DC_DC8051_CFG_RAM_ACCESS_SETUP, 0);
358 
359 	return 0;
360 }
361 
362 /* return 0 if values match, non-zero and complain otherwise */
invalid_header(struct hfi1_devdata * dd,const char * what,u32 actual,u32 expected)363 static int invalid_header(struct hfi1_devdata *dd, const char *what,
364 			  u32 actual, u32 expected)
365 {
366 	if (actual == expected)
367 		return 0;
368 
369 	dd_dev_err(dd,
370 		"invalid firmware header field %s: expected 0x%x, actual 0x%x\n",
371 		what, expected, actual);
372 	return 1;
373 }
374 
375 /*
376  * Verify that the static fields in the CSS header match.
377  */
verify_css_header(struct hfi1_devdata * dd,struct css_header * css)378 static int verify_css_header(struct hfi1_devdata *dd, struct css_header *css)
379 {
380 	/* verify CSS header fields (most sizes are in DW, so add /4) */
381 	if (invalid_header(dd, "module_type", css->module_type, CSS_MODULE_TYPE)
382 			|| invalid_header(dd, "header_len", css->header_len,
383 					(sizeof(struct firmware_file)/4))
384 			|| invalid_header(dd, "header_version",
385 					css->header_version, CSS_HEADER_VERSION)
386 			|| invalid_header(dd, "module_vendor",
387 					css->module_vendor, CSS_MODULE_VENDOR)
388 			|| invalid_header(dd, "key_size",
389 					css->key_size, KEY_SIZE/4)
390 			|| invalid_header(dd, "modulus_size",
391 					css->modulus_size, KEY_SIZE/4)
392 			|| invalid_header(dd, "exponent_size",
393 					css->exponent_size, EXPONENT_SIZE/4)) {
394 		return -EINVAL;
395 	}
396 	return 0;
397 }
398 
399 /*
400  * Make sure there are at least some bytes after the prefix.
401  */
payload_check(struct hfi1_devdata * dd,const char * name,long file_size,long prefix_size)402 static int payload_check(struct hfi1_devdata *dd, const char *name,
403 			 long file_size, long prefix_size)
404 {
405 	/* make sure we have some payload */
406 	if (prefix_size >= file_size) {
407 		dd_dev_err(dd,
408 			"firmware \"%s\", size %ld, must be larger than %ld bytes\n",
409 			name, file_size, prefix_size);
410 		return -EINVAL;
411 	}
412 
413 	return 0;
414 }
415 
416 /*
417  * Request the firmware from the system.  Extract the pieces and fill in
418  * fdet.  If successful, the caller will need to call dispose_one_firmware().
419  * Returns 0 on success, -ERRNO on error.
420  */
obtain_one_firmware(struct hfi1_devdata * dd,const char * name,struct firmware_details * fdet)421 static int obtain_one_firmware(struct hfi1_devdata *dd, const char *name,
422 			       struct firmware_details *fdet)
423 {
424 	struct css_header *css;
425 	int ret;
426 
427 	memset(fdet, 0, sizeof(*fdet));
428 
429 	ret = request_firmware(&fdet->fw, name, &dd->pcidev->dev);
430 	if (ret) {
431 		dd_dev_err(dd, "cannot load firmware \"%s\", err %d\n",
432 			name, ret);
433 		return ret;
434 	}
435 
436 	/* verify the firmware */
437 	if (fdet->fw->size < sizeof(struct css_header)) {
438 		dd_dev_err(dd, "firmware \"%s\" is too small\n", name);
439 		ret = -EINVAL;
440 		goto done;
441 	}
442 	css = (struct css_header *)fdet->fw->data;
443 
444 	hfi1_cdbg(FIRMWARE, "Firmware %s details:", name);
445 	hfi1_cdbg(FIRMWARE, "file size: 0x%lx bytes", fdet->fw->size);
446 	hfi1_cdbg(FIRMWARE, "CSS structure:");
447 	hfi1_cdbg(FIRMWARE, "  module_type    0x%x", css->module_type);
448 	hfi1_cdbg(FIRMWARE, "  header_len     0x%03x (0x%03x bytes)",
449 		  css->header_len, 4 * css->header_len);
450 	hfi1_cdbg(FIRMWARE, "  header_version 0x%x", css->header_version);
451 	hfi1_cdbg(FIRMWARE, "  module_id      0x%x", css->module_id);
452 	hfi1_cdbg(FIRMWARE, "  module_vendor  0x%x", css->module_vendor);
453 	hfi1_cdbg(FIRMWARE, "  date           0x%x", css->date);
454 	hfi1_cdbg(FIRMWARE, "  size           0x%03x (0x%03x bytes)",
455 		  css->size, 4 * css->size);
456 	hfi1_cdbg(FIRMWARE, "  key_size       0x%03x (0x%03x bytes)",
457 		  css->key_size, 4 * css->key_size);
458 	hfi1_cdbg(FIRMWARE, "  modulus_size   0x%03x (0x%03x bytes)",
459 		  css->modulus_size, 4 * css->modulus_size);
460 	hfi1_cdbg(FIRMWARE, "  exponent_size  0x%03x (0x%03x bytes)",
461 		  css->exponent_size, 4 * css->exponent_size);
462 	hfi1_cdbg(FIRMWARE, "firmware size: 0x%lx bytes",
463 		  fdet->fw->size - sizeof(struct firmware_file));
464 
465 	/*
466 	 * If the file does not have a valid CSS header, fail.
467 	 * Otherwise, check the CSS size field for an expected size.
468 	 * The augmented file has r2 and mu inserted after the header
469 	 * was generated, so there will be a known difference between
470 	 * the CSS header size and the actual file size.  Use this
471 	 * difference to identify an augmented file.
472 	 *
473 	 * Note: css->size is in DWORDs, multiply by 4 to get bytes.
474 	 */
475 	ret = verify_css_header(dd, css);
476 	if (ret) {
477 		dd_dev_info(dd, "Invalid CSS header for \"%s\"\n", name);
478 	} else if ((css->size*4) == fdet->fw->size) {
479 		/* non-augmented firmware file */
480 		struct firmware_file *ff = (struct firmware_file *)
481 							fdet->fw->data;
482 
483 		/* make sure there are bytes in the payload */
484 		ret = payload_check(dd, name, fdet->fw->size,
485 						sizeof(struct firmware_file));
486 		if (ret == 0) {
487 			fdet->css_header = css;
488 			fdet->modulus = ff->modulus;
489 			fdet->exponent = ff->exponent;
490 			fdet->signature = ff->signature;
491 			fdet->r2 = fdet->dummy_header.r2; /* use dummy space */
492 			fdet->mu = fdet->dummy_header.mu; /* use dummy space */
493 			fdet->firmware_ptr = ff->firmware;
494 			fdet->firmware_len = fdet->fw->size -
495 						sizeof(struct firmware_file);
496 			/*
497 			 * Header does not include r2 and mu - generate here.
498 			 * For now, fail.
499 			 */
500 			dd_dev_err(dd, "driver is unable to validate firmware without r2 and mu (not in firmware file)\n");
501 			ret = -EINVAL;
502 		}
503 	} else if ((css->size*4) + AUGMENT_SIZE == fdet->fw->size) {
504 		/* augmented firmware file */
505 		struct augmented_firmware_file *aff =
506 			(struct augmented_firmware_file *)fdet->fw->data;
507 
508 		/* make sure there are bytes in the payload */
509 		ret = payload_check(dd, name, fdet->fw->size,
510 					sizeof(struct augmented_firmware_file));
511 		if (ret == 0) {
512 			fdet->css_header = css;
513 			fdet->modulus = aff->modulus;
514 			fdet->exponent = aff->exponent;
515 			fdet->signature = aff->signature;
516 			fdet->r2 = aff->r2;
517 			fdet->mu = aff->mu;
518 			fdet->firmware_ptr = aff->firmware;
519 			fdet->firmware_len = fdet->fw->size -
520 					sizeof(struct augmented_firmware_file);
521 		}
522 	} else {
523 		/* css->size check failed */
524 		dd_dev_err(dd,
525 			"invalid firmware header field size: expected 0x%lx or 0x%lx, actual 0x%x\n",
526 			fdet->fw->size/4, (fdet->fw->size - AUGMENT_SIZE)/4,
527 			css->size);
528 
529 		ret = -EINVAL;
530 	}
531 
532 done:
533 	/* if returning an error, clean up after ourselves */
534 	if (ret)
535 		dispose_one_firmware(fdet);
536 	return ret;
537 }
538 
dispose_one_firmware(struct firmware_details * fdet)539 static void dispose_one_firmware(struct firmware_details *fdet)
540 {
541 	release_firmware(fdet->fw);
542 	fdet->fw = NULL;
543 }
544 
545 /*
546  * Called by all HFIs when loading their firmware - i.e. device probe time.
547  * The first one will do the actual firmware load.  Use a mutex to resolve
548  * any possible race condition.
549  *
550  * The call to this routine cannot be moved to driver load because the kernel
551  * call request_firmware() requires a device which is only available after
552  * the first device probe.
553  */
obtain_firmware(struct hfi1_devdata * dd)554 static int obtain_firmware(struct hfi1_devdata *dd)
555 {
556 	int err = 0;
557 
558 	mutex_lock(&fw_mutex);
559 	if (fw_state == FW_ACQUIRED) {
560 		goto done;	/* already acquired */
561 	} else if (fw_state == FW_ERR) {
562 		err = fw_err;
563 		goto done;	/* already tried and failed */
564 	}
565 
566 	if (fw_8051_load) {
567 		err = obtain_one_firmware(dd, fw_8051_name, &fw_8051);
568 		if (err)
569 			goto done;
570 	}
571 
572 	if (fw_fabric_serdes_load) {
573 		err = obtain_one_firmware(dd, fw_fabric_serdes_name,
574 			&fw_fabric);
575 		if (err)
576 			goto done;
577 	}
578 
579 	if (fw_sbus_load) {
580 		err = obtain_one_firmware(dd, fw_sbus_name, &fw_sbus);
581 		if (err)
582 			goto done;
583 	}
584 
585 	if (fw_pcie_serdes_load) {
586 		err = obtain_one_firmware(dd, fw_pcie_serdes_name, &fw_pcie);
587 		if (err)
588 			goto done;
589 	}
590 
591 	if (platform_config_load) {
592 		platform_config = NULL;
593 		err = request_firmware(&platform_config, platform_config_name,
594 						&dd->pcidev->dev);
595 		if (err) {
596 			err = 0;
597 			platform_config = NULL;
598 		}
599 	}
600 
601 	/* success */
602 	fw_state = FW_ACQUIRED;
603 
604 done:
605 	if (err) {
606 		fw_err = err;
607 		fw_state = FW_ERR;
608 	}
609 	mutex_unlock(&fw_mutex);
610 
611 	return err;
612 }
613 
614 /*
615  * Called when the driver unloads.  The timing is asymmetric with its
616  * counterpart, obtain_firmware().  If called at device remove time,
617  * then it is conceivable that another device could probe while the
618  * firmware is being disposed.  The mutexes can be moved to do that
619  * safely, but then the firmware would be requested from the OS multiple
620  * times.
621  *
622  * No mutex is needed as the driver is unloading and there cannot be any
623  * other callers.
624  */
dispose_firmware(void)625 void dispose_firmware(void)
626 {
627 	dispose_one_firmware(&fw_8051);
628 	dispose_one_firmware(&fw_fabric);
629 	dispose_one_firmware(&fw_pcie);
630 	dispose_one_firmware(&fw_sbus);
631 
632 	release_firmware(platform_config);
633 	platform_config = NULL;
634 
635 	/* retain the error state, otherwise revert to empty */
636 	if (fw_state != FW_ERR)
637 		fw_state = FW_EMPTY;
638 }
639 
640 /*
641  * Write a block of data to a given array CSR.  All calls will be in
642  * multiples of 8 bytes.
643  */
write_rsa_data(struct hfi1_devdata * dd,int what,const u8 * data,int nbytes)644 static void write_rsa_data(struct hfi1_devdata *dd, int what,
645 			   const u8 *data, int nbytes)
646 {
647 	int qw_size = nbytes/8;
648 	int i;
649 
650 	if (((unsigned long)data & 0x7) == 0) {
651 		/* aligned */
652 		u64 *ptr = (u64 *)data;
653 
654 		for (i = 0; i < qw_size; i++, ptr++)
655 			write_csr(dd, what + (8*i), *ptr);
656 	} else {
657 		/* not aligned */
658 		for (i = 0; i < qw_size; i++, data += 8) {
659 			u64 value;
660 
661 			memcpy(&value, data, 8);
662 			write_csr(dd, what + (8*i), value);
663 		}
664 	}
665 }
666 
667 /*
668  * Write a block of data to a given CSR as a stream of writes.  All calls will
669  * be in multiples of 8 bytes.
670  */
write_streamed_rsa_data(struct hfi1_devdata * dd,int what,const u8 * data,int nbytes)671 static void write_streamed_rsa_data(struct hfi1_devdata *dd, int what,
672 				    const u8 *data, int nbytes)
673 {
674 	u64 *ptr = (u64 *)data;
675 	int qw_size = nbytes/8;
676 
677 	for (; qw_size > 0; qw_size--, ptr++)
678 		write_csr(dd, what, *ptr);
679 }
680 
681 /*
682  * Download the signature and start the RSA mechanism.  Wait for
683  * RSA_ENGINE_TIMEOUT before giving up.
684  */
run_rsa(struct hfi1_devdata * dd,const char * who,const u8 * signature)685 static int run_rsa(struct hfi1_devdata *dd, const char *who,
686 		   const u8 *signature)
687 {
688 	unsigned long timeout;
689 	u64 reg;
690 	u32 status;
691 	int ret = 0;
692 
693 	/* write the signature */
694 	write_rsa_data(dd, MISC_CFG_RSA_SIGNATURE, signature, KEY_SIZE);
695 
696 	/* initialize RSA */
697 	write_csr(dd, MISC_CFG_RSA_CMD, RSA_CMD_INIT);
698 
699 	/*
700 	 * Make sure the engine is idle and insert a delay between the two
701 	 * writes to MISC_CFG_RSA_CMD.
702 	 */
703 	status = (read_csr(dd, MISC_CFG_FW_CTRL)
704 			   & MISC_CFG_FW_CTRL_RSA_STATUS_SMASK)
705 			     >> MISC_CFG_FW_CTRL_RSA_STATUS_SHIFT;
706 	if (status != RSA_STATUS_IDLE) {
707 		dd_dev_err(dd, "%s security engine not idle - giving up\n",
708 			who);
709 		return -EBUSY;
710 	}
711 
712 	/* start RSA */
713 	write_csr(dd, MISC_CFG_RSA_CMD, RSA_CMD_START);
714 
715 	/*
716 	 * Look for the result.
717 	 *
718 	 * The RSA engine is hooked up to two MISC errors.  The driver
719 	 * masks these errors as they do not respond to the standard
720 	 * error "clear down" mechanism.  Look for these errors here and
721 	 * clear them when possible.  This routine will exit with the
722 	 * errors of the current run still set.
723 	 *
724 	 * MISC_FW_AUTH_FAILED_ERR
725 	 *	Firmware authorization failed.  This can be cleared by
726 	 *	re-initializing the RSA engine, then clearing the status bit.
727 	 *	Do not re-init the RSA angine immediately after a successful
728 	 *	run - this will reset the current authorization.
729 	 *
730 	 * MISC_KEY_MISMATCH_ERR
731 	 *	Key does not match.  The only way to clear this is to load
732 	 *	a matching key then clear the status bit.  If this error
733 	 *	is raised, it will persist outside of this routine until a
734 	 *	matching key is loaded.
735 	 */
736 	timeout = msecs_to_jiffies(RSA_ENGINE_TIMEOUT) + jiffies;
737 	while (1) {
738 		status = (read_csr(dd, MISC_CFG_FW_CTRL)
739 			   & MISC_CFG_FW_CTRL_RSA_STATUS_SMASK)
740 			     >> MISC_CFG_FW_CTRL_RSA_STATUS_SHIFT;
741 
742 		if (status == RSA_STATUS_IDLE) {
743 			/* should not happen */
744 			dd_dev_err(dd, "%s firmware security bad idle state\n",
745 				who);
746 			ret = -EINVAL;
747 			break;
748 		} else if (status == RSA_STATUS_DONE) {
749 			/* finished successfully */
750 			break;
751 		} else if (status == RSA_STATUS_FAILED) {
752 			/* finished unsuccessfully */
753 			ret = -EINVAL;
754 			break;
755 		}
756 		/* else still active */
757 
758 		if (time_after(jiffies, timeout)) {
759 			/*
760 			 * Timed out while active.  We can't reset the engine
761 			 * if it is stuck active, but run through the
762 			 * error code to see what error bits are set.
763 			 */
764 			dd_dev_err(dd, "%s firmware security time out\n", who);
765 			ret = -ETIMEDOUT;
766 			break;
767 		}
768 
769 		msleep(20);
770 	}
771 
772 	/*
773 	 * Arrive here on success or failure.  Clear all RSA engine
774 	 * errors.  All current errors will stick - the RSA logic is keeping
775 	 * error high.  All previous errors will clear - the RSA logic
776 	 * is not keeping the error high.
777 	 */
778 	write_csr(dd, MISC_ERR_CLEAR,
779 			MISC_ERR_STATUS_MISC_FW_AUTH_FAILED_ERR_SMASK
780 			| MISC_ERR_STATUS_MISC_KEY_MISMATCH_ERR_SMASK);
781 	/*
782 	 * All that is left are the current errors.  Print failure details,
783 	 * if any.
784 	 */
785 	reg = read_csr(dd, MISC_ERR_STATUS);
786 	if (ret) {
787 		if (reg & MISC_ERR_STATUS_MISC_FW_AUTH_FAILED_ERR_SMASK)
788 			dd_dev_err(dd, "%s firmware authorization failed\n",
789 				who);
790 		if (reg & MISC_ERR_STATUS_MISC_KEY_MISMATCH_ERR_SMASK)
791 			dd_dev_err(dd, "%s firmware key mismatch\n", who);
792 	}
793 
794 	return ret;
795 }
796 
load_security_variables(struct hfi1_devdata * dd,struct firmware_details * fdet)797 static void load_security_variables(struct hfi1_devdata *dd,
798 				    struct firmware_details *fdet)
799 {
800 	/* Security variables a.  Write the modulus */
801 	write_rsa_data(dd, MISC_CFG_RSA_MODULUS, fdet->modulus, KEY_SIZE);
802 	/* Security variables b.  Write the r2 */
803 	write_rsa_data(dd, MISC_CFG_RSA_R2, fdet->r2, KEY_SIZE);
804 	/* Security variables c.  Write the mu */
805 	write_rsa_data(dd, MISC_CFG_RSA_MU, fdet->mu, MU_SIZE);
806 	/* Security variables d.  Write the header */
807 	write_streamed_rsa_data(dd, MISC_CFG_SHA_PRELOAD,
808 			(u8 *)fdet->css_header, sizeof(struct css_header));
809 }
810 
811 /* return the 8051 firmware state */
get_firmware_state(struct hfi1_devdata * dd)812 static inline u32 get_firmware_state(struct hfi1_devdata *dd)
813 {
814 	u64 reg = read_csr(dd, DC_DC8051_STS_CUR_STATE);
815 
816 	return (reg >> DC_DC8051_STS_CUR_STATE_FIRMWARE_SHIFT)
817 				& DC_DC8051_STS_CUR_STATE_FIRMWARE_MASK;
818 }
819 
820 /*
821  * Wait until the firmware is up and ready to take host requests.
822  * Return 0 on success, -ETIMEDOUT on timeout.
823  */
wait_fm_ready(struct hfi1_devdata * dd,u32 mstimeout)824 int wait_fm_ready(struct hfi1_devdata *dd, u32 mstimeout)
825 {
826 	unsigned long timeout;
827 
828 	/* in the simulator, the fake 8051 is always ready */
829 	if (dd->icode == ICODE_FUNCTIONAL_SIMULATOR)
830 		return 0;
831 
832 	timeout = msecs_to_jiffies(mstimeout) + jiffies;
833 	while (1) {
834 		if (get_firmware_state(dd) == 0xa0)	/* ready */
835 			return 0;
836 		if (time_after(jiffies, timeout))	/* timed out */
837 			return -ETIMEDOUT;
838 		usleep_range(1950, 2050); /* sleep 2ms-ish */
839 	}
840 }
841 
842 /*
843  * Load the 8051 firmware.
844  */
load_8051_firmware(struct hfi1_devdata * dd,struct firmware_details * fdet)845 static int load_8051_firmware(struct hfi1_devdata *dd,
846 			      struct firmware_details *fdet)
847 {
848 	u64 reg;
849 	int ret;
850 	u8 ver_a, ver_b;
851 
852 	/*
853 	 * DC Reset sequence
854 	 * Load DC 8051 firmware
855 	 */
856 	/*
857 	 * DC reset step 1: Reset DC8051
858 	 */
859 	reg = DC_DC8051_CFG_RST_M8051W_SMASK
860 		| DC_DC8051_CFG_RST_CRAM_SMASK
861 		| DC_DC8051_CFG_RST_DRAM_SMASK
862 		| DC_DC8051_CFG_RST_IRAM_SMASK
863 		| DC_DC8051_CFG_RST_SFR_SMASK;
864 	write_csr(dd, DC_DC8051_CFG_RST, reg);
865 
866 	/*
867 	 * DC reset step 2 (optional): Load 8051 data memory with link
868 	 * configuration
869 	 */
870 
871 	/*
872 	 * DC reset step 3: Load DC8051 firmware
873 	 */
874 	/* release all but the core reset */
875 	reg = DC_DC8051_CFG_RST_M8051W_SMASK;
876 	write_csr(dd, DC_DC8051_CFG_RST, reg);
877 
878 	/* Firmware load step 1 */
879 	load_security_variables(dd, fdet);
880 
881 	/*
882 	 * Firmware load step 2.  Clear MISC_CFG_FW_CTRL.FW_8051_LOADED
883 	 */
884 	write_csr(dd, MISC_CFG_FW_CTRL, 0);
885 
886 	/* Firmware load steps 3-5 */
887 	ret = write_8051(dd, 1/*code*/, 0, fdet->firmware_ptr,
888 							fdet->firmware_len);
889 	if (ret)
890 		return ret;
891 
892 	/*
893 	 * DC reset step 4. Host starts the DC8051 firmware
894 	 */
895 	/*
896 	 * Firmware load step 6.  Set MISC_CFG_FW_CTRL.FW_8051_LOADED
897 	 */
898 	write_csr(dd, MISC_CFG_FW_CTRL, MISC_CFG_FW_CTRL_FW_8051_LOADED_SMASK);
899 
900 	/* Firmware load steps 7-10 */
901 	ret = run_rsa(dd, "8051", fdet->signature);
902 	if (ret)
903 		return ret;
904 
905 	/* clear all reset bits, releasing the 8051 */
906 	write_csr(dd, DC_DC8051_CFG_RST, 0ull);
907 
908 	/*
909 	 * DC reset step 5. Wait for firmware to be ready to accept host
910 	 * requests.
911 	 */
912 	ret = wait_fm_ready(dd, TIMEOUT_8051_START);
913 	if (ret) { /* timed out */
914 		dd_dev_err(dd, "8051 start timeout, current state 0x%x\n",
915 			get_firmware_state(dd));
916 		return -ETIMEDOUT;
917 	}
918 
919 	read_misc_status(dd, &ver_a, &ver_b);
920 	dd_dev_info(dd, "8051 firmware version %d.%d\n",
921 		(int)ver_b, (int)ver_a);
922 	dd->dc8051_ver = dc8051_ver(ver_b, ver_a);
923 
924 	return 0;
925 }
926 
927 /*
928  * Write the SBus request register
929  *
930  * No need for masking - the arguments are sized exactly.
931  */
sbus_request(struct hfi1_devdata * dd,u8 receiver_addr,u8 data_addr,u8 command,u32 data_in)932 void sbus_request(struct hfi1_devdata *dd,
933 		  u8 receiver_addr, u8 data_addr, u8 command, u32 data_in)
934 {
935 	write_csr(dd, ASIC_CFG_SBUS_REQUEST,
936 		((u64)data_in << ASIC_CFG_SBUS_REQUEST_DATA_IN_SHIFT)
937 		| ((u64)command << ASIC_CFG_SBUS_REQUEST_COMMAND_SHIFT)
938 		| ((u64)data_addr << ASIC_CFG_SBUS_REQUEST_DATA_ADDR_SHIFT)
939 		| ((u64)receiver_addr
940 			<< ASIC_CFG_SBUS_REQUEST_RECEIVER_ADDR_SHIFT));
941 }
942 
943 /*
944  * Turn off the SBus and fabric serdes spicos.
945  *
946  * + Must be called with Sbus fast mode turned on.
947  * + Must be called after fabric serdes broadcast is set up.
948  * + Must be called before the 8051 is loaded - assumes 8051 is not loaded
949  *   when using MISC_CFG_FW_CTRL.
950  */
turn_off_spicos(struct hfi1_devdata * dd,int flags)951 static void turn_off_spicos(struct hfi1_devdata *dd, int flags)
952 {
953 	/* only needed on A0 */
954 	if (!is_a0(dd))
955 		return;
956 
957 	dd_dev_info(dd, "Turning off spicos:%s%s\n",
958 		flags & SPICO_SBUS ? " SBus" : "",
959 		flags & SPICO_FABRIC ? " fabric" : "");
960 
961 	write_csr(dd, MISC_CFG_FW_CTRL, ENABLE_SPICO_SMASK);
962 	/* disable SBus spico */
963 	if (flags & SPICO_SBUS)
964 		sbus_request(dd, SBUS_MASTER_BROADCAST, 0x01,
965 			WRITE_SBUS_RECEIVER, 0x00000040);
966 
967 	/* disable the fabric serdes spicos */
968 	if (flags & SPICO_FABRIC)
969 		sbus_request(dd, fabric_serdes_broadcast[dd->hfi1_id],
970 			     0x07, WRITE_SBUS_RECEIVER, 0x00000000);
971 	write_csr(dd, MISC_CFG_FW_CTRL, 0);
972 }
973 
974 /*
975  *  Reset all of the fabric serdes for our HFI.
976  */
fabric_serdes_reset(struct hfi1_devdata * dd)977 void fabric_serdes_reset(struct hfi1_devdata *dd)
978 {
979 	u8 ra;
980 
981 	if (dd->icode != ICODE_RTL_SILICON) /* only for RTL */
982 		return;
983 
984 	ra = fabric_serdes_broadcast[dd->hfi1_id];
985 
986 	acquire_hw_mutex(dd);
987 	set_sbus_fast_mode(dd);
988 	/* place SerDes in reset and disable SPICO */
989 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000011);
990 	/* wait 100 refclk cycles @ 156.25MHz => 640ns */
991 	udelay(1);
992 	/* remove SerDes reset */
993 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000010);
994 	/* turn SPICO enable on */
995 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000002);
996 	clear_sbus_fast_mode(dd);
997 	release_hw_mutex(dd);
998 }
999 
1000 /* Access to the SBus in this routine should probably be serialized */
sbus_request_slow(struct hfi1_devdata * dd,u8 receiver_addr,u8 data_addr,u8 command,u32 data_in)1001 int sbus_request_slow(struct hfi1_devdata *dd,
1002 		      u8 receiver_addr, u8 data_addr, u8 command, u32 data_in)
1003 {
1004 	u64 reg, count = 0;
1005 
1006 	sbus_request(dd, receiver_addr, data_addr, command, data_in);
1007 	write_csr(dd, ASIC_CFG_SBUS_EXECUTE,
1008 		  ASIC_CFG_SBUS_EXECUTE_EXECUTE_SMASK);
1009 	/* Wait for both DONE and RCV_DATA_VALID to go high */
1010 	reg = read_csr(dd, ASIC_STS_SBUS_RESULT);
1011 	while (!((reg & ASIC_STS_SBUS_RESULT_DONE_SMASK) &&
1012 		 (reg & ASIC_STS_SBUS_RESULT_RCV_DATA_VALID_SMASK))) {
1013 		if (count++ >= SBUS_MAX_POLL_COUNT) {
1014 			u64 counts = read_csr(dd, ASIC_STS_SBUS_COUNTERS);
1015 			/*
1016 			 * If the loop has timed out, we are OK if DONE bit
1017 			 * is set and RCV_DATA_VALID and EXECUTE counters
1018 			 * are the same. If not, we cannot proceed.
1019 			 */
1020 			if ((reg & ASIC_STS_SBUS_RESULT_DONE_SMASK) &&
1021 			    (SBUS_COUNTER(counts, RCV_DATA_VALID) ==
1022 			     SBUS_COUNTER(counts, EXECUTE)))
1023 				break;
1024 			return -ETIMEDOUT;
1025 		}
1026 		udelay(1);
1027 		reg = read_csr(dd, ASIC_STS_SBUS_RESULT);
1028 	}
1029 	count = 0;
1030 	write_csr(dd, ASIC_CFG_SBUS_EXECUTE, 0);
1031 	/* Wait for DONE to clear after EXECUTE is cleared */
1032 	reg = read_csr(dd, ASIC_STS_SBUS_RESULT);
1033 	while (reg & ASIC_STS_SBUS_RESULT_DONE_SMASK) {
1034 		if (count++ >= SBUS_MAX_POLL_COUNT)
1035 			return -ETIME;
1036 		udelay(1);
1037 		reg = read_csr(dd, ASIC_STS_SBUS_RESULT);
1038 	}
1039 	return 0;
1040 }
1041 
load_fabric_serdes_firmware(struct hfi1_devdata * dd,struct firmware_details * fdet)1042 static int load_fabric_serdes_firmware(struct hfi1_devdata *dd,
1043 				       struct firmware_details *fdet)
1044 {
1045 	int i, err;
1046 	const u8 ra = fabric_serdes_broadcast[dd->hfi1_id]; /* receiver addr */
1047 
1048 	dd_dev_info(dd, "Downloading fabric firmware\n");
1049 
1050 	/* step 1: load security variables */
1051 	load_security_variables(dd, fdet);
1052 	/* step 2: place SerDes in reset and disable SPICO */
1053 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000011);
1054 	/* wait 100 refclk cycles @ 156.25MHz => 640ns */
1055 	udelay(1);
1056 	/* step 3:  remove SerDes reset */
1057 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000010);
1058 	/* step 4: assert IMEM override */
1059 	sbus_request(dd, ra, 0x00, WRITE_SBUS_RECEIVER, 0x40000000);
1060 	/* step 5: download SerDes machine code */
1061 	for (i = 0; i < fdet->firmware_len; i += 4) {
1062 		sbus_request(dd, ra, 0x0a, WRITE_SBUS_RECEIVER,
1063 					*(u32 *)&fdet->firmware_ptr[i]);
1064 	}
1065 	/* step 6: IMEM override off */
1066 	sbus_request(dd, ra, 0x00, WRITE_SBUS_RECEIVER, 0x00000000);
1067 	/* step 7: turn ECC on */
1068 	sbus_request(dd, ra, 0x0b, WRITE_SBUS_RECEIVER, 0x000c0000);
1069 
1070 	/* steps 8-11: run the RSA engine */
1071 	err = run_rsa(dd, "fabric serdes", fdet->signature);
1072 	if (err)
1073 		return err;
1074 
1075 	/* step 12: turn SPICO enable on */
1076 	sbus_request(dd, ra, 0x07, WRITE_SBUS_RECEIVER, 0x00000002);
1077 	/* step 13: enable core hardware interrupts */
1078 	sbus_request(dd, ra, 0x08, WRITE_SBUS_RECEIVER, 0x00000000);
1079 
1080 	return 0;
1081 }
1082 
load_sbus_firmware(struct hfi1_devdata * dd,struct firmware_details * fdet)1083 static int load_sbus_firmware(struct hfi1_devdata *dd,
1084 			      struct firmware_details *fdet)
1085 {
1086 	int i, err;
1087 	const u8 ra = SBUS_MASTER_BROADCAST; /* receiver address */
1088 
1089 	dd_dev_info(dd, "Downloading SBus firmware\n");
1090 
1091 	/* step 1: load security variables */
1092 	load_security_variables(dd, fdet);
1093 	/* step 2: place SPICO into reset and enable off */
1094 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x000000c0);
1095 	/* step 3: remove reset, enable off, IMEM_CNTRL_EN on */
1096 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x00000240);
1097 	/* step 4: set starting IMEM address for burst download */
1098 	sbus_request(dd, ra, 0x03, WRITE_SBUS_RECEIVER, 0x80000000);
1099 	/* step 5: download the SBus Master machine code */
1100 	for (i = 0; i < fdet->firmware_len; i += 4) {
1101 		sbus_request(dd, ra, 0x14, WRITE_SBUS_RECEIVER,
1102 					*(u32 *)&fdet->firmware_ptr[i]);
1103 	}
1104 	/* step 6: set IMEM_CNTL_EN off */
1105 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x00000040);
1106 	/* step 7: turn ECC on */
1107 	sbus_request(dd, ra, 0x16, WRITE_SBUS_RECEIVER, 0x000c0000);
1108 
1109 	/* steps 8-11: run the RSA engine */
1110 	err = run_rsa(dd, "SBus", fdet->signature);
1111 	if (err)
1112 		return err;
1113 
1114 	/* step 12: set SPICO_ENABLE on */
1115 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x00000140);
1116 
1117 	return 0;
1118 }
1119 
load_pcie_serdes_firmware(struct hfi1_devdata * dd,struct firmware_details * fdet)1120 static int load_pcie_serdes_firmware(struct hfi1_devdata *dd,
1121 				     struct firmware_details *fdet)
1122 {
1123 	int i;
1124 	const u8 ra = SBUS_MASTER_BROADCAST; /* receiver address */
1125 
1126 	dd_dev_info(dd, "Downloading PCIe firmware\n");
1127 
1128 	/* step 1: load security variables */
1129 	load_security_variables(dd, fdet);
1130 	/* step 2: assert single step (halts the SBus Master spico) */
1131 	sbus_request(dd, ra, 0x05, WRITE_SBUS_RECEIVER, 0x00000001);
1132 	/* step 3: enable XDMEM access */
1133 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x00000d40);
1134 	/* step 4: load firmware into SBus Master XDMEM */
1135 	/* NOTE: the dmem address, write_en, and wdata are all pre-packed,
1136 	   we only need to pick up the bytes and write them */
1137 	for (i = 0; i < fdet->firmware_len; i += 4) {
1138 		sbus_request(dd, ra, 0x04, WRITE_SBUS_RECEIVER,
1139 					*(u32 *)&fdet->firmware_ptr[i]);
1140 	}
1141 	/* step 5: disable XDMEM access */
1142 	sbus_request(dd, ra, 0x01, WRITE_SBUS_RECEIVER, 0x00000140);
1143 	/* step 6: allow SBus Spico to run */
1144 	sbus_request(dd, ra, 0x05, WRITE_SBUS_RECEIVER, 0x00000000);
1145 
1146 	/* steps 7-11: run RSA, if it succeeds, firmware is available to
1147 	   be swapped */
1148 	return run_rsa(dd, "PCIe serdes", fdet->signature);
1149 }
1150 
1151 /*
1152  * Set the given broadcast values on the given list of devices.
1153  */
set_serdes_broadcast(struct hfi1_devdata * dd,u8 bg1,u8 bg2,const u8 * addrs,int count)1154 static void set_serdes_broadcast(struct hfi1_devdata *dd, u8 bg1, u8 bg2,
1155 				 const u8 *addrs, int count)
1156 {
1157 	while (--count >= 0) {
1158 		/*
1159 		 * Set BROADCAST_GROUP_1 and BROADCAST_GROUP_2, leave
1160 		 * defaults for everything else.  Do not read-modify-write,
1161 		 * per instruction from the manufacturer.
1162 		 *
1163 		 * Register 0xfd:
1164 		 *	bits    what
1165 		 *	-----	---------------------------------
1166 		 *	  0	IGNORE_BROADCAST  (default 0)
1167 		 *	11:4	BROADCAST_GROUP_1 (default 0xff)
1168 		 *	23:16	BROADCAST_GROUP_2 (default 0xff)
1169 		 */
1170 		sbus_request(dd, addrs[count], 0xfd, WRITE_SBUS_RECEIVER,
1171 				(u32)bg1 << 4 | (u32)bg2 << 16);
1172 	}
1173 }
1174 
acquire_hw_mutex(struct hfi1_devdata * dd)1175 int acquire_hw_mutex(struct hfi1_devdata *dd)
1176 {
1177 	unsigned long timeout;
1178 	int try = 0;
1179 	u8 mask = 1 << dd->hfi1_id;
1180 	u8 user;
1181 
1182 retry:
1183 	timeout = msecs_to_jiffies(HM_TIMEOUT) + jiffies;
1184 	while (1) {
1185 		write_csr(dd, ASIC_CFG_MUTEX, mask);
1186 		user = (u8)read_csr(dd, ASIC_CFG_MUTEX);
1187 		if (user == mask)
1188 			return 0; /* success */
1189 		if (time_after(jiffies, timeout))
1190 			break; /* timed out */
1191 		msleep(20);
1192 	}
1193 
1194 	/* timed out */
1195 	dd_dev_err(dd,
1196 		"Unable to acquire hardware mutex, mutex mask %u, my mask %u (%s)\n",
1197 		(u32)user, (u32)mask, (try == 0) ? "retrying" : "giving up");
1198 
1199 	if (try == 0) {
1200 		/* break mutex and retry */
1201 		write_csr(dd, ASIC_CFG_MUTEX, 0);
1202 		try++;
1203 		goto retry;
1204 	}
1205 
1206 	return -EBUSY;
1207 }
1208 
release_hw_mutex(struct hfi1_devdata * dd)1209 void release_hw_mutex(struct hfi1_devdata *dd)
1210 {
1211 	write_csr(dd, ASIC_CFG_MUTEX, 0);
1212 }
1213 
set_sbus_fast_mode(struct hfi1_devdata * dd)1214 void set_sbus_fast_mode(struct hfi1_devdata *dd)
1215 {
1216 	write_csr(dd, ASIC_CFG_SBUS_EXECUTE,
1217 				ASIC_CFG_SBUS_EXECUTE_FAST_MODE_SMASK);
1218 }
1219 
clear_sbus_fast_mode(struct hfi1_devdata * dd)1220 void clear_sbus_fast_mode(struct hfi1_devdata *dd)
1221 {
1222 	u64 reg, count = 0;
1223 
1224 	reg = read_csr(dd, ASIC_STS_SBUS_COUNTERS);
1225 	while (SBUS_COUNTER(reg, EXECUTE) !=
1226 	       SBUS_COUNTER(reg, RCV_DATA_VALID)) {
1227 		if (count++ >= SBUS_MAX_POLL_COUNT)
1228 			break;
1229 		udelay(1);
1230 		reg = read_csr(dd, ASIC_STS_SBUS_COUNTERS);
1231 	}
1232 	write_csr(dd, ASIC_CFG_SBUS_EXECUTE, 0);
1233 }
1234 
load_firmware(struct hfi1_devdata * dd)1235 int load_firmware(struct hfi1_devdata *dd)
1236 {
1237 	int ret;
1238 
1239 	if (fw_fabric_serdes_load) {
1240 		ret = acquire_hw_mutex(dd);
1241 		if (ret)
1242 			return ret;
1243 
1244 		set_sbus_fast_mode(dd);
1245 
1246 		set_serdes_broadcast(dd, all_fabric_serdes_broadcast,
1247 				fabric_serdes_broadcast[dd->hfi1_id],
1248 				fabric_serdes_addrs[dd->hfi1_id],
1249 				NUM_FABRIC_SERDES);
1250 		turn_off_spicos(dd, SPICO_FABRIC);
1251 		ret = load_fabric_serdes_firmware(dd, &fw_fabric);
1252 
1253 		clear_sbus_fast_mode(dd);
1254 		release_hw_mutex(dd);
1255 		if (ret)
1256 			return ret;
1257 	}
1258 
1259 	if (fw_8051_load) {
1260 		ret = load_8051_firmware(dd, &fw_8051);
1261 		if (ret)
1262 			return ret;
1263 	}
1264 
1265 	return 0;
1266 }
1267 
hfi1_firmware_init(struct hfi1_devdata * dd)1268 int hfi1_firmware_init(struct hfi1_devdata *dd)
1269 {
1270 	/* only RTL can use these */
1271 	if (dd->icode != ICODE_RTL_SILICON) {
1272 		fw_fabric_serdes_load = 0;
1273 		fw_pcie_serdes_load = 0;
1274 		fw_sbus_load = 0;
1275 	}
1276 
1277 	/* no 8051 or QSFP on simulator */
1278 	if (dd->icode == ICODE_FUNCTIONAL_SIMULATOR) {
1279 		fw_8051_load = 0;
1280 		platform_config_load = 0;
1281 	}
1282 
1283 	if (!fw_8051_name) {
1284 		if (dd->icode == ICODE_RTL_SILICON)
1285 			fw_8051_name = DEFAULT_FW_8051_NAME_ASIC;
1286 		else
1287 			fw_8051_name = DEFAULT_FW_8051_NAME_FPGA;
1288 	}
1289 	if (!fw_fabric_serdes_name)
1290 		fw_fabric_serdes_name = DEFAULT_FW_FABRIC_NAME;
1291 	if (!fw_sbus_name)
1292 		fw_sbus_name = DEFAULT_FW_SBUS_NAME;
1293 	if (!fw_pcie_serdes_name)
1294 		fw_pcie_serdes_name = DEFAULT_FW_PCIE_NAME;
1295 	if (!platform_config_name)
1296 		platform_config_name = DEFAULT_PLATFORM_CONFIG_NAME;
1297 
1298 	return obtain_firmware(dd);
1299 }
1300 
parse_platform_config(struct hfi1_devdata * dd)1301 int parse_platform_config(struct hfi1_devdata *dd)
1302 {
1303 	struct platform_config_cache *pcfgcache = &dd->pcfg_cache;
1304 	u32 *ptr = NULL;
1305 	u32 header1 = 0, header2 = 0, magic_num = 0, crc = 0;
1306 	u32 record_idx = 0, table_type = 0, table_length_dwords = 0;
1307 
1308 	if (platform_config == NULL) {
1309 		dd_dev_info(dd, "%s: Missing config file\n", __func__);
1310 		goto bail;
1311 	}
1312 	ptr = (u32 *)platform_config->data;
1313 
1314 	magic_num = *ptr;
1315 	ptr++;
1316 	if (magic_num != PLATFORM_CONFIG_MAGIC_NUM) {
1317 		dd_dev_info(dd, "%s: Bad config file\n", __func__);
1318 		goto bail;
1319 	}
1320 
1321 	while (ptr < (u32 *)(platform_config->data + platform_config->size)) {
1322 		header1 = *ptr;
1323 		header2 = *(ptr + 1);
1324 		if (header1 != ~header2) {
1325 			dd_dev_info(dd, "%s: Failed validation at offset %ld\n",
1326 				__func__, (ptr - (u32 *)platform_config->data));
1327 			goto bail;
1328 		}
1329 
1330 		record_idx = *ptr &
1331 			((1 << PLATFORM_CONFIG_HEADER_RECORD_IDX_LEN_BITS) - 1);
1332 
1333 		table_length_dwords = (*ptr >>
1334 				PLATFORM_CONFIG_HEADER_TABLE_LENGTH_SHIFT) &
1335 		      ((1 << PLATFORM_CONFIG_HEADER_TABLE_LENGTH_LEN_BITS) - 1);
1336 
1337 		table_type = (*ptr >> PLATFORM_CONFIG_HEADER_TABLE_TYPE_SHIFT) &
1338 			((1 << PLATFORM_CONFIG_HEADER_TABLE_TYPE_LEN_BITS) - 1);
1339 
1340 		/* Done with this set of headers */
1341 		ptr += 2;
1342 
1343 		if (record_idx) {
1344 			/* data table */
1345 			switch (table_type) {
1346 			case PLATFORM_CONFIG_SYSTEM_TABLE:
1347 				pcfgcache->config_tables[table_type].num_table =
1348 									1;
1349 				break;
1350 			case PLATFORM_CONFIG_PORT_TABLE:
1351 				pcfgcache->config_tables[table_type].num_table =
1352 									2;
1353 				break;
1354 			case PLATFORM_CONFIG_RX_PRESET_TABLE:
1355 				/* fall through */
1356 			case PLATFORM_CONFIG_TX_PRESET_TABLE:
1357 				/* fall through */
1358 			case PLATFORM_CONFIG_QSFP_ATTEN_TABLE:
1359 				/* fall through */
1360 			case PLATFORM_CONFIG_VARIABLE_SETTINGS_TABLE:
1361 				pcfgcache->config_tables[table_type].num_table =
1362 							table_length_dwords;
1363 				break;
1364 			default:
1365 				dd_dev_info(dd,
1366 				      "%s: Unknown data table %d, offset %ld\n",
1367 					__func__, table_type,
1368 				       (ptr - (u32 *)platform_config->data));
1369 				goto bail; /* We don't trust this file now */
1370 			}
1371 			pcfgcache->config_tables[table_type].table = ptr;
1372 		} else {
1373 			/* metadata table */
1374 			switch (table_type) {
1375 			case PLATFORM_CONFIG_SYSTEM_TABLE:
1376 				/* fall through */
1377 			case PLATFORM_CONFIG_PORT_TABLE:
1378 				/* fall through */
1379 			case PLATFORM_CONFIG_RX_PRESET_TABLE:
1380 				/* fall through */
1381 			case PLATFORM_CONFIG_TX_PRESET_TABLE:
1382 				/* fall through */
1383 			case PLATFORM_CONFIG_QSFP_ATTEN_TABLE:
1384 				/* fall through */
1385 			case PLATFORM_CONFIG_VARIABLE_SETTINGS_TABLE:
1386 				break;
1387 			default:
1388 				dd_dev_info(dd,
1389 				  "%s: Unknown metadata table %d, offset %ld\n",
1390 				  __func__, table_type,
1391 				  (ptr - (u32 *)platform_config->data));
1392 				goto bail; /* We don't trust this file now */
1393 			}
1394 			pcfgcache->config_tables[table_type].table_metadata =
1395 									ptr;
1396 		}
1397 
1398 		/* Calculate and check table crc */
1399 		crc = crc32_le(~(u32)0, (unsigned char const *)ptr,
1400 				(table_length_dwords * 4));
1401 		crc ^= ~(u32)0;
1402 
1403 		/* Jump the table */
1404 		ptr += table_length_dwords;
1405 		if (crc != *ptr) {
1406 			dd_dev_info(dd, "%s: Failed CRC check at offset %ld\n",
1407 				__func__, (ptr - (u32 *)platform_config->data));
1408 			goto bail;
1409 		}
1410 		/* Jump the CRC DWORD */
1411 		ptr++;
1412 	}
1413 
1414 	pcfgcache->cache_valid = 1;
1415 	return 0;
1416 bail:
1417 	memset(pcfgcache, 0, sizeof(struct platform_config_cache));
1418 	return -EINVAL;
1419 }
1420 
get_platform_fw_field_metadata(struct hfi1_devdata * dd,int table,int field,u32 * field_len_bits,u32 * field_start_bits)1421 static int get_platform_fw_field_metadata(struct hfi1_devdata *dd, int table,
1422 		int field, u32 *field_len_bits, u32 *field_start_bits)
1423 {
1424 	struct platform_config_cache *pcfgcache = &dd->pcfg_cache;
1425 	u32 *src_ptr = NULL;
1426 
1427 	if (!pcfgcache->cache_valid)
1428 		return -EINVAL;
1429 
1430 	switch (table) {
1431 	case PLATFORM_CONFIG_SYSTEM_TABLE:
1432 		/* fall through */
1433 	case PLATFORM_CONFIG_PORT_TABLE:
1434 		/* fall through */
1435 	case PLATFORM_CONFIG_RX_PRESET_TABLE:
1436 		/* fall through */
1437 	case PLATFORM_CONFIG_TX_PRESET_TABLE:
1438 		/* fall through */
1439 	case PLATFORM_CONFIG_QSFP_ATTEN_TABLE:
1440 		/* fall through */
1441 	case PLATFORM_CONFIG_VARIABLE_SETTINGS_TABLE:
1442 		if (field && field < platform_config_table_limits[table])
1443 			src_ptr =
1444 			pcfgcache->config_tables[table].table_metadata + field;
1445 		break;
1446 	default:
1447 		dd_dev_info(dd, "%s: Unknown table\n", __func__);
1448 		break;
1449 	}
1450 
1451 	if (!src_ptr)
1452 		return -EINVAL;
1453 
1454 	if (field_start_bits)
1455 		*field_start_bits = *src_ptr &
1456 		      ((1 << METADATA_TABLE_FIELD_START_LEN_BITS) - 1);
1457 
1458 	if (field_len_bits)
1459 		*field_len_bits = (*src_ptr >> METADATA_TABLE_FIELD_LEN_SHIFT)
1460 		       & ((1 << METADATA_TABLE_FIELD_LEN_LEN_BITS) - 1);
1461 
1462 	return 0;
1463 }
1464 
1465 /* This is the central interface to getting data out of the platform config
1466  * file. It depends on parse_platform_config() having populated the
1467  * platform_config_cache in hfi1_devdata, and checks the cache_valid member to
1468  * validate the sanity of the cache.
1469  *
1470  * The non-obvious parameters:
1471  * @table_index: Acts as a look up key into which instance of the tables the
1472  * relevant field is fetched from.
1473  *
1474  * This applies to the data tables that have multiple instances. The port table
1475  * is an exception to this rule as each HFI only has one port and thus the
1476  * relevant table can be distinguished by hfi_id.
1477  *
1478  * @data: pointer to memory that will be populated with the field requested.
1479  * @len: length of memory pointed by @data in bytes.
1480  */
get_platform_config_field(struct hfi1_devdata * dd,enum platform_config_table_type_encoding table_type,int table_index,int field_index,u32 * data,u32 len)1481 int get_platform_config_field(struct hfi1_devdata *dd,
1482 			enum platform_config_table_type_encoding table_type,
1483 			int table_index, int field_index, u32 *data, u32 len)
1484 {
1485 	int ret = 0, wlen = 0, seek = 0;
1486 	u32 field_len_bits = 0, field_start_bits = 0, *src_ptr = NULL;
1487 	struct platform_config_cache *pcfgcache = &dd->pcfg_cache;
1488 
1489 	if (data)
1490 		memset(data, 0, len);
1491 	else
1492 		return -EINVAL;
1493 
1494 	ret = get_platform_fw_field_metadata(dd, table_type, field_index,
1495 					&field_len_bits, &field_start_bits);
1496 	if (ret)
1497 		return -EINVAL;
1498 
1499 	/* Convert length to bits */
1500 	len *= 8;
1501 
1502 	/* Our metadata function checked cache_valid and field_index for us */
1503 	switch (table_type) {
1504 	case PLATFORM_CONFIG_SYSTEM_TABLE:
1505 		src_ptr = pcfgcache->config_tables[table_type].table;
1506 
1507 		if (field_index != SYSTEM_TABLE_QSFP_POWER_CLASS_MAX) {
1508 			if (len < field_len_bits)
1509 				return -EINVAL;
1510 
1511 			seek = field_start_bits/8;
1512 			wlen = field_len_bits/8;
1513 
1514 			src_ptr = (u32 *)((u8 *)src_ptr + seek);
1515 
1516 			/* We expect the field to be byte aligned and whole byte
1517 			 * lengths if we are here */
1518 			memcpy(data, src_ptr, wlen);
1519 			return 0;
1520 		}
1521 		break;
1522 	case PLATFORM_CONFIG_PORT_TABLE:
1523 		/* Port table is 4 DWORDS in META_VERSION 0 */
1524 		src_ptr = dd->hfi1_id ?
1525 			pcfgcache->config_tables[table_type].table + 4 :
1526 			pcfgcache->config_tables[table_type].table;
1527 		break;
1528 	case PLATFORM_CONFIG_RX_PRESET_TABLE:
1529 		/* fall through */
1530 	case PLATFORM_CONFIG_TX_PRESET_TABLE:
1531 		/* fall through */
1532 	case PLATFORM_CONFIG_QSFP_ATTEN_TABLE:
1533 		/* fall through */
1534 	case PLATFORM_CONFIG_VARIABLE_SETTINGS_TABLE:
1535 		src_ptr = pcfgcache->config_tables[table_type].table;
1536 
1537 		if (table_index <
1538 			pcfgcache->config_tables[table_type].num_table)
1539 			src_ptr += table_index;
1540 		else
1541 			src_ptr = NULL;
1542 		break;
1543 	default:
1544 		dd_dev_info(dd, "%s: Unknown table\n", __func__);
1545 		break;
1546 	}
1547 
1548 	if (!src_ptr || len < field_len_bits)
1549 		return -EINVAL;
1550 
1551 	src_ptr += (field_start_bits/32);
1552 	*data = (*src_ptr >> (field_start_bits % 32)) &
1553 			((1 << field_len_bits) - 1);
1554 
1555 	return 0;
1556 }
1557 
1558 /*
1559  * Download the firmware needed for the Gen3 PCIe SerDes.  An update
1560  * to the SBus firmware is needed before updating the PCIe firmware.
1561  *
1562  * Note: caller must be holding the HW mutex.
1563  */
load_pcie_firmware(struct hfi1_devdata * dd)1564 int load_pcie_firmware(struct hfi1_devdata *dd)
1565 {
1566 	int ret = 0;
1567 
1568 	/* both firmware loads below use the SBus */
1569 	set_sbus_fast_mode(dd);
1570 
1571 	if (fw_sbus_load && (dd->flags & HFI1_DO_INIT_ASIC)) {
1572 		turn_off_spicos(dd, SPICO_SBUS);
1573 		ret = load_sbus_firmware(dd, &fw_sbus);
1574 		if (ret)
1575 			goto done;
1576 	}
1577 
1578 	if (fw_pcie_serdes_load) {
1579 		dd_dev_info(dd, "Setting PCIe SerDes broadcast\n");
1580 		set_serdes_broadcast(dd, all_pcie_serdes_broadcast,
1581 					pcie_serdes_broadcast[dd->hfi1_id],
1582 					pcie_serdes_addrs[dd->hfi1_id],
1583 					NUM_PCIE_SERDES);
1584 		ret = load_pcie_serdes_firmware(dd, &fw_pcie);
1585 		if (ret)
1586 			goto done;
1587 	}
1588 
1589 done:
1590 	clear_sbus_fast_mode(dd);
1591 
1592 	return ret;
1593 }
1594 
1595 /*
1596  * Read the GUID from the hardware, store it in dd.
1597  */
read_guid(struct hfi1_devdata * dd)1598 void read_guid(struct hfi1_devdata *dd)
1599 {
1600 	/* Take the DC out of reset to get a valid GUID value */
1601 	write_csr(dd, CCE_DC_CTRL, 0);
1602 	(void) read_csr(dd, CCE_DC_CTRL);
1603 
1604 	dd->base_guid = read_csr(dd, DC_DC8051_CFG_LOCAL_GUID);
1605 	dd_dev_info(dd, "GUID %llx",
1606 		(unsigned long long)dd->base_guid);
1607 }
1608