1 /*
2 * Intel Wireless WiMAX Connection 2400m
3 * Firmware uploader
4 *
5 *
6 * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * * Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
17 * distribution.
18 * * Neither the name of Intel Corporation nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 *
35 * Intel Corporation <linux-wimax@intel.com>
36 * Yanir Lubetkin <yanirx.lubetkin@intel.com>
37 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
38 * - Initial implementation
39 *
40 *
41 * THE PROCEDURE
42 *
43 * The 2400m and derived devices work in two modes: boot-mode or
44 * normal mode. In boot mode we can execute only a handful of commands
45 * targeted at uploading the firmware and launching it.
46 *
47 * The 2400m enters boot mode when it is first connected to the
48 * system, when it crashes and when you ask it to reboot. There are
49 * two submodes of the boot mode: signed and non-signed. Signed takes
50 * firmwares signed with a certain private key, non-signed takes any
51 * firmware. Normal hardware takes only signed firmware.
52 *
53 * On boot mode, in USB, we write to the device using the bulk out
54 * endpoint and read from it in the notification endpoint.
55 *
56 * Upon entrance to boot mode, the device sends (preceded with a few
57 * zero length packets (ZLPs) on the notification endpoint in USB) a
58 * reboot barker (4 le32 words with the same value). We ack it by
59 * sending the same barker to the device. The device acks with a
60 * reboot ack barker (4 le32 words with value I2400M_ACK_BARKER) and
61 * then is fully booted. At this point we can upload the firmware.
62 *
63 * Note that different iterations of the device and EEPROM
64 * configurations will send different [re]boot barkers; these are
65 * collected in i2400m_barker_db along with the firmware
66 * characteristics they require.
67 *
68 * This process is accomplished by the i2400m_bootrom_init()
69 * function. All the device interaction happens through the
70 * i2400m_bm_cmd() [boot mode command]. Special return values will
71 * indicate if the device did reset during the process.
72 *
73 * After this, we read the MAC address and then (if needed)
74 * reinitialize the device. We need to read it ahead of time because
75 * in the future, we might not upload the firmware until userspace
76 * 'ifconfig up's the device.
77 *
78 * We can then upload the firmware file. The file is composed of a BCF
79 * header (basic data, keys and signatures) and a list of write
80 * commands and payloads. Optionally more BCF headers might follow the
81 * main payload. We first upload the header [i2400m_dnload_init()] and
82 * then pass the commands and payloads verbatim to the i2400m_bm_cmd()
83 * function [i2400m_dnload_bcf()]. Then we tell the device to jump to
84 * the new firmware [i2400m_dnload_finalize()].
85 *
86 * Once firmware is uploaded, we are good to go :)
87 *
88 * When we don't know in which mode we are, we first try by sending a
89 * warm reset request that will take us to boot-mode. If we time out
90 * waiting for a reboot barker, that means maybe we are already in
91 * boot mode, so we send a reboot barker.
92 *
93 * COMMAND EXECUTION
94 *
95 * This code (and process) is single threaded; for executing commands,
96 * we post a URB to the notification endpoint, post the command, wait
97 * for data on the notification buffer. We don't need to worry about
98 * others as we know we are the only ones in there.
99 *
100 * BACKEND IMPLEMENTATION
101 *
102 * This code is bus-generic; the bus-specific driver provides back end
103 * implementations to send a boot mode command to the device and to
104 * read an acknolwedgement from it (or an asynchronous notification)
105 * from it.
106 *
107 * FIRMWARE LOADING
108 *
109 * Note that in some cases, we can't just load a firmware file (for
110 * example, when resuming). For that, we might cache the firmware
111 * file. Thus, when doing the bootstrap, if there is a cache firmware
112 * file, it is used; if not, loading from disk is attempted.
113 *
114 * ROADMAP
115 *
116 * i2400m_barker_db_init Called by i2400m_driver_init()
117 * i2400m_barker_db_add
118 *
119 * i2400m_barker_db_exit Called by i2400m_driver_exit()
120 *
121 * i2400m_dev_bootstrap Called by __i2400m_dev_start()
122 * request_firmware
123 * i2400m_fw_bootstrap
124 * i2400m_fw_check
125 * i2400m_fw_hdr_check
126 * i2400m_fw_dnload
127 * release_firmware
128 *
129 * i2400m_fw_dnload
130 * i2400m_bootrom_init
131 * i2400m_bm_cmd
132 * i2400m_reset
133 * i2400m_dnload_init
134 * i2400m_dnload_init_signed
135 * i2400m_dnload_init_nonsigned
136 * i2400m_download_chunk
137 * i2400m_bm_cmd
138 * i2400m_dnload_bcf
139 * i2400m_bm_cmd
140 * i2400m_dnload_finalize
141 * i2400m_bm_cmd
142 *
143 * i2400m_bm_cmd
144 * i2400m->bus_bm_cmd_send()
145 * i2400m->bus_bm_wait_for_ack
146 * __i2400m_bm_ack_verify
147 * i2400m_is_boot_barker
148 *
149 * i2400m_bm_cmd_prepare Used by bus-drivers to prep
150 * commands before sending
151 *
152 * i2400m_pm_notifier Called on Power Management events
153 * i2400m_fw_cache
154 * i2400m_fw_uncache
155 */
156 #include <linux/firmware.h>
157 #include <linux/sched.h>
158 #include <linux/slab.h>
159 #include <linux/usb.h>
160 #include <linux/export.h>
161 #include "i2400m.h"
162
163
164 #define D_SUBMODULE fw
165 #include "debug-levels.h"
166
167
168 static const __le32 i2400m_ACK_BARKER[4] = {
169 cpu_to_le32(I2400M_ACK_BARKER),
170 cpu_to_le32(I2400M_ACK_BARKER),
171 cpu_to_le32(I2400M_ACK_BARKER),
172 cpu_to_le32(I2400M_ACK_BARKER)
173 };
174
175
176 /**
177 * Prepare a boot-mode command for delivery
178 *
179 * @cmd: pointer to bootrom header to prepare
180 *
181 * Computes checksum if so needed. After calling this function, DO NOT
182 * modify the command or header as the checksum won't work anymore.
183 *
184 * We do it from here because some times we cannot do it in the
185 * original context the command was sent (it is a const), so when we
186 * copy it to our staging buffer, we add the checksum there.
187 */
i2400m_bm_cmd_prepare(struct i2400m_bootrom_header * cmd)188 void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header *cmd)
189 {
190 if (i2400m_brh_get_use_checksum(cmd)) {
191 int i;
192 u32 checksum = 0;
193 const u32 *checksum_ptr = (void *) cmd->payload;
194 for (i = 0; i < cmd->data_size / 4; i++)
195 checksum += cpu_to_le32(*checksum_ptr++);
196 checksum += cmd->command + cmd->target_addr + cmd->data_size;
197 cmd->block_checksum = cpu_to_le32(checksum);
198 }
199 }
200 EXPORT_SYMBOL_GPL(i2400m_bm_cmd_prepare);
201
202
203 /*
204 * Database of known barkers.
205 *
206 * A barker is what the device sends indicating he is ready to be
207 * bootloaded. Different versions of the device will send different
208 * barkers. Depending on the barker, it might mean the device wants
209 * some kind of firmware or the other.
210 */
211 static struct i2400m_barker_db {
212 __le32 data[4];
213 } *i2400m_barker_db;
214 static size_t i2400m_barker_db_used, i2400m_barker_db_size;
215
216
217 static
i2400m_zrealloc_2x(void ** ptr,size_t * _count,size_t el_size,gfp_t gfp_flags)218 int i2400m_zrealloc_2x(void **ptr, size_t *_count, size_t el_size,
219 gfp_t gfp_flags)
220 {
221 size_t old_count = *_count,
222 new_count = old_count ? 2 * old_count : 2,
223 old_size = el_size * old_count,
224 new_size = el_size * new_count;
225 void *nptr = krealloc(*ptr, new_size, gfp_flags);
226 if (nptr) {
227 /* zero the other half or the whole thing if old_count
228 * was zero */
229 if (old_size == 0)
230 memset(nptr, 0, new_size);
231 else
232 memset(nptr + old_size, 0, old_size);
233 *_count = new_count;
234 *ptr = nptr;
235 return 0;
236 } else
237 return -ENOMEM;
238 }
239
240
241 /*
242 * Add a barker to the database
243 *
244 * This cannot used outside of this module and only at at module_init
245 * time. This is to avoid the need to do locking.
246 */
247 static
i2400m_barker_db_add(u32 barker_id)248 int i2400m_barker_db_add(u32 barker_id)
249 {
250 int result;
251
252 struct i2400m_barker_db *barker;
253 if (i2400m_barker_db_used >= i2400m_barker_db_size) {
254 result = i2400m_zrealloc_2x(
255 (void **) &i2400m_barker_db, &i2400m_barker_db_size,
256 sizeof(i2400m_barker_db[0]), GFP_KERNEL);
257 if (result < 0)
258 return result;
259 }
260 barker = i2400m_barker_db + i2400m_barker_db_used++;
261 barker->data[0] = le32_to_cpu(barker_id);
262 barker->data[1] = le32_to_cpu(barker_id);
263 barker->data[2] = le32_to_cpu(barker_id);
264 barker->data[3] = le32_to_cpu(barker_id);
265 return 0;
266 }
267
268
i2400m_barker_db_exit(void)269 void i2400m_barker_db_exit(void)
270 {
271 kfree(i2400m_barker_db);
272 i2400m_barker_db = NULL;
273 i2400m_barker_db_size = 0;
274 i2400m_barker_db_used = 0;
275 }
276
277
278 /*
279 * Helper function to add all the known stable barkers to the barker
280 * database.
281 */
282 static
i2400m_barker_db_known_barkers(void)283 int i2400m_barker_db_known_barkers(void)
284 {
285 int result;
286
287 result = i2400m_barker_db_add(I2400M_NBOOT_BARKER);
288 if (result < 0)
289 goto error_add;
290 result = i2400m_barker_db_add(I2400M_SBOOT_BARKER);
291 if (result < 0)
292 goto error_add;
293 result = i2400m_barker_db_add(I2400M_SBOOT_BARKER_6050);
294 if (result < 0)
295 goto error_add;
296 error_add:
297 return result;
298 }
299
300
301 /*
302 * Initialize the barker database
303 *
304 * This can only be used from the module_init function for this
305 * module; this is to avoid the need to do locking.
306 *
307 * @options: command line argument with extra barkers to
308 * recognize. This is a comma-separated list of 32-bit hex
309 * numbers. They are appended to the existing list. Setting 0
310 * cleans the existing list and starts a new one.
311 */
i2400m_barker_db_init(const char * _options)312 int i2400m_barker_db_init(const char *_options)
313 {
314 int result;
315 char *options = NULL, *options_orig, *token;
316
317 i2400m_barker_db = NULL;
318 i2400m_barker_db_size = 0;
319 i2400m_barker_db_used = 0;
320
321 result = i2400m_barker_db_known_barkers();
322 if (result < 0)
323 goto error_add;
324 /* parse command line options from i2400m.barkers */
325 if (_options != NULL) {
326 unsigned barker;
327
328 options_orig = kstrdup(_options, GFP_KERNEL);
329 if (options_orig == NULL) {
330 result = -ENOMEM;
331 goto error_parse;
332 }
333 options = options_orig;
334
335 while ((token = strsep(&options, ",")) != NULL) {
336 if (*token == '\0') /* eat joint commas */
337 continue;
338 if (sscanf(token, "%x", &barker) != 1
339 || barker > 0xffffffff) {
340 printk(KERN_ERR "%s: can't recognize "
341 "i2400m.barkers value '%s' as "
342 "a 32-bit number\n",
343 __func__, token);
344 result = -EINVAL;
345 goto error_parse;
346 }
347 if (barker == 0) {
348 /* clean list and start new */
349 i2400m_barker_db_exit();
350 continue;
351 }
352 result = i2400m_barker_db_add(barker);
353 if (result < 0)
354 goto error_parse_add;
355 }
356 kfree(options_orig);
357 }
358 return 0;
359
360 error_parse_add:
361 error_parse:
362 kfree(options_orig);
363 error_add:
364 kfree(i2400m_barker_db);
365 return result;
366 }
367
368
369 /*
370 * Recognize a boot barker
371 *
372 * @buf: buffer where the boot barker.
373 * @buf_size: size of the buffer (has to be 16 bytes). It is passed
374 * here so the function can check it for the caller.
375 *
376 * Note that as a side effect, upon identifying the obtained boot
377 * barker, this function will set i2400m->barker to point to the right
378 * barker database entry. Subsequent calls to the function will result
379 * in verifying that the same type of boot barker is returned when the
380 * device [re]boots (as long as the same device instance is used).
381 *
382 * Return: 0 if @buf matches a known boot barker. -ENOENT if the
383 * buffer in @buf doesn't match any boot barker in the database or
384 * -EILSEQ if the buffer doesn't have the right size.
385 */
i2400m_is_boot_barker(struct i2400m * i2400m,const void * buf,size_t buf_size)386 int i2400m_is_boot_barker(struct i2400m *i2400m,
387 const void *buf, size_t buf_size)
388 {
389 int result;
390 struct device *dev = i2400m_dev(i2400m);
391 struct i2400m_barker_db *barker;
392 int i;
393
394 result = -ENOENT;
395 if (buf_size != sizeof(i2400m_barker_db[i].data))
396 return result;
397
398 /* Short circuit if we have already discovered the barker
399 * associated with the device. */
400 if (i2400m->barker
401 && !memcmp(buf, i2400m->barker, sizeof(i2400m->barker->data))) {
402 unsigned index = (i2400m->barker - i2400m_barker_db)
403 / sizeof(*i2400m->barker);
404 d_printf(2, dev, "boot barker cache-confirmed #%u/%08x\n",
405 index, le32_to_cpu(i2400m->barker->data[0]));
406 return 0;
407 }
408
409 for (i = 0; i < i2400m_barker_db_used; i++) {
410 barker = &i2400m_barker_db[i];
411 BUILD_BUG_ON(sizeof(barker->data) != 16);
412 if (memcmp(buf, barker->data, sizeof(barker->data)))
413 continue;
414
415 if (i2400m->barker == NULL) {
416 i2400m->barker = barker;
417 d_printf(1, dev, "boot barker set to #%u/%08x\n",
418 i, le32_to_cpu(barker->data[0]));
419 if (barker->data[0] == le32_to_cpu(I2400M_NBOOT_BARKER))
420 i2400m->sboot = 0;
421 else
422 i2400m->sboot = 1;
423 } else if (i2400m->barker != barker) {
424 dev_err(dev, "HW inconsistency: device "
425 "reports a different boot barker "
426 "than set (from %08x to %08x)\n",
427 le32_to_cpu(i2400m->barker->data[0]),
428 le32_to_cpu(barker->data[0]));
429 result = -EIO;
430 } else
431 d_printf(2, dev, "boot barker confirmed #%u/%08x\n",
432 i, le32_to_cpu(barker->data[0]));
433 result = 0;
434 break;
435 }
436 return result;
437 }
438 EXPORT_SYMBOL_GPL(i2400m_is_boot_barker);
439
440
441 /*
442 * Verify the ack data received
443 *
444 * Given a reply to a boot mode command, chew it and verify everything
445 * is ok.
446 *
447 * @opcode: opcode which generated this ack. For error messages.
448 * @ack: pointer to ack data we received
449 * @ack_size: size of that data buffer
450 * @flags: I2400M_BM_CMD_* flags we called the command with.
451 *
452 * Way too long function -- maybe it should be further split
453 */
454 static
__i2400m_bm_ack_verify(struct i2400m * i2400m,int opcode,struct i2400m_bootrom_header * ack,size_t ack_size,int flags)455 ssize_t __i2400m_bm_ack_verify(struct i2400m *i2400m, int opcode,
456 struct i2400m_bootrom_header *ack,
457 size_t ack_size, int flags)
458 {
459 ssize_t result = -ENOMEM;
460 struct device *dev = i2400m_dev(i2400m);
461
462 d_fnstart(8, dev, "(i2400m %p opcode %d ack %p size %zu)\n",
463 i2400m, opcode, ack, ack_size);
464 if (ack_size < sizeof(*ack)) {
465 result = -EIO;
466 dev_err(dev, "boot-mode cmd %d: HW BUG? notification didn't "
467 "return enough data (%zu bytes vs %zu expected)\n",
468 opcode, ack_size, sizeof(*ack));
469 goto error_ack_short;
470 }
471 result = i2400m_is_boot_barker(i2400m, ack, ack_size);
472 if (result >= 0) {
473 result = -ERESTARTSYS;
474 d_printf(6, dev, "boot-mode cmd %d: HW boot barker\n", opcode);
475 goto error_reboot;
476 }
477 if (ack_size == sizeof(i2400m_ACK_BARKER)
478 && memcmp(ack, i2400m_ACK_BARKER, sizeof(*ack)) == 0) {
479 result = -EISCONN;
480 d_printf(3, dev, "boot-mode cmd %d: HW reboot ack barker\n",
481 opcode);
482 goto error_reboot_ack;
483 }
484 result = 0;
485 if (flags & I2400M_BM_CMD_RAW)
486 goto out_raw;
487 ack->data_size = le32_to_cpu(ack->data_size);
488 ack->target_addr = le32_to_cpu(ack->target_addr);
489 ack->block_checksum = le32_to_cpu(ack->block_checksum);
490 d_printf(5, dev, "boot-mode cmd %d: notification for opcode %u "
491 "response %u csum %u rr %u da %u\n",
492 opcode, i2400m_brh_get_opcode(ack),
493 i2400m_brh_get_response(ack),
494 i2400m_brh_get_use_checksum(ack),
495 i2400m_brh_get_response_required(ack),
496 i2400m_brh_get_direct_access(ack));
497 result = -EIO;
498 if (i2400m_brh_get_signature(ack) != 0xcbbc) {
499 dev_err(dev, "boot-mode cmd %d: HW BUG? wrong signature "
500 "0x%04x\n", opcode, i2400m_brh_get_signature(ack));
501 goto error_ack_signature;
502 }
503 if (opcode != -1 && opcode != i2400m_brh_get_opcode(ack)) {
504 dev_err(dev, "boot-mode cmd %d: HW BUG? "
505 "received response for opcode %u, expected %u\n",
506 opcode, i2400m_brh_get_opcode(ack), opcode);
507 goto error_ack_opcode;
508 }
509 if (i2400m_brh_get_response(ack) != 0) { /* failed? */
510 dev_err(dev, "boot-mode cmd %d: error; hw response %u\n",
511 opcode, i2400m_brh_get_response(ack));
512 goto error_ack_failed;
513 }
514 if (ack_size < ack->data_size + sizeof(*ack)) {
515 dev_err(dev, "boot-mode cmd %d: SW BUG "
516 "driver provided only %zu bytes for %zu bytes "
517 "of data\n", opcode, ack_size,
518 (size_t) le32_to_cpu(ack->data_size) + sizeof(*ack));
519 goto error_ack_short_buffer;
520 }
521 result = ack_size;
522 /* Don't you love this stack of empty targets? Well, I don't
523 * either, but it helps track exactly who comes in here and
524 * why :) */
525 error_ack_short_buffer:
526 error_ack_failed:
527 error_ack_opcode:
528 error_ack_signature:
529 out_raw:
530 error_reboot_ack:
531 error_reboot:
532 error_ack_short:
533 d_fnend(8, dev, "(i2400m %p opcode %d ack %p size %zu) = %d\n",
534 i2400m, opcode, ack, ack_size, (int) result);
535 return result;
536 }
537
538
539 /**
540 * i2400m_bm_cmd - Execute a boot mode command
541 *
542 * @cmd: buffer containing the command data (pointing at the header).
543 * This data can be ANYWHERE (for USB, we will copy it to an
544 * specific buffer). Make sure everything is in proper little
545 * endian.
546 *
547 * A raw buffer can be also sent, just cast it and set flags to
548 * I2400M_BM_CMD_RAW.
549 *
550 * This function will generate a checksum for you if the
551 * checksum bit in the command is set (unless I2400M_BM_CMD_RAW
552 * is set).
553 *
554 * You can use the i2400m->bm_cmd_buf to stage your commands and
555 * send them.
556 *
557 * If NULL, no command is sent (we just wait for an ack).
558 *
559 * @cmd_size: size of the command. Will be auto padded to the
560 * bus-specific drivers padding requirements.
561 *
562 * @ack: buffer where to place the acknowledgement. If it is a regular
563 * command response, all fields will be returned with the right,
564 * native endianess.
565 *
566 * You *cannot* use i2400m->bm_ack_buf for this buffer.
567 *
568 * @ack_size: size of @ack, 16 aligned; you need to provide at least
569 * sizeof(*ack) bytes and then enough to contain the return data
570 * from the command
571 *
572 * @flags: see I2400M_BM_CMD_* above.
573 *
574 * @returns: bytes received by the notification; if < 0, an errno code
575 * denoting an error or:
576 *
577 * -ERESTARTSYS The device has rebooted
578 *
579 * Executes a boot-mode command and waits for a response, doing basic
580 * validation on it; if a zero length response is received, it retries
581 * waiting for a response until a non-zero one is received (timing out
582 * after %I2400M_BOOT_RETRIES retries).
583 */
584 static
i2400m_bm_cmd(struct i2400m * i2400m,const struct i2400m_bootrom_header * cmd,size_t cmd_size,struct i2400m_bootrom_header * ack,size_t ack_size,int flags)585 ssize_t i2400m_bm_cmd(struct i2400m *i2400m,
586 const struct i2400m_bootrom_header *cmd, size_t cmd_size,
587 struct i2400m_bootrom_header *ack, size_t ack_size,
588 int flags)
589 {
590 ssize_t result = -ENOMEM, rx_bytes;
591 struct device *dev = i2400m_dev(i2400m);
592 int opcode = cmd == NULL ? -1 : i2400m_brh_get_opcode(cmd);
593
594 d_fnstart(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu)\n",
595 i2400m, cmd, cmd_size, ack, ack_size);
596 BUG_ON(ack_size < sizeof(*ack));
597 BUG_ON(i2400m->boot_mode == 0);
598
599 if (cmd != NULL) { /* send the command */
600 result = i2400m->bus_bm_cmd_send(i2400m, cmd, cmd_size, flags);
601 if (result < 0)
602 goto error_cmd_send;
603 if ((flags & I2400M_BM_CMD_RAW) == 0)
604 d_printf(5, dev,
605 "boot-mode cmd %d csum %u rr %u da %u: "
606 "addr 0x%04x size %u block csum 0x%04x\n",
607 opcode, i2400m_brh_get_use_checksum(cmd),
608 i2400m_brh_get_response_required(cmd),
609 i2400m_brh_get_direct_access(cmd),
610 cmd->target_addr, cmd->data_size,
611 cmd->block_checksum);
612 }
613 result = i2400m->bus_bm_wait_for_ack(i2400m, ack, ack_size);
614 if (result < 0) {
615 dev_err(dev, "boot-mode cmd %d: error waiting for an ack: %d\n",
616 opcode, (int) result); /* bah, %zd doesn't work */
617 goto error_wait_for_ack;
618 }
619 rx_bytes = result;
620 /* verify the ack and read more if necessary [result is the
621 * final amount of bytes we get in the ack] */
622 result = __i2400m_bm_ack_verify(i2400m, opcode, ack, ack_size, flags);
623 if (result < 0)
624 goto error_bad_ack;
625 /* Don't you love this stack of empty targets? Well, I don't
626 * either, but it helps track exactly who comes in here and
627 * why :) */
628 result = rx_bytes;
629 error_bad_ack:
630 error_wait_for_ack:
631 error_cmd_send:
632 d_fnend(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu) = %d\n",
633 i2400m, cmd, cmd_size, ack, ack_size, (int) result);
634 return result;
635 }
636
637
638 /**
639 * i2400m_download_chunk - write a single chunk of data to the device's memory
640 *
641 * @i2400m: device descriptor
642 * @buf: the buffer to write
643 * @buf_len: length of the buffer to write
644 * @addr: address in the device memory space
645 * @direct: bootrom write mode
646 * @do_csum: should a checksum validation be performed
647 */
i2400m_download_chunk(struct i2400m * i2400m,const void * chunk,size_t __chunk_len,unsigned long addr,unsigned int direct,unsigned int do_csum)648 static int i2400m_download_chunk(struct i2400m *i2400m, const void *chunk,
649 size_t __chunk_len, unsigned long addr,
650 unsigned int direct, unsigned int do_csum)
651 {
652 int ret;
653 size_t chunk_len = ALIGN(__chunk_len, I2400M_PL_ALIGN);
654 struct device *dev = i2400m_dev(i2400m);
655 struct {
656 struct i2400m_bootrom_header cmd;
657 u8 cmd_payload[chunk_len];
658 } __packed *buf;
659 struct i2400m_bootrom_header ack;
660
661 d_fnstart(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
662 "direct %u do_csum %u)\n", i2400m, chunk, __chunk_len,
663 addr, direct, do_csum);
664 buf = i2400m->bm_cmd_buf;
665 memcpy(buf->cmd_payload, chunk, __chunk_len);
666 memset(buf->cmd_payload + __chunk_len, 0xad, chunk_len - __chunk_len);
667
668 buf->cmd.command = i2400m_brh_command(I2400M_BRH_WRITE,
669 __chunk_len & 0x3 ? 0 : do_csum,
670 __chunk_len & 0xf ? 0 : direct);
671 buf->cmd.target_addr = cpu_to_le32(addr);
672 buf->cmd.data_size = cpu_to_le32(__chunk_len);
673 ret = i2400m_bm_cmd(i2400m, &buf->cmd, sizeof(buf->cmd) + chunk_len,
674 &ack, sizeof(ack), 0);
675 if (ret >= 0)
676 ret = 0;
677 d_fnend(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
678 "direct %u do_csum %u) = %d\n", i2400m, chunk, __chunk_len,
679 addr, direct, do_csum, ret);
680 return ret;
681 }
682
683
684 /*
685 * Download a BCF file's sections to the device
686 *
687 * @i2400m: device descriptor
688 * @bcf: pointer to firmware data (first header followed by the
689 * payloads). Assumed verified and consistent.
690 * @bcf_len: length (in bytes) of the @bcf buffer.
691 *
692 * Returns: < 0 errno code on error or the offset to the jump instruction.
693 *
694 * Given a BCF file, downloads each section (a command and a payload)
695 * to the device's address space. Actually, it just executes each
696 * command i the BCF file.
697 *
698 * The section size has to be aligned to 4 bytes AND the padding has
699 * to be taken from the firmware file, as the signature takes it into
700 * account.
701 */
702 static
i2400m_dnload_bcf(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf,size_t bcf_len)703 ssize_t i2400m_dnload_bcf(struct i2400m *i2400m,
704 const struct i2400m_bcf_hdr *bcf, size_t bcf_len)
705 {
706 ssize_t ret;
707 struct device *dev = i2400m_dev(i2400m);
708 size_t offset, /* iterator offset */
709 data_size, /* Size of the data payload */
710 section_size, /* Size of the whole section (cmd + payload) */
711 section = 1;
712 const struct i2400m_bootrom_header *bh;
713 struct i2400m_bootrom_header ack;
714
715 d_fnstart(3, dev, "(i2400m %p bcf %p bcf_len %zu)\n",
716 i2400m, bcf, bcf_len);
717 /* Iterate over the command blocks in the BCF file that start
718 * after the header */
719 offset = le32_to_cpu(bcf->header_len) * sizeof(u32);
720 while (1) { /* start sending the file */
721 bh = (void *) bcf + offset;
722 data_size = le32_to_cpu(bh->data_size);
723 section_size = ALIGN(sizeof(*bh) + data_size, 4);
724 d_printf(7, dev,
725 "downloading section #%zu (@%zu %zu B) to 0x%08x\n",
726 section, offset, sizeof(*bh) + data_size,
727 le32_to_cpu(bh->target_addr));
728 /*
729 * We look for JUMP cmd from the bootmode header,
730 * either I2400M_BRH_SIGNED_JUMP for secure boot
731 * or I2400M_BRH_JUMP for unsecure boot, the last chunk
732 * should be the bootmode header with JUMP cmd.
733 */
734 if (i2400m_brh_get_opcode(bh) == I2400M_BRH_SIGNED_JUMP ||
735 i2400m_brh_get_opcode(bh) == I2400M_BRH_JUMP) {
736 d_printf(5, dev, "jump found @%zu\n", offset);
737 break;
738 }
739 if (offset + section_size > bcf_len) {
740 dev_err(dev, "fw %s: bad section #%zu, "
741 "end (@%zu) beyond EOF (@%zu)\n",
742 i2400m->fw_name, section,
743 offset + section_size, bcf_len);
744 ret = -EINVAL;
745 goto error_section_beyond_eof;
746 }
747 __i2400m_msleep(20);
748 ret = i2400m_bm_cmd(i2400m, bh, section_size,
749 &ack, sizeof(ack), I2400M_BM_CMD_RAW);
750 if (ret < 0) {
751 dev_err(dev, "fw %s: section #%zu (@%zu %zu B) "
752 "failed %d\n", i2400m->fw_name, section,
753 offset, sizeof(*bh) + data_size, (int) ret);
754 goto error_send;
755 }
756 offset += section_size;
757 section++;
758 }
759 ret = offset;
760 error_section_beyond_eof:
761 error_send:
762 d_fnend(3, dev, "(i2400m %p bcf %p bcf_len %zu) = %d\n",
763 i2400m, bcf, bcf_len, (int) ret);
764 return ret;
765 }
766
767
768 /*
769 * Indicate if the device emitted a reboot barker that indicates
770 * "signed boot"
771 */
772 static
i2400m_boot_is_signed(struct i2400m * i2400m)773 unsigned i2400m_boot_is_signed(struct i2400m *i2400m)
774 {
775 return likely(i2400m->sboot);
776 }
777
778
779 /*
780 * Do the final steps of uploading firmware
781 *
782 * @bcf_hdr: BCF header we are actually using
783 * @bcf: pointer to the firmware image (which matches the first header
784 * that is followed by the actual payloads).
785 * @offset: [byte] offset into @bcf for the command we need to send.
786 *
787 * Depending on the boot mode (signed vs non-signed), different
788 * actions need to be taken.
789 */
790 static
i2400m_dnload_finalize(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf_hdr,const struct i2400m_bcf_hdr * bcf,size_t offset)791 int i2400m_dnload_finalize(struct i2400m *i2400m,
792 const struct i2400m_bcf_hdr *bcf_hdr,
793 const struct i2400m_bcf_hdr *bcf, size_t offset)
794 {
795 int ret = 0;
796 struct device *dev = i2400m_dev(i2400m);
797 struct i2400m_bootrom_header *cmd, ack;
798 struct {
799 struct i2400m_bootrom_header cmd;
800 u8 cmd_pl[0];
801 } __packed *cmd_buf;
802 size_t signature_block_offset, signature_block_size;
803
804 d_fnstart(3, dev, "offset %zu\n", offset);
805 cmd = (void *) bcf + offset;
806 if (i2400m_boot_is_signed(i2400m) == 0) {
807 struct i2400m_bootrom_header jump_ack;
808 d_printf(1, dev, "unsecure boot, jumping to 0x%08x\n",
809 le32_to_cpu(cmd->target_addr));
810 cmd_buf = i2400m->bm_cmd_buf;
811 memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd));
812 cmd = &cmd_buf->cmd;
813 /* now cmd points to the actual bootrom_header in cmd_buf */
814 i2400m_brh_set_opcode(cmd, I2400M_BRH_JUMP);
815 cmd->data_size = 0;
816 ret = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd),
817 &jump_ack, sizeof(jump_ack), 0);
818 } else {
819 d_printf(1, dev, "secure boot, jumping to 0x%08x\n",
820 le32_to_cpu(cmd->target_addr));
821 cmd_buf = i2400m->bm_cmd_buf;
822 memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd));
823 signature_block_offset =
824 sizeof(*bcf_hdr)
825 + le32_to_cpu(bcf_hdr->key_size) * sizeof(u32)
826 + le32_to_cpu(bcf_hdr->exponent_size) * sizeof(u32);
827 signature_block_size =
828 le32_to_cpu(bcf_hdr->modulus_size) * sizeof(u32);
829 memcpy(cmd_buf->cmd_pl,
830 (void *) bcf_hdr + signature_block_offset,
831 signature_block_size);
832 ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd,
833 sizeof(cmd_buf->cmd) + signature_block_size,
834 &ack, sizeof(ack), I2400M_BM_CMD_RAW);
835 }
836 d_fnend(3, dev, "returning %d\n", ret);
837 return ret;
838 }
839
840
841 /**
842 * i2400m_bootrom_init - Reboots a powered device into boot mode
843 *
844 * @i2400m: device descriptor
845 * @flags:
846 * I2400M_BRI_SOFT: a reboot barker has been seen
847 * already, so don't wait for it.
848 *
849 * I2400M_BRI_NO_REBOOT: Don't send a reboot command, but wait
850 * for a reboot barker notification. This is a one shot; if
851 * the state machine needs to send a reboot command it will.
852 *
853 * Returns:
854 *
855 * < 0 errno code on error, 0 if ok.
856 *
857 * Description:
858 *
859 * Tries hard enough to put the device in boot-mode. There are two
860 * main phases to this:
861 *
862 * a. (1) send a reboot command and (2) get a reboot barker
863 *
864 * b. (1) echo/ack the reboot sending the reboot barker back and (2)
865 * getting an ack barker in return
866 *
867 * We want to skip (a) in some cases [soft]. The state machine is
868 * horrible, but it is basically: on each phase, send what has to be
869 * sent (if any), wait for the answer and act on the answer. We might
870 * have to backtrack and retry, so we keep a max tries counter for
871 * that.
872 *
873 * It sucks because we don't know ahead of time which is going to be
874 * the reboot barker (the device might send different ones depending
875 * on its EEPROM config) and once the device reboots and waits for the
876 * echo/ack reboot barker being sent back, it doesn't understand
877 * anything else. So we can be left at the point where we don't know
878 * what to send to it -- cold reset and bus reset seem to have little
879 * effect. So the function iterates (in this case) through all the
880 * known barkers and tries them all until an ACK is
881 * received. Otherwise, it gives up.
882 *
883 * If we get a timeout after sending a warm reset, we do it again.
884 */
i2400m_bootrom_init(struct i2400m * i2400m,enum i2400m_bri flags)885 int i2400m_bootrom_init(struct i2400m *i2400m, enum i2400m_bri flags)
886 {
887 int result;
888 struct device *dev = i2400m_dev(i2400m);
889 struct i2400m_bootrom_header *cmd;
890 struct i2400m_bootrom_header ack;
891 int count = i2400m->bus_bm_retries;
892 int ack_timeout_cnt = 1;
893 unsigned i;
894
895 BUILD_BUG_ON(sizeof(*cmd) != sizeof(i2400m_barker_db[0].data));
896 BUILD_BUG_ON(sizeof(ack) != sizeof(i2400m_ACK_BARKER));
897
898 d_fnstart(4, dev, "(i2400m %p flags 0x%08x)\n", i2400m, flags);
899 result = -ENOMEM;
900 cmd = i2400m->bm_cmd_buf;
901 if (flags & I2400M_BRI_SOFT)
902 goto do_reboot_ack;
903 do_reboot:
904 ack_timeout_cnt = 1;
905 if (--count < 0)
906 goto error_timeout;
907 d_printf(4, dev, "device reboot: reboot command [%d # left]\n",
908 count);
909 if ((flags & I2400M_BRI_NO_REBOOT) == 0)
910 i2400m_reset(i2400m, I2400M_RT_WARM);
911 result = i2400m_bm_cmd(i2400m, NULL, 0, &ack, sizeof(ack),
912 I2400M_BM_CMD_RAW);
913 flags &= ~I2400M_BRI_NO_REBOOT;
914 switch (result) {
915 case -ERESTARTSYS:
916 /*
917 * at this point, i2400m_bm_cmd(), through
918 * __i2400m_bm_ack_process(), has updated
919 * i2400m->barker and we are good to go.
920 */
921 d_printf(4, dev, "device reboot: got reboot barker\n");
922 break;
923 case -EISCONN: /* we don't know how it got here...but we follow it */
924 d_printf(4, dev, "device reboot: got ack barker - whatever\n");
925 goto do_reboot;
926 case -ETIMEDOUT:
927 /*
928 * Device has timed out, we might be in boot mode
929 * already and expecting an ack; if we don't know what
930 * the barker is, we just send them all. Cold reset
931 * and bus reset don't work. Beats me.
932 */
933 if (i2400m->barker != NULL) {
934 dev_err(dev, "device boot: reboot barker timed out, "
935 "trying (set) %08x echo/ack\n",
936 le32_to_cpu(i2400m->barker->data[0]));
937 goto do_reboot_ack;
938 }
939 for (i = 0; i < i2400m_barker_db_used; i++) {
940 struct i2400m_barker_db *barker = &i2400m_barker_db[i];
941 memcpy(cmd, barker->data, sizeof(barker->data));
942 result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd),
943 &ack, sizeof(ack),
944 I2400M_BM_CMD_RAW);
945 if (result == -EISCONN) {
946 dev_warn(dev, "device boot: got ack barker "
947 "after sending echo/ack barker "
948 "#%d/%08x; rebooting j.i.c.\n",
949 i, le32_to_cpu(barker->data[0]));
950 flags &= ~I2400M_BRI_NO_REBOOT;
951 goto do_reboot;
952 }
953 }
954 dev_err(dev, "device boot: tried all the echo/acks, could "
955 "not get device to respond; giving up");
956 result = -ESHUTDOWN;
957 case -EPROTO:
958 case -ESHUTDOWN: /* dev is gone */
959 case -EINTR: /* user cancelled */
960 goto error_dev_gone;
961 default:
962 dev_err(dev, "device reboot: error %d while waiting "
963 "for reboot barker - rebooting\n", result);
964 d_dump(1, dev, &ack, result);
965 goto do_reboot;
966 }
967 /* At this point we ack back with 4 REBOOT barkers and expect
968 * 4 ACK barkers. This is ugly, as we send a raw command --
969 * hence the cast. _bm_cmd() will catch the reboot ack
970 * notification and report it as -EISCONN. */
971 do_reboot_ack:
972 d_printf(4, dev, "device reboot ack: sending ack [%d # left]\n", count);
973 memcpy(cmd, i2400m->barker->data, sizeof(i2400m->barker->data));
974 result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd),
975 &ack, sizeof(ack), I2400M_BM_CMD_RAW);
976 switch (result) {
977 case -ERESTARTSYS:
978 d_printf(4, dev, "reboot ack: got reboot barker - retrying\n");
979 if (--count < 0)
980 goto error_timeout;
981 goto do_reboot_ack;
982 case -EISCONN:
983 d_printf(4, dev, "reboot ack: got ack barker - good\n");
984 break;
985 case -ETIMEDOUT: /* no response, maybe it is the other type? */
986 if (ack_timeout_cnt-- < 0) {
987 d_printf(4, dev, "reboot ack timedout: retrying\n");
988 goto do_reboot_ack;
989 } else {
990 dev_err(dev, "reboot ack timedout too long: "
991 "trying reboot\n");
992 goto do_reboot;
993 }
994 break;
995 case -EPROTO:
996 case -ESHUTDOWN: /* dev is gone */
997 goto error_dev_gone;
998 default:
999 dev_err(dev, "device reboot ack: error %d while waiting for "
1000 "reboot ack barker - rebooting\n", result);
1001 goto do_reboot;
1002 }
1003 d_printf(2, dev, "device reboot ack: got ack barker - boot done\n");
1004 result = 0;
1005 exit_timeout:
1006 error_dev_gone:
1007 d_fnend(4, dev, "(i2400m %p flags 0x%08x) = %d\n",
1008 i2400m, flags, result);
1009 return result;
1010
1011 error_timeout:
1012 dev_err(dev, "Timed out waiting for reboot ack\n");
1013 result = -ETIMEDOUT;
1014 goto exit_timeout;
1015 }
1016
1017
1018 /*
1019 * Read the MAC addr
1020 *
1021 * The position this function reads is fixed in device memory and
1022 * always available, even without firmware.
1023 *
1024 * Note we specify we want to read only six bytes, but provide space
1025 * for 16, as we always get it rounded up.
1026 */
i2400m_read_mac_addr(struct i2400m * i2400m)1027 int i2400m_read_mac_addr(struct i2400m *i2400m)
1028 {
1029 int result;
1030 struct device *dev = i2400m_dev(i2400m);
1031 struct net_device *net_dev = i2400m->wimax_dev.net_dev;
1032 struct i2400m_bootrom_header *cmd;
1033 struct {
1034 struct i2400m_bootrom_header ack;
1035 u8 ack_pl[16];
1036 } __packed ack_buf;
1037
1038 d_fnstart(5, dev, "(i2400m %p)\n", i2400m);
1039 cmd = i2400m->bm_cmd_buf;
1040 cmd->command = i2400m_brh_command(I2400M_BRH_READ, 0, 1);
1041 cmd->target_addr = cpu_to_le32(0x00203fe8);
1042 cmd->data_size = cpu_to_le32(6);
1043 result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd),
1044 &ack_buf.ack, sizeof(ack_buf), 0);
1045 if (result < 0) {
1046 dev_err(dev, "BM: read mac addr failed: %d\n", result);
1047 goto error_read_mac;
1048 }
1049 d_printf(2, dev, "mac addr is %pM\n", ack_buf.ack_pl);
1050 if (i2400m->bus_bm_mac_addr_impaired == 1) {
1051 ack_buf.ack_pl[0] = 0x00;
1052 ack_buf.ack_pl[1] = 0x16;
1053 ack_buf.ack_pl[2] = 0xd3;
1054 get_random_bytes(&ack_buf.ack_pl[3], 3);
1055 dev_err(dev, "BM is MAC addr impaired, faking MAC addr to "
1056 "mac addr is %pM\n", ack_buf.ack_pl);
1057 result = 0;
1058 }
1059 net_dev->addr_len = ETH_ALEN;
1060 memcpy(net_dev->dev_addr, ack_buf.ack_pl, ETH_ALEN);
1061 error_read_mac:
1062 d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, result);
1063 return result;
1064 }
1065
1066
1067 /*
1068 * Initialize a non signed boot
1069 *
1070 * This implies sending some magic values to the device's memory. Note
1071 * we convert the values to little endian in the same array
1072 * declaration.
1073 */
1074 static
i2400m_dnload_init_nonsigned(struct i2400m * i2400m)1075 int i2400m_dnload_init_nonsigned(struct i2400m *i2400m)
1076 {
1077 unsigned i = 0;
1078 int ret = 0;
1079 struct device *dev = i2400m_dev(i2400m);
1080 d_fnstart(5, dev, "(i2400m %p)\n", i2400m);
1081 if (i2400m->bus_bm_pokes_table) {
1082 while (i2400m->bus_bm_pokes_table[i].address) {
1083 ret = i2400m_download_chunk(
1084 i2400m,
1085 &i2400m->bus_bm_pokes_table[i].data,
1086 sizeof(i2400m->bus_bm_pokes_table[i].data),
1087 i2400m->bus_bm_pokes_table[i].address, 1, 1);
1088 if (ret < 0)
1089 break;
1090 i++;
1091 }
1092 }
1093 d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret);
1094 return ret;
1095 }
1096
1097
1098 /*
1099 * Initialize the signed boot process
1100 *
1101 * @i2400m: device descriptor
1102 *
1103 * @bcf_hdr: pointer to the firmware header; assumes it is fully in
1104 * memory (it has gone through basic validation).
1105 *
1106 * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw
1107 * rebooted.
1108 *
1109 * This writes the firmware BCF header to the device using the
1110 * HASH_PAYLOAD_ONLY command.
1111 */
1112 static
i2400m_dnload_init_signed(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf_hdr)1113 int i2400m_dnload_init_signed(struct i2400m *i2400m,
1114 const struct i2400m_bcf_hdr *bcf_hdr)
1115 {
1116 int ret;
1117 struct device *dev = i2400m_dev(i2400m);
1118 struct {
1119 struct i2400m_bootrom_header cmd;
1120 struct i2400m_bcf_hdr cmd_pl;
1121 } __packed *cmd_buf;
1122 struct i2400m_bootrom_header ack;
1123
1124 d_fnstart(5, dev, "(i2400m %p bcf_hdr %p)\n", i2400m, bcf_hdr);
1125 cmd_buf = i2400m->bm_cmd_buf;
1126 cmd_buf->cmd.command =
1127 i2400m_brh_command(I2400M_BRH_HASH_PAYLOAD_ONLY, 0, 0);
1128 cmd_buf->cmd.target_addr = 0;
1129 cmd_buf->cmd.data_size = cpu_to_le32(sizeof(cmd_buf->cmd_pl));
1130 memcpy(&cmd_buf->cmd_pl, bcf_hdr, sizeof(*bcf_hdr));
1131 ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, sizeof(*cmd_buf),
1132 &ack, sizeof(ack), 0);
1133 if (ret >= 0)
1134 ret = 0;
1135 d_fnend(5, dev, "(i2400m %p bcf_hdr %p) = %d\n", i2400m, bcf_hdr, ret);
1136 return ret;
1137 }
1138
1139
1140 /*
1141 * Initialize the firmware download at the device size
1142 *
1143 * Multiplex to the one that matters based on the device's mode
1144 * (signed or non-signed).
1145 */
1146 static
i2400m_dnload_init(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf_hdr)1147 int i2400m_dnload_init(struct i2400m *i2400m,
1148 const struct i2400m_bcf_hdr *bcf_hdr)
1149 {
1150 int result;
1151 struct device *dev = i2400m_dev(i2400m);
1152
1153 if (i2400m_boot_is_signed(i2400m)) {
1154 d_printf(1, dev, "signed boot\n");
1155 result = i2400m_dnload_init_signed(i2400m, bcf_hdr);
1156 if (result == -ERESTARTSYS)
1157 return result;
1158 if (result < 0)
1159 dev_err(dev, "firmware %s: signed boot download "
1160 "initialization failed: %d\n",
1161 i2400m->fw_name, result);
1162 } else {
1163 /* non-signed boot process without pokes */
1164 d_printf(1, dev, "non-signed boot\n");
1165 result = i2400m_dnload_init_nonsigned(i2400m);
1166 if (result == -ERESTARTSYS)
1167 return result;
1168 if (result < 0)
1169 dev_err(dev, "firmware %s: non-signed download "
1170 "initialization failed: %d\n",
1171 i2400m->fw_name, result);
1172 }
1173 return result;
1174 }
1175
1176
1177 /*
1178 * Run consistency tests on the firmware file and load up headers
1179 *
1180 * Check for the firmware being made for the i2400m device,
1181 * etc...These checks are mostly informative, as the device will make
1182 * them too; but the driver's response is more informative on what
1183 * went wrong.
1184 *
1185 * This will also look at all the headers present on the firmware
1186 * file, and update i2400m->fw_bcf_hdr to point to them.
1187 */
1188 static
i2400m_fw_hdr_check(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf_hdr,size_t index,size_t offset)1189 int i2400m_fw_hdr_check(struct i2400m *i2400m,
1190 const struct i2400m_bcf_hdr *bcf_hdr,
1191 size_t index, size_t offset)
1192 {
1193 struct device *dev = i2400m_dev(i2400m);
1194
1195 unsigned module_type, header_len, major_version, minor_version,
1196 module_id, module_vendor, date, size;
1197
1198 module_type = le32_to_cpu(bcf_hdr->module_type);
1199 header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);
1200 major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000)
1201 >> 16;
1202 minor_version = le32_to_cpu(bcf_hdr->header_version) & 0x0000ffff;
1203 module_id = le32_to_cpu(bcf_hdr->module_id);
1204 module_vendor = le32_to_cpu(bcf_hdr->module_vendor);
1205 date = le32_to_cpu(bcf_hdr->date);
1206 size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);
1207
1208 d_printf(1, dev, "firmware %s #%zd@%08zx: BCF header "
1209 "type:vendor:id 0x%x:%x:%x v%u.%u (%u/%u B) built %08x\n",
1210 i2400m->fw_name, index, offset,
1211 module_type, module_vendor, module_id,
1212 major_version, minor_version, header_len, size, date);
1213
1214 /* Hard errors */
1215 if (major_version != 1) {
1216 dev_err(dev, "firmware %s #%zd@%08zx: major header version "
1217 "v%u.%u not supported\n",
1218 i2400m->fw_name, index, offset,
1219 major_version, minor_version);
1220 return -EBADF;
1221 }
1222
1223 if (module_type != 6) { /* built for the right hardware? */
1224 dev_err(dev, "firmware %s #%zd@%08zx: unexpected module "
1225 "type 0x%x; aborting\n",
1226 i2400m->fw_name, index, offset,
1227 module_type);
1228 return -EBADF;
1229 }
1230
1231 if (module_vendor != 0x8086) {
1232 dev_err(dev, "firmware %s #%zd@%08zx: unexpected module "
1233 "vendor 0x%x; aborting\n",
1234 i2400m->fw_name, index, offset, module_vendor);
1235 return -EBADF;
1236 }
1237
1238 if (date < 0x20080300)
1239 dev_warn(dev, "firmware %s #%zd@%08zx: build date %08x "
1240 "too old; unsupported\n",
1241 i2400m->fw_name, index, offset, date);
1242 return 0;
1243 }
1244
1245
1246 /*
1247 * Run consistency tests on the firmware file and load up headers
1248 *
1249 * Check for the firmware being made for the i2400m device,
1250 * etc...These checks are mostly informative, as the device will make
1251 * them too; but the driver's response is more informative on what
1252 * went wrong.
1253 *
1254 * This will also look at all the headers present on the firmware
1255 * file, and update i2400m->fw_hdrs to point to them.
1256 */
1257 static
i2400m_fw_check(struct i2400m * i2400m,const void * bcf,size_t bcf_size)1258 int i2400m_fw_check(struct i2400m *i2400m, const void *bcf, size_t bcf_size)
1259 {
1260 int result;
1261 struct device *dev = i2400m_dev(i2400m);
1262 size_t headers = 0;
1263 const struct i2400m_bcf_hdr *bcf_hdr;
1264 const void *itr, *next, *top;
1265 size_t slots = 0, used_slots = 0;
1266
1267 for (itr = bcf, top = itr + bcf_size;
1268 itr < top;
1269 headers++, itr = next) {
1270 size_t leftover, offset, header_len, size;
1271
1272 leftover = top - itr;
1273 offset = itr - bcf;
1274 if (leftover <= sizeof(*bcf_hdr)) {
1275 dev_err(dev, "firmware %s: %zu B left at @%zx, "
1276 "not enough for BCF header\n",
1277 i2400m->fw_name, leftover, offset);
1278 break;
1279 }
1280 bcf_hdr = itr;
1281 /* Only the first header is supposed to be followed by
1282 * payload */
1283 header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len);
1284 size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);
1285 if (headers == 0)
1286 next = itr + size;
1287 else
1288 next = itr + header_len;
1289
1290 result = i2400m_fw_hdr_check(i2400m, bcf_hdr, headers, offset);
1291 if (result < 0)
1292 continue;
1293 if (used_slots + 1 >= slots) {
1294 /* +1 -> we need to account for the one we'll
1295 * occupy and at least an extra one for
1296 * always being NULL */
1297 result = i2400m_zrealloc_2x(
1298 (void **) &i2400m->fw_hdrs, &slots,
1299 sizeof(i2400m->fw_hdrs[0]),
1300 GFP_KERNEL);
1301 if (result < 0)
1302 goto error_zrealloc;
1303 }
1304 i2400m->fw_hdrs[used_slots] = bcf_hdr;
1305 used_slots++;
1306 }
1307 if (headers == 0) {
1308 dev_err(dev, "firmware %s: no usable headers found\n",
1309 i2400m->fw_name);
1310 result = -EBADF;
1311 } else
1312 result = 0;
1313 error_zrealloc:
1314 return result;
1315 }
1316
1317
1318 /*
1319 * Match a barker to a BCF header module ID
1320 *
1321 * The device sends a barker which tells the firmware loader which
1322 * header in the BCF file has to be used. This does the matching.
1323 */
1324 static
i2400m_bcf_hdr_match(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf_hdr)1325 unsigned i2400m_bcf_hdr_match(struct i2400m *i2400m,
1326 const struct i2400m_bcf_hdr *bcf_hdr)
1327 {
1328 u32 barker = le32_to_cpu(i2400m->barker->data[0])
1329 & 0x7fffffff;
1330 u32 module_id = le32_to_cpu(bcf_hdr->module_id)
1331 & 0x7fffffff; /* high bit used for something else */
1332
1333 /* special case for 5x50 */
1334 if (barker == I2400M_SBOOT_BARKER && module_id == 0)
1335 return 1;
1336 if (module_id == barker)
1337 return 1;
1338 return 0;
1339 }
1340
1341 static
i2400m_bcf_hdr_find(struct i2400m * i2400m)1342 const struct i2400m_bcf_hdr *i2400m_bcf_hdr_find(struct i2400m *i2400m)
1343 {
1344 struct device *dev = i2400m_dev(i2400m);
1345 const struct i2400m_bcf_hdr **bcf_itr, *bcf_hdr;
1346 unsigned i = 0;
1347 u32 barker = le32_to_cpu(i2400m->barker->data[0]);
1348
1349 d_printf(2, dev, "finding BCF header for barker %08x\n", barker);
1350 if (barker == I2400M_NBOOT_BARKER) {
1351 bcf_hdr = i2400m->fw_hdrs[0];
1352 d_printf(1, dev, "using BCF header #%u/%08x for non-signed "
1353 "barker\n", 0, le32_to_cpu(bcf_hdr->module_id));
1354 return bcf_hdr;
1355 }
1356 for (bcf_itr = i2400m->fw_hdrs; *bcf_itr != NULL; bcf_itr++, i++) {
1357 bcf_hdr = *bcf_itr;
1358 if (i2400m_bcf_hdr_match(i2400m, bcf_hdr)) {
1359 d_printf(1, dev, "hit on BCF hdr #%u/%08x\n",
1360 i, le32_to_cpu(bcf_hdr->module_id));
1361 return bcf_hdr;
1362 } else
1363 d_printf(1, dev, "miss on BCF hdr #%u/%08x\n",
1364 i, le32_to_cpu(bcf_hdr->module_id));
1365 }
1366 dev_err(dev, "cannot find a matching BCF header for barker %08x\n",
1367 barker);
1368 return NULL;
1369 }
1370
1371
1372 /*
1373 * Download the firmware to the device
1374 *
1375 * @i2400m: device descriptor
1376 * @bcf: pointer to loaded (and minimally verified for consistency)
1377 * firmware
1378 * @bcf_size: size of the @bcf buffer (header plus payloads)
1379 *
1380 * The process for doing this is described in this file's header.
1381 *
1382 * Note we only reinitialize boot-mode if the flags say so. Some hw
1383 * iterations need it, some don't. In any case, if we loop, we always
1384 * need to reinitialize the boot room, hence the flags modification.
1385 */
1386 static
i2400m_fw_dnload(struct i2400m * i2400m,const struct i2400m_bcf_hdr * bcf,size_t fw_size,enum i2400m_bri flags)1387 int i2400m_fw_dnload(struct i2400m *i2400m, const struct i2400m_bcf_hdr *bcf,
1388 size_t fw_size, enum i2400m_bri flags)
1389 {
1390 int ret = 0;
1391 struct device *dev = i2400m_dev(i2400m);
1392 int count = i2400m->bus_bm_retries;
1393 const struct i2400m_bcf_hdr *bcf_hdr;
1394 size_t bcf_size;
1395
1396 d_fnstart(5, dev, "(i2400m %p bcf %p fw size %zu)\n",
1397 i2400m, bcf, fw_size);
1398 i2400m->boot_mode = 1;
1399 wmb(); /* Make sure other readers see it */
1400 hw_reboot:
1401 if (count-- == 0) {
1402 ret = -ERESTARTSYS;
1403 dev_err(dev, "device rebooted too many times, aborting\n");
1404 goto error_too_many_reboots;
1405 }
1406 if (flags & I2400M_BRI_MAC_REINIT) {
1407 ret = i2400m_bootrom_init(i2400m, flags);
1408 if (ret < 0) {
1409 dev_err(dev, "bootrom init failed: %d\n", ret);
1410 goto error_bootrom_init;
1411 }
1412 }
1413 flags |= I2400M_BRI_MAC_REINIT;
1414
1415 /*
1416 * Initialize the download, push the bytes to the device and
1417 * then jump to the new firmware. Note @ret is passed with the
1418 * offset of the jump instruction to _dnload_finalize()
1419 *
1420 * Note we need to use the BCF header in the firmware image
1421 * that matches the barker that the device sent when it
1422 * rebooted, so it has to be passed along.
1423 */
1424 ret = -EBADF;
1425 bcf_hdr = i2400m_bcf_hdr_find(i2400m);
1426 if (bcf_hdr == NULL)
1427 goto error_bcf_hdr_find;
1428
1429 ret = i2400m_dnload_init(i2400m, bcf_hdr);
1430 if (ret == -ERESTARTSYS)
1431 goto error_dev_rebooted;
1432 if (ret < 0)
1433 goto error_dnload_init;
1434
1435 /*
1436 * bcf_size refers to one header size plus the fw sections size
1437 * indicated by the header,ie. if there are other extended headers
1438 * at the tail, they are not counted
1439 */
1440 bcf_size = sizeof(u32) * le32_to_cpu(bcf_hdr->size);
1441 ret = i2400m_dnload_bcf(i2400m, bcf, bcf_size);
1442 if (ret == -ERESTARTSYS)
1443 goto error_dev_rebooted;
1444 if (ret < 0) {
1445 dev_err(dev, "fw %s: download failed: %d\n",
1446 i2400m->fw_name, ret);
1447 goto error_dnload_bcf;
1448 }
1449
1450 ret = i2400m_dnload_finalize(i2400m, bcf_hdr, bcf, ret);
1451 if (ret == -ERESTARTSYS)
1452 goto error_dev_rebooted;
1453 if (ret < 0) {
1454 dev_err(dev, "fw %s: "
1455 "download finalization failed: %d\n",
1456 i2400m->fw_name, ret);
1457 goto error_dnload_finalize;
1458 }
1459
1460 d_printf(2, dev, "fw %s successfully uploaded\n",
1461 i2400m->fw_name);
1462 i2400m->boot_mode = 0;
1463 wmb(); /* Make sure i2400m_msg_to_dev() sees boot_mode */
1464 error_dnload_finalize:
1465 error_dnload_bcf:
1466 error_dnload_init:
1467 error_bcf_hdr_find:
1468 error_bootrom_init:
1469 error_too_many_reboots:
1470 d_fnend(5, dev, "(i2400m %p bcf %p size %zu) = %d\n",
1471 i2400m, bcf, fw_size, ret);
1472 return ret;
1473
1474 error_dev_rebooted:
1475 dev_err(dev, "device rebooted, %d tries left\n", count);
1476 /* we got the notification already, no need to wait for it again */
1477 flags |= I2400M_BRI_SOFT;
1478 goto hw_reboot;
1479 }
1480
1481 static
i2400m_fw_bootstrap(struct i2400m * i2400m,const struct firmware * fw,enum i2400m_bri flags)1482 int i2400m_fw_bootstrap(struct i2400m *i2400m, const struct firmware *fw,
1483 enum i2400m_bri flags)
1484 {
1485 int ret;
1486 struct device *dev = i2400m_dev(i2400m);
1487 const struct i2400m_bcf_hdr *bcf; /* Firmware data */
1488
1489 d_fnstart(5, dev, "(i2400m %p)\n", i2400m);
1490 bcf = (void *) fw->data;
1491 ret = i2400m_fw_check(i2400m, bcf, fw->size);
1492 if (ret >= 0)
1493 ret = i2400m_fw_dnload(i2400m, bcf, fw->size, flags);
1494 if (ret < 0)
1495 dev_err(dev, "%s: cannot use: %d, skipping\n",
1496 i2400m->fw_name, ret);
1497 kfree(i2400m->fw_hdrs);
1498 i2400m->fw_hdrs = NULL;
1499 d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret);
1500 return ret;
1501 }
1502
1503
1504 /* Refcounted container for firmware data */
1505 struct i2400m_fw {
1506 struct kref kref;
1507 const struct firmware *fw;
1508 };
1509
1510
1511 static
i2400m_fw_destroy(struct kref * kref)1512 void i2400m_fw_destroy(struct kref *kref)
1513 {
1514 struct i2400m_fw *i2400m_fw =
1515 container_of(kref, struct i2400m_fw, kref);
1516 release_firmware(i2400m_fw->fw);
1517 kfree(i2400m_fw);
1518 }
1519
1520
1521 static
i2400m_fw_get(struct i2400m_fw * i2400m_fw)1522 struct i2400m_fw *i2400m_fw_get(struct i2400m_fw *i2400m_fw)
1523 {
1524 if (i2400m_fw != NULL && i2400m_fw != (void *) ~0)
1525 kref_get(&i2400m_fw->kref);
1526 return i2400m_fw;
1527 }
1528
1529
1530 static
i2400m_fw_put(struct i2400m_fw * i2400m_fw)1531 void i2400m_fw_put(struct i2400m_fw *i2400m_fw)
1532 {
1533 kref_put(&i2400m_fw->kref, i2400m_fw_destroy);
1534 }
1535
1536
1537 /**
1538 * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware
1539 *
1540 * @i2400m: device descriptor
1541 *
1542 * Returns: >= 0 if ok, < 0 errno code on error.
1543 *
1544 * This sets up the firmware upload environment, loads the firmware
1545 * file from disk, verifies and then calls the firmware upload process
1546 * per se.
1547 *
1548 * Can be called either from probe, or after a warm reset. Can not be
1549 * called from within an interrupt. All the flow in this code is
1550 * single-threade; all I/Os are synchronous.
1551 */
i2400m_dev_bootstrap(struct i2400m * i2400m,enum i2400m_bri flags)1552 int i2400m_dev_bootstrap(struct i2400m *i2400m, enum i2400m_bri flags)
1553 {
1554 int ret, itr;
1555 struct device *dev = i2400m_dev(i2400m);
1556 struct i2400m_fw *i2400m_fw;
1557 const struct i2400m_bcf_hdr *bcf; /* Firmware data */
1558 const struct firmware *fw;
1559 const char *fw_name;
1560
1561 d_fnstart(5, dev, "(i2400m %p)\n", i2400m);
1562
1563 ret = -ENODEV;
1564 spin_lock(&i2400m->rx_lock);
1565 i2400m_fw = i2400m_fw_get(i2400m->fw_cached);
1566 spin_unlock(&i2400m->rx_lock);
1567 if (i2400m_fw == (void *) ~0) {
1568 dev_err(dev, "can't load firmware now!");
1569 goto out;
1570 } else if (i2400m_fw != NULL) {
1571 dev_info(dev, "firmware %s: loading from cache\n",
1572 i2400m->fw_name);
1573 ret = i2400m_fw_bootstrap(i2400m, i2400m_fw->fw, flags);
1574 i2400m_fw_put(i2400m_fw);
1575 goto out;
1576 }
1577
1578 /* Load firmware files to memory. */
1579 for (itr = 0, bcf = NULL, ret = -ENOENT; ; itr++) {
1580 fw_name = i2400m->bus_fw_names[itr];
1581 if (fw_name == NULL) {
1582 dev_err(dev, "Could not find a usable firmware image\n");
1583 break;
1584 }
1585 d_printf(1, dev, "trying firmware %s (%d)\n", fw_name, itr);
1586 ret = request_firmware(&fw, fw_name, dev);
1587 if (ret < 0) {
1588 dev_err(dev, "fw %s: cannot load file: %d\n",
1589 fw_name, ret);
1590 continue;
1591 }
1592 i2400m->fw_name = fw_name;
1593 ret = i2400m_fw_bootstrap(i2400m, fw, flags);
1594 release_firmware(fw);
1595 if (ret >= 0) /* firmware loaded successfully */
1596 break;
1597 i2400m->fw_name = NULL;
1598 }
1599 out:
1600 d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret);
1601 return ret;
1602 }
1603 EXPORT_SYMBOL_GPL(i2400m_dev_bootstrap);
1604
1605
i2400m_fw_cache(struct i2400m * i2400m)1606 void i2400m_fw_cache(struct i2400m *i2400m)
1607 {
1608 int result;
1609 struct i2400m_fw *i2400m_fw;
1610 struct device *dev = i2400m_dev(i2400m);
1611
1612 /* if there is anything there, free it -- now, this'd be weird */
1613 spin_lock(&i2400m->rx_lock);
1614 i2400m_fw = i2400m->fw_cached;
1615 spin_unlock(&i2400m->rx_lock);
1616 if (i2400m_fw != NULL && i2400m_fw != (void *) ~0) {
1617 i2400m_fw_put(i2400m_fw);
1618 WARN(1, "%s:%u: still cached fw still present?\n",
1619 __func__, __LINE__);
1620 }
1621
1622 if (i2400m->fw_name == NULL) {
1623 dev_err(dev, "firmware n/a: can't cache\n");
1624 i2400m_fw = (void *) ~0;
1625 goto out;
1626 }
1627
1628 i2400m_fw = kzalloc(sizeof(*i2400m_fw), GFP_ATOMIC);
1629 if (i2400m_fw == NULL)
1630 goto out;
1631 kref_init(&i2400m_fw->kref);
1632 result = request_firmware(&i2400m_fw->fw, i2400m->fw_name, dev);
1633 if (result < 0) {
1634 dev_err(dev, "firmware %s: failed to cache: %d\n",
1635 i2400m->fw_name, result);
1636 kfree(i2400m_fw);
1637 i2400m_fw = (void *) ~0;
1638 } else
1639 dev_info(dev, "firmware %s: cached\n", i2400m->fw_name);
1640 out:
1641 spin_lock(&i2400m->rx_lock);
1642 i2400m->fw_cached = i2400m_fw;
1643 spin_unlock(&i2400m->rx_lock);
1644 }
1645
1646
i2400m_fw_uncache(struct i2400m * i2400m)1647 void i2400m_fw_uncache(struct i2400m *i2400m)
1648 {
1649 struct i2400m_fw *i2400m_fw;
1650
1651 spin_lock(&i2400m->rx_lock);
1652 i2400m_fw = i2400m->fw_cached;
1653 i2400m->fw_cached = NULL;
1654 spin_unlock(&i2400m->rx_lock);
1655
1656 if (i2400m_fw != NULL && i2400m_fw != (void *) ~0)
1657 i2400m_fw_put(i2400m_fw);
1658 }
1659
1660