1 /*
2 * NCI based driver for Samsung S3FWRN5 NFC chip
3 *
4 * Copyright (C) 2015 Samsung Electrnoics
5 * Robert Baldyga <r.baldyga@samsung.com>
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include <linux/completion.h>
21 #include <linux/firmware.h>
22 #include <linux/crypto.h>
23 #include <crypto/sha.h>
24
25 #include "s3fwrn5.h"
26 #include "firmware.h"
27
28 struct s3fwrn5_fw_version {
29 __u8 major;
30 __u8 build1;
31 __u8 build2;
32 __u8 target;
33 };
34
s3fwrn5_fw_send_msg(struct s3fwrn5_fw_info * fw_info,struct sk_buff * msg,struct sk_buff ** rsp)35 static int s3fwrn5_fw_send_msg(struct s3fwrn5_fw_info *fw_info,
36 struct sk_buff *msg, struct sk_buff **rsp)
37 {
38 struct s3fwrn5_info *info =
39 container_of(fw_info, struct s3fwrn5_info, fw_info);
40 long ret;
41
42 reinit_completion(&fw_info->completion);
43
44 ret = s3fwrn5_write(info, msg);
45 if (ret < 0)
46 return ret;
47
48 ret = wait_for_completion_interruptible_timeout(
49 &fw_info->completion, msecs_to_jiffies(1000));
50 if (ret < 0)
51 return ret;
52 else if (ret == 0)
53 return -ENXIO;
54
55 if (!fw_info->rsp)
56 return -EINVAL;
57
58 *rsp = fw_info->rsp;
59 fw_info->rsp = NULL;
60
61 return 0;
62 }
63
s3fwrn5_fw_prep_msg(struct s3fwrn5_fw_info * fw_info,struct sk_buff ** msg,u8 type,u8 code,const void * data,u16 len)64 static int s3fwrn5_fw_prep_msg(struct s3fwrn5_fw_info *fw_info,
65 struct sk_buff **msg, u8 type, u8 code, const void *data, u16 len)
66 {
67 struct s3fwrn5_fw_header hdr;
68 struct sk_buff *skb;
69
70 hdr.type = type | fw_info->parity;
71 fw_info->parity ^= 0x80;
72 hdr.code = code;
73 hdr.len = len;
74
75 skb = alloc_skb(S3FWRN5_FW_HDR_SIZE + len, GFP_KERNEL);
76 if (!skb)
77 return -ENOMEM;
78
79 memcpy(skb_put(skb, S3FWRN5_FW_HDR_SIZE), &hdr, S3FWRN5_FW_HDR_SIZE);
80 if (len)
81 memcpy(skb_put(skb, len), data, len);
82
83 *msg = skb;
84
85 return 0;
86 }
87
s3fwrn5_fw_get_bootinfo(struct s3fwrn5_fw_info * fw_info,struct s3fwrn5_fw_cmd_get_bootinfo_rsp * bootinfo)88 static int s3fwrn5_fw_get_bootinfo(struct s3fwrn5_fw_info *fw_info,
89 struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo)
90 {
91 struct sk_buff *msg, *rsp = NULL;
92 struct s3fwrn5_fw_header *hdr;
93 int ret;
94
95 /* Send GET_BOOTINFO command */
96
97 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
98 S3FWRN5_FW_CMD_GET_BOOTINFO, NULL, 0);
99 if (ret < 0)
100 return ret;
101
102 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
103 kfree_skb(msg);
104 if (ret < 0)
105 return ret;
106
107 hdr = (struct s3fwrn5_fw_header *) rsp->data;
108 if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
109 ret = -EINVAL;
110 goto out;
111 }
112
113 memcpy(bootinfo, rsp->data + S3FWRN5_FW_HDR_SIZE, 10);
114
115 out:
116 kfree_skb(rsp);
117 return ret;
118 }
119
s3fwrn5_fw_enter_update_mode(struct s3fwrn5_fw_info * fw_info,const void * hash_data,u16 hash_size,const void * sig_data,u16 sig_size)120 static int s3fwrn5_fw_enter_update_mode(struct s3fwrn5_fw_info *fw_info,
121 const void *hash_data, u16 hash_size,
122 const void *sig_data, u16 sig_size)
123 {
124 struct s3fwrn5_fw_cmd_enter_updatemode args;
125 struct sk_buff *msg, *rsp = NULL;
126 struct s3fwrn5_fw_header *hdr;
127 int ret;
128
129 /* Send ENTER_UPDATE_MODE command */
130
131 args.hashcode_size = hash_size;
132 args.signature_size = sig_size;
133
134 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
135 S3FWRN5_FW_CMD_ENTER_UPDATE_MODE, &args, sizeof(args));
136 if (ret < 0)
137 return ret;
138
139 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
140 kfree_skb(msg);
141 if (ret < 0)
142 return ret;
143
144 hdr = (struct s3fwrn5_fw_header *) rsp->data;
145 if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
146 ret = -EPROTO;
147 goto out;
148 }
149
150 kfree_skb(rsp);
151
152 /* Send hashcode data */
153
154 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_DATA, 0,
155 hash_data, hash_size);
156 if (ret < 0)
157 return ret;
158
159 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
160 kfree_skb(msg);
161 if (ret < 0)
162 return ret;
163
164 hdr = (struct s3fwrn5_fw_header *) rsp->data;
165 if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
166 ret = -EPROTO;
167 goto out;
168 }
169
170 kfree_skb(rsp);
171
172 /* Send signature data */
173
174 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_DATA, 0,
175 sig_data, sig_size);
176 if (ret < 0)
177 return ret;
178
179 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
180 kfree_skb(msg);
181 if (ret < 0)
182 return ret;
183
184 hdr = (struct s3fwrn5_fw_header *) rsp->data;
185 if (hdr->code != S3FWRN5_FW_RET_SUCCESS)
186 ret = -EPROTO;
187
188 out:
189 kfree_skb(rsp);
190 return ret;
191 }
192
s3fwrn5_fw_update_sector(struct s3fwrn5_fw_info * fw_info,u32 base_addr,const void * data)193 static int s3fwrn5_fw_update_sector(struct s3fwrn5_fw_info *fw_info,
194 u32 base_addr, const void *data)
195 {
196 struct s3fwrn5_fw_cmd_update_sector args;
197 struct sk_buff *msg, *rsp = NULL;
198 struct s3fwrn5_fw_header *hdr;
199 int ret, i;
200
201 /* Send UPDATE_SECTOR command */
202
203 args.base_address = base_addr;
204
205 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
206 S3FWRN5_FW_CMD_UPDATE_SECTOR, &args, sizeof(args));
207 if (ret < 0)
208 return ret;
209
210 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
211 kfree_skb(msg);
212 if (ret < 0)
213 return ret;
214
215 hdr = (struct s3fwrn5_fw_header *) rsp->data;
216 if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
217 ret = -EPROTO;
218 goto err;
219 }
220
221 kfree_skb(rsp);
222
223 /* Send data split into 256-byte packets */
224
225 for (i = 0; i < 16; ++i) {
226 ret = s3fwrn5_fw_prep_msg(fw_info, &msg,
227 S3FWRN5_FW_MSG_DATA, 0, data+256*i, 256);
228 if (ret < 0)
229 break;
230
231 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
232 kfree_skb(msg);
233 if (ret < 0)
234 break;
235
236 hdr = (struct s3fwrn5_fw_header *) rsp->data;
237 if (hdr->code != S3FWRN5_FW_RET_SUCCESS) {
238 ret = -EPROTO;
239 goto err;
240 }
241
242 kfree_skb(rsp);
243 }
244
245 return ret;
246
247 err:
248 kfree_skb(rsp);
249 return ret;
250 }
251
s3fwrn5_fw_complete_update_mode(struct s3fwrn5_fw_info * fw_info)252 static int s3fwrn5_fw_complete_update_mode(struct s3fwrn5_fw_info *fw_info)
253 {
254 struct sk_buff *msg, *rsp = NULL;
255 struct s3fwrn5_fw_header *hdr;
256 int ret;
257
258 /* Send COMPLETE_UPDATE_MODE command */
259
260 ret = s3fwrn5_fw_prep_msg(fw_info, &msg, S3FWRN5_FW_MSG_CMD,
261 S3FWRN5_FW_CMD_COMPLETE_UPDATE_MODE, NULL, 0);
262 if (ret < 0)
263 return ret;
264
265 ret = s3fwrn5_fw_send_msg(fw_info, msg, &rsp);
266 kfree_skb(msg);
267 if (ret < 0)
268 return ret;
269
270 hdr = (struct s3fwrn5_fw_header *) rsp->data;
271 if (hdr->code != S3FWRN5_FW_RET_SUCCESS)
272 ret = -EPROTO;
273
274 kfree_skb(rsp);
275
276 return ret;
277 }
278
279 /*
280 * Firmware header stucture:
281 *
282 * 0x00 - 0x0B : Date and time string (w/o NUL termination)
283 * 0x10 - 0x13 : Firmware version
284 * 0x14 - 0x17 : Signature address
285 * 0x18 - 0x1B : Signature size
286 * 0x1C - 0x1F : Firmware image address
287 * 0x20 - 0x23 : Firmware sectors count
288 * 0x24 - 0x27 : Custom signature address
289 * 0x28 - 0x2B : Custom signature size
290 */
291
292 #define S3FWRN5_FW_IMAGE_HEADER_SIZE 44
293
s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info * fw_info)294 static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
295 {
296 struct s3fwrn5_fw_image *fw = &fw_info->fw;
297 u32 sig_off;
298 u32 image_off;
299 u32 custom_sig_off;
300 int ret;
301
302 ret = request_firmware(&fw->fw, fw_info->fw_name,
303 &fw_info->ndev->nfc_dev->dev);
304 if (ret < 0)
305 return ret;
306
307 if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
308 release_firmware(fw->fw);
309 return -EINVAL;
310 }
311
312 memcpy(fw->date, fw->fw->data + 0x00, 12);
313 fw->date[12] = '\0';
314
315 memcpy(&fw->version, fw->fw->data + 0x10, 4);
316
317 memcpy(&sig_off, fw->fw->data + 0x14, 4);
318 fw->sig = fw->fw->data + sig_off;
319 memcpy(&fw->sig_size, fw->fw->data + 0x18, 4);
320
321 memcpy(&image_off, fw->fw->data + 0x1C, 4);
322 fw->image = fw->fw->data + image_off;
323 memcpy(&fw->image_sectors, fw->fw->data + 0x20, 4);
324
325 memcpy(&custom_sig_off, fw->fw->data + 0x24, 4);
326 fw->custom_sig = fw->fw->data + custom_sig_off;
327 memcpy(&fw->custom_sig_size, fw->fw->data + 0x28, 4);
328
329 return 0;
330 }
331
s3fwrn5_fw_release_firmware(struct s3fwrn5_fw_info * fw_info)332 static void s3fwrn5_fw_release_firmware(struct s3fwrn5_fw_info *fw_info)
333 {
334 release_firmware(fw_info->fw.fw);
335 }
336
s3fwrn5_fw_get_base_addr(struct s3fwrn5_fw_cmd_get_bootinfo_rsp * bootinfo,u32 * base_addr)337 static int s3fwrn5_fw_get_base_addr(
338 struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo, u32 *base_addr)
339 {
340 int i;
341 struct {
342 u8 version[4];
343 u32 base_addr;
344 } match[] = {
345 {{0x05, 0x00, 0x00, 0x00}, 0x00005000},
346 {{0x05, 0x00, 0x00, 0x01}, 0x00003000},
347 {{0x05, 0x00, 0x00, 0x02}, 0x00003000},
348 {{0x05, 0x00, 0x00, 0x03}, 0x00003000},
349 {{0x05, 0x00, 0x00, 0x05}, 0x00003000}
350 };
351
352 for (i = 0; i < ARRAY_SIZE(match); ++i)
353 if (bootinfo->hw_version[0] == match[i].version[0] &&
354 bootinfo->hw_version[1] == match[i].version[1] &&
355 bootinfo->hw_version[3] == match[i].version[3]) {
356 *base_addr = match[i].base_addr;
357 return 0;
358 }
359
360 return -EINVAL;
361 }
362
363 static inline bool
s3fwrn5_fw_is_custom(struct s3fwrn5_fw_cmd_get_bootinfo_rsp * bootinfo)364 s3fwrn5_fw_is_custom(struct s3fwrn5_fw_cmd_get_bootinfo_rsp *bootinfo)
365 {
366 return !!bootinfo->hw_version[2];
367 }
368
s3fwrn5_fw_setup(struct s3fwrn5_fw_info * fw_info)369 int s3fwrn5_fw_setup(struct s3fwrn5_fw_info *fw_info)
370 {
371 struct s3fwrn5_fw_cmd_get_bootinfo_rsp bootinfo;
372 int ret;
373
374 /* Get firmware data */
375
376 ret = s3fwrn5_fw_request_firmware(fw_info);
377 if (ret < 0) {
378 dev_err(&fw_info->ndev->nfc_dev->dev,
379 "Failed to get fw file, ret=%02x\n", ret);
380 return ret;
381 }
382
383 /* Get bootloader info */
384
385 ret = s3fwrn5_fw_get_bootinfo(fw_info, &bootinfo);
386 if (ret < 0) {
387 dev_err(&fw_info->ndev->nfc_dev->dev,
388 "Failed to get bootinfo, ret=%02x\n", ret);
389 goto err;
390 }
391
392 /* Match hardware version to obtain firmware base address */
393
394 ret = s3fwrn5_fw_get_base_addr(&bootinfo, &fw_info->base_addr);
395 if (ret < 0) {
396 dev_err(&fw_info->ndev->nfc_dev->dev,
397 "Unknown hardware version\n");
398 goto err;
399 }
400
401 fw_info->sector_size = bootinfo.sector_size;
402
403 fw_info->sig_size = s3fwrn5_fw_is_custom(&bootinfo) ?
404 fw_info->fw.custom_sig_size : fw_info->fw.sig_size;
405 fw_info->sig = s3fwrn5_fw_is_custom(&bootinfo) ?
406 fw_info->fw.custom_sig : fw_info->fw.sig;
407
408 return 0;
409
410 err:
411 s3fwrn5_fw_release_firmware(fw_info);
412 return ret;
413 }
414
s3fwrn5_fw_check_version(struct s3fwrn5_fw_info * fw_info,u32 version)415 bool s3fwrn5_fw_check_version(struct s3fwrn5_fw_info *fw_info, u32 version)
416 {
417 struct s3fwrn5_fw_version *new = (void *) &fw_info->fw.version;
418 struct s3fwrn5_fw_version *old = (void *) &version;
419
420 if (new->major > old->major)
421 return true;
422 if (new->build1 > old->build1)
423 return true;
424 if (new->build2 > old->build2)
425 return true;
426
427 return false;
428 }
429
s3fwrn5_fw_download(struct s3fwrn5_fw_info * fw_info)430 int s3fwrn5_fw_download(struct s3fwrn5_fw_info *fw_info)
431 {
432 struct s3fwrn5_fw_image *fw = &fw_info->fw;
433 u8 hash_data[SHA1_DIGEST_SIZE];
434 struct scatterlist sg;
435 struct hash_desc desc;
436 u32 image_size, off;
437 int ret;
438
439 image_size = fw_info->sector_size * fw->image_sectors;
440
441 /* Compute SHA of firmware data */
442
443 sg_init_one(&sg, fw->image, image_size);
444 desc.tfm = crypto_alloc_hash("sha1", 0, CRYPTO_ALG_ASYNC);
445 crypto_hash_init(&desc);
446 crypto_hash_update(&desc, &sg, image_size);
447 crypto_hash_final(&desc, hash_data);
448 crypto_free_hash(desc.tfm);
449
450 /* Firmware update process */
451
452 dev_info(&fw_info->ndev->nfc_dev->dev,
453 "Firmware update: %s\n", fw_info->fw_name);
454
455 ret = s3fwrn5_fw_enter_update_mode(fw_info, hash_data,
456 SHA1_DIGEST_SIZE, fw_info->sig, fw_info->sig_size);
457 if (ret < 0) {
458 dev_err(&fw_info->ndev->nfc_dev->dev,
459 "Unable to enter update mode\n");
460 goto out;
461 }
462
463 for (off = 0; off < image_size; off += fw_info->sector_size) {
464 ret = s3fwrn5_fw_update_sector(fw_info,
465 fw_info->base_addr + off, fw->image + off);
466 if (ret < 0) {
467 dev_err(&fw_info->ndev->nfc_dev->dev,
468 "Firmware update error (code=%d)\n", ret);
469 goto out;
470 }
471 }
472
473 ret = s3fwrn5_fw_complete_update_mode(fw_info);
474 if (ret < 0) {
475 dev_err(&fw_info->ndev->nfc_dev->dev,
476 "Unable to complete update mode\n");
477 goto out;
478 }
479
480 dev_info(&fw_info->ndev->nfc_dev->dev,
481 "Firmware update: success\n");
482
483 out:
484 return ret;
485 }
486
s3fwrn5_fw_init(struct s3fwrn5_fw_info * fw_info,const char * fw_name)487 void s3fwrn5_fw_init(struct s3fwrn5_fw_info *fw_info, const char *fw_name)
488 {
489 fw_info->parity = 0x00;
490 fw_info->rsp = NULL;
491 fw_info->fw.fw = NULL;
492 strcpy(fw_info->fw_name, fw_name);
493 init_completion(&fw_info->completion);
494 }
495
s3fwrn5_fw_cleanup(struct s3fwrn5_fw_info * fw_info)496 void s3fwrn5_fw_cleanup(struct s3fwrn5_fw_info *fw_info)
497 {
498 s3fwrn5_fw_release_firmware(fw_info);
499 }
500
s3fwrn5_fw_recv_frame(struct nci_dev * ndev,struct sk_buff * skb)501 int s3fwrn5_fw_recv_frame(struct nci_dev *ndev, struct sk_buff *skb)
502 {
503 struct s3fwrn5_info *info = nci_get_drvdata(ndev);
504 struct s3fwrn5_fw_info *fw_info = &info->fw_info;
505
506 BUG_ON(fw_info->rsp);
507
508 fw_info->rsp = skb;
509
510 complete(&fw_info->completion);
511
512 return 0;
513 }
514