1// SPDX-License-Identifier: GPL-2.0
2/*
3 * ISH-TP client driver for ISH firmware loading
4 *
5 * Copyright (c) 2019, Intel Corporation.
6 */
7
8#include <linux/firmware.h>
9#include <linux/module.h>
10#include <linux/pci.h>
11#include <linux/intel-ish-client-if.h>
12#include <linux/property.h>
13#include <asm/cacheflush.h>
14
15/* Number of times we attempt to load the firmware before giving up */
16#define MAX_LOAD_ATTEMPTS 3
17
18/* ISH TX/RX ring buffer pool size */
19#define LOADER_CL_RX_RING_SIZE 1
20#define LOADER_CL_TX_RING_SIZE 1
21
22/*
23 * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
24 * used to temporarily hold the data transferred from host to Shim
25 * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
26 * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
27 * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
28 * have a max payload of 3968 bytes (= 32 x 124 payload).
29 */
30#define LOADER_SHIM_IPC_BUF_SIZE 3968
31
32/**
33 * enum ish_loader_commands - ISH loader host commands.
34 * @LOADER_CMD_XFER_QUERY: Query the Shim firmware loader for
35 * capabilities
36 * @LOADER_CMD_XFER_FRAGMENT: Transfer one firmware image fragment at a
37 * time. The command may be executed
38 * multiple times until the entire firmware
39 * image is downloaded to SRAM.
40 * @LOADER_CMD_START: Start executing the main firmware.
41 */
42enum ish_loader_commands {
43 LOADER_CMD_XFER_QUERY = 0,
44 LOADER_CMD_XFER_FRAGMENT,
45 LOADER_CMD_START,
46};
47
48/* Command bit mask */
49#define CMD_MASK GENMASK(6, 0)
50#define IS_RESPONSE BIT(7)
51
52/*
53 * ISH firmware max delay for one transmit failure is 1 Hz,
54 * and firmware will retry 2 times, so 3 Hz is used for timeout.
55 */
56#define ISHTP_SEND_TIMEOUT (3 * HZ)
57
58/*
59 * Loader transfer modes:
60 *
61 * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
62 * transfer data. This may use IPC or DMA if supported in firmware.
63 * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
64 * both IPC & DMA (legacy).
65 *
66 * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
67 * from the sensor data streaming. Here we download a large (300+ Kb)
68 * image directly to ISH SRAM memory. There is limited benefit of
69 * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
70 * this "direct dma" mode, where we do not use ISH-TP for DMA, but
71 * instead manage the DMA directly in kernel driver and Shim firmware
72 * loader (allocate buffer, break in chucks and transfer). This allows
73 * to overcome 4 Kb limit, and optimize the data flow path in firmware.
74 */
75#define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
76#define LOADER_XFER_MODE_ISHTP BIT(1)
77
78/* ISH Transport Loader client unique GUID */
79static const struct ishtp_device_id loader_ishtp_id_table[] = {
80 { .guid = GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
81 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc) },
82 { }
83};
84MODULE_DEVICE_TABLE(ishtp, loader_ishtp_id_table);
85
86#define FILENAME_SIZE 256
87
88/*
89 * The firmware loading latency will be minimum if we can DMA the
90 * entire ISH firmware image in one go. This requires that we allocate
91 * a large DMA buffer in kernel, which could be problematic on some
92 * platforms. So here we limit the DMA buffer size via a module_param.
93 * We default to 4 pages, but a customer can set it to higher limit if
94 * deemed appropriate for his platform.
95 */
96static int dma_buf_size_limit = 4 * PAGE_SIZE;
97
98/**
99 * struct loader_msg_hdr - Header for ISH Loader commands.
100 * @command: LOADER_CMD* commands. Bit 7 is the response.
101 * @reserved: Reserved space
102 * @status: Command response status. Non 0, is error
103 * condition.
104 *
105 * This structure is used as header for every command/data sent/received
106 * between Host driver and ISH Shim firmware loader.
107 */
108struct loader_msg_hdr {
109 u8 command;
110 u8 reserved[2];
111 u8 status;
112} __packed;
113
114struct loader_xfer_query {
115 struct loader_msg_hdr hdr;
116 u32 image_size;
117} __packed;
118
119struct ish_fw_version {
120 u16 major;
121 u16 minor;
122 u16 hotfix;
123 u16 build;
124} __packed;
125
126union loader_version {
127 u32 value;
128 struct {
129 u8 major;
130 u8 minor;
131 u8 hotfix;
132 u8 build;
133 };
134} __packed;
135
136struct loader_capability {
137 u32 max_fw_image_size;
138 u32 xfer_mode;
139 u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
140} __packed;
141
142struct shim_fw_info {
143 struct ish_fw_version ish_fw_version;
144 u32 protocol_version;
145 union loader_version ldr_version;
146 struct loader_capability ldr_capability;
147} __packed;
148
149struct loader_xfer_query_response {
150 struct loader_msg_hdr hdr;
151 struct shim_fw_info fw_info;
152} __packed;
153
154struct loader_xfer_fragment {
155 struct loader_msg_hdr hdr;
156 u32 xfer_mode;
157 u32 offset;
158 u32 size;
159 u32 is_last;
160} __packed;
161
162struct loader_xfer_ipc_fragment {
163 struct loader_xfer_fragment fragment;
164 u8 data[] ____cacheline_aligned; /* variable length payload here */
165} __packed;
166
167struct loader_xfer_dma_fragment {
168 struct loader_xfer_fragment fragment;
169 u64 ddr_phys_addr;
170} __packed;
171
172struct loader_start {
173 struct loader_msg_hdr hdr;
174} __packed;
175
176/**
177 * struct response_info - Encapsulate firmware response related
178 * information for passing between function
179 * loader_cl_send() and process_recv() callback.
180 * @data: Copy the data received from firmware here.
181 * @max_size: Max size allocated for the @data buffer. If the
182 * received data exceeds this value, we log an
183 * error.
184 * @size: Actual size of data received from firmware.
185 * @error: Returns 0 for success, negative error code for a
186 * failure in function process_recv().
187 * @received: Set to true on receiving a valid firmware
188 * response to host command
189 * @wait_queue: Wait queue for Host firmware loading where the
190 * client sends message to ISH firmware and waits
191 * for response
192 */
193struct response_info {
194 void *data;
195 size_t max_size;
196 size_t size;
197 int error;
198 bool received;
199 wait_queue_head_t wait_queue;
200};
201
202/*
203 * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
204 * @work_ishtp_reset: Work queue for reset handling.
205 * @work_fw_load: Work queue for host firmware loading.
206 * @flag_retry: Flag for indicating host firmware loading should
207 * be retried.
208 * @retry_count: Count the number of retries.
209 *
210 * This structure is used to store data per client.
211 */
212struct ishtp_cl_data {
213 struct ishtp_cl *loader_ishtp_cl;
214 struct ishtp_cl_device *cl_device;
215
216 /*
217 * Used for passing firmware response information between
218 * loader_cl_send() and process_recv() callback.
219 */
220 struct response_info response;
221
222 struct work_struct work_ishtp_reset;
223 struct work_struct work_fw_load;
224
225 /*
226 * In certain failure scenrios, it makes sense to reset the ISH
227 * subsystem and retry Host firmware loading (e.g. bad message
228 * packet, ENOMEM, etc.). On the other hand, failures due to
229 * protocol mismatch, etc., are not recoverable. We do not
230 * retry them.
231 *
232 * If set, the flag indicates that we should re-try the
233 * particular failure.
234 */
235 bool flag_retry;
236 int retry_count;
237};
238
239#define IPC_FRAGMENT_DATA_PREAMBLE \
240 offsetof(struct loader_xfer_ipc_fragment, data)
241
242#define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
243
244/**
245 * get_firmware_variant() - Gets the filename of firmware image to be
246 * loaded based on platform variant.
247 * @client_data: Client data instance.
248 * @filename: Returns firmware filename.
249 *
250 * Queries the firmware-name device property string.
251 *
252 * Return: 0 for success, negative error code for failure.
253 */
254static int get_firmware_variant(struct ishtp_cl_data *client_data,
255 char *filename)
256{
257 int rv;
258 const char *val;
259 struct device *devc = ishtp_get_pci_device(cl_device: client_data->cl_device);
260
261 rv = device_property_read_string(dev: devc, propname: "firmware-name", val: &val);
262 if (rv < 0) {
263 dev_err(devc,
264 "Error: ISH firmware-name device property required\n");
265 return rv;
266 }
267 return snprintf(buf: filename, FILENAME_SIZE, fmt: "intel/%s", val);
268}
269
270/**
271 * loader_cl_send() - Send message from host to firmware
272 *
273 * @client_data: Client data instance
274 * @out_msg: Message buffer to be sent to firmware
275 * @out_size: Size of out going message
276 * @in_msg: Message buffer where the incoming data copied.
277 * This buffer is allocated by calling
278 * @in_size: Max size of incoming message
279 *
280 * Return: Number of bytes copied in the in_msg on success, negative
281 * error code on failure.
282 */
283static int loader_cl_send(struct ishtp_cl_data *client_data,
284 u8 *out_msg, size_t out_size,
285 u8 *in_msg, size_t in_size)
286{
287 int rv;
288 struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
289 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
290
291 dev_dbg(cl_data_to_dev(client_data),
292 "%s: command=%02lx is_response=%u status=%02x\n",
293 __func__,
294 out_hdr->command & CMD_MASK,
295 out_hdr->command & IS_RESPONSE ? 1 : 0,
296 out_hdr->status);
297
298 /* Setup in coming buffer & size */
299 client_data->response.data = in_msg;
300 client_data->response.max_size = in_size;
301 client_data->response.error = 0;
302 client_data->response.received = false;
303
304 rv = ishtp_cl_send(cl: loader_ishtp_cl, buf: out_msg, length: out_size);
305 if (rv < 0) {
306 dev_err(cl_data_to_dev(client_data),
307 "ishtp_cl_send error %d\n", rv);
308 return rv;
309 }
310
311 wait_event_interruptible_timeout(client_data->response.wait_queue,
312 client_data->response.received,
313 ISHTP_SEND_TIMEOUT);
314 if (!client_data->response.received) {
315 dev_err(cl_data_to_dev(client_data),
316 "Timed out for response to command=%02lx",
317 out_hdr->command & CMD_MASK);
318 return -ETIMEDOUT;
319 }
320
321 if (client_data->response.error < 0)
322 return client_data->response.error;
323
324 return client_data->response.size;
325}
326
327/**
328 * process_recv() - Receive and parse incoming packet
329 * @loader_ishtp_cl: Client instance to get stats
330 * @rb_in_proc: ISH received message buffer
331 *
332 * Parse the incoming packet. If it is a response packet then it will
333 * update received and wake up the caller waiting to for the response.
334 */
335static void process_recv(struct ishtp_cl *loader_ishtp_cl,
336 struct ishtp_cl_rb *rb_in_proc)
337{
338 struct loader_msg_hdr *hdr;
339 size_t data_len = rb_in_proc->buf_idx;
340 struct ishtp_cl_data *client_data =
341 ishtp_get_client_data(cl: loader_ishtp_cl);
342
343 /* Sanity check */
344 if (!client_data->response.data) {
345 dev_err(cl_data_to_dev(client_data),
346 "Receiving buffer is null. Should be allocated by calling function\n");
347 client_data->response.error = -EINVAL;
348 goto end;
349 }
350
351 if (client_data->response.received) {
352 dev_err(cl_data_to_dev(client_data),
353 "Previous firmware message not yet processed\n");
354 client_data->response.error = -EINVAL;
355 goto end;
356 }
357 /*
358 * All firmware messages have a header. Check buffer size
359 * before accessing elements inside.
360 */
361 if (!rb_in_proc->buffer.data) {
362 dev_warn(cl_data_to_dev(client_data),
363 "rb_in_proc->buffer.data returned null");
364 client_data->response.error = -EBADMSG;
365 goto end;
366 }
367
368 if (data_len < sizeof(struct loader_msg_hdr)) {
369 dev_err(cl_data_to_dev(client_data),
370 "data size %zu is less than header %zu\n",
371 data_len, sizeof(struct loader_msg_hdr));
372 client_data->response.error = -EMSGSIZE;
373 goto end;
374 }
375
376 hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
377
378 dev_dbg(cl_data_to_dev(client_data),
379 "%s: command=%02lx is_response=%u status=%02x\n",
380 __func__,
381 hdr->command & CMD_MASK,
382 hdr->command & IS_RESPONSE ? 1 : 0,
383 hdr->status);
384
385 if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
386 ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
387 ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
388 dev_err(cl_data_to_dev(client_data),
389 "Invalid command=%02lx\n",
390 hdr->command & CMD_MASK);
391 client_data->response.error = -EPROTO;
392 goto end;
393 }
394
395 if (data_len > client_data->response.max_size) {
396 dev_err(cl_data_to_dev(client_data),
397 "Received buffer size %zu is larger than allocated buffer %zu\n",
398 data_len, client_data->response.max_size);
399 client_data->response.error = -EMSGSIZE;
400 goto end;
401 }
402
403 /* We expect only "response" messages from firmware */
404 if (!(hdr->command & IS_RESPONSE)) {
405 dev_err(cl_data_to_dev(client_data),
406 "Invalid response to command\n");
407 client_data->response.error = -EIO;
408 goto end;
409 }
410
411 if (hdr->status) {
412 dev_err(cl_data_to_dev(client_data),
413 "Loader returned status %d\n",
414 hdr->status);
415 client_data->response.error = -EIO;
416 goto end;
417 }
418
419 /* Update the actual received buffer size */
420 client_data->response.size = data_len;
421
422 /*
423 * Copy the buffer received in firmware response for the
424 * calling thread.
425 */
426 memcpy(client_data->response.data,
427 rb_in_proc->buffer.data, data_len);
428
429 /* Set flag before waking up the caller */
430 client_data->response.received = true;
431
432end:
433 /* Free the buffer */
434 ishtp_cl_io_rb_recycle(rb: rb_in_proc);
435 rb_in_proc = NULL;
436
437 /* Wake the calling thread */
438 wake_up_interruptible(&client_data->response.wait_queue);
439}
440
441/**
442 * loader_cl_event_cb() - bus driver callback for incoming message
443 * @cl_device: Pointer to the ishtp client device for which this
444 * message is targeted
445 *
446 * Remove the packet from the list and process the message by calling
447 * process_recv
448 */
449static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
450{
451 struct ishtp_cl_rb *rb_in_proc;
452 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
453
454 while ((rb_in_proc = ishtp_cl_rx_get_rb(cl: loader_ishtp_cl)) != NULL) {
455 /* Process the data packet from firmware */
456 process_recv(loader_ishtp_cl, rb_in_proc);
457 }
458}
459
460/**
461 * ish_query_loader_prop() - Query ISH Shim firmware loader
462 * @client_data: Client data instance
463 * @fw: Pointer to firmware data struct in host memory
464 * @fw_info: Loader firmware properties
465 *
466 * This function queries the ISH Shim firmware loader for capabilities.
467 *
468 * Return: 0 for success, negative error code for failure.
469 */
470static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
471 const struct firmware *fw,
472 struct shim_fw_info *fw_info)
473{
474 int rv;
475 struct loader_xfer_query ldr_xfer_query;
476 struct loader_xfer_query_response ldr_xfer_query_resp;
477
478 memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
479 ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
480 ldr_xfer_query.image_size = fw->size;
481 rv = loader_cl_send(client_data,
482 out_msg: (u8 *)&ldr_xfer_query,
483 out_size: sizeof(ldr_xfer_query),
484 in_msg: (u8 *)&ldr_xfer_query_resp,
485 in_size: sizeof(ldr_xfer_query_resp));
486 if (rv < 0) {
487 client_data->flag_retry = true;
488 *fw_info = (struct shim_fw_info){};
489 return rv;
490 }
491
492 /* On success, the return value is the received buffer size */
493 if (rv != sizeof(struct loader_xfer_query_response)) {
494 dev_err(cl_data_to_dev(client_data),
495 "data size %d is not equal to size of loader_xfer_query_response %zu\n",
496 rv, sizeof(struct loader_xfer_query_response));
497 client_data->flag_retry = true;
498 *fw_info = (struct shim_fw_info){};
499 return -EMSGSIZE;
500 }
501
502 /* Save fw_info for use outside this function */
503 *fw_info = ldr_xfer_query_resp.fw_info;
504
505 /* Loader firmware properties */
506 dev_dbg(cl_data_to_dev(client_data),
507 "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
508 fw_info->ish_fw_version.major,
509 fw_info->ish_fw_version.minor,
510 fw_info->ish_fw_version.hotfix,
511 fw_info->ish_fw_version.build,
512 fw_info->protocol_version,
513 fw_info->ldr_version.value);
514
515 dev_dbg(cl_data_to_dev(client_data),
516 "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
517 fw_info->ldr_capability.max_fw_image_size,
518 fw_info->ldr_capability.xfer_mode,
519 fw_info->ldr_capability.max_dma_buf_size,
520 dma_buf_size_limit);
521
522 /* Sanity checks */
523 if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
524 dev_err(cl_data_to_dev(client_data),
525 "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
526 fw->size,
527 fw_info->ldr_capability.max_fw_image_size);
528 return -ENOSPC;
529 }
530
531 /* For DMA the buffer size should be multiple of cacheline size */
532 if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
533 (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
534 dev_err(cl_data_to_dev(client_data),
535 "Shim firmware loader buffer size %d should be multiple of cacheline\n",
536 fw_info->ldr_capability.max_dma_buf_size);
537 return -EINVAL;
538 }
539
540 return 0;
541}
542
543/**
544 * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface
545 * @client_data: Client data instance
546 * @fw: Pointer to firmware data struct in host memory
547 *
548 * This function uses ISH-TP to transfer ISH firmware from host to
549 * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
550 * support.
551 *
552 * Return: 0 for success, negative error code for failure.
553 */
554static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
555 const struct firmware *fw)
556{
557 int rv;
558 u32 fragment_offset, fragment_size, payload_max_size;
559 struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
560 struct loader_msg_hdr ldr_xfer_ipc_ack;
561
562 payload_max_size =
563 LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
564
565 ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
566 if (!ldr_xfer_ipc_frag) {
567 client_data->flag_retry = true;
568 return -ENOMEM;
569 }
570
571 ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
572 ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
573
574 /* Break the firmware image into fragments and send as ISH-TP payload */
575 fragment_offset = 0;
576 while (fragment_offset < fw->size) {
577 if (fragment_offset + payload_max_size < fw->size) {
578 fragment_size = payload_max_size;
579 ldr_xfer_ipc_frag->fragment.is_last = 0;
580 } else {
581 fragment_size = fw->size - fragment_offset;
582 ldr_xfer_ipc_frag->fragment.is_last = 1;
583 }
584
585 ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
586 ldr_xfer_ipc_frag->fragment.size = fragment_size;
587 memcpy(ldr_xfer_ipc_frag->data,
588 &fw->data[fragment_offset],
589 fragment_size);
590
591 dev_dbg(cl_data_to_dev(client_data),
592 "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
593 ldr_xfer_ipc_frag->fragment.offset,
594 ldr_xfer_ipc_frag->fragment.size,
595 ldr_xfer_ipc_frag->fragment.is_last);
596
597 rv = loader_cl_send(client_data,
598 out_msg: (u8 *)ldr_xfer_ipc_frag,
599 IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
600 in_msg: (u8 *)&ldr_xfer_ipc_ack,
601 in_size: sizeof(ldr_xfer_ipc_ack));
602 if (rv < 0) {
603 client_data->flag_retry = true;
604 goto end_err_resp_buf_release;
605 }
606
607 fragment_offset += fragment_size;
608 }
609
610 kfree(objp: ldr_xfer_ipc_frag);
611 return 0;
612
613end_err_resp_buf_release:
614 /* Free ISH buffer if not done already, in error case */
615 kfree(objp: ldr_xfer_ipc_frag);
616 return rv;
617}
618
619/**
620 * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
621 * @client_data: Client data instance
622 * @fw: Pointer to firmware data struct in host memory
623 * @fw_info: Loader firmware properties
624 *
625 * Host firmware load is a unique case where we need to download
626 * a large firmware image (200+ Kb). This function implements
627 * direct DMA transfer in kernel and ISH firmware. This allows
628 * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
629 * directly to ISH UMA at location of choice.
630 * Function depends on corresponding support in ISH firmware.
631 *
632 * Return: 0 for success, negative error code for failure.
633 */
634static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
635 const struct firmware *fw,
636 const struct shim_fw_info fw_info)
637{
638 int rv;
639 void *dma_buf;
640 dma_addr_t dma_buf_phy;
641 u32 fragment_offset, fragment_size, payload_max_size;
642 struct loader_msg_hdr ldr_xfer_dma_frag_ack;
643 struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
644 struct device *devc = ishtp_get_pci_device(cl_device: client_data->cl_device);
645 u32 shim_fw_buf_size =
646 fw_info.ldr_capability.max_dma_buf_size;
647
648 /*
649 * payload_max_size should be set to minimum of
650 * (1) Size of firmware to be loaded,
651 * (2) Max DMA buffer size supported by Shim firmware,
652 * (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
653 */
654 payload_max_size = min3(fw->size,
655 (size_t)shim_fw_buf_size,
656 (size_t)dma_buf_size_limit);
657
658 /*
659 * Buffer size should be multiple of cacheline size
660 * if it's not, select the previous cacheline boundary.
661 */
662 payload_max_size &= ~(L1_CACHE_BYTES - 1);
663
664 dma_buf = dma_alloc_coherent(dev: devc, size: payload_max_size, dma_handle: &dma_buf_phy, GFP_KERNEL);
665 if (!dma_buf) {
666 client_data->flag_retry = true;
667 return -ENOMEM;
668 }
669
670 ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
671 ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
672 ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
673
674 /* Send the firmware image in chucks of payload_max_size */
675 fragment_offset = 0;
676 while (fragment_offset < fw->size) {
677 if (fragment_offset + payload_max_size < fw->size) {
678 fragment_size = payload_max_size;
679 ldr_xfer_dma_frag.fragment.is_last = 0;
680 } else {
681 fragment_size = fw->size - fragment_offset;
682 ldr_xfer_dma_frag.fragment.is_last = 1;
683 }
684
685 ldr_xfer_dma_frag.fragment.offset = fragment_offset;
686 ldr_xfer_dma_frag.fragment.size = fragment_size;
687 memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
688
689 /* Flush cache to be sure the data is in main memory. */
690 clflush_cache_range(addr: dma_buf, size: payload_max_size);
691
692 dev_dbg(cl_data_to_dev(client_data),
693 "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
694 ldr_xfer_dma_frag.fragment.offset,
695 ldr_xfer_dma_frag.fragment.size,
696 ldr_xfer_dma_frag.fragment.is_last,
697 ldr_xfer_dma_frag.ddr_phys_addr);
698
699 rv = loader_cl_send(client_data,
700 out_msg: (u8 *)&ldr_xfer_dma_frag,
701 out_size: sizeof(ldr_xfer_dma_frag),
702 in_msg: (u8 *)&ldr_xfer_dma_frag_ack,
703 in_size: sizeof(ldr_xfer_dma_frag_ack));
704 if (rv < 0) {
705 client_data->flag_retry = true;
706 goto end_err_resp_buf_release;
707 }
708
709 fragment_offset += fragment_size;
710 }
711
712end_err_resp_buf_release:
713 dma_free_coherent(dev: devc, size: payload_max_size, cpu_addr: dma_buf, dma_handle: dma_buf_phy);
714 return rv;
715}
716
717/**
718 * ish_fw_start() - Start executing ISH main firmware
719 * @client_data: client data instance
720 *
721 * This function sends message to Shim firmware loader to start
722 * the execution of ISH main firmware.
723 *
724 * Return: 0 for success, negative error code for failure.
725 */
726static int ish_fw_start(struct ishtp_cl_data *client_data)
727{
728 struct loader_start ldr_start;
729 struct loader_msg_hdr ldr_start_ack;
730
731 memset(&ldr_start, 0, sizeof(ldr_start));
732 ldr_start.hdr.command = LOADER_CMD_START;
733 return loader_cl_send(client_data,
734 out_msg: (u8 *)&ldr_start,
735 out_size: sizeof(ldr_start),
736 in_msg: (u8 *)&ldr_start_ack,
737 in_size: sizeof(ldr_start_ack));
738}
739
740/**
741 * load_fw_from_host() - Loads ISH firmware from host
742 * @client_data: Client data instance
743 *
744 * This function loads the ISH firmware to ISH SRAM and starts execution
745 *
746 * Return: 0 for success, negative error code for failure.
747 */
748static int load_fw_from_host(struct ishtp_cl_data *client_data)
749{
750 int rv;
751 u32 xfer_mode;
752 char *filename;
753 const struct firmware *fw;
754 struct shim_fw_info fw_info;
755 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
756
757 client_data->flag_retry = false;
758
759 filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
760 if (!filename) {
761 client_data->flag_retry = true;
762 rv = -ENOMEM;
763 goto end_error;
764 }
765
766 /* Get filename of the ISH firmware to be loaded */
767 rv = get_firmware_variant(client_data, filename);
768 if (rv < 0)
769 goto end_err_filename_buf_release;
770
771 rv = request_firmware(fw: &fw, name: filename, cl_data_to_dev(client_data));
772 if (rv < 0)
773 goto end_err_filename_buf_release;
774
775 /* Step 1: Query Shim firmware loader properties */
776
777 rv = ish_query_loader_prop(client_data, fw, fw_info: &fw_info);
778 if (rv < 0)
779 goto end_err_fw_release;
780
781 /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
782
783 xfer_mode = fw_info.ldr_capability.xfer_mode;
784 if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
785 rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
786 } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
787 rv = ish_fw_xfer_ishtp(client_data, fw);
788 } else {
789 dev_err(cl_data_to_dev(client_data),
790 "No transfer mode selected in firmware\n");
791 rv = -EINVAL;
792 }
793 if (rv < 0)
794 goto end_err_fw_release;
795
796 /* Step 3: Start ISH main firmware exeuction */
797
798 rv = ish_fw_start(client_data);
799 if (rv < 0)
800 goto end_err_fw_release;
801
802 release_firmware(fw);
803 dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
804 filename);
805 kfree(objp: filename);
806 return 0;
807
808end_err_fw_release:
809 release_firmware(fw);
810end_err_filename_buf_release:
811 kfree(objp: filename);
812end_error:
813 /* Keep a count of retries, and give up after 3 attempts */
814 if (client_data->flag_retry &&
815 client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
816 dev_warn(cl_data_to_dev(client_data),
817 "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
818 rv);
819 ish_hw_reset(dev: ishtp_get_ishtp_device(cl: loader_ishtp_cl));
820 } else {
821 dev_err(cl_data_to_dev(client_data),
822 "ISH host firmware load failed %d\n", rv);
823 }
824 return rv;
825}
826
827static void load_fw_from_host_handler(struct work_struct *work)
828{
829 struct ishtp_cl_data *client_data;
830
831 client_data = container_of(work, struct ishtp_cl_data,
832 work_fw_load);
833 load_fw_from_host(client_data);
834}
835
836/**
837 * loader_init() - Init function for ISH-TP client
838 * @loader_ishtp_cl: ISH-TP client instance
839 * @reset: true if called for init after reset
840 *
841 * Return: 0 for success, negative error code for failure
842 */
843static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
844{
845 int rv;
846 struct ishtp_fw_client *fw_client;
847 struct ishtp_cl_data *client_data =
848 ishtp_get_client_data(cl: loader_ishtp_cl);
849
850 dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
851
852 rv = ishtp_cl_link(cl: loader_ishtp_cl);
853 if (rv < 0) {
854 dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
855 return rv;
856 }
857
858 /* Connect to firmware client */
859 ishtp_set_tx_ring_size(cl: loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
860 ishtp_set_rx_ring_size(cl: loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
861
862 fw_client =
863 ishtp_fw_cl_get_client(dev: ishtp_get_ishtp_device(cl: loader_ishtp_cl),
864 uuid: &loader_ishtp_id_table[0].guid);
865 if (!fw_client) {
866 dev_err(cl_data_to_dev(client_data),
867 "ISH client uuid not found\n");
868 rv = -ENOENT;
869 goto err_cl_unlink;
870 }
871
872 ishtp_cl_set_fw_client_id(cl: loader_ishtp_cl,
873 fw_client_id: ishtp_get_fw_client_id(fw_client));
874 ishtp_set_connection_state(cl: loader_ishtp_cl, state: ISHTP_CL_CONNECTING);
875
876 rv = ishtp_cl_connect(cl: loader_ishtp_cl);
877 if (rv < 0) {
878 dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
879 goto err_cl_unlink;
880 }
881
882 dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
883
884 ishtp_register_event_cb(device: client_data->cl_device, read_cb: loader_cl_event_cb);
885
886 return 0;
887
888err_cl_unlink:
889 ishtp_cl_unlink(cl: loader_ishtp_cl);
890 return rv;
891}
892
893static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
894{
895 ishtp_set_connection_state(cl: loader_ishtp_cl, state: ISHTP_CL_DISCONNECTING);
896 ishtp_cl_disconnect(cl: loader_ishtp_cl);
897 ishtp_cl_unlink(cl: loader_ishtp_cl);
898 ishtp_cl_flush_queues(cl: loader_ishtp_cl);
899
900 /* Disband and free all Tx and Rx client-level rings */
901 ishtp_cl_free(cl: loader_ishtp_cl);
902}
903
904static void reset_handler(struct work_struct *work)
905{
906 int rv;
907 struct ishtp_cl_data *client_data;
908 struct ishtp_cl *loader_ishtp_cl;
909 struct ishtp_cl_device *cl_device;
910
911 client_data = container_of(work, struct ishtp_cl_data,
912 work_ishtp_reset);
913
914 loader_ishtp_cl = client_data->loader_ishtp_cl;
915 cl_device = client_data->cl_device;
916
917 /* Unlink, flush queues & start again */
918 ishtp_cl_unlink(cl: loader_ishtp_cl);
919 ishtp_cl_flush_queues(cl: loader_ishtp_cl);
920 ishtp_cl_free(cl: loader_ishtp_cl);
921
922 loader_ishtp_cl = ishtp_cl_allocate(cl_device);
923 if (!loader_ishtp_cl)
924 return;
925
926 ishtp_set_drvdata(cl_device, data: loader_ishtp_cl);
927 ishtp_set_client_data(cl: loader_ishtp_cl, data: client_data);
928 client_data->loader_ishtp_cl = loader_ishtp_cl;
929 client_data->cl_device = cl_device;
930
931 rv = loader_init(loader_ishtp_cl, reset: 1);
932 if (rv < 0) {
933 dev_err(ishtp_device(cl_device), "Reset Failed\n");
934 return;
935 }
936
937 /* ISH firmware loading from host */
938 load_fw_from_host(client_data);
939}
940
941/**
942 * loader_ishtp_cl_probe() - ISH-TP client driver probe
943 * @cl_device: ISH-TP client device instance
944 *
945 * This function gets called on device create on ISH-TP bus
946 *
947 * Return: 0 for success, negative error code for failure
948 */
949static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
950{
951 struct ishtp_cl *loader_ishtp_cl;
952 struct ishtp_cl_data *client_data;
953 int rv;
954
955 client_data = devm_kzalloc(dev: ishtp_device(cl_device),
956 size: sizeof(*client_data),
957 GFP_KERNEL);
958 if (!client_data)
959 return -ENOMEM;
960
961 loader_ishtp_cl = ishtp_cl_allocate(cl_device);
962 if (!loader_ishtp_cl)
963 return -ENOMEM;
964
965 ishtp_set_drvdata(cl_device, data: loader_ishtp_cl);
966 ishtp_set_client_data(cl: loader_ishtp_cl, data: client_data);
967 client_data->loader_ishtp_cl = loader_ishtp_cl;
968 client_data->cl_device = cl_device;
969
970 init_waitqueue_head(&client_data->response.wait_queue);
971
972 INIT_WORK(&client_data->work_ishtp_reset,
973 reset_handler);
974 INIT_WORK(&client_data->work_fw_load,
975 load_fw_from_host_handler);
976
977 rv = loader_init(loader_ishtp_cl, reset: 0);
978 if (rv < 0) {
979 ishtp_cl_free(cl: loader_ishtp_cl);
980 return rv;
981 }
982 ishtp_get_device(cl_dev: cl_device);
983
984 client_data->retry_count = 0;
985
986 /* ISH firmware loading from host */
987 schedule_work(work: &client_data->work_fw_load);
988
989 return 0;
990}
991
992/**
993 * loader_ishtp_cl_remove() - ISH-TP client driver remove
994 * @cl_device: ISH-TP client device instance
995 *
996 * This function gets called on device remove on ISH-TP bus
997 *
998 * Return: 0
999 */
1000static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
1001{
1002 struct ishtp_cl_data *client_data;
1003 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1004
1005 client_data = ishtp_get_client_data(cl: loader_ishtp_cl);
1006
1007 /*
1008 * The sequence of the following two cancel_work_sync() is
1009 * important. The work_fw_load can in turn schedue
1010 * work_ishtp_reset, so first cancel work_fw_load then
1011 * cancel work_ishtp_reset.
1012 */
1013 cancel_work_sync(work: &client_data->work_fw_load);
1014 cancel_work_sync(work: &client_data->work_ishtp_reset);
1015 loader_deinit(loader_ishtp_cl);
1016 ishtp_put_device(cl_dev: cl_device);
1017}
1018
1019/**
1020 * loader_ishtp_cl_reset() - ISH-TP client driver reset
1021 * @cl_device: ISH-TP client device instance
1022 *
1023 * This function gets called on device reset on ISH-TP bus
1024 *
1025 * Return: 0
1026 */
1027static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
1028{
1029 struct ishtp_cl_data *client_data;
1030 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1031
1032 client_data = ishtp_get_client_data(cl: loader_ishtp_cl);
1033
1034 schedule_work(work: &client_data->work_ishtp_reset);
1035
1036 return 0;
1037}
1038
1039static struct ishtp_cl_driver loader_ishtp_cl_driver = {
1040 .name = "ish-loader",
1041 .id = loader_ishtp_id_table,
1042 .probe = loader_ishtp_cl_probe,
1043 .remove = loader_ishtp_cl_remove,
1044 .reset = loader_ishtp_cl_reset,
1045};
1046
1047static int __init ish_loader_init(void)
1048{
1049 return ishtp_cl_driver_register(driver: &loader_ishtp_cl_driver, THIS_MODULE);
1050}
1051
1052static void __exit ish_loader_exit(void)
1053{
1054 ishtp_cl_driver_unregister(driver: &loader_ishtp_cl_driver);
1055}
1056
1057late_initcall(ish_loader_init);
1058module_exit(ish_loader_exit);
1059
1060module_param(dma_buf_size_limit, int, 0644);
1061MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
1062
1063MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
1064MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
1065
1066MODULE_LICENSE("GPL v2");
1067

source code of linux/drivers/hid/intel-ish-hid/ishtp-fw-loader.c