1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * ISH-TP client driver for ISH firmware loading
4 *
5 * Copyright (c) 2019, Intel Corporation.
6 */
7
8 #include <linux/firmware.h>
9 #include <linux/module.h>
10 #include <linux/pci.h>
11 #include <linux/intel-ish-client-if.h>
12 #include <linux/property.h>
13 #include <asm/cacheflush.h>
14
15 /* Number of times we attempt to load the firmware before giving up */
16 #define MAX_LOAD_ATTEMPTS 3
17
18 /* ISH TX/RX ring buffer pool size */
19 #define LOADER_CL_RX_RING_SIZE 1
20 #define LOADER_CL_TX_RING_SIZE 1
21
22 /*
23 * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
24 * used to temporarily hold the data transferred from host to Shim
25 * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
26 * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
27 * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
28 * have a max payload of 3968 bytes (= 32 x 124 payload).
29 */
30 #define LOADER_SHIM_IPC_BUF_SIZE 3968
31
32 /**
33 * enum ish_loader_commands - ISH loader host commands.
34 * @LOADER_CMD_XFER_QUERY: Query the Shim firmware loader for
35 * capabilities
36 * @LOADER_CMD_XFER_FRAGMENT: Transfer one firmware image fragment at a
37 * time. The command may be executed
38 * multiple times until the entire firmware
39 * image is downloaded to SRAM.
40 * @LOADER_CMD_START: Start executing the main firmware.
41 */
42 enum ish_loader_commands {
43 LOADER_CMD_XFER_QUERY = 0,
44 LOADER_CMD_XFER_FRAGMENT,
45 LOADER_CMD_START,
46 };
47
48 /* Command bit mask */
49 #define CMD_MASK GENMASK(6, 0)
50 #define IS_RESPONSE BIT(7)
51
52 /*
53 * ISH firmware max delay for one transmit failure is 1 Hz,
54 * and firmware will retry 2 times, so 3 Hz is used for timeout.
55 */
56 #define ISHTP_SEND_TIMEOUT (3 * HZ)
57
58 /*
59 * Loader transfer modes:
60 *
61 * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
62 * transfer data. This may use IPC or DMA if supported in firmware.
63 * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
64 * both IPC & DMA (legacy).
65 *
66 * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
67 * from the sensor data streaming. Here we download a large (300+ Kb)
68 * image directly to ISH SRAM memory. There is limited benefit of
69 * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
70 * this "direct dma" mode, where we do not use ISH-TP for DMA, but
71 * instead manage the DMA directly in kernel driver and Shim firmware
72 * loader (allocate buffer, break in chucks and transfer). This allows
73 * to overcome 4 Kb limit, and optimize the data flow path in firmware.
74 */
75 #define LOADER_XFER_MODE_DIRECT_DMA BIT(0)
76 #define LOADER_XFER_MODE_ISHTP BIT(1)
77
78 /* ISH Transport Loader client unique GUID */
79 static const guid_t loader_ishtp_guid =
80 GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
81 0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc);
82
83 #define FILENAME_SIZE 256
84
85 /*
86 * The firmware loading latency will be minimum if we can DMA the
87 * entire ISH firmware image in one go. This requires that we allocate
88 * a large DMA buffer in kernel, which could be problematic on some
89 * platforms. So here we limit the DMA buffer size via a module_param.
90 * We default to 4 pages, but a customer can set it to higher limit if
91 * deemed appropriate for his platform.
92 */
93 static int dma_buf_size_limit = 4 * PAGE_SIZE;
94
95 /**
96 * struct loader_msg_hdr - Header for ISH Loader commands.
97 * @command: LOADER_CMD* commands. Bit 7 is the response.
98 * @reserved: Reserved space
99 * @status: Command response status. Non 0, is error
100 * condition.
101 *
102 * This structure is used as header for every command/data sent/received
103 * between Host driver and ISH Shim firmware loader.
104 */
105 struct loader_msg_hdr {
106 u8 command;
107 u8 reserved[2];
108 u8 status;
109 } __packed;
110
111 struct loader_xfer_query {
112 struct loader_msg_hdr hdr;
113 u32 image_size;
114 } __packed;
115
116 struct ish_fw_version {
117 u16 major;
118 u16 minor;
119 u16 hotfix;
120 u16 build;
121 } __packed;
122
123 union loader_version {
124 u32 value;
125 struct {
126 u8 major;
127 u8 minor;
128 u8 hotfix;
129 u8 build;
130 };
131 } __packed;
132
133 struct loader_capability {
134 u32 max_fw_image_size;
135 u32 xfer_mode;
136 u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
137 } __packed;
138
139 struct shim_fw_info {
140 struct ish_fw_version ish_fw_version;
141 u32 protocol_version;
142 union loader_version ldr_version;
143 struct loader_capability ldr_capability;
144 } __packed;
145
146 struct loader_xfer_query_response {
147 struct loader_msg_hdr hdr;
148 struct shim_fw_info fw_info;
149 } __packed;
150
151 struct loader_xfer_fragment {
152 struct loader_msg_hdr hdr;
153 u32 xfer_mode;
154 u32 offset;
155 u32 size;
156 u32 is_last;
157 } __packed;
158
159 struct loader_xfer_ipc_fragment {
160 struct loader_xfer_fragment fragment;
161 u8 data[] ____cacheline_aligned; /* variable length payload here */
162 } __packed;
163
164 struct loader_xfer_dma_fragment {
165 struct loader_xfer_fragment fragment;
166 u64 ddr_phys_addr;
167 } __packed;
168
169 struct loader_start {
170 struct loader_msg_hdr hdr;
171 } __packed;
172
173 /**
174 * struct response_info - Encapsulate firmware response related
175 * information for passing between function
176 * loader_cl_send() and process_recv() callback.
177 * @data: Copy the data received from firmware here.
178 * @max_size: Max size allocated for the @data buffer. If the
179 * received data exceeds this value, we log an
180 * error.
181 * @size: Actual size of data received from firmware.
182 * @error: Returns 0 for success, negative error code for a
183 * failure in function process_recv().
184 * @received: Set to true on receiving a valid firmware
185 * response to host command
186 * @wait_queue: Wait queue for Host firmware loading where the
187 * client sends message to ISH firmware and waits
188 * for response
189 */
190 struct response_info {
191 void *data;
192 size_t max_size;
193 size_t size;
194 int error;
195 bool received;
196 wait_queue_head_t wait_queue;
197 };
198
199 /*
200 * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
201 * @work_ishtp_reset: Work queue for reset handling.
202 * @work_fw_load: Work queue for host firmware loading.
203 * @flag_retry: Flag for indicating host firmware loading should
204 * be retried.
205 * @retry_count: Count the number of retries.
206 *
207 * This structure is used to store data per client.
208 */
209 struct ishtp_cl_data {
210 struct ishtp_cl *loader_ishtp_cl;
211 struct ishtp_cl_device *cl_device;
212
213 /*
214 * Used for passing firmware response information between
215 * loader_cl_send() and process_recv() callback.
216 */
217 struct response_info response;
218
219 struct work_struct work_ishtp_reset;
220 struct work_struct work_fw_load;
221
222 /*
223 * In certain failure scenrios, it makes sense to reset the ISH
224 * subsystem and retry Host firmware loading (e.g. bad message
225 * packet, ENOMEM, etc.). On the other hand, failures due to
226 * protocol mismatch, etc., are not recoverable. We do not
227 * retry them.
228 *
229 * If set, the flag indicates that we should re-try the
230 * particular failure.
231 */
232 bool flag_retry;
233 int retry_count;
234 };
235
236 #define IPC_FRAGMENT_DATA_PREAMBLE \
237 offsetof(struct loader_xfer_ipc_fragment, data)
238
239 #define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
240
241 /**
242 * get_firmware_variant() - Gets the filename of firmware image to be
243 * loaded based on platform variant.
244 * @client_data: Client data instance.
245 * @filename: Returns firmware filename.
246 *
247 * Queries the firmware-name device property string.
248 *
249 * Return: 0 for success, negative error code for failure.
250 */
get_firmware_variant(struct ishtp_cl_data * client_data,char * filename)251 static int get_firmware_variant(struct ishtp_cl_data *client_data,
252 char *filename)
253 {
254 int rv;
255 const char *val;
256 struct device *devc = ishtp_get_pci_device(client_data->cl_device);
257
258 rv = device_property_read_string(devc, "firmware-name", &val);
259 if (rv < 0) {
260 dev_err(devc,
261 "Error: ISH firmware-name device property required\n");
262 return rv;
263 }
264 return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
265 }
266
267 /**
268 * loader_cl_send() Send message from host to firmware
269 * @client_data: Client data instance
270 * @out_msg: Message buffer to be sent to firmware
271 * @out_size: Size of out going message
272 * @in_msg: Message buffer where the incoming data copied.
273 * This buffer is allocated by calling
274 * @in_size: Max size of incoming message
275 *
276 * Return: Number of bytes copied in the in_msg on success, negative
277 * error code on failure.
278 */
loader_cl_send(struct ishtp_cl_data * client_data,u8 * out_msg,size_t out_size,u8 * in_msg,size_t in_size)279 static int loader_cl_send(struct ishtp_cl_data *client_data,
280 u8 *out_msg, size_t out_size,
281 u8 *in_msg, size_t in_size)
282 {
283 int rv;
284 struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
285 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
286
287 dev_dbg(cl_data_to_dev(client_data),
288 "%s: command=%02lx is_response=%u status=%02x\n",
289 __func__,
290 out_hdr->command & CMD_MASK,
291 out_hdr->command & IS_RESPONSE ? 1 : 0,
292 out_hdr->status);
293
294 /* Setup in coming buffer & size */
295 client_data->response.data = in_msg;
296 client_data->response.max_size = in_size;
297 client_data->response.error = 0;
298 client_data->response.received = false;
299
300 rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
301 if (rv < 0) {
302 dev_err(cl_data_to_dev(client_data),
303 "ishtp_cl_send error %d\n", rv);
304 return rv;
305 }
306
307 wait_event_interruptible_timeout(client_data->response.wait_queue,
308 client_data->response.received,
309 ISHTP_SEND_TIMEOUT);
310 if (!client_data->response.received) {
311 dev_err(cl_data_to_dev(client_data),
312 "Timed out for response to command=%02lx",
313 out_hdr->command & CMD_MASK);
314 return -ETIMEDOUT;
315 }
316
317 if (client_data->response.error < 0)
318 return client_data->response.error;
319
320 return client_data->response.size;
321 }
322
323 /**
324 * process_recv() - Receive and parse incoming packet
325 * @loader_ishtp_cl: Client instance to get stats
326 * @rb_in_proc: ISH received message buffer
327 *
328 * Parse the incoming packet. If it is a response packet then it will
329 * update received and wake up the caller waiting to for the response.
330 */
process_recv(struct ishtp_cl * loader_ishtp_cl,struct ishtp_cl_rb * rb_in_proc)331 static void process_recv(struct ishtp_cl *loader_ishtp_cl,
332 struct ishtp_cl_rb *rb_in_proc)
333 {
334 struct loader_msg_hdr *hdr;
335 size_t data_len = rb_in_proc->buf_idx;
336 struct ishtp_cl_data *client_data =
337 ishtp_get_client_data(loader_ishtp_cl);
338
339 /* Sanity check */
340 if (!client_data->response.data) {
341 dev_err(cl_data_to_dev(client_data),
342 "Receiving buffer is null. Should be allocated by calling function\n");
343 client_data->response.error = -EINVAL;
344 goto end;
345 }
346
347 if (client_data->response.received) {
348 dev_err(cl_data_to_dev(client_data),
349 "Previous firmware message not yet processed\n");
350 client_data->response.error = -EINVAL;
351 goto end;
352 }
353 /*
354 * All firmware messages have a header. Check buffer size
355 * before accessing elements inside.
356 */
357 if (!rb_in_proc->buffer.data) {
358 dev_warn(cl_data_to_dev(client_data),
359 "rb_in_proc->buffer.data returned null");
360 client_data->response.error = -EBADMSG;
361 goto end;
362 }
363
364 if (data_len < sizeof(struct loader_msg_hdr)) {
365 dev_err(cl_data_to_dev(client_data),
366 "data size %zu is less than header %zu\n",
367 data_len, sizeof(struct loader_msg_hdr));
368 client_data->response.error = -EMSGSIZE;
369 goto end;
370 }
371
372 hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
373
374 dev_dbg(cl_data_to_dev(client_data),
375 "%s: command=%02lx is_response=%u status=%02x\n",
376 __func__,
377 hdr->command & CMD_MASK,
378 hdr->command & IS_RESPONSE ? 1 : 0,
379 hdr->status);
380
381 if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
382 ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
383 ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
384 dev_err(cl_data_to_dev(client_data),
385 "Invalid command=%02lx\n",
386 hdr->command & CMD_MASK);
387 client_data->response.error = -EPROTO;
388 goto end;
389 }
390
391 if (data_len > client_data->response.max_size) {
392 dev_err(cl_data_to_dev(client_data),
393 "Received buffer size %zu is larger than allocated buffer %zu\n",
394 data_len, client_data->response.max_size);
395 client_data->response.error = -EMSGSIZE;
396 goto end;
397 }
398
399 /* We expect only "response" messages from firmware */
400 if (!(hdr->command & IS_RESPONSE)) {
401 dev_err(cl_data_to_dev(client_data),
402 "Invalid response to command\n");
403 client_data->response.error = -EIO;
404 goto end;
405 }
406
407 if (hdr->status) {
408 dev_err(cl_data_to_dev(client_data),
409 "Loader returned status %d\n",
410 hdr->status);
411 client_data->response.error = -EIO;
412 goto end;
413 }
414
415 /* Update the actual received buffer size */
416 client_data->response.size = data_len;
417
418 /*
419 * Copy the buffer received in firmware response for the
420 * calling thread.
421 */
422 memcpy(client_data->response.data,
423 rb_in_proc->buffer.data, data_len);
424
425 /* Set flag before waking up the caller */
426 client_data->response.received = true;
427
428 end:
429 /* Free the buffer */
430 ishtp_cl_io_rb_recycle(rb_in_proc);
431 rb_in_proc = NULL;
432
433 /* Wake the calling thread */
434 wake_up_interruptible(&client_data->response.wait_queue);
435 }
436
437 /**
438 * loader_cl_event_cb() - bus driver callback for incoming message
439 * @cl_device: Pointer to the ishtp client device for which this
440 * message is targeted
441 *
442 * Remove the packet from the list and process the message by calling
443 * process_recv
444 */
loader_cl_event_cb(struct ishtp_cl_device * cl_device)445 static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
446 {
447 struct ishtp_cl_rb *rb_in_proc;
448 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
449
450 while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
451 /* Process the data packet from firmware */
452 process_recv(loader_ishtp_cl, rb_in_proc);
453 }
454 }
455
456 /**
457 * ish_query_loader_prop() - Query ISH Shim firmware loader
458 * @client_data: Client data instance
459 * @fw: Pointer to firmware data struct in host memory
460 * @fw_info: Loader firmware properties
461 *
462 * This function queries the ISH Shim firmware loader for capabilities.
463 *
464 * Return: 0 for success, negative error code for failure.
465 */
ish_query_loader_prop(struct ishtp_cl_data * client_data,const struct firmware * fw,struct shim_fw_info * fw_info)466 static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
467 const struct firmware *fw,
468 struct shim_fw_info *fw_info)
469 {
470 int rv;
471 struct loader_xfer_query ldr_xfer_query;
472 struct loader_xfer_query_response ldr_xfer_query_resp;
473
474 memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
475 ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
476 ldr_xfer_query.image_size = fw->size;
477 rv = loader_cl_send(client_data,
478 (u8 *)&ldr_xfer_query,
479 sizeof(ldr_xfer_query),
480 (u8 *)&ldr_xfer_query_resp,
481 sizeof(ldr_xfer_query_resp));
482 if (rv < 0) {
483 client_data->flag_retry = true;
484 *fw_info = (struct shim_fw_info){};
485 return rv;
486 }
487
488 /* On success, the return value is the received buffer size */
489 if (rv != sizeof(struct loader_xfer_query_response)) {
490 dev_err(cl_data_to_dev(client_data),
491 "data size %d is not equal to size of loader_xfer_query_response %zu\n",
492 rv, sizeof(struct loader_xfer_query_response));
493 client_data->flag_retry = true;
494 *fw_info = (struct shim_fw_info){};
495 return -EMSGSIZE;
496 }
497
498 /* Save fw_info for use outside this function */
499 *fw_info = ldr_xfer_query_resp.fw_info;
500
501 /* Loader firmware properties */
502 dev_dbg(cl_data_to_dev(client_data),
503 "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
504 fw_info->ish_fw_version.major,
505 fw_info->ish_fw_version.minor,
506 fw_info->ish_fw_version.hotfix,
507 fw_info->ish_fw_version.build,
508 fw_info->protocol_version,
509 fw_info->ldr_version.value);
510
511 dev_dbg(cl_data_to_dev(client_data),
512 "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
513 fw_info->ldr_capability.max_fw_image_size,
514 fw_info->ldr_capability.xfer_mode,
515 fw_info->ldr_capability.max_dma_buf_size,
516 dma_buf_size_limit);
517
518 /* Sanity checks */
519 if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
520 dev_err(cl_data_to_dev(client_data),
521 "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
522 fw->size,
523 fw_info->ldr_capability.max_fw_image_size);
524 return -ENOSPC;
525 }
526
527 /* For DMA the buffer size should be multiple of cacheline size */
528 if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
529 (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
530 dev_err(cl_data_to_dev(client_data),
531 "Shim firmware loader buffer size %d should be multiple of cacheline\n",
532 fw_info->ldr_capability.max_dma_buf_size);
533 return -EINVAL;
534 }
535
536 return 0;
537 }
538
539 /**
540 * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface
541 * @client_data: Client data instance
542 * @fw: Pointer to firmware data struct in host memory
543 *
544 * This function uses ISH-TP to transfer ISH firmware from host to
545 * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
546 * support.
547 *
548 * Return: 0 for success, negative error code for failure.
549 */
ish_fw_xfer_ishtp(struct ishtp_cl_data * client_data,const struct firmware * fw)550 static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
551 const struct firmware *fw)
552 {
553 int rv;
554 u32 fragment_offset, fragment_size, payload_max_size;
555 struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
556 struct loader_msg_hdr ldr_xfer_ipc_ack;
557
558 payload_max_size =
559 LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
560
561 ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
562 if (!ldr_xfer_ipc_frag) {
563 client_data->flag_retry = true;
564 return -ENOMEM;
565 }
566
567 ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
568 ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
569
570 /* Break the firmware image into fragments and send as ISH-TP payload */
571 fragment_offset = 0;
572 while (fragment_offset < fw->size) {
573 if (fragment_offset + payload_max_size < fw->size) {
574 fragment_size = payload_max_size;
575 ldr_xfer_ipc_frag->fragment.is_last = 0;
576 } else {
577 fragment_size = fw->size - fragment_offset;
578 ldr_xfer_ipc_frag->fragment.is_last = 1;
579 }
580
581 ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
582 ldr_xfer_ipc_frag->fragment.size = fragment_size;
583 memcpy(ldr_xfer_ipc_frag->data,
584 &fw->data[fragment_offset],
585 fragment_size);
586
587 dev_dbg(cl_data_to_dev(client_data),
588 "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
589 ldr_xfer_ipc_frag->fragment.offset,
590 ldr_xfer_ipc_frag->fragment.size,
591 ldr_xfer_ipc_frag->fragment.is_last);
592
593 rv = loader_cl_send(client_data,
594 (u8 *)ldr_xfer_ipc_frag,
595 IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
596 (u8 *)&ldr_xfer_ipc_ack,
597 sizeof(ldr_xfer_ipc_ack));
598 if (rv < 0) {
599 client_data->flag_retry = true;
600 goto end_err_resp_buf_release;
601 }
602
603 fragment_offset += fragment_size;
604 }
605
606 kfree(ldr_xfer_ipc_frag);
607 return 0;
608
609 end_err_resp_buf_release:
610 /* Free ISH buffer if not done already, in error case */
611 kfree(ldr_xfer_ipc_frag);
612 return rv;
613 }
614
615 /**
616 * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
617 * @client_data: Client data instance
618 * @fw: Pointer to firmware data struct in host memory
619 * @fw_info: Loader firmware properties
620 *
621 * Host firmware load is a unique case where we need to download
622 * a large firmware image (200+ Kb). This function implements
623 * direct DMA transfer in kernel and ISH firmware. This allows
624 * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
625 * directly to ISH UMA at location of choice.
626 * Function depends on corresponding support in ISH firmware.
627 *
628 * Return: 0 for success, negative error code for failure.
629 */
ish_fw_xfer_direct_dma(struct ishtp_cl_data * client_data,const struct firmware * fw,const struct shim_fw_info fw_info)630 static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
631 const struct firmware *fw,
632 const struct shim_fw_info fw_info)
633 {
634 int rv;
635 void *dma_buf;
636 dma_addr_t dma_buf_phy;
637 u32 fragment_offset, fragment_size, payload_max_size;
638 struct loader_msg_hdr ldr_xfer_dma_frag_ack;
639 struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
640 struct device *devc = ishtp_get_pci_device(client_data->cl_device);
641 u32 shim_fw_buf_size =
642 fw_info.ldr_capability.max_dma_buf_size;
643
644 /*
645 * payload_max_size should be set to minimum of
646 * (1) Size of firmware to be loaded,
647 * (2) Max DMA buffer size supported by Shim firmware,
648 * (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
649 */
650 payload_max_size = min3(fw->size,
651 (size_t)shim_fw_buf_size,
652 (size_t)dma_buf_size_limit);
653
654 /*
655 * Buffer size should be multiple of cacheline size
656 * if it's not, select the previous cacheline boundary.
657 */
658 payload_max_size &= ~(L1_CACHE_BYTES - 1);
659
660 dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32);
661 if (!dma_buf) {
662 client_data->flag_retry = true;
663 return -ENOMEM;
664 }
665
666 dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size,
667 DMA_TO_DEVICE);
668 if (dma_mapping_error(devc, dma_buf_phy)) {
669 dev_err(cl_data_to_dev(client_data), "DMA map failed\n");
670 client_data->flag_retry = true;
671 rv = -ENOMEM;
672 goto end_err_dma_buf_release;
673 }
674
675 ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
676 ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
677 ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
678
679 /* Send the firmware image in chucks of payload_max_size */
680 fragment_offset = 0;
681 while (fragment_offset < fw->size) {
682 if (fragment_offset + payload_max_size < fw->size) {
683 fragment_size = payload_max_size;
684 ldr_xfer_dma_frag.fragment.is_last = 0;
685 } else {
686 fragment_size = fw->size - fragment_offset;
687 ldr_xfer_dma_frag.fragment.is_last = 1;
688 }
689
690 ldr_xfer_dma_frag.fragment.offset = fragment_offset;
691 ldr_xfer_dma_frag.fragment.size = fragment_size;
692 memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
693
694 dma_sync_single_for_device(devc, dma_buf_phy,
695 payload_max_size,
696 DMA_TO_DEVICE);
697
698 /*
699 * Flush cache here because the dma_sync_single_for_device()
700 * does not do for x86.
701 */
702 clflush_cache_range(dma_buf, payload_max_size);
703
704 dev_dbg(cl_data_to_dev(client_data),
705 "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
706 ldr_xfer_dma_frag.fragment.offset,
707 ldr_xfer_dma_frag.fragment.size,
708 ldr_xfer_dma_frag.fragment.is_last,
709 ldr_xfer_dma_frag.ddr_phys_addr);
710
711 rv = loader_cl_send(client_data,
712 (u8 *)&ldr_xfer_dma_frag,
713 sizeof(ldr_xfer_dma_frag),
714 (u8 *)&ldr_xfer_dma_frag_ack,
715 sizeof(ldr_xfer_dma_frag_ack));
716 if (rv < 0) {
717 client_data->flag_retry = true;
718 goto end_err_resp_buf_release;
719 }
720
721 fragment_offset += fragment_size;
722 }
723
724 dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
725 kfree(dma_buf);
726 return 0;
727
728 end_err_resp_buf_release:
729 /* Free ISH buffer if not done already, in error case */
730 dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
731 end_err_dma_buf_release:
732 kfree(dma_buf);
733 return rv;
734 }
735
736 /**
737 * ish_fw_start() - Start executing ISH main firmware
738 * @client_data: client data instance
739 *
740 * This function sends message to Shim firmware loader to start
741 * the execution of ISH main firmware.
742 *
743 * Return: 0 for success, negative error code for failure.
744 */
ish_fw_start(struct ishtp_cl_data * client_data)745 static int ish_fw_start(struct ishtp_cl_data *client_data)
746 {
747 struct loader_start ldr_start;
748 struct loader_msg_hdr ldr_start_ack;
749
750 memset(&ldr_start, 0, sizeof(ldr_start));
751 ldr_start.hdr.command = LOADER_CMD_START;
752 return loader_cl_send(client_data,
753 (u8 *)&ldr_start,
754 sizeof(ldr_start),
755 (u8 *)&ldr_start_ack,
756 sizeof(ldr_start_ack));
757 }
758
759 /**
760 * load_fw_from_host() - Loads ISH firmware from host
761 * @client_data: Client data instance
762 *
763 * This function loads the ISH firmware to ISH SRAM and starts execution
764 *
765 * Return: 0 for success, negative error code for failure.
766 */
load_fw_from_host(struct ishtp_cl_data * client_data)767 static int load_fw_from_host(struct ishtp_cl_data *client_data)
768 {
769 int rv;
770 u32 xfer_mode;
771 char *filename;
772 const struct firmware *fw;
773 struct shim_fw_info fw_info;
774 struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
775
776 client_data->flag_retry = false;
777
778 filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
779 if (!filename) {
780 client_data->flag_retry = true;
781 rv = -ENOMEM;
782 goto end_error;
783 }
784
785 /* Get filename of the ISH firmware to be loaded */
786 rv = get_firmware_variant(client_data, filename);
787 if (rv < 0)
788 goto end_err_filename_buf_release;
789
790 rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
791 if (rv < 0)
792 goto end_err_filename_buf_release;
793
794 /* Step 1: Query Shim firmware loader properties */
795
796 rv = ish_query_loader_prop(client_data, fw, &fw_info);
797 if (rv < 0)
798 goto end_err_fw_release;
799
800 /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
801
802 xfer_mode = fw_info.ldr_capability.xfer_mode;
803 if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
804 rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
805 } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
806 rv = ish_fw_xfer_ishtp(client_data, fw);
807 } else {
808 dev_err(cl_data_to_dev(client_data),
809 "No transfer mode selected in firmware\n");
810 rv = -EINVAL;
811 }
812 if (rv < 0)
813 goto end_err_fw_release;
814
815 /* Step 3: Start ISH main firmware exeuction */
816
817 rv = ish_fw_start(client_data);
818 if (rv < 0)
819 goto end_err_fw_release;
820
821 release_firmware(fw);
822 dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
823 filename);
824 kfree(filename);
825 return 0;
826
827 end_err_fw_release:
828 release_firmware(fw);
829 end_err_filename_buf_release:
830 kfree(filename);
831 end_error:
832 /* Keep a count of retries, and give up after 3 attempts */
833 if (client_data->flag_retry &&
834 client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
835 dev_warn(cl_data_to_dev(client_data),
836 "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
837 rv);
838 ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
839 } else {
840 dev_err(cl_data_to_dev(client_data),
841 "ISH host firmware load failed %d\n", rv);
842 }
843 return rv;
844 }
845
load_fw_from_host_handler(struct work_struct * work)846 static void load_fw_from_host_handler(struct work_struct *work)
847 {
848 struct ishtp_cl_data *client_data;
849
850 client_data = container_of(work, struct ishtp_cl_data,
851 work_fw_load);
852 load_fw_from_host(client_data);
853 }
854
855 /**
856 * loader_init() - Init function for ISH-TP client
857 * @loader_ishtp_cl: ISH-TP client instance
858 * @reset: true if called for init after reset
859 *
860 * Return: 0 for success, negative error code for failure
861 */
loader_init(struct ishtp_cl * loader_ishtp_cl,int reset)862 static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
863 {
864 int rv;
865 struct ishtp_fw_client *fw_client;
866 struct ishtp_cl_data *client_data =
867 ishtp_get_client_data(loader_ishtp_cl);
868
869 dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
870
871 rv = ishtp_cl_link(loader_ishtp_cl);
872 if (rv < 0) {
873 dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
874 return rv;
875 }
876
877 /* Connect to firmware client */
878 ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
879 ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
880
881 fw_client =
882 ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl),
883 &loader_ishtp_guid);
884 if (!fw_client) {
885 dev_err(cl_data_to_dev(client_data),
886 "ISH client uuid not found\n");
887 rv = -ENOENT;
888 goto err_cl_unlink;
889 }
890
891 ishtp_cl_set_fw_client_id(loader_ishtp_cl,
892 ishtp_get_fw_client_id(fw_client));
893 ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING);
894
895 rv = ishtp_cl_connect(loader_ishtp_cl);
896 if (rv < 0) {
897 dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
898 goto err_cl_unlink;
899 }
900
901 dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
902
903 ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
904
905 return 0;
906
907 err_cl_unlink:
908 ishtp_cl_unlink(loader_ishtp_cl);
909 return rv;
910 }
911
loader_deinit(struct ishtp_cl * loader_ishtp_cl)912 static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
913 {
914 ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING);
915 ishtp_cl_disconnect(loader_ishtp_cl);
916 ishtp_cl_unlink(loader_ishtp_cl);
917 ishtp_cl_flush_queues(loader_ishtp_cl);
918
919 /* Disband and free all Tx and Rx client-level rings */
920 ishtp_cl_free(loader_ishtp_cl);
921 }
922
reset_handler(struct work_struct * work)923 static void reset_handler(struct work_struct *work)
924 {
925 int rv;
926 struct ishtp_cl_data *client_data;
927 struct ishtp_cl *loader_ishtp_cl;
928 struct ishtp_cl_device *cl_device;
929
930 client_data = container_of(work, struct ishtp_cl_data,
931 work_ishtp_reset);
932
933 loader_ishtp_cl = client_data->loader_ishtp_cl;
934 cl_device = client_data->cl_device;
935
936 /* Unlink, flush queues & start again */
937 ishtp_cl_unlink(loader_ishtp_cl);
938 ishtp_cl_flush_queues(loader_ishtp_cl);
939 ishtp_cl_free(loader_ishtp_cl);
940
941 loader_ishtp_cl = ishtp_cl_allocate(cl_device);
942 if (!loader_ishtp_cl)
943 return;
944
945 ishtp_set_drvdata(cl_device, loader_ishtp_cl);
946 ishtp_set_client_data(loader_ishtp_cl, client_data);
947 client_data->loader_ishtp_cl = loader_ishtp_cl;
948 client_data->cl_device = cl_device;
949
950 rv = loader_init(loader_ishtp_cl, 1);
951 if (rv < 0) {
952 dev_err(ishtp_device(cl_device), "Reset Failed\n");
953 return;
954 }
955
956 /* ISH firmware loading from host */
957 load_fw_from_host(client_data);
958 }
959
960 /**
961 * loader_ishtp_cl_probe() - ISH-TP client driver probe
962 * @cl_device: ISH-TP client device instance
963 *
964 * This function gets called on device create on ISH-TP bus
965 *
966 * Return: 0 for success, negative error code for failure
967 */
loader_ishtp_cl_probe(struct ishtp_cl_device * cl_device)968 static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
969 {
970 struct ishtp_cl *loader_ishtp_cl;
971 struct ishtp_cl_data *client_data;
972 int rv;
973
974 client_data = devm_kzalloc(ishtp_device(cl_device),
975 sizeof(*client_data),
976 GFP_KERNEL);
977 if (!client_data)
978 return -ENOMEM;
979
980 loader_ishtp_cl = ishtp_cl_allocate(cl_device);
981 if (!loader_ishtp_cl)
982 return -ENOMEM;
983
984 ishtp_set_drvdata(cl_device, loader_ishtp_cl);
985 ishtp_set_client_data(loader_ishtp_cl, client_data);
986 client_data->loader_ishtp_cl = loader_ishtp_cl;
987 client_data->cl_device = cl_device;
988
989 init_waitqueue_head(&client_data->response.wait_queue);
990
991 INIT_WORK(&client_data->work_ishtp_reset,
992 reset_handler);
993 INIT_WORK(&client_data->work_fw_load,
994 load_fw_from_host_handler);
995
996 rv = loader_init(loader_ishtp_cl, 0);
997 if (rv < 0) {
998 ishtp_cl_free(loader_ishtp_cl);
999 return rv;
1000 }
1001 ishtp_get_device(cl_device);
1002
1003 client_data->retry_count = 0;
1004
1005 /* ISH firmware loading from host */
1006 schedule_work(&client_data->work_fw_load);
1007
1008 return 0;
1009 }
1010
1011 /**
1012 * loader_ishtp_cl_remove() - ISH-TP client driver remove
1013 * @cl_device: ISH-TP client device instance
1014 *
1015 * This function gets called on device remove on ISH-TP bus
1016 *
1017 * Return: 0
1018 */
loader_ishtp_cl_remove(struct ishtp_cl_device * cl_device)1019 static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
1020 {
1021 struct ishtp_cl_data *client_data;
1022 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1023
1024 client_data = ishtp_get_client_data(loader_ishtp_cl);
1025
1026 /*
1027 * The sequence of the following two cancel_work_sync() is
1028 * important. The work_fw_load can in turn schedue
1029 * work_ishtp_reset, so first cancel work_fw_load then
1030 * cancel work_ishtp_reset.
1031 */
1032 cancel_work_sync(&client_data->work_fw_load);
1033 cancel_work_sync(&client_data->work_ishtp_reset);
1034 loader_deinit(loader_ishtp_cl);
1035 ishtp_put_device(cl_device);
1036 }
1037
1038 /**
1039 * loader_ishtp_cl_reset() - ISH-TP client driver reset
1040 * @cl_device: ISH-TP client device instance
1041 *
1042 * This function gets called on device reset on ISH-TP bus
1043 *
1044 * Return: 0
1045 */
loader_ishtp_cl_reset(struct ishtp_cl_device * cl_device)1046 static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
1047 {
1048 struct ishtp_cl_data *client_data;
1049 struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1050
1051 client_data = ishtp_get_client_data(loader_ishtp_cl);
1052
1053 schedule_work(&client_data->work_ishtp_reset);
1054
1055 return 0;
1056 }
1057
1058 static struct ishtp_cl_driver loader_ishtp_cl_driver = {
1059 .name = "ish-loader",
1060 .guid = &loader_ishtp_guid,
1061 .probe = loader_ishtp_cl_probe,
1062 .remove = loader_ishtp_cl_remove,
1063 .reset = loader_ishtp_cl_reset,
1064 };
1065
ish_loader_init(void)1066 static int __init ish_loader_init(void)
1067 {
1068 return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
1069 }
1070
ish_loader_exit(void)1071 static void __exit ish_loader_exit(void)
1072 {
1073 ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
1074 }
1075
1076 late_initcall(ish_loader_init);
1077 module_exit(ish_loader_exit);
1078
1079 module_param(dma_buf_size_limit, int, 0644);
1080 MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
1081
1082 MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
1083 MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
1084
1085 MODULE_LICENSE("GPL v2");
1086 MODULE_ALIAS("ishtp:*");
1087
