ishtp-fw-loader.c

   1// SPDX-License-Identifier: GPL-2.0
   2/*
   3 * ISH-TP client driver for ISH firmware loading
   4 *
   5 * Copyright (c) 2019, Intel Corporation.
   6 */
   7
   8#include <linux/firmware.h>
   9#include <linux/module.h>
  10#include <linux/pci.h>
  11#include <linux/intel-ish-client-if.h>
  12#include <linux/property.h>
  13#include <asm/cacheflush.h>
  14
  15/* Number of times we attempt to load the firmware before giving up */
  16#define MAX_LOAD_ATTEMPTS			3
  17
  18/* ISH TX/RX ring buffer pool size */
  19#define LOADER_CL_RX_RING_SIZE			1
  20#define LOADER_CL_TX_RING_SIZE			1
  21
  22/*
  23 * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
  24 * used to temporarily hold the data transferred from host to Shim
  25 * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
  26 * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
  27 * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
  28 * have a max payload of 3968 bytes (= 32 x 124 payload).
  29 */
  30#define LOADER_SHIM_IPC_BUF_SIZE		3968
  31
  32/**
  33 * enum ish_loader_commands -	ISH loader host commands.
  34 * @LOADER_CMD_XFER_QUERY:	Query the Shim firmware loader for
  35 *				capabilities
  36 * @LOADER_CMD_XFER_FRAGMENT:	Transfer one firmware image fragment at a
  37 *				time. The command may be executed
  38 *				multiple times until the entire firmware
  39 *				image is downloaded to SRAM.
  40 * @LOADER_CMD_START:		Start executing the main firmware.
  41 */
  42enum ish_loader_commands {
  43	LOADER_CMD_XFER_QUERY = 0,
  44	LOADER_CMD_XFER_FRAGMENT,
  45	LOADER_CMD_START,
  46};
  47
  48/* Command bit mask */
  49#define	CMD_MASK				GENMASK(6, 0)
  50#define	IS_RESPONSE				BIT(7)
  51
  52/*
  53 * ISH firmware max delay for one transmit failure is 1 Hz,
  54 * and firmware will retry 2 times, so 3 Hz is used for timeout.
  55 */
  56#define ISHTP_SEND_TIMEOUT			(3 * HZ)
  57
  58/*
  59 * Loader transfer modes:
  60 *
  61 * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
  62 * transfer data. This may use IPC or DMA if supported in firmware.
  63 * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
  64 * both IPC & DMA (legacy).
  65 *
  66 * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
  67 * from the sensor data streaming. Here we download a large (300+ Kb)
  68 * image directly to ISH SRAM memory. There is limited benefit of
  69 * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
  70 * this "direct dma" mode, where we do not use ISH-TP for DMA, but
  71 * instead manage the DMA directly in kernel driver and Shim firmware
  72 * loader (allocate buffer, break in chucks and transfer). This allows
  73 * to overcome 4 Kb limit, and optimize the data flow path in firmware.
  74 */
  75#define LOADER_XFER_MODE_DIRECT_DMA		BIT(0)
  76#define LOADER_XFER_MODE_ISHTP			BIT(1)
  77
  78/* ISH Transport Loader client unique GUID */
  79static const struct ishtp_device_id loader_ishtp_id_table[] = {
  80	{ .guid = GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
  81		  0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc) },
  82	{ }
  83};
  84MODULE_DEVICE_TABLE(ishtp, loader_ishtp_id_table);
  85
  86#define FILENAME_SIZE				256
  87
  88/*
  89 * The firmware loading latency will be minimum if we can DMA the
  90 * entire ISH firmware image in one go. This requires that we allocate
  91 * a large DMA buffer in kernel, which could be problematic on some
  92 * platforms. So here we limit the DMA buffer size via a module_param.
  93 * We default to 4 pages, but a customer can set it to higher limit if
  94 * deemed appropriate for his platform.
  95 */
  96static int dma_buf_size_limit = 4 * PAGE_SIZE;
  97
  98/**
  99 * struct loader_msg_hdr - Header for ISH Loader commands.
 100 * @command:		LOADER_CMD* commands. Bit 7 is the response.
 101 * @reserved:		Reserved space
 102 * @status:		Command response status. Non 0, is error
 103 *			condition.
 104 *
 105 * This structure is used as header for every command/data sent/received
 106 * between Host driver and ISH Shim firmware loader.
 107 */
 108struct loader_msg_hdr {
 109	u8 command;
 110	u8 reserved[2];
 111	u8 status;
 112} __packed;
 113
 114struct loader_xfer_query {
 115	struct loader_msg_hdr hdr;
 116	u32 image_size;
 117} __packed;
 118
 119struct ish_fw_version {
 120	u16 major;
 121	u16 minor;
 122	u16 hotfix;
 123	u16 build;
 124} __packed;
 125
 126union loader_version {
 127	u32 value;
 128	struct {
 129		u8 major;
 130		u8 minor;
 131		u8 hotfix;
 132		u8 build;
 133	};
 134} __packed;
 135
 136struct loader_capability {
 137	u32 max_fw_image_size;
 138	u32 xfer_mode;
 139	u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
 140} __packed;
 141
 142struct shim_fw_info {
 143	struct ish_fw_version ish_fw_version;
 144	u32 protocol_version;
 145	union loader_version ldr_version;
 146	struct loader_capability ldr_capability;
 147} __packed;
 148
 149struct loader_xfer_query_response {
 150	struct loader_msg_hdr hdr;
 151	struct shim_fw_info fw_info;
 152} __packed;
 153
 154struct loader_xfer_fragment {
 155	struct loader_msg_hdr hdr;
 156	u32 xfer_mode;
 157	u32 offset;
 158	u32 size;
 159	u32 is_last;
 160} __packed;
 161
 162struct loader_xfer_ipc_fragment {
 163	struct loader_xfer_fragment fragment;
 164	u8 data[] ____cacheline_aligned; /* variable length payload here */
 165} __packed;
 166
 167struct loader_xfer_dma_fragment {
 168	struct loader_xfer_fragment fragment;
 169	u64 ddr_phys_addr;
 170} __packed;
 171
 172struct loader_start {
 173	struct loader_msg_hdr hdr;
 174} __packed;
 175
 176/**
 177 * struct response_info - Encapsulate firmware response related
 178 *			information for passing between function
 179 *			loader_cl_send() and process_recv() callback.
 180 * @data:		Copy the data received from firmware here.
 181 * @max_size:		Max size allocated for the @data buffer. If the
 182 *			received data exceeds this value, we log an
 183 *			error.
 184 * @size:		Actual size of data received from firmware.
 185 * @error:		Returns 0 for success, negative error code for a
 186 *			failure in function process_recv().
 187 * @received:		Set to true on receiving a valid firmware
 188 *			response to host command
 189 * @wait_queue:		Wait queue for Host firmware loading where the
 190 *			client sends message to ISH firmware and waits
 191 *			for response
 192 */
 193struct response_info {
 194	void *data;
 195	size_t max_size;
 196	size_t size;
 197	int error;
 198	bool received;
 199	wait_queue_head_t wait_queue;
 200};
 201
 202/*
 203 * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
 204 * @work_ishtp_reset:	Work queue for reset handling.
 205 * @work_fw_load:	Work queue for host firmware loading.
 206 * @flag_retry:		Flag for indicating host firmware loading should
 207 *			be retried.
 208 * @retry_count:	Count the number of retries.
 209 *
 210 * This structure is used to store data per client.
 211 */
 212struct ishtp_cl_data {
 213	struct ishtp_cl *loader_ishtp_cl;
 214	struct ishtp_cl_device *cl_device;
 215
 216	/*
 217	 * Used for passing firmware response information between
 218	 * loader_cl_send() and process_recv() callback.
 219	 */
 220	struct response_info response;
 221
 222	struct work_struct work_ishtp_reset;
 223	struct work_struct work_fw_load;
 224
 225	/*
 226	 * In certain failure scenrios, it makes sense to reset the ISH
 227	 * subsystem and retry Host firmware loading (e.g. bad message
 228	 * packet, ENOMEM, etc.). On the other hand, failures due to
 229	 * protocol mismatch, etc., are not recoverable. We do not
 230	 * retry them.
 231	 *
 232	 * If set, the flag indicates that we should re-try the
 233	 * particular failure.
 234	 */
 235	bool flag_retry;
 236	int retry_count;
 237};
 238
 239#define IPC_FRAGMENT_DATA_PREAMBLE				\
 240	offsetof(struct loader_xfer_ipc_fragment, data)
 241
 242#define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
 243
 244/**
 245 * get_firmware_variant() - Gets the filename of firmware image to be
 246 *			loaded based on platform variant.
 247 * @client_data:	Client data instance.
 248 * @filename:		Returns firmware filename.
 249 *
 250 * Queries the firmware-name device property string.
 251 *
 252 * Return: 0 for success, negative error code for failure.
 253 */
 254static int get_firmware_variant(struct ishtp_cl_data *client_data,
 255				char *filename)
 256{
 257	int rv;
 258	const char *val;
 259	struct device *devc = ishtp_get_pci_device(client_data->cl_device);
 260
 261	rv = device_property_read_string(devc, "firmware-name", &val);
 262	if (rv < 0) {
 263		dev_err(devc,
 264			"Error: ISH firmware-name device property required\n");
 265		return rv;
 266	}
 267	return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
 268}
 269
 270/**
 271 * loader_cl_send() - Send message from host to firmware
 272 *
 273 * @client_data:	Client data instance
 274 * @out_msg:		Message buffer to be sent to firmware
 275 * @out_size:		Size of out going message
 276 * @in_msg:		Message buffer where the incoming data copied.
 277 *			This buffer is allocated by calling
 278 * @in_size:		Max size of incoming message
 279 *
 280 * Return: Number of bytes copied in the in_msg on success, negative
 281 * error code on failure.
 282 */
 283static int loader_cl_send(struct ishtp_cl_data *client_data,
 284			  u8 *out_msg, size_t out_size,
 285			  u8 *in_msg, size_t in_size)
 286{
 287	int rv;
 288	struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
 289	struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
 290
 291	dev_dbg(cl_data_to_dev(client_data),
 292		"%s: command=%02lx is_response=%u status=%02x\n",
 293		__func__,
 294		out_hdr->command & CMD_MASK,
 295		out_hdr->command & IS_RESPONSE ? 1 : 0,
 296		out_hdr->status);
 297
 298	/* Setup in coming buffer & size */
 299	client_data->response.data = in_msg;
 300	client_data->response.max_size = in_size;
 301	client_data->response.error = 0;
 302	client_data->response.received = false;
 303
 304	rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
 305	if (rv < 0) {
 306		dev_err(cl_data_to_dev(client_data),
 307			"ishtp_cl_send error %d\n", rv);
 308		return rv;
 309	}
 310
 311	wait_event_interruptible_timeout(client_data->response.wait_queue,
 312					 client_data->response.received,
 313					 ISHTP_SEND_TIMEOUT);
 314	if (!client_data->response.received) {
 315		dev_err(cl_data_to_dev(client_data),
 316			"Timed out for response to command=%02lx",
 317			out_hdr->command & CMD_MASK);
 318		return -ETIMEDOUT;
 319	}
 320
 321	if (client_data->response.error < 0)
 322		return client_data->response.error;
 323
 324	return client_data->response.size;
 325}
 326
 327/**
 328 * process_recv() -	Receive and parse incoming packet
 329 * @loader_ishtp_cl:	Client instance to get stats
 330 * @rb_in_proc:		ISH received message buffer
 331 *
 332 * Parse the incoming packet. If it is a response packet then it will
 333 * update received and wake up the caller waiting to for the response.
 334 */
 335static void process_recv(struct ishtp_cl *loader_ishtp_cl,
 336			 struct ishtp_cl_rb *rb_in_proc)
 337{
 338	struct loader_msg_hdr *hdr;
 339	size_t data_len = rb_in_proc->buf_idx;
 340	struct ishtp_cl_data *client_data =
 341		ishtp_get_client_data(loader_ishtp_cl);
 342
 343	/* Sanity check */
 344	if (!client_data->response.data) {
 345		dev_err(cl_data_to_dev(client_data),
 346			"Receiving buffer is null. Should be allocated by calling function\n");
 347		client_data->response.error = -EINVAL;
 348		goto end;
 349	}
 350
 351	if (client_data->response.received) {
 352		dev_err(cl_data_to_dev(client_data),
 353			"Previous firmware message not yet processed\n");
 354		client_data->response.error = -EINVAL;
 355		goto end;
 356	}
 357	/*
 358	 * All firmware messages have a header. Check buffer size
 359	 * before accessing elements inside.
 360	 */
 361	if (!rb_in_proc->buffer.data) {
 362		dev_warn(cl_data_to_dev(client_data),
 363			 "rb_in_proc->buffer.data returned null");
 364		client_data->response.error = -EBADMSG;
 365		goto end;
 366	}
 367
 368	if (data_len < sizeof(struct loader_msg_hdr)) {
 369		dev_err(cl_data_to_dev(client_data),
 370			"data size %zu is less than header %zu\n",
 371			data_len, sizeof(struct loader_msg_hdr));
 372		client_data->response.error = -EMSGSIZE;
 373		goto end;
 374	}
 375
 376	hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
 377
 378	dev_dbg(cl_data_to_dev(client_data),
 379		"%s: command=%02lx is_response=%u status=%02x\n",
 380		__func__,
 381		hdr->command & CMD_MASK,
 382		hdr->command & IS_RESPONSE ? 1 : 0,
 383		hdr->status);
 384
 385	if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
 386	    ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
 387	    ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
 388		dev_err(cl_data_to_dev(client_data),
 389			"Invalid command=%02lx\n",
 390			hdr->command & CMD_MASK);
 391		client_data->response.error = -EPROTO;
 392		goto end;
 393	}
 394
 395	if (data_len > client_data->response.max_size) {
 396		dev_err(cl_data_to_dev(client_data),
 397			"Received buffer size %zu is larger than allocated buffer %zu\n",
 398			data_len, client_data->response.max_size);
 399		client_data->response.error = -EMSGSIZE;
 400		goto end;
 401	}
 402
 403	/* We expect only "response" messages from firmware */
 404	if (!(hdr->command & IS_RESPONSE)) {
 405		dev_err(cl_data_to_dev(client_data),
 406			"Invalid response to command\n");
 407		client_data->response.error = -EIO;
 408		goto end;
 409	}
 410
 411	if (hdr->status) {
 412		dev_err(cl_data_to_dev(client_data),
 413			"Loader returned status %d\n",
 414			hdr->status);
 415		client_data->response.error = -EIO;
 416		goto end;
 417	}
 418
 419	/* Update the actual received buffer size */
 420	client_data->response.size = data_len;
 421
 422	/*
 423	 * Copy the buffer received in firmware response for the
 424	 * calling thread.
 425	 */
 426	memcpy(client_data->response.data,
 427	       rb_in_proc->buffer.data, data_len);
 428
 429	/* Set flag before waking up the caller */
 430	client_data->response.received = true;
 431
 432end:
 433	/* Free the buffer */
 434	ishtp_cl_io_rb_recycle(rb_in_proc);
 435	rb_in_proc = NULL;
 436
 437	/* Wake the calling thread */
 438	wake_up_interruptible(&client_data->response.wait_queue);
 439}
 440
 441/**
 442 * loader_cl_event_cb() - bus driver callback for incoming message
 443 * @cl_device:		Pointer to the ishtp client device for which this
 444 *			message is targeted
 445 *
 446 * Remove the packet from the list and process the message by calling
 447 * process_recv
 448 */
 449static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
 450{
 451	struct ishtp_cl_rb *rb_in_proc;
 452	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
 453
 454	while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
 455		/* Process the data packet from firmware */
 456		process_recv(loader_ishtp_cl, rb_in_proc);
 457	}
 458}
 459
 460/**
 461 * ish_query_loader_prop() -  Query ISH Shim firmware loader
 462 * @client_data:	Client data instance
 463 * @fw:			Pointer to firmware data struct in host memory
 464 * @fw_info:		Loader firmware properties
 465 *
 466 * This function queries the ISH Shim firmware loader for capabilities.
 467 *
 468 * Return: 0 for success, negative error code for failure.
 469 */
 470static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
 471				 const struct firmware *fw,
 472				 struct shim_fw_info *fw_info)
 473{
 474	int rv;
 475	struct loader_xfer_query ldr_xfer_query;
 476	struct loader_xfer_query_response ldr_xfer_query_resp;
 477
 478	memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
 479	ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
 480	ldr_xfer_query.image_size = fw->size;
 481	rv = loader_cl_send(client_data,
 482			    (u8 *)&ldr_xfer_query,
 483			    sizeof(ldr_xfer_query),
 484			    (u8 *)&ldr_xfer_query_resp,
 485			    sizeof(ldr_xfer_query_resp));
 486	if (rv < 0) {
 487		client_data->flag_retry = true;
 488		*fw_info = (struct shim_fw_info){};
 489		return rv;
 490	}
 491
 492	/* On success, the return value is the received buffer size */
 493	if (rv != sizeof(struct loader_xfer_query_response)) {
 494		dev_err(cl_data_to_dev(client_data),
 495			"data size %d is not equal to size of loader_xfer_query_response %zu\n",
 496			rv, sizeof(struct loader_xfer_query_response));
 497		client_data->flag_retry = true;
 498		*fw_info = (struct shim_fw_info){};
 499		return -EMSGSIZE;
 500	}
 501
 502	/* Save fw_info for use outside this function */
 503	*fw_info = ldr_xfer_query_resp.fw_info;
 504
 505	/* Loader firmware properties */
 506	dev_dbg(cl_data_to_dev(client_data),
 507		"ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
 508		fw_info->ish_fw_version.major,
 509		fw_info->ish_fw_version.minor,
 510		fw_info->ish_fw_version.hotfix,
 511		fw_info->ish_fw_version.build,
 512		fw_info->protocol_version,
 513		fw_info->ldr_version.value);
 514
 515	dev_dbg(cl_data_to_dev(client_data),
 516		"loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
 517		fw_info->ldr_capability.max_fw_image_size,
 518		fw_info->ldr_capability.xfer_mode,
 519		fw_info->ldr_capability.max_dma_buf_size,
 520		dma_buf_size_limit);
 521
 522	/* Sanity checks */
 523	if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
 524		dev_err(cl_data_to_dev(client_data),
 525			"ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
 526			fw->size,
 527			fw_info->ldr_capability.max_fw_image_size);
 528		return -ENOSPC;
 529	}
 530
 531	/* For DMA the buffer size should be multiple of cacheline size */
 532	if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
 533	    (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
 534		dev_err(cl_data_to_dev(client_data),
 535			"Shim firmware loader buffer size %d should be multiple of cacheline\n",
 536			fw_info->ldr_capability.max_dma_buf_size);
 537		return -EINVAL;
 538	}
 539
 540	return 0;
 541}
 542
 543/**
 544 * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface
 545 * @client_data:	Client data instance
 546 * @fw:			Pointer to firmware data struct in host memory
 547 *
 548 * This function uses ISH-TP to transfer ISH firmware from host to
 549 * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
 550 * support.
 551 *
 552 * Return: 0 for success, negative error code for failure.
 553 */
 554static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
 555			     const struct firmware *fw)
 556{
 557	int rv;
 558	u32 fragment_offset, fragment_size, payload_max_size;
 559	struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
 560	struct loader_msg_hdr ldr_xfer_ipc_ack;
 561
 562	payload_max_size =
 563		LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
 564
 565	ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
 566	if (!ldr_xfer_ipc_frag) {
 567		client_data->flag_retry = true;
 568		return -ENOMEM;
 569	}
 570
 571	ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
 572	ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
 573
 574	/* Break the firmware image into fragments and send as ISH-TP payload */
 575	fragment_offset = 0;
 576	while (fragment_offset < fw->size) {
 577		if (fragment_offset + payload_max_size < fw->size) {
 578			fragment_size = payload_max_size;
 579			ldr_xfer_ipc_frag->fragment.is_last = 0;
 580		} else {
 581			fragment_size = fw->size - fragment_offset;
 582			ldr_xfer_ipc_frag->fragment.is_last = 1;
 583		}
 584
 585		ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
 586		ldr_xfer_ipc_frag->fragment.size = fragment_size;
 587		memcpy(ldr_xfer_ipc_frag->data,
 588		       &fw->data[fragment_offset],
 589		       fragment_size);
 590
 591		dev_dbg(cl_data_to_dev(client_data),
 592			"xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
 593			ldr_xfer_ipc_frag->fragment.offset,
 594			ldr_xfer_ipc_frag->fragment.size,
 595			ldr_xfer_ipc_frag->fragment.is_last);
 596
 597		rv = loader_cl_send(client_data,
 598				    (u8 *)ldr_xfer_ipc_frag,
 599				    IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
 600				    (u8 *)&ldr_xfer_ipc_ack,
 601				    sizeof(ldr_xfer_ipc_ack));
 602		if (rv < 0) {
 603			client_data->flag_retry = true;
 604			goto end_err_resp_buf_release;
 605		}
 606
 607		fragment_offset += fragment_size;
 608	}
 609
 610	kfree(ldr_xfer_ipc_frag);
 611	return 0;
 612
 613end_err_resp_buf_release:
 614	/* Free ISH buffer if not done already, in error case */
 615	kfree(ldr_xfer_ipc_frag);
 616	return rv;
 617}
 618
 619/**
 620 * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
 621 * @client_data:	Client data instance
 622 * @fw:			Pointer to firmware data struct in host memory
 623 * @fw_info:		Loader firmware properties
 624 *
 625 * Host firmware load is a unique case where we need to download
 626 * a large firmware image (200+ Kb). This function implements
 627 * direct DMA transfer in kernel and ISH firmware. This allows
 628 * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
 629 * directly to ISH UMA at location of choice.
 630 * Function depends on corresponding support in ISH firmware.
 631 *
 632 * Return: 0 for success, negative error code for failure.
 633 */
 634static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
 635				  const struct firmware *fw,
 636				  const struct shim_fw_info fw_info)
 637{
 638	int rv = 0;
 639	void *dma_buf;
 640	dma_addr_t dma_buf_phy;
 641	u32 fragment_offset, fragment_size, payload_max_size;
 642	struct loader_msg_hdr ldr_xfer_dma_frag_ack;
 643	struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
 644	struct device *devc = ishtp_get_pci_device(client_data->cl_device);
 645	u32 shim_fw_buf_size =
 646		fw_info.ldr_capability.max_dma_buf_size;
 647
 648	/*
 649	 * payload_max_size should be set to minimum of
 650	 *  (1) Size of firmware to be loaded,
 651	 *  (2) Max DMA buffer size supported by Shim firmware,
 652	 *  (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
 653	 */
 654	payload_max_size = min3(fw->size,
 655				(size_t)shim_fw_buf_size,
 656				(size_t)dma_buf_size_limit);
 657
 658	/*
 659	 * Buffer size should be multiple of cacheline size
 660	 * if it's not, select the previous cacheline boundary.
 661	 */
 662	payload_max_size &= ~(L1_CACHE_BYTES - 1);
 663
 664	dma_buf = dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_KERNEL);
 665	if (!dma_buf) {
 666		client_data->flag_retry = true;
 667		return -ENOMEM;
 668	}
 669
 670	ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
 671	ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
 672	ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
 673
 674	/* Send the firmware image in chucks of payload_max_size */
 675	fragment_offset = 0;
 676	while (fragment_offset < fw->size) {
 677		if (fragment_offset + payload_max_size < fw->size) {
 678			fragment_size = payload_max_size;
 679			ldr_xfer_dma_frag.fragment.is_last = 0;
 680		} else {
 681			fragment_size = fw->size - fragment_offset;
 682			ldr_xfer_dma_frag.fragment.is_last = 1;
 683		}
 684
 685		ldr_xfer_dma_frag.fragment.offset = fragment_offset;
 686		ldr_xfer_dma_frag.fragment.size = fragment_size;
 687		memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
 688
 689		/* Flush cache to be sure the data is in main memory. */
 690		clflush_cache_range(dma_buf, payload_max_size);
 691
 692		dev_dbg(cl_data_to_dev(client_data),
 693			"xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
 694			ldr_xfer_dma_frag.fragment.offset,
 695			ldr_xfer_dma_frag.fragment.size,
 696			ldr_xfer_dma_frag.fragment.is_last,
 697			ldr_xfer_dma_frag.ddr_phys_addr);
 698
 699		rv = loader_cl_send(client_data,
 700				    (u8 *)&ldr_xfer_dma_frag,
 701				    sizeof(ldr_xfer_dma_frag),
 702				    (u8 *)&ldr_xfer_dma_frag_ack,
 703				    sizeof(ldr_xfer_dma_frag_ack));
 704		if (rv < 0) {
 705			client_data->flag_retry = true;
 706			goto end_err_resp_buf_release;
 707		}
 708
 709		fragment_offset += fragment_size;
 710	}
 711
 712end_err_resp_buf_release:
 713	dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy);
 714	return rv;
 715}
 716
 717/**
 718 * ish_fw_start() -	Start executing ISH main firmware
 719 * @client_data:	client data instance
 720 *
 721 * This function sends message to Shim firmware loader to start
 722 * the execution of ISH main firmware.
 723 *
 724 * Return: 0 for success, negative error code for failure.
 725 */
 726static int ish_fw_start(struct ishtp_cl_data *client_data)
 727{
 728	struct loader_start ldr_start;
 729	struct loader_msg_hdr ldr_start_ack;
 730
 731	memset(&ldr_start, 0, sizeof(ldr_start));
 732	ldr_start.hdr.command = LOADER_CMD_START;
 733	return loader_cl_send(client_data,
 734			    (u8 *)&ldr_start,
 735			    sizeof(ldr_start),
 736			    (u8 *)&ldr_start_ack,
 737			    sizeof(ldr_start_ack));
 738}
 739
 740/**
 741 * load_fw_from_host() - Loads ISH firmware from host
 742 * @client_data:	Client data instance
 743 *
 744 * This function loads the ISH firmware to ISH SRAM and starts execution
 745 *
 746 * Return: 0 for success, negative error code for failure.
 747 */
 748static int load_fw_from_host(struct ishtp_cl_data *client_data)
 749{
 750	int rv;
 751	u32 xfer_mode;
 752	char *filename;
 753	const struct firmware *fw;
 754	struct shim_fw_info fw_info;
 755	struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
 756
 757	client_data->flag_retry = false;
 758
 759	filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
 760	if (!filename) {
 761		client_data->flag_retry = true;
 762		rv = -ENOMEM;
 763		goto end_error;
 764	}
 765
 766	/* Get filename of the ISH firmware to be loaded */
 767	rv = get_firmware_variant(client_data, filename);
 768	if (rv < 0)
 769		goto end_err_filename_buf_release;
 770
 771	rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
 772	if (rv < 0)
 773		goto end_err_filename_buf_release;
 774
 775	/* Step 1: Query Shim firmware loader properties */
 776
 777	rv = ish_query_loader_prop(client_data, fw, &fw_info);
 778	if (rv < 0)
 779		goto end_err_fw_release;
 780
 781	/* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
 782
 783	xfer_mode = fw_info.ldr_capability.xfer_mode;
 784	if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
 785		rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
 786	} else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
 787		rv = ish_fw_xfer_ishtp(client_data, fw);
 788	} else {
 789		dev_err(cl_data_to_dev(client_data),
 790			"No transfer mode selected in firmware\n");
 791		rv = -EINVAL;
 792	}
 793	if (rv < 0)
 794		goto end_err_fw_release;
 795
 796	/* Step 3: Start ISH main firmware execution */
 797
 798	rv = ish_fw_start(client_data);
 799	if (rv < 0)
 800		goto end_err_fw_release;
 801
 802	release_firmware(fw);
 803	dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
 804		 filename);
 805	kfree(filename);
 806	return 0;
 807
 808end_err_fw_release:
 809	release_firmware(fw);
 810end_err_filename_buf_release:
 811	kfree(filename);
 812end_error:
 813	/* Keep a count of retries, and give up after 3 attempts */
 814	if (client_data->flag_retry &&
 815	    client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
 816		dev_warn(cl_data_to_dev(client_data),
 817			 "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
 818			 rv);
 819		ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
 820	} else {
 821		dev_err(cl_data_to_dev(client_data),
 822			"ISH host firmware load failed %d\n", rv);
 823	}
 824	return rv;
 825}
 826
 827static void load_fw_from_host_handler(struct work_struct *work)
 828{
 829	struct ishtp_cl_data *client_data;
 830
 831	client_data = container_of(work, struct ishtp_cl_data,
 832				   work_fw_load);
 833	load_fw_from_host(client_data);
 834}
 835
 836/**
 837 * loader_init() -	Init function for ISH-TP client
 838 * @loader_ishtp_cl:	ISH-TP client instance
 839 * @reset:		true if called for init after reset
 840 *
 841 * Return: 0 for success, negative error code for failure
 842 */
 843static int loader_init(struct ishtp_cl *loader_ishtp_cl, bool reset)
 844{
 845	int rv;
 846	struct ishtp_cl_data *client_data =
 847		ishtp_get_client_data(loader_ishtp_cl);
 848
 849	dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
 850
 851	rv = ishtp_cl_establish_connection(loader_ishtp_cl,
 852					   &loader_ishtp_id_table[0].guid,
 853					   LOADER_CL_TX_RING_SIZE,
 854					   LOADER_CL_RX_RING_SIZE,
 855					   reset);
 856	if (rv < 0) {
 857		dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
 858		goto err_cl_disconnect;
 859	}
 860
 861	dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
 862
 863	ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
 864
 865	return 0;
 866
 867err_cl_disconnect:
 868	ishtp_cl_destroy_connection(loader_ishtp_cl, reset);
 869	return rv;
 870}
 871
 872static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
 873{
 874	ishtp_cl_destroy_connection(loader_ishtp_cl, false);
 875
 876	/* Disband and free all Tx and Rx client-level rings */
 877	ishtp_cl_free(loader_ishtp_cl);
 878}
 879
 880static void reset_handler(struct work_struct *work)
 881{
 882	int rv;
 883	struct ishtp_cl_data *client_data;
 884	struct ishtp_cl *loader_ishtp_cl;
 885	struct ishtp_cl_device *cl_device;
 886
 887	client_data = container_of(work, struct ishtp_cl_data,
 888				   work_ishtp_reset);
 889
 890	loader_ishtp_cl = client_data->loader_ishtp_cl;
 891	cl_device = client_data->cl_device;
 892
 893	ishtp_cl_destroy_connection(loader_ishtp_cl, true);
 894
 895	rv = loader_init(loader_ishtp_cl, 1);
 896	if (rv < 0) {
 897		dev_err(ishtp_device(cl_device), "Reset Failed\n");
 898		return;
 899	}
 900
 901	/* ISH firmware loading from host */
 902	load_fw_from_host(client_data);
 903}
 904
 905/**
 906 * loader_ishtp_cl_probe() - ISH-TP client driver probe
 907 * @cl_device:		ISH-TP client device instance
 908 *
 909 * This function gets called on device create on ISH-TP bus
 910 *
 911 * Return: 0 for success, negative error code for failure
 912 */
 913static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
 914{
 915	struct ishtp_cl *loader_ishtp_cl;
 916	struct ishtp_cl_data *client_data;
 917	int rv;
 918
 919	client_data = devm_kzalloc(ishtp_device(cl_device),
 920				   sizeof(*client_data),
 921				   GFP_KERNEL);
 922	if (!client_data)
 923		return -ENOMEM;
 924
 925	loader_ishtp_cl = ishtp_cl_allocate(cl_device);
 926	if (!loader_ishtp_cl)
 927		return -ENOMEM;
 928
 929	ishtp_set_drvdata(cl_device, loader_ishtp_cl);
 930	ishtp_set_client_data(loader_ishtp_cl, client_data);
 931	client_data->loader_ishtp_cl = loader_ishtp_cl;
 932	client_data->cl_device = cl_device;
 933
 934	init_waitqueue_head(&client_data->response.wait_queue);
 935
 936	INIT_WORK(&client_data->work_ishtp_reset,
 937		  reset_handler);
 938	INIT_WORK(&client_data->work_fw_load,
 939		  load_fw_from_host_handler);
 940
 941	rv = loader_init(loader_ishtp_cl, false);
 942	if (rv < 0) {
 943		ishtp_cl_free(loader_ishtp_cl);
 944		return rv;
 945	}
 946	ishtp_get_device(cl_device);
 947
 948	client_data->retry_count = 0;
 949
 950	/* ISH firmware loading from host */
 951	schedule_work(&client_data->work_fw_load);
 952
 953	return 0;
 954}
 955
 956/**
 957 * loader_ishtp_cl_remove() - ISH-TP client driver remove
 958 * @cl_device:		ISH-TP client device instance
 959 *
 960 * This function gets called on device remove on ISH-TP bus
 961 *
 962 * Return: 0
 963 */
 964static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
 965{
 966	struct ishtp_cl_data *client_data;
 967	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
 968
 969	client_data = ishtp_get_client_data(loader_ishtp_cl);
 970
 971	/*
 972	 * The sequence of the following two cancel_work_sync() is
 973	 * important. The work_fw_load can in turn schedue
 974	 * work_ishtp_reset, so first cancel work_fw_load then
 975	 * cancel work_ishtp_reset.
 976	 */
 977	cancel_work_sync(&client_data->work_fw_load);
 978	cancel_work_sync(&client_data->work_ishtp_reset);
 979	loader_deinit(loader_ishtp_cl);
 980	ishtp_put_device(cl_device);
 981}
 982
 983/**
 984 * loader_ishtp_cl_reset() - ISH-TP client driver reset
 985 * @cl_device:		ISH-TP client device instance
 986 *
 987 * This function gets called on device reset on ISH-TP bus
 988 *
 989 * Return: 0
 990 */
 991static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
 992{
 993	struct ishtp_cl_data *client_data;
 994	struct ishtp_cl	*loader_ishtp_cl = ishtp_get_drvdata(cl_device);
 995
 996	client_data = ishtp_get_client_data(loader_ishtp_cl);
 997
 998	schedule_work(&client_data->work_ishtp_reset);
 999
1000	return 0;
1001}
1002
1003static struct ishtp_cl_driver	loader_ishtp_cl_driver = {
1004	.name = "ish-loader",
1005	.id = loader_ishtp_id_table,
1006	.probe = loader_ishtp_cl_probe,
1007	.remove = loader_ishtp_cl_remove,
1008	.reset = loader_ishtp_cl_reset,
1009};
1010
1011static int __init ish_loader_init(void)
1012{
1013	return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
1014}
1015
1016static void __exit ish_loader_exit(void)
1017{
1018	ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
1019}
1020
1021late_initcall(ish_loader_init);
1022module_exit(ish_loader_exit);
1023
1024module_param(dma_buf_size_limit, int, 0644);
1025MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
1026
1027MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
1028MODULE_AUTHOR("Rushikesh S Kadam <rushikesh.s.kadam@intel.com>");
1029
1030MODULE_LICENSE("GPL v2");