2 * Intel Wireless WiMAX Connection 2400m
6 * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * * Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
18 * * Neither the name of Intel Corporation nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 * Intel Corporation <linux-wimax@intel.com>
36 * Yanir Lubetkin <yanirx.lubetkin@intel.com>
37 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
38 * - Initial implementation
43 * The 2400m and derived devices work in two modes: boot-mode or
44 * normal mode. In boot mode we can execute only a handful of commands
45 * targeted at uploading the firmware and launching it.
47 * The 2400m enters boot mode when it is first connected to the
48 * system, when it crashes and when you ask it to reboot. There are
49 * two submodes of the boot mode: signed and non-signed. Signed takes
50 * firmwares signed with a certain private key, non-signed takes any
51 * firmware. Normal hardware takes only signed firmware.
53 * On boot mode, in USB, we write to the device using the bulk out
54 * endpoint and read from it in the notification endpoint. In SDIO we
55 * talk to it via the write address and read from the read address.
57 * Upon entrance to boot mode, the device sends (preceeded with a few
58 * zero length packets (ZLPs) on the notification endpoint in USB) a
59 * reboot barker (4 le32 words with the same value). We ack it by
60 * sending the same barker to the device. The device acks with a
61 * reboot ack barker (4 le32 words with value I2400M_ACK_BARKER) and
62 * then is fully booted. At this point we can upload the firmware.
64 * Note that different iterations of the device and EEPROM
65 * configurations will send different [re]boot barkers; these are
66 * collected in i2400m_barker_db along with the firmware
67 * characteristics they require.
69 * This process is accomplished by the i2400m_bootrom_init()
70 * function. All the device interaction happens through the
71 * i2400m_bm_cmd() [boot mode command]. Special return values will
72 * indicate if the device did reset during the process.
74 * After this, we read the MAC address and then (if needed)
75 * reinitialize the device. We need to read it ahead of time because
76 * in the future, we might not upload the firmware until userspace
77 * 'ifconfig up's the device.
79 * We can then upload the firmware file. The file is composed of a BCF
80 * header (basic data, keys and signatures) and a list of write
81 * commands and payloads. We first upload the header
82 * [i2400m_dnload_init()] and then pass the commands and payloads
83 * verbatim to the i2400m_bm_cmd() function
84 * [i2400m_dnload_bcf()]. Then we tell the device to jump to the new
85 * firmware [i2400m_dnload_finalize()].
87 * Once firmware is uploaded, we are good to go :)
89 * When we don't know in which mode we are, we first try by sending a
90 * warm reset request that will take us to boot-mode. If we time out
91 * waiting for a reboot barker, that means maybe we are already in
92 * boot mode, so we send a reboot barker.
96 * This code (and process) is single threaded; for executing commands,
97 * we post a URB to the notification endpoint, post the command, wait
98 * for data on the notification buffer. We don't need to worry about
99 * others as we know we are the only ones in there.
101 * BACKEND IMPLEMENTATION
103 * This code is bus-generic; the bus-specific driver provides back end
104 * implementations to send a boot mode command to the device and to
105 * read an acknolwedgement from it (or an asynchronous notification)
110 * i2400m_barker_db_init Called by i2400m_driver_init()
111 * i2400m_barker_db_add
113 * i2400m_barker_db_exit Called by i2400m_driver_exit()
115 * i2400m_dev_bootstrap Called by __i2400m_dev_start()
122 * i2400m_bootrom_init
126 * i2400m_dnload_init_signed
127 * i2400m_dnload_init_nonsigned
128 * i2400m_download_chunk
132 * i2400m_dnload_finalize
136 * i2400m->bus_bm_cmd_send()
137 * i2400m->bus_bm_wait_for_ack
138 * __i2400m_bm_ack_verify
139 * i2400m_is_boot_barker
141 * i2400m_bm_cmd_prepare Used by bus-drivers to prep
142 * commands before sending
144 #include <linux/firmware.h>
145 #include <linux/sched.h>
146 #include <linux/usb.h>
150 #define D_SUBMODULE fw
151 #include "debug-levels.h"
154 static const __le32 i2400m_ACK_BARKER
[4] = {
155 cpu_to_le32(I2400M_ACK_BARKER
),
156 cpu_to_le32(I2400M_ACK_BARKER
),
157 cpu_to_le32(I2400M_ACK_BARKER
),
158 cpu_to_le32(I2400M_ACK_BARKER
)
163 * Prepare a boot-mode command for delivery
165 * @cmd: pointer to bootrom header to prepare
167 * Computes checksum if so needed. After calling this function, DO NOT
168 * modify the command or header as the checksum won't work anymore.
170 * We do it from here because some times we cannot do it in the
171 * original context the command was sent (it is a const), so when we
172 * copy it to our staging buffer, we add the checksum there.
174 void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header
*cmd
)
176 if (i2400m_brh_get_use_checksum(cmd
)) {
179 const u32
*checksum_ptr
= (void *) cmd
->payload
;
180 for (i
= 0; i
< cmd
->data_size
/ 4; i
++)
181 checksum
+= cpu_to_le32(*checksum_ptr
++);
182 checksum
+= cmd
->command
+ cmd
->target_addr
+ cmd
->data_size
;
183 cmd
->block_checksum
= cpu_to_le32(checksum
);
186 EXPORT_SYMBOL_GPL(i2400m_bm_cmd_prepare
);
190 * Database of known barkers.
192 * A barker is what the device sends indicating he is ready to be
193 * bootloaded. Different versions of the device will send different
194 * barkers. Depending on the barker, it might mean the device wants
195 * some kind of firmware or the other.
197 static struct i2400m_barker_db
{
200 static size_t i2400m_barker_db_used
, i2400m_barker_db_size
;
204 int i2400m_zrealloc_2x(void **ptr
, size_t *_count
, size_t el_size
,
207 size_t old_count
= *_count
,
208 new_count
= old_count
? 2 * old_count
: 2,
209 old_size
= el_size
* old_count
,
210 new_size
= el_size
* new_count
;
211 void *nptr
= krealloc(*ptr
, new_size
, gfp_flags
);
213 /* zero the other half or the whole thing if old_count
216 memset(nptr
, 0, new_size
);
218 memset(nptr
+ old_size
, 0, old_size
);
228 * Add a barker to the database
230 * This cannot used outside of this module and only at at module_init
231 * time. This is to avoid the need to do locking.
234 int i2400m_barker_db_add(u32 barker_id
)
238 struct i2400m_barker_db
*barker
;
239 if (i2400m_barker_db_used
>= i2400m_barker_db_size
) {
240 result
= i2400m_zrealloc_2x(
241 (void **) &i2400m_barker_db
, &i2400m_barker_db_size
,
242 sizeof(i2400m_barker_db
[0]), GFP_KERNEL
);
246 barker
= i2400m_barker_db
+ i2400m_barker_db_used
++;
247 barker
->data
[0] = le32_to_cpu(barker_id
);
248 barker
->data
[1] = le32_to_cpu(barker_id
);
249 barker
->data
[2] = le32_to_cpu(barker_id
);
250 barker
->data
[3] = le32_to_cpu(barker_id
);
255 void i2400m_barker_db_exit(void)
257 kfree(i2400m_barker_db
);
258 i2400m_barker_db
= NULL
;
259 i2400m_barker_db_size
= 0;
260 i2400m_barker_db_used
= 0;
265 * Helper function to add all the known stable barkers to the barker
269 int i2400m_barker_db_known_barkers(void)
273 result
= i2400m_barker_db_add(I2400M_NBOOT_BARKER
);
276 result
= i2400m_barker_db_add(I2400M_SBOOT_BARKER
);
285 * Initialize the barker database
287 * This can only be used from the module_init function for this
288 * module; this is to avoid the need to do locking.
290 * @options: command line argument with extra barkers to
291 * recognize. This is a comma-separated list of 32-bit hex
292 * numbers. They are appended to the existing list. Setting 0
293 * cleans the existing list and starts a new one.
295 int i2400m_barker_db_init(const char *_options
)
298 char *options
= NULL
, *options_orig
, *token
;
300 i2400m_barker_db
= NULL
;
301 i2400m_barker_db_size
= 0;
302 i2400m_barker_db_used
= 0;
304 result
= i2400m_barker_db_known_barkers();
307 /* parse command line options from i2400m.barkers */
308 if (_options
!= NULL
) {
311 options_orig
= kstrdup(_options
, GFP_KERNEL
);
312 if (options_orig
== NULL
)
314 options
= options_orig
;
316 while ((token
= strsep(&options
, ",")) != NULL
) {
317 if (*token
== '\0') /* eat joint commas */
319 if (sscanf(token
, "%x", &barker
) != 1
320 || barker
> 0xffffffff) {
321 printk(KERN_ERR
"%s: can't recognize "
322 "i2400m.barkers value '%s' as "
329 /* clean list and start new */
330 i2400m_barker_db_exit();
333 result
= i2400m_barker_db_add(barker
);
343 kfree(i2400m_barker_db
);
349 * Recognize a boot barker
351 * @buf: buffer where the boot barker.
352 * @buf_size: size of the buffer (has to be 16 bytes). It is passed
353 * here so the function can check it for the caller.
355 * Note that as a side effect, upon identifying the obtained boot
356 * barker, this function will set i2400m->barker to point to the right
357 * barker database entry. Subsequent calls to the function will result
358 * in verifying that the same type of boot barker is returned when the
359 * device [re]boots (as long as the same device instance is used).
361 * Return: 0 if @buf matches a known boot barker. -ENOENT if the
362 * buffer in @buf doesn't match any boot barker in the database or
363 * -EILSEQ if the buffer doesn't have the right size.
365 int i2400m_is_boot_barker(struct i2400m
*i2400m
,
366 const void *buf
, size_t buf_size
)
369 struct device
*dev
= i2400m_dev(i2400m
);
370 struct i2400m_barker_db
*barker
;
374 if (buf_size
!= sizeof(i2400m_barker_db
[i
].data
))
377 /* Short circuit if we have already discovered the barker
378 * associated with the device. */
380 && !memcmp(buf
, i2400m
->barker
, sizeof(i2400m
->barker
->data
))) {
381 unsigned index
= (i2400m
->barker
- i2400m_barker_db
)
382 / sizeof(*i2400m
->barker
);
383 d_printf(2, dev
, "boot barker cache-confirmed #%u/%08x\n",
384 index
, le32_to_cpu(i2400m
->barker
->data
[0]));
388 for (i
= 0; i
< i2400m_barker_db_used
; i
++) {
389 barker
= &i2400m_barker_db
[i
];
390 BUILD_BUG_ON(sizeof(barker
->data
) != 16);
391 if (memcmp(buf
, barker
->data
, sizeof(barker
->data
)))
394 if (i2400m
->barker
== NULL
) {
395 i2400m
->barker
= barker
;
396 d_printf(1, dev
, "boot barker set to #%u/%08x\n",
397 i
, le32_to_cpu(barker
->data
[0]));
398 if (barker
->data
[0] == le32_to_cpu(I2400M_NBOOT_BARKER
))
402 } else if (i2400m
->barker
!= barker
) {
403 dev_err(dev
, "HW inconsistency: device "
404 "reports a different boot barker "
405 "than set (from %08x to %08x)\n",
406 le32_to_cpu(i2400m
->barker
->data
[0]),
407 le32_to_cpu(barker
->data
[0]));
410 d_printf(2, dev
, "boot barker confirmed #%u/%08x\n",
411 i
, le32_to_cpu(barker
->data
[0]));
417 EXPORT_SYMBOL_GPL(i2400m_is_boot_barker
);
421 * Verify the ack data received
423 * Given a reply to a boot mode command, chew it and verify everything
426 * @opcode: opcode which generated this ack. For error messages.
427 * @ack: pointer to ack data we received
428 * @ack_size: size of that data buffer
429 * @flags: I2400M_BM_CMD_* flags we called the command with.
431 * Way too long function -- maybe it should be further split
434 ssize_t
__i2400m_bm_ack_verify(struct i2400m
*i2400m
, int opcode
,
435 struct i2400m_bootrom_header
*ack
,
436 size_t ack_size
, int flags
)
438 ssize_t result
= -ENOMEM
;
439 struct device
*dev
= i2400m_dev(i2400m
);
441 d_fnstart(8, dev
, "(i2400m %p opcode %d ack %p size %zu)\n",
442 i2400m
, opcode
, ack
, ack_size
);
443 if (ack_size
< sizeof(*ack
)) {
445 dev_err(dev
, "boot-mode cmd %d: HW BUG? notification didn't "
446 "return enough data (%zu bytes vs %zu expected)\n",
447 opcode
, ack_size
, sizeof(*ack
));
448 goto error_ack_short
;
450 result
= i2400m_is_boot_barker(i2400m
, ack
, ack_size
);
452 result
= -ERESTARTSYS
;
453 d_printf(6, dev
, "boot-mode cmd %d: HW boot barker\n", opcode
);
456 if (ack_size
== sizeof(i2400m_ACK_BARKER
)
457 && memcmp(ack
, i2400m_ACK_BARKER
, sizeof(*ack
)) == 0) {
459 d_printf(3, dev
, "boot-mode cmd %d: HW reboot ack barker\n",
461 goto error_reboot_ack
;
464 if (flags
& I2400M_BM_CMD_RAW
)
466 ack
->data_size
= le32_to_cpu(ack
->data_size
);
467 ack
->target_addr
= le32_to_cpu(ack
->target_addr
);
468 ack
->block_checksum
= le32_to_cpu(ack
->block_checksum
);
469 d_printf(5, dev
, "boot-mode cmd %d: notification for opcode %u "
470 "response %u csum %u rr %u da %u\n",
471 opcode
, i2400m_brh_get_opcode(ack
),
472 i2400m_brh_get_response(ack
),
473 i2400m_brh_get_use_checksum(ack
),
474 i2400m_brh_get_response_required(ack
),
475 i2400m_brh_get_direct_access(ack
));
477 if (i2400m_brh_get_signature(ack
) != 0xcbbc) {
478 dev_err(dev
, "boot-mode cmd %d: HW BUG? wrong signature "
479 "0x%04x\n", opcode
, i2400m_brh_get_signature(ack
));
480 goto error_ack_signature
;
482 if (opcode
!= -1 && opcode
!= i2400m_brh_get_opcode(ack
)) {
483 dev_err(dev
, "boot-mode cmd %d: HW BUG? "
484 "received response for opcode %u, expected %u\n",
485 opcode
, i2400m_brh_get_opcode(ack
), opcode
);
486 goto error_ack_opcode
;
488 if (i2400m_brh_get_response(ack
) != 0) { /* failed? */
489 dev_err(dev
, "boot-mode cmd %d: error; hw response %u\n",
490 opcode
, i2400m_brh_get_response(ack
));
491 goto error_ack_failed
;
493 if (ack_size
< ack
->data_size
+ sizeof(*ack
)) {
494 dev_err(dev
, "boot-mode cmd %d: SW BUG "
495 "driver provided only %zu bytes for %zu bytes "
496 "of data\n", opcode
, ack_size
,
497 (size_t) le32_to_cpu(ack
->data_size
) + sizeof(*ack
));
498 goto error_ack_short_buffer
;
501 /* Don't you love this stack of empty targets? Well, I don't
502 * either, but it helps track exactly who comes in here and
504 error_ack_short_buffer
:
512 d_fnend(8, dev
, "(i2400m %p opcode %d ack %p size %zu) = %d\n",
513 i2400m
, opcode
, ack
, ack_size
, (int) result
);
519 * i2400m_bm_cmd - Execute a boot mode command
521 * @cmd: buffer containing the command data (pointing at the header).
522 * This data can be ANYWHERE (for USB, we will copy it to an
523 * specific buffer). Make sure everything is in proper little
526 * A raw buffer can be also sent, just cast it and set flags to
529 * This function will generate a checksum for you if the
530 * checksum bit in the command is set (unless I2400M_BM_CMD_RAW
533 * You can use the i2400m->bm_cmd_buf to stage your commands and
536 * If NULL, no command is sent (we just wait for an ack).
538 * @cmd_size: size of the command. Will be auto padded to the
539 * bus-specific drivers padding requirements.
541 * @ack: buffer where to place the acknowledgement. If it is a regular
542 * command response, all fields will be returned with the right,
545 * You *cannot* use i2400m->bm_ack_buf for this buffer.
547 * @ack_size: size of @ack, 16 aligned; you need to provide at least
548 * sizeof(*ack) bytes and then enough to contain the return data
551 * @flags: see I2400M_BM_CMD_* above.
553 * @returns: bytes received by the notification; if < 0, an errno code
554 * denoting an error or:
556 * -ERESTARTSYS The device has rebooted
558 * Executes a boot-mode command and waits for a response, doing basic
559 * validation on it; if a zero length response is received, it retries
560 * waiting for a response until a non-zero one is received (timing out
561 * after %I2400M_BOOT_RETRIES retries).
564 ssize_t
i2400m_bm_cmd(struct i2400m
*i2400m
,
565 const struct i2400m_bootrom_header
*cmd
, size_t cmd_size
,
566 struct i2400m_bootrom_header
*ack
, size_t ack_size
,
569 ssize_t result
= -ENOMEM
, rx_bytes
;
570 struct device
*dev
= i2400m_dev(i2400m
);
571 int opcode
= cmd
== NULL
? -1 : i2400m_brh_get_opcode(cmd
);
573 d_fnstart(6, dev
, "(i2400m %p cmd %p size %zu ack %p size %zu)\n",
574 i2400m
, cmd
, cmd_size
, ack
, ack_size
);
575 BUG_ON(ack_size
< sizeof(*ack
));
576 BUG_ON(i2400m
->boot_mode
== 0);
578 if (cmd
!= NULL
) { /* send the command */
579 result
= i2400m
->bus_bm_cmd_send(i2400m
, cmd
, cmd_size
, flags
);
582 if ((flags
& I2400M_BM_CMD_RAW
) == 0)
584 "boot-mode cmd %d csum %u rr %u da %u: "
585 "addr 0x%04x size %u block csum 0x%04x\n",
586 opcode
, i2400m_brh_get_use_checksum(cmd
),
587 i2400m_brh_get_response_required(cmd
),
588 i2400m_brh_get_direct_access(cmd
),
589 cmd
->target_addr
, cmd
->data_size
,
590 cmd
->block_checksum
);
592 result
= i2400m
->bus_bm_wait_for_ack(i2400m
, ack
, ack_size
);
594 dev_err(dev
, "boot-mode cmd %d: error waiting for an ack: %d\n",
595 opcode
, (int) result
); /* bah, %zd doesn't work */
596 goto error_wait_for_ack
;
599 /* verify the ack and read more if neccessary [result is the
600 * final amount of bytes we get in the ack] */
601 result
= __i2400m_bm_ack_verify(i2400m
, opcode
, ack
, ack_size
, flags
);
604 /* Don't you love this stack of empty targets? Well, I don't
605 * either, but it helps track exactly who comes in here and
611 d_fnend(6, dev
, "(i2400m %p cmd %p size %zu ack %p size %zu) = %d\n",
612 i2400m
, cmd
, cmd_size
, ack
, ack_size
, (int) result
);
618 * i2400m_download_chunk - write a single chunk of data to the device's memory
620 * @i2400m: device descriptor
621 * @buf: the buffer to write
622 * @buf_len: length of the buffer to write
623 * @addr: address in the device memory space
624 * @direct: bootrom write mode
625 * @do_csum: should a checksum validation be performed
627 static int i2400m_download_chunk(struct i2400m
*i2400m
, const void *chunk
,
628 size_t __chunk_len
, unsigned long addr
,
629 unsigned int direct
, unsigned int do_csum
)
632 size_t chunk_len
= ALIGN(__chunk_len
, I2400M_PL_ALIGN
);
633 struct device
*dev
= i2400m_dev(i2400m
);
635 struct i2400m_bootrom_header cmd
;
636 u8 cmd_payload
[chunk_len
];
637 } __attribute__((packed
)) *buf
;
638 struct i2400m_bootrom_header ack
;
640 d_fnstart(5, dev
, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
641 "direct %u do_csum %u)\n", i2400m
, chunk
, __chunk_len
,
642 addr
, direct
, do_csum
);
643 buf
= i2400m
->bm_cmd_buf
;
644 memcpy(buf
->cmd_payload
, chunk
, __chunk_len
);
645 memset(buf
->cmd_payload
+ __chunk_len
, 0xad, chunk_len
- __chunk_len
);
647 buf
->cmd
.command
= i2400m_brh_command(I2400M_BRH_WRITE
,
648 __chunk_len
& 0x3 ? 0 : do_csum
,
649 __chunk_len
& 0xf ? 0 : direct
);
650 buf
->cmd
.target_addr
= cpu_to_le32(addr
);
651 buf
->cmd
.data_size
= cpu_to_le32(__chunk_len
);
652 ret
= i2400m_bm_cmd(i2400m
, &buf
->cmd
, sizeof(buf
->cmd
) + chunk_len
,
653 &ack
, sizeof(ack
), 0);
656 d_fnend(5, dev
, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
657 "direct %u do_csum %u) = %d\n", i2400m
, chunk
, __chunk_len
,
658 addr
, direct
, do_csum
, ret
);
664 * Download a BCF file's sections to the device
666 * @i2400m: device descriptor
667 * @bcf: pointer to firmware data (followed by the payloads). Assumed
668 * verified and consistent.
669 * @bcf_len: length (in bytes) of the @bcf buffer.
671 * Returns: < 0 errno code on error or the offset to the jump instruction.
673 * Given a BCF file, downloads each section (a command and a payload)
674 * to the device's address space. Actually, it just executes each
675 * command i the BCF file.
677 * The section size has to be aligned to 4 bytes AND the padding has
678 * to be taken from the firmware file, as the signature takes it into
682 ssize_t
i2400m_dnload_bcf(struct i2400m
*i2400m
,
683 const struct i2400m_bcf_hdr
*bcf
, size_t bcf_len
)
686 struct device
*dev
= i2400m_dev(i2400m
);
687 size_t offset
, /* iterator offset */
688 data_size
, /* Size of the data payload */
689 section_size
, /* Size of the whole section (cmd + payload) */
691 const struct i2400m_bootrom_header
*bh
;
692 struct i2400m_bootrom_header ack
;
694 d_fnstart(3, dev
, "(i2400m %p bcf %p bcf_len %zu)\n",
695 i2400m
, bcf
, bcf_len
);
696 /* Iterate over the command blocks in the BCF file that start
697 * after the header */
698 offset
= le32_to_cpu(bcf
->header_len
) * sizeof(u32
);
699 while (1) { /* start sending the file */
700 bh
= (void *) bcf
+ offset
;
701 data_size
= le32_to_cpu(bh
->data_size
);
702 section_size
= ALIGN(sizeof(*bh
) + data_size
, 4);
704 "downloading section #%zu (@%zu %zu B) to 0x%08x\n",
705 section
, offset
, sizeof(*bh
) + data_size
,
706 le32_to_cpu(bh
->target_addr
));
707 if (i2400m_brh_get_opcode(bh
) == I2400M_BRH_SIGNED_JUMP
) {
708 /* Secure boot needs to stop here */
709 d_printf(5, dev
, "signed jump found @%zu\n", offset
);
712 if (offset
+ section_size
== bcf_len
)
713 /* Non-secure boot stops here */
715 if (offset
+ section_size
> bcf_len
) {
716 dev_err(dev
, "fw %s: bad section #%zu, "
717 "end (@%zu) beyond EOF (@%zu)\n",
718 i2400m
->fw_name
, section
,
719 offset
+ section_size
, bcf_len
);
721 goto error_section_beyond_eof
;
724 ret
= i2400m_bm_cmd(i2400m
, bh
, section_size
,
725 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
727 dev_err(dev
, "fw %s: section #%zu (@%zu %zu B) "
728 "failed %d\n", i2400m
->fw_name
, section
,
729 offset
, sizeof(*bh
) + data_size
, (int) ret
);
732 offset
+= section_size
;
736 error_section_beyond_eof
:
738 d_fnend(3, dev
, "(i2400m %p bcf %p bcf_len %zu) = %d\n",
739 i2400m
, bcf
, bcf_len
, (int) ret
);
745 * Indicate if the device emitted a reboot barker that indicates
749 unsigned i2400m_boot_is_signed(struct i2400m
*i2400m
)
751 return likely(i2400m
->sboot
);
756 * Do the final steps of uploading firmware
758 * Depending on the boot mode (signed vs non-signed), different
759 * actions need to be taken.
762 int i2400m_dnload_finalize(struct i2400m
*i2400m
,
763 const struct i2400m_bcf_hdr
*bcf
, size_t offset
)
766 struct device
*dev
= i2400m_dev(i2400m
);
767 struct i2400m_bootrom_header
*cmd
, ack
;
769 struct i2400m_bootrom_header cmd
;
771 } __attribute__((packed
)) *cmd_buf
;
772 size_t signature_block_offset
, signature_block_size
;
774 d_fnstart(3, dev
, "offset %zu\n", offset
);
775 cmd
= (void *) bcf
+ offset
;
776 if (i2400m_boot_is_signed(i2400m
) == 0) {
777 struct i2400m_bootrom_header jump_ack
;
778 d_printf(1, dev
, "unsecure boot, jumping to 0x%08x\n",
779 le32_to_cpu(cmd
->target_addr
));
780 cmd_buf
= i2400m
->bm_cmd_buf
;
781 memcpy(&cmd_buf
->cmd
, cmd
, sizeof(*cmd
));
783 /* now cmd points to the actual bootrom_header in cmd_buf */
784 i2400m_brh_set_opcode(cmd
, I2400M_BRH_JUMP
);
786 ret
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
787 &jump_ack
, sizeof(jump_ack
), 0);
789 d_printf(1, dev
, "secure boot, jumping to 0x%08x\n",
790 le32_to_cpu(cmd
->target_addr
));
791 cmd_buf
= i2400m
->bm_cmd_buf
;
792 memcpy(&cmd_buf
->cmd
, cmd
, sizeof(*cmd
));
793 signature_block_offset
=
795 + le32_to_cpu(bcf
->key_size
) * sizeof(u32
)
796 + le32_to_cpu(bcf
->exponent_size
) * sizeof(u32
);
797 signature_block_size
=
798 le32_to_cpu(bcf
->modulus_size
) * sizeof(u32
);
799 memcpy(cmd_buf
->cmd_pl
, (void *) bcf
+ signature_block_offset
,
800 signature_block_size
);
801 ret
= i2400m_bm_cmd(i2400m
, &cmd_buf
->cmd
,
802 sizeof(cmd_buf
->cmd
) + signature_block_size
,
803 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
805 d_fnend(3, dev
, "returning %d\n", ret
);
811 * i2400m_bootrom_init - Reboots a powered device into boot mode
813 * @i2400m: device descriptor
815 * I2400M_BRI_SOFT: a reboot notification has been seen
816 * already, so don't wait for it.
818 * I2400M_BRI_NO_REBOOT: Don't send a reboot command, but wait
819 * for a reboot barker notification. This is a one shot; if
820 * the state machine needs to send a reboot command it will.
824 * < 0 errno code on error, 0 if ok.
828 * Tries hard enough to put the device in boot-mode. There are two
829 * main phases to this:
831 * a. (1) send a reboot command and (2) get a reboot barker
832 * b. (1) ack the reboot sending a reboot barker and (2) getting an
833 * ack barker in return
835 * We want to skip (a) in some cases [soft]. The state machine is
836 * horrible, but it is basically: on each phase, send what has to be
837 * sent (if any), wait for the answer and act on the answer. We might
838 * have to backtrack and retry, so we keep a max tries counter for
841 * If we get a timeout after sending a warm reset, we do it again.
843 int i2400m_bootrom_init(struct i2400m
*i2400m
, enum i2400m_bri flags
)
846 struct device
*dev
= i2400m_dev(i2400m
);
847 struct i2400m_bootrom_header
*cmd
;
848 struct i2400m_bootrom_header ack
;
849 int count
= i2400m
->bus_bm_retries
;
850 int ack_timeout_cnt
= 1;
852 BUILD_BUG_ON(sizeof(*cmd
) != sizeof(i2400m_barker_db
[0].data
));
853 BUILD_BUG_ON(sizeof(ack
) != sizeof(i2400m_ACK_BARKER
));
855 d_fnstart(4, dev
, "(i2400m %p flags 0x%08x)\n", i2400m
, flags
);
857 cmd
= i2400m
->bm_cmd_buf
;
858 if (flags
& I2400M_BRI_SOFT
)
863 d_printf(4, dev
, "device reboot: reboot command [%d # left]\n",
865 if ((flags
& I2400M_BRI_NO_REBOOT
) == 0)
866 i2400m
->bus_reset(i2400m
, I2400M_RT_WARM
);
867 result
= i2400m_bm_cmd(i2400m
, NULL
, 0, &ack
, sizeof(ack
),
869 flags
&= ~I2400M_BRI_NO_REBOOT
;
872 d_printf(4, dev
, "device reboot: got reboot barker\n");
874 case -EISCONN
: /* we don't know how it got here...but we follow it */
875 d_printf(4, dev
, "device reboot: got ack barker - whatever\n");
877 case -ETIMEDOUT
: /* device has timed out, we might be in boot
878 * mode already and expecting an ack, let's try
880 if (i2400m
->barker
== NULL
) {
881 dev_info(dev
, "warm reset timed out, unknown barker "
882 "type, rebooting\n");
885 dev_info(dev
, "warm reset timed out, trying an ack\n");
889 case -ESHUTDOWN
: /* dev is gone */
890 case -EINTR
: /* user cancelled */
893 dev_err(dev
, "device reboot: error %d while waiting "
894 "for reboot barker - rebooting\n", result
);
897 /* At this point we ack back with 4 REBOOT barkers and expect
898 * 4 ACK barkers. This is ugly, as we send a raw command --
899 * hence the cast. _bm_cmd() will catch the reboot ack
900 * notification and report it as -EISCONN. */
902 d_printf(4, dev
, "device reboot ack: sending ack [%d # left]\n", count
);
903 memcpy(cmd
, i2400m
->barker
->data
, sizeof(i2400m
->barker
->data
));
904 result
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
905 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
908 d_printf(4, dev
, "reboot ack: got reboot barker - retrying\n");
913 d_printf(4, dev
, "reboot ack: got ack barker - good\n");
915 case -ETIMEDOUT
: /* no response, maybe it is the other type? */
916 if (ack_timeout_cnt
-- < 0) {
917 d_printf(4, dev
, "reboot ack timedout: retrying\n");
920 dev_err(dev
, "reboot ack timedout too long: "
926 case -ESHUTDOWN
: /* dev is gone */
929 dev_err(dev
, "device reboot ack: error %d while waiting for "
930 "reboot ack barker - rebooting\n", result
);
933 d_printf(2, dev
, "device reboot ack: got ack barker - boot done\n");
937 d_fnend(4, dev
, "(i2400m %p flags 0x%08x) = %d\n",
938 i2400m
, flags
, result
);
942 dev_err(dev
, "Timed out waiting for reboot ack\n");
951 * The position this function reads is fixed in device memory and
952 * always available, even without firmware.
954 * Note we specify we want to read only six bytes, but provide space
955 * for 16, as we always get it rounded up.
957 int i2400m_read_mac_addr(struct i2400m
*i2400m
)
960 struct device
*dev
= i2400m_dev(i2400m
);
961 struct net_device
*net_dev
= i2400m
->wimax_dev
.net_dev
;
962 struct i2400m_bootrom_header
*cmd
;
964 struct i2400m_bootrom_header ack
;
966 } __attribute__((packed
)) ack_buf
;
968 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
969 cmd
= i2400m
->bm_cmd_buf
;
970 cmd
->command
= i2400m_brh_command(I2400M_BRH_READ
, 0, 1);
971 cmd
->target_addr
= cpu_to_le32(0x00203fe8);
972 cmd
->data_size
= cpu_to_le32(6);
973 result
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
974 &ack_buf
.ack
, sizeof(ack_buf
), 0);
976 dev_err(dev
, "BM: read mac addr failed: %d\n", result
);
980 "mac addr is %02x:%02x:%02x:%02x:%02x:%02x\n",
981 ack_buf
.ack_pl
[0], ack_buf
.ack_pl
[1],
982 ack_buf
.ack_pl
[2], ack_buf
.ack_pl
[3],
983 ack_buf
.ack_pl
[4], ack_buf
.ack_pl
[5]);
984 if (i2400m
->bus_bm_mac_addr_impaired
== 1) {
985 ack_buf
.ack_pl
[0] = 0x00;
986 ack_buf
.ack_pl
[1] = 0x16;
987 ack_buf
.ack_pl
[2] = 0xd3;
988 get_random_bytes(&ack_buf
.ack_pl
[3], 3);
989 dev_err(dev
, "BM is MAC addr impaired, faking MAC addr to "
990 "mac addr is %02x:%02x:%02x:%02x:%02x:%02x\n",
991 ack_buf
.ack_pl
[0], ack_buf
.ack_pl
[1],
992 ack_buf
.ack_pl
[2], ack_buf
.ack_pl
[3],
993 ack_buf
.ack_pl
[4], ack_buf
.ack_pl
[5]);
996 net_dev
->addr_len
= ETH_ALEN
;
997 memcpy(net_dev
->perm_addr
, ack_buf
.ack_pl
, ETH_ALEN
);
998 memcpy(net_dev
->dev_addr
, ack_buf
.ack_pl
, ETH_ALEN
);
1000 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, result
);
1006 * Initialize a non signed boot
1008 * This implies sending some magic values to the device's memory. Note
1009 * we convert the values to little endian in the same array
1013 int i2400m_dnload_init_nonsigned(struct i2400m
*i2400m
)
1017 struct device
*dev
= i2400m_dev(i2400m
);
1018 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1019 if (i2400m
->bus_bm_pokes_table
) {
1020 while (i2400m
->bus_bm_pokes_table
[i
].address
) {
1021 ret
= i2400m_download_chunk(
1023 &i2400m
->bus_bm_pokes_table
[i
].data
,
1024 sizeof(i2400m
->bus_bm_pokes_table
[i
].data
),
1025 i2400m
->bus_bm_pokes_table
[i
].address
, 1, 1);
1031 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, ret
);
1037 * Initialize the signed boot process
1039 * @i2400m: device descriptor
1041 * @bcf_hdr: pointer to the firmware header; assumes it is fully in
1042 * memory (it has gone through basic validation).
1044 * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw
1047 * This writes the firmware BCF header to the device using the
1048 * HASH_PAYLOAD_ONLY command.
1051 int i2400m_dnload_init_signed(struct i2400m
*i2400m
,
1052 const struct i2400m_bcf_hdr
*bcf_hdr
)
1055 struct device
*dev
= i2400m_dev(i2400m
);
1057 struct i2400m_bootrom_header cmd
;
1058 struct i2400m_bcf_hdr cmd_pl
;
1059 } __attribute__((packed
)) *cmd_buf
;
1060 struct i2400m_bootrom_header ack
;
1062 d_fnstart(5, dev
, "(i2400m %p bcf_hdr %p)\n", i2400m
, bcf_hdr
);
1063 cmd_buf
= i2400m
->bm_cmd_buf
;
1064 cmd_buf
->cmd
.command
=
1065 i2400m_brh_command(I2400M_BRH_HASH_PAYLOAD_ONLY
, 0, 0);
1066 cmd_buf
->cmd
.target_addr
= 0;
1067 cmd_buf
->cmd
.data_size
= cpu_to_le32(sizeof(cmd_buf
->cmd_pl
));
1068 memcpy(&cmd_buf
->cmd_pl
, bcf_hdr
, sizeof(*bcf_hdr
));
1069 ret
= i2400m_bm_cmd(i2400m
, &cmd_buf
->cmd
, sizeof(*cmd_buf
),
1070 &ack
, sizeof(ack
), 0);
1073 d_fnend(5, dev
, "(i2400m %p bcf_hdr %p) = %d\n", i2400m
, bcf_hdr
, ret
);
1079 * Initialize the firmware download at the device size
1081 * Multiplex to the one that matters based on the device's mode
1082 * (signed or non-signed).
1085 int i2400m_dnload_init(struct i2400m
*i2400m
, const struct i2400m_bcf_hdr
*bcf
)
1088 struct device
*dev
= i2400m_dev(i2400m
);
1090 if (i2400m_boot_is_signed(i2400m
)) {
1091 d_printf(1, dev
, "signed boot\n");
1092 result
= i2400m_dnload_init_signed(i2400m
, bcf
);
1093 if (result
== -ERESTARTSYS
)
1096 dev_err(dev
, "firmware %s: signed boot download "
1097 "initialization failed: %d\n",
1098 i2400m
->fw_name
, result
);
1100 /* non-signed boot process without pokes */
1101 d_printf(1, dev
, "non-signed boot\n");
1102 result
= i2400m_dnload_init_nonsigned(i2400m
);
1103 if (result
== -ERESTARTSYS
)
1106 dev_err(dev
, "firmware %s: non-signed download "
1107 "initialization failed: %d\n",
1108 i2400m
->fw_name
, result
);
1115 * Run quick consistency tests on the firmware file
1117 * Check for the firmware being made for the i2400m device,
1118 * etc...These checks are mostly informative, as the device will make
1119 * them too; but the driver's response is more informative on what
1123 int i2400m_fw_check(struct i2400m
*i2400m
,
1124 const struct i2400m_bcf_hdr
*bcf
,
1128 struct device
*dev
= i2400m_dev(i2400m
);
1129 unsigned module_type
, header_len
, major_version
, minor_version
,
1130 module_id
, module_vendor
, date
, size
;
1132 /* Check hard errors */
1134 if (bcf_size
< sizeof(*bcf
)) { /* big enough header? */
1135 dev_err(dev
, "firmware %s too short: "
1136 "%zu B vs %zu (at least) expected\n",
1137 i2400m
->fw_name
, bcf_size
, sizeof(*bcf
));
1141 module_type
= bcf
->module_type
;
1142 header_len
= sizeof(u32
) * le32_to_cpu(bcf
->header_len
);
1143 major_version
= le32_to_cpu(bcf
->header_version
) & 0xffff0000 >> 16;
1144 minor_version
= le32_to_cpu(bcf
->header_version
) & 0x0000ffff;
1145 module_id
= le32_to_cpu(bcf
->module_id
);
1146 module_vendor
= le32_to_cpu(bcf
->module_vendor
);
1147 date
= le32_to_cpu(bcf
->date
);
1148 size
= sizeof(u32
) * le32_to_cpu(bcf
->size
);
1150 if (bcf_size
!= size
) { /* annoyingly paranoid */
1151 dev_err(dev
, "firmware %s: bad size, got "
1152 "%zu B vs %u expected\n",
1153 i2400m
->fw_name
, bcf_size
, size
);
1157 d_printf(2, dev
, "type 0x%x id 0x%x vendor 0x%x; header v%u.%u (%zu B) "
1158 "date %08x (%zu B)\n",
1159 module_type
, module_id
, module_vendor
,
1160 major_version
, minor_version
, (size_t) header_len
,
1161 date
, (size_t) size
);
1163 if (module_type
!= 6) { /* built for the right hardware? */
1164 dev_err(dev
, "bad fw %s: unexpected module type 0x%x; "
1165 "aborting\n", i2400m
->fw_name
, module_type
);
1169 /* Check soft-er errors */
1171 if (module_vendor
!= 0x8086)
1172 dev_err(dev
, "bad fw %s? unexpected vendor 0x%04x\n",
1173 i2400m
->fw_name
, module_vendor
);
1174 if (date
< 0x20080300)
1175 dev_err(dev
, "bad fw %s? build date too old %08x\n",
1176 i2400m
->fw_name
, date
);
1183 * Download the firmware to the device
1185 * @i2400m: device descriptor
1186 * @bcf: pointer to loaded (and minimally verified for consistency)
1188 * @bcf_size: size of the @bcf buffer (header plus payloads)
1190 * The process for doing this is described in this file's header.
1192 * Note we only reinitialize boot-mode if the flags say so. Some hw
1193 * iterations need it, some don't. In any case, if we loop, we always
1194 * need to reinitialize the boot room, hence the flags modification.
1197 int i2400m_fw_dnload(struct i2400m
*i2400m
, const struct i2400m_bcf_hdr
*bcf
,
1198 size_t bcf_size
, enum i2400m_bri flags
)
1201 struct device
*dev
= i2400m_dev(i2400m
);
1202 int count
= i2400m
->bus_bm_retries
;
1204 d_fnstart(5, dev
, "(i2400m %p bcf %p size %zu)\n",
1205 i2400m
, bcf
, bcf_size
);
1206 i2400m
->boot_mode
= 1;
1207 wmb(); /* Make sure other readers see it */
1211 dev_err(dev
, "device rebooted too many times, aborting\n");
1212 goto error_too_many_reboots
;
1214 if (flags
& I2400M_BRI_MAC_REINIT
) {
1215 ret
= i2400m_bootrom_init(i2400m
, flags
);
1217 dev_err(dev
, "bootrom init failed: %d\n", ret
);
1218 goto error_bootrom_init
;
1221 flags
|= I2400M_BRI_MAC_REINIT
;
1224 * Initialize the download, push the bytes to the device and
1225 * then jump to the new firmware. Note @ret is passed with the
1226 * offset of the jump instruction to _dnload_finalize()
1228 ret
= i2400m_dnload_init(i2400m
, bcf
); /* Init device's dnload */
1229 if (ret
== -ERESTARTSYS
)
1230 goto error_dev_rebooted
;
1232 goto error_dnload_init
;
1234 ret
= i2400m_dnload_bcf(i2400m
, bcf
, bcf_size
);
1235 if (ret
== -ERESTARTSYS
)
1236 goto error_dev_rebooted
;
1238 dev_err(dev
, "fw %s: download failed: %d\n",
1239 i2400m
->fw_name
, ret
);
1240 goto error_dnload_bcf
;
1243 ret
= i2400m_dnload_finalize(i2400m
, bcf
, ret
);
1244 if (ret
== -ERESTARTSYS
)
1245 goto error_dev_rebooted
;
1247 dev_err(dev
, "fw %s: "
1248 "download finalization failed: %d\n",
1249 i2400m
->fw_name
, ret
);
1250 goto error_dnload_finalize
;
1253 d_printf(2, dev
, "fw %s successfully uploaded\n",
1255 i2400m
->boot_mode
= 0;
1256 wmb(); /* Make sure i2400m_msg_to_dev() sees boot_mode */
1257 error_dnload_finalize
:
1261 error_too_many_reboots
:
1262 d_fnend(5, dev
, "(i2400m %p bcf %p size %zu) = %d\n",
1263 i2400m
, bcf
, bcf_size
, ret
);
1267 dev_err(dev
, "device rebooted, %d tries left\n", count
);
1268 /* we got the notification already, no need to wait for it again */
1269 flags
|= I2400M_BRI_SOFT
;
1275 * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware
1277 * @i2400m: device descriptor
1279 * Returns: >= 0 if ok, < 0 errno code on error.
1281 * This sets up the firmware upload environment, loads the firmware
1282 * file from disk, verifies and then calls the firmware upload process
1285 * Can be called either from probe, or after a warm reset. Can not be
1286 * called from within an interrupt. All the flow in this code is
1287 * single-threade; all I/Os are synchronous.
1289 int i2400m_dev_bootstrap(struct i2400m
*i2400m
, enum i2400m_bri flags
)
1292 struct device
*dev
= i2400m_dev(i2400m
);
1293 const struct firmware
*fw
;
1294 const struct i2400m_bcf_hdr
*bcf
; /* Firmware data */
1295 const char *fw_name
;
1297 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1299 /* Load firmware files to memory. */
1300 for (itr
= 0, bcf
= NULL
, ret
= -ENOENT
; ; itr
++) {
1301 fw_name
= i2400m
->bus_fw_names
[itr
];
1302 if (fw_name
== NULL
) {
1303 dev_err(dev
, "Could not find a usable firmware image\n");
1307 d_printf(1, dev
, "trying firmware %s (%d)\n", fw_name
, itr
);
1308 ret
= request_firmware(&fw
, fw_name
, dev
);
1310 dev_err(dev
, "fw %s: cannot load file: %d\n",
1314 bcf
= (void *) fw
->data
;
1315 i2400m
->fw_name
= fw_name
;
1316 ret
= i2400m_fw_check(i2400m
, bcf
, fw
->size
);
1318 ret
= i2400m_fw_dnload(i2400m
, bcf
, fw
->size
, flags
);
1322 dev_err(dev
, "%s: cannot use, skipping\n", fw_name
);
1323 release_firmware(fw
);
1325 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, ret
);
1328 EXPORT_SYMBOL_GPL(i2400m_dev_bootstrap
);