]>
Commit | Line | Data |
---|---|---|
467cc396 IPG |
1 | /* |
2 | * Intel Wireless WiMAX Connection 2400m | |
3 | * Firmware uploader | |
4 | * | |
5 | * | |
6 | * Copyright (C) 2007-2008 Intel Corporation. All rights reserved. | |
7 | * | |
8 | * Redistribution and use in source and binary forms, with or without | |
9 | * modification, are permitted provided that the following conditions | |
10 | * are met: | |
11 | * | |
12 | * * Redistributions of source code must retain the above copyright | |
13 | * notice, this list of conditions and the following disclaimer. | |
14 | * * Redistributions in binary form must reproduce the above copyright | |
15 | * notice, this list of conditions and the following disclaimer in | |
16 | * the documentation and/or other materials provided with the | |
17 | * distribution. | |
18 | * * Neither the name of Intel Corporation nor the names of its | |
19 | * contributors may be used to endorse or promote products derived | |
20 | * from this software without specific prior written permission. | |
21 | * | |
22 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
23 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
24 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
25 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
26 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
27 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
28 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
29 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
30 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
31 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
32 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
33 | * | |
34 | * | |
35 | * Intel Corporation <linux-wimax@intel.com> | |
36 | * Yanir Lubetkin <yanirx.lubetkin@intel.com> | |
37 | * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> | |
38 | * - Initial implementation | |
39 | * | |
40 | * | |
41 | * THE PROCEDURE | |
42 | * | |
aba3792a IPG |
43 | * The 2400m and derived devices work in two modes: boot-mode or |
44 | * normal mode. In boot mode we can execute only a handful of commands | |
45 | * targeted at uploading the firmware and launching it. | |
467cc396 IPG |
46 | * |
47 | * The 2400m enters boot mode when it is first connected to the | |
48 | * system, when it crashes and when you ask it to reboot. There are | |
49 | * two submodes of the boot mode: signed and non-signed. Signed takes | |
50 | * firmwares signed with a certain private key, non-signed takes any | |
51 | * firmware. Normal hardware takes only signed firmware. | |
52 | * | |
aba3792a | 53 | * On boot mode, in USB, we write to the device using the bulk out |
5da7b2e0 | 54 | * endpoint and read from it in the notification endpoint. |
aba3792a | 55 | * |
25985edc | 56 | * Upon entrance to boot mode, the device sends (preceded with a few |
aba3792a IPG |
57 | * zero length packets (ZLPs) on the notification endpoint in USB) a |
58 | * reboot barker (4 le32 words with the same value). We ack it by | |
59 | * sending the same barker to the device. The device acks with a | |
60 | * reboot ack barker (4 le32 words with value I2400M_ACK_BARKER) and | |
61 | * then is fully booted. At this point we can upload the firmware. | |
62 | * | |
63 | * Note that different iterations of the device and EEPROM | |
64 | * configurations will send different [re]boot barkers; these are | |
65 | * collected in i2400m_barker_db along with the firmware | |
66 | * characteristics they require. | |
467cc396 IPG |
67 | * |
68 | * This process is accomplished by the i2400m_bootrom_init() | |
69 | * function. All the device interaction happens through the | |
70 | * i2400m_bm_cmd() [boot mode command]. Special return values will | |
aba3792a | 71 | * indicate if the device did reset during the process. |
467cc396 IPG |
72 | * |
73 | * After this, we read the MAC address and then (if needed) | |
74 | * reinitialize the device. We need to read it ahead of time because | |
75 | * in the future, we might not upload the firmware until userspace | |
76 | * 'ifconfig up's the device. | |
77 | * | |
78 | * We can then upload the firmware file. The file is composed of a BCF | |
79 | * header (basic data, keys and signatures) and a list of write | |
bfc44187 IPG |
80 | * commands and payloads. Optionally more BCF headers might follow the |
81 | * main payload. We first upload the header [i2400m_dnload_init()] and | |
82 | * then pass the commands and payloads verbatim to the i2400m_bm_cmd() | |
83 | * function [i2400m_dnload_bcf()]. Then we tell the device to jump to | |
84 | * the new firmware [i2400m_dnload_finalize()]. | |
467cc396 IPG |
85 | * |
86 | * Once firmware is uploaded, we are good to go :) | |
87 | * | |
88 | * When we don't know in which mode we are, we first try by sending a | |
89 | * warm reset request that will take us to boot-mode. If we time out | |
90 | * waiting for a reboot barker, that means maybe we are already in | |
91 | * boot mode, so we send a reboot barker. | |
92 | * | |
93 | * COMMAND EXECUTION | |
94 | * | |
95 | * This code (and process) is single threaded; for executing commands, | |
96 | * we post a URB to the notification endpoint, post the command, wait | |
97 | * for data on the notification buffer. We don't need to worry about | |
98 | * others as we know we are the only ones in there. | |
99 | * | |
100 | * BACKEND IMPLEMENTATION | |
101 | * | |
102 | * This code is bus-generic; the bus-specific driver provides back end | |
103 | * implementations to send a boot mode command to the device and to | |
104 | * read an acknolwedgement from it (or an asynchronous notification) | |
105 | * from it. | |
106 | * | |
7b43ca70 IPG |
107 | * FIRMWARE LOADING |
108 | * | |
109 | * Note that in some cases, we can't just load a firmware file (for | |
110 | * example, when resuming). For that, we might cache the firmware | |
111 | * file. Thus, when doing the bootstrap, if there is a cache firmware | |
112 | * file, it is used; if not, loading from disk is attempted. | |
113 | * | |
467cc396 IPG |
114 | * ROADMAP |
115 | * | |
aba3792a IPG |
116 | * i2400m_barker_db_init Called by i2400m_driver_init() |
117 | * i2400m_barker_db_add | |
118 | * | |
119 | * i2400m_barker_db_exit Called by i2400m_driver_exit() | |
120 | * | |
467cc396 IPG |
121 | * i2400m_dev_bootstrap Called by __i2400m_dev_start() |
122 | * request_firmware | |
7b43ca70 IPG |
123 | * i2400m_fw_bootstrap |
124 | * i2400m_fw_check | |
125 | * i2400m_fw_hdr_check | |
126 | * i2400m_fw_dnload | |
467cc396 IPG |
127 | * release_firmware |
128 | * | |
129 | * i2400m_fw_dnload | |
130 | * i2400m_bootrom_init | |
131 | * i2400m_bm_cmd | |
c931ceeb | 132 | * i2400m_reset |
467cc396 IPG |
133 | * i2400m_dnload_init |
134 | * i2400m_dnload_init_signed | |
135 | * i2400m_dnload_init_nonsigned | |
136 | * i2400m_download_chunk | |
137 | * i2400m_bm_cmd | |
138 | * i2400m_dnload_bcf | |
139 | * i2400m_bm_cmd | |
140 | * i2400m_dnload_finalize | |
141 | * i2400m_bm_cmd | |
142 | * | |
143 | * i2400m_bm_cmd | |
144 | * i2400m->bus_bm_cmd_send() | |
145 | * i2400m->bus_bm_wait_for_ack | |
146 | * __i2400m_bm_ack_verify | |
aba3792a | 147 | * i2400m_is_boot_barker |
467cc396 IPG |
148 | * |
149 | * i2400m_bm_cmd_prepare Used by bus-drivers to prep | |
150 | * commands before sending | |
7b43ca70 IPG |
151 | * |
152 | * i2400m_pm_notifier Called on Power Management events | |
153 | * i2400m_fw_cache | |
154 | * i2400m_fw_uncache | |
467cc396 IPG |
155 | */ |
156 | #include <linux/firmware.h> | |
157 | #include <linux/sched.h> | |
5a0e3ad6 | 158 | #include <linux/slab.h> |
467cc396 | 159 | #include <linux/usb.h> |
ee40fa06 | 160 | #include <linux/export.h> |
467cc396 IPG |
161 | #include "i2400m.h" |
162 | ||
163 | ||
164 | #define D_SUBMODULE fw | |
165 | #include "debug-levels.h" | |
166 | ||
167 | ||
168 | static const __le32 i2400m_ACK_BARKER[4] = { | |
ee437770 HH |
169 | cpu_to_le32(I2400M_ACK_BARKER), |
170 | cpu_to_le32(I2400M_ACK_BARKER), | |
171 | cpu_to_le32(I2400M_ACK_BARKER), | |
172 | cpu_to_le32(I2400M_ACK_BARKER) | |
467cc396 IPG |
173 | }; |
174 | ||
175 | ||
176 | /** | |
177 | * Prepare a boot-mode command for delivery | |
178 | * | |
179 | * @cmd: pointer to bootrom header to prepare | |
180 | * | |
181 | * Computes checksum if so needed. After calling this function, DO NOT | |
182 | * modify the command or header as the checksum won't work anymore. | |
183 | * | |
184 | * We do it from here because some times we cannot do it in the | |
185 | * original context the command was sent (it is a const), so when we | |
186 | * copy it to our staging buffer, we add the checksum there. | |
187 | */ | |
188 | void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header *cmd) | |
189 | { | |
190 | if (i2400m_brh_get_use_checksum(cmd)) { | |
191 | int i; | |
192 | u32 checksum = 0; | |
193 | const u32 *checksum_ptr = (void *) cmd->payload; | |
194 | for (i = 0; i < cmd->data_size / 4; i++) | |
195 | checksum += cpu_to_le32(*checksum_ptr++); | |
196 | checksum += cmd->command + cmd->target_addr + cmd->data_size; | |
197 | cmd->block_checksum = cpu_to_le32(checksum); | |
198 | } | |
199 | } | |
200 | EXPORT_SYMBOL_GPL(i2400m_bm_cmd_prepare); | |
201 | ||
202 | ||
aba3792a IPG |
203 | /* |
204 | * Database of known barkers. | |
205 | * | |
206 | * A barker is what the device sends indicating he is ready to be | |
207 | * bootloaded. Different versions of the device will send different | |
208 | * barkers. Depending on the barker, it might mean the device wants | |
209 | * some kind of firmware or the other. | |
210 | */ | |
211 | static struct i2400m_barker_db { | |
212 | __le32 data[4]; | |
213 | } *i2400m_barker_db; | |
214 | static size_t i2400m_barker_db_used, i2400m_barker_db_size; | |
215 | ||
216 | ||
217 | static | |
218 | int i2400m_zrealloc_2x(void **ptr, size_t *_count, size_t el_size, | |
219 | gfp_t gfp_flags) | |
220 | { | |
221 | size_t old_count = *_count, | |
222 | new_count = old_count ? 2 * old_count : 2, | |
223 | old_size = el_size * old_count, | |
224 | new_size = el_size * new_count; | |
225 | void *nptr = krealloc(*ptr, new_size, gfp_flags); | |
226 | if (nptr) { | |
227 | /* zero the other half or the whole thing if old_count | |
228 | * was zero */ | |
229 | if (old_size == 0) | |
230 | memset(nptr, 0, new_size); | |
231 | else | |
232 | memset(nptr + old_size, 0, old_size); | |
233 | *_count = new_count; | |
234 | *ptr = nptr; | |
235 | return 0; | |
236 | } else | |
237 | return -ENOMEM; | |
238 | } | |
239 | ||
240 | ||
241 | /* | |
242 | * Add a barker to the database | |
243 | * | |
244 | * This cannot used outside of this module and only at at module_init | |
245 | * time. This is to avoid the need to do locking. | |
246 | */ | |
247 | static | |
248 | int i2400m_barker_db_add(u32 barker_id) | |
249 | { | |
250 | int result; | |
251 | ||
252 | struct i2400m_barker_db *barker; | |
253 | if (i2400m_barker_db_used >= i2400m_barker_db_size) { | |
254 | result = i2400m_zrealloc_2x( | |
255 | (void **) &i2400m_barker_db, &i2400m_barker_db_size, | |
256 | sizeof(i2400m_barker_db[0]), GFP_KERNEL); | |
257 | if (result < 0) | |
258 | return result; | |
259 | } | |
260 | barker = i2400m_barker_db + i2400m_barker_db_used++; | |
261 | barker->data[0] = le32_to_cpu(barker_id); | |
262 | barker->data[1] = le32_to_cpu(barker_id); | |
263 | barker->data[2] = le32_to_cpu(barker_id); | |
264 | barker->data[3] = le32_to_cpu(barker_id); | |
265 | return 0; | |
266 | } | |
267 | ||
268 | ||
269 | void i2400m_barker_db_exit(void) | |
270 | { | |
271 | kfree(i2400m_barker_db); | |
272 | i2400m_barker_db = NULL; | |
273 | i2400m_barker_db_size = 0; | |
274 | i2400m_barker_db_used = 0; | |
275 | } | |
276 | ||
277 | ||
278 | /* | |
279 | * Helper function to add all the known stable barkers to the barker | |
280 | * database. | |
281 | */ | |
282 | static | |
283 | int i2400m_barker_db_known_barkers(void) | |
284 | { | |
285 | int result; | |
286 | ||
287 | result = i2400m_barker_db_add(I2400M_NBOOT_BARKER); | |
288 | if (result < 0) | |
289 | goto error_add; | |
290 | result = i2400m_barker_db_add(I2400M_SBOOT_BARKER); | |
291 | if (result < 0) | |
292 | goto error_add; | |
7329012e DB |
293 | result = i2400m_barker_db_add(I2400M_SBOOT_BARKER_6050); |
294 | if (result < 0) | |
295 | goto error_add; | |
aba3792a IPG |
296 | error_add: |
297 | return result; | |
298 | } | |
299 | ||
300 | ||
301 | /* | |
302 | * Initialize the barker database | |
303 | * | |
304 | * This can only be used from the module_init function for this | |
305 | * module; this is to avoid the need to do locking. | |
306 | * | |
307 | * @options: command line argument with extra barkers to | |
308 | * recognize. This is a comma-separated list of 32-bit hex | |
309 | * numbers. They are appended to the existing list. Setting 0 | |
310 | * cleans the existing list and starts a new one. | |
311 | */ | |
312 | int i2400m_barker_db_init(const char *_options) | |
313 | { | |
314 | int result; | |
315 | char *options = NULL, *options_orig, *token; | |
316 | ||
317 | i2400m_barker_db = NULL; | |
318 | i2400m_barker_db_size = 0; | |
319 | i2400m_barker_db_used = 0; | |
320 | ||
321 | result = i2400m_barker_db_known_barkers(); | |
322 | if (result < 0) | |
323 | goto error_add; | |
324 | /* parse command line options from i2400m.barkers */ | |
325 | if (_options != NULL) { | |
326 | unsigned barker; | |
327 | ||
328 | options_orig = kstrdup(_options, GFP_KERNEL); | |
82a820e8 JL |
329 | if (options_orig == NULL) { |
330 | result = -ENOMEM; | |
aba3792a | 331 | goto error_parse; |
82a820e8 | 332 | } |
aba3792a IPG |
333 | options = options_orig; |
334 | ||
335 | while ((token = strsep(&options, ",")) != NULL) { | |
336 | if (*token == '\0') /* eat joint commas */ | |
337 | continue; | |
338 | if (sscanf(token, "%x", &barker) != 1 | |
339 | || barker > 0xffffffff) { | |
340 | printk(KERN_ERR "%s: can't recognize " | |
341 | "i2400m.barkers value '%s' as " | |
342 | "a 32-bit number\n", | |
343 | __func__, token); | |
344 | result = -EINVAL; | |
345 | goto error_parse; | |
346 | } | |
347 | if (barker == 0) { | |
348 | /* clean list and start new */ | |
349 | i2400m_barker_db_exit(); | |
350 | continue; | |
351 | } | |
352 | result = i2400m_barker_db_add(barker); | |
353 | if (result < 0) | |
44ef3a03 | 354 | goto error_parse_add; |
aba3792a IPG |
355 | } |
356 | kfree(options_orig); | |
357 | } | |
358 | return 0; | |
359 | ||
44ef3a03 | 360 | error_parse_add: |
aba3792a | 361 | error_parse: |
44ef3a03 | 362 | kfree(options_orig); |
aba3792a IPG |
363 | error_add: |
364 | kfree(i2400m_barker_db); | |
365 | return result; | |
366 | } | |
367 | ||
368 | ||
369 | /* | |
370 | * Recognize a boot barker | |
371 | * | |
372 | * @buf: buffer where the boot barker. | |
373 | * @buf_size: size of the buffer (has to be 16 bytes). It is passed | |
374 | * here so the function can check it for the caller. | |
375 | * | |
376 | * Note that as a side effect, upon identifying the obtained boot | |
377 | * barker, this function will set i2400m->barker to point to the right | |
378 | * barker database entry. Subsequent calls to the function will result | |
379 | * in verifying that the same type of boot barker is returned when the | |
380 | * device [re]boots (as long as the same device instance is used). | |
381 | * | |
382 | * Return: 0 if @buf matches a known boot barker. -ENOENT if the | |
383 | * buffer in @buf doesn't match any boot barker in the database or | |
384 | * -EILSEQ if the buffer doesn't have the right size. | |
385 | */ | |
386 | int i2400m_is_boot_barker(struct i2400m *i2400m, | |
387 | const void *buf, size_t buf_size) | |
388 | { | |
389 | int result; | |
390 | struct device *dev = i2400m_dev(i2400m); | |
391 | struct i2400m_barker_db *barker; | |
392 | int i; | |
393 | ||
394 | result = -ENOENT; | |
395 | if (buf_size != sizeof(i2400m_barker_db[i].data)) | |
396 | return result; | |
397 | ||
398 | /* Short circuit if we have already discovered the barker | |
399 | * associated with the device. */ | |
400 | if (i2400m->barker | |
401 | && !memcmp(buf, i2400m->barker, sizeof(i2400m->barker->data))) { | |
402 | unsigned index = (i2400m->barker - i2400m_barker_db) | |
403 | / sizeof(*i2400m->barker); | |
404 | d_printf(2, dev, "boot barker cache-confirmed #%u/%08x\n", | |
405 | index, le32_to_cpu(i2400m->barker->data[0])); | |
406 | return 0; | |
407 | } | |
408 | ||
409 | for (i = 0; i < i2400m_barker_db_used; i++) { | |
410 | barker = &i2400m_barker_db[i]; | |
411 | BUILD_BUG_ON(sizeof(barker->data) != 16); | |
412 | if (memcmp(buf, barker->data, sizeof(barker->data))) | |
413 | continue; | |
414 | ||
415 | if (i2400m->barker == NULL) { | |
416 | i2400m->barker = barker; | |
417 | d_printf(1, dev, "boot barker set to #%u/%08x\n", | |
418 | i, le32_to_cpu(barker->data[0])); | |
419 | if (barker->data[0] == le32_to_cpu(I2400M_NBOOT_BARKER)) | |
420 | i2400m->sboot = 0; | |
421 | else | |
422 | i2400m->sboot = 1; | |
423 | } else if (i2400m->barker != barker) { | |
424 | dev_err(dev, "HW inconsistency: device " | |
425 | "reports a different boot barker " | |
426 | "than set (from %08x to %08x)\n", | |
427 | le32_to_cpu(i2400m->barker->data[0]), | |
428 | le32_to_cpu(barker->data[0])); | |
429 | result = -EIO; | |
430 | } else | |
431 | d_printf(2, dev, "boot barker confirmed #%u/%08x\n", | |
432 | i, le32_to_cpu(barker->data[0])); | |
433 | result = 0; | |
434 | break; | |
435 | } | |
436 | return result; | |
437 | } | |
438 | EXPORT_SYMBOL_GPL(i2400m_is_boot_barker); | |
439 | ||
440 | ||
467cc396 IPG |
441 | /* |
442 | * Verify the ack data received | |
443 | * | |
444 | * Given a reply to a boot mode command, chew it and verify everything | |
445 | * is ok. | |
446 | * | |
447 | * @opcode: opcode which generated this ack. For error messages. | |
448 | * @ack: pointer to ack data we received | |
449 | * @ack_size: size of that data buffer | |
450 | * @flags: I2400M_BM_CMD_* flags we called the command with. | |
451 | * | |
452 | * Way too long function -- maybe it should be further split | |
453 | */ | |
454 | static | |
455 | ssize_t __i2400m_bm_ack_verify(struct i2400m *i2400m, int opcode, | |
456 | struct i2400m_bootrom_header *ack, | |
457 | size_t ack_size, int flags) | |
458 | { | |
459 | ssize_t result = -ENOMEM; | |
460 | struct device *dev = i2400m_dev(i2400m); | |
461 | ||
462 | d_fnstart(8, dev, "(i2400m %p opcode %d ack %p size %zu)\n", | |
463 | i2400m, opcode, ack, ack_size); | |
464 | if (ack_size < sizeof(*ack)) { | |
465 | result = -EIO; | |
466 | dev_err(dev, "boot-mode cmd %d: HW BUG? notification didn't " | |
467 | "return enough data (%zu bytes vs %zu expected)\n", | |
468 | opcode, ack_size, sizeof(*ack)); | |
469 | goto error_ack_short; | |
470 | } | |
aba3792a IPG |
471 | result = i2400m_is_boot_barker(i2400m, ack, ack_size); |
472 | if (result >= 0) { | |
467cc396 | 473 | result = -ERESTARTSYS; |
aba3792a | 474 | d_printf(6, dev, "boot-mode cmd %d: HW boot barker\n", opcode); |
467cc396 IPG |
475 | goto error_reboot; |
476 | } | |
477 | if (ack_size == sizeof(i2400m_ACK_BARKER) | |
478 | && memcmp(ack, i2400m_ACK_BARKER, sizeof(*ack)) == 0) { | |
479 | result = -EISCONN; | |
480 | d_printf(3, dev, "boot-mode cmd %d: HW reboot ack barker\n", | |
481 | opcode); | |
482 | goto error_reboot_ack; | |
483 | } | |
484 | result = 0; | |
485 | if (flags & I2400M_BM_CMD_RAW) | |
486 | goto out_raw; | |
487 | ack->data_size = le32_to_cpu(ack->data_size); | |
488 | ack->target_addr = le32_to_cpu(ack->target_addr); | |
489 | ack->block_checksum = le32_to_cpu(ack->block_checksum); | |
490 | d_printf(5, dev, "boot-mode cmd %d: notification for opcode %u " | |
491 | "response %u csum %u rr %u da %u\n", | |
492 | opcode, i2400m_brh_get_opcode(ack), | |
493 | i2400m_brh_get_response(ack), | |
494 | i2400m_brh_get_use_checksum(ack), | |
495 | i2400m_brh_get_response_required(ack), | |
496 | i2400m_brh_get_direct_access(ack)); | |
497 | result = -EIO; | |
498 | if (i2400m_brh_get_signature(ack) != 0xcbbc) { | |
499 | dev_err(dev, "boot-mode cmd %d: HW BUG? wrong signature " | |
500 | "0x%04x\n", opcode, i2400m_brh_get_signature(ack)); | |
501 | goto error_ack_signature; | |
502 | } | |
503 | if (opcode != -1 && opcode != i2400m_brh_get_opcode(ack)) { | |
504 | dev_err(dev, "boot-mode cmd %d: HW BUG? " | |
505 | "received response for opcode %u, expected %u\n", | |
506 | opcode, i2400m_brh_get_opcode(ack), opcode); | |
507 | goto error_ack_opcode; | |
508 | } | |
509 | if (i2400m_brh_get_response(ack) != 0) { /* failed? */ | |
510 | dev_err(dev, "boot-mode cmd %d: error; hw response %u\n", | |
511 | opcode, i2400m_brh_get_response(ack)); | |
512 | goto error_ack_failed; | |
513 | } | |
514 | if (ack_size < ack->data_size + sizeof(*ack)) { | |
515 | dev_err(dev, "boot-mode cmd %d: SW BUG " | |
516 | "driver provided only %zu bytes for %zu bytes " | |
517 | "of data\n", opcode, ack_size, | |
518 | (size_t) le32_to_cpu(ack->data_size) + sizeof(*ack)); | |
519 | goto error_ack_short_buffer; | |
520 | } | |
521 | result = ack_size; | |
522 | /* Don't you love this stack of empty targets? Well, I don't | |
523 | * either, but it helps track exactly who comes in here and | |
524 | * why :) */ | |
525 | error_ack_short_buffer: | |
526 | error_ack_failed: | |
527 | error_ack_opcode: | |
528 | error_ack_signature: | |
529 | out_raw: | |
530 | error_reboot_ack: | |
531 | error_reboot: | |
532 | error_ack_short: | |
533 | d_fnend(8, dev, "(i2400m %p opcode %d ack %p size %zu) = %d\n", | |
534 | i2400m, opcode, ack, ack_size, (int) result); | |
535 | return result; | |
536 | } | |
537 | ||
538 | ||
539 | /** | |
540 | * i2400m_bm_cmd - Execute a boot mode command | |
541 | * | |
542 | * @cmd: buffer containing the command data (pointing at the header). | |
543 | * This data can be ANYWHERE (for USB, we will copy it to an | |
544 | * specific buffer). Make sure everything is in proper little | |
545 | * endian. | |
546 | * | |
547 | * A raw buffer can be also sent, just cast it and set flags to | |
548 | * I2400M_BM_CMD_RAW. | |
549 | * | |
550 | * This function will generate a checksum for you if the | |
551 | * checksum bit in the command is set (unless I2400M_BM_CMD_RAW | |
552 | * is set). | |
553 | * | |
554 | * You can use the i2400m->bm_cmd_buf to stage your commands and | |
555 | * send them. | |
556 | * | |
557 | * If NULL, no command is sent (we just wait for an ack). | |
558 | * | |
559 | * @cmd_size: size of the command. Will be auto padded to the | |
560 | * bus-specific drivers padding requirements. | |
561 | * | |
562 | * @ack: buffer where to place the acknowledgement. If it is a regular | |
563 | * command response, all fields will be returned with the right, | |
564 | * native endianess. | |
565 | * | |
566 | * You *cannot* use i2400m->bm_ack_buf for this buffer. | |
567 | * | |
568 | * @ack_size: size of @ack, 16 aligned; you need to provide at least | |
569 | * sizeof(*ack) bytes and then enough to contain the return data | |
570 | * from the command | |
571 | * | |
572 | * @flags: see I2400M_BM_CMD_* above. | |
573 | * | |
574 | * @returns: bytes received by the notification; if < 0, an errno code | |
575 | * denoting an error or: | |
576 | * | |
577 | * -ERESTARTSYS The device has rebooted | |
578 | * | |
579 | * Executes a boot-mode command and waits for a response, doing basic | |
580 | * validation on it; if a zero length response is received, it retries | |
581 | * waiting for a response until a non-zero one is received (timing out | |
582 | * after %I2400M_BOOT_RETRIES retries). | |
583 | */ | |
584 | static | |
585 | ssize_t i2400m_bm_cmd(struct i2400m *i2400m, | |
586 | const struct i2400m_bootrom_header *cmd, size_t cmd_size, | |
587 | struct i2400m_bootrom_header *ack, size_t ack_size, | |
588 | int flags) | |
589 | { | |
590 | ssize_t result = -ENOMEM, rx_bytes; | |
591 | struct device *dev = i2400m_dev(i2400m); | |
592 | int opcode = cmd == NULL ? -1 : i2400m_brh_get_opcode(cmd); | |
593 | ||
594 | d_fnstart(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu)\n", | |
595 | i2400m, cmd, cmd_size, ack, ack_size); | |
596 | BUG_ON(ack_size < sizeof(*ack)); | |
597 | BUG_ON(i2400m->boot_mode == 0); | |
598 | ||
599 | if (cmd != NULL) { /* send the command */ | |
467cc396 IPG |
600 | result = i2400m->bus_bm_cmd_send(i2400m, cmd, cmd_size, flags); |
601 | if (result < 0) | |
602 | goto error_cmd_send; | |
603 | if ((flags & I2400M_BM_CMD_RAW) == 0) | |
604 | d_printf(5, dev, | |
605 | "boot-mode cmd %d csum %u rr %u da %u: " | |
606 | "addr 0x%04x size %u block csum 0x%04x\n", | |
607 | opcode, i2400m_brh_get_use_checksum(cmd), | |
608 | i2400m_brh_get_response_required(cmd), | |
609 | i2400m_brh_get_direct_access(cmd), | |
610 | cmd->target_addr, cmd->data_size, | |
611 | cmd->block_checksum); | |
612 | } | |
613 | result = i2400m->bus_bm_wait_for_ack(i2400m, ack, ack_size); | |
614 | if (result < 0) { | |
615 | dev_err(dev, "boot-mode cmd %d: error waiting for an ack: %d\n", | |
616 | opcode, (int) result); /* bah, %zd doesn't work */ | |
617 | goto error_wait_for_ack; | |
618 | } | |
619 | rx_bytes = result; | |
3ad2f3fb | 620 | /* verify the ack and read more if necessary [result is the |
467cc396 IPG |
621 | * final amount of bytes we get in the ack] */ |
622 | result = __i2400m_bm_ack_verify(i2400m, opcode, ack, ack_size, flags); | |
623 | if (result < 0) | |
624 | goto error_bad_ack; | |
625 | /* Don't you love this stack of empty targets? Well, I don't | |
626 | * either, but it helps track exactly who comes in here and | |
627 | * why :) */ | |
628 | result = rx_bytes; | |
629 | error_bad_ack: | |
630 | error_wait_for_ack: | |
631 | error_cmd_send: | |
632 | d_fnend(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu) = %d\n", | |
633 | i2400m, cmd, cmd_size, ack, ack_size, (int) result); | |
634 | return result; | |
635 | } | |
636 | ||
637 | ||
638 | /** | |
639 | * i2400m_download_chunk - write a single chunk of data to the device's memory | |
640 | * | |
641 | * @i2400m: device descriptor | |
642 | * @buf: the buffer to write | |
643 | * @buf_len: length of the buffer to write | |
644 | * @addr: address in the device memory space | |
645 | * @direct: bootrom write mode | |
646 | * @do_csum: should a checksum validation be performed | |
647 | */ | |
648 | static int i2400m_download_chunk(struct i2400m *i2400m, const void *chunk, | |
649 | size_t __chunk_len, unsigned long addr, | |
650 | unsigned int direct, unsigned int do_csum) | |
651 | { | |
652 | int ret; | |
8593a196 | 653 | size_t chunk_len = ALIGN(__chunk_len, I2400M_PL_ALIGN); |
467cc396 IPG |
654 | struct device *dev = i2400m_dev(i2400m); |
655 | struct { | |
656 | struct i2400m_bootrom_header cmd; | |
365ff9df | 657 | u8 cmd_payload[]; |
ba2d3587 | 658 | } __packed *buf; |
467cc396 IPG |
659 | struct i2400m_bootrom_header ack; |
660 | ||
661 | d_fnstart(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx " | |
662 | "direct %u do_csum %u)\n", i2400m, chunk, __chunk_len, | |
663 | addr, direct, do_csum); | |
664 | buf = i2400m->bm_cmd_buf; | |
665 | memcpy(buf->cmd_payload, chunk, __chunk_len); | |
666 | memset(buf->cmd_payload + __chunk_len, 0xad, chunk_len - __chunk_len); | |
667 | ||
668 | buf->cmd.command = i2400m_brh_command(I2400M_BRH_WRITE, | |
669 | __chunk_len & 0x3 ? 0 : do_csum, | |
670 | __chunk_len & 0xf ? 0 : direct); | |
671 | buf->cmd.target_addr = cpu_to_le32(addr); | |
672 | buf->cmd.data_size = cpu_to_le32(__chunk_len); | |
673 | ret = i2400m_bm_cmd(i2400m, &buf->cmd, sizeof(buf->cmd) + chunk_len, | |
674 | &ack, sizeof(ack), 0); | |
675 | if (ret >= 0) | |
676 | ret = 0; | |
677 | d_fnend(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx " | |
678 | "direct %u do_csum %u) = %d\n", i2400m, chunk, __chunk_len, | |
679 | addr, direct, do_csum, ret); | |
680 | return ret; | |
681 | } | |
682 | ||
683 | ||
684 | /* | |
685 | * Download a BCF file's sections to the device | |
686 | * | |
687 | * @i2400m: device descriptor | |
10607c86 IPG |
688 | * @bcf: pointer to firmware data (first header followed by the |
689 | * payloads). Assumed verified and consistent. | |
467cc396 IPG |
690 | * @bcf_len: length (in bytes) of the @bcf buffer. |
691 | * | |
692 | * Returns: < 0 errno code on error or the offset to the jump instruction. | |
693 | * | |
694 | * Given a BCF file, downloads each section (a command and a payload) | |
695 | * to the device's address space. Actually, it just executes each | |
696 | * command i the BCF file. | |
697 | * | |
698 | * The section size has to be aligned to 4 bytes AND the padding has | |
699 | * to be taken from the firmware file, as the signature takes it into | |
700 | * account. | |
701 | */ | |
702 | static | |
703 | ssize_t i2400m_dnload_bcf(struct i2400m *i2400m, | |
704 | const struct i2400m_bcf_hdr *bcf, size_t bcf_len) | |
705 | { | |
706 | ssize_t ret; | |
707 | struct device *dev = i2400m_dev(i2400m); | |
708 | size_t offset, /* iterator offset */ | |
709 | data_size, /* Size of the data payload */ | |
710 | section_size, /* Size of the whole section (cmd + payload) */ | |
711 | section = 1; | |
712 | const struct i2400m_bootrom_header *bh; | |
713 | struct i2400m_bootrom_header ack; | |
714 | ||
715 | d_fnstart(3, dev, "(i2400m %p bcf %p bcf_len %zu)\n", | |
716 | i2400m, bcf, bcf_len); | |
717 | /* Iterate over the command blocks in the BCF file that start | |
718 | * after the header */ | |
719 | offset = le32_to_cpu(bcf->header_len) * sizeof(u32); | |
720 | while (1) { /* start sending the file */ | |
721 | bh = (void *) bcf + offset; | |
722 | data_size = le32_to_cpu(bh->data_size); | |
723 | section_size = ALIGN(sizeof(*bh) + data_size, 4); | |
724 | d_printf(7, dev, | |
725 | "downloading section #%zu (@%zu %zu B) to 0x%08x\n", | |
726 | section, offset, sizeof(*bh) + data_size, | |
727 | le32_to_cpu(bh->target_addr)); | |
6f4fc90a CK |
728 | /* |
729 | * We look for JUMP cmd from the bootmode header, | |
730 | * either I2400M_BRH_SIGNED_JUMP for secure boot | |
731 | * or I2400M_BRH_JUMP for unsecure boot, the last chunk | |
732 | * should be the bootmode header with JUMP cmd. | |
733 | */ | |
734 | if (i2400m_brh_get_opcode(bh) == I2400M_BRH_SIGNED_JUMP || | |
735 | i2400m_brh_get_opcode(bh) == I2400M_BRH_JUMP) { | |
736 | d_printf(5, dev, "jump found @%zu\n", offset); | |
467cc396 IPG |
737 | break; |
738 | } | |
467cc396 IPG |
739 | if (offset + section_size > bcf_len) { |
740 | dev_err(dev, "fw %s: bad section #%zu, " | |
741 | "end (@%zu) beyond EOF (@%zu)\n", | |
1039abbc | 742 | i2400m->fw_name, section, |
467cc396 IPG |
743 | offset + section_size, bcf_len); |
744 | ret = -EINVAL; | |
745 | goto error_section_beyond_eof; | |
746 | } | |
747 | __i2400m_msleep(20); | |
748 | ret = i2400m_bm_cmd(i2400m, bh, section_size, | |
749 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
750 | if (ret < 0) { | |
751 | dev_err(dev, "fw %s: section #%zu (@%zu %zu B) " | |
1039abbc | 752 | "failed %d\n", i2400m->fw_name, section, |
467cc396 IPG |
753 | offset, sizeof(*bh) + data_size, (int) ret); |
754 | goto error_send; | |
755 | } | |
756 | offset += section_size; | |
757 | section++; | |
758 | } | |
759 | ret = offset; | |
760 | error_section_beyond_eof: | |
761 | error_send: | |
762 | d_fnend(3, dev, "(i2400m %p bcf %p bcf_len %zu) = %d\n", | |
763 | i2400m, bcf, bcf_len, (int) ret); | |
764 | return ret; | |
765 | } | |
766 | ||
767 | ||
32742e61 IPG |
768 | /* |
769 | * Indicate if the device emitted a reboot barker that indicates | |
770 | * "signed boot" | |
771 | */ | |
772 | static | |
773 | unsigned i2400m_boot_is_signed(struct i2400m *i2400m) | |
774 | { | |
775 | return likely(i2400m->sboot); | |
776 | } | |
777 | ||
778 | ||
467cc396 IPG |
779 | /* |
780 | * Do the final steps of uploading firmware | |
781 | * | |
10607c86 IPG |
782 | * @bcf_hdr: BCF header we are actually using |
783 | * @bcf: pointer to the firmware image (which matches the first header | |
784 | * that is followed by the actual payloads). | |
785 | * @offset: [byte] offset into @bcf for the command we need to send. | |
786 | * | |
467cc396 IPG |
787 | * Depending on the boot mode (signed vs non-signed), different |
788 | * actions need to be taken. | |
789 | */ | |
790 | static | |
791 | int i2400m_dnload_finalize(struct i2400m *i2400m, | |
10607c86 | 792 | const struct i2400m_bcf_hdr *bcf_hdr, |
467cc396 IPG |
793 | const struct i2400m_bcf_hdr *bcf, size_t offset) |
794 | { | |
795 | int ret = 0; | |
796 | struct device *dev = i2400m_dev(i2400m); | |
797 | struct i2400m_bootrom_header *cmd, ack; | |
798 | struct { | |
799 | struct i2400m_bootrom_header cmd; | |
800 | u8 cmd_pl[0]; | |
ba2d3587 | 801 | } __packed *cmd_buf; |
467cc396 IPG |
802 | size_t signature_block_offset, signature_block_size; |
803 | ||
804 | d_fnstart(3, dev, "offset %zu\n", offset); | |
805 | cmd = (void *) bcf + offset; | |
32742e61 | 806 | if (i2400m_boot_is_signed(i2400m) == 0) { |
467cc396 | 807 | struct i2400m_bootrom_header jump_ack; |
ead68239 | 808 | d_printf(1, dev, "unsecure boot, jumping to 0x%08x\n", |
467cc396 | 809 | le32_to_cpu(cmd->target_addr)); |
8d8fe198 CK |
810 | cmd_buf = i2400m->bm_cmd_buf; |
811 | memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd)); | |
812 | cmd = &cmd_buf->cmd; | |
813 | /* now cmd points to the actual bootrom_header in cmd_buf */ | |
467cc396 IPG |
814 | i2400m_brh_set_opcode(cmd, I2400M_BRH_JUMP); |
815 | cmd->data_size = 0; | |
816 | ret = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
817 | &jump_ack, sizeof(jump_ack), 0); | |
818 | } else { | |
ead68239 | 819 | d_printf(1, dev, "secure boot, jumping to 0x%08x\n", |
467cc396 IPG |
820 | le32_to_cpu(cmd->target_addr)); |
821 | cmd_buf = i2400m->bm_cmd_buf; | |
822 | memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd)); | |
823 | signature_block_offset = | |
10607c86 IPG |
824 | sizeof(*bcf_hdr) |
825 | + le32_to_cpu(bcf_hdr->key_size) * sizeof(u32) | |
826 | + le32_to_cpu(bcf_hdr->exponent_size) * sizeof(u32); | |
467cc396 | 827 | signature_block_size = |
10607c86 IPG |
828 | le32_to_cpu(bcf_hdr->modulus_size) * sizeof(u32); |
829 | memcpy(cmd_buf->cmd_pl, | |
830 | (void *) bcf_hdr + signature_block_offset, | |
467cc396 IPG |
831 | signature_block_size); |
832 | ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, | |
833 | sizeof(cmd_buf->cmd) + signature_block_size, | |
834 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
835 | } | |
836 | d_fnend(3, dev, "returning %d\n", ret); | |
837 | return ret; | |
838 | } | |
839 | ||
840 | ||
841 | /** | |
842 | * i2400m_bootrom_init - Reboots a powered device into boot mode | |
843 | * | |
844 | * @i2400m: device descriptor | |
845 | * @flags: | |
923d708f | 846 | * I2400M_BRI_SOFT: a reboot barker has been seen |
467cc396 IPG |
847 | * already, so don't wait for it. |
848 | * | |
849 | * I2400M_BRI_NO_REBOOT: Don't send a reboot command, but wait | |
850 | * for a reboot barker notification. This is a one shot; if | |
851 | * the state machine needs to send a reboot command it will. | |
852 | * | |
853 | * Returns: | |
854 | * | |
855 | * < 0 errno code on error, 0 if ok. | |
856 | * | |
467cc396 IPG |
857 | * Description: |
858 | * | |
859 | * Tries hard enough to put the device in boot-mode. There are two | |
860 | * main phases to this: | |
861 | * | |
862 | * a. (1) send a reboot command and (2) get a reboot barker | |
923d708f IPG |
863 | * |
864 | * b. (1) echo/ack the reboot sending the reboot barker back and (2) | |
865 | * getting an ack barker in return | |
467cc396 IPG |
866 | * |
867 | * We want to skip (a) in some cases [soft]. The state machine is | |
868 | * horrible, but it is basically: on each phase, send what has to be | |
869 | * sent (if any), wait for the answer and act on the answer. We might | |
870 | * have to backtrack and retry, so we keep a max tries counter for | |
871 | * that. | |
872 | * | |
923d708f IPG |
873 | * It sucks because we don't know ahead of time which is going to be |
874 | * the reboot barker (the device might send different ones depending | |
875 | * on its EEPROM config) and once the device reboots and waits for the | |
876 | * echo/ack reboot barker being sent back, it doesn't understand | |
877 | * anything else. So we can be left at the point where we don't know | |
878 | * what to send to it -- cold reset and bus reset seem to have little | |
879 | * effect. So the function iterates (in this case) through all the | |
880 | * known barkers and tries them all until an ACK is | |
881 | * received. Otherwise, it gives up. | |
882 | * | |
467cc396 IPG |
883 | * If we get a timeout after sending a warm reset, we do it again. |
884 | */ | |
885 | int i2400m_bootrom_init(struct i2400m *i2400m, enum i2400m_bri flags) | |
886 | { | |
887 | int result; | |
888 | struct device *dev = i2400m_dev(i2400m); | |
889 | struct i2400m_bootrom_header *cmd; | |
890 | struct i2400m_bootrom_header ack; | |
c3083658 | 891 | int count = i2400m->bus_bm_retries; |
467cc396 | 892 | int ack_timeout_cnt = 1; |
923d708f | 893 | unsigned i; |
467cc396 | 894 | |
aba3792a | 895 | BUILD_BUG_ON(sizeof(*cmd) != sizeof(i2400m_barker_db[0].data)); |
467cc396 IPG |
896 | BUILD_BUG_ON(sizeof(ack) != sizeof(i2400m_ACK_BARKER)); |
897 | ||
898 | d_fnstart(4, dev, "(i2400m %p flags 0x%08x)\n", i2400m, flags); | |
899 | result = -ENOMEM; | |
900 | cmd = i2400m->bm_cmd_buf; | |
901 | if (flags & I2400M_BRI_SOFT) | |
902 | goto do_reboot_ack; | |
903 | do_reboot: | |
923d708f | 904 | ack_timeout_cnt = 1; |
467cc396 IPG |
905 | if (--count < 0) |
906 | goto error_timeout; | |
907 | d_printf(4, dev, "device reboot: reboot command [%d # left]\n", | |
908 | count); | |
909 | if ((flags & I2400M_BRI_NO_REBOOT) == 0) | |
c931ceeb | 910 | i2400m_reset(i2400m, I2400M_RT_WARM); |
467cc396 IPG |
911 | result = i2400m_bm_cmd(i2400m, NULL, 0, &ack, sizeof(ack), |
912 | I2400M_BM_CMD_RAW); | |
913 | flags &= ~I2400M_BRI_NO_REBOOT; | |
914 | switch (result) { | |
915 | case -ERESTARTSYS: | |
923d708f IPG |
916 | /* |
917 | * at this point, i2400m_bm_cmd(), through | |
918 | * __i2400m_bm_ack_process(), has updated | |
919 | * i2400m->barker and we are good to go. | |
920 | */ | |
467cc396 IPG |
921 | d_printf(4, dev, "device reboot: got reboot barker\n"); |
922 | break; | |
923 | case -EISCONN: /* we don't know how it got here...but we follow it */ | |
924 | d_printf(4, dev, "device reboot: got ack barker - whatever\n"); | |
925 | goto do_reboot; | |
923d708f IPG |
926 | case -ETIMEDOUT: |
927 | /* | |
928 | * Device has timed out, we might be in boot mode | |
929 | * already and expecting an ack; if we don't know what | |
930 | * the barker is, we just send them all. Cold reset | |
931 | * and bus reset don't work. Beats me. | |
932 | */ | |
933 | if (i2400m->barker != NULL) { | |
934 | dev_err(dev, "device boot: reboot barker timed out, " | |
935 | "trying (set) %08x echo/ack\n", | |
936 | le32_to_cpu(i2400m->barker->data[0])); | |
aba3792a IPG |
937 | goto do_reboot_ack; |
938 | } | |
923d708f IPG |
939 | for (i = 0; i < i2400m_barker_db_used; i++) { |
940 | struct i2400m_barker_db *barker = &i2400m_barker_db[i]; | |
941 | memcpy(cmd, barker->data, sizeof(barker->data)); | |
942 | result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
943 | &ack, sizeof(ack), | |
944 | I2400M_BM_CMD_RAW); | |
945 | if (result == -EISCONN) { | |
946 | dev_warn(dev, "device boot: got ack barker " | |
947 | "after sending echo/ack barker " | |
948 | "#%d/%08x; rebooting j.i.c.\n", | |
949 | i, le32_to_cpu(barker->data[0])); | |
950 | flags &= ~I2400M_BRI_NO_REBOOT; | |
951 | goto do_reboot; | |
952 | } | |
953 | } | |
954 | dev_err(dev, "device boot: tried all the echo/acks, could " | |
955 | "not get device to respond; giving up"); | |
956 | result = -ESHUTDOWN; | |
467cc396 IPG |
957 | case -EPROTO: |
958 | case -ESHUTDOWN: /* dev is gone */ | |
959 | case -EINTR: /* user cancelled */ | |
960 | goto error_dev_gone; | |
961 | default: | |
962 | dev_err(dev, "device reboot: error %d while waiting " | |
963 | "for reboot barker - rebooting\n", result); | |
923d708f | 964 | d_dump(1, dev, &ack, result); |
467cc396 IPG |
965 | goto do_reboot; |
966 | } | |
967 | /* At this point we ack back with 4 REBOOT barkers and expect | |
968 | * 4 ACK barkers. This is ugly, as we send a raw command -- | |
969 | * hence the cast. _bm_cmd() will catch the reboot ack | |
970 | * notification and report it as -EISCONN. */ | |
971 | do_reboot_ack: | |
972 | d_printf(4, dev, "device reboot ack: sending ack [%d # left]\n", count); | |
aba3792a | 973 | memcpy(cmd, i2400m->barker->data, sizeof(i2400m->barker->data)); |
467cc396 IPG |
974 | result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), |
975 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
976 | switch (result) { | |
977 | case -ERESTARTSYS: | |
978 | d_printf(4, dev, "reboot ack: got reboot barker - retrying\n"); | |
979 | if (--count < 0) | |
980 | goto error_timeout; | |
981 | goto do_reboot_ack; | |
982 | case -EISCONN: | |
983 | d_printf(4, dev, "reboot ack: got ack barker - good\n"); | |
984 | break; | |
985 | case -ETIMEDOUT: /* no response, maybe it is the other type? */ | |
aba3792a IPG |
986 | if (ack_timeout_cnt-- < 0) { |
987 | d_printf(4, dev, "reboot ack timedout: retrying\n"); | |
467cc396 IPG |
988 | goto do_reboot_ack; |
989 | } else { | |
990 | dev_err(dev, "reboot ack timedout too long: " | |
991 | "trying reboot\n"); | |
992 | goto do_reboot; | |
993 | } | |
994 | break; | |
995 | case -EPROTO: | |
996 | case -ESHUTDOWN: /* dev is gone */ | |
997 | goto error_dev_gone; | |
998 | default: | |
999 | dev_err(dev, "device reboot ack: error %d while waiting for " | |
1000 | "reboot ack barker - rebooting\n", result); | |
1001 | goto do_reboot; | |
1002 | } | |
1003 | d_printf(2, dev, "device reboot ack: got ack barker - boot done\n"); | |
1004 | result = 0; | |
1005 | exit_timeout: | |
1006 | error_dev_gone: | |
1007 | d_fnend(4, dev, "(i2400m %p flags 0x%08x) = %d\n", | |
1008 | i2400m, flags, result); | |
1009 | return result; | |
1010 | ||
1011 | error_timeout: | |
6e053d6c | 1012 | dev_err(dev, "Timed out waiting for reboot ack\n"); |
467cc396 IPG |
1013 | result = -ETIMEDOUT; |
1014 | goto exit_timeout; | |
1015 | } | |
1016 | ||
1017 | ||
1018 | /* | |
1019 | * Read the MAC addr | |
1020 | * | |
1021 | * The position this function reads is fixed in device memory and | |
1022 | * always available, even without firmware. | |
1023 | * | |
1024 | * Note we specify we want to read only six bytes, but provide space | |
1025 | * for 16, as we always get it rounded up. | |
1026 | */ | |
1027 | int i2400m_read_mac_addr(struct i2400m *i2400m) | |
1028 | { | |
1029 | int result; | |
1030 | struct device *dev = i2400m_dev(i2400m); | |
1031 | struct net_device *net_dev = i2400m->wimax_dev.net_dev; | |
1032 | struct i2400m_bootrom_header *cmd; | |
1033 | struct { | |
1034 | struct i2400m_bootrom_header ack; | |
1035 | u8 ack_pl[16]; | |
ba2d3587 | 1036 | } __packed ack_buf; |
467cc396 IPG |
1037 | |
1038 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); | |
1039 | cmd = i2400m->bm_cmd_buf; | |
1040 | cmd->command = i2400m_brh_command(I2400M_BRH_READ, 0, 1); | |
1041 | cmd->target_addr = cpu_to_le32(0x00203fe8); | |
1042 | cmd->data_size = cpu_to_le32(6); | |
1043 | result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
1044 | &ack_buf.ack, sizeof(ack_buf), 0); | |
1045 | if (result < 0) { | |
1046 | dev_err(dev, "BM: read mac addr failed: %d\n", result); | |
1047 | goto error_read_mac; | |
1048 | } | |
595acf27 | 1049 | d_printf(2, dev, "mac addr is %pM\n", ack_buf.ack_pl); |
467cc396 IPG |
1050 | if (i2400m->bus_bm_mac_addr_impaired == 1) { |
1051 | ack_buf.ack_pl[0] = 0x00; | |
1052 | ack_buf.ack_pl[1] = 0x16; | |
1053 | ack_buf.ack_pl[2] = 0xd3; | |
1054 | get_random_bytes(&ack_buf.ack_pl[3], 3); | |
1055 | dev_err(dev, "BM is MAC addr impaired, faking MAC addr to " | |
595acf27 | 1056 | "mac addr is %pM\n", ack_buf.ack_pl); |
467cc396 IPG |
1057 | result = 0; |
1058 | } | |
1059 | net_dev->addr_len = ETH_ALEN; | |
467cc396 IPG |
1060 | memcpy(net_dev->dev_addr, ack_buf.ack_pl, ETH_ALEN); |
1061 | error_read_mac: | |
1062 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, result); | |
1063 | return result; | |
1064 | } | |
1065 | ||
1066 | ||
1067 | /* | |
1068 | * Initialize a non signed boot | |
1069 | * | |
1070 | * This implies sending some magic values to the device's memory. Note | |
1071 | * we convert the values to little endian in the same array | |
1072 | * declaration. | |
1073 | */ | |
1074 | static | |
1075 | int i2400m_dnload_init_nonsigned(struct i2400m *i2400m) | |
1076 | { | |
7308a0c2 DB |
1077 | unsigned i = 0; |
1078 | int ret = 0; | |
467cc396 | 1079 | struct device *dev = i2400m_dev(i2400m); |
467cc396 | 1080 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); |
7308a0c2 DB |
1081 | if (i2400m->bus_bm_pokes_table) { |
1082 | while (i2400m->bus_bm_pokes_table[i].address) { | |
1083 | ret = i2400m_download_chunk( | |
1084 | i2400m, | |
1085 | &i2400m->bus_bm_pokes_table[i].data, | |
1086 | sizeof(i2400m->bus_bm_pokes_table[i].data), | |
1087 | i2400m->bus_bm_pokes_table[i].address, 1, 1); | |
1088 | if (ret < 0) | |
1089 | break; | |
1090 | i++; | |
1091 | } | |
467cc396 IPG |
1092 | } |
1093 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret); | |
1094 | return ret; | |
1095 | } | |
1096 | ||
1097 | ||
1098 | /* | |
1099 | * Initialize the signed boot process | |
1100 | * | |
1101 | * @i2400m: device descriptor | |
1102 | * | |
1103 | * @bcf_hdr: pointer to the firmware header; assumes it is fully in | |
1104 | * memory (it has gone through basic validation). | |
1105 | * | |
1106 | * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw | |
1107 | * rebooted. | |
1108 | * | |
1109 | * This writes the firmware BCF header to the device using the | |
1110 | * HASH_PAYLOAD_ONLY command. | |
1111 | */ | |
1112 | static | |
1113 | int i2400m_dnload_init_signed(struct i2400m *i2400m, | |
1114 | const struct i2400m_bcf_hdr *bcf_hdr) | |
1115 | { | |
1116 | int ret; | |
1117 | struct device *dev = i2400m_dev(i2400m); | |
1118 | struct { | |
1119 | struct i2400m_bootrom_header cmd; | |
1120 | struct i2400m_bcf_hdr cmd_pl; | |
ba2d3587 | 1121 | } __packed *cmd_buf; |
467cc396 IPG |
1122 | struct i2400m_bootrom_header ack; |
1123 | ||
1124 | d_fnstart(5, dev, "(i2400m %p bcf_hdr %p)\n", i2400m, bcf_hdr); | |
1125 | cmd_buf = i2400m->bm_cmd_buf; | |
1126 | cmd_buf->cmd.command = | |
1127 | i2400m_brh_command(I2400M_BRH_HASH_PAYLOAD_ONLY, 0, 0); | |
1128 | cmd_buf->cmd.target_addr = 0; | |
1129 | cmd_buf->cmd.data_size = cpu_to_le32(sizeof(cmd_buf->cmd_pl)); | |
1130 | memcpy(&cmd_buf->cmd_pl, bcf_hdr, sizeof(*bcf_hdr)); | |
1131 | ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, sizeof(*cmd_buf), | |
1132 | &ack, sizeof(ack), 0); | |
1133 | if (ret >= 0) | |
1134 | ret = 0; | |
1135 | d_fnend(5, dev, "(i2400m %p bcf_hdr %p) = %d\n", i2400m, bcf_hdr, ret); | |
1136 | return ret; | |
1137 | } | |
1138 | ||
1139 | ||
1140 | /* | |
1141 | * Initialize the firmware download at the device size | |
1142 | * | |
1143 | * Multiplex to the one that matters based on the device's mode | |
1144 | * (signed or non-signed). | |
1145 | */ | |
1146 | static | |
10607c86 IPG |
1147 | int i2400m_dnload_init(struct i2400m *i2400m, |
1148 | const struct i2400m_bcf_hdr *bcf_hdr) | |
467cc396 IPG |
1149 | { |
1150 | int result; | |
1151 | struct device *dev = i2400m_dev(i2400m); | |
467cc396 | 1152 | |
32742e61 IPG |
1153 | if (i2400m_boot_is_signed(i2400m)) { |
1154 | d_printf(1, dev, "signed boot\n"); | |
10607c86 | 1155 | result = i2400m_dnload_init_signed(i2400m, bcf_hdr); |
467cc396 IPG |
1156 | if (result == -ERESTARTSYS) |
1157 | return result; | |
1158 | if (result < 0) | |
32742e61 | 1159 | dev_err(dev, "firmware %s: signed boot download " |
467cc396 | 1160 | "initialization failed: %d\n", |
1039abbc | 1161 | i2400m->fw_name, result); |
32742e61 IPG |
1162 | } else { |
1163 | /* non-signed boot process without pokes */ | |
1164 | d_printf(1, dev, "non-signed boot\n"); | |
1165 | result = i2400m_dnload_init_nonsigned(i2400m); | |
467cc396 IPG |
1166 | if (result == -ERESTARTSYS) |
1167 | return result; | |
1168 | if (result < 0) | |
32742e61 | 1169 | dev_err(dev, "firmware %s: non-signed download " |
467cc396 | 1170 | "initialization failed: %d\n", |
1039abbc | 1171 | i2400m->fw_name, result); |
467cc396 IPG |
1172 | } |
1173 | return result; | |
1174 | } | |
1175 | ||
1176 | ||
1177 | /* | |
bfc44187 | 1178 | * Run consistency tests on the firmware file and load up headers |
467cc396 IPG |
1179 | * |
1180 | * Check for the firmware being made for the i2400m device, | |
1181 | * etc...These checks are mostly informative, as the device will make | |
1182 | * them too; but the driver's response is more informative on what | |
1183 | * went wrong. | |
bfc44187 IPG |
1184 | * |
1185 | * This will also look at all the headers present on the firmware | |
1186 | * file, and update i2400m->fw_bcf_hdr to point to them. | |
467cc396 IPG |
1187 | */ |
1188 | static | |
bfc44187 IPG |
1189 | int i2400m_fw_hdr_check(struct i2400m *i2400m, |
1190 | const struct i2400m_bcf_hdr *bcf_hdr, | |
1191 | size_t index, size_t offset) | |
467cc396 | 1192 | { |
467cc396 | 1193 | struct device *dev = i2400m_dev(i2400m); |
bfc44187 | 1194 | |
467cc396 IPG |
1195 | unsigned module_type, header_len, major_version, minor_version, |
1196 | module_id, module_vendor, date, size; | |
1197 | ||
a385a53e | 1198 | module_type = le32_to_cpu(bcf_hdr->module_type); |
bfc44187 IPG |
1199 | header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len); |
1200 | major_version = (le32_to_cpu(bcf_hdr->header_version) & 0xffff0000) | |
1201 | >> 16; | |
1202 | minor_version = le32_to_cpu(bcf_hdr->header_version) & 0x0000ffff; | |
1203 | module_id = le32_to_cpu(bcf_hdr->module_id); | |
1204 | module_vendor = le32_to_cpu(bcf_hdr->module_vendor); | |
1205 | date = le32_to_cpu(bcf_hdr->date); | |
1206 | size = sizeof(u32) * le32_to_cpu(bcf_hdr->size); | |
1207 | ||
10607c86 IPG |
1208 | d_printf(1, dev, "firmware %s #%zd@%08zx: BCF header " |
1209 | "type:vendor:id 0x%x:%x:%x v%u.%u (%u/%u B) built %08x\n", | |
bfc44187 IPG |
1210 | i2400m->fw_name, index, offset, |
1211 | module_type, module_vendor, module_id, | |
1212 | major_version, minor_version, header_len, size, date); | |
1213 | ||
1214 | /* Hard errors */ | |
1215 | if (major_version != 1) { | |
10607c86 | 1216 | dev_err(dev, "firmware %s #%zd@%08zx: major header version " |
bfc44187 IPG |
1217 | "v%u.%u not supported\n", |
1218 | i2400m->fw_name, index, offset, | |
1219 | major_version, minor_version); | |
1220 | return -EBADF; | |
467cc396 IPG |
1221 | } |
1222 | ||
467cc396 | 1223 | if (module_type != 6) { /* built for the right hardware? */ |
10607c86 | 1224 | dev_err(dev, "firmware %s #%zd@%08zx: unexpected module " |
bfc44187 IPG |
1225 | "type 0x%x; aborting\n", |
1226 | i2400m->fw_name, index, offset, | |
1227 | module_type); | |
1228 | return -EBADF; | |
467cc396 IPG |
1229 | } |
1230 | ||
bfc44187 | 1231 | if (module_vendor != 0x8086) { |
10607c86 | 1232 | dev_err(dev, "firmware %s #%zd@%08zx: unexpected module " |
bfc44187 IPG |
1233 | "vendor 0x%x; aborting\n", |
1234 | i2400m->fw_name, index, offset, module_vendor); | |
1235 | return -EBADF; | |
fabce1a4 IPG |
1236 | } |
1237 | ||
467cc396 | 1238 | if (date < 0x20080300) |
10607c86 | 1239 | dev_warn(dev, "firmware %s #%zd@%08zx: build date %08x " |
bfc44187 IPG |
1240 | "too old; unsupported\n", |
1241 | i2400m->fw_name, index, offset, date); | |
1242 | return 0; | |
1243 | } | |
1244 | ||
1245 | ||
1246 | /* | |
1247 | * Run consistency tests on the firmware file and load up headers | |
1248 | * | |
1249 | * Check for the firmware being made for the i2400m device, | |
1250 | * etc...These checks are mostly informative, as the device will make | |
1251 | * them too; but the driver's response is more informative on what | |
1252 | * went wrong. | |
1253 | * | |
1254 | * This will also look at all the headers present on the firmware | |
1255 | * file, and update i2400m->fw_hdrs to point to them. | |
1256 | */ | |
1257 | static | |
1258 | int i2400m_fw_check(struct i2400m *i2400m, const void *bcf, size_t bcf_size) | |
1259 | { | |
1260 | int result; | |
1261 | struct device *dev = i2400m_dev(i2400m); | |
1262 | size_t headers = 0; | |
1263 | const struct i2400m_bcf_hdr *bcf_hdr; | |
1264 | const void *itr, *next, *top; | |
10607c86 | 1265 | size_t slots = 0, used_slots = 0; |
bfc44187 IPG |
1266 | |
1267 | for (itr = bcf, top = itr + bcf_size; | |
1268 | itr < top; | |
1269 | headers++, itr = next) { | |
1270 | size_t leftover, offset, header_len, size; | |
1271 | ||
1272 | leftover = top - itr; | |
c2fd03a0 | 1273 | offset = itr - bcf; |
bfc44187 | 1274 | if (leftover <= sizeof(*bcf_hdr)) { |
10607c86 | 1275 | dev_err(dev, "firmware %s: %zu B left at @%zx, " |
bfc44187 IPG |
1276 | "not enough for BCF header\n", |
1277 | i2400m->fw_name, leftover, offset); | |
1278 | break; | |
1279 | } | |
1280 | bcf_hdr = itr; | |
1281 | /* Only the first header is supposed to be followed by | |
1282 | * payload */ | |
1283 | header_len = sizeof(u32) * le32_to_cpu(bcf_hdr->header_len); | |
1284 | size = sizeof(u32) * le32_to_cpu(bcf_hdr->size); | |
1285 | if (headers == 0) | |
1286 | next = itr + size; | |
1287 | else | |
1288 | next = itr + header_len; | |
1289 | ||
1290 | result = i2400m_fw_hdr_check(i2400m, bcf_hdr, headers, offset); | |
1291 | if (result < 0) | |
1292 | continue; | |
1293 | if (used_slots + 1 >= slots) { | |
1294 | /* +1 -> we need to account for the one we'll | |
1295 | * occupy and at least an extra one for | |
1296 | * always being NULL */ | |
1297 | result = i2400m_zrealloc_2x( | |
1298 | (void **) &i2400m->fw_hdrs, &slots, | |
1299 | sizeof(i2400m->fw_hdrs[0]), | |
1300 | GFP_KERNEL); | |
1301 | if (result < 0) | |
1302 | goto error_zrealloc; | |
1303 | } | |
1304 | i2400m->fw_hdrs[used_slots] = bcf_hdr; | |
1305 | used_slots++; | |
1306 | } | |
1307 | if (headers == 0) { | |
1308 | dev_err(dev, "firmware %s: no usable headers found\n", | |
1309 | i2400m->fw_name); | |
1310 | result = -EBADF; | |
1311 | } else | |
1312 | result = 0; | |
1313 | error_zrealloc: | |
467cc396 IPG |
1314 | return result; |
1315 | } | |
1316 | ||
1317 | ||
10607c86 IPG |
1318 | /* |
1319 | * Match a barker to a BCF header module ID | |
1320 | * | |
1321 | * The device sends a barker which tells the firmware loader which | |
1322 | * header in the BCF file has to be used. This does the matching. | |
1323 | */ | |
1324 | static | |
1325 | unsigned i2400m_bcf_hdr_match(struct i2400m *i2400m, | |
1326 | const struct i2400m_bcf_hdr *bcf_hdr) | |
1327 | { | |
1328 | u32 barker = le32_to_cpu(i2400m->barker->data[0]) | |
1329 | & 0x7fffffff; | |
1330 | u32 module_id = le32_to_cpu(bcf_hdr->module_id) | |
1331 | & 0x7fffffff; /* high bit used for something else */ | |
1332 | ||
1333 | /* special case for 5x50 */ | |
1334 | if (barker == I2400M_SBOOT_BARKER && module_id == 0) | |
1335 | return 1; | |
1336 | if (module_id == barker) | |
1337 | return 1; | |
1338 | return 0; | |
1339 | } | |
1340 | ||
1341 | static | |
1342 | const struct i2400m_bcf_hdr *i2400m_bcf_hdr_find(struct i2400m *i2400m) | |
1343 | { | |
1344 | struct device *dev = i2400m_dev(i2400m); | |
1345 | const struct i2400m_bcf_hdr **bcf_itr, *bcf_hdr; | |
1346 | unsigned i = 0; | |
1347 | u32 barker = le32_to_cpu(i2400m->barker->data[0]); | |
1348 | ||
1349 | d_printf(2, dev, "finding BCF header for barker %08x\n", barker); | |
1350 | if (barker == I2400M_NBOOT_BARKER) { | |
1351 | bcf_hdr = i2400m->fw_hdrs[0]; | |
1352 | d_printf(1, dev, "using BCF header #%u/%08x for non-signed " | |
1353 | "barker\n", 0, le32_to_cpu(bcf_hdr->module_id)); | |
1354 | return bcf_hdr; | |
1355 | } | |
1356 | for (bcf_itr = i2400m->fw_hdrs; *bcf_itr != NULL; bcf_itr++, i++) { | |
1357 | bcf_hdr = *bcf_itr; | |
1358 | if (i2400m_bcf_hdr_match(i2400m, bcf_hdr)) { | |
1359 | d_printf(1, dev, "hit on BCF hdr #%u/%08x\n", | |
1360 | i, le32_to_cpu(bcf_hdr->module_id)); | |
1361 | return bcf_hdr; | |
1362 | } else | |
1363 | d_printf(1, dev, "miss on BCF hdr #%u/%08x\n", | |
1364 | i, le32_to_cpu(bcf_hdr->module_id)); | |
1365 | } | |
1366 | dev_err(dev, "cannot find a matching BCF header for barker %08x\n", | |
1367 | barker); | |
1368 | return NULL; | |
1369 | } | |
1370 | ||
1371 | ||
467cc396 IPG |
1372 | /* |
1373 | * Download the firmware to the device | |
1374 | * | |
1375 | * @i2400m: device descriptor | |
1376 | * @bcf: pointer to loaded (and minimally verified for consistency) | |
1377 | * firmware | |
1378 | * @bcf_size: size of the @bcf buffer (header plus payloads) | |
1379 | * | |
1380 | * The process for doing this is described in this file's header. | |
1381 | * | |
1382 | * Note we only reinitialize boot-mode if the flags say so. Some hw | |
1383 | * iterations need it, some don't. In any case, if we loop, we always | |
1384 | * need to reinitialize the boot room, hence the flags modification. | |
1385 | */ | |
1386 | static | |
1387 | int i2400m_fw_dnload(struct i2400m *i2400m, const struct i2400m_bcf_hdr *bcf, | |
28cff50d | 1388 | size_t fw_size, enum i2400m_bri flags) |
467cc396 IPG |
1389 | { |
1390 | int ret = 0; | |
1391 | struct device *dev = i2400m_dev(i2400m); | |
ecddfd5e | 1392 | int count = i2400m->bus_bm_retries; |
10607c86 | 1393 | const struct i2400m_bcf_hdr *bcf_hdr; |
28cff50d | 1394 | size_t bcf_size; |
467cc396 | 1395 | |
28cff50d CK |
1396 | d_fnstart(5, dev, "(i2400m %p bcf %p fw size %zu)\n", |
1397 | i2400m, bcf, fw_size); | |
467cc396 | 1398 | i2400m->boot_mode = 1; |
b4013f91 | 1399 | wmb(); /* Make sure other readers see it */ |
467cc396 IPG |
1400 | hw_reboot: |
1401 | if (count-- == 0) { | |
1402 | ret = -ERESTARTSYS; | |
1403 | dev_err(dev, "device rebooted too many times, aborting\n"); | |
1404 | goto error_too_many_reboots; | |
1405 | } | |
1406 | if (flags & I2400M_BRI_MAC_REINIT) { | |
1407 | ret = i2400m_bootrom_init(i2400m, flags); | |
1408 | if (ret < 0) { | |
1409 | dev_err(dev, "bootrom init failed: %d\n", ret); | |
1410 | goto error_bootrom_init; | |
1411 | } | |
1412 | } | |
1413 | flags |= I2400M_BRI_MAC_REINIT; | |
1414 | ||
1415 | /* | |
1416 | * Initialize the download, push the bytes to the device and | |
1417 | * then jump to the new firmware. Note @ret is passed with the | |
1418 | * offset of the jump instruction to _dnload_finalize() | |
10607c86 IPG |
1419 | * |
1420 | * Note we need to use the BCF header in the firmware image | |
1421 | * that matches the barker that the device sent when it | |
1422 | * rebooted, so it has to be passed along. | |
467cc396 | 1423 | */ |
10607c86 IPG |
1424 | ret = -EBADF; |
1425 | bcf_hdr = i2400m_bcf_hdr_find(i2400m); | |
1426 | if (bcf_hdr == NULL) | |
1427 | goto error_bcf_hdr_find; | |
1428 | ||
1429 | ret = i2400m_dnload_init(i2400m, bcf_hdr); | |
467cc396 IPG |
1430 | if (ret == -ERESTARTSYS) |
1431 | goto error_dev_rebooted; | |
1432 | if (ret < 0) | |
1433 | goto error_dnload_init; | |
1434 | ||
28cff50d CK |
1435 | /* |
1436 | * bcf_size refers to one header size plus the fw sections size | |
1437 | * indicated by the header,ie. if there are other extended headers | |
1438 | * at the tail, they are not counted | |
1439 | */ | |
1440 | bcf_size = sizeof(u32) * le32_to_cpu(bcf_hdr->size); | |
467cc396 IPG |
1441 | ret = i2400m_dnload_bcf(i2400m, bcf, bcf_size); |
1442 | if (ret == -ERESTARTSYS) | |
1443 | goto error_dev_rebooted; | |
1444 | if (ret < 0) { | |
1445 | dev_err(dev, "fw %s: download failed: %d\n", | |
1039abbc | 1446 | i2400m->fw_name, ret); |
467cc396 IPG |
1447 | goto error_dnload_bcf; |
1448 | } | |
1449 | ||
10607c86 | 1450 | ret = i2400m_dnload_finalize(i2400m, bcf_hdr, bcf, ret); |
467cc396 IPG |
1451 | if (ret == -ERESTARTSYS) |
1452 | goto error_dev_rebooted; | |
1453 | if (ret < 0) { | |
1454 | dev_err(dev, "fw %s: " | |
1455 | "download finalization failed: %d\n", | |
1039abbc | 1456 | i2400m->fw_name, ret); |
467cc396 IPG |
1457 | goto error_dnload_finalize; |
1458 | } | |
1459 | ||
1460 | d_printf(2, dev, "fw %s successfully uploaded\n", | |
1039abbc | 1461 | i2400m->fw_name); |
467cc396 | 1462 | i2400m->boot_mode = 0; |
b4013f91 | 1463 | wmb(); /* Make sure i2400m_msg_to_dev() sees boot_mode */ |
467cc396 IPG |
1464 | error_dnload_finalize: |
1465 | error_dnload_bcf: | |
1466 | error_dnload_init: | |
10607c86 | 1467 | error_bcf_hdr_find: |
467cc396 IPG |
1468 | error_bootrom_init: |
1469 | error_too_many_reboots: | |
1470 | d_fnend(5, dev, "(i2400m %p bcf %p size %zu) = %d\n", | |
28cff50d | 1471 | i2400m, bcf, fw_size, ret); |
467cc396 IPG |
1472 | return ret; |
1473 | ||
1474 | error_dev_rebooted: | |
1475 | dev_err(dev, "device rebooted, %d tries left\n", count); | |
1476 | /* we got the notification already, no need to wait for it again */ | |
1477 | flags |= I2400M_BRI_SOFT; | |
1478 | goto hw_reboot; | |
1479 | } | |
1480 | ||
7b43ca70 IPG |
1481 | static |
1482 | int i2400m_fw_bootstrap(struct i2400m *i2400m, const struct firmware *fw, | |
1483 | enum i2400m_bri flags) | |
1484 | { | |
1485 | int ret; | |
1486 | struct device *dev = i2400m_dev(i2400m); | |
1487 | const struct i2400m_bcf_hdr *bcf; /* Firmware data */ | |
1488 | ||
1489 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); | |
1490 | bcf = (void *) fw->data; | |
1491 | ret = i2400m_fw_check(i2400m, bcf, fw->size); | |
1492 | if (ret >= 0) | |
1493 | ret = i2400m_fw_dnload(i2400m, bcf, fw->size, flags); | |
1494 | if (ret < 0) | |
1495 | dev_err(dev, "%s: cannot use: %d, skipping\n", | |
1496 | i2400m->fw_name, ret); | |
1497 | kfree(i2400m->fw_hdrs); | |
1498 | i2400m->fw_hdrs = NULL; | |
1499 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret); | |
1500 | return ret; | |
1501 | } | |
1502 | ||
1503 | ||
1504 | /* Refcounted container for firmware data */ | |
1505 | struct i2400m_fw { | |
1506 | struct kref kref; | |
1507 | const struct firmware *fw; | |
1508 | }; | |
1509 | ||
1510 | ||
1511 | static | |
1512 | void i2400m_fw_destroy(struct kref *kref) | |
1513 | { | |
1514 | struct i2400m_fw *i2400m_fw = | |
1515 | container_of(kref, struct i2400m_fw, kref); | |
1516 | release_firmware(i2400m_fw->fw); | |
1517 | kfree(i2400m_fw); | |
1518 | } | |
1519 | ||
1520 | ||
1521 | static | |
1522 | struct i2400m_fw *i2400m_fw_get(struct i2400m_fw *i2400m_fw) | |
1523 | { | |
1524 | if (i2400m_fw != NULL && i2400m_fw != (void *) ~0) | |
1525 | kref_get(&i2400m_fw->kref); | |
1526 | return i2400m_fw; | |
1527 | } | |
1528 | ||
1529 | ||
1530 | static | |
1531 | void i2400m_fw_put(struct i2400m_fw *i2400m_fw) | |
1532 | { | |
1533 | kref_put(&i2400m_fw->kref, i2400m_fw_destroy); | |
1534 | } | |
1535 | ||
467cc396 IPG |
1536 | |
1537 | /** | |
1538 | * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware | |
1539 | * | |
1540 | * @i2400m: device descriptor | |
1541 | * | |
1542 | * Returns: >= 0 if ok, < 0 errno code on error. | |
1543 | * | |
1544 | * This sets up the firmware upload environment, loads the firmware | |
1545 | * file from disk, verifies and then calls the firmware upload process | |
1546 | * per se. | |
1547 | * | |
1548 | * Can be called either from probe, or after a warm reset. Can not be | |
1549 | * called from within an interrupt. All the flow in this code is | |
1550 | * single-threade; all I/Os are synchronous. | |
1551 | */ | |
1552 | int i2400m_dev_bootstrap(struct i2400m *i2400m, enum i2400m_bri flags) | |
1553 | { | |
ebc5f62b | 1554 | int ret, itr; |
467cc396 | 1555 | struct device *dev = i2400m_dev(i2400m); |
7b43ca70 | 1556 | struct i2400m_fw *i2400m_fw; |
7b43ca70 | 1557 | const struct firmware *fw; |
1039abbc | 1558 | const char *fw_name; |
467cc396 IPG |
1559 | |
1560 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); | |
1039abbc | 1561 | |
7b43ca70 IPG |
1562 | ret = -ENODEV; |
1563 | spin_lock(&i2400m->rx_lock); | |
1564 | i2400m_fw = i2400m_fw_get(i2400m->fw_cached); | |
1565 | spin_unlock(&i2400m->rx_lock); | |
1566 | if (i2400m_fw == (void *) ~0) { | |
1567 | dev_err(dev, "can't load firmware now!"); | |
1568 | goto out; | |
1569 | } else if (i2400m_fw != NULL) { | |
1570 | dev_info(dev, "firmware %s: loading from cache\n", | |
1571 | i2400m->fw_name); | |
1572 | ret = i2400m_fw_bootstrap(i2400m, i2400m_fw->fw, flags); | |
1573 | i2400m_fw_put(i2400m_fw); | |
1574 | goto out; | |
1575 | } | |
1576 | ||
467cc396 | 1577 | /* Load firmware files to memory. */ |
3c546728 | 1578 | for (itr = 0, ret = -ENOENT; ; itr++) { |
1039abbc IPG |
1579 | fw_name = i2400m->bus_fw_names[itr]; |
1580 | if (fw_name == NULL) { | |
1581 | dev_err(dev, "Could not find a usable firmware image\n"); | |
ebc5f62b | 1582 | break; |
1039abbc | 1583 | } |
ebc5f62b | 1584 | d_printf(1, dev, "trying firmware %s (%d)\n", fw_name, itr); |
1039abbc | 1585 | ret = request_firmware(&fw, fw_name, dev); |
ebc5f62b | 1586 | if (ret < 0) { |
1039abbc IPG |
1587 | dev_err(dev, "fw %s: cannot load file: %d\n", |
1588 | fw_name, ret); | |
ebc5f62b IPG |
1589 | continue; |
1590 | } | |
ebc5f62b | 1591 | i2400m->fw_name = fw_name; |
7b43ca70 | 1592 | ret = i2400m_fw_bootstrap(i2400m, fw, flags); |
ebc5f62b | 1593 | release_firmware(fw); |
25985edc | 1594 | if (ret >= 0) /* firmware loaded successfully */ |
bfc44187 | 1595 | break; |
7b43ca70 | 1596 | i2400m->fw_name = NULL; |
467cc396 | 1597 | } |
7b43ca70 | 1598 | out: |
467cc396 IPG |
1599 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret); |
1600 | return ret; | |
1601 | } | |
1602 | EXPORT_SYMBOL_GPL(i2400m_dev_bootstrap); | |
7b43ca70 IPG |
1603 | |
1604 | ||
1605 | void i2400m_fw_cache(struct i2400m *i2400m) | |
1606 | { | |
1607 | int result; | |
1608 | struct i2400m_fw *i2400m_fw; | |
1609 | struct device *dev = i2400m_dev(i2400m); | |
1610 | ||
1611 | /* if there is anything there, free it -- now, this'd be weird */ | |
1612 | spin_lock(&i2400m->rx_lock); | |
1613 | i2400m_fw = i2400m->fw_cached; | |
1614 | spin_unlock(&i2400m->rx_lock); | |
1615 | if (i2400m_fw != NULL && i2400m_fw != (void *) ~0) { | |
1616 | i2400m_fw_put(i2400m_fw); | |
1617 | WARN(1, "%s:%u: still cached fw still present?\n", | |
1618 | __func__, __LINE__); | |
1619 | } | |
1620 | ||
1621 | if (i2400m->fw_name == NULL) { | |
1622 | dev_err(dev, "firmware n/a: can't cache\n"); | |
1623 | i2400m_fw = (void *) ~0; | |
1624 | goto out; | |
1625 | } | |
1626 | ||
1627 | i2400m_fw = kzalloc(sizeof(*i2400m_fw), GFP_ATOMIC); | |
1628 | if (i2400m_fw == NULL) | |
1629 | goto out; | |
1630 | kref_init(&i2400m_fw->kref); | |
1631 | result = request_firmware(&i2400m_fw->fw, i2400m->fw_name, dev); | |
1632 | if (result < 0) { | |
1633 | dev_err(dev, "firmware %s: failed to cache: %d\n", | |
1634 | i2400m->fw_name, result); | |
1635 | kfree(i2400m_fw); | |
1636 | i2400m_fw = (void *) ~0; | |
1637 | } else | |
1638 | dev_info(dev, "firmware %s: cached\n", i2400m->fw_name); | |
1639 | out: | |
1640 | spin_lock(&i2400m->rx_lock); | |
1641 | i2400m->fw_cached = i2400m_fw; | |
1642 | spin_unlock(&i2400m->rx_lock); | |
1643 | } | |
1644 | ||
1645 | ||
1646 | void i2400m_fw_uncache(struct i2400m *i2400m) | |
1647 | { | |
1648 | struct i2400m_fw *i2400m_fw; | |
1649 | ||
1650 | spin_lock(&i2400m->rx_lock); | |
1651 | i2400m_fw = i2400m->fw_cached; | |
1652 | i2400m->fw_cached = NULL; | |
1653 | spin_unlock(&i2400m->rx_lock); | |
1654 | ||
1655 | if (i2400m_fw != NULL && i2400m_fw != (void *) ~0) | |
1656 | i2400m_fw_put(i2400m_fw); | |
1657 | } | |
1658 |