drivers/staging/greybus/bootrom.c

   1 /*
   2  * BOOTROM Greybus driver.
   3  *
   4  * Copyright 2016 Google Inc.
   5  * Copyright 2016 Linaro Ltd.
   6  *
   7  * Released under the GPLv2 only.
   8  */
   9
  10 #include <linux/firmware.h>
  11 #include <linux/jiffies.h>
  12 #include <linux/mutex.h>
  13 #include <linux/workqueue.h>
  14
  15 #include "greybus.h"
  16
  17 /* Timeout, in jiffies, within which the next request must be received */
  18 #define NEXT_REQ_TIMEOUT_MS     1000
  19
  20 enum next_request_type {
  21         NEXT_REQ_FIRMWARE_SIZE,
  22         NEXT_REQ_GET_FIRMWARE,
  23         NEXT_REQ_READY_TO_BOOT,
  24         NEXT_REQ_MODE_SWITCH,
  25 };
  26
  27 struct gb_bootrom {
  28         struct gb_connection    *connection;
  29         const struct firmware   *fw;
  30         u8                      protocol_major;
  31         u8                      protocol_minor;
  32         enum next_request_type  next_request;
  33         struct delayed_work     dwork;
  34         struct mutex            mutex; /* Protects bootrom->fw */
  35 };
  36
  37 static void free_firmware(struct gb_bootrom *bootrom)
  38 {
  39         if (!bootrom->fw)
  40                 return;
  41
  42         release_firmware(bootrom->fw);
  43         bootrom->fw = NULL;
  44 }
  45
  46 static void gb_bootrom_timedout(struct work_struct *work)
  47 {
  48         struct delayed_work *dwork = to_delayed_work(work);
  49         struct gb_bootrom *bootrom = container_of(dwork, struct gb_bootrom, dwork);
  50         struct device *dev = &bootrom->connection->bundle->dev;
  51         const char *reason;
  52
  53         switch (bootrom->next_request) {
  54         case NEXT_REQ_FIRMWARE_SIZE:
  55                 reason = "Firmware Size Request";
  56                 break;
  57         case NEXT_REQ_GET_FIRMWARE:
  58                 reason = "Get Firmware Request";
  59                 break;
  60         case NEXT_REQ_READY_TO_BOOT:
  61                 reason = "Ready to Boot Request";
  62                 break;
  63         case NEXT_REQ_MODE_SWITCH:
  64                 reason = "Interface Mode Switch";
  65                 break;
  66         default:
  67                 reason = NULL;
  68                 dev_err(dev, "Invalid next-request: %u", bootrom->next_request);
  69                 break;
  70         }
  71
  72         dev_err(dev, "Timed out waiting for %s from the Module\n", reason);
  73
  74         mutex_lock(&bootrom->mutex);
  75         free_firmware(bootrom);
  76         mutex_unlock(&bootrom->mutex);
  77
  78         /* TODO: Power-off Module ? */
  79 }
  80
  81 static void gb_bootrom_set_timeout(struct gb_bootrom *bootrom,
  82                         enum next_request_type next, unsigned long timeout)
  83 {
  84         bootrom->next_request = next;
  85         schedule_delayed_work(&bootrom->dwork, msecs_to_jiffies(timeout));
  86 }
  87
  88 /*
  89  * The es2 chip doesn't have VID/PID programmed into the hardware and we need to
  90  * hack that up to distinguish different modules and their firmware blobs.
  91  *
  92  * This fetches VID/PID (over bootrom protocol) for es2 chip only, when VID/PID
  93  * already sent during hotplug are 0.
  94  *
  95  * Otherwise, we keep intf->vendor_id/product_id same as what's passed
  96  * during hotplug.
  97  */
  98 static void bootrom_es2_fixup_vid_pid(struct gb_bootrom *bootrom)
  99 {
 100         struct gb_bootrom_get_vid_pid_response response;
 101         struct gb_connection *connection = bootrom->connection;
 102         struct gb_interface *intf = connection->bundle->intf;
 103         int ret;
 104
 105         if (!(intf->quirks & GB_INTERFACE_QUIRK_NO_ARA_IDS))
 106                 return;
 107
 108         ret = gb_operation_sync(connection, GB_BOOTROM_TYPE_GET_VID_PID,
 109                                 NULL, 0, &response, sizeof(response));
 110         if (ret) {
 111                 dev_err(&connection->bundle->dev,
 112                         "Bootrom get vid/pid operation failed (%d)\n", ret);
 113                 return;
 114         }
 115
 116         /*
 117          * NOTE: This is hacked, so that the same values of VID/PID can be used
 118          * by next firmware level as well. The uevent for bootrom will still
 119          * have VID/PID as 0, though after this point the sysfs files will start
 120          * showing the updated values. But yeah, that's a bit racy as the same
 121          * sysfs files would be showing 0 before this point.
 122          */
 123         intf->vendor_id = le32_to_cpu(response.vendor_id);
 124         intf->product_id = le32_to_cpu(response.product_id);
 125
 126         dev_dbg(&connection->bundle->dev, "Bootrom got vid (0x%x)/pid (0x%x)\n",
 127                 intf->vendor_id, intf->product_id);
 128 }
 129
 130 /* This returns path of the firmware blob on the disk */
 131 static int download_firmware(struct gb_bootrom *bootrom, u8 stage)
 132 {
 133         struct gb_connection *connection = bootrom->connection;
 134         struct gb_interface *intf = connection->bundle->intf;
 135         char firmware_name[48];
 136         int rc;
 137
 138         /* Already have a firmware, free it */
 139         free_firmware(bootrom);
 140
 141         /*
 142          * Create firmware name
 143          *
 144          * XXX Name it properly..
 145          */
 146         snprintf(firmware_name, sizeof(firmware_name),
 147                  "ara_%08x_%08x_%08x_%08x_%02x.tftf",
 148                  intf->ddbl1_manufacturer_id, intf->ddbl1_product_id,
 149                  intf->vendor_id, intf->product_id, stage);
 150
 151         // FIXME:
 152         // Turn to dev_dbg later after everyone has valid bootloaders with good
 153         // ids, but leave this as dev_info for now to make it easier to track
 154         // down "empty" vid/pid modules.
 155         dev_info(&connection->bundle->dev, "Firmware file '%s' requested\n",
 156                  firmware_name);
 157
 158         rc = request_firmware(&bootrom->fw, firmware_name,
 159                 &connection->bundle->dev);
 160         if (rc)
 161                 dev_err(&connection->bundle->dev,
 162                         "Firmware request for %s has failed : %d",
 163                         firmware_name, rc);
 164         return rc;
 165 }
 166
 167 static int gb_bootrom_firmware_size_request(struct gb_operation *op)
 168 {
 169         struct gb_bootrom *bootrom = gb_connection_get_data(op->connection);
 170         struct gb_bootrom_firmware_size_request *size_request = op->request->payload;
 171         struct gb_bootrom_firmware_size_response *size_response;
 172         struct device *dev = &op->connection->bundle->dev;
 173         int ret;
 174
 175         /* Disable timeouts */
 176         cancel_delayed_work_sync(&bootrom->dwork);
 177
 178         if (op->request->payload_size != sizeof(*size_request)) {
 179                 dev_err(dev, "%s: illegal size of firmware size request (%zu != %zu)\n",
 180                         __func__, op->request->payload_size,
 181                         sizeof(*size_request));
 182                 ret = -EINVAL;
 183                 goto queue_work;
 184         }
 185
 186         mutex_lock(&bootrom->mutex);
 187
 188         ret = download_firmware(bootrom, size_request->stage);
 189         if (ret) {
 190                 dev_err(dev, "%s: failed to download firmware (%d)\n", __func__,
 191                         ret);
 192                 goto unlock;
 193         }
 194
 195         if (!gb_operation_response_alloc(op, sizeof(*size_response),
 196                                          GFP_KERNEL)) {
 197                 dev_err(dev, "%s: error allocating response\n", __func__);
 198                 free_firmware(bootrom);
 199                 ret = -ENOMEM;
 200                 goto unlock;
 201         }
 202
 203         size_response = op->response->payload;
 204         size_response->size = cpu_to_le32(bootrom->fw->size);
 205
 206         dev_dbg(dev, "%s: firmware size %d bytes\n", __func__, size_response->size);
 207
 208 unlock:
 209         mutex_unlock(&bootrom->mutex);
 210
 211 queue_work:
 212         /* Refresh timeout */
 213         gb_bootrom_set_timeout(bootrom, NEXT_REQ_GET_FIRMWARE,
 214                                NEXT_REQ_TIMEOUT_MS);
 215
 216         return ret;
 217 }
 218
 219 static int gb_bootrom_get_firmware(struct gb_operation *op)
 220 {
 221         struct gb_bootrom *bootrom = gb_connection_get_data(op->connection);
 222         const struct firmware *fw;
 223         struct gb_bootrom_get_firmware_request *firmware_request;
 224         struct gb_bootrom_get_firmware_response *firmware_response;
 225         struct device *dev = &op->connection->bundle->dev;
 226         unsigned int offset, size;
 227         enum next_request_type next_request;
 228         int ret = 0;
 229
 230         /* Disable timeouts */
 231         cancel_delayed_work_sync(&bootrom->dwork);
 232
 233         if (op->request->payload_size != sizeof(*firmware_request)) {
 234                 dev_err(dev, "%s: Illegal size of get firmware request (%zu %zu)\n",
 235                         __func__, op->request->payload_size,
 236                         sizeof(*firmware_request));
 237                 ret = -EINVAL;
 238                 goto queue_work;
 239         }
 240
 241         mutex_lock(&bootrom->mutex);
 242
 243         fw = bootrom->fw;
 244         if (!fw) {
 245                 dev_err(dev, "%s: firmware not available\n", __func__);
 246                 ret = -EINVAL;
 247                 goto unlock;
 248         }
 249
 250         firmware_request = op->request->payload;
 251         offset = le32_to_cpu(firmware_request->offset);
 252         size = le32_to_cpu(firmware_request->size);
 253
 254         if (offset >= fw->size || size > fw->size - offset) {
 255                 dev_warn(dev, "bad firmware request (offs = %u, size = %u)\n",
 256                                 offset, size);
 257                 ret = -EINVAL;
 258                 goto unlock;
 259         }
 260
 261         if (!gb_operation_response_alloc(op, sizeof(*firmware_response) + size,
 262                                          GFP_KERNEL)) {
 263                 dev_err(dev, "%s: error allocating response\n", __func__);
 264                 ret = -ENOMEM;
 265                 goto unlock;
 266         }
 267
 268         firmware_response = op->response->payload;
 269         memcpy(firmware_response->data, fw->data + offset, size);
 270
 271         dev_dbg(dev, "responding with firmware (offs = %u, size = %u)\n", offset,
 272                 size);
 273
 274 unlock:
 275         mutex_unlock(&bootrom->mutex);
 276
 277 queue_work:
 278         /* Refresh timeout */
 279         if (!ret && (offset + size == fw->size))
 280                 next_request = NEXT_REQ_READY_TO_BOOT;
 281         else
 282                 next_request = NEXT_REQ_GET_FIRMWARE;
 283
 284         gb_bootrom_set_timeout(bootrom, next_request, NEXT_REQ_TIMEOUT_MS);
 285
 286         return ret;
 287 }
 288
 289 static int gb_bootrom_ready_to_boot(struct gb_operation *op)
 290 {
 291         struct gb_connection *connection = op->connection;
 292         struct gb_bootrom *bootrom = gb_connection_get_data(connection);
 293         struct gb_bootrom_ready_to_boot_request *rtb_request;
 294         struct device *dev = &connection->bundle->dev;
 295         u8 status;
 296         int ret = 0;
 297
 298         /* Disable timeouts */
 299         cancel_delayed_work_sync(&bootrom->dwork);
 300
 301         if (op->request->payload_size != sizeof(*rtb_request)) {
 302                 dev_err(dev, "%s: Illegal size of ready to boot request (%zu %zu)\n",
 303                         __func__, op->request->payload_size,
 304                         sizeof(*rtb_request));
 305                 ret = -EINVAL;
 306                 goto queue_work;
 307         }
 308
 309         rtb_request = op->request->payload;
 310         status = rtb_request->status;
 311
 312         /* Return error if the blob was invalid */
 313         if (status == GB_BOOTROM_BOOT_STATUS_INVALID) {
 314                 ret = -EINVAL;
 315                 goto queue_work;
 316         }
 317
 318         /*
 319          * XXX Should we return error for insecure firmware?
 320          */
 321         dev_dbg(dev, "ready to boot: 0x%x, 0\n", status);
 322
 323 queue_work:
 324         /*
 325          * Refresh timeout, the Interface shall load the new personality and
 326          * send a new hotplug request, which shall get rid of the bootrom
 327          * connection. As that can take some time, increase the timeout a bit.
 328          */
 329         gb_bootrom_set_timeout(bootrom, NEXT_REQ_MODE_SWITCH,
 330                                5 * NEXT_REQ_TIMEOUT_MS);
 331
 332         return ret;
 333 }
 334
 335 static int gb_bootrom_request_handler(struct gb_operation *op)
 336 {
 337         u8 type = op->type;
 338
 339         switch (type) {
 340         case GB_BOOTROM_TYPE_FIRMWARE_SIZE:
 341                 return gb_bootrom_firmware_size_request(op);
 342         case GB_BOOTROM_TYPE_GET_FIRMWARE:
 343                 return gb_bootrom_get_firmware(op);
 344         case GB_BOOTROM_TYPE_READY_TO_BOOT:
 345                 return gb_bootrom_ready_to_boot(op);
 346         default:
 347                 dev_err(&op->connection->bundle->dev,
 348                         "unsupported request: %u\n", type);
 349                 return -EINVAL;
 350         }
 351 }
 352
 353 static int gb_bootrom_get_version(struct gb_bootrom *bootrom)
 354 {
 355         struct gb_bundle *bundle = bootrom->connection->bundle;
 356         struct gb_bootrom_version_request request;
 357         struct gb_bootrom_version_response response;
 358         int ret;
 359
 360         request.major = GB_BOOTROM_VERSION_MAJOR;
 361         request.minor = GB_BOOTROM_VERSION_MINOR;
 362
 363         ret = gb_operation_sync(bootrom->connection,
 364                                 GB_BOOTROM_TYPE_VERSION,
 365                                 &request, sizeof(request), &response,
 366                                 sizeof(response));
 367         if (ret) {
 368                 dev_err(&bundle->dev,
 369                                 "failed to get protocol version: %d\n",
 370                                 ret);
 371                 return ret;
 372         }
 373
 374         if (response.major > request.major) {
 375                 dev_err(&bundle->dev,
 376                                 "unsupported major protocol version (%u > %u)\n",
 377                                 response.major, request.major);
 378                 return -ENOTSUPP;
 379         }
 380
 381         bootrom->protocol_major = response.major;
 382         bootrom->protocol_minor = response.minor;
 383
 384         dev_dbg(&bundle->dev, "%s - %u.%u\n", __func__, response.major,
 385                         response.minor);
 386
 387         return 0;
 388 }
 389
 390 static int gb_bootrom_probe(struct gb_bundle *bundle,
 391                                         const struct greybus_bundle_id *id)
 392 {
 393         struct greybus_descriptor_cport *cport_desc;
 394         struct gb_connection *connection;
 395         struct gb_bootrom *bootrom;
 396         int ret;
 397
 398         if (bundle->num_cports != 1)
 399                 return -ENODEV;
 400
 401         cport_desc = &bundle->cport_desc[0];
 402         if (cport_desc->protocol_id != GREYBUS_PROTOCOL_BOOTROM)
 403                 return -ENODEV;
 404
 405         bootrom = kzalloc(sizeof(*bootrom), GFP_KERNEL);
 406         if (!bootrom)
 407                 return -ENOMEM;
 408
 409         connection = gb_connection_create(bundle,
 410                                                 le16_to_cpu(cport_desc->id),
 411                                                 gb_bootrom_request_handler);
 412         if (IS_ERR(connection)) {
 413                 ret = PTR_ERR(connection);
 414                 goto err_free_bootrom;
 415         }
 416
 417         gb_connection_set_data(connection, bootrom);
 418
 419         bootrom->connection = connection;
 420
 421         mutex_init(&bootrom->mutex);
 422         INIT_DELAYED_WORK(&bootrom->dwork, gb_bootrom_timedout);
 423         greybus_set_drvdata(bundle, bootrom);
 424
 425         ret = gb_connection_enable_tx(connection);
 426         if (ret)
 427                 goto err_connection_destroy;
 428
 429         ret = gb_bootrom_get_version(bootrom);
 430         if (ret)
 431                 goto err_connection_disable;
 432
 433         bootrom_es2_fixup_vid_pid(bootrom);
 434
 435         ret = gb_connection_enable(connection);
 436         if (ret)
 437                 goto err_connection_disable;
 438
 439         /* Tell bootrom we're ready. */
 440         ret = gb_operation_sync(connection, GB_BOOTROM_TYPE_AP_READY, NULL, 0,
 441                                 NULL, 0);
 442         if (ret) {
 443                 dev_err(&connection->bundle->dev,
 444                                 "failed to send AP READY: %d\n", ret);
 445                 goto err_connection_disable;
 446         }
 447
 448         /* Refresh timeout */
 449         gb_bootrom_set_timeout(bootrom, NEXT_REQ_FIRMWARE_SIZE,
 450                                NEXT_REQ_TIMEOUT_MS);
 451
 452         dev_dbg(&bundle->dev, "AP_READY sent\n");
 453
 454         return 0;
 455
 456 err_connection_disable:
 457         gb_connection_disable(connection);
 458 err_connection_destroy:
 459         gb_connection_destroy(connection);
 460 err_free_bootrom:
 461         kfree(bootrom);
 462
 463         return ret;
 464 }
 465
 466 static void gb_bootrom_disconnect(struct gb_bundle *bundle)
 467 {
 468         struct gb_bootrom *bootrom = greybus_get_drvdata(bundle);
 469
 470         dev_dbg(&bundle->dev, "%s\n", __func__);
 471
 472         gb_connection_disable(bootrom->connection);
 473
 474         /* Disable timeouts */
 475         cancel_delayed_work_sync(&bootrom->dwork);
 476
 477         /*
 478          * Release firmware:
 479          *
 480          * As the connection and the delayed work are already disabled, we don't
 481          * need to lock access to bootrom->fw here.
 482          */
 483         free_firmware(bootrom);
 484
 485         gb_connection_destroy(bootrom->connection);
 486         kfree(bootrom);
 487 }
 488
 489 static const struct greybus_bundle_id gb_bootrom_id_table[] = {
 490         { GREYBUS_DEVICE_CLASS(GREYBUS_CLASS_BOOTROM) },
 491         { }
 492 };
 493
 494 static struct greybus_driver gb_bootrom_driver = {
 495         .name           = "bootrom",
 496         .probe          = gb_bootrom_probe,
 497         .disconnect     = gb_bootrom_disconnect,
 498         .id_table       = gb_bootrom_id_table,
 499 };
 500
 501 module_greybus_driver(gb_bootrom_driver);
 502
 503 MODULE_LICENSE("GPL v2");