drivers/hid/intel-ish-hid/ishtp-fw-loader.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * ISH-TP client driver for ISH firmware loading
   4  *
   5  * Copyright (c) 2019, Intel Corporation.
   6  */
   7
   8 #include <linux/firmware.h>
   9 #include <linux/module.h>
  10 #include <linux/pci.h>
  11 #include <linux/intel-ish-client-if.h>
  12 #include <linux/property.h>
  13 #include <asm/cacheflush.h>
  14
  15 /* Number of times we attempt to load the firmware before giving up */
  16 #define MAX_LOAD_ATTEMPTS                       3
  17
  18 /* ISH TX/RX ring buffer pool size */
  19 #define LOADER_CL_RX_RING_SIZE                  1
  20 #define LOADER_CL_TX_RING_SIZE                  1
  21
  22 /*
  23  * ISH Shim firmware loader reserves 4 Kb buffer in SRAM. The buffer is
  24  * used to temporarily hold the data transferred from host to Shim
  25  * firmware loader. Reason for the odd size of 3968 bytes? Each IPC
  26  * transfer is 128 bytes (= 4 bytes header + 124 bytes payload). So the
  27  * 4 Kb buffer can hold maximum of 32 IPC transfers, which means we can
  28  * have a max payload of 3968 bytes (= 32 x 124 payload).
  29  */
  30 #define LOADER_SHIM_IPC_BUF_SIZE                3968
  31
  32 /**
  33  * enum ish_loader_commands -   ISH loader host commands.
  34  * @LOADER_CMD_XFER_QUERY:      Query the Shim firmware loader for
  35  *                              capabilities
  36  * @LOADER_CMD_XFER_FRAGMENT:   Transfer one firmware image fragment at a
  37  *                              time. The command may be executed
  38  *                              multiple times until the entire firmware
  39  *                              image is downloaded to SRAM.
  40  * @LOADER_CMD_START:           Start executing the main firmware.
  41  */
  42 enum ish_loader_commands {
  43         LOADER_CMD_XFER_QUERY = 0,
  44         LOADER_CMD_XFER_FRAGMENT,
  45         LOADER_CMD_START,
  46 };
  47
  48 /* Command bit mask */
  49 #define CMD_MASK                                GENMASK(6, 0)
  50 #define IS_RESPONSE                             BIT(7)
  51
  52 /*
  53  * ISH firmware max delay for one transmit failure is 1 Hz,
  54  * and firmware will retry 2 times, so 3 Hz is used for timeout.
  55  */
  56 #define ISHTP_SEND_TIMEOUT                      (3 * HZ)
  57
  58 /*
  59  * Loader transfer modes:
  60  *
  61  * LOADER_XFER_MODE_ISHTP mode uses the existing ISH-TP mechanism to
  62  * transfer data. This may use IPC or DMA if supported in firmware.
  63  * The buffer size is limited to 4 Kb by the IPC/ISH-TP protocol for
  64  * both IPC & DMA (legacy).
  65  *
  66  * LOADER_XFER_MODE_DIRECT_DMA - firmware loading is a bit different
  67  * from the sensor data streaming. Here we download a large (300+ Kb)
  68  * image directly to ISH SRAM memory. There is limited benefit of
  69  * DMA'ing 300 Kb image in 4 Kb chucks limit. Hence, we introduce
  70  * this "direct dma" mode, where we do not use ISH-TP for DMA, but
  71  * instead manage the DMA directly in kernel driver and Shim firmware
  72  * loader (allocate buffer, break in chucks and transfer). This allows
  73  * to overcome 4 Kb limit, and optimize the data flow path in firmware.
  74  */
  75 #define LOADER_XFER_MODE_DIRECT_DMA             BIT(0)
  76 #define LOADER_XFER_MODE_ISHTP                  BIT(1)
  77
  78 /* ISH Transport Loader client unique GUID */
  79 static const struct ishtp_device_id loader_ishtp_id_table[] = {
  80         { .guid = GUID_INIT(0xc804d06a, 0x55bd, 0x4ea7,
  81                   0xad, 0xed, 0x1e, 0x31, 0x22, 0x8c, 0x76, 0xdc) },
  82         { }
  83 };
  84 MODULE_DEVICE_TABLE(ishtp, loader_ishtp_id_table);
  85
  86 #define FILENAME_SIZE                           256
  87
  88 /*
  89  * The firmware loading latency will be minimum if we can DMA the
  90  * entire ISH firmware image in one go. This requires that we allocate
  91  * a large DMA buffer in kernel, which could be problematic on some
  92  * platforms. So here we limit the DMA buffer size via a module_param.
  93  * We default to 4 pages, but a customer can set it to higher limit if
  94  * deemed appropriate for his platform.
  95  */
  96 static int dma_buf_size_limit = 4 * PAGE_SIZE;
  97
  98 /**
  99  * struct loader_msg_hdr - Header for ISH Loader commands.
 100  * @command:            LOADER_CMD* commands. Bit 7 is the response.
 101  * @reserved:           Reserved space
 102  * @status:             Command response status. Non 0, is error
 103  *                      condition.
 104  *
 105  * This structure is used as header for every command/data sent/received
 106  * between Host driver and ISH Shim firmware loader.
 107  */
 108 struct loader_msg_hdr {
 109         u8 command;
 110         u8 reserved[2];
 111         u8 status;
 112 } __packed;
 113
 114 struct loader_xfer_query {
 115         struct loader_msg_hdr hdr;
 116         u32 image_size;
 117 } __packed;
 118
 119 struct ish_fw_version {
 120         u16 major;
 121         u16 minor;
 122         u16 hotfix;
 123         u16 build;
 124 } __packed;
 125
 126 union loader_version {
 127         u32 value;
 128         struct {
 129                 u8 major;
 130                 u8 minor;
 131                 u8 hotfix;
 132                 u8 build;
 133         };
 134 } __packed;
 135
 136 struct loader_capability {
 137         u32 max_fw_image_size;
 138         u32 xfer_mode;
 139         u32 max_dma_buf_size; /* only for dma mode, multiples of cacheline */
 140 } __packed;
 141
 142 struct shim_fw_info {
 143         struct ish_fw_version ish_fw_version;
 144         u32 protocol_version;
 145         union loader_version ldr_version;
 146         struct loader_capability ldr_capability;
 147 } __packed;
 148
 149 struct loader_xfer_query_response {
 150         struct loader_msg_hdr hdr;
 151         struct shim_fw_info fw_info;
 152 } __packed;
 153
 154 struct loader_xfer_fragment {
 155         struct loader_msg_hdr hdr;
 156         u32 xfer_mode;
 157         u32 offset;
 158         u32 size;
 159         u32 is_last;
 160 } __packed;
 161
 162 struct loader_xfer_ipc_fragment {
 163         struct loader_xfer_fragment fragment;
 164         u8 data[] ____cacheline_aligned; /* variable length payload here */
 165 } __packed;
 166
 167 struct loader_xfer_dma_fragment {
 168         struct loader_xfer_fragment fragment;
 169         u64 ddr_phys_addr;
 170 } __packed;
 171
 172 struct loader_start {
 173         struct loader_msg_hdr hdr;
 174 } __packed;
 175
 176 /**
 177  * struct response_info - Encapsulate firmware response related
 178  *                      information for passing between function
 179  *                      loader_cl_send() and process_recv() callback.
 180  * @data:               Copy the data received from firmware here.
 181  * @max_size:           Max size allocated for the @data buffer. If the
 182  *                      received data exceeds this value, we log an
 183  *                      error.
 184  * @size:               Actual size of data received from firmware.
 185  * @error:              Returns 0 for success, negative error code for a
 186  *                      failure in function process_recv().
 187  * @received:           Set to true on receiving a valid firmware
 188  *                      response to host command
 189  * @wait_queue:         Wait queue for Host firmware loading where the
 190  *                      client sends message to ISH firmware and waits
 191  *                      for response
 192  */
 193 struct response_info {
 194         void *data;
 195         size_t max_size;
 196         size_t size;
 197         int error;
 198         bool received;
 199         wait_queue_head_t wait_queue;
 200 };
 201
 202 /*
 203  * struct ishtp_cl_data - Encapsulate per ISH-TP Client Data.
 204  * @work_ishtp_reset:   Work queue for reset handling.
 205  * @work_fw_load:       Work queue for host firmware loading.
 206  * @flag_retry:         Flag for indicating host firmware loading should
 207  *                      be retried.
 208  * @retry_count:        Count the number of retries.
 209  *
 210  * This structure is used to store data per client.
 211  */
 212 struct ishtp_cl_data {
 213         struct ishtp_cl *loader_ishtp_cl;
 214         struct ishtp_cl_device *cl_device;
 215
 216         /*
 217          * Used for passing firmware response information between
 218          * loader_cl_send() and process_recv() callback.
 219          */
 220         struct response_info response;
 221
 222         struct work_struct work_ishtp_reset;
 223         struct work_struct work_fw_load;
 224
 225         /*
 226          * In certain failure scenrios, it makes sense to reset the ISH
 227          * subsystem and retry Host firmware loading (e.g. bad message
 228          * packet, ENOMEM, etc.). On the other hand, failures due to
 229          * protocol mismatch, etc., are not recoverable. We do not
 230          * retry them.
 231          *
 232          * If set, the flag indicates that we should re-try the
 233          * particular failure.
 234          */
 235         bool flag_retry;
 236         int retry_count;
 237 };
 238
 239 #define IPC_FRAGMENT_DATA_PREAMBLE                              \
 240         offsetof(struct loader_xfer_ipc_fragment, data)
 241
 242 #define cl_data_to_dev(client_data) ishtp_device((client_data)->cl_device)
 243
 244 /**
 245  * get_firmware_variant() - Gets the filename of firmware image to be
 246  *                      loaded based on platform variant.
 247  * @client_data:        Client data instance.
 248  * @filename:           Returns firmware filename.
 249  *
 250  * Queries the firmware-name device property string.
 251  *
 252  * Return: 0 for success, negative error code for failure.
 253  */
 254 static int get_firmware_variant(struct ishtp_cl_data *client_data,
 255                                 char *filename)
 256 {
 257         int rv;
 258         const char *val;
 259         struct device *devc = ishtp_get_pci_device(client_data->cl_device);
 260
 261         rv = device_property_read_string(devc, "firmware-name", &val);
 262         if (rv < 0) {
 263                 dev_err(devc,
 264                         "Error: ISH firmware-name device property required\n");
 265                 return rv;
 266         }
 267         return snprintf(filename, FILENAME_SIZE, "intel/%s", val);
 268 }
 269
 270 /**
 271  * loader_cl_send()     Send message from host to firmware
 272  * @client_data:        Client data instance
 273  * @out_msg:            Message buffer to be sent to firmware
 274  * @out_size:           Size of out going message
 275  * @in_msg:             Message buffer where the incoming data copied.
 276  *                      This buffer is allocated by calling
 277  * @in_size:            Max size of incoming message
 278  *
 279  * Return: Number of bytes copied in the in_msg on success, negative
 280  * error code on failure.
 281  */
 282 static int loader_cl_send(struct ishtp_cl_data *client_data,
 283                           u8 *out_msg, size_t out_size,
 284                           u8 *in_msg, size_t in_size)
 285 {
 286         int rv;
 287         struct loader_msg_hdr *out_hdr = (struct loader_msg_hdr *)out_msg;
 288         struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
 289
 290         dev_dbg(cl_data_to_dev(client_data),
 291                 "%s: command=%02lx is_response=%u status=%02x\n",
 292                 __func__,
 293                 out_hdr->command & CMD_MASK,
 294                 out_hdr->command & IS_RESPONSE ? 1 : 0,
 295                 out_hdr->status);
 296
 297         /* Setup in coming buffer & size */
 298         client_data->response.data = in_msg;
 299         client_data->response.max_size = in_size;
 300         client_data->response.error = 0;
 301         client_data->response.received = false;
 302
 303         rv = ishtp_cl_send(loader_ishtp_cl, out_msg, out_size);
 304         if (rv < 0) {
 305                 dev_err(cl_data_to_dev(client_data),
 306                         "ishtp_cl_send error %d\n", rv);
 307                 return rv;
 308         }
 309
 310         wait_event_interruptible_timeout(client_data->response.wait_queue,
 311                                          client_data->response.received,
 312                                          ISHTP_SEND_TIMEOUT);
 313         if (!client_data->response.received) {
 314                 dev_err(cl_data_to_dev(client_data),
 315                         "Timed out for response to command=%02lx",
 316                         out_hdr->command & CMD_MASK);
 317                 return -ETIMEDOUT;
 318         }
 319
 320         if (client_data->response.error < 0)
 321                 return client_data->response.error;
 322
 323         return client_data->response.size;
 324 }
 325
 326 /**
 327  * process_recv() -     Receive and parse incoming packet
 328  * @loader_ishtp_cl:    Client instance to get stats
 329  * @rb_in_proc:         ISH received message buffer
 330  *
 331  * Parse the incoming packet. If it is a response packet then it will
 332  * update received and wake up the caller waiting to for the response.
 333  */
 334 static void process_recv(struct ishtp_cl *loader_ishtp_cl,
 335                          struct ishtp_cl_rb *rb_in_proc)
 336 {
 337         struct loader_msg_hdr *hdr;
 338         size_t data_len = rb_in_proc->buf_idx;
 339         struct ishtp_cl_data *client_data =
 340                 ishtp_get_client_data(loader_ishtp_cl);
 341
 342         /* Sanity check */
 343         if (!client_data->response.data) {
 344                 dev_err(cl_data_to_dev(client_data),
 345                         "Receiving buffer is null. Should be allocated by calling function\n");
 346                 client_data->response.error = -EINVAL;
 347                 goto end;
 348         }
 349
 350         if (client_data->response.received) {
 351                 dev_err(cl_data_to_dev(client_data),
 352                         "Previous firmware message not yet processed\n");
 353                 client_data->response.error = -EINVAL;
 354                 goto end;
 355         }
 356         /*
 357          * All firmware messages have a header. Check buffer size
 358          * before accessing elements inside.
 359          */
 360         if (!rb_in_proc->buffer.data) {
 361                 dev_warn(cl_data_to_dev(client_data),
 362                          "rb_in_proc->buffer.data returned null");
 363                 client_data->response.error = -EBADMSG;
 364                 goto end;
 365         }
 366
 367         if (data_len < sizeof(struct loader_msg_hdr)) {
 368                 dev_err(cl_data_to_dev(client_data),
 369                         "data size %zu is less than header %zu\n",
 370                         data_len, sizeof(struct loader_msg_hdr));
 371                 client_data->response.error = -EMSGSIZE;
 372                 goto end;
 373         }
 374
 375         hdr = (struct loader_msg_hdr *)rb_in_proc->buffer.data;
 376
 377         dev_dbg(cl_data_to_dev(client_data),
 378                 "%s: command=%02lx is_response=%u status=%02x\n",
 379                 __func__,
 380                 hdr->command & CMD_MASK,
 381                 hdr->command & IS_RESPONSE ? 1 : 0,
 382                 hdr->status);
 383
 384         if (((hdr->command & CMD_MASK) != LOADER_CMD_XFER_QUERY) &&
 385             ((hdr->command & CMD_MASK) != LOADER_CMD_XFER_FRAGMENT) &&
 386             ((hdr->command & CMD_MASK) != LOADER_CMD_START)) {
 387                 dev_err(cl_data_to_dev(client_data),
 388                         "Invalid command=%02lx\n",
 389                         hdr->command & CMD_MASK);
 390                 client_data->response.error = -EPROTO;
 391                 goto end;
 392         }
 393
 394         if (data_len > client_data->response.max_size) {
 395                 dev_err(cl_data_to_dev(client_data),
 396                         "Received buffer size %zu is larger than allocated buffer %zu\n",
 397                         data_len, client_data->response.max_size);
 398                 client_data->response.error = -EMSGSIZE;
 399                 goto end;
 400         }
 401
 402         /* We expect only "response" messages from firmware */
 403         if (!(hdr->command & IS_RESPONSE)) {
 404                 dev_err(cl_data_to_dev(client_data),
 405                         "Invalid response to command\n");
 406                 client_data->response.error = -EIO;
 407                 goto end;
 408         }
 409
 410         if (hdr->status) {
 411                 dev_err(cl_data_to_dev(client_data),
 412                         "Loader returned status %d\n",
 413                         hdr->status);
 414                 client_data->response.error = -EIO;
 415                 goto end;
 416         }
 417
 418         /* Update the actual received buffer size */
 419         client_data->response.size = data_len;
 420
 421         /*
 422          * Copy the buffer received in firmware response for the
 423          * calling thread.
 424          */
 425         memcpy(client_data->response.data,
 426                rb_in_proc->buffer.data, data_len);
 427
 428         /* Set flag before waking up the caller */
 429         client_data->response.received = true;
 430
 431 end:
 432         /* Free the buffer */
 433         ishtp_cl_io_rb_recycle(rb_in_proc);
 434         rb_in_proc = NULL;
 435
 436         /* Wake the calling thread */
 437         wake_up_interruptible(&client_data->response.wait_queue);
 438 }
 439
 440 /**
 441  * loader_cl_event_cb() - bus driver callback for incoming message
 442  * @cl_device:          Pointer to the ishtp client device for which this
 443  *                      message is targeted
 444  *
 445  * Remove the packet from the list and process the message by calling
 446  * process_recv
 447  */
 448 static void loader_cl_event_cb(struct ishtp_cl_device *cl_device)
 449 {
 450         struct ishtp_cl_rb *rb_in_proc;
 451         struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
 452
 453         while ((rb_in_proc = ishtp_cl_rx_get_rb(loader_ishtp_cl)) != NULL) {
 454                 /* Process the data packet from firmware */
 455                 process_recv(loader_ishtp_cl, rb_in_proc);
 456         }
 457 }
 458
 459 /**
 460  * ish_query_loader_prop() -  Query ISH Shim firmware loader
 461  * @client_data:        Client data instance
 462  * @fw:                 Pointer to firmware data struct in host memory
 463  * @fw_info:            Loader firmware properties
 464  *
 465  * This function queries the ISH Shim firmware loader for capabilities.
 466  *
 467  * Return: 0 for success, negative error code for failure.
 468  */
 469 static int ish_query_loader_prop(struct ishtp_cl_data *client_data,
 470                                  const struct firmware *fw,
 471                                  struct shim_fw_info *fw_info)
 472 {
 473         int rv;
 474         struct loader_xfer_query ldr_xfer_query;
 475         struct loader_xfer_query_response ldr_xfer_query_resp;
 476
 477         memset(&ldr_xfer_query, 0, sizeof(ldr_xfer_query));
 478         ldr_xfer_query.hdr.command = LOADER_CMD_XFER_QUERY;
 479         ldr_xfer_query.image_size = fw->size;
 480         rv = loader_cl_send(client_data,
 481                             (u8 *)&ldr_xfer_query,
 482                             sizeof(ldr_xfer_query),
 483                             (u8 *)&ldr_xfer_query_resp,
 484                             sizeof(ldr_xfer_query_resp));
 485         if (rv < 0) {
 486                 client_data->flag_retry = true;
 487                 *fw_info = (struct shim_fw_info){};
 488                 return rv;
 489         }
 490
 491         /* On success, the return value is the received buffer size */
 492         if (rv != sizeof(struct loader_xfer_query_response)) {
 493                 dev_err(cl_data_to_dev(client_data),
 494                         "data size %d is not equal to size of loader_xfer_query_response %zu\n",
 495                         rv, sizeof(struct loader_xfer_query_response));
 496                 client_data->flag_retry = true;
 497                 *fw_info = (struct shim_fw_info){};
 498                 return -EMSGSIZE;
 499         }
 500
 501         /* Save fw_info for use outside this function */
 502         *fw_info = ldr_xfer_query_resp.fw_info;
 503
 504         /* Loader firmware properties */
 505         dev_dbg(cl_data_to_dev(client_data),
 506                 "ish_fw_version: major=%d minor=%d hotfix=%d build=%d protocol_version=0x%x loader_version=%d\n",
 507                 fw_info->ish_fw_version.major,
 508                 fw_info->ish_fw_version.minor,
 509                 fw_info->ish_fw_version.hotfix,
 510                 fw_info->ish_fw_version.build,
 511                 fw_info->protocol_version,
 512                 fw_info->ldr_version.value);
 513
 514         dev_dbg(cl_data_to_dev(client_data),
 515                 "loader_capability: max_fw_image_size=0x%x xfer_mode=%d max_dma_buf_size=0x%x dma_buf_size_limit=0x%x\n",
 516                 fw_info->ldr_capability.max_fw_image_size,
 517                 fw_info->ldr_capability.xfer_mode,
 518                 fw_info->ldr_capability.max_dma_buf_size,
 519                 dma_buf_size_limit);
 520
 521         /* Sanity checks */
 522         if (fw_info->ldr_capability.max_fw_image_size < fw->size) {
 523                 dev_err(cl_data_to_dev(client_data),
 524                         "ISH firmware size %zu is greater than Shim firmware loader max supported %d\n",
 525                         fw->size,
 526                         fw_info->ldr_capability.max_fw_image_size);
 527                 return -ENOSPC;
 528         }
 529
 530         /* For DMA the buffer size should be multiple of cacheline size */
 531         if ((fw_info->ldr_capability.xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) &&
 532             (fw_info->ldr_capability.max_dma_buf_size % L1_CACHE_BYTES)) {
 533                 dev_err(cl_data_to_dev(client_data),
 534                         "Shim firmware loader buffer size %d should be multiple of cacheline\n",
 535                         fw_info->ldr_capability.max_dma_buf_size);
 536                 return -EINVAL;
 537         }
 538
 539         return 0;
 540 }
 541
 542 /**
 543  * ish_fw_xfer_ishtp() - Loads ISH firmware using ishtp interface
 544  * @client_data:        Client data instance
 545  * @fw:                 Pointer to firmware data struct in host memory
 546  *
 547  * This function uses ISH-TP to transfer ISH firmware from host to
 548  * ISH SRAM. Lower layers may use IPC or DMA depending on firmware
 549  * support.
 550  *
 551  * Return: 0 for success, negative error code for failure.
 552  */
 553 static int ish_fw_xfer_ishtp(struct ishtp_cl_data *client_data,
 554                              const struct firmware *fw)
 555 {
 556         int rv;
 557         u32 fragment_offset, fragment_size, payload_max_size;
 558         struct loader_xfer_ipc_fragment *ldr_xfer_ipc_frag;
 559         struct loader_msg_hdr ldr_xfer_ipc_ack;
 560
 561         payload_max_size =
 562                 LOADER_SHIM_IPC_BUF_SIZE - IPC_FRAGMENT_DATA_PREAMBLE;
 563
 564         ldr_xfer_ipc_frag = kzalloc(LOADER_SHIM_IPC_BUF_SIZE, GFP_KERNEL);
 565         if (!ldr_xfer_ipc_frag) {
 566                 client_data->flag_retry = true;
 567                 return -ENOMEM;
 568         }
 569
 570         ldr_xfer_ipc_frag->fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
 571         ldr_xfer_ipc_frag->fragment.xfer_mode = LOADER_XFER_MODE_ISHTP;
 572
 573         /* Break the firmware image into fragments and send as ISH-TP payload */
 574         fragment_offset = 0;
 575         while (fragment_offset < fw->size) {
 576                 if (fragment_offset + payload_max_size < fw->size) {
 577                         fragment_size = payload_max_size;
 578                         ldr_xfer_ipc_frag->fragment.is_last = 0;
 579                 } else {
 580                         fragment_size = fw->size - fragment_offset;
 581                         ldr_xfer_ipc_frag->fragment.is_last = 1;
 582                 }
 583
 584                 ldr_xfer_ipc_frag->fragment.offset = fragment_offset;
 585                 ldr_xfer_ipc_frag->fragment.size = fragment_size;
 586                 memcpy(ldr_xfer_ipc_frag->data,
 587                        &fw->data[fragment_offset],
 588                        fragment_size);
 589
 590                 dev_dbg(cl_data_to_dev(client_data),
 591                         "xfer_mode=ipc offset=0x%08x size=0x%08x is_last=%d\n",
 592                         ldr_xfer_ipc_frag->fragment.offset,
 593                         ldr_xfer_ipc_frag->fragment.size,
 594                         ldr_xfer_ipc_frag->fragment.is_last);
 595
 596                 rv = loader_cl_send(client_data,
 597                                     (u8 *)ldr_xfer_ipc_frag,
 598                                     IPC_FRAGMENT_DATA_PREAMBLE + fragment_size,
 599                                     (u8 *)&ldr_xfer_ipc_ack,
 600                                     sizeof(ldr_xfer_ipc_ack));
 601                 if (rv < 0) {
 602                         client_data->flag_retry = true;
 603                         goto end_err_resp_buf_release;
 604                 }
 605
 606                 fragment_offset += fragment_size;
 607         }
 608
 609         kfree(ldr_xfer_ipc_frag);
 610         return 0;
 611
 612 end_err_resp_buf_release:
 613         /* Free ISH buffer if not done already, in error case */
 614         kfree(ldr_xfer_ipc_frag);
 615         return rv;
 616 }
 617
 618 /**
 619  * ish_fw_xfer_direct_dma() - Loads ISH firmware using direct dma
 620  * @client_data:        Client data instance
 621  * @fw:                 Pointer to firmware data struct in host memory
 622  * @fw_info:            Loader firmware properties
 623  *
 624  * Host firmware load is a unique case where we need to download
 625  * a large firmware image (200+ Kb). This function implements
 626  * direct DMA transfer in kernel and ISH firmware. This allows
 627  * us to overcome the ISH-TP 4 Kb limit, and allows us to DMA
 628  * directly to ISH UMA at location of choice.
 629  * Function depends on corresponding support in ISH firmware.
 630  *
 631  * Return: 0 for success, negative error code for failure.
 632  */
 633 static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
 634                                   const struct firmware *fw,
 635                                   const struct shim_fw_info fw_info)
 636 {
 637         int rv;
 638         void *dma_buf;
 639         dma_addr_t dma_buf_phy;
 640         u32 fragment_offset, fragment_size, payload_max_size;
 641         struct loader_msg_hdr ldr_xfer_dma_frag_ack;
 642         struct loader_xfer_dma_fragment ldr_xfer_dma_frag;
 643         struct device *devc = ishtp_get_pci_device(client_data->cl_device);
 644         u32 shim_fw_buf_size =
 645                 fw_info.ldr_capability.max_dma_buf_size;
 646
 647         /*
 648          * payload_max_size should be set to minimum of
 649          *  (1) Size of firmware to be loaded,
 650          *  (2) Max DMA buffer size supported by Shim firmware,
 651          *  (3) DMA buffer size limit set by boot_param dma_buf_size_limit.
 652          */
 653         payload_max_size = min3(fw->size,
 654                                 (size_t)shim_fw_buf_size,
 655                                 (size_t)dma_buf_size_limit);
 656
 657         /*
 658          * Buffer size should be multiple of cacheline size
 659          * if it's not, select the previous cacheline boundary.
 660          */
 661         payload_max_size &= ~(L1_CACHE_BYTES - 1);
 662
 663         dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32);
 664         if (!dma_buf) {
 665                 client_data->flag_retry = true;
 666                 return -ENOMEM;
 667         }
 668
 669         dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size,
 670                                      DMA_TO_DEVICE);
 671         if (dma_mapping_error(devc, dma_buf_phy)) {
 672                 dev_err(cl_data_to_dev(client_data), "DMA map failed\n");
 673                 client_data->flag_retry = true;
 674                 rv = -ENOMEM;
 675                 goto end_err_dma_buf_release;
 676         }
 677
 678         ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT;
 679         ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA;
 680         ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy;
 681
 682         /* Send the firmware image in chucks of payload_max_size */
 683         fragment_offset = 0;
 684         while (fragment_offset < fw->size) {
 685                 if (fragment_offset + payload_max_size < fw->size) {
 686                         fragment_size = payload_max_size;
 687                         ldr_xfer_dma_frag.fragment.is_last = 0;
 688                 } else {
 689                         fragment_size = fw->size - fragment_offset;
 690                         ldr_xfer_dma_frag.fragment.is_last = 1;
 691                 }
 692
 693                 ldr_xfer_dma_frag.fragment.offset = fragment_offset;
 694                 ldr_xfer_dma_frag.fragment.size = fragment_size;
 695                 memcpy(dma_buf, &fw->data[fragment_offset], fragment_size);
 696
 697                 dma_sync_single_for_device(devc, dma_buf_phy,
 698                                            payload_max_size,
 699                                            DMA_TO_DEVICE);
 700
 701                 /*
 702                  * Flush cache here because the dma_sync_single_for_device()
 703                  * does not do for x86.
 704                  */
 705                 clflush_cache_range(dma_buf, payload_max_size);
 706
 707                 dev_dbg(cl_data_to_dev(client_data),
 708                         "xfer_mode=dma offset=0x%08x size=0x%x is_last=%d ddr_phys_addr=0x%016llx\n",
 709                         ldr_xfer_dma_frag.fragment.offset,
 710                         ldr_xfer_dma_frag.fragment.size,
 711                         ldr_xfer_dma_frag.fragment.is_last,
 712                         ldr_xfer_dma_frag.ddr_phys_addr);
 713
 714                 rv = loader_cl_send(client_data,
 715                                     (u8 *)&ldr_xfer_dma_frag,
 716                                     sizeof(ldr_xfer_dma_frag),
 717                                     (u8 *)&ldr_xfer_dma_frag_ack,
 718                                     sizeof(ldr_xfer_dma_frag_ack));
 719                 if (rv < 0) {
 720                         client_data->flag_retry = true;
 721                         goto end_err_resp_buf_release;
 722                 }
 723
 724                 fragment_offset += fragment_size;
 725         }
 726
 727         dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
 728         kfree(dma_buf);
 729         return 0;
 730
 731 end_err_resp_buf_release:
 732         /* Free ISH buffer if not done already, in error case */
 733         dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE);
 734 end_err_dma_buf_release:
 735         kfree(dma_buf);
 736         return rv;
 737 }
 738
 739 /**
 740  * ish_fw_start() -     Start executing ISH main firmware
 741  * @client_data:        client data instance
 742  *
 743  * This function sends message to Shim firmware loader to start
 744  * the execution of ISH main firmware.
 745  *
 746  * Return: 0 for success, negative error code for failure.
 747  */
 748 static int ish_fw_start(struct ishtp_cl_data *client_data)
 749 {
 750         struct loader_start ldr_start;
 751         struct loader_msg_hdr ldr_start_ack;
 752
 753         memset(&ldr_start, 0, sizeof(ldr_start));
 754         ldr_start.hdr.command = LOADER_CMD_START;
 755         return loader_cl_send(client_data,
 756                             (u8 *)&ldr_start,
 757                             sizeof(ldr_start),
 758                             (u8 *)&ldr_start_ack,
 759                             sizeof(ldr_start_ack));
 760 }
 761
 762 /**
 763  * load_fw_from_host() - Loads ISH firmware from host
 764  * @client_data:        Client data instance
 765  *
 766  * This function loads the ISH firmware to ISH SRAM and starts execution
 767  *
 768  * Return: 0 for success, negative error code for failure.
 769  */
 770 static int load_fw_from_host(struct ishtp_cl_data *client_data)
 771 {
 772         int rv;
 773         u32 xfer_mode;
 774         char *filename;
 775         const struct firmware *fw;
 776         struct shim_fw_info fw_info;
 777         struct ishtp_cl *loader_ishtp_cl = client_data->loader_ishtp_cl;
 778
 779         client_data->flag_retry = false;
 780
 781         filename = kzalloc(FILENAME_SIZE, GFP_KERNEL);
 782         if (!filename) {
 783                 client_data->flag_retry = true;
 784                 rv = -ENOMEM;
 785                 goto end_error;
 786         }
 787
 788         /* Get filename of the ISH firmware to be loaded */
 789         rv = get_firmware_variant(client_data, filename);
 790         if (rv < 0)
 791                 goto end_err_filename_buf_release;
 792
 793         rv = request_firmware(&fw, filename, cl_data_to_dev(client_data));
 794         if (rv < 0)
 795                 goto end_err_filename_buf_release;
 796
 797         /* Step 1: Query Shim firmware loader properties */
 798
 799         rv = ish_query_loader_prop(client_data, fw, &fw_info);
 800         if (rv < 0)
 801                 goto end_err_fw_release;
 802
 803         /* Step 2: Send the main firmware image to be loaded, to ISH SRAM */
 804
 805         xfer_mode = fw_info.ldr_capability.xfer_mode;
 806         if (xfer_mode & LOADER_XFER_MODE_DIRECT_DMA) {
 807                 rv = ish_fw_xfer_direct_dma(client_data, fw, fw_info);
 808         } else if (xfer_mode & LOADER_XFER_MODE_ISHTP) {
 809                 rv = ish_fw_xfer_ishtp(client_data, fw);
 810         } else {
 811                 dev_err(cl_data_to_dev(client_data),
 812                         "No transfer mode selected in firmware\n");
 813                 rv = -EINVAL;
 814         }
 815         if (rv < 0)
 816                 goto end_err_fw_release;
 817
 818         /* Step 3: Start ISH main firmware exeuction */
 819
 820         rv = ish_fw_start(client_data);
 821         if (rv < 0)
 822                 goto end_err_fw_release;
 823
 824         release_firmware(fw);
 825         dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
 826                  filename);
 827         kfree(filename);
 828         return 0;
 829
 830 end_err_fw_release:
 831         release_firmware(fw);
 832 end_err_filename_buf_release:
 833         kfree(filename);
 834 end_error:
 835         /* Keep a count of retries, and give up after 3 attempts */
 836         if (client_data->flag_retry &&
 837             client_data->retry_count++ < MAX_LOAD_ATTEMPTS) {
 838                 dev_warn(cl_data_to_dev(client_data),
 839                          "ISH host firmware load failed %d. Resetting ISH, and trying again..\n",
 840                          rv);
 841                 ish_hw_reset(ishtp_get_ishtp_device(loader_ishtp_cl));
 842         } else {
 843                 dev_err(cl_data_to_dev(client_data),
 844                         "ISH host firmware load failed %d\n", rv);
 845         }
 846         return rv;
 847 }
 848
 849 static void load_fw_from_host_handler(struct work_struct *work)
 850 {
 851         struct ishtp_cl_data *client_data;
 852
 853         client_data = container_of(work, struct ishtp_cl_data,
 854                                    work_fw_load);
 855         load_fw_from_host(client_data);
 856 }
 857
 858 /**
 859  * loader_init() -      Init function for ISH-TP client
 860  * @loader_ishtp_cl:    ISH-TP client instance
 861  * @reset:              true if called for init after reset
 862  *
 863  * Return: 0 for success, negative error code for failure
 864  */
 865 static int loader_init(struct ishtp_cl *loader_ishtp_cl, int reset)
 866 {
 867         int rv;
 868         struct ishtp_fw_client *fw_client;
 869         struct ishtp_cl_data *client_data =
 870                 ishtp_get_client_data(loader_ishtp_cl);
 871
 872         dev_dbg(cl_data_to_dev(client_data), "reset flag: %d\n", reset);
 873
 874         rv = ishtp_cl_link(loader_ishtp_cl);
 875         if (rv < 0) {
 876                 dev_err(cl_data_to_dev(client_data), "ishtp_cl_link failed\n");
 877                 return rv;
 878         }
 879
 880         /* Connect to firmware client */
 881         ishtp_set_tx_ring_size(loader_ishtp_cl, LOADER_CL_TX_RING_SIZE);
 882         ishtp_set_rx_ring_size(loader_ishtp_cl, LOADER_CL_RX_RING_SIZE);
 883
 884         fw_client =
 885                 ishtp_fw_cl_get_client(ishtp_get_ishtp_device(loader_ishtp_cl),
 886                                        &loader_ishtp_id_table[0].guid);
 887         if (!fw_client) {
 888                 dev_err(cl_data_to_dev(client_data),
 889                         "ISH client uuid not found\n");
 890                 rv = -ENOENT;
 891                 goto err_cl_unlink;
 892         }
 893
 894         ishtp_cl_set_fw_client_id(loader_ishtp_cl,
 895                                   ishtp_get_fw_client_id(fw_client));
 896         ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_CONNECTING);
 897
 898         rv = ishtp_cl_connect(loader_ishtp_cl);
 899         if (rv < 0) {
 900                 dev_err(cl_data_to_dev(client_data), "Client connect fail\n");
 901                 goto err_cl_unlink;
 902         }
 903
 904         dev_dbg(cl_data_to_dev(client_data), "Client connected\n");
 905
 906         ishtp_register_event_cb(client_data->cl_device, loader_cl_event_cb);
 907
 908         return 0;
 909
 910 err_cl_unlink:
 911         ishtp_cl_unlink(loader_ishtp_cl);
 912         return rv;
 913 }
 914
 915 static void loader_deinit(struct ishtp_cl *loader_ishtp_cl)
 916 {
 917         ishtp_set_connection_state(loader_ishtp_cl, ISHTP_CL_DISCONNECTING);
 918         ishtp_cl_disconnect(loader_ishtp_cl);
 919         ishtp_cl_unlink(loader_ishtp_cl);
 920         ishtp_cl_flush_queues(loader_ishtp_cl);
 921
 922         /* Disband and free all Tx and Rx client-level rings */
 923         ishtp_cl_free(loader_ishtp_cl);
 924 }
 925
 926 static void reset_handler(struct work_struct *work)
 927 {
 928         int rv;
 929         struct ishtp_cl_data *client_data;
 930         struct ishtp_cl *loader_ishtp_cl;
 931         struct ishtp_cl_device *cl_device;
 932
 933         client_data = container_of(work, struct ishtp_cl_data,
 934                                    work_ishtp_reset);
 935
 936         loader_ishtp_cl = client_data->loader_ishtp_cl;
 937         cl_device = client_data->cl_device;
 938
 939         /* Unlink, flush queues & start again */
 940         ishtp_cl_unlink(loader_ishtp_cl);
 941         ishtp_cl_flush_queues(loader_ishtp_cl);
 942         ishtp_cl_free(loader_ishtp_cl);
 943
 944         loader_ishtp_cl = ishtp_cl_allocate(cl_device);
 945         if (!loader_ishtp_cl)
 946                 return;
 947
 948         ishtp_set_drvdata(cl_device, loader_ishtp_cl);
 949         ishtp_set_client_data(loader_ishtp_cl, client_data);
 950         client_data->loader_ishtp_cl = loader_ishtp_cl;
 951         client_data->cl_device = cl_device;
 952
 953         rv = loader_init(loader_ishtp_cl, 1);
 954         if (rv < 0) {
 955                 dev_err(ishtp_device(cl_device), "Reset Failed\n");
 956                 return;
 957         }
 958
 959         /* ISH firmware loading from host */
 960         load_fw_from_host(client_data);
 961 }
 962
 963 /**
 964  * loader_ishtp_cl_probe() - ISH-TP client driver probe
 965  * @cl_device:          ISH-TP client device instance
 966  *
 967  * This function gets called on device create on ISH-TP bus
 968  *
 969  * Return: 0 for success, negative error code for failure
 970  */
 971 static int loader_ishtp_cl_probe(struct ishtp_cl_device *cl_device)
 972 {
 973         struct ishtp_cl *loader_ishtp_cl;
 974         struct ishtp_cl_data *client_data;
 975         int rv;
 976
 977         client_data = devm_kzalloc(ishtp_device(cl_device),
 978                                    sizeof(*client_data),
 979                                    GFP_KERNEL);
 980         if (!client_data)
 981                 return -ENOMEM;
 982
 983         loader_ishtp_cl = ishtp_cl_allocate(cl_device);
 984         if (!loader_ishtp_cl)
 985                 return -ENOMEM;
 986
 987         ishtp_set_drvdata(cl_device, loader_ishtp_cl);
 988         ishtp_set_client_data(loader_ishtp_cl, client_data);
 989         client_data->loader_ishtp_cl = loader_ishtp_cl;
 990         client_data->cl_device = cl_device;
 991
 992         init_waitqueue_head(&client_data->response.wait_queue);
 993
 994         INIT_WORK(&client_data->work_ishtp_reset,
 995                   reset_handler);
 996         INIT_WORK(&client_data->work_fw_load,
 997                   load_fw_from_host_handler);
 998
 999         rv = loader_init(loader_ishtp_cl, 0);
1000         if (rv < 0) {
1001                 ishtp_cl_free(loader_ishtp_cl);
1002                 return rv;
1003         }
1004         ishtp_get_device(cl_device);
1005
1006         client_data->retry_count = 0;
1007
1008         /* ISH firmware loading from host */
1009         schedule_work(&client_data->work_fw_load);
1010
1011         return 0;
1012 }
1013
1014 /**
1015  * loader_ishtp_cl_remove() - ISH-TP client driver remove
1016  * @cl_device:          ISH-TP client device instance
1017  *
1018  * This function gets called on device remove on ISH-TP bus
1019  *
1020  * Return: 0
1021  */
1022 static void loader_ishtp_cl_remove(struct ishtp_cl_device *cl_device)
1023 {
1024         struct ishtp_cl_data *client_data;
1025         struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1026
1027         client_data = ishtp_get_client_data(loader_ishtp_cl);
1028
1029         /*
1030          * The sequence of the following two cancel_work_sync() is
1031          * important. The work_fw_load can in turn schedue
1032          * work_ishtp_reset, so first cancel work_fw_load then
1033          * cancel work_ishtp_reset.
1034          */
1035         cancel_work_sync(&client_data->work_fw_load);
1036         cancel_work_sync(&client_data->work_ishtp_reset);
1037         loader_deinit(loader_ishtp_cl);
1038         ishtp_put_device(cl_device);
1039 }
1040
1041 /**
1042  * loader_ishtp_cl_reset() - ISH-TP client driver reset
1043  * @cl_device:          ISH-TP client device instance
1044  *
1045  * This function gets called on device reset on ISH-TP bus
1046  *
1047  * Return: 0
1048  */
1049 static int loader_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
1050 {
1051         struct ishtp_cl_data *client_data;
1052         struct ishtp_cl *loader_ishtp_cl = ishtp_get_drvdata(cl_device);
1053
1054         client_data = ishtp_get_client_data(loader_ishtp_cl);
1055
1056         schedule_work(&client_data->work_ishtp_reset);
1057
1058         return 0;
1059 }
1060
1061 static struct ishtp_cl_driver   loader_ishtp_cl_driver = {
1062         .name = "ish-loader",
1063         .id = loader_ishtp_id_table,
1064         .probe = loader_ishtp_cl_probe,
1065         .remove = loader_ishtp_cl_remove,
1066         .reset = loader_ishtp_cl_reset,
1067 };
1068
1069 static int __init ish_loader_init(void)
1070 {
1071         return ishtp_cl_driver_register(&loader_ishtp_cl_driver, THIS_MODULE);
1072 }
1073
1074 static void __exit ish_loader_exit(void)
1075 {
1076         ishtp_cl_driver_unregister(&loader_ishtp_cl_driver);
1077 }
1078
1079 late_initcall(ish_loader_init);
1080 module_exit(ish_loader_exit);
1081
1082 module_param(dma_buf_size_limit, int, 0644);
1083 MODULE_PARM_DESC(dma_buf_size_limit, "Limit the DMA buf size to this value in bytes");
1084
1085 MODULE_DESCRIPTION("ISH ISH-TP Host firmware Loader Client Driver");
1086 MODULE_AUTHOR("Rushikesh S Kadam <[email protected]>");
1087
1088 MODULE_LICENSE("GPL v2");