1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2023, Intel Corporation.
4 * Intel Visual Sensing Controller Transport Layer Linux driver
7 #include <linux/acpi.h>
8 #include <linux/align.h>
9 #include <linux/bitfield.h>
10 #include <linux/bits.h>
11 #include <linux/cleanup.h>
12 #include <linux/firmware.h>
13 #include <linux/sizes.h>
14 #include <linux/slab.h>
15 #include <linux/string_helpers.h>
16 #include <linux/types.h>
18 #include <asm-generic/unaligned.h>
22 #define VSC_MAGIC_NUM 0x49505343 /* IPSC */
23 #define VSC_MAGIC_FW 0x49574653 /* IWFS */
24 #define VSC_MAGIC_FILE 0x46564353 /* FVCS */
26 #define VSC_ADDR_BASE 0xE0030000
27 #define VSC_EFUSE_ADDR (VSC_ADDR_BASE + 0x038)
28 #define VSC_STRAP_ADDR (VSC_ADDR_BASE + 0x100)
30 #define VSC_MAINSTEPPING_VERSION_MASK GENMASK(7, 4)
31 #define VSC_MAINSTEPPING_VERSION_A 0
33 #define VSC_SUBSTEPPING_VERSION_MASK GENMASK(3, 0)
34 #define VSC_SUBSTEPPING_VERSION_0 0
35 #define VSC_SUBSTEPPING_VERSION_1 2
37 #define VSC_BOOT_IMG_OPTION_MASK GENMASK(15, 0)
39 #define VSC_SKU_CFG_LOCATION 0x5001A000
40 #define VSC_SKU_MAX_SIZE 4100u
42 #define VSC_ACE_IMG_CNT 2
43 #define VSC_CSI_IMG_CNT 4
44 #define VSC_IMG_CNT_MAX 6
46 #define VSC_ROM_PKG_SIZE 256u
47 #define VSC_FW_PKG_SIZE 512u
49 #define VSC_IMAGE_DIR /*(DEBLOBBED)*/
51 #define VSC_CSI_IMAGE_NAME VSC_IMAGE_DIR "/*(DEBLOBBED)*/"
52 #define VSC_ACE_IMAGE_NAME_FMT VSC_IMAGE_DIR "/*(DEBLOBBED)*/"
53 #define VSC_CFG_IMAGE_NAME_FMT VSC_IMAGE_DIR "/*(DEBLOBBED)*/"
55 #define VSC_IMAGE_PATH_MAX_LEN 64
57 #define VSC_SENSOR_NAME_MAX_LEN 16
67 VSC_CMD_CAM_BOOT = 10,
70 /* command ack token */
72 VSC_TOKEN_BOOTLOADER_REQ = 1,
73 VSC_TOKEN_DUMP_RESP = 4,
79 VSC_IMG_BOOTLOADER_TYPE = 1,
80 VSC_IMG_CSI_EM7D_TYPE,
82 VSC_IMG_CSI_RUNTIME_TYPE,
83 VSC_IMG_ACE_VISION_TYPE,
90 VSC_IMG_BOOTLOADER_FRAG,
92 VSC_IMG_CSI_RUNTIME_FRAG,
93 VSC_IMG_ACE_VISION_FRAG,
95 VSC_IMG_CSI_EM7D_FRAG,
111 DECLARE_FLEX_ARRAY(__u8, res);
117 DECLARE_FLEX_ARRAY(__le32, payload);
119 /* download continue */
123 /* 8 is the offset of payload */
124 __u8 payload[VSC_ROM_PKG_SIZE - 8];
131 DECLARE_FLEX_ARRAY(__u8, payload);
133 /* 5 is the offset of padding */
134 __u8 padding[VSC_ROM_PKG_SIZE - 5];
138 struct vsc_rom_cmd_ack {
156 DECLARE_FLEX_ARRAY(__u8, res);
161 DECLARE_FLEX_ARRAY(__le32, payload);
166 DECLARE_FLEX_ARRAY(__u8, payload);
171 DECLARE_FLEX_ARRAY(__u8, payload);
173 /* 5 is the offset of padding */
174 __u8 padding[VSC_FW_PKG_SIZE - 5];
182 __le32 image_location[VSC_IMG_CNT_MAX];
191 struct vsc_image_code_data {
198 struct vsc_img_frag {
206 * struct vsc_fw_loader - represent vsc firmware loader
207 * @dev: device used to request fimware
208 * @tp: transport layer used with the firmware loader
214 * @option: command option
215 * @count: total image count
216 * @sensor_name: camera sensor name
217 * @frags: image fragments
219 struct vsc_fw_loader {
223 const struct firmware *csi;
224 const struct firmware *ace;
225 const struct firmware *cfg;
233 char sensor_name[VSC_SENSOR_NAME_MAX_LEN];
235 struct vsc_img_frag frags[VSC_IMG_FRAG_MAX];
238 static inline u32 vsc_sum_crc(void *data, size_t size)
243 for (i = 0; i < size; i++)
244 crc += *((u8 *)data + i);
249 /* get sensor name to construct image name */
250 static int vsc_get_sensor_name(struct vsc_fw_loader *fw_loader,
253 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER };
254 union acpi_object obj = {
255 .type = ACPI_TYPE_INTEGER,
258 struct acpi_object_list arg_list = {
262 union acpi_object *ret_obj;
267 handle = ACPI_HANDLE(dev);
271 status = acpi_evaluate_object(handle, "SID", &arg_list, &buffer);
272 if (ACPI_FAILURE(status)) {
273 dev_err(dev, "can't evaluate SID method: %d\n", status);
277 ret_obj = buffer.pointer;
279 dev_err(dev, "can't locate ACPI buffer\n");
283 if (ret_obj->type != ACPI_TYPE_STRING) {
284 dev_err(dev, "found non-string entry\n");
289 /* string length excludes trailing NUL */
290 if (ret_obj->string.length >= sizeof(fw_loader->sensor_name)) {
291 dev_err(dev, "sensor name buffer too small\n");
296 memcpy(fw_loader->sensor_name, ret_obj->string.pointer,
297 ret_obj->string.length);
299 string_lower(fw_loader->sensor_name, fw_loader->sensor_name);
302 ACPI_FREE(buffer.pointer);
307 static int vsc_identify_silicon(struct vsc_fw_loader *fw_loader)
309 struct vsc_rom_cmd_ack *ack = fw_loader->rx_buf;
310 struct vsc_rom_cmd *cmd = fw_loader->tx_buf;
311 u8 version, sub_version;
314 /* identify stepping information */
315 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
316 cmd->cmd_id = VSC_CMD_DUMP_MEM;
317 cmd->data.dump_mem.addr = cpu_to_le32(VSC_EFUSE_ADDR);
318 cmd->data.dump_mem.len = cpu_to_le16(sizeof(__le32));
319 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, ack, VSC_ROM_PKG_SIZE);
322 if (ack->token == VSC_TOKEN_ERROR)
325 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
326 cmd->cmd_id = VSC_CMD_GET_CONT;
327 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, ack, VSC_ROM_PKG_SIZE);
330 if (ack->token != VSC_TOKEN_DUMP_RESP)
333 version = FIELD_GET(VSC_MAINSTEPPING_VERSION_MASK, ack->payload[0]);
334 sub_version = FIELD_GET(VSC_SUBSTEPPING_VERSION_MASK, ack->payload[0]);
336 if (version != VSC_MAINSTEPPING_VERSION_A)
339 if (sub_version != VSC_SUBSTEPPING_VERSION_0 &&
340 sub_version != VSC_SUBSTEPPING_VERSION_1)
343 dev_info(fw_loader->dev, "silicon stepping version is %u:%u\n",
344 version, sub_version);
346 /* identify strap information */
347 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
348 cmd->cmd_id = VSC_CMD_DUMP_MEM;
349 cmd->data.dump_mem.addr = cpu_to_le32(VSC_STRAP_ADDR);
350 cmd->data.dump_mem.len = cpu_to_le16(sizeof(__le32));
351 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, ack, VSC_ROM_PKG_SIZE);
354 if (ack->token == VSC_TOKEN_ERROR)
357 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
358 cmd->cmd_id = VSC_CMD_GET_CONT;
359 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, ack, VSC_ROM_PKG_SIZE);
362 if (ack->token != VSC_TOKEN_DUMP_RESP)
368 static int vsc_identify_csi_image(struct vsc_fw_loader *fw_loader)
370 const struct firmware *image;
371 struct vsc_fw_sign *sign;
376 ret = reject_firmware(&image, VSC_CSI_IMAGE_NAME, fw_loader->dev);
380 img = (struct vsc_img *)image->data;
383 goto err_release_image;
386 if (le32_to_cpu(img->magic) != VSC_MAGIC_FILE) {
388 goto err_release_image;
391 if (le32_to_cpu(img->image_count) != VSC_CSI_IMG_CNT) {
393 goto err_release_image;
395 fw_loader->count += le32_to_cpu(img->image_count) - 1;
398 FIELD_GET(VSC_BOOT_IMG_OPTION_MASK, le32_to_cpu(img->option));
400 sign = (struct vsc_fw_sign *)
401 (img->image_location + le32_to_cpu(img->image_count));
403 for (i = 0; i < VSC_CSI_IMG_CNT; i++) {
404 /* mapping from CSI image index to image code data */
405 static const struct vsc_image_code_data csi_image_map[] = {
406 { VSC_IMG_BOOTLOADER_FRAG, VSC_IMG_BOOTLOADER_TYPE },
407 { VSC_IMG_CSI_SEM_FRAG, VSC_IMG_CSI_SEM_TYPE },
408 { VSC_IMG_CSI_RUNTIME_FRAG, VSC_IMG_CSI_RUNTIME_TYPE },
409 { VSC_IMG_CSI_EM7D_FRAG, VSC_IMG_CSI_EM7D_TYPE },
411 struct vsc_img_frag *frag;
413 if ((u8 *)sign + sizeof(*sign) > image->data + image->size) {
415 goto err_release_image;
418 if (le32_to_cpu(sign->magic) != VSC_MAGIC_FW) {
420 goto err_release_image;
423 if (!le32_to_cpu(img->image_location[i])) {
425 goto err_release_image;
428 frag = &fw_loader->frags[csi_image_map[i].frag_index];
430 frag->data = sign->image;
431 frag->size = le32_to_cpu(sign->image_size);
432 frag->location = le32_to_cpu(img->image_location[i]);
433 frag->type = csi_image_map[i].image_type;
435 sign = (struct vsc_fw_sign *)
436 (sign->image + le32_to_cpu(sign->image_size));
439 fw_loader->csi = image;
444 release_firmware(image);
449 static int vsc_identify_ace_image(struct vsc_fw_loader *fw_loader)
451 char path[VSC_IMAGE_PATH_MAX_LEN];
452 const struct firmware *image;
453 struct vsc_fw_sign *sign;
458 snprintf(path, sizeof(path), VSC_ACE_IMAGE_NAME_FMT,
459 fw_loader->sensor_name);
461 ret = reject_firmware(&image, path, fw_loader->dev);
465 img = (struct vsc_img *)image->data;
468 goto err_release_image;
471 if (le32_to_cpu(img->magic) != VSC_MAGIC_FILE) {
473 goto err_release_image;
476 if (le32_to_cpu(img->image_count) != VSC_ACE_IMG_CNT) {
478 goto err_release_image;
480 fw_loader->count += le32_to_cpu(img->image_count);
482 sign = (struct vsc_fw_sign *)
483 (img->image_location + le32_to_cpu(img->image_count));
485 for (i = 0; i < VSC_ACE_IMG_CNT; i++) {
486 /* mapping from ACE image index to image code data */
487 static const struct vsc_image_code_data ace_image_map[] = {
488 { VSC_IMG_ACE_VISION_FRAG, VSC_IMG_ACE_VISION_TYPE },
489 { VSC_IMG_ACE_CFG_FRAG, VSC_IMG_ACE_CFG_TYPE },
491 struct vsc_img_frag *frag, *last_frag;
494 if ((u8 *)sign + sizeof(*sign) > image->data + image->size) {
496 goto err_release_image;
499 if (le32_to_cpu(sign->magic) != VSC_MAGIC_FW) {
501 goto err_release_image;
504 frag_index = ace_image_map[i].frag_index;
505 frag = &fw_loader->frags[frag_index];
507 frag->data = sign->image;
508 frag->size = le32_to_cpu(sign->image_size);
509 frag->location = le32_to_cpu(img->image_location[i]);
510 frag->type = ace_image_map[i].image_type;
512 if (!frag->location) {
513 last_frag = &fw_loader->frags[frag_index - 1];
515 ALIGN(last_frag->location + last_frag->size, SZ_4K);
518 sign = (struct vsc_fw_sign *)
519 (sign->image + le32_to_cpu(sign->image_size));
522 fw_loader->ace = image;
527 release_firmware(image);
532 static int vsc_identify_cfg_image(struct vsc_fw_loader *fw_loader)
534 struct vsc_img_frag *frag = &fw_loader->frags[VSC_IMG_SKU_CFG_FRAG];
535 char path[VSC_IMAGE_PATH_MAX_LEN];
536 const struct firmware *image;
540 snprintf(path, sizeof(path), VSC_CFG_IMAGE_NAME_FMT,
541 fw_loader->sensor_name);
543 ret = reject_firmware(&image, path, fw_loader->dev);
547 /* identify image size */
548 if (image->size <= sizeof(u32) || image->size > VSC_SKU_MAX_SIZE) {
550 goto err_release_image;
553 size = le32_to_cpu(*((__le32 *)image->data)) + sizeof(u32);
554 if (image->size != size) {
556 goto err_release_image;
559 frag->data = image->data;
560 frag->size = image->size;
561 frag->type = VSC_IMG_SKU_CFG_TYPE;
562 frag->location = VSC_SKU_CFG_LOCATION;
564 fw_loader->cfg = image;
569 release_firmware(image);
574 static int vsc_download_bootloader(struct vsc_fw_loader *fw_loader)
576 struct vsc_img_frag *frag = &fw_loader->frags[VSC_IMG_BOOTLOADER_FRAG];
577 struct vsc_rom_cmd_ack *ack = fw_loader->rx_buf;
578 struct vsc_rom_cmd *cmd = fw_loader->tx_buf;
584 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
585 cmd->cmd_id = VSC_CMD_QUERY;
586 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, ack, VSC_ROM_PKG_SIZE);
589 if (ack->token != VSC_TOKEN_DUMP_RESP &&
590 ack->token != VSC_TOKEN_BOOTLOADER_REQ)
593 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
594 cmd->cmd_id = VSC_CMD_DL_START;
595 cmd->data.dl_start.option = cpu_to_le16(fw_loader->option);
596 cmd->data.dl_start.img_type = frag->type;
597 cmd->data.dl_start.img_len = cpu_to_le32(frag->size);
598 cmd->data.dl_start.img_loc = cpu_to_le32(frag->location);
600 c_len = offsetof(struct vsc_rom_cmd, data.dl_start.crc);
601 cmd->data.dl_start.crc = cpu_to_le32(vsc_sum_crc(cmd, c_len));
603 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, NULL, VSC_ROM_PKG_SIZE);
610 /* download image data */
612 len = min(remain, sizeof(cmd->data.dl_cont.payload));
614 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
615 cmd->cmd_id = VSC_CMD_DL_CONT;
616 cmd->data.dl_cont.len = cpu_to_le16(len);
617 cmd->data.dl_cont.end_flag = remain == len;
618 memcpy(cmd->data.dl_cont.payload, p, len);
620 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, NULL, VSC_ROM_PKG_SIZE);
631 static int vsc_download_firmware(struct vsc_fw_loader *fw_loader)
633 struct vsc_fw_cmd *cmd = fw_loader->tx_buf;
634 unsigned int i, index = 0;
638 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
639 cmd->cmd_id = VSC_CMD_DL_SET;
640 cmd->data.dl_set.img_cnt = cpu_to_le16(fw_loader->count);
641 put_unaligned_le16(fw_loader->option, &cmd->data.dl_set.option);
643 for (i = VSC_IMG_CSI_SEM_FRAG; i <= VSC_IMG_CSI_EM7D_FRAG; i++) {
644 struct vsc_img_frag *frag = &fw_loader->frags[i];
646 cmd->data.dl_set.payload[index++] = cpu_to_le32(frag->location);
647 cmd->data.dl_set.payload[index++] = cpu_to_le32(frag->size);
650 c_len = offsetof(struct vsc_fw_cmd, data.dl_set.payload[index]);
651 cmd->data.dl_set.payload[index] = cpu_to_le32(vsc_sum_crc(cmd, c_len));
653 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, NULL, VSC_FW_PKG_SIZE);
657 for (i = VSC_IMG_CSI_SEM_FRAG; i < VSC_IMG_FRAG_MAX; i++) {
658 struct vsc_img_frag *frag = &fw_loader->frags[i];
662 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
663 cmd->cmd_id = VSC_CMD_DL_START;
664 cmd->data.dl_start.img_type = frag->type;
665 cmd->data.dl_start.img_len = cpu_to_le32(frag->size);
666 cmd->data.dl_start.img_loc = cpu_to_le32(frag->location);
667 put_unaligned_le16(fw_loader->option, &cmd->data.dl_start.option);
669 c_len = offsetof(struct vsc_fw_cmd, data.dl_start.crc);
670 cmd->data.dl_start.crc = cpu_to_le32(vsc_sum_crc(cmd, c_len));
672 ret = vsc_tp_rom_xfer(fw_loader->tp, cmd, NULL, VSC_FW_PKG_SIZE);
679 /* download image data */
681 u32 len = min(remain, VSC_FW_PKG_SIZE);
683 memcpy(fw_loader->tx_buf, p, len);
684 memset(fw_loader->tx_buf + len, 0, VSC_FW_PKG_SIZE - len);
686 ret = vsc_tp_rom_xfer(fw_loader->tp, fw_loader->tx_buf,
687 NULL, VSC_FW_PKG_SIZE);
696 cmd->magic = cpu_to_le32(VSC_MAGIC_NUM);
697 cmd->cmd_id = VSC_CMD_CAM_BOOT;
699 c_len = offsetof(struct vsc_fw_cmd, data.dl_start.crc);
700 cmd->data.boot.crc = cpu_to_le32(vsc_sum_crc(cmd, c_len));
702 return vsc_tp_rom_xfer(fw_loader->tp, cmd, NULL, VSC_FW_PKG_SIZE);
706 * vsc_tp_init - init vsc_tp
707 * @tp: vsc_tp device handle
708 * @dev: device node for mei vsc device
709 * Return: 0 in case of success, negative value in case of error
711 int vsc_tp_init(struct vsc_tp *tp, struct device *dev)
713 struct vsc_fw_loader *fw_loader __free(kfree) = NULL;
714 void *tx_buf __free(kfree) = NULL;
715 void *rx_buf __free(kfree) = NULL;
718 fw_loader = kzalloc(sizeof(*fw_loader), GFP_KERNEL);
722 tx_buf = kzalloc(VSC_FW_PKG_SIZE, GFP_KERNEL);
726 rx_buf = kzalloc(VSC_FW_PKG_SIZE, GFP_KERNEL);
730 fw_loader->tx_buf = tx_buf;
731 fw_loader->rx_buf = rx_buf;
734 fw_loader->dev = dev;
736 ret = vsc_get_sensor_name(fw_loader, dev);
740 ret = vsc_identify_silicon(fw_loader);
744 ret = vsc_identify_csi_image(fw_loader);
748 ret = vsc_identify_ace_image(fw_loader);
750 goto err_release_csi;
752 ret = vsc_identify_cfg_image(fw_loader);
754 goto err_release_ace;
756 ret = vsc_download_bootloader(fw_loader);
758 ret = vsc_download_firmware(fw_loader);
760 release_firmware(fw_loader->cfg);
763 release_firmware(fw_loader->ace);
766 release_firmware(fw_loader->csi);
770 EXPORT_SYMBOL_NS_GPL(vsc_tp_init, VSC_TP);