2 * Copyright (c) 2014-2017 Qualcomm Atheros, Inc.
3 * Copyright (c) 2018, The Linux Foundation. All rights reserved.
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 /* Algorithmic part of the firmware download.
19 * To be included in the container file providing framework
22 #define wil_err_fw(wil, fmt, arg...) wil_err(wil, "ERR[ FW ]" fmt, ##arg)
23 #define wil_dbg_fw(wil, fmt, arg...) wil_dbg(wil, "DBG[ FW ]" fmt, ##arg)
24 #define wil_hex_dump_fw(prefix_str, prefix_type, rowsize, \
25 groupsize, buf, len, ascii) \
26 print_hex_dump_debug("DBG[ FW ]" prefix_str, \
27 prefix_type, rowsize, \
28 groupsize, buf, len, ascii)
30 static bool wil_fw_addr_check(struct wil6210_priv *wil,
31 void __iomem **ioaddr, __le32 val,
32 u32 size, const char *msg)
34 *ioaddr = wmi_buffer_block(wil, val, size);
36 wil_err_fw(wil, "bad %s: 0x%08x\n", msg, le32_to_cpu(val));
43 * wil_fw_verify - verify firmware file validity
45 * perform various checks for the firmware file header.
46 * records are not validated.
48 * Return file size or negative error
50 static int wil_fw_verify(struct wil6210_priv *wil, const u8 *data, size_t size)
52 const struct wil_fw_record_head *hdr = (const void *)data;
53 struct wil_fw_record_file_header fh;
54 const struct wil_fw_record_file_header *fh_;
59 wil_err_fw(wil, "image size not aligned: %zu\n", size);
62 /* have enough data for the file header? */
63 if (size < sizeof(*hdr) + sizeof(fh)) {
64 wil_err_fw(wil, "file too short: %zu bytes\n", size);
68 /* start with the file header? */
69 if (le16_to_cpu(hdr->type) != wil_fw_type_file_header) {
70 wil_err_fw(wil, "no file header\n");
75 fh_ = (struct wil_fw_record_file_header *)&hdr[1];
76 dlen = le32_to_cpu(fh_->data_len);
78 wil_err_fw(wil, "data length not aligned: %lu\n", (ulong)dlen);
82 wil_err_fw(wil, "file truncated at %zu/%lu\n",
86 if (dlen < sizeof(*hdr) + sizeof(fh)) {
87 wil_err_fw(wil, "data length too short: %lu\n", (ulong)dlen);
92 if (le32_to_cpu(fh_->signature) != WIL_FW_SIGNATURE) {
93 wil_err_fw(wil, "bad header signature: 0x%08x\n",
94 le32_to_cpu(fh_->signature));
99 if (le32_to_cpu(fh_->version) > WIL_FW_FMT_VERSION) {
100 wil_err_fw(wil, "unsupported header version: %d\n",
101 le32_to_cpu(fh_->version));
105 /* checksum. ~crc32(~0, data, size) when fh.crc set to 0*/
109 crc = crc32_le(~0, (unsigned char const *)hdr, sizeof(*hdr));
110 crc = crc32_le(crc, (unsigned char const *)&fh, sizeof(fh));
111 crc = crc32_le(crc, (unsigned char const *)&fh_[1],
112 dlen - sizeof(*hdr) - sizeof(fh));
115 if (crc != le32_to_cpu(fh_->crc)) {
116 wil_err_fw(wil, "checksum mismatch:"
117 " calculated for %lu bytes 0x%08x != 0x%08x\n",
118 (ulong)dlen, crc, le32_to_cpu(fh_->crc));
125 static int fw_ignore_section(struct wil6210_priv *wil, const void *data,
132 fw_handle_capabilities(struct wil6210_priv *wil, const void *data,
135 const struct wil_fw_record_capabilities *rec = data;
138 if (size < sizeof(*rec)) {
139 wil_err_fw(wil, "capabilities record too short: %zu\n", size);
140 /* let the FW load anyway */
144 capa_size = size - offsetof(struct wil_fw_record_capabilities,
146 bitmap_zero(wil->fw_capabilities, WMI_FW_CAPABILITY_MAX);
147 memcpy(wil->fw_capabilities, rec->capabilities,
148 min_t(size_t, sizeof(wil->fw_capabilities), capa_size));
149 wil_hex_dump_fw("CAPA", DUMP_PREFIX_OFFSET, 16, 1,
150 rec->capabilities, capa_size, false);
155 fw_handle_brd_file(struct wil6210_priv *wil, const void *data,
158 const struct wil_fw_record_brd_file *rec = data;
160 if (size < sizeof(*rec)) {
161 wil_err_fw(wil, "brd_file record too short: %zu\n", size);
165 wil->brd_file_addr = le32_to_cpu(rec->base_addr);
166 wil->brd_file_max_size = le32_to_cpu(rec->max_size_bytes);
168 wil_dbg_fw(wil, "brd_file_addr 0x%x, brd_file_max_size %d\n",
169 wil->brd_file_addr, wil->brd_file_max_size);
175 fw_handle_concurrency(struct wil6210_priv *wil, const void *data,
178 const struct wil_fw_record_concurrency *rec = data;
179 const struct wil_fw_concurrency_combo *combo;
180 const struct wil_fw_concurrency_limit *limit;
181 size_t remain, lsize;
184 if (size < sizeof(*rec)) {
185 wil_err_fw(wil, "concurrency record too short: %zu\n", size);
186 /* continue, let the FW load anyway */
190 n_combos = le16_to_cpu(rec->n_combos);
191 remain = size - offsetof(struct wil_fw_record_concurrency, combos);
193 for (i = 0; i < n_combos; i++) {
194 if (remain < sizeof(*combo))
196 remain -= sizeof(*combo);
197 limit = combo->limits;
198 lsize = combo->n_limits * sizeof(*limit);
202 limit += combo->n_limits;
203 combo = (struct wil_fw_concurrency_combo *)limit;
206 return wil_cfg80211_iface_combinations_from_fw(wil, rec);
208 wil_err_fw(wil, "concurrency record truncated\n");
213 fw_handle_comment(struct wil6210_priv *wil, const void *data,
216 const struct wil_fw_record_comment_hdr *hdr = data;
220 if (size < sizeof(*hdr))
223 magic = le32_to_cpu(hdr->magic);
226 case WIL_FW_CAPABILITIES_MAGIC:
227 wil_dbg_fw(wil, "magic is WIL_FW_CAPABILITIES_MAGIC\n");
228 rc = fw_handle_capabilities(wil, data, size);
230 case WIL_BRD_FILE_MAGIC:
231 wil_dbg_fw(wil, "magic is WIL_BRD_FILE_MAGIC\n");
232 rc = fw_handle_brd_file(wil, data, size);
234 case WIL_FW_CONCURRENCY_MAGIC:
235 wil_dbg_fw(wil, "magic is WIL_FW_CONCURRENCY_MAGIC\n");
236 rc = fw_handle_concurrency(wil, data, size);
239 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1,
246 static int __fw_handle_data(struct wil6210_priv *wil, const void *data,
247 size_t size, __le32 addr)
249 const struct wil_fw_record_data *d = data;
251 size_t s = size - sizeof(*d);
253 if (size < sizeof(*d) + sizeof(u32)) {
254 wil_err_fw(wil, "data record too short: %zu\n", size);
258 if (!wil_fw_addr_check(wil, &dst, addr, s, "address"))
260 wil_dbg_fw(wil, "write [0x%08x] <== %zu bytes\n", le32_to_cpu(addr), s);
261 wil_memcpy_toio_32(dst, d->data, s);
262 wmb(); /* finish before processing next record */
267 static int fw_handle_data(struct wil6210_priv *wil, const void *data,
270 const struct wil_fw_record_data *d = data;
272 return __fw_handle_data(wil, data, size, d->addr);
275 static int fw_handle_fill(struct wil6210_priv *wil, const void *data,
278 const struct wil_fw_record_fill *d = data;
281 size_t s = (size_t)le32_to_cpu(d->size);
283 if (size != sizeof(*d)) {
284 wil_err_fw(wil, "bad size for fill record: %zu\n", size);
288 if (s < sizeof(u32)) {
289 wil_err_fw(wil, "fill size too short: %zu\n", s);
293 if (s % sizeof(u32)) {
294 wil_err_fw(wil, "fill size not aligned: %zu\n", s);
298 if (!wil_fw_addr_check(wil, &dst, d->addr, s, "address"))
301 v = le32_to_cpu(d->value);
302 wil_dbg_fw(wil, "fill [0x%08x] <== 0x%08x, %zu bytes\n",
303 le32_to_cpu(d->addr), v, s);
304 wil_memset_toio_32(dst, v, s);
305 wmb(); /* finish before processing next record */
310 static int fw_handle_file_header(struct wil6210_priv *wil, const void *data,
313 const struct wil_fw_record_file_header *d = data;
315 if (size != sizeof(*d)) {
316 wil_err_fw(wil, "file header length incorrect: %zu\n", size);
320 wil_dbg_fw(wil, "new file, ver. %d, %i bytes\n",
321 d->version, d->data_len);
322 wil_hex_dump_fw("", DUMP_PREFIX_OFFSET, 16, 1, d->comment,
323 sizeof(d->comment), true);
325 if (!memcmp(d->comment, WIL_FW_VERSION_PREFIX,
326 WIL_FW_VERSION_PREFIX_LEN))
327 memcpy(wil->fw_version,
328 d->comment + WIL_FW_VERSION_PREFIX_LEN,
329 min(sizeof(d->comment) - WIL_FW_VERSION_PREFIX_LEN,
330 sizeof(wil->fw_version) - 1));
335 static int fw_handle_direct_write(struct wil6210_priv *wil, const void *data,
338 const struct wil_fw_record_direct_write *d = data;
339 const struct wil_fw_data_dwrite *block = d->data;
342 if (size % sizeof(*block)) {
343 wil_err_fw(wil, "record size not aligned on %zu: %zu\n",
344 sizeof(*block), size);
347 n = size / sizeof(*block);
349 for (i = 0; i < n; i++) {
351 u32 m = le32_to_cpu(block[i].mask);
352 u32 v = le32_to_cpu(block[i].value);
355 if (!wil_fw_addr_check(wil, &dst, block[i].addr, 0, "address"))
359 y = (x & m) | (v & ~m);
360 wil_dbg_fw(wil, "write [0x%08x] <== 0x%08x "
361 "(old 0x%08x val 0x%08x mask 0x%08x)\n",
362 le32_to_cpu(block[i].addr), y, x, v, m);
364 wmb(); /* finish before processing next record */
370 static int gw_write(struct wil6210_priv *wil, void __iomem *gwa_addr,
371 void __iomem *gwa_cmd, void __iomem *gwa_ctl, u32 gw_cmd,
377 writel(gw_cmd, gwa_cmd);
378 wmb(); /* finish before activate gw */
380 writel(WIL_FW_GW_CTL_RUN, gwa_ctl); /* activate gw */
382 udelay(1); /* typical time is few usec */
384 wil_err_fw(wil, "gw timeout\n");
387 } while (readl(gwa_ctl) & WIL_FW_GW_CTL_BUSY); /* gw done? */
392 static int fw_handle_gateway_data(struct wil6210_priv *wil, const void *data,
395 const struct wil_fw_record_gateway_data *d = data;
396 const struct wil_fw_data_gw *block = d->data;
397 void __iomem *gwa_addr;
398 void __iomem *gwa_val;
399 void __iomem *gwa_cmd;
400 void __iomem *gwa_ctl;
404 if (size < sizeof(*d) + sizeof(*block)) {
405 wil_err_fw(wil, "gateway record too short: %zu\n", size);
409 if ((size - sizeof(*d)) % sizeof(*block)) {
410 wil_err_fw(wil, "gateway record data size"
411 " not aligned on %zu: %zu\n",
412 sizeof(*block), size - sizeof(*d));
415 n = (size - sizeof(*d)) / sizeof(*block);
417 gw_cmd = le32_to_cpu(d->command);
419 wil_dbg_fw(wil, "gw write record [%3d] blocks, cmd 0x%08x\n",
422 if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
423 "gateway_addr_addr") ||
424 !wil_fw_addr_check(wil, &gwa_val, d->gateway_value_addr, 0,
425 "gateway_value_addr") ||
426 !wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
427 "gateway_cmd_addr") ||
428 !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
429 "gateway_ctrl_address"))
432 wil_dbg_fw(wil, "gw addresses: addr 0x%08x val 0x%08x"
433 " cmd 0x%08x ctl 0x%08x\n",
434 le32_to_cpu(d->gateway_addr_addr),
435 le32_to_cpu(d->gateway_value_addr),
436 le32_to_cpu(d->gateway_cmd_addr),
437 le32_to_cpu(d->gateway_ctrl_address));
439 for (i = 0; i < n; i++) {
441 u32 a = le32_to_cpu(block[i].addr);
442 u32 v = le32_to_cpu(block[i].value);
444 wil_dbg_fw(wil, " gw write[%3d] [0x%08x] <== 0x%08x\n",
448 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
456 static int fw_handle_gateway_data4(struct wil6210_priv *wil, const void *data,
459 const struct wil_fw_record_gateway_data4 *d = data;
460 const struct wil_fw_data_gw4 *block = d->data;
461 void __iomem *gwa_addr;
462 void __iomem *gwa_val[ARRAY_SIZE(block->value)];
463 void __iomem *gwa_cmd;
464 void __iomem *gwa_ctl;
468 if (size < sizeof(*d) + sizeof(*block)) {
469 wil_err_fw(wil, "gateway4 record too short: %zu\n", size);
473 if ((size - sizeof(*d)) % sizeof(*block)) {
474 wil_err_fw(wil, "gateway4 record data size"
475 " not aligned on %zu: %zu\n",
476 sizeof(*block), size - sizeof(*d));
479 n = (size - sizeof(*d)) / sizeof(*block);
481 gw_cmd = le32_to_cpu(d->command);
483 wil_dbg_fw(wil, "gw4 write record [%3d] blocks, cmd 0x%08x\n",
486 if (!wil_fw_addr_check(wil, &gwa_addr, d->gateway_addr_addr, 0,
487 "gateway_addr_addr"))
489 for (k = 0; k < ARRAY_SIZE(block->value); k++)
490 if (!wil_fw_addr_check(wil, &gwa_val[k],
491 d->gateway_value_addr[k],
492 0, "gateway_value_addr"))
494 if (!wil_fw_addr_check(wil, &gwa_cmd, d->gateway_cmd_addr, 0,
495 "gateway_cmd_addr") ||
496 !wil_fw_addr_check(wil, &gwa_ctl, d->gateway_ctrl_address, 0,
497 "gateway_ctrl_address"))
500 wil_dbg_fw(wil, "gw4 addresses: addr 0x%08x cmd 0x%08x ctl 0x%08x\n",
501 le32_to_cpu(d->gateway_addr_addr),
502 le32_to_cpu(d->gateway_cmd_addr),
503 le32_to_cpu(d->gateway_ctrl_address));
504 wil_hex_dump_fw("val addresses: ", DUMP_PREFIX_NONE, 16, 4,
505 d->gateway_value_addr, sizeof(d->gateway_value_addr),
508 for (i = 0; i < n; i++) {
510 u32 a = le32_to_cpu(block[i].addr);
511 u32 v[ARRAY_SIZE(block->value)];
513 for (k = 0; k < ARRAY_SIZE(block->value); k++)
514 v[k] = le32_to_cpu(block[i].value[k]);
516 wil_dbg_fw(wil, " gw4 write[%3d] [0x%08x] <==\n", i, a);
517 wil_hex_dump_fw(" val ", DUMP_PREFIX_NONE, 16, 4, v,
520 for (k = 0; k < ARRAY_SIZE(block->value); k++)
521 writel(v[k], gwa_val[k]);
522 rc = gw_write(wil, gwa_addr, gwa_cmd, gwa_ctl, gw_cmd, a);
530 static const struct {
532 int (*load_handler)(struct wil6210_priv *wil, const void *data,
534 int (*parse_handler)(struct wil6210_priv *wil, const void *data,
536 } wil_fw_handlers[] = {
537 {wil_fw_type_comment, fw_handle_comment, fw_handle_comment},
538 {wil_fw_type_data, fw_handle_data, fw_ignore_section},
539 {wil_fw_type_fill, fw_handle_fill, fw_ignore_section},
540 /* wil_fw_type_action */
541 /* wil_fw_type_verify */
542 {wil_fw_type_file_header, fw_handle_file_header,
543 fw_handle_file_header},
544 {wil_fw_type_direct_write, fw_handle_direct_write, fw_ignore_section},
545 {wil_fw_type_gateway_data, fw_handle_gateway_data, fw_ignore_section},
546 {wil_fw_type_gateway_data4, fw_handle_gateway_data4,
550 static int wil_fw_handle_record(struct wil6210_priv *wil, int type,
551 const void *data, size_t size, bool load)
555 for (i = 0; i < ARRAY_SIZE(wil_fw_handlers); i++)
556 if (wil_fw_handlers[i].type == type)
558 wil_fw_handlers[i].load_handler(
560 wil_fw_handlers[i].parse_handler(
563 wil_err_fw(wil, "unknown record type: %d\n", type);
568 * wil_fw_process - process section from FW file
569 * if load is true: Load the FW and uCode code and data to the
570 * corresponding device memory regions,
571 * otherwise only parse and look for capabilities
575 static int wil_fw_process(struct wil6210_priv *wil, const void *data,
576 size_t size, bool load)
579 const struct wil_fw_record_head *hdr;
582 for (hdr = data;; hdr = (const void *)hdr + s, size -= s) {
583 if (size < sizeof(*hdr))
585 hdr_sz = le32_to_cpu(hdr->size);
586 s = sizeof(*hdr) + hdr_sz;
590 wil_err_fw(wil, "unaligned record size: %zu\n",
594 rc = wil_fw_handle_record(wil, le16_to_cpu(hdr->type),
595 &hdr[1], hdr_sz, load);
600 wil_err_fw(wil, "unprocessed bytes: %zu\n", size);
601 if (size >= sizeof(*hdr)) {
602 wil_err_fw(wil, "Stop at offset %ld"
603 " record type %d [%zd bytes]\n",
604 (long)((const void *)hdr - data),
605 le16_to_cpu(hdr->type), hdr_sz);
614 * wil_request_firmware - Request firmware
616 * Request firmware image from the file
617 * If load is true, load firmware to device, otherwise
618 * only parse and extract capabilities
622 int wil_request_firmware(struct wil6210_priv *wil, const char *name,
626 const struct firmware *fw;
630 rc = reject_firmware(&fw, name, wil_to_dev(wil));
632 wil_err_fw(wil, "Failed to load firmware %s rc %d\n", name, rc);
635 wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, fw->size);
637 for (sz = fw->size, d = fw->data; sz; sz -= rc1, d += rc1) {
638 rc1 = wil_fw_verify(wil, d, sz);
643 rc = wil_fw_process(wil, d, rc1, load);
649 release_firmware(fw);
654 * wil_brd_process - process section from BRD file
658 static int wil_brd_process(struct wil6210_priv *wil, const void *data,
662 const struct wil_fw_record_head *hdr = data;
666 /* Assuming the board file includes only one header record and one data
667 * record. Each record starts with wil_fw_record_head.
669 if (size < sizeof(*hdr))
671 s = sizeof(*hdr) + le32_to_cpu(hdr->size);
675 /* Skip the header record and handle the data record */
676 hdr = (const void *)hdr + s;
678 if (size < sizeof(*hdr))
680 hdr_sz = le32_to_cpu(hdr->size);
682 if (wil->brd_file_max_size && hdr_sz > wil->brd_file_max_size)
684 if (sizeof(*hdr) + hdr_sz > size)
687 wil_err_fw(wil, "unaligned record size: %zu\n",
691 type = le16_to_cpu(hdr->type);
692 if (type != wil_fw_type_data) {
693 wil_err_fw(wil, "invalid record type for board file: %d\n",
697 if (hdr_sz < sizeof(struct wil_fw_record_data)) {
698 wil_err_fw(wil, "data record too short: %zu\n", hdr_sz);
702 wil_dbg_fw(wil, "using addr from fw file: [0x%08x]\n",
705 rc = __fw_handle_data(wil, &hdr[1], hdr_sz,
706 cpu_to_le32(wil->brd_file_addr));
712 * wil_request_board - Request board file
714 * Request board image from the file
715 * board file address and max size are read from FW file
716 * during initialization.
717 * brd file shall include one header and one data section.
721 int wil_request_board(struct wil6210_priv *wil, const char *name)
724 const struct firmware *brd;
726 rc = reject_firmware(&brd, name, wil_to_dev(wil));
728 wil_err_fw(wil, "Failed to load brd %s\n", name);
731 wil_dbg_fw(wil, "Loading <%s>, %zu bytes\n", name, brd->size);
733 /* Verify the header */
734 dlen = wil_fw_verify(wil, brd->data, brd->size);
739 /* Process the data record */
740 rc = wil_brd_process(wil, brd->data, dlen);
743 release_firmware(brd);
748 * wil_fw_verify_file_exists - checks if firmware file exist
750 * @wil: driver context
751 * @name: firmware file name
753 * return value - boolean, true for success, false for failure
755 bool wil_fw_verify_file_exists(struct wil6210_priv *wil, const char *name)
757 const struct firmware *fw;
760 rc = reject_firmware(&fw, name, wil_to_dev(wil));
762 release_firmware(fw);
764 wil_dbg_fw(wil, "<%s> not available: %d\n", name, rc);