]>
Commit | Line | Data |
---|---|---|
467cc396 IPG |
1 | /* |
2 | * Intel Wireless WiMAX Connection 2400m | |
3 | * Firmware uploader | |
4 | * | |
5 | * | |
6 | * Copyright (C) 2007-2008 Intel Corporation. All rights reserved. | |
7 | * | |
8 | * Redistribution and use in source and binary forms, with or without | |
9 | * modification, are permitted provided that the following conditions | |
10 | * are met: | |
11 | * | |
12 | * * Redistributions of source code must retain the above copyright | |
13 | * notice, this list of conditions and the following disclaimer. | |
14 | * * Redistributions in binary form must reproduce the above copyright | |
15 | * notice, this list of conditions and the following disclaimer in | |
16 | * the documentation and/or other materials provided with the | |
17 | * distribution. | |
18 | * * Neither the name of Intel Corporation nor the names of its | |
19 | * contributors may be used to endorse or promote products derived | |
20 | * from this software without specific prior written permission. | |
21 | * | |
22 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
23 | * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
24 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
25 | * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
26 | * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
27 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
28 | * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
29 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
30 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
31 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
32 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
33 | * | |
34 | * | |
35 | * Intel Corporation <linux-wimax@intel.com> | |
36 | * Yanir Lubetkin <yanirx.lubetkin@intel.com> | |
37 | * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com> | |
38 | * - Initial implementation | |
39 | * | |
40 | * | |
41 | * THE PROCEDURE | |
42 | * | |
43 | * (this is decribed for USB, but for SDIO is similar) | |
44 | * | |
45 | * The 2400m works in two modes: boot-mode or normal mode. In boot | |
46 | * mode we can execute only a handful of commands targeted at | |
47 | * uploading the firmware and launching it. | |
48 | * | |
49 | * The 2400m enters boot mode when it is first connected to the | |
50 | * system, when it crashes and when you ask it to reboot. There are | |
51 | * two submodes of the boot mode: signed and non-signed. Signed takes | |
52 | * firmwares signed with a certain private key, non-signed takes any | |
53 | * firmware. Normal hardware takes only signed firmware. | |
54 | * | |
55 | * Upon entrance to boot mode, the device sends a few zero length | |
56 | * packets (ZLPs) on the notification endpoint, then a reboot barker | |
57 | * (4 le32 words with value I2400M_{S,N}BOOT_BARKER). We ack it by | |
58 | * sending the same barker on the bulk out endpoint. The device acks | |
59 | * with a reboot ack barker (4 le32 words with value 0xfeedbabe) and | |
60 | * then the device is fully rebooted. At this point we can upload the | |
61 | * firmware. | |
62 | * | |
63 | * This process is accomplished by the i2400m_bootrom_init() | |
64 | * function. All the device interaction happens through the | |
65 | * i2400m_bm_cmd() [boot mode command]. Special return values will | |
66 | * indicate if the device resets. | |
67 | * | |
68 | * After this, we read the MAC address and then (if needed) | |
69 | * reinitialize the device. We need to read it ahead of time because | |
70 | * in the future, we might not upload the firmware until userspace | |
71 | * 'ifconfig up's the device. | |
72 | * | |
73 | * We can then upload the firmware file. The file is composed of a BCF | |
74 | * header (basic data, keys and signatures) and a list of write | |
75 | * commands and payloads. We first upload the header | |
76 | * [i2400m_dnload_init()] and then pass the commands and payloads | |
77 | * verbatim to the i2400m_bm_cmd() function | |
78 | * [i2400m_dnload_bcf()]. Then we tell the device to jump to the new | |
79 | * firmware [i2400m_dnload_finalize()]. | |
80 | * | |
81 | * Once firmware is uploaded, we are good to go :) | |
82 | * | |
83 | * When we don't know in which mode we are, we first try by sending a | |
84 | * warm reset request that will take us to boot-mode. If we time out | |
85 | * waiting for a reboot barker, that means maybe we are already in | |
86 | * boot mode, so we send a reboot barker. | |
87 | * | |
88 | * COMMAND EXECUTION | |
89 | * | |
90 | * This code (and process) is single threaded; for executing commands, | |
91 | * we post a URB to the notification endpoint, post the command, wait | |
92 | * for data on the notification buffer. We don't need to worry about | |
93 | * others as we know we are the only ones in there. | |
94 | * | |
95 | * BACKEND IMPLEMENTATION | |
96 | * | |
97 | * This code is bus-generic; the bus-specific driver provides back end | |
98 | * implementations to send a boot mode command to the device and to | |
99 | * read an acknolwedgement from it (or an asynchronous notification) | |
100 | * from it. | |
101 | * | |
102 | * ROADMAP | |
103 | * | |
104 | * i2400m_dev_bootstrap Called by __i2400m_dev_start() | |
105 | * request_firmware | |
106 | * i2400m_fw_check | |
107 | * i2400m_fw_dnload | |
108 | * release_firmware | |
109 | * | |
110 | * i2400m_fw_dnload | |
111 | * i2400m_bootrom_init | |
112 | * i2400m_bm_cmd | |
113 | * i2400m->bus_reset | |
114 | * i2400m_dnload_init | |
115 | * i2400m_dnload_init_signed | |
116 | * i2400m_dnload_init_nonsigned | |
117 | * i2400m_download_chunk | |
118 | * i2400m_bm_cmd | |
119 | * i2400m_dnload_bcf | |
120 | * i2400m_bm_cmd | |
121 | * i2400m_dnload_finalize | |
122 | * i2400m_bm_cmd | |
123 | * | |
124 | * i2400m_bm_cmd | |
125 | * i2400m->bus_bm_cmd_send() | |
126 | * i2400m->bus_bm_wait_for_ack | |
127 | * __i2400m_bm_ack_verify | |
128 | * | |
129 | * i2400m_bm_cmd_prepare Used by bus-drivers to prep | |
130 | * commands before sending | |
131 | */ | |
132 | #include <linux/firmware.h> | |
133 | #include <linux/sched.h> | |
134 | #include <linux/usb.h> | |
135 | #include "i2400m.h" | |
136 | ||
137 | ||
138 | #define D_SUBMODULE fw | |
139 | #include "debug-levels.h" | |
140 | ||
141 | ||
142 | static const __le32 i2400m_ACK_BARKER[4] = { | |
ee437770 HH |
143 | cpu_to_le32(I2400M_ACK_BARKER), |
144 | cpu_to_le32(I2400M_ACK_BARKER), | |
145 | cpu_to_le32(I2400M_ACK_BARKER), | |
146 | cpu_to_le32(I2400M_ACK_BARKER) | |
467cc396 IPG |
147 | }; |
148 | ||
149 | ||
150 | /** | |
151 | * Prepare a boot-mode command for delivery | |
152 | * | |
153 | * @cmd: pointer to bootrom header to prepare | |
154 | * | |
155 | * Computes checksum if so needed. After calling this function, DO NOT | |
156 | * modify the command or header as the checksum won't work anymore. | |
157 | * | |
158 | * We do it from here because some times we cannot do it in the | |
159 | * original context the command was sent (it is a const), so when we | |
160 | * copy it to our staging buffer, we add the checksum there. | |
161 | */ | |
162 | void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header *cmd) | |
163 | { | |
164 | if (i2400m_brh_get_use_checksum(cmd)) { | |
165 | int i; | |
166 | u32 checksum = 0; | |
167 | const u32 *checksum_ptr = (void *) cmd->payload; | |
168 | for (i = 0; i < cmd->data_size / 4; i++) | |
169 | checksum += cpu_to_le32(*checksum_ptr++); | |
170 | checksum += cmd->command + cmd->target_addr + cmd->data_size; | |
171 | cmd->block_checksum = cpu_to_le32(checksum); | |
172 | } | |
173 | } | |
174 | EXPORT_SYMBOL_GPL(i2400m_bm_cmd_prepare); | |
175 | ||
176 | ||
177 | /* | |
178 | * Verify the ack data received | |
179 | * | |
180 | * Given a reply to a boot mode command, chew it and verify everything | |
181 | * is ok. | |
182 | * | |
183 | * @opcode: opcode which generated this ack. For error messages. | |
184 | * @ack: pointer to ack data we received | |
185 | * @ack_size: size of that data buffer | |
186 | * @flags: I2400M_BM_CMD_* flags we called the command with. | |
187 | * | |
188 | * Way too long function -- maybe it should be further split | |
189 | */ | |
190 | static | |
191 | ssize_t __i2400m_bm_ack_verify(struct i2400m *i2400m, int opcode, | |
192 | struct i2400m_bootrom_header *ack, | |
193 | size_t ack_size, int flags) | |
194 | { | |
195 | ssize_t result = -ENOMEM; | |
196 | struct device *dev = i2400m_dev(i2400m); | |
197 | ||
198 | d_fnstart(8, dev, "(i2400m %p opcode %d ack %p size %zu)\n", | |
199 | i2400m, opcode, ack, ack_size); | |
200 | if (ack_size < sizeof(*ack)) { | |
201 | result = -EIO; | |
202 | dev_err(dev, "boot-mode cmd %d: HW BUG? notification didn't " | |
203 | "return enough data (%zu bytes vs %zu expected)\n", | |
204 | opcode, ack_size, sizeof(*ack)); | |
205 | goto error_ack_short; | |
206 | } | |
207 | if (ack_size == sizeof(i2400m_NBOOT_BARKER) | |
208 | && memcmp(ack, i2400m_NBOOT_BARKER, sizeof(*ack)) == 0) { | |
209 | result = -ERESTARTSYS; | |
210 | i2400m->sboot = 0; | |
211 | d_printf(6, dev, "boot-mode cmd %d: " | |
212 | "HW non-signed boot barker\n", opcode); | |
213 | goto error_reboot; | |
214 | } | |
215 | if (ack_size == sizeof(i2400m_SBOOT_BARKER) | |
216 | && memcmp(ack, i2400m_SBOOT_BARKER, sizeof(*ack)) == 0) { | |
217 | result = -ERESTARTSYS; | |
218 | i2400m->sboot = 1; | |
219 | d_printf(6, dev, "boot-mode cmd %d: HW signed reboot barker\n", | |
220 | opcode); | |
221 | goto error_reboot; | |
222 | } | |
223 | if (ack_size == sizeof(i2400m_ACK_BARKER) | |
224 | && memcmp(ack, i2400m_ACK_BARKER, sizeof(*ack)) == 0) { | |
225 | result = -EISCONN; | |
226 | d_printf(3, dev, "boot-mode cmd %d: HW reboot ack barker\n", | |
227 | opcode); | |
228 | goto error_reboot_ack; | |
229 | } | |
230 | result = 0; | |
231 | if (flags & I2400M_BM_CMD_RAW) | |
232 | goto out_raw; | |
233 | ack->data_size = le32_to_cpu(ack->data_size); | |
234 | ack->target_addr = le32_to_cpu(ack->target_addr); | |
235 | ack->block_checksum = le32_to_cpu(ack->block_checksum); | |
236 | d_printf(5, dev, "boot-mode cmd %d: notification for opcode %u " | |
237 | "response %u csum %u rr %u da %u\n", | |
238 | opcode, i2400m_brh_get_opcode(ack), | |
239 | i2400m_brh_get_response(ack), | |
240 | i2400m_brh_get_use_checksum(ack), | |
241 | i2400m_brh_get_response_required(ack), | |
242 | i2400m_brh_get_direct_access(ack)); | |
243 | result = -EIO; | |
244 | if (i2400m_brh_get_signature(ack) != 0xcbbc) { | |
245 | dev_err(dev, "boot-mode cmd %d: HW BUG? wrong signature " | |
246 | "0x%04x\n", opcode, i2400m_brh_get_signature(ack)); | |
247 | goto error_ack_signature; | |
248 | } | |
249 | if (opcode != -1 && opcode != i2400m_brh_get_opcode(ack)) { | |
250 | dev_err(dev, "boot-mode cmd %d: HW BUG? " | |
251 | "received response for opcode %u, expected %u\n", | |
252 | opcode, i2400m_brh_get_opcode(ack), opcode); | |
253 | goto error_ack_opcode; | |
254 | } | |
255 | if (i2400m_brh_get_response(ack) != 0) { /* failed? */ | |
256 | dev_err(dev, "boot-mode cmd %d: error; hw response %u\n", | |
257 | opcode, i2400m_brh_get_response(ack)); | |
258 | goto error_ack_failed; | |
259 | } | |
260 | if (ack_size < ack->data_size + sizeof(*ack)) { | |
261 | dev_err(dev, "boot-mode cmd %d: SW BUG " | |
262 | "driver provided only %zu bytes for %zu bytes " | |
263 | "of data\n", opcode, ack_size, | |
264 | (size_t) le32_to_cpu(ack->data_size) + sizeof(*ack)); | |
265 | goto error_ack_short_buffer; | |
266 | } | |
267 | result = ack_size; | |
268 | /* Don't you love this stack of empty targets? Well, I don't | |
269 | * either, but it helps track exactly who comes in here and | |
270 | * why :) */ | |
271 | error_ack_short_buffer: | |
272 | error_ack_failed: | |
273 | error_ack_opcode: | |
274 | error_ack_signature: | |
275 | out_raw: | |
276 | error_reboot_ack: | |
277 | error_reboot: | |
278 | error_ack_short: | |
279 | d_fnend(8, dev, "(i2400m %p opcode %d ack %p size %zu) = %d\n", | |
280 | i2400m, opcode, ack, ack_size, (int) result); | |
281 | return result; | |
282 | } | |
283 | ||
284 | ||
285 | /** | |
286 | * i2400m_bm_cmd - Execute a boot mode command | |
287 | * | |
288 | * @cmd: buffer containing the command data (pointing at the header). | |
289 | * This data can be ANYWHERE (for USB, we will copy it to an | |
290 | * specific buffer). Make sure everything is in proper little | |
291 | * endian. | |
292 | * | |
293 | * A raw buffer can be also sent, just cast it and set flags to | |
294 | * I2400M_BM_CMD_RAW. | |
295 | * | |
296 | * This function will generate a checksum for you if the | |
297 | * checksum bit in the command is set (unless I2400M_BM_CMD_RAW | |
298 | * is set). | |
299 | * | |
300 | * You can use the i2400m->bm_cmd_buf to stage your commands and | |
301 | * send them. | |
302 | * | |
303 | * If NULL, no command is sent (we just wait for an ack). | |
304 | * | |
305 | * @cmd_size: size of the command. Will be auto padded to the | |
306 | * bus-specific drivers padding requirements. | |
307 | * | |
308 | * @ack: buffer where to place the acknowledgement. If it is a regular | |
309 | * command response, all fields will be returned with the right, | |
310 | * native endianess. | |
311 | * | |
312 | * You *cannot* use i2400m->bm_ack_buf for this buffer. | |
313 | * | |
314 | * @ack_size: size of @ack, 16 aligned; you need to provide at least | |
315 | * sizeof(*ack) bytes and then enough to contain the return data | |
316 | * from the command | |
317 | * | |
318 | * @flags: see I2400M_BM_CMD_* above. | |
319 | * | |
320 | * @returns: bytes received by the notification; if < 0, an errno code | |
321 | * denoting an error or: | |
322 | * | |
323 | * -ERESTARTSYS The device has rebooted | |
324 | * | |
325 | * Executes a boot-mode command and waits for a response, doing basic | |
326 | * validation on it; if a zero length response is received, it retries | |
327 | * waiting for a response until a non-zero one is received (timing out | |
328 | * after %I2400M_BOOT_RETRIES retries). | |
329 | */ | |
330 | static | |
331 | ssize_t i2400m_bm_cmd(struct i2400m *i2400m, | |
332 | const struct i2400m_bootrom_header *cmd, size_t cmd_size, | |
333 | struct i2400m_bootrom_header *ack, size_t ack_size, | |
334 | int flags) | |
335 | { | |
336 | ssize_t result = -ENOMEM, rx_bytes; | |
337 | struct device *dev = i2400m_dev(i2400m); | |
338 | int opcode = cmd == NULL ? -1 : i2400m_brh_get_opcode(cmd); | |
339 | ||
340 | d_fnstart(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu)\n", | |
341 | i2400m, cmd, cmd_size, ack, ack_size); | |
342 | BUG_ON(ack_size < sizeof(*ack)); | |
343 | BUG_ON(i2400m->boot_mode == 0); | |
344 | ||
345 | if (cmd != NULL) { /* send the command */ | |
467cc396 IPG |
346 | result = i2400m->bus_bm_cmd_send(i2400m, cmd, cmd_size, flags); |
347 | if (result < 0) | |
348 | goto error_cmd_send; | |
349 | if ((flags & I2400M_BM_CMD_RAW) == 0) | |
350 | d_printf(5, dev, | |
351 | "boot-mode cmd %d csum %u rr %u da %u: " | |
352 | "addr 0x%04x size %u block csum 0x%04x\n", | |
353 | opcode, i2400m_brh_get_use_checksum(cmd), | |
354 | i2400m_brh_get_response_required(cmd), | |
355 | i2400m_brh_get_direct_access(cmd), | |
356 | cmd->target_addr, cmd->data_size, | |
357 | cmd->block_checksum); | |
358 | } | |
359 | result = i2400m->bus_bm_wait_for_ack(i2400m, ack, ack_size); | |
360 | if (result < 0) { | |
361 | dev_err(dev, "boot-mode cmd %d: error waiting for an ack: %d\n", | |
362 | opcode, (int) result); /* bah, %zd doesn't work */ | |
363 | goto error_wait_for_ack; | |
364 | } | |
365 | rx_bytes = result; | |
366 | /* verify the ack and read more if neccessary [result is the | |
367 | * final amount of bytes we get in the ack] */ | |
368 | result = __i2400m_bm_ack_verify(i2400m, opcode, ack, ack_size, flags); | |
369 | if (result < 0) | |
370 | goto error_bad_ack; | |
371 | /* Don't you love this stack of empty targets? Well, I don't | |
372 | * either, but it helps track exactly who comes in here and | |
373 | * why :) */ | |
374 | result = rx_bytes; | |
375 | error_bad_ack: | |
376 | error_wait_for_ack: | |
377 | error_cmd_send: | |
378 | d_fnend(6, dev, "(i2400m %p cmd %p size %zu ack %p size %zu) = %d\n", | |
379 | i2400m, cmd, cmd_size, ack, ack_size, (int) result); | |
380 | return result; | |
381 | } | |
382 | ||
383 | ||
384 | /** | |
385 | * i2400m_download_chunk - write a single chunk of data to the device's memory | |
386 | * | |
387 | * @i2400m: device descriptor | |
388 | * @buf: the buffer to write | |
389 | * @buf_len: length of the buffer to write | |
390 | * @addr: address in the device memory space | |
391 | * @direct: bootrom write mode | |
392 | * @do_csum: should a checksum validation be performed | |
393 | */ | |
394 | static int i2400m_download_chunk(struct i2400m *i2400m, const void *chunk, | |
395 | size_t __chunk_len, unsigned long addr, | |
396 | unsigned int direct, unsigned int do_csum) | |
397 | { | |
398 | int ret; | |
8593a196 | 399 | size_t chunk_len = ALIGN(__chunk_len, I2400M_PL_ALIGN); |
467cc396 IPG |
400 | struct device *dev = i2400m_dev(i2400m); |
401 | struct { | |
402 | struct i2400m_bootrom_header cmd; | |
403 | u8 cmd_payload[chunk_len]; | |
404 | } __attribute__((packed)) *buf; | |
405 | struct i2400m_bootrom_header ack; | |
406 | ||
407 | d_fnstart(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx " | |
408 | "direct %u do_csum %u)\n", i2400m, chunk, __chunk_len, | |
409 | addr, direct, do_csum); | |
410 | buf = i2400m->bm_cmd_buf; | |
411 | memcpy(buf->cmd_payload, chunk, __chunk_len); | |
412 | memset(buf->cmd_payload + __chunk_len, 0xad, chunk_len - __chunk_len); | |
413 | ||
414 | buf->cmd.command = i2400m_brh_command(I2400M_BRH_WRITE, | |
415 | __chunk_len & 0x3 ? 0 : do_csum, | |
416 | __chunk_len & 0xf ? 0 : direct); | |
417 | buf->cmd.target_addr = cpu_to_le32(addr); | |
418 | buf->cmd.data_size = cpu_to_le32(__chunk_len); | |
419 | ret = i2400m_bm_cmd(i2400m, &buf->cmd, sizeof(buf->cmd) + chunk_len, | |
420 | &ack, sizeof(ack), 0); | |
421 | if (ret >= 0) | |
422 | ret = 0; | |
423 | d_fnend(5, dev, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx " | |
424 | "direct %u do_csum %u) = %d\n", i2400m, chunk, __chunk_len, | |
425 | addr, direct, do_csum, ret); | |
426 | return ret; | |
427 | } | |
428 | ||
429 | ||
430 | /* | |
431 | * Download a BCF file's sections to the device | |
432 | * | |
433 | * @i2400m: device descriptor | |
434 | * @bcf: pointer to firmware data (followed by the payloads). Assumed | |
435 | * verified and consistent. | |
436 | * @bcf_len: length (in bytes) of the @bcf buffer. | |
437 | * | |
438 | * Returns: < 0 errno code on error or the offset to the jump instruction. | |
439 | * | |
440 | * Given a BCF file, downloads each section (a command and a payload) | |
441 | * to the device's address space. Actually, it just executes each | |
442 | * command i the BCF file. | |
443 | * | |
444 | * The section size has to be aligned to 4 bytes AND the padding has | |
445 | * to be taken from the firmware file, as the signature takes it into | |
446 | * account. | |
447 | */ | |
448 | static | |
449 | ssize_t i2400m_dnload_bcf(struct i2400m *i2400m, | |
450 | const struct i2400m_bcf_hdr *bcf, size_t bcf_len) | |
451 | { | |
452 | ssize_t ret; | |
453 | struct device *dev = i2400m_dev(i2400m); | |
454 | size_t offset, /* iterator offset */ | |
455 | data_size, /* Size of the data payload */ | |
456 | section_size, /* Size of the whole section (cmd + payload) */ | |
457 | section = 1; | |
458 | const struct i2400m_bootrom_header *bh; | |
459 | struct i2400m_bootrom_header ack; | |
460 | ||
461 | d_fnstart(3, dev, "(i2400m %p bcf %p bcf_len %zu)\n", | |
462 | i2400m, bcf, bcf_len); | |
463 | /* Iterate over the command blocks in the BCF file that start | |
464 | * after the header */ | |
465 | offset = le32_to_cpu(bcf->header_len) * sizeof(u32); | |
466 | while (1) { /* start sending the file */ | |
467 | bh = (void *) bcf + offset; | |
468 | data_size = le32_to_cpu(bh->data_size); | |
469 | section_size = ALIGN(sizeof(*bh) + data_size, 4); | |
470 | d_printf(7, dev, | |
471 | "downloading section #%zu (@%zu %zu B) to 0x%08x\n", | |
472 | section, offset, sizeof(*bh) + data_size, | |
473 | le32_to_cpu(bh->target_addr)); | |
474 | if (i2400m_brh_get_opcode(bh) == I2400M_BRH_SIGNED_JUMP) { | |
475 | /* Secure boot needs to stop here */ | |
476 | d_printf(5, dev, "signed jump found @%zu\n", offset); | |
477 | break; | |
478 | } | |
479 | if (offset + section_size == bcf_len) | |
480 | /* Non-secure boot stops here */ | |
481 | break; | |
482 | if (offset + section_size > bcf_len) { | |
483 | dev_err(dev, "fw %s: bad section #%zu, " | |
484 | "end (@%zu) beyond EOF (@%zu)\n", | |
1039abbc | 485 | i2400m->fw_name, section, |
467cc396 IPG |
486 | offset + section_size, bcf_len); |
487 | ret = -EINVAL; | |
488 | goto error_section_beyond_eof; | |
489 | } | |
490 | __i2400m_msleep(20); | |
491 | ret = i2400m_bm_cmd(i2400m, bh, section_size, | |
492 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
493 | if (ret < 0) { | |
494 | dev_err(dev, "fw %s: section #%zu (@%zu %zu B) " | |
1039abbc | 495 | "failed %d\n", i2400m->fw_name, section, |
467cc396 IPG |
496 | offset, sizeof(*bh) + data_size, (int) ret); |
497 | goto error_send; | |
498 | } | |
499 | offset += section_size; | |
500 | section++; | |
501 | } | |
502 | ret = offset; | |
503 | error_section_beyond_eof: | |
504 | error_send: | |
505 | d_fnend(3, dev, "(i2400m %p bcf %p bcf_len %zu) = %d\n", | |
506 | i2400m, bcf, bcf_len, (int) ret); | |
507 | return ret; | |
508 | } | |
509 | ||
510 | ||
32742e61 IPG |
511 | /* |
512 | * Indicate if the device emitted a reboot barker that indicates | |
513 | * "signed boot" | |
514 | */ | |
515 | static | |
516 | unsigned i2400m_boot_is_signed(struct i2400m *i2400m) | |
517 | { | |
518 | return likely(i2400m->sboot); | |
519 | } | |
520 | ||
521 | ||
467cc396 IPG |
522 | /* |
523 | * Do the final steps of uploading firmware | |
524 | * | |
525 | * Depending on the boot mode (signed vs non-signed), different | |
526 | * actions need to be taken. | |
527 | */ | |
528 | static | |
529 | int i2400m_dnload_finalize(struct i2400m *i2400m, | |
530 | const struct i2400m_bcf_hdr *bcf, size_t offset) | |
531 | { | |
532 | int ret = 0; | |
533 | struct device *dev = i2400m_dev(i2400m); | |
534 | struct i2400m_bootrom_header *cmd, ack; | |
535 | struct { | |
536 | struct i2400m_bootrom_header cmd; | |
537 | u8 cmd_pl[0]; | |
538 | } __attribute__((packed)) *cmd_buf; | |
539 | size_t signature_block_offset, signature_block_size; | |
540 | ||
541 | d_fnstart(3, dev, "offset %zu\n", offset); | |
542 | cmd = (void *) bcf + offset; | |
32742e61 | 543 | if (i2400m_boot_is_signed(i2400m) == 0) { |
467cc396 | 544 | struct i2400m_bootrom_header jump_ack; |
ead68239 | 545 | d_printf(1, dev, "unsecure boot, jumping to 0x%08x\n", |
467cc396 | 546 | le32_to_cpu(cmd->target_addr)); |
8d8fe198 CK |
547 | cmd_buf = i2400m->bm_cmd_buf; |
548 | memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd)); | |
549 | cmd = &cmd_buf->cmd; | |
550 | /* now cmd points to the actual bootrom_header in cmd_buf */ | |
467cc396 IPG |
551 | i2400m_brh_set_opcode(cmd, I2400M_BRH_JUMP); |
552 | cmd->data_size = 0; | |
553 | ret = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
554 | &jump_ack, sizeof(jump_ack), 0); | |
555 | } else { | |
ead68239 | 556 | d_printf(1, dev, "secure boot, jumping to 0x%08x\n", |
467cc396 IPG |
557 | le32_to_cpu(cmd->target_addr)); |
558 | cmd_buf = i2400m->bm_cmd_buf; | |
559 | memcpy(&cmd_buf->cmd, cmd, sizeof(*cmd)); | |
560 | signature_block_offset = | |
561 | sizeof(*bcf) | |
562 | + le32_to_cpu(bcf->key_size) * sizeof(u32) | |
563 | + le32_to_cpu(bcf->exponent_size) * sizeof(u32); | |
564 | signature_block_size = | |
565 | le32_to_cpu(bcf->modulus_size) * sizeof(u32); | |
566 | memcpy(cmd_buf->cmd_pl, (void *) bcf + signature_block_offset, | |
567 | signature_block_size); | |
568 | ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, | |
569 | sizeof(cmd_buf->cmd) + signature_block_size, | |
570 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
571 | } | |
572 | d_fnend(3, dev, "returning %d\n", ret); | |
573 | return ret; | |
574 | } | |
575 | ||
576 | ||
577 | /** | |
578 | * i2400m_bootrom_init - Reboots a powered device into boot mode | |
579 | * | |
580 | * @i2400m: device descriptor | |
581 | * @flags: | |
582 | * I2400M_BRI_SOFT: a reboot notification has been seen | |
583 | * already, so don't wait for it. | |
584 | * | |
585 | * I2400M_BRI_NO_REBOOT: Don't send a reboot command, but wait | |
586 | * for a reboot barker notification. This is a one shot; if | |
587 | * the state machine needs to send a reboot command it will. | |
588 | * | |
589 | * Returns: | |
590 | * | |
591 | * < 0 errno code on error, 0 if ok. | |
592 | * | |
593 | * i2400m->sboot set to 0 for unsecure boot process, 1 for secure | |
594 | * boot process. | |
595 | * | |
596 | * Description: | |
597 | * | |
598 | * Tries hard enough to put the device in boot-mode. There are two | |
599 | * main phases to this: | |
600 | * | |
601 | * a. (1) send a reboot command and (2) get a reboot barker | |
602 | * b. (1) ack the reboot sending a reboot barker and (2) getting an | |
603 | * ack barker in return | |
604 | * | |
605 | * We want to skip (a) in some cases [soft]. The state machine is | |
606 | * horrible, but it is basically: on each phase, send what has to be | |
607 | * sent (if any), wait for the answer and act on the answer. We might | |
608 | * have to backtrack and retry, so we keep a max tries counter for | |
609 | * that. | |
610 | * | |
611 | * If we get a timeout after sending a warm reset, we do it again. | |
612 | */ | |
613 | int i2400m_bootrom_init(struct i2400m *i2400m, enum i2400m_bri flags) | |
614 | { | |
615 | int result; | |
616 | struct device *dev = i2400m_dev(i2400m); | |
617 | struct i2400m_bootrom_header *cmd; | |
618 | struct i2400m_bootrom_header ack; | |
c3083658 | 619 | int count = i2400m->bus_bm_retries; |
467cc396 IPG |
620 | int ack_timeout_cnt = 1; |
621 | ||
622 | BUILD_BUG_ON(sizeof(*cmd) != sizeof(i2400m_NBOOT_BARKER)); | |
623 | BUILD_BUG_ON(sizeof(ack) != sizeof(i2400m_ACK_BARKER)); | |
624 | ||
625 | d_fnstart(4, dev, "(i2400m %p flags 0x%08x)\n", i2400m, flags); | |
626 | result = -ENOMEM; | |
627 | cmd = i2400m->bm_cmd_buf; | |
628 | if (flags & I2400M_BRI_SOFT) | |
629 | goto do_reboot_ack; | |
630 | do_reboot: | |
631 | if (--count < 0) | |
632 | goto error_timeout; | |
633 | d_printf(4, dev, "device reboot: reboot command [%d # left]\n", | |
634 | count); | |
635 | if ((flags & I2400M_BRI_NO_REBOOT) == 0) | |
636 | i2400m->bus_reset(i2400m, I2400M_RT_WARM); | |
637 | result = i2400m_bm_cmd(i2400m, NULL, 0, &ack, sizeof(ack), | |
638 | I2400M_BM_CMD_RAW); | |
639 | flags &= ~I2400M_BRI_NO_REBOOT; | |
640 | switch (result) { | |
641 | case -ERESTARTSYS: | |
642 | d_printf(4, dev, "device reboot: got reboot barker\n"); | |
643 | break; | |
644 | case -EISCONN: /* we don't know how it got here...but we follow it */ | |
645 | d_printf(4, dev, "device reboot: got ack barker - whatever\n"); | |
646 | goto do_reboot; | |
647 | case -ETIMEDOUT: /* device has timed out, we might be in boot | |
648 | * mode already and expecting an ack, let's try | |
649 | * that */ | |
650 | dev_info(dev, "warm reset timed out, trying an ack\n"); | |
651 | goto do_reboot_ack; | |
652 | case -EPROTO: | |
653 | case -ESHUTDOWN: /* dev is gone */ | |
654 | case -EINTR: /* user cancelled */ | |
655 | goto error_dev_gone; | |
656 | default: | |
657 | dev_err(dev, "device reboot: error %d while waiting " | |
658 | "for reboot barker - rebooting\n", result); | |
659 | goto do_reboot; | |
660 | } | |
661 | /* At this point we ack back with 4 REBOOT barkers and expect | |
662 | * 4 ACK barkers. This is ugly, as we send a raw command -- | |
663 | * hence the cast. _bm_cmd() will catch the reboot ack | |
664 | * notification and report it as -EISCONN. */ | |
665 | do_reboot_ack: | |
666 | d_printf(4, dev, "device reboot ack: sending ack [%d # left]\n", count); | |
667 | if (i2400m->sboot == 0) | |
668 | memcpy(cmd, i2400m_NBOOT_BARKER, | |
669 | sizeof(i2400m_NBOOT_BARKER)); | |
670 | else | |
671 | memcpy(cmd, i2400m_SBOOT_BARKER, | |
672 | sizeof(i2400m_SBOOT_BARKER)); | |
673 | result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
674 | &ack, sizeof(ack), I2400M_BM_CMD_RAW); | |
675 | switch (result) { | |
676 | case -ERESTARTSYS: | |
677 | d_printf(4, dev, "reboot ack: got reboot barker - retrying\n"); | |
678 | if (--count < 0) | |
679 | goto error_timeout; | |
680 | goto do_reboot_ack; | |
681 | case -EISCONN: | |
682 | d_printf(4, dev, "reboot ack: got ack barker - good\n"); | |
683 | break; | |
684 | case -ETIMEDOUT: /* no response, maybe it is the other type? */ | |
685 | if (ack_timeout_cnt-- >= 0) { | |
686 | d_printf(4, dev, "reboot ack timedout: " | |
687 | "trying the other type?\n"); | |
688 | i2400m->sboot = !i2400m->sboot; | |
689 | goto do_reboot_ack; | |
690 | } else { | |
691 | dev_err(dev, "reboot ack timedout too long: " | |
692 | "trying reboot\n"); | |
693 | goto do_reboot; | |
694 | } | |
695 | break; | |
696 | case -EPROTO: | |
697 | case -ESHUTDOWN: /* dev is gone */ | |
698 | goto error_dev_gone; | |
699 | default: | |
700 | dev_err(dev, "device reboot ack: error %d while waiting for " | |
701 | "reboot ack barker - rebooting\n", result); | |
702 | goto do_reboot; | |
703 | } | |
704 | d_printf(2, dev, "device reboot ack: got ack barker - boot done\n"); | |
705 | result = 0; | |
706 | exit_timeout: | |
707 | error_dev_gone: | |
708 | d_fnend(4, dev, "(i2400m %p flags 0x%08x) = %d\n", | |
709 | i2400m, flags, result); | |
710 | return result; | |
711 | ||
712 | error_timeout: | |
6e053d6c | 713 | dev_err(dev, "Timed out waiting for reboot ack\n"); |
467cc396 IPG |
714 | result = -ETIMEDOUT; |
715 | goto exit_timeout; | |
716 | } | |
717 | ||
718 | ||
719 | /* | |
720 | * Read the MAC addr | |
721 | * | |
722 | * The position this function reads is fixed in device memory and | |
723 | * always available, even without firmware. | |
724 | * | |
725 | * Note we specify we want to read only six bytes, but provide space | |
726 | * for 16, as we always get it rounded up. | |
727 | */ | |
728 | int i2400m_read_mac_addr(struct i2400m *i2400m) | |
729 | { | |
730 | int result; | |
731 | struct device *dev = i2400m_dev(i2400m); | |
732 | struct net_device *net_dev = i2400m->wimax_dev.net_dev; | |
733 | struct i2400m_bootrom_header *cmd; | |
734 | struct { | |
735 | struct i2400m_bootrom_header ack; | |
736 | u8 ack_pl[16]; | |
737 | } __attribute__((packed)) ack_buf; | |
738 | ||
739 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); | |
740 | cmd = i2400m->bm_cmd_buf; | |
741 | cmd->command = i2400m_brh_command(I2400M_BRH_READ, 0, 1); | |
742 | cmd->target_addr = cpu_to_le32(0x00203fe8); | |
743 | cmd->data_size = cpu_to_le32(6); | |
744 | result = i2400m_bm_cmd(i2400m, cmd, sizeof(*cmd), | |
745 | &ack_buf.ack, sizeof(ack_buf), 0); | |
746 | if (result < 0) { | |
747 | dev_err(dev, "BM: read mac addr failed: %d\n", result); | |
748 | goto error_read_mac; | |
749 | } | |
750 | d_printf(2, dev, | |
751 | "mac addr is %02x:%02x:%02x:%02x:%02x:%02x\n", | |
752 | ack_buf.ack_pl[0], ack_buf.ack_pl[1], | |
753 | ack_buf.ack_pl[2], ack_buf.ack_pl[3], | |
754 | ack_buf.ack_pl[4], ack_buf.ack_pl[5]); | |
755 | if (i2400m->bus_bm_mac_addr_impaired == 1) { | |
756 | ack_buf.ack_pl[0] = 0x00; | |
757 | ack_buf.ack_pl[1] = 0x16; | |
758 | ack_buf.ack_pl[2] = 0xd3; | |
759 | get_random_bytes(&ack_buf.ack_pl[3], 3); | |
760 | dev_err(dev, "BM is MAC addr impaired, faking MAC addr to " | |
761 | "mac addr is %02x:%02x:%02x:%02x:%02x:%02x\n", | |
762 | ack_buf.ack_pl[0], ack_buf.ack_pl[1], | |
763 | ack_buf.ack_pl[2], ack_buf.ack_pl[3], | |
764 | ack_buf.ack_pl[4], ack_buf.ack_pl[5]); | |
765 | result = 0; | |
766 | } | |
767 | net_dev->addr_len = ETH_ALEN; | |
768 | memcpy(net_dev->perm_addr, ack_buf.ack_pl, ETH_ALEN); | |
769 | memcpy(net_dev->dev_addr, ack_buf.ack_pl, ETH_ALEN); | |
770 | error_read_mac: | |
771 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, result); | |
772 | return result; | |
773 | } | |
774 | ||
775 | ||
776 | /* | |
777 | * Initialize a non signed boot | |
778 | * | |
779 | * This implies sending some magic values to the device's memory. Note | |
780 | * we convert the values to little endian in the same array | |
781 | * declaration. | |
782 | */ | |
783 | static | |
784 | int i2400m_dnload_init_nonsigned(struct i2400m *i2400m) | |
785 | { | |
7308a0c2 DB |
786 | unsigned i = 0; |
787 | int ret = 0; | |
467cc396 | 788 | struct device *dev = i2400m_dev(i2400m); |
467cc396 | 789 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); |
7308a0c2 DB |
790 | if (i2400m->bus_bm_pokes_table) { |
791 | while (i2400m->bus_bm_pokes_table[i].address) { | |
792 | ret = i2400m_download_chunk( | |
793 | i2400m, | |
794 | &i2400m->bus_bm_pokes_table[i].data, | |
795 | sizeof(i2400m->bus_bm_pokes_table[i].data), | |
796 | i2400m->bus_bm_pokes_table[i].address, 1, 1); | |
797 | if (ret < 0) | |
798 | break; | |
799 | i++; | |
800 | } | |
467cc396 IPG |
801 | } |
802 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret); | |
803 | return ret; | |
804 | } | |
805 | ||
806 | ||
807 | /* | |
808 | * Initialize the signed boot process | |
809 | * | |
810 | * @i2400m: device descriptor | |
811 | * | |
812 | * @bcf_hdr: pointer to the firmware header; assumes it is fully in | |
813 | * memory (it has gone through basic validation). | |
814 | * | |
815 | * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw | |
816 | * rebooted. | |
817 | * | |
818 | * This writes the firmware BCF header to the device using the | |
819 | * HASH_PAYLOAD_ONLY command. | |
820 | */ | |
821 | static | |
822 | int i2400m_dnload_init_signed(struct i2400m *i2400m, | |
823 | const struct i2400m_bcf_hdr *bcf_hdr) | |
824 | { | |
825 | int ret; | |
826 | struct device *dev = i2400m_dev(i2400m); | |
827 | struct { | |
828 | struct i2400m_bootrom_header cmd; | |
829 | struct i2400m_bcf_hdr cmd_pl; | |
830 | } __attribute__((packed)) *cmd_buf; | |
831 | struct i2400m_bootrom_header ack; | |
832 | ||
833 | d_fnstart(5, dev, "(i2400m %p bcf_hdr %p)\n", i2400m, bcf_hdr); | |
834 | cmd_buf = i2400m->bm_cmd_buf; | |
835 | cmd_buf->cmd.command = | |
836 | i2400m_brh_command(I2400M_BRH_HASH_PAYLOAD_ONLY, 0, 0); | |
837 | cmd_buf->cmd.target_addr = 0; | |
838 | cmd_buf->cmd.data_size = cpu_to_le32(sizeof(cmd_buf->cmd_pl)); | |
839 | memcpy(&cmd_buf->cmd_pl, bcf_hdr, sizeof(*bcf_hdr)); | |
840 | ret = i2400m_bm_cmd(i2400m, &cmd_buf->cmd, sizeof(*cmd_buf), | |
841 | &ack, sizeof(ack), 0); | |
842 | if (ret >= 0) | |
843 | ret = 0; | |
844 | d_fnend(5, dev, "(i2400m %p bcf_hdr %p) = %d\n", i2400m, bcf_hdr, ret); | |
845 | return ret; | |
846 | } | |
847 | ||
848 | ||
849 | /* | |
850 | * Initialize the firmware download at the device size | |
851 | * | |
852 | * Multiplex to the one that matters based on the device's mode | |
853 | * (signed or non-signed). | |
854 | */ | |
855 | static | |
856 | int i2400m_dnload_init(struct i2400m *i2400m, const struct i2400m_bcf_hdr *bcf) | |
857 | { | |
858 | int result; | |
859 | struct device *dev = i2400m_dev(i2400m); | |
467cc396 | 860 | |
32742e61 IPG |
861 | if (i2400m_boot_is_signed(i2400m)) { |
862 | d_printf(1, dev, "signed boot\n"); | |
863 | result = i2400m_dnload_init_signed(i2400m, bcf); | |
467cc396 IPG |
864 | if (result == -ERESTARTSYS) |
865 | return result; | |
866 | if (result < 0) | |
32742e61 | 867 | dev_err(dev, "firmware %s: signed boot download " |
467cc396 | 868 | "initialization failed: %d\n", |
1039abbc | 869 | i2400m->fw_name, result); |
32742e61 IPG |
870 | } else { |
871 | /* non-signed boot process without pokes */ | |
872 | d_printf(1, dev, "non-signed boot\n"); | |
873 | result = i2400m_dnload_init_nonsigned(i2400m); | |
467cc396 IPG |
874 | if (result == -ERESTARTSYS) |
875 | return result; | |
876 | if (result < 0) | |
32742e61 | 877 | dev_err(dev, "firmware %s: non-signed download " |
467cc396 | 878 | "initialization failed: %d\n", |
1039abbc | 879 | i2400m->fw_name, result); |
467cc396 IPG |
880 | } |
881 | return result; | |
882 | } | |
883 | ||
884 | ||
885 | /* | |
886 | * Run quick consistency tests on the firmware file | |
887 | * | |
888 | * Check for the firmware being made for the i2400m device, | |
889 | * etc...These checks are mostly informative, as the device will make | |
890 | * them too; but the driver's response is more informative on what | |
891 | * went wrong. | |
892 | */ | |
893 | static | |
894 | int i2400m_fw_check(struct i2400m *i2400m, | |
895 | const struct i2400m_bcf_hdr *bcf, | |
896 | size_t bcf_size) | |
897 | { | |
898 | int result; | |
899 | struct device *dev = i2400m_dev(i2400m); | |
900 | unsigned module_type, header_len, major_version, minor_version, | |
901 | module_id, module_vendor, date, size; | |
902 | ||
903 | /* Check hard errors */ | |
904 | result = -EINVAL; | |
905 | if (bcf_size < sizeof(*bcf)) { /* big enough header? */ | |
906 | dev_err(dev, "firmware %s too short: " | |
907 | "%zu B vs %zu (at least) expected\n", | |
1039abbc | 908 | i2400m->fw_name, bcf_size, sizeof(*bcf)); |
467cc396 IPG |
909 | goto error; |
910 | } | |
911 | ||
912 | module_type = bcf->module_type; | |
913 | header_len = sizeof(u32) * le32_to_cpu(bcf->header_len); | |
914 | major_version = le32_to_cpu(bcf->header_version) & 0xffff0000 >> 16; | |
915 | minor_version = le32_to_cpu(bcf->header_version) & 0x0000ffff; | |
916 | module_id = le32_to_cpu(bcf->module_id); | |
917 | module_vendor = le32_to_cpu(bcf->module_vendor); | |
918 | date = le32_to_cpu(bcf->date); | |
919 | size = sizeof(u32) * le32_to_cpu(bcf->size); | |
920 | ||
921 | if (bcf_size != size) { /* annoyingly paranoid */ | |
922 | dev_err(dev, "firmware %s: bad size, got " | |
923 | "%zu B vs %u expected\n", | |
1039abbc | 924 | i2400m->fw_name, bcf_size, size); |
467cc396 IPG |
925 | goto error; |
926 | } | |
927 | ||
928 | d_printf(2, dev, "type 0x%x id 0x%x vendor 0x%x; header v%u.%u (%zu B) " | |
929 | "date %08x (%zu B)\n", | |
930 | module_type, module_id, module_vendor, | |
931 | major_version, minor_version, (size_t) header_len, | |
932 | date, (size_t) size); | |
933 | ||
934 | if (module_type != 6) { /* built for the right hardware? */ | |
935 | dev_err(dev, "bad fw %s: unexpected module type 0x%x; " | |
1039abbc | 936 | "aborting\n", i2400m->fw_name, module_type); |
467cc396 IPG |
937 | goto error; |
938 | } | |
939 | ||
940 | /* Check soft-er errors */ | |
941 | result = 0; | |
942 | if (module_vendor != 0x8086) | |
943 | dev_err(dev, "bad fw %s? unexpected vendor 0x%04x\n", | |
1039abbc | 944 | i2400m->fw_name, module_vendor); |
467cc396 IPG |
945 | if (date < 0x20080300) |
946 | dev_err(dev, "bad fw %s? build date too old %08x\n", | |
1039abbc | 947 | i2400m->fw_name, date); |
467cc396 IPG |
948 | error: |
949 | return result; | |
950 | } | |
951 | ||
952 | ||
953 | /* | |
954 | * Download the firmware to the device | |
955 | * | |
956 | * @i2400m: device descriptor | |
957 | * @bcf: pointer to loaded (and minimally verified for consistency) | |
958 | * firmware | |
959 | * @bcf_size: size of the @bcf buffer (header plus payloads) | |
960 | * | |
961 | * The process for doing this is described in this file's header. | |
962 | * | |
963 | * Note we only reinitialize boot-mode if the flags say so. Some hw | |
964 | * iterations need it, some don't. In any case, if we loop, we always | |
965 | * need to reinitialize the boot room, hence the flags modification. | |
966 | */ | |
967 | static | |
968 | int i2400m_fw_dnload(struct i2400m *i2400m, const struct i2400m_bcf_hdr *bcf, | |
969 | size_t bcf_size, enum i2400m_bri flags) | |
970 | { | |
971 | int ret = 0; | |
972 | struct device *dev = i2400m_dev(i2400m); | |
ecddfd5e | 973 | int count = i2400m->bus_bm_retries; |
467cc396 IPG |
974 | |
975 | d_fnstart(5, dev, "(i2400m %p bcf %p size %zu)\n", | |
976 | i2400m, bcf, bcf_size); | |
977 | i2400m->boot_mode = 1; | |
b4013f91 | 978 | wmb(); /* Make sure other readers see it */ |
467cc396 IPG |
979 | hw_reboot: |
980 | if (count-- == 0) { | |
981 | ret = -ERESTARTSYS; | |
982 | dev_err(dev, "device rebooted too many times, aborting\n"); | |
983 | goto error_too_many_reboots; | |
984 | } | |
985 | if (flags & I2400M_BRI_MAC_REINIT) { | |
986 | ret = i2400m_bootrom_init(i2400m, flags); | |
987 | if (ret < 0) { | |
988 | dev_err(dev, "bootrom init failed: %d\n", ret); | |
989 | goto error_bootrom_init; | |
990 | } | |
991 | } | |
992 | flags |= I2400M_BRI_MAC_REINIT; | |
993 | ||
994 | /* | |
995 | * Initialize the download, push the bytes to the device and | |
996 | * then jump to the new firmware. Note @ret is passed with the | |
997 | * offset of the jump instruction to _dnload_finalize() | |
998 | */ | |
999 | ret = i2400m_dnload_init(i2400m, bcf); /* Init device's dnload */ | |
1000 | if (ret == -ERESTARTSYS) | |
1001 | goto error_dev_rebooted; | |
1002 | if (ret < 0) | |
1003 | goto error_dnload_init; | |
1004 | ||
1005 | ret = i2400m_dnload_bcf(i2400m, bcf, bcf_size); | |
1006 | if (ret == -ERESTARTSYS) | |
1007 | goto error_dev_rebooted; | |
1008 | if (ret < 0) { | |
1009 | dev_err(dev, "fw %s: download failed: %d\n", | |
1039abbc | 1010 | i2400m->fw_name, ret); |
467cc396 IPG |
1011 | goto error_dnload_bcf; |
1012 | } | |
1013 | ||
1014 | ret = i2400m_dnload_finalize(i2400m, bcf, ret); | |
1015 | if (ret == -ERESTARTSYS) | |
1016 | goto error_dev_rebooted; | |
1017 | if (ret < 0) { | |
1018 | dev_err(dev, "fw %s: " | |
1019 | "download finalization failed: %d\n", | |
1039abbc | 1020 | i2400m->fw_name, ret); |
467cc396 IPG |
1021 | goto error_dnload_finalize; |
1022 | } | |
1023 | ||
1024 | d_printf(2, dev, "fw %s successfully uploaded\n", | |
1039abbc | 1025 | i2400m->fw_name); |
467cc396 | 1026 | i2400m->boot_mode = 0; |
b4013f91 | 1027 | wmb(); /* Make sure i2400m_msg_to_dev() sees boot_mode */ |
467cc396 IPG |
1028 | error_dnload_finalize: |
1029 | error_dnload_bcf: | |
1030 | error_dnload_init: | |
1031 | error_bootrom_init: | |
1032 | error_too_many_reboots: | |
1033 | d_fnend(5, dev, "(i2400m %p bcf %p size %zu) = %d\n", | |
1034 | i2400m, bcf, bcf_size, ret); | |
1035 | return ret; | |
1036 | ||
1037 | error_dev_rebooted: | |
1038 | dev_err(dev, "device rebooted, %d tries left\n", count); | |
1039 | /* we got the notification already, no need to wait for it again */ | |
1040 | flags |= I2400M_BRI_SOFT; | |
1041 | goto hw_reboot; | |
1042 | } | |
1043 | ||
1044 | ||
1045 | /** | |
1046 | * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware | |
1047 | * | |
1048 | * @i2400m: device descriptor | |
1049 | * | |
1050 | * Returns: >= 0 if ok, < 0 errno code on error. | |
1051 | * | |
1052 | * This sets up the firmware upload environment, loads the firmware | |
1053 | * file from disk, verifies and then calls the firmware upload process | |
1054 | * per se. | |
1055 | * | |
1056 | * Can be called either from probe, or after a warm reset. Can not be | |
1057 | * called from within an interrupt. All the flow in this code is | |
1058 | * single-threade; all I/Os are synchronous. | |
1059 | */ | |
1060 | int i2400m_dev_bootstrap(struct i2400m *i2400m, enum i2400m_bri flags) | |
1061 | { | |
1039abbc | 1062 | int ret = 0, itr = 0; |
467cc396 IPG |
1063 | struct device *dev = i2400m_dev(i2400m); |
1064 | const struct firmware *fw; | |
1065 | const struct i2400m_bcf_hdr *bcf; /* Firmware data */ | |
1039abbc | 1066 | const char *fw_name; |
467cc396 IPG |
1067 | |
1068 | d_fnstart(5, dev, "(i2400m %p)\n", i2400m); | |
1039abbc | 1069 | |
467cc396 | 1070 | /* Load firmware files to memory. */ |
1039abbc IPG |
1071 | itr = 0; |
1072 | while(1) { | |
1073 | fw_name = i2400m->bus_fw_names[itr]; | |
1074 | if (fw_name == NULL) { | |
1075 | dev_err(dev, "Could not find a usable firmware image\n"); | |
1076 | ret = -ENOENT; | |
1077 | goto error_no_fw; | |
1078 | } | |
1079 | ret = request_firmware(&fw, fw_name, dev); | |
1080 | if (ret == 0) | |
1081 | break; /* got it */ | |
1082 | if (ret < 0) | |
1083 | dev_err(dev, "fw %s: cannot load file: %d\n", | |
1084 | fw_name, ret); | |
1085 | itr++; | |
467cc396 | 1086 | } |
467cc396 | 1087 | |
1039abbc IPG |
1088 | bcf = (void *) fw->data; |
1089 | i2400m->fw_name = fw_name; | |
467cc396 IPG |
1090 | ret = i2400m_fw_check(i2400m, bcf, fw->size); |
1091 | if (ret < 0) | |
1092 | goto error_fw_bad; | |
1093 | ret = i2400m_fw_dnload(i2400m, bcf, fw->size, flags); | |
1094 | error_fw_bad: | |
1095 | release_firmware(fw); | |
1039abbc | 1096 | error_no_fw: |
467cc396 IPG |
1097 | d_fnend(5, dev, "(i2400m %p) = %d\n", i2400m, ret); |
1098 | return ret; | |
1099 | } | |
1100 | EXPORT_SYMBOL_GPL(i2400m_dev_bootstrap); |