450 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2 3/* Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved. */4 5#include <linux/firmware.h>6#include <linux/limits.h>7#include <linux/mhi.h>8#include <linux/minmax.h>9#include <linux/mod_devicetable.h>10#include <linux/overflow.h>11#include <linux/types.h>12#include <linux/workqueue.h>13 14#include "sahara.h"15 16#define SAHARA_HELLO_CMD 0x1 /* Min protocol version 1.0 */17#define SAHARA_HELLO_RESP_CMD 0x2 /* Min protocol version 1.0 */18#define SAHARA_READ_DATA_CMD 0x3 /* Min protocol version 1.0 */19#define SAHARA_END_OF_IMAGE_CMD 0x4 /* Min protocol version 1.0 */20#define SAHARA_DONE_CMD 0x5 /* Min protocol version 1.0 */21#define SAHARA_DONE_RESP_CMD 0x6 /* Min protocol version 1.0 */22#define SAHARA_RESET_CMD 0x7 /* Min protocol version 1.0 */23#define SAHARA_RESET_RESP_CMD 0x8 /* Min protocol version 1.0 */24#define SAHARA_MEM_DEBUG_CMD 0x9 /* Min protocol version 2.0 */25#define SAHARA_MEM_READ_CMD 0xa /* Min protocol version 2.0 */26#define SAHARA_CMD_READY_CMD 0xb /* Min protocol version 2.1 */27#define SAHARA_SWITCH_MODE_CMD 0xc /* Min protocol version 2.1 */28#define SAHARA_EXECUTE_CMD 0xd /* Min protocol version 2.1 */29#define SAHARA_EXECUTE_RESP_CMD 0xe /* Min protocol version 2.1 */30#define SAHARA_EXECUTE_DATA_CMD 0xf /* Min protocol version 2.1 */31#define SAHARA_MEM_DEBUG64_CMD 0x10 /* Min protocol version 2.5 */32#define SAHARA_MEM_READ64_CMD 0x11 /* Min protocol version 2.5 */33#define SAHARA_READ_DATA64_CMD 0x12 /* Min protocol version 2.8 */34#define SAHARA_RESET_STATE_CMD 0x13 /* Min protocol version 2.9 */35#define SAHARA_WRITE_DATA_CMD 0x14 /* Min protocol version 3.0 */36 37#define SAHARA_PACKET_MAX_SIZE 0xffffU /* MHI_MAX_MTU */38#define SAHARA_TRANSFER_MAX_SIZE 0x8000039#define SAHARA_NUM_TX_BUF DIV_ROUND_UP(SAHARA_TRANSFER_MAX_SIZE,\40 SAHARA_PACKET_MAX_SIZE)41#define SAHARA_IMAGE_ID_NONE U32_MAX42 43#define SAHARA_VERSION 244#define SAHARA_SUCCESS 045 46#define SAHARA_MODE_IMAGE_TX_PENDING 0x047#define SAHARA_MODE_IMAGE_TX_COMPLETE 0x148#define SAHARA_MODE_MEMORY_DEBUG 0x249#define SAHARA_MODE_COMMAND 0x350 51#define SAHARA_HELLO_LENGTH 0x3052#define SAHARA_READ_DATA_LENGTH 0x1453#define SAHARA_END_OF_IMAGE_LENGTH 0x1054#define SAHARA_DONE_LENGTH 0x855#define SAHARA_RESET_LENGTH 0x856 57struct sahara_packet {58 __le32 cmd;59 __le32 length;60 61 union {62 struct {63 __le32 version;64 __le32 version_compat;65 __le32 max_length;66 __le32 mode;67 } hello;68 struct {69 __le32 version;70 __le32 version_compat;71 __le32 status;72 __le32 mode;73 } hello_resp;74 struct {75 __le32 image;76 __le32 offset;77 __le32 length;78 } read_data;79 struct {80 __le32 image;81 __le32 status;82 } end_of_image;83 };84};85 86struct sahara_context {87 struct sahara_packet *tx[SAHARA_NUM_TX_BUF];88 struct sahara_packet *rx;89 struct work_struct work;90 struct mhi_device *mhi_dev;91 const char **image_table;92 u32 table_size;93 u32 active_image_id;94 const struct firmware *firmware;95};96 97static const char *aic100_image_table[] = {98 [1] = "qcom/aic100/fw1.bin",99 [2] = "qcom/aic100/fw2.bin",100 [4] = "qcom/aic100/fw4.bin",101 [5] = "qcom/aic100/fw5.bin",102 [6] = "qcom/aic100/fw6.bin",103 [8] = "qcom/aic100/fw8.bin",104 [9] = "qcom/aic100/fw9.bin",105 [10] = "qcom/aic100/fw10.bin",106};107 108static int sahara_find_image(struct sahara_context *context, u32 image_id)109{110 int ret;111 112 if (image_id == context->active_image_id)113 return 0;114 115 if (context->active_image_id != SAHARA_IMAGE_ID_NONE) {116 dev_err(&context->mhi_dev->dev, "image id %d is not valid as %d is active\n",117 image_id, context->active_image_id);118 return -EINVAL;119 }120 121 if (image_id >= context->table_size || !context->image_table[image_id]) {122 dev_err(&context->mhi_dev->dev, "request for unknown image: %d\n", image_id);123 return -EINVAL;124 }125 126 /*127 * This image might be optional. The device may continue without it.128 * Only the device knows. Suppress error messages that could suggest an129 * a problem when we were actually able to continue.130 */131 ret = firmware_request_nowarn(&context->firmware,132 context->image_table[image_id],133 &context->mhi_dev->dev);134 if (ret) {135 dev_dbg(&context->mhi_dev->dev, "request for image id %d / file %s failed %d\n",136 image_id, context->image_table[image_id], ret);137 return ret;138 }139 140 context->active_image_id = image_id;141 142 return 0;143}144 145static void sahara_release_image(struct sahara_context *context)146{147 if (context->active_image_id != SAHARA_IMAGE_ID_NONE)148 release_firmware(context->firmware);149 context->active_image_id = SAHARA_IMAGE_ID_NONE;150}151 152static void sahara_send_reset(struct sahara_context *context)153{154 int ret;155 156 context->tx[0]->cmd = cpu_to_le32(SAHARA_RESET_CMD);157 context->tx[0]->length = cpu_to_le32(SAHARA_RESET_LENGTH);158 159 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],160 SAHARA_RESET_LENGTH, MHI_EOT);161 if (ret)162 dev_err(&context->mhi_dev->dev, "Unable to send reset response %d\n", ret);163}164 165static void sahara_hello(struct sahara_context *context)166{167 int ret;168 169 dev_dbg(&context->mhi_dev->dev,170 "HELLO cmd received. length:%d version:%d version_compat:%d max_length:%d mode:%d\n",171 le32_to_cpu(context->rx->length),172 le32_to_cpu(context->rx->hello.version),173 le32_to_cpu(context->rx->hello.version_compat),174 le32_to_cpu(context->rx->hello.max_length),175 le32_to_cpu(context->rx->hello.mode));176 177 if (le32_to_cpu(context->rx->length) != SAHARA_HELLO_LENGTH) {178 dev_err(&context->mhi_dev->dev, "Malformed hello packet - length %d\n",179 le32_to_cpu(context->rx->length));180 return;181 }182 if (le32_to_cpu(context->rx->hello.version) != SAHARA_VERSION) {183 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - version %d\n",184 le32_to_cpu(context->rx->hello.version));185 return;186 }187 188 if (le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_PENDING &&189 le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_COMPLETE) {190 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - mode %d\n",191 le32_to_cpu(context->rx->hello.mode));192 return;193 }194 195 context->tx[0]->cmd = cpu_to_le32(SAHARA_HELLO_RESP_CMD);196 context->tx[0]->length = cpu_to_le32(SAHARA_HELLO_LENGTH);197 context->tx[0]->hello_resp.version = cpu_to_le32(SAHARA_VERSION);198 context->tx[0]->hello_resp.version_compat = cpu_to_le32(SAHARA_VERSION);199 context->tx[0]->hello_resp.status = cpu_to_le32(SAHARA_SUCCESS);200 context->tx[0]->hello_resp.mode = context->rx->hello_resp.mode;201 202 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],203 SAHARA_HELLO_LENGTH, MHI_EOT);204 if (ret)205 dev_err(&context->mhi_dev->dev, "Unable to send hello response %d\n", ret);206}207 208static void sahara_read_data(struct sahara_context *context)209{210 u32 image_id, data_offset, data_len, pkt_data_len;211 int ret;212 int i;213 214 dev_dbg(&context->mhi_dev->dev,215 "READ_DATA cmd received. length:%d image:%d offset:%d data_length:%d\n",216 le32_to_cpu(context->rx->length),217 le32_to_cpu(context->rx->read_data.image),218 le32_to_cpu(context->rx->read_data.offset),219 le32_to_cpu(context->rx->read_data.length));220 221 if (le32_to_cpu(context->rx->length) != SAHARA_READ_DATA_LENGTH) {222 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - length %d\n",223 le32_to_cpu(context->rx->length));224 return;225 }226 227 image_id = le32_to_cpu(context->rx->read_data.image);228 data_offset = le32_to_cpu(context->rx->read_data.offset);229 data_len = le32_to_cpu(context->rx->read_data.length);230 231 ret = sahara_find_image(context, image_id);232 if (ret) {233 sahara_send_reset(context);234 return;235 }236 237 /*238 * Image is released when the device is done with it via239 * SAHARA_END_OF_IMAGE_CMD. sahara_send_reset() will either cause the240 * device to retry the operation with a modification, or decide to be241 * done with the image and trigger SAHARA_END_OF_IMAGE_CMD.242 * release_image() is called from SAHARA_END_OF_IMAGE_CMD. processing243 * and is not needed here on error.244 */245 246 if (data_len > SAHARA_TRANSFER_MAX_SIZE) {247 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data len %d exceeds max xfer size %d\n",248 data_len, SAHARA_TRANSFER_MAX_SIZE);249 sahara_send_reset(context);250 return;251 }252 253 if (data_offset >= context->firmware->size) {254 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d exceeds file size %zu\n",255 data_offset, context->firmware->size);256 sahara_send_reset(context);257 return;258 }259 260 if (size_add(data_offset, data_len) > context->firmware->size) {261 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d and length %d exceeds file size %zu\n",262 data_offset, data_len, context->firmware->size);263 sahara_send_reset(context);264 return;265 }266 267 for (i = 0; i < SAHARA_NUM_TX_BUF && data_len; ++i) {268 pkt_data_len = min(data_len, SAHARA_PACKET_MAX_SIZE);269 270 memcpy(context->tx[i], &context->firmware->data[data_offset], pkt_data_len);271 272 data_offset += pkt_data_len;273 data_len -= pkt_data_len;274 275 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE,276 context->tx[i], pkt_data_len,277 !data_len ? MHI_EOT : MHI_CHAIN);278 if (ret) {279 dev_err(&context->mhi_dev->dev, "Unable to send read_data response %d\n",280 ret);281 return;282 }283 }284}285 286static void sahara_end_of_image(struct sahara_context *context)287{288 int ret;289 290 dev_dbg(&context->mhi_dev->dev,291 "END_OF_IMAGE cmd received. length:%d image:%d status:%d\n",292 le32_to_cpu(context->rx->length),293 le32_to_cpu(context->rx->end_of_image.image),294 le32_to_cpu(context->rx->end_of_image.status));295 296 if (le32_to_cpu(context->rx->length) != SAHARA_END_OF_IMAGE_LENGTH) {297 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - length %d\n",298 le32_to_cpu(context->rx->length));299 return;300 }301 302 if (context->active_image_id != SAHARA_IMAGE_ID_NONE &&303 le32_to_cpu(context->rx->end_of_image.image) != context->active_image_id) {304 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - image %d is not the active image\n",305 le32_to_cpu(context->rx->end_of_image.image));306 return;307 }308 309 sahara_release_image(context);310 311 if (le32_to_cpu(context->rx->end_of_image.status))312 return;313 314 context->tx[0]->cmd = cpu_to_le32(SAHARA_DONE_CMD);315 context->tx[0]->length = cpu_to_le32(SAHARA_DONE_LENGTH);316 317 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],318 SAHARA_DONE_LENGTH, MHI_EOT);319 if (ret)320 dev_dbg(&context->mhi_dev->dev, "Unable to send done response %d\n", ret);321}322 323static void sahara_processing(struct work_struct *work)324{325 struct sahara_context *context = container_of(work, struct sahara_context, work);326 int ret;327 328 switch (le32_to_cpu(context->rx->cmd)) {329 case SAHARA_HELLO_CMD:330 sahara_hello(context);331 break;332 case SAHARA_READ_DATA_CMD:333 sahara_read_data(context);334 break;335 case SAHARA_END_OF_IMAGE_CMD:336 sahara_end_of_image(context);337 break;338 case SAHARA_DONE_RESP_CMD:339 /* Intentional do nothing as we don't need to exit an app */340 break;341 default:342 dev_err(&context->mhi_dev->dev, "Unknown command %d\n",343 le32_to_cpu(context->rx->cmd));344 break;345 }346 347 ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE, context->rx,348 SAHARA_PACKET_MAX_SIZE, MHI_EOT);349 if (ret)350 dev_err(&context->mhi_dev->dev, "Unable to requeue rx buf %d\n", ret);351}352 353static int sahara_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_device_id *id)354{355 struct sahara_context *context;356 int ret;357 int i;358 359 context = devm_kzalloc(&mhi_dev->dev, sizeof(*context), GFP_KERNEL);360 if (!context)361 return -ENOMEM;362 363 context->rx = devm_kzalloc(&mhi_dev->dev, SAHARA_PACKET_MAX_SIZE, GFP_KERNEL);364 if (!context->rx)365 return -ENOMEM;366 367 /*368 * AIC100 defines SAHARA_TRANSFER_MAX_SIZE as the largest value it369 * will request for READ_DATA. This is larger than370 * SAHARA_PACKET_MAX_SIZE, and we need 9x SAHARA_PACKET_MAX_SIZE to371 * cover SAHARA_TRANSFER_MAX_SIZE. When the remote side issues a372 * READ_DATA, it requires a transfer of the exact size requested. We373 * can use MHI_CHAIN to link multiple buffers into a single transfer374 * but the remote side will not consume the buffers until it sees an375 * EOT, thus we need to allocate enough buffers to put in the tx fifo376 * to cover an entire READ_DATA request of the max size.377 */378 for (i = 0; i < SAHARA_NUM_TX_BUF; ++i) {379 context->tx[i] = devm_kzalloc(&mhi_dev->dev, SAHARA_PACKET_MAX_SIZE, GFP_KERNEL);380 if (!context->tx[i])381 return -ENOMEM;382 }383 384 context->mhi_dev = mhi_dev;385 INIT_WORK(&context->work, sahara_processing);386 context->image_table = aic100_image_table;387 context->table_size = ARRAY_SIZE(aic100_image_table);388 context->active_image_id = SAHARA_IMAGE_ID_NONE;389 dev_set_drvdata(&mhi_dev->dev, context);390 391 ret = mhi_prepare_for_transfer(mhi_dev);392 if (ret)393 return ret;394 395 ret = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, context->rx, SAHARA_PACKET_MAX_SIZE, MHI_EOT);396 if (ret) {397 mhi_unprepare_from_transfer(mhi_dev);398 return ret;399 }400 401 return 0;402}403 404static void sahara_mhi_remove(struct mhi_device *mhi_dev)405{406 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);407 408 cancel_work_sync(&context->work);409 sahara_release_image(context);410 mhi_unprepare_from_transfer(mhi_dev);411}412 413static void sahara_mhi_ul_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result)414{415}416 417static void sahara_mhi_dl_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result)418{419 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);420 421 if (!mhi_result->transaction_status)422 schedule_work(&context->work);423}424 425static const struct mhi_device_id sahara_mhi_match_table[] = {426 { .chan = "QAIC_SAHARA", },427 {},428};429 430static struct mhi_driver sahara_mhi_driver = {431 .id_table = sahara_mhi_match_table,432 .remove = sahara_mhi_remove,433 .probe = sahara_mhi_probe,434 .ul_xfer_cb = sahara_mhi_ul_xfer_cb,435 .dl_xfer_cb = sahara_mhi_dl_xfer_cb,436 .driver = {437 .name = "sahara",438 },439};440 441int sahara_register(void)442{443 return mhi_driver_register(&sahara_mhi_driver);444}445 446void sahara_unregister(void)447{448 mhi_driver_unregister(&sahara_mhi_driver);449}450