1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2019-2020 Linaro Limited */
3
4 #include <linux/acpi.h>
5 #include <linux/firmware.h>
6 #include <linux/module.h>
7 #include <linux/pci.h>
8 #include <linux/slab.h>
9 #include <linux/unaligned.h>
10
11 #include "xhci.h"
12 #include "xhci-trace.h"
13 #include "xhci-pci.h"
14
15 #define RENESAS_FW_VERSION 0x6C
16 #define RENESAS_ROM_CONFIG 0xF0
17 #define RENESAS_FW_STATUS 0xF4
18 #define RENESAS_FW_STATUS_MSB 0xF5
19 #define RENESAS_ROM_STATUS 0xF6
20 #define RENESAS_ROM_STATUS_MSB 0xF7
21 #define RENESAS_DATA0 0xF8
22 #define RENESAS_DATA1 0xFC
23
24 #define RENESAS_FW_VERSION_FIELD GENMASK(23, 7)
25 #define RENESAS_FW_VERSION_OFFSET 8
26
27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE BIT(0)
28 #define RENESAS_FW_STATUS_LOCK BIT(1)
29 #define RENESAS_FW_STATUS_RESULT GENMASK(6, 4)
30 #define RENESAS_FW_STATUS_INVALID 0
31 #define RENESAS_FW_STATUS_SUCCESS BIT(4)
32 #define RENESAS_FW_STATUS_ERROR BIT(5)
33 #define RENESAS_FW_STATUS_SET_DATA0 BIT(8)
34 #define RENESAS_FW_STATUS_SET_DATA1 BIT(9)
35
36 #define RENESAS_ROM_STATUS_ACCESS BIT(0)
37 #define RENESAS_ROM_STATUS_ERASE BIT(1)
38 #define RENESAS_ROM_STATUS_RELOAD BIT(2)
39 #define RENESAS_ROM_STATUS_RESULT GENMASK(6, 4)
40 #define RENESAS_ROM_STATUS_NO_RESULT 0
41 #define RENESAS_ROM_STATUS_SUCCESS BIT(4)
42 #define RENESAS_ROM_STATUS_ERROR BIT(5)
43 #define RENESAS_ROM_STATUS_SET_DATA0 BIT(8)
44 #define RENESAS_ROM_STATUS_SET_DATA1 BIT(9)
45 #define RENESAS_ROM_STATUS_ROM_EXISTS BIT(15)
46
47 #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F
48 #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D
49
50 #define RENESAS_RETRY 10000
51 #define RENESAS_DELAY 10
52
53 #define RENESAS_FW_NAME "renesas_usb_fw.mem"
54
renesas_fw_download_image(struct pci_dev * dev,const u32 * fw,size_t step,bool rom)55 static int renesas_fw_download_image(struct pci_dev *dev,
56 const u32 *fw, size_t step, bool rom)
57 {
58 size_t i;
59 int err;
60 u8 fw_status;
61 bool data0_or_data1;
62 u32 status_reg;
63
64 if (rom)
65 status_reg = RENESAS_ROM_STATUS_MSB;
66 else
67 status_reg = RENESAS_FW_STATUS_MSB;
68
69 /*
70 * The hardware does alternate between two 32-bit pages.
71 * (This is because each row of the firmware is 8 bytes).
72 *
73 * for even steps we use DATA0, for odd steps DATA1.
74 */
75 data0_or_data1 = (step & 1) == 1;
76
77 /* step+1. Read "Set DATAX" and confirm it is cleared. */
78 for (i = 0; i < RENESAS_RETRY; i++) {
79 err = pci_read_config_byte(dev, status_reg, &fw_status);
80 if (err) {
81 dev_err(&dev->dev, "Read Status failed: %d\n",
82 pcibios_err_to_errno(err));
83 return pcibios_err_to_errno(err);
84 }
85 if (!(fw_status & BIT(data0_or_data1)))
86 break;
87
88 udelay(RENESAS_DELAY);
89 }
90 if (i == RENESAS_RETRY) {
91 dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step);
92 return -ETIMEDOUT;
93 }
94
95 /*
96 * step+2. Write FW data to "DATAX".
97 * "LSB is left" => force little endian
98 */
99 err = pci_write_config_dword(dev, data0_or_data1 ?
100 RENESAS_DATA1 : RENESAS_DATA0,
101 (__force u32)cpu_to_le32(fw[step]));
102 if (err) {
103 dev_err(&dev->dev, "Write to DATAX failed: %d\n",
104 pcibios_err_to_errno(err));
105 return pcibios_err_to_errno(err);
106 }
107
108 udelay(100);
109
110 /* step+3. Set "Set DATAX". */
111 err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1));
112 if (err) {
113 dev_err(&dev->dev, "Write config for DATAX failed: %d\n",
114 pcibios_err_to_errno(err));
115 return pcibios_err_to_errno(err);
116 }
117
118 return 0;
119 }
120
renesas_fw_verify(const void * fw_data,size_t length)121 static int renesas_fw_verify(const void *fw_data,
122 size_t length)
123 {
124 u16 fw_version_pointer;
125
126 /*
127 * The Firmware's Data Format is describe in
128 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124
129 */
130
131 /*
132 * The bootrom chips of the big brother have sizes up to 64k, let's
133 * assume that's the biggest the firmware can get.
134 */
135 if (length < 0x1000 || length >= 0x10000) {
136 pr_err("firmware is size %zd is not (4k - 64k).",
137 length);
138 return -EINVAL;
139 }
140
141 /* The First 2 bytes are fixed value (55aa). "LSB on Left" */
142 if (get_unaligned_le16(fw_data) != 0x55aa) {
143 pr_err("no valid firmware header found.");
144 return -EINVAL;
145 }
146
147 /* verify the firmware version position and print it. */
148 fw_version_pointer = get_unaligned_le16(fw_data + 4);
149 if (fw_version_pointer + 2 >= length) {
150 pr_err("fw ver pointer is outside of the firmware image");
151 return -EINVAL;
152 }
153
154 return 0;
155 }
156
renesas_check_rom(struct pci_dev * pdev)157 static bool renesas_check_rom(struct pci_dev *pdev)
158 {
159 u16 rom_status;
160 int retval;
161
162 /* Check if external ROM exists */
163 retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status);
164 if (retval)
165 return false;
166
167 rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS;
168 if (rom_status) {
169 dev_dbg(&pdev->dev, "External ROM exists\n");
170 return true; /* External ROM exists */
171 }
172
173 return false;
174 }
175
renesas_check_rom_state(struct pci_dev * pdev)176 static int renesas_check_rom_state(struct pci_dev *pdev)
177 {
178 u16 rom_state;
179 u32 version;
180 int err;
181
182 /* check FW version */
183 err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version);
184 if (err)
185 return pcibios_err_to_errno(err);
186
187 version &= RENESAS_FW_VERSION_FIELD;
188 version = version >> RENESAS_FW_VERSION_OFFSET;
189 dev_dbg(&pdev->dev, "Found ROM version: %x\n", version);
190
191 /*
192 * Test if ROM is present and loaded, if so we can skip everything
193 */
194 err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state);
195 if (err)
196 return pcibios_err_to_errno(err);
197
198 if (rom_state & RENESAS_ROM_STATUS_ROM_EXISTS) {
199 /* ROM exists */
200 dev_dbg(&pdev->dev, "ROM exists\n");
201
202 /* Check the "Result Code" Bits (6:4) and act accordingly */
203 switch (rom_state & RENESAS_ROM_STATUS_RESULT) {
204 case RENESAS_ROM_STATUS_SUCCESS:
205 return 0;
206
207 case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */
208 dev_dbg(&pdev->dev, "Unknown ROM status ...\n");
209 return -ENOENT;
210
211 case RENESAS_ROM_STATUS_ERROR: /* Error State */
212 default: /* All other states are marked as "Reserved states" */
213 dev_err(&pdev->dev, "Invalid ROM..");
214 break;
215 }
216 }
217
218 return -EIO;
219 }
220
renesas_fw_check_running(struct pci_dev * pdev)221 static int renesas_fw_check_running(struct pci_dev *pdev)
222 {
223 u8 fw_state;
224 int err;
225
226 /*
227 * Test if the device is actually needing the firmware. As most
228 * BIOSes will initialize the device for us. If the device is
229 * initialized.
230 */
231 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state);
232 if (err)
233 return pcibios_err_to_errno(err);
234
235 /*
236 * Check if "FW Download Lock" is locked. If it is and the FW is
237 * ready we can simply continue. If the FW is not ready, we have
238 * to give up.
239 */
240 if (fw_state & RENESAS_FW_STATUS_LOCK) {
241 dev_dbg(&pdev->dev, "FW Download Lock is engaged.");
242
243 if (fw_state & RENESAS_FW_STATUS_SUCCESS)
244 return 0;
245
246 dev_err(&pdev->dev,
247 "FW Download Lock is set and FW is not ready. Giving Up.");
248 return -EIO;
249 }
250
251 /*
252 * Check if "FW Download Enable" is set. If someone (us?) tampered
253 * with it and it can't be reset, we have to give up too... and
254 * ask for a forgiveness and a reboot.
255 */
256 if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) {
257 dev_err(&pdev->dev,
258 "FW Download Enable is stale. Giving Up (poweroff/reboot needed).");
259 return -EIO;
260 }
261
262 /* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */
263 switch (fw_state & RENESAS_FW_STATUS_RESULT) {
264 case 0: /* No result yet */
265 dev_dbg(&pdev->dev, "FW is not ready/loaded yet.");
266
267 /* tell the caller, that this device needs the firmware. */
268 return 1;
269
270 case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */
271 dev_dbg(&pdev->dev, "FW is ready.");
272 return 0;
273
274 case RENESAS_FW_STATUS_ERROR: /* Error State */
275 dev_err(&pdev->dev,
276 "hardware is in an error state. Giving up (poweroff/reboot needed).");
277 return -ENODEV;
278
279 default: /* All other states are marked as "Reserved states" */
280 dev_err(&pdev->dev,
281 "hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).",
282 (fw_state & RENESAS_FW_STATUS_RESULT) >> 4);
283 return -EINVAL;
284 }
285 }
286
renesas_fw_download(struct pci_dev * pdev,const struct firmware * fw)287 static int renesas_fw_download(struct pci_dev *pdev,
288 const struct firmware *fw)
289 {
290 const u32 *fw_data = (const u32 *)fw->data;
291 size_t i;
292 int err;
293 u8 fw_status;
294
295 /*
296 * For more information and the big picture: please look at the
297 * "Firmware Download Sequence" in "7.1 FW Download Interface"
298 * of R19UH0078EJ0500 Rev.5.00 page 131
299 */
300
301 /*
302 * 0. Set "FW Download Enable" bit in the
303 * "FW Download Control & Status Register" at 0xF4
304 */
305 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS,
306 RENESAS_FW_STATUS_DOWNLOAD_ENABLE);
307 if (err)
308 return pcibios_err_to_errno(err);
309
310 /* 1 - 10 follow one step after the other. */
311 for (i = 0; i < fw->size / 4; i++) {
312 err = renesas_fw_download_image(pdev, fw_data, i, false);
313 if (err) {
314 dev_err(&pdev->dev,
315 "Firmware Download Step %zd failed at position %zd bytes with (%d).",
316 i, i * 4, err);
317 return err;
318 }
319 }
320
321 /*
322 * This sequence continues until the last data is written to
323 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1"
324 * is cleared by the hardware beforehand.
325 */
326 for (i = 0; i < RENESAS_RETRY; i++) {
327 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB,
328 &fw_status);
329 if (err)
330 return pcibios_err_to_errno(err);
331 if (!(fw_status & (BIT(0) | BIT(1))))
332 break;
333
334 udelay(RENESAS_DELAY);
335 }
336 if (i == RENESAS_RETRY)
337 dev_warn(&pdev->dev, "Final Firmware Download step timed out.");
338
339 /*
340 * 11. After finishing writing the last data of FW, the
341 * System Software must clear "FW Download Enable"
342 */
343 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0);
344 if (err)
345 return pcibios_err_to_errno(err);
346
347 /* 12. Read "Result Code" and confirm it is good. */
348 for (i = 0; i < RENESAS_RETRY; i++) {
349 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status);
350 if (err)
351 return pcibios_err_to_errno(err);
352 if (fw_status & RENESAS_FW_STATUS_SUCCESS)
353 break;
354
355 udelay(RENESAS_DELAY);
356 }
357 if (i == RENESAS_RETRY) {
358 /* Timed out / Error - let's see if we can fix this */
359 err = renesas_fw_check_running(pdev);
360 switch (err) {
361 case 0: /*
362 * we shouldn't end up here.
363 * maybe it took a little bit longer.
364 * But all should be well?
365 */
366 break;
367
368 case 1: /* (No result yet! */
369 dev_err(&pdev->dev, "FW Load timedout");
370 return -ETIMEDOUT;
371
372 default:
373 return err;
374 }
375 }
376
377 return 0;
378 }
379
renesas_rom_erase(struct pci_dev * pdev)380 static void renesas_rom_erase(struct pci_dev *pdev)
381 {
382 int retval, i;
383 u8 status;
384
385 dev_dbg(&pdev->dev, "Performing ROM Erase...\n");
386 retval = pci_write_config_dword(pdev, RENESAS_DATA0,
387 RENESAS_ROM_ERASE_MAGIC);
388 if (retval) {
389 dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n",
390 pcibios_err_to_errno(retval));
391 return;
392 }
393
394 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
395 if (retval) {
396 dev_err(&pdev->dev, "ROM status read failed: %d\n",
397 pcibios_err_to_errno(retval));
398 return;
399 }
400 status |= RENESAS_ROM_STATUS_ERASE;
401 retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status);
402 if (retval) {
403 dev_err(&pdev->dev, "ROM erase set word write failed\n");
404 return;
405 }
406
407 /* sleep a bit while ROM is erased */
408 msleep(20);
409
410 for (i = 0; i < RENESAS_RETRY; i++) {
411 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS,
412 &status);
413 status &= RENESAS_ROM_STATUS_ERASE;
414 if (!status)
415 break;
416
417 mdelay(RENESAS_DELAY);
418 }
419
420 if (i == RENESAS_RETRY)
421 dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status);
422
423 dev_dbg(&pdev->dev, "ROM Erase... Done success\n");
424 }
425
renesas_setup_rom(struct pci_dev * pdev,const struct firmware * fw)426 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw)
427 {
428 const u32 *fw_data = (const u32 *)fw->data;
429 int err, i;
430 u8 status;
431
432 /* 2. Write magic word to Data0 */
433 err = pci_write_config_dword(pdev, RENESAS_DATA0,
434 RENESAS_ROM_WRITE_MAGIC);
435 if (err)
436 return false;
437
438 /* 3. Set External ROM access */
439 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
440 RENESAS_ROM_STATUS_ACCESS);
441 if (err)
442 goto remove_bypass;
443
444 /* 4. Check the result */
445 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
446 if (err)
447 goto remove_bypass;
448 status &= GENMASK(6, 4);
449 if (status) {
450 dev_err(&pdev->dev,
451 "setting external rom failed: %x\n", status);
452 goto remove_bypass;
453 }
454
455 /* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */
456 for (i = 0; i < fw->size / 4; i++) {
457 err = renesas_fw_download_image(pdev, fw_data, i, true);
458 if (err) {
459 dev_err(&pdev->dev,
460 "ROM Download Step %d failed at position %d bytes with (%d)\n",
461 i, i * 4, err);
462 goto remove_bypass;
463 }
464 }
465
466 /*
467 * wait till DATA0/1 is cleared
468 */
469 for (i = 0; i < RENESAS_RETRY; i++) {
470 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB,
471 &status);
472 if (err)
473 goto remove_bypass;
474 if (!(status & (BIT(0) | BIT(1))))
475 break;
476
477 udelay(RENESAS_DELAY);
478 }
479 if (i == RENESAS_RETRY) {
480 dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n");
481 goto remove_bypass;
482 }
483
484 /* 17. Remove bypass */
485 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
486 if (err)
487 return false;
488
489 udelay(10);
490
491 /* 18. check result */
492 for (i = 0; i < RENESAS_RETRY; i++) {
493 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
494 if (err) {
495 dev_err(&pdev->dev, "Read ROM status failed:%d\n",
496 pcibios_err_to_errno(err));
497 return false;
498 }
499 status &= RENESAS_ROM_STATUS_RESULT;
500 if (status == RENESAS_ROM_STATUS_SUCCESS) {
501 dev_dbg(&pdev->dev, "Download ROM success\n");
502 break;
503 }
504 udelay(RENESAS_DELAY);
505 }
506 if (i == RENESAS_RETRY) { /* Timed out */
507 dev_err(&pdev->dev,
508 "Download to external ROM TO: %x\n", status);
509 return false;
510 }
511
512 dev_dbg(&pdev->dev, "Download to external ROM succeeded\n");
513
514 /* Last step set Reload */
515 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
516 RENESAS_ROM_STATUS_RELOAD);
517 if (err) {
518 dev_err(&pdev->dev, "Set ROM execute failed: %d\n",
519 pcibios_err_to_errno(err));
520 return false;
521 }
522
523 /*
524 * wait till Reload is cleared
525 */
526 for (i = 0; i < RENESAS_RETRY; i++) {
527 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
528 if (err)
529 return false;
530 if (!(status & RENESAS_ROM_STATUS_RELOAD))
531 break;
532
533 udelay(RENESAS_DELAY);
534 }
535 if (i == RENESAS_RETRY) {
536 dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status);
537 return false;
538 }
539
540 return true;
541
542 remove_bypass:
543 pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
544 return false;
545 }
546
renesas_load_fw(struct pci_dev * pdev,const struct firmware * fw)547 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw)
548 {
549 int err = 0;
550 bool rom;
551
552 /* Check if the device has external ROM */
553 rom = renesas_check_rom(pdev);
554 if (rom) {
555 /* perform chip erase first */
556 renesas_rom_erase(pdev);
557
558 /* lets try loading fw on ROM first */
559 rom = renesas_setup_rom(pdev, fw);
560 if (!rom) {
561 dev_dbg(&pdev->dev,
562 "ROM load failed, falling back on FW load\n");
563 } else {
564 dev_dbg(&pdev->dev,
565 "ROM load success\n");
566 goto exit;
567 }
568 }
569
570 err = renesas_fw_download(pdev, fw);
571
572 exit:
573 if (err)
574 dev_err(&pdev->dev, "firmware failed to download (%d).", err);
575 return err;
576 }
577
renesas_xhci_check_request_fw(struct pci_dev * pdev,const struct pci_device_id * id)578 static int renesas_xhci_check_request_fw(struct pci_dev *pdev,
579 const struct pci_device_id *id)
580 {
581 const char fw_name[] = RENESAS_FW_NAME;
582 const struct firmware *fw;
583 bool has_rom;
584 int err;
585
586 /* Check if device has ROM and loaded, if so skip everything */
587 has_rom = renesas_check_rom(pdev);
588 if (has_rom) {
589 err = renesas_check_rom_state(pdev);
590 if (!err)
591 return 0;
592 else if (err != -ENOENT)
593 has_rom = false;
594 }
595
596 err = renesas_fw_check_running(pdev);
597 /* Continue ahead, if the firmware is already running. */
598 if (!err)
599 return 0;
600
601 /* no firmware interface available */
602 if (err != 1)
603 return has_rom ? 0 : err;
604
605 pci_dev_get(pdev);
606 err = firmware_request_nowarn(&fw, fw_name, &pdev->dev);
607 pci_dev_put(pdev);
608 if (err) {
609 if (has_rom) {
610 dev_info(&pdev->dev, "failed to load firmware %s, fallback to ROM\n",
611 fw_name);
612 return 0;
613 }
614 dev_err(&pdev->dev, "failed to load firmware %s: %d\n",
615 fw_name, err);
616 return err;
617 }
618
619 err = renesas_fw_verify(fw->data, fw->size);
620 if (err)
621 goto exit;
622
623 err = renesas_load_fw(pdev, fw);
624 exit:
625 release_firmware(fw);
626 return err;
627 }
628
629 static int
xhci_pci_renesas_probe(struct pci_dev * dev,const struct pci_device_id * id)630 xhci_pci_renesas_probe(struct pci_dev *dev, const struct pci_device_id *id)
631 {
632 int retval;
633
634 retval = renesas_xhci_check_request_fw(dev, id);
635 if (retval)
636 return retval;
637
638 return xhci_pci_common_probe(dev, id);
639 }
640
641 static const struct pci_device_id pci_ids[] = {
642 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0014) },
643 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0015) },
644 { /* end: all zeroes */ }
645 };
646 MODULE_DEVICE_TABLE(pci, pci_ids);
647
648 static struct pci_driver xhci_renesas_pci_driver = {
649 .name = "xhci-pci-renesas",
650 .id_table = pci_ids,
651
652 .probe = xhci_pci_renesas_probe,
653 .remove = xhci_pci_remove,
654
655 .shutdown = usb_hcd_pci_shutdown,
656 .driver = {
657 .pm = pm_ptr(&usb_hcd_pci_pm_ops),
658 },
659 };
660 module_pci_driver(xhci_renesas_pci_driver);
661
662 MODULE_DESCRIPTION("Renesas xHCI PCI Host Controller Driver");
663 MODULE_FIRMWARE(RENESAS_FW_NAME);
664 MODULE_IMPORT_NS("xhci");
665 MODULE_LICENSE("GPL v2");
666