1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
4 *
5 */
6
7 #include <linux/delay.h>
8 #include <linux/device.h>
9 #include <linux/dma-direction.h>
10 #include <linux/dma-mapping.h>
11 #include <linux/firmware.h>
12 #include <linux/interrupt.h>
13 #include <linux/list.h>
14 #include <linux/mhi.h>
15 #include <linux/module.h>
16 #include <linux/random.h>
17 #include <linux/slab.h>
18 #include <linux/wait.h>
19 #include "internal.h"
20
21 /* Setup RDDM vector table for RDDM transfer and program RXVEC */
mhi_rddm_prepare(struct mhi_controller * mhi_cntrl,struct image_info * img_info)22 int mhi_rddm_prepare(struct mhi_controller *mhi_cntrl,
23 struct image_info *img_info)
24 {
25 struct mhi_buf *mhi_buf = img_info->mhi_buf;
26 struct bhi_vec_entry *bhi_vec = img_info->bhi_vec;
27 void __iomem *base = mhi_cntrl->bhie;
28 struct device *dev = &mhi_cntrl->mhi_dev->dev;
29 u32 sequence_id;
30 unsigned int i;
31 int ret;
32
33 for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) {
34 bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
35 bhi_vec->size = cpu_to_le64(mhi_buf->len);
36 }
37
38 dev_dbg(dev, "BHIe programming for RDDM\n");
39
40 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECADDR_HIGH_OFFS,
41 upper_32_bits(mhi_buf->dma_addr));
42
43 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECADDR_LOW_OFFS,
44 lower_32_bits(mhi_buf->dma_addr));
45
46 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECSIZE_OFFS, mhi_buf->len);
47 sequence_id = MHI_RANDOM_U32_NONZERO(BHIE_RXVECSTATUS_SEQNUM_BMSK);
48
49 ret = mhi_write_reg_field(mhi_cntrl, base, BHIE_RXVECDB_OFFS,
50 BHIE_RXVECDB_SEQNUM_BMSK, sequence_id);
51 if (ret) {
52 dev_err(dev, "Failed to write sequence ID for BHIE_RXVECDB\n");
53 return ret;
54 }
55
56 dev_dbg(dev, "Address: %p and len: 0x%zx sequence: %u\n",
57 &mhi_buf->dma_addr, mhi_buf->len, sequence_id);
58
59 return 0;
60 }
61
62 /* Collect RDDM buffer during kernel panic */
__mhi_download_rddm_in_panic(struct mhi_controller * mhi_cntrl)63 static int __mhi_download_rddm_in_panic(struct mhi_controller *mhi_cntrl)
64 {
65 int ret;
66 u32 rx_status;
67 enum mhi_ee_type ee;
68 const u32 delayus = 2000;
69 u32 retry = (mhi_cntrl->timeout_ms * 1000) / delayus;
70 const u32 rddm_timeout_us = 200000;
71 int rddm_retry = rddm_timeout_us / delayus;
72 void __iomem *base = mhi_cntrl->bhie;
73 struct device *dev = &mhi_cntrl->mhi_dev->dev;
74
75 dev_dbg(dev, "Entered with pm_state:%s dev_state:%s ee:%s\n",
76 to_mhi_pm_state_str(mhi_cntrl->pm_state),
77 mhi_state_str(mhi_cntrl->dev_state),
78 TO_MHI_EXEC_STR(mhi_cntrl->ee));
79
80 /*
81 * This should only be executing during a kernel panic, we expect all
82 * other cores to shutdown while we're collecting RDDM buffer. After
83 * returning from this function, we expect the device to reset.
84 *
85 * Normally, we read/write pm_state only after grabbing the
86 * pm_lock, since we're in a panic, skipping it. Also there is no
87 * guarantee that this state change would take effect since
88 * we're setting it w/o grabbing pm_lock
89 */
90 mhi_cntrl->pm_state = MHI_PM_LD_ERR_FATAL_DETECT;
91 /* update should take the effect immediately */
92 smp_wmb();
93
94 /*
95 * Make sure device is not already in RDDM. In case the device asserts
96 * and a kernel panic follows, device will already be in RDDM.
97 * Do not trigger SYS ERR again and proceed with waiting for
98 * image download completion.
99 */
100 ee = mhi_get_exec_env(mhi_cntrl);
101 if (ee == MHI_EE_MAX)
102 goto error_exit_rddm;
103
104 if (ee != MHI_EE_RDDM) {
105 dev_dbg(dev, "Trigger device into RDDM mode using SYS ERR\n");
106 mhi_set_mhi_state(mhi_cntrl, MHI_STATE_SYS_ERR);
107
108 dev_dbg(dev, "Waiting for device to enter RDDM\n");
109 while (rddm_retry--) {
110 ee = mhi_get_exec_env(mhi_cntrl);
111 if (ee == MHI_EE_RDDM)
112 break;
113
114 udelay(delayus);
115 }
116
117 if (rddm_retry <= 0) {
118 /* Hardware reset so force device to enter RDDM */
119 dev_dbg(dev,
120 "Did not enter RDDM, do a host req reset\n");
121 mhi_soc_reset(mhi_cntrl);
122 udelay(delayus);
123 }
124
125 ee = mhi_get_exec_env(mhi_cntrl);
126 }
127
128 dev_dbg(dev,
129 "Waiting for RDDM image download via BHIe, current EE:%s\n",
130 TO_MHI_EXEC_STR(ee));
131
132 while (retry--) {
133 ret = mhi_read_reg_field(mhi_cntrl, base, BHIE_RXVECSTATUS_OFFS,
134 BHIE_RXVECSTATUS_STATUS_BMSK, &rx_status);
135 if (ret)
136 return -EIO;
137
138 if (rx_status == BHIE_RXVECSTATUS_STATUS_XFER_COMPL)
139 return 0;
140
141 udelay(delayus);
142 }
143
144 ee = mhi_get_exec_env(mhi_cntrl);
145 ret = mhi_read_reg(mhi_cntrl, base, BHIE_RXVECSTATUS_OFFS, &rx_status);
146
147 dev_err(dev, "RXVEC_STATUS: 0x%x\n", rx_status);
148
149 error_exit_rddm:
150 dev_err(dev, "RDDM transfer failed. Current EE: %s\n",
151 TO_MHI_EXEC_STR(ee));
152
153 return -EIO;
154 }
155
156 /* Download RDDM image from device */
mhi_download_rddm_image(struct mhi_controller * mhi_cntrl,bool in_panic)157 int mhi_download_rddm_image(struct mhi_controller *mhi_cntrl, bool in_panic)
158 {
159 void __iomem *base = mhi_cntrl->bhie;
160 struct device *dev = &mhi_cntrl->mhi_dev->dev;
161 u32 rx_status;
162
163 if (in_panic)
164 return __mhi_download_rddm_in_panic(mhi_cntrl);
165
166 dev_dbg(dev, "Waiting for RDDM image download via BHIe\n");
167
168 /* Wait for the image download to complete */
169 wait_event_timeout(mhi_cntrl->state_event,
170 mhi_read_reg_field(mhi_cntrl, base,
171 BHIE_RXVECSTATUS_OFFS,
172 BHIE_RXVECSTATUS_STATUS_BMSK,
173 &rx_status) || rx_status,
174 msecs_to_jiffies(mhi_cntrl->timeout_ms));
175
176 return (rx_status == BHIE_RXVECSTATUS_STATUS_XFER_COMPL) ? 0 : -EIO;
177 }
178 EXPORT_SYMBOL_GPL(mhi_download_rddm_image);
179
mhi_fw_load_error_dump(struct mhi_controller * mhi_cntrl)180 static void mhi_fw_load_error_dump(struct mhi_controller *mhi_cntrl)
181 {
182 struct device *dev = &mhi_cntrl->mhi_dev->dev;
183 rwlock_t *pm_lock = &mhi_cntrl->pm_lock;
184 void __iomem *base = mhi_cntrl->bhi;
185 int ret, i;
186 u32 val;
187 struct {
188 char *name;
189 u32 offset;
190 } error_reg[] = {
191 { "ERROR_CODE", BHI_ERRCODE },
192 { "ERROR_DBG1", BHI_ERRDBG1 },
193 { "ERROR_DBG2", BHI_ERRDBG2 },
194 { "ERROR_DBG3", BHI_ERRDBG3 },
195 { NULL },
196 };
197
198 read_lock_bh(pm_lock);
199 if (MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) {
200 for (i = 0; error_reg[i].name; i++) {
201 ret = mhi_read_reg(mhi_cntrl, base, error_reg[i].offset, &val);
202 if (ret)
203 break;
204 dev_err(dev, "Reg: %s value: 0x%x\n", error_reg[i].name, val);
205 }
206 }
207 read_unlock_bh(pm_lock);
208 }
209
mhi_fw_load_bhie(struct mhi_controller * mhi_cntrl,const struct mhi_buf * mhi_buf)210 static int mhi_fw_load_bhie(struct mhi_controller *mhi_cntrl,
211 const struct mhi_buf *mhi_buf)
212 {
213 void __iomem *base = mhi_cntrl->bhie;
214 struct device *dev = &mhi_cntrl->mhi_dev->dev;
215 rwlock_t *pm_lock = &mhi_cntrl->pm_lock;
216 u32 tx_status, sequence_id;
217 int ret;
218
219 read_lock_bh(pm_lock);
220 if (!MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) {
221 read_unlock_bh(pm_lock);
222 return -EIO;
223 }
224
225 sequence_id = MHI_RANDOM_U32_NONZERO(BHIE_TXVECSTATUS_SEQNUM_BMSK);
226 dev_dbg(dev, "Starting image download via BHIe. Sequence ID: %u\n",
227 sequence_id);
228 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECADDR_HIGH_OFFS,
229 upper_32_bits(mhi_buf->dma_addr));
230
231 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECADDR_LOW_OFFS,
232 lower_32_bits(mhi_buf->dma_addr));
233
234 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECSIZE_OFFS, mhi_buf->len);
235
236 ret = mhi_write_reg_field(mhi_cntrl, base, BHIE_TXVECDB_OFFS,
237 BHIE_TXVECDB_SEQNUM_BMSK, sequence_id);
238 read_unlock_bh(pm_lock);
239
240 if (ret)
241 return ret;
242
243 /* Wait for the image download to complete */
244 ret = wait_event_timeout(mhi_cntrl->state_event,
245 MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) ||
246 mhi_read_reg_field(mhi_cntrl, base,
247 BHIE_TXVECSTATUS_OFFS,
248 BHIE_TXVECSTATUS_STATUS_BMSK,
249 &tx_status) || tx_status,
250 msecs_to_jiffies(mhi_cntrl->timeout_ms));
251 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) ||
252 tx_status != BHIE_TXVECSTATUS_STATUS_XFER_COMPL)
253 return -EIO;
254
255 return (!ret) ? -ETIMEDOUT : 0;
256 }
257
mhi_fw_load_bhi(struct mhi_controller * mhi_cntrl,const struct mhi_buf * mhi_buf)258 static int mhi_fw_load_bhi(struct mhi_controller *mhi_cntrl,
259 const struct mhi_buf *mhi_buf)
260 {
261 struct device *dev = &mhi_cntrl->mhi_dev->dev;
262 rwlock_t *pm_lock = &mhi_cntrl->pm_lock;
263 void __iomem *base = mhi_cntrl->bhi;
264 u32 tx_status, session_id;
265 int ret;
266
267 read_lock_bh(pm_lock);
268 if (!MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) {
269 read_unlock_bh(pm_lock);
270 goto invalid_pm_state;
271 }
272
273 session_id = MHI_RANDOM_U32_NONZERO(BHI_TXDB_SEQNUM_BMSK);
274 dev_dbg(dev, "Starting image download via BHI. Session ID: %u\n",
275 session_id);
276 mhi_write_reg(mhi_cntrl, base, BHI_STATUS, 0);
277 mhi_write_reg(mhi_cntrl, base, BHI_IMGADDR_HIGH, upper_32_bits(mhi_buf->dma_addr));
278 mhi_write_reg(mhi_cntrl, base, BHI_IMGADDR_LOW, lower_32_bits(mhi_buf->dma_addr));
279 mhi_write_reg(mhi_cntrl, base, BHI_IMGSIZE, mhi_buf->len);
280 mhi_write_reg(mhi_cntrl, base, BHI_IMGTXDB, session_id);
281 read_unlock_bh(pm_lock);
282
283 /* Wait for the image download to complete */
284 ret = wait_event_timeout(mhi_cntrl->state_event,
285 MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) ||
286 mhi_read_reg_field(mhi_cntrl, base, BHI_STATUS,
287 BHI_STATUS_MASK, &tx_status) || tx_status,
288 msecs_to_jiffies(mhi_cntrl->timeout_ms));
289 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state))
290 goto invalid_pm_state;
291
292 if (tx_status == BHI_STATUS_ERROR) {
293 dev_err(dev, "Image transfer failed\n");
294 mhi_fw_load_error_dump(mhi_cntrl);
295 goto invalid_pm_state;
296 }
297
298 return (!ret) ? -ETIMEDOUT : 0;
299
300 invalid_pm_state:
301
302 return -EIO;
303 }
304
mhi_free_bhi_buffer(struct mhi_controller * mhi_cntrl,struct image_info * image_info)305 static void mhi_free_bhi_buffer(struct mhi_controller *mhi_cntrl,
306 struct image_info *image_info)
307 {
308 struct mhi_buf *mhi_buf = image_info->mhi_buf;
309
310 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len, mhi_buf->buf, mhi_buf->dma_addr);
311 kfree(image_info->mhi_buf);
312 kfree(image_info);
313 }
314
mhi_free_bhie_table(struct mhi_controller * mhi_cntrl,struct image_info * image_info)315 void mhi_free_bhie_table(struct mhi_controller *mhi_cntrl,
316 struct image_info *image_info)
317 {
318 int i;
319 struct mhi_buf *mhi_buf = image_info->mhi_buf;
320
321 for (i = 0; i < image_info->entries; i++, mhi_buf++)
322 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len,
323 mhi_buf->buf, mhi_buf->dma_addr);
324
325 kfree(image_info->mhi_buf);
326 kfree(image_info);
327 }
328
mhi_alloc_bhi_buffer(struct mhi_controller * mhi_cntrl,struct image_info ** image_info,size_t alloc_size)329 static int mhi_alloc_bhi_buffer(struct mhi_controller *mhi_cntrl,
330 struct image_info **image_info,
331 size_t alloc_size)
332 {
333 struct image_info *img_info;
334 struct mhi_buf *mhi_buf;
335
336 img_info = kzalloc_obj(*img_info);
337 if (!img_info)
338 return -ENOMEM;
339
340 /* Allocate memory for entry */
341 img_info->mhi_buf = kzalloc_obj(*img_info->mhi_buf);
342 if (!img_info->mhi_buf)
343 goto error_alloc_mhi_buf;
344
345 /* Allocate and populate vector table */
346 mhi_buf = img_info->mhi_buf;
347
348 mhi_buf->len = alloc_size;
349 mhi_buf->buf = dma_alloc_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len,
350 &mhi_buf->dma_addr, GFP_KERNEL);
351 if (!mhi_buf->buf)
352 goto error_alloc_segment;
353
354 img_info->bhi_vec = NULL;
355 img_info->entries = 1;
356 *image_info = img_info;
357
358 return 0;
359
360 error_alloc_segment:
361 kfree(mhi_buf);
362 error_alloc_mhi_buf:
363 kfree(img_info);
364
365 return -ENOMEM;
366 }
367
mhi_alloc_bhie_table(struct mhi_controller * mhi_cntrl,struct image_info ** image_info,size_t alloc_size)368 int mhi_alloc_bhie_table(struct mhi_controller *mhi_cntrl,
369 struct image_info **image_info,
370 size_t alloc_size)
371 {
372 size_t seg_size = mhi_cntrl->seg_len;
373 int segments = DIV_ROUND_UP(alloc_size, seg_size) + 1;
374 int i;
375 struct image_info *img_info;
376 struct mhi_buf *mhi_buf;
377
378 img_info = kzalloc_obj(*img_info);
379 if (!img_info)
380 return -ENOMEM;
381
382 /* Allocate memory for entries */
383 img_info->mhi_buf = kzalloc_objs(*img_info->mhi_buf, segments);
384 if (!img_info->mhi_buf)
385 goto error_alloc_mhi_buf;
386
387 /* Allocate and populate vector table */
388 mhi_buf = img_info->mhi_buf;
389 for (i = 0; i < segments; i++, mhi_buf++) {
390 size_t vec_size = seg_size;
391
392 /* Vector table is the last entry */
393 if (i == segments - 1)
394 vec_size = sizeof(struct bhi_vec_entry) * i;
395
396 mhi_buf->len = vec_size;
397 mhi_buf->buf = dma_alloc_coherent(mhi_cntrl->cntrl_dev,
398 vec_size, &mhi_buf->dma_addr,
399 GFP_KERNEL);
400 if (!mhi_buf->buf)
401 goto error_alloc_segment;
402 }
403
404 img_info->bhi_vec = img_info->mhi_buf[segments - 1].buf;
405 img_info->entries = segments;
406 *image_info = img_info;
407
408 return 0;
409
410 error_alloc_segment:
411 for (--i, --mhi_buf; i >= 0; i--, mhi_buf--)
412 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len,
413 mhi_buf->buf, mhi_buf->dma_addr);
414 kfree(img_info->mhi_buf);
415
416 error_alloc_mhi_buf:
417 kfree(img_info);
418
419 return -ENOMEM;
420 }
421
mhi_firmware_copy_bhie(struct mhi_controller * mhi_cntrl,const u8 * buf,size_t remainder,struct image_info * img_info)422 static void mhi_firmware_copy_bhie(struct mhi_controller *mhi_cntrl,
423 const u8 *buf, size_t remainder,
424 struct image_info *img_info)
425 {
426 size_t to_cpy;
427 struct mhi_buf *mhi_buf = img_info->mhi_buf;
428 struct bhi_vec_entry *bhi_vec = img_info->bhi_vec;
429
430 while (remainder) {
431 to_cpy = min(remainder, mhi_buf->len);
432 memcpy(mhi_buf->buf, buf, to_cpy);
433 bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr);
434 bhi_vec->size = cpu_to_le64(to_cpy);
435
436 buf += to_cpy;
437 remainder -= to_cpy;
438 bhi_vec++;
439 mhi_buf++;
440 }
441 }
442
mhi_fw_load_type_get(const struct mhi_controller * mhi_cntrl)443 static enum mhi_fw_load_type mhi_fw_load_type_get(const struct mhi_controller *mhi_cntrl)
444 {
445 if (mhi_cntrl->fbc_download) {
446 return MHI_FW_LOAD_FBC;
447 } else {
448 if (mhi_cntrl->seg_len)
449 return MHI_FW_LOAD_BHIE;
450 else
451 return MHI_FW_LOAD_BHI;
452 }
453 }
454
mhi_load_image_bhi(struct mhi_controller * mhi_cntrl,const u8 * fw_data,size_t size)455 static int mhi_load_image_bhi(struct mhi_controller *mhi_cntrl, const u8 *fw_data, size_t size)
456 {
457 struct image_info *image;
458 int ret;
459
460 ret = mhi_alloc_bhi_buffer(mhi_cntrl, &image, size);
461 if (ret)
462 return ret;
463
464 /* Load the firmware into BHI vec table */
465 memcpy(image->mhi_buf->buf, fw_data, size);
466
467 ret = mhi_fw_load_bhi(mhi_cntrl, &image->mhi_buf[image->entries - 1]);
468 mhi_free_bhi_buffer(mhi_cntrl, image);
469
470 return ret;
471 }
472
mhi_load_image_bhie(struct mhi_controller * mhi_cntrl,const u8 * fw_data,size_t size)473 static int mhi_load_image_bhie(struct mhi_controller *mhi_cntrl, const u8 *fw_data, size_t size)
474 {
475 struct image_info *image;
476 int ret;
477
478 ret = mhi_alloc_bhie_table(mhi_cntrl, &image, size);
479 if (ret)
480 return ret;
481
482 mhi_firmware_copy_bhie(mhi_cntrl, fw_data, size, image);
483
484 ret = mhi_fw_load_bhie(mhi_cntrl, &image->mhi_buf[image->entries - 1]);
485 mhi_free_bhie_table(mhi_cntrl, image);
486
487 return ret;
488 }
489
mhi_fw_load_handler(struct mhi_controller * mhi_cntrl)490 void mhi_fw_load_handler(struct mhi_controller *mhi_cntrl)
491 {
492 const struct firmware *firmware = NULL;
493 struct device *dev = &mhi_cntrl->mhi_dev->dev;
494 enum mhi_fw_load_type fw_load_type;
495 enum mhi_pm_state new_state;
496 const char *fw_name;
497 const u8 *fw_data;
498 size_t size, fw_sz;
499 int ret;
500
501 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state)) {
502 dev_err(dev, "Device MHI is not in valid state\n");
503 return;
504 }
505
506 /* save hardware info from BHI */
507 ret = mhi_read_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_SERIALNU,
508 &mhi_cntrl->serial_number);
509 if (ret)
510 dev_err(dev, "Could not capture serial number via BHI\n");
511
512 /* wait for ready on pass through or any other execution environment */
513 if (!MHI_FW_LOAD_CAPABLE(mhi_cntrl->ee))
514 goto fw_load_ready_state;
515
516 fw_name = (mhi_cntrl->ee == MHI_EE_EDL) ?
517 mhi_cntrl->edl_image : mhi_cntrl->fw_image;
518
519 /* check if the driver has already provided the firmware data */
520 if (!fw_name && mhi_cntrl->fbc_download &&
521 mhi_cntrl->fw_data && mhi_cntrl->fw_sz) {
522 if (!mhi_cntrl->sbl_size) {
523 dev_err(dev, "fw_data provided but no sbl_size\n");
524 goto error_fw_load;
525 }
526
527 size = mhi_cntrl->sbl_size;
528 fw_data = mhi_cntrl->fw_data;
529 fw_sz = mhi_cntrl->fw_sz;
530 goto skip_req_fw;
531 }
532
533 if (!fw_name || (mhi_cntrl->fbc_download && (!mhi_cntrl->sbl_size ||
534 !mhi_cntrl->seg_len))) {
535 dev_err(dev,
536 "No firmware image defined or !sbl_size || !seg_len\n");
537 goto error_fw_load;
538 }
539
540 ret = request_firmware(&firmware, fw_name, dev);
541 if (ret) {
542 dev_err(dev, "Error loading firmware: %d\n", ret);
543 goto error_fw_load;
544 }
545
546 size = (mhi_cntrl->fbc_download) ? mhi_cntrl->sbl_size : firmware->size;
547
548 /* SBL size provided is maximum size, not necessarily the image size */
549 if (size > firmware->size)
550 size = firmware->size;
551
552 fw_data = firmware->data;
553 fw_sz = firmware->size;
554
555 skip_req_fw:
556 fw_load_type = mhi_fw_load_type_get(mhi_cntrl);
557 if (fw_load_type == MHI_FW_LOAD_BHIE)
558 ret = mhi_load_image_bhie(mhi_cntrl, fw_data, size);
559 else
560 ret = mhi_load_image_bhi(mhi_cntrl, fw_data, size);
561
562 /* Error or in EDL mode, we're done */
563 if (ret) {
564 dev_err(dev, "MHI did not load image over BHI%s, ret: %d\n",
565 fw_load_type == MHI_FW_LOAD_BHIE ? "e" : "",
566 ret);
567 release_firmware(firmware);
568 goto error_fw_load;
569 }
570
571 /* Wait for ready since EDL image was loaded */
572 if (fw_name && fw_name == mhi_cntrl->edl_image) {
573 release_firmware(firmware);
574 goto fw_load_ready_state;
575 }
576
577 write_lock_irq(&mhi_cntrl->pm_lock);
578 mhi_cntrl->dev_state = MHI_STATE_RESET;
579 write_unlock_irq(&mhi_cntrl->pm_lock);
580
581 /*
582 * If we're doing fbc, populate vector tables while
583 * device transitioning into MHI READY state
584 */
585 if (fw_load_type == MHI_FW_LOAD_FBC) {
586 /*
587 * Some FW combine two separate ELF images (SBL + WLAN FW) in a single
588 * file. Hence, check for the existence of the second ELF header after
589 * SBL. If present, load the second image separately.
590 */
591 if (!memcmp(fw_data + mhi_cntrl->sbl_size, ELFMAG, SELFMAG)) {
592 fw_data += mhi_cntrl->sbl_size;
593 fw_sz -= mhi_cntrl->sbl_size;
594 }
595
596 ret = mhi_alloc_bhie_table(mhi_cntrl, &mhi_cntrl->fbc_image, fw_sz);
597 if (ret) {
598 release_firmware(firmware);
599 goto error_fw_load;
600 }
601
602 /* Load the firmware into BHIE vec table */
603 mhi_firmware_copy_bhie(mhi_cntrl, fw_data, fw_sz, mhi_cntrl->fbc_image);
604 }
605
606 release_firmware(firmware);
607
608 fw_load_ready_state:
609 /* Transitioning into MHI RESET->READY state */
610 ret = mhi_ready_state_transition(mhi_cntrl);
611 if (ret) {
612 dev_err(dev, "MHI did not enter READY state\n");
613 goto error_ready_state;
614 }
615
616 dev_info(dev, "Wait for device to enter SBL or Mission mode\n");
617 return;
618
619 error_ready_state:
620 if (mhi_cntrl->fbc_image) {
621 mhi_free_bhie_table(mhi_cntrl, mhi_cntrl->fbc_image);
622 mhi_cntrl->fbc_image = NULL;
623 }
624
625 error_fw_load:
626 write_lock_irq(&mhi_cntrl->pm_lock);
627 new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR);
628 write_unlock_irq(&mhi_cntrl->pm_lock);
629 if (new_state == MHI_PM_FW_DL_ERR)
630 wake_up_all(&mhi_cntrl->state_event);
631 }
632
mhi_download_amss_image(struct mhi_controller * mhi_cntrl)633 int mhi_download_amss_image(struct mhi_controller *mhi_cntrl)
634 {
635 struct image_info *image_info = mhi_cntrl->fbc_image;
636 struct device *dev = &mhi_cntrl->mhi_dev->dev;
637 enum mhi_pm_state new_state;
638 int ret;
639
640 if (!image_info)
641 return -EIO;
642
643 ret = mhi_fw_load_bhie(mhi_cntrl,
644 /* Vector table is the last entry */
645 &image_info->mhi_buf[image_info->entries - 1]);
646 if (ret) {
647 dev_err(dev, "MHI did not load AMSS, ret:%d\n", ret);
648 write_lock_irq(&mhi_cntrl->pm_lock);
649 new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR);
650 write_unlock_irq(&mhi_cntrl->pm_lock);
651 if (new_state == MHI_PM_FW_DL_ERR)
652 wake_up_all(&mhi_cntrl->state_event);
653 }
654
655 return ret;
656 }
657