1 // SPDX-License-Identifier: GPL-2.0-only
2
3 /* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */
4
5 #include <linux/devcoredump.h>
6 #include <linux/firmware.h>
7 #include <linux/limits.h>
8 #include <linux/mhi.h>
9 #include <linux/minmax.h>
10 #include <linux/overflow.h>
11 #include <linux/types.h>
12 #include <linux/vmalloc.h>
13 #include <linux/workqueue.h>
14
15 #include "sahara.h"
16
17 #define SAHARA_HELLO_CMD 0x1 /* Min protocol version 1.0 */
18 #define SAHARA_HELLO_RESP_CMD 0x2 /* Min protocol version 1.0 */
19 #define SAHARA_READ_DATA_CMD 0x3 /* Min protocol version 1.0 */
20 #define SAHARA_END_OF_IMAGE_CMD 0x4 /* Min protocol version 1.0 */
21 #define SAHARA_DONE_CMD 0x5 /* Min protocol version 1.0 */
22 #define SAHARA_DONE_RESP_CMD 0x6 /* Min protocol version 1.0 */
23 #define SAHARA_RESET_CMD 0x7 /* Min protocol version 1.0 */
24 #define SAHARA_RESET_RESP_CMD 0x8 /* Min protocol version 1.0 */
25 #define SAHARA_MEM_DEBUG_CMD 0x9 /* Min protocol version 2.0 */
26 #define SAHARA_MEM_READ_CMD 0xa /* Min protocol version 2.0 */
27 #define SAHARA_CMD_READY_CMD 0xb /* Min protocol version 2.1 */
28 #define SAHARA_SWITCH_MODE_CMD 0xc /* Min protocol version 2.1 */
29 #define SAHARA_EXECUTE_CMD 0xd /* Min protocol version 2.1 */
30 #define SAHARA_EXECUTE_RESP_CMD 0xe /* Min protocol version 2.1 */
31 #define SAHARA_EXECUTE_DATA_CMD 0xf /* Min protocol version 2.1 */
32 #define SAHARA_MEM_DEBUG64_CMD 0x10 /* Min protocol version 2.5 */
33 #define SAHARA_MEM_READ64_CMD 0x11 /* Min protocol version 2.5 */
34 #define SAHARA_READ_DATA64_CMD 0x12 /* Min protocol version 2.8 */
35 #define SAHARA_RESET_STATE_CMD 0x13 /* Min protocol version 2.9 */
36 #define SAHARA_WRITE_DATA_CMD 0x14 /* Min protocol version 3.0 */
37
38 #define SAHARA_PACKET_MAX_SIZE 0xffffU /* MHI_MAX_MTU */
39 #define SAHARA_TRANSFER_MAX_SIZE 0x80000
40 #define SAHARA_READ_MAX_SIZE 0xfff0U /* Avoid unaligned requests */
41 #define SAHARA_NUM_TX_BUF DIV_ROUND_UP(SAHARA_TRANSFER_MAX_SIZE,\
42 SAHARA_PACKET_MAX_SIZE)
43 #define SAHARA_IMAGE_ID_NONE U32_MAX
44
45 #define SAHARA_VERSION 2
46 #define SAHARA_SUCCESS 0
47 #define SAHARA_TABLE_ENTRY_STR_LEN 20
48
49 #define SAHARA_MODE_IMAGE_TX_PENDING 0x0
50 #define SAHARA_MODE_IMAGE_TX_COMPLETE 0x1
51 #define SAHARA_MODE_MEMORY_DEBUG 0x2
52 #define SAHARA_MODE_COMMAND 0x3
53
54 #define SAHARA_HELLO_LENGTH 0x30
55 #define SAHARA_READ_DATA_LENGTH 0x14
56 #define SAHARA_END_OF_IMAGE_LENGTH 0x10
57 #define SAHARA_DONE_LENGTH 0x8
58 #define SAHARA_RESET_LENGTH 0x8
59 #define SAHARA_MEM_DEBUG64_LENGTH 0x18
60 #define SAHARA_MEM_READ64_LENGTH 0x18
61
62 struct sahara_packet {
63 __le32 cmd;
64 __le32 length;
65
66 union {
67 struct {
68 __le32 version;
69 __le32 version_compat;
70 __le32 max_length;
71 __le32 mode;
72 } hello;
73 struct {
74 __le32 version;
75 __le32 version_compat;
76 __le32 status;
77 __le32 mode;
78 } hello_resp;
79 struct {
80 __le32 image;
81 __le32 offset;
82 __le32 length;
83 } read_data;
84 struct {
85 __le32 image;
86 __le32 status;
87 } end_of_image;
88 struct {
89 __le64 table_address;
90 __le64 table_length;
91 } memory_debug64;
92 struct {
93 __le64 memory_address;
94 __le64 memory_length;
95 } memory_read64;
96 };
97 };
98
99 struct sahara_debug_table_entry64 {
100 __le64 type;
101 __le64 address;
102 __le64 length;
103 char description[SAHARA_TABLE_ENTRY_STR_LEN];
104 char filename[SAHARA_TABLE_ENTRY_STR_LEN];
105 };
106
107 struct sahara_dump_table_entry {
108 u64 type;
109 u64 address;
110 u64 length;
111 char description[SAHARA_TABLE_ENTRY_STR_LEN];
112 char filename[SAHARA_TABLE_ENTRY_STR_LEN];
113 };
114
115 #define SAHARA_DUMP_V1_MAGIC 0x1234567890abcdef
116 #define SAHARA_DUMP_V1_VER 1
117 struct sahara_memory_dump_meta_v1 {
118 u64 magic;
119 u64 version;
120 u64 dump_size;
121 u64 table_size;
122 };
123
124 /*
125 * Layout of crashdump provided to user via devcoredump
126 * +------------------------------------------+
127 * | Crashdump Meta structure |
128 * | type: struct sahara_memory_dump_meta_v1 |
129 * +------------------------------------------+
130 * | Crashdump Table |
131 * | type: array of struct |
132 * | sahara_dump_table_entry |
133 * | |
134 * | |
135 * +------------------------------------------+
136 * | Crashdump |
137 * | |
138 * | |
139 * | |
140 * | |
141 * | |
142 * +------------------------------------------+
143 *
144 * First is the metadata header. Userspace can use the magic number to verify
145 * the content type, and then check the version for the rest of the format.
146 * New versions should keep the magic number location/value, and version
147 * location, but increment the version value.
148 *
149 * For v1, the metadata lists the size of the entire dump (header + table +
150 * dump) and the size of the table. Then the dump image table, which describes
151 * the contents of the dump. Finally all the images are listed in order, with
152 * no deadspace in between. Userspace can use the sizes listed in the image
153 * table to reconstruct the individual images.
154 */
155
156 struct sahara_context {
157 struct sahara_packet *tx[SAHARA_NUM_TX_BUF];
158 struct sahara_packet *rx;
159 struct work_struct fw_work;
160 struct work_struct dump_work;
161 struct work_struct read_data_work;
162 struct mhi_device *mhi_dev;
163 const char * const *image_table;
164 u32 table_size;
165 u32 active_image_id;
166 const struct firmware *firmware;
167 u64 dump_table_address;
168 u64 dump_table_length;
169 size_t rx_size;
170 size_t rx_size_requested;
171 void *mem_dump;
172 size_t mem_dump_sz;
173 struct sahara_dump_table_entry *dump_image;
174 u64 dump_image_offset;
175 void *mem_dump_freespace;
176 u64 dump_images_left;
177 u32 read_data_offset;
178 u32 read_data_length;
179 bool is_mem_dump_mode;
180 bool non_streaming;
181 };
182
183 static const char * const aic100_image_table[] = {
184 [1] = "qcom/aic100/fw1.bin",
185 [2] = "qcom/aic100/fw2.bin",
186 [4] = "qcom/aic100/fw4.bin",
187 [5] = "qcom/aic100/fw5.bin",
188 [6] = "qcom/aic100/fw6.bin",
189 [8] = "qcom/aic100/fw8.bin",
190 [9] = "qcom/aic100/fw9.bin",
191 [10] = "qcom/aic100/fw10.bin",
192 };
193
194 static const char * const aic200_image_table[] = {
195 [5] = "qcom/aic200/uefi.elf",
196 [12] = "qcom/aic200/aic200-nsp.bin",
197 [23] = "qcom/aic200/aop.mbn",
198 [32] = "qcom/aic200/tz.mbn",
199 [33] = "qcom/aic200/hypvm.mbn",
200 [38] = "qcom/aic200/xbl_config.elf",
201 [39] = "qcom/aic200/aic200_abl.elf",
202 [40] = "qcom/aic200/apdp.mbn",
203 [41] = "qcom/aic200/devcfg.mbn",
204 [42] = "qcom/aic200/sec.elf",
205 [43] = "qcom/aic200/aic200-hlos.elf",
206 [49] = "qcom/aic200/shrm.elf",
207 [50] = "qcom/aic200/cpucp.elf",
208 [51] = "qcom/aic200/aop_devcfg.mbn",
209 [54] = "qcom/aic200/qupv3fw.elf",
210 [57] = "qcom/aic200/cpucp_dtbs.elf",
211 [62] = "qcom/aic200/uefi_dtbs.elf",
212 [63] = "qcom/aic200/xbl_ac_config.mbn",
213 [64] = "qcom/aic200/tz_ac_config.mbn",
214 [65] = "qcom/aic200/hyp_ac_config.mbn",
215 [66] = "qcom/aic200/pdp.elf",
216 [67] = "qcom/aic200/pdp_cdb.elf",
217 [68] = "qcom/aic200/sdi.mbn",
218 [69] = "qcom/aic200/dcd.mbn",
219 [73] = "qcom/aic200/gearvm.mbn",
220 [74] = "qcom/aic200/sti.bin",
221 [76] = "qcom/aic200/tz_qti_config.mbn",
222 [78] = "qcom/aic200/pvs.bin",
223 };
224
is_streaming(struct sahara_context * context)225 static bool is_streaming(struct sahara_context *context)
226 {
227 return !context->non_streaming;
228 }
229
sahara_find_image(struct sahara_context * context,u32 image_id)230 static int sahara_find_image(struct sahara_context *context, u32 image_id)
231 {
232 int ret;
233
234 if (image_id == context->active_image_id)
235 return 0;
236
237 if (context->active_image_id != SAHARA_IMAGE_ID_NONE) {
238 dev_err(&context->mhi_dev->dev, "image id %d is not valid as %d is active\n",
239 image_id, context->active_image_id);
240 return -EINVAL;
241 }
242
243 if (image_id >= context->table_size || !context->image_table[image_id]) {
244 dev_err(&context->mhi_dev->dev, "request for unknown image: %d\n", image_id);
245 return -EINVAL;
246 }
247
248 /*
249 * This image might be optional. The device may continue without it.
250 * Only the device knows. Suppress error messages that could suggest an
251 * a problem when we were actually able to continue.
252 */
253 ret = firmware_request_nowarn(&context->firmware,
254 context->image_table[image_id],
255 &context->mhi_dev->dev);
256 if (ret) {
257 dev_dbg(&context->mhi_dev->dev, "request for image id %d / file %s failed %d\n",
258 image_id, context->image_table[image_id], ret);
259 return ret;
260 }
261
262 context->active_image_id = image_id;
263
264 return 0;
265 }
266
sahara_release_image(struct sahara_context * context)267 static void sahara_release_image(struct sahara_context *context)
268 {
269 if (context->active_image_id != SAHARA_IMAGE_ID_NONE)
270 release_firmware(context->firmware);
271 context->active_image_id = SAHARA_IMAGE_ID_NONE;
272 }
273
sahara_send_reset(struct sahara_context * context)274 static void sahara_send_reset(struct sahara_context *context)
275 {
276 int ret;
277
278 context->is_mem_dump_mode = false;
279 context->read_data_offset = 0;
280 context->read_data_length = 0;
281
282 context->tx[0]->cmd = cpu_to_le32(SAHARA_RESET_CMD);
283 context->tx[0]->length = cpu_to_le32(SAHARA_RESET_LENGTH);
284
285 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
286 SAHARA_RESET_LENGTH, MHI_EOT);
287 if (ret)
288 dev_err(&context->mhi_dev->dev, "Unable to send reset response %d\n", ret);
289 }
290
sahara_hello(struct sahara_context * context)291 static void sahara_hello(struct sahara_context *context)
292 {
293 int ret;
294
295 dev_dbg(&context->mhi_dev->dev,
296 "HELLO cmd received. length:%d version:%d version_compat:%d max_length:%d mode:%d\n",
297 le32_to_cpu(context->rx->length),
298 le32_to_cpu(context->rx->hello.version),
299 le32_to_cpu(context->rx->hello.version_compat),
300 le32_to_cpu(context->rx->hello.max_length),
301 le32_to_cpu(context->rx->hello.mode));
302
303 if (le32_to_cpu(context->rx->length) != SAHARA_HELLO_LENGTH) {
304 dev_err(&context->mhi_dev->dev, "Malformed hello packet - length %d\n",
305 le32_to_cpu(context->rx->length));
306 return;
307 }
308 if (le32_to_cpu(context->rx->hello.version) != SAHARA_VERSION) {
309 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - version %d\n",
310 le32_to_cpu(context->rx->hello.version));
311 return;
312 }
313
314 if (le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_PENDING &&
315 le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_COMPLETE &&
316 le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_MEMORY_DEBUG) {
317 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - mode %d\n",
318 le32_to_cpu(context->rx->hello.mode));
319 return;
320 }
321
322 context->tx[0]->cmd = cpu_to_le32(SAHARA_HELLO_RESP_CMD);
323 context->tx[0]->length = cpu_to_le32(SAHARA_HELLO_LENGTH);
324 context->tx[0]->hello_resp.version = cpu_to_le32(SAHARA_VERSION);
325 context->tx[0]->hello_resp.version_compat = cpu_to_le32(SAHARA_VERSION);
326 context->tx[0]->hello_resp.status = cpu_to_le32(SAHARA_SUCCESS);
327 context->tx[0]->hello_resp.mode = context->rx->hello_resp.mode;
328
329 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
330 SAHARA_HELLO_LENGTH, MHI_EOT);
331 if (ret)
332 dev_err(&context->mhi_dev->dev, "Unable to send hello response %d\n", ret);
333 }
334
read_data_helper(struct sahara_context * context,int buf_index)335 static int read_data_helper(struct sahara_context *context, int buf_index)
336 {
337 enum mhi_flags mhi_flag;
338 u32 pkt_data_len;
339 int ret;
340
341 pkt_data_len = min(context->read_data_length, SAHARA_PACKET_MAX_SIZE);
342
343 memcpy(context->tx[buf_index],
344 &context->firmware->data[context->read_data_offset],
345 pkt_data_len);
346
347 context->read_data_offset += pkt_data_len;
348 context->read_data_length -= pkt_data_len;
349
350 if (is_streaming(context) || !context->read_data_length)
351 mhi_flag = MHI_EOT;
352 else
353 mhi_flag = MHI_CHAIN;
354
355 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE,
356 context->tx[buf_index], pkt_data_len, mhi_flag);
357 if (ret) {
358 dev_err(&context->mhi_dev->dev, "Unable to send read_data response %d\n", ret);
359 return ret;
360 }
361
362 return 0;
363 }
364
sahara_read_data(struct sahara_context * context)365 static void sahara_read_data(struct sahara_context *context)
366 {
367 u32 image_id, data_offset, data_len;
368 int ret;
369 int i;
370
371 dev_dbg(&context->mhi_dev->dev,
372 "READ_DATA cmd received. length:%d image:%d offset:%d data_length:%d\n",
373 le32_to_cpu(context->rx->length),
374 le32_to_cpu(context->rx->read_data.image),
375 le32_to_cpu(context->rx->read_data.offset),
376 le32_to_cpu(context->rx->read_data.length));
377
378 if (le32_to_cpu(context->rx->length) != SAHARA_READ_DATA_LENGTH) {
379 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - length %d\n",
380 le32_to_cpu(context->rx->length));
381 return;
382 }
383
384 image_id = le32_to_cpu(context->rx->read_data.image);
385 data_offset = le32_to_cpu(context->rx->read_data.offset);
386 data_len = le32_to_cpu(context->rx->read_data.length);
387
388 ret = sahara_find_image(context, image_id);
389 if (ret) {
390 sahara_send_reset(context);
391 return;
392 }
393
394 /*
395 * Image is released when the device is done with it via
396 * SAHARA_END_OF_IMAGE_CMD. sahara_send_reset() will either cause the
397 * device to retry the operation with a modification, or decide to be
398 * done with the image and trigger SAHARA_END_OF_IMAGE_CMD.
399 * release_image() is called from SAHARA_END_OF_IMAGE_CMD. processing
400 * and is not needed here on error.
401 */
402
403 if (context->non_streaming && data_len > SAHARA_TRANSFER_MAX_SIZE) {
404 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data len %d exceeds max xfer size %d\n",
405 data_len, SAHARA_TRANSFER_MAX_SIZE);
406 sahara_send_reset(context);
407 return;
408 }
409
410 if (data_offset >= context->firmware->size) {
411 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d exceeds file size %zu\n",
412 data_offset, context->firmware->size);
413 sahara_send_reset(context);
414 return;
415 }
416
417 if (size_add(data_offset, data_len) > context->firmware->size) {
418 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d and length %d exceeds file size %zu\n",
419 data_offset, data_len, context->firmware->size);
420 sahara_send_reset(context);
421 return;
422 }
423
424 context->read_data_offset = data_offset;
425 context->read_data_length = data_len;
426
427 if (is_streaming(context)) {
428 schedule_work(&context->read_data_work);
429 return;
430 }
431
432 for (i = 0; i < SAHARA_NUM_TX_BUF && context->read_data_length; ++i) {
433 ret = read_data_helper(context, i);
434 if (ret)
435 break;
436 }
437 }
438
sahara_end_of_image(struct sahara_context * context)439 static void sahara_end_of_image(struct sahara_context *context)
440 {
441 int ret;
442
443 dev_dbg(&context->mhi_dev->dev,
444 "END_OF_IMAGE cmd received. length:%d image:%d status:%d\n",
445 le32_to_cpu(context->rx->length),
446 le32_to_cpu(context->rx->end_of_image.image),
447 le32_to_cpu(context->rx->end_of_image.status));
448
449 if (le32_to_cpu(context->rx->length) != SAHARA_END_OF_IMAGE_LENGTH) {
450 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - length %d\n",
451 le32_to_cpu(context->rx->length));
452 return;
453 }
454
455 if (context->active_image_id != SAHARA_IMAGE_ID_NONE &&
456 le32_to_cpu(context->rx->end_of_image.image) != context->active_image_id) {
457 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - image %d is not the active image\n",
458 le32_to_cpu(context->rx->end_of_image.image));
459 return;
460 }
461
462 sahara_release_image(context);
463
464 if (le32_to_cpu(context->rx->end_of_image.status))
465 return;
466
467 context->tx[0]->cmd = cpu_to_le32(SAHARA_DONE_CMD);
468 context->tx[0]->length = cpu_to_le32(SAHARA_DONE_LENGTH);
469
470 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
471 SAHARA_DONE_LENGTH, MHI_EOT);
472 if (ret)
473 dev_dbg(&context->mhi_dev->dev, "Unable to send done response %d\n", ret);
474 }
475
sahara_memory_debug64(struct sahara_context * context)476 static void sahara_memory_debug64(struct sahara_context *context)
477 {
478 int ret;
479
480 dev_dbg(&context->mhi_dev->dev,
481 "MEMORY DEBUG64 cmd received. length:%d table_address:%#llx table_length:%#llx\n",
482 le32_to_cpu(context->rx->length),
483 le64_to_cpu(context->rx->memory_debug64.table_address),
484 le64_to_cpu(context->rx->memory_debug64.table_length));
485
486 if (le32_to_cpu(context->rx->length) != SAHARA_MEM_DEBUG64_LENGTH) {
487 dev_err(&context->mhi_dev->dev, "Malformed memory debug64 packet - length %d\n",
488 le32_to_cpu(context->rx->length));
489 return;
490 }
491
492 context->dump_table_address = le64_to_cpu(context->rx->memory_debug64.table_address);
493 context->dump_table_length = le64_to_cpu(context->rx->memory_debug64.table_length);
494
495 if (context->dump_table_length % sizeof(struct sahara_debug_table_entry64) != 0 ||
496 !context->dump_table_length) {
497 dev_err(&context->mhi_dev->dev, "Malformed memory debug64 packet - table length %lld\n",
498 context->dump_table_length);
499 return;
500 }
501
502 /*
503 * From this point, the protocol flips. We make memory_read requests to
504 * the device, and the device responds with the raw data. If the device
505 * has an error, it will send an End of Image command. First we need to
506 * request the memory dump table so that we know where all the pieces
507 * of the dump are that we can consume.
508 */
509
510 context->is_mem_dump_mode = true;
511
512 /*
513 * Assume that the table is smaller than our MTU so that we can read it
514 * in one shot. The spec does not put an upper limit on the table, but
515 * no known device will exceed this.
516 */
517 if (context->dump_table_length > SAHARA_PACKET_MAX_SIZE) {
518 dev_err(&context->mhi_dev->dev, "Memory dump table length %lld exceeds supported size. Discarding dump\n",
519 context->dump_table_length);
520 sahara_send_reset(context);
521 return;
522 }
523
524 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD);
525 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH);
526 context->tx[0]->memory_read64.memory_address = cpu_to_le64(context->dump_table_address);
527 context->tx[0]->memory_read64.memory_length = cpu_to_le64(context->dump_table_length);
528
529 context->rx_size_requested = context->dump_table_length;
530
531 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
532 SAHARA_MEM_READ64_LENGTH, MHI_EOT);
533 if (ret)
534 dev_err(&context->mhi_dev->dev, "Unable to send read for dump table %d\n", ret);
535 }
536
sahara_processing(struct work_struct * work)537 static void sahara_processing(struct work_struct *work)
538 {
539 struct sahara_context *context = container_of(work, struct sahara_context, fw_work);
540 int ret;
541
542 switch (le32_to_cpu(context->rx->cmd)) {
543 case SAHARA_HELLO_CMD:
544 sahara_hello(context);
545 break;
546 case SAHARA_READ_DATA_CMD:
547 sahara_read_data(context);
548 break;
549 case SAHARA_END_OF_IMAGE_CMD:
550 sahara_end_of_image(context);
551 break;
552 case SAHARA_DONE_RESP_CMD:
553 /* Intentional do nothing as we don't need to exit an app */
554 break;
555 case SAHARA_RESET_RESP_CMD:
556 /* Intentional do nothing as we don't need to exit an app */
557 break;
558 case SAHARA_MEM_DEBUG64_CMD:
559 sahara_memory_debug64(context);
560 break;
561 default:
562 dev_err(&context->mhi_dev->dev, "Unknown command %d\n",
563 le32_to_cpu(context->rx->cmd));
564 break;
565 }
566
567 ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE, context->rx,
568 SAHARA_PACKET_MAX_SIZE, MHI_EOT);
569 if (ret)
570 dev_err(&context->mhi_dev->dev, "Unable to requeue rx buf %d\n", ret);
571 }
572
sahara_parse_dump_table(struct sahara_context * context)573 static void sahara_parse_dump_table(struct sahara_context *context)
574 {
575 struct sahara_dump_table_entry *image_out_table;
576 struct sahara_debug_table_entry64 *dev_table;
577 struct sahara_memory_dump_meta_v1 *dump_meta;
578 u64 table_nents;
579 u64 dump_length;
580 u64 mul_bytes;
581 int ret;
582 u64 i;
583
584 table_nents = context->dump_table_length / sizeof(*dev_table);
585 context->dump_images_left = table_nents;
586 dump_length = 0;
587
588 dev_table = (struct sahara_debug_table_entry64 *)(context->rx);
589 for (i = 0; i < table_nents; ++i) {
590 /* Do not trust the device, ensure the strings are terminated */
591 dev_table[i].description[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0;
592 dev_table[i].filename[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0;
593
594 if (check_add_overflow(dump_length,
595 le64_to_cpu(dev_table[i].length),
596 &dump_length)) {
597 /* Discard the dump */
598 sahara_send_reset(context);
599 return;
600 }
601
602 dev_dbg(&context->mhi_dev->dev,
603 "Memory dump table entry %lld type: %lld address: %#llx length: %#llx description: \"%s\" filename \"%s\"\n",
604 i,
605 le64_to_cpu(dev_table[i].type),
606 le64_to_cpu(dev_table[i].address),
607 le64_to_cpu(dev_table[i].length),
608 dev_table[i].description,
609 dev_table[i].filename);
610 }
611
612 if (check_add_overflow(dump_length, (u64)sizeof(*dump_meta), &dump_length)) {
613 /* Discard the dump */
614 sahara_send_reset(context);
615 return;
616 }
617 if (check_mul_overflow((u64)sizeof(*image_out_table), table_nents, &mul_bytes)) {
618 /* Discard the dump */
619 sahara_send_reset(context);
620 return;
621 }
622 if (check_add_overflow(dump_length, mul_bytes, &dump_length)) {
623 /* Discard the dump */
624 sahara_send_reset(context);
625 return;
626 }
627
628 context->mem_dump_sz = dump_length;
629 context->mem_dump = vzalloc(dump_length);
630 if (!context->mem_dump) {
631 /* Discard the dump */
632 sahara_send_reset(context);
633 return;
634 }
635
636 /* Populate the dump metadata and table for userspace */
637 dump_meta = context->mem_dump;
638 dump_meta->magic = SAHARA_DUMP_V1_MAGIC;
639 dump_meta->version = SAHARA_DUMP_V1_VER;
640 dump_meta->dump_size = dump_length;
641 dump_meta->table_size = context->dump_table_length;
642
643 image_out_table = context->mem_dump + sizeof(*dump_meta);
644 for (i = 0; i < table_nents; ++i) {
645 image_out_table[i].type = le64_to_cpu(dev_table[i].type);
646 image_out_table[i].address = le64_to_cpu(dev_table[i].address);
647 image_out_table[i].length = le64_to_cpu(dev_table[i].length);
648 strscpy(image_out_table[i].description, dev_table[i].description,
649 SAHARA_TABLE_ENTRY_STR_LEN);
650 strscpy(image_out_table[i].filename,
651 dev_table[i].filename,
652 SAHARA_TABLE_ENTRY_STR_LEN);
653 }
654
655 context->mem_dump_freespace = &image_out_table[i];
656
657 /* Done parsing the table, switch to image dump mode */
658 context->dump_table_length = 0;
659
660 /* Request the first chunk of the first image */
661 context->dump_image = &image_out_table[0];
662 dump_length = min_t(u64, context->dump_image->length, SAHARA_READ_MAX_SIZE);
663 /* Avoid requesting EOI sized data so that we can identify errors */
664 if (dump_length == SAHARA_END_OF_IMAGE_LENGTH)
665 dump_length = SAHARA_END_OF_IMAGE_LENGTH / 2;
666
667 context->dump_image_offset = dump_length;
668
669 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD);
670 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH);
671 context->tx[0]->memory_read64.memory_address = cpu_to_le64(context->dump_image->address);
672 context->tx[0]->memory_read64.memory_length = cpu_to_le64(dump_length);
673
674 context->rx_size_requested = dump_length;
675
676 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
677 SAHARA_MEM_READ64_LENGTH, MHI_EOT);
678 if (ret)
679 dev_err(&context->mhi_dev->dev, "Unable to send read for dump content %d\n", ret);
680 }
681
sahara_parse_dump_image(struct sahara_context * context)682 static void sahara_parse_dump_image(struct sahara_context *context)
683 {
684 u64 dump_length;
685 int ret;
686
687 memcpy(context->mem_dump_freespace, context->rx, context->rx_size);
688 context->mem_dump_freespace += context->rx_size;
689
690 if (context->dump_image_offset >= context->dump_image->length) {
691 /* Need to move to next image */
692 context->dump_image++;
693 context->dump_images_left--;
694 context->dump_image_offset = 0;
695
696 if (!context->dump_images_left) {
697 /* Dump done */
698 dev_coredumpv(context->mhi_dev->mhi_cntrl->cntrl_dev,
699 context->mem_dump,
700 context->mem_dump_sz,
701 GFP_KERNEL);
702 context->mem_dump = NULL;
703 sahara_send_reset(context);
704 return;
705 }
706 }
707
708 /* Get next image chunk */
709 dump_length = context->dump_image->length - context->dump_image_offset;
710 dump_length = min_t(u64, dump_length, SAHARA_READ_MAX_SIZE);
711 /* Avoid requesting EOI sized data so that we can identify errors */
712 if (dump_length == SAHARA_END_OF_IMAGE_LENGTH)
713 dump_length = SAHARA_END_OF_IMAGE_LENGTH / 2;
714
715 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD);
716 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH);
717 context->tx[0]->memory_read64.memory_address =
718 cpu_to_le64(context->dump_image->address + context->dump_image_offset);
719 context->tx[0]->memory_read64.memory_length = cpu_to_le64(dump_length);
720
721 context->dump_image_offset += dump_length;
722 context->rx_size_requested = dump_length;
723
724 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0],
725 SAHARA_MEM_READ64_LENGTH, MHI_EOT);
726 if (ret)
727 dev_err(&context->mhi_dev->dev,
728 "Unable to send read for dump content %d\n", ret);
729 }
730
sahara_dump_processing(struct work_struct * work)731 static void sahara_dump_processing(struct work_struct *work)
732 {
733 struct sahara_context *context = container_of(work, struct sahara_context, dump_work);
734 int ret;
735
736 /*
737 * We should get the expected raw data, but if the device has an error
738 * it is supposed to send EOI with an error code.
739 */
740 if (context->rx_size != context->rx_size_requested &&
741 context->rx_size != SAHARA_END_OF_IMAGE_LENGTH) {
742 dev_err(&context->mhi_dev->dev,
743 "Unexpected response to read_data. Expected size: %#zx got: %#zx\n",
744 context->rx_size_requested,
745 context->rx_size);
746 goto error;
747 }
748
749 if (context->rx_size == SAHARA_END_OF_IMAGE_LENGTH &&
750 le32_to_cpu(context->rx->cmd) == SAHARA_END_OF_IMAGE_CMD) {
751 dev_err(&context->mhi_dev->dev,
752 "Unexpected EOI response to read_data. Status: %d\n",
753 le32_to_cpu(context->rx->end_of_image.status));
754 goto error;
755 }
756
757 if (context->rx_size == SAHARA_END_OF_IMAGE_LENGTH &&
758 le32_to_cpu(context->rx->cmd) != SAHARA_END_OF_IMAGE_CMD) {
759 dev_err(&context->mhi_dev->dev,
760 "Invalid EOI response to read_data. CMD: %d\n",
761 le32_to_cpu(context->rx->cmd));
762 goto error;
763 }
764
765 /*
766 * Need to know if we received the dump table, or part of a dump image.
767 * Since we get raw data, we cannot tell from the data itself. Instead,
768 * we use the stored dump_table_length, which we zero after we read and
769 * process the entire table.
770 */
771 if (context->dump_table_length)
772 sahara_parse_dump_table(context);
773 else
774 sahara_parse_dump_image(context);
775
776 ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE, context->rx,
777 SAHARA_PACKET_MAX_SIZE, MHI_EOT);
778 if (ret)
779 dev_err(&context->mhi_dev->dev, "Unable to requeue rx buf %d\n", ret);
780
781 return;
782
783 error:
784 vfree(context->mem_dump);
785 context->mem_dump = NULL;
786 sahara_send_reset(context);
787 }
788
sahara_read_data_processing(struct work_struct * work)789 static void sahara_read_data_processing(struct work_struct *work)
790 {
791 struct sahara_context *context = container_of(work, struct sahara_context, read_data_work);
792
793 read_data_helper(context, 0);
794 }
795
sahara_mhi_probe(struct mhi_device * mhi_dev,const struct mhi_device_id * id)796 static int sahara_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_device_id *id)
797 {
798 struct sahara_context *context;
799 int ret;
800 int i;
801
802 context = devm_kzalloc(&mhi_dev->dev, sizeof(*context), GFP_KERNEL);
803 if (!context)
804 return -ENOMEM;
805
806 context->rx = devm_kzalloc(&mhi_dev->dev, SAHARA_PACKET_MAX_SIZE, GFP_KERNEL);
807 if (!context->rx)
808 return -ENOMEM;
809
810 if (!strcmp(mhi_dev->mhi_cntrl->name, "AIC200")) {
811 context->image_table = aic200_image_table;
812 context->table_size = ARRAY_SIZE(aic200_image_table);
813 } else {
814 context->image_table = aic100_image_table;
815 context->table_size = ARRAY_SIZE(aic100_image_table);
816 context->non_streaming = true;
817 }
818
819 /*
820 * There are two firmware implementations for READ_DATA handling.
821 * The older "SBL" implementation defines a Sahara transfer size, and
822 * expects that the response is a single transport transfer. If the
823 * FW wants to transfer a file that is larger than the transfer size,
824 * the FW will issue multiple READ_DATA commands. For this
825 * implementation, we need to allocate enough buffers to contain the
826 * entire Sahara transfer size.
827 *
828 * The newer "XBL" implementation does not define a maximum transfer
829 * size and instead expects the data to be streamed over using the
830 * transport level MTU. The FW will issue a single READ_DATA command
831 * of whatever size, and consume multiple transport level transfers
832 * until the expected amount of data is consumed. For this
833 * implementation we only need a single buffer of the transport MTU
834 * but we'll need to be able to use it multiple times for a single
835 * READ_DATA request.
836 *
837 * AIC100 is the SBL implementation and defines SAHARA_TRANSFER_MAX_SIZE
838 * and we need 9x SAHARA_PACKET_MAX_SIZE to cover that. We can use
839 * MHI_CHAIN to link multiple buffers into a single transfer but the
840 * remote side will not consume the buffers until it sees an EOT, thus
841 * we need to allocate enough buffers to put in the tx fifo to cover an
842 * entire READ_DATA request of the max size.
843 *
844 * AIC200 is the XBL implementation, and so a single buffer will work.
845 */
846 for (i = 0; i < SAHARA_NUM_TX_BUF; ++i) {
847 context->tx[i] = devm_kzalloc(&mhi_dev->dev,
848 SAHARA_PACKET_MAX_SIZE,
849 GFP_KERNEL);
850 if (!context->tx[i])
851 return -ENOMEM;
852 if (is_streaming(context))
853 break;
854 }
855
856 context->mhi_dev = mhi_dev;
857 INIT_WORK(&context->fw_work, sahara_processing);
858 INIT_WORK(&context->dump_work, sahara_dump_processing);
859 INIT_WORK(&context->read_data_work, sahara_read_data_processing);
860
861 context->active_image_id = SAHARA_IMAGE_ID_NONE;
862 dev_set_drvdata(&mhi_dev->dev, context);
863
864 ret = mhi_prepare_for_transfer(mhi_dev);
865 if (ret)
866 return ret;
867
868 ret = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, context->rx, SAHARA_PACKET_MAX_SIZE, MHI_EOT);
869 if (ret) {
870 mhi_unprepare_from_transfer(mhi_dev);
871 return ret;
872 }
873
874 return 0;
875 }
876
sahara_mhi_remove(struct mhi_device * mhi_dev)877 static void sahara_mhi_remove(struct mhi_device *mhi_dev)
878 {
879 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);
880
881 cancel_work_sync(&context->fw_work);
882 cancel_work_sync(&context->dump_work);
883 vfree(context->mem_dump);
884 sahara_release_image(context);
885 mhi_unprepare_from_transfer(mhi_dev);
886 }
887
sahara_mhi_ul_xfer_cb(struct mhi_device * mhi_dev,struct mhi_result * mhi_result)888 static void sahara_mhi_ul_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result)
889 {
890 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);
891
892 if (!mhi_result->transaction_status && context->read_data_length && is_streaming(context))
893 schedule_work(&context->read_data_work);
894 }
895
sahara_mhi_dl_xfer_cb(struct mhi_device * mhi_dev,struct mhi_result * mhi_result)896 static void sahara_mhi_dl_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result)
897 {
898 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);
899
900 if (!mhi_result->transaction_status) {
901 context->rx_size = mhi_result->bytes_xferd;
902 if (context->is_mem_dump_mode)
903 schedule_work(&context->dump_work);
904 else
905 schedule_work(&context->fw_work);
906 }
907
908 }
909
910 static const struct mhi_device_id sahara_mhi_match_table[] = {
911 { .chan = "QAIC_SAHARA", },
912 {},
913 };
914
915 static struct mhi_driver sahara_mhi_driver = {
916 .id_table = sahara_mhi_match_table,
917 .remove = sahara_mhi_remove,
918 .probe = sahara_mhi_probe,
919 .ul_xfer_cb = sahara_mhi_ul_xfer_cb,
920 .dl_xfer_cb = sahara_mhi_dl_xfer_cb,
921 .driver = {
922 .name = "sahara",
923 },
924 };
925
sahara_register(void)926 int sahara_register(void)
927 {
928 return mhi_driver_register(&sahara_mhi_driver);
929 }
930
sahara_unregister(void)931 void sahara_unregister(void)
932 {
933 mhi_driver_unregister(&sahara_mhi_driver);
934 }
935