1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Marvell NFC driver: Firmware downloader
4 *
5 * Copyright (C) 2015, Marvell International Ltd.
6 */
7
8 #include <linux/module.h>
9 #include <linux/unaligned.h>
10 #include <linux/firmware.h>
11 #include <linux/nfc.h>
12 #include <net/nfc/nci.h>
13 #include <net/nfc/nci_core.h>
14 #include "nfcmrvl.h"
15
16 #define FW_DNLD_TIMEOUT 15000
17
18 #define NCI_OP_PROPRIETARY_BOOT_CMD nci_opcode_pack(NCI_GID_PROPRIETARY, \
19 NCI_OP_PROP_BOOT_CMD)
20
21 /* FW download states */
22
23 enum {
24 STATE_RESET = 0,
25 STATE_INIT,
26 STATE_SET_REF_CLOCK,
27 STATE_SET_HI_CONFIG,
28 STATE_OPEN_LC,
29 STATE_FW_DNLD,
30 STATE_CLOSE_LC,
31 STATE_BOOT
32 };
33
34 enum {
35 SUBSTATE_WAIT_COMMAND = 0,
36 SUBSTATE_WAIT_ACK_CREDIT,
37 SUBSTATE_WAIT_NACK_CREDIT,
38 SUBSTATE_WAIT_DATA_CREDIT,
39 };
40
41 /*
42 * Patterns for responses
43 */
44
45 static const uint8_t nci_pattern_core_reset_ntf[] = {
46 0x60, 0x00, 0x02, 0xA0, 0x01
47 };
48
49 static const uint8_t nci_pattern_core_init_rsp[] = {
50 0x40, 0x01, 0x11
51 };
52
53 static const uint8_t nci_pattern_core_set_config_rsp[] = {
54 0x40, 0x02, 0x02, 0x00, 0x00
55 };
56
57 static const uint8_t nci_pattern_core_conn_create_rsp[] = {
58 0x40, 0x04, 0x04, 0x00
59 };
60
61 static const uint8_t nci_pattern_core_conn_close_rsp[] = {
62 0x40, 0x05, 0x01, 0x00
63 };
64
65 static const uint8_t nci_pattern_core_conn_credits_ntf[] = {
66 0x60, 0x06, 0x03, 0x01, NCI_CORE_LC_CONNID_PROP_FW_DL, 0x01
67 };
68
69 static const uint8_t nci_pattern_proprietary_boot_rsp[] = {
70 0x4F, 0x3A, 0x01, 0x00
71 };
72
alloc_lc_skb(struct nfcmrvl_private * priv,uint8_t plen)73 static struct sk_buff *alloc_lc_skb(struct nfcmrvl_private *priv, uint8_t plen)
74 {
75 struct sk_buff *skb;
76 struct nci_data_hdr *hdr;
77
78 skb = nci_skb_alloc(priv->ndev, (NCI_DATA_HDR_SIZE + plen), GFP_KERNEL);
79 if (!skb)
80 return NULL;
81
82 hdr = skb_put(skb, NCI_DATA_HDR_SIZE);
83 hdr->conn_id = NCI_CORE_LC_CONNID_PROP_FW_DL;
84 hdr->rfu = 0;
85 hdr->plen = plen;
86
87 nci_mt_set((__u8 *)hdr, NCI_MT_DATA_PKT);
88 nci_pbf_set((__u8 *)hdr, NCI_PBF_LAST);
89
90 return skb;
91 }
92
fw_dnld_over(struct nfcmrvl_private * priv,u32 error)93 static void fw_dnld_over(struct nfcmrvl_private *priv, u32 error)
94 {
95 if (priv->fw_dnld.fw) {
96 release_firmware(priv->fw_dnld.fw);
97 priv->fw_dnld.fw = NULL;
98 priv->fw_dnld.header = NULL;
99 priv->fw_dnld.binary_config = NULL;
100 }
101
102 atomic_set(&priv->ndev->cmd_cnt, 0);
103
104 if (timer_pending(&priv->ndev->cmd_timer))
105 timer_delete_sync(&priv->ndev->cmd_timer);
106
107 if (timer_pending(&priv->fw_dnld.timer))
108 timer_delete_sync(&priv->fw_dnld.timer);
109
110 nfc_info(priv->dev, "FW loading over (%d)]\n", error);
111
112 if (error != 0) {
113 /* failed, halt the chip to avoid power consumption */
114 nfcmrvl_chip_halt(priv);
115 }
116
117 nfc_fw_download_done(priv->ndev->nfc_dev, priv->fw_dnld.name, error);
118 }
119
fw_dnld_timeout(struct timer_list * t)120 static void fw_dnld_timeout(struct timer_list *t)
121 {
122 struct nfcmrvl_private *priv = timer_container_of(priv, t,
123 fw_dnld.timer);
124
125 nfc_err(priv->dev, "FW loading timeout");
126 priv->fw_dnld.state = STATE_RESET;
127 fw_dnld_over(priv, -ETIMEDOUT);
128 }
129
process_state_reset(struct nfcmrvl_private * priv,const struct sk_buff * skb)130 static int process_state_reset(struct nfcmrvl_private *priv,
131 const struct sk_buff *skb)
132 {
133 if (sizeof(nci_pattern_core_reset_ntf) != skb->len ||
134 memcmp(skb->data, nci_pattern_core_reset_ntf,
135 sizeof(nci_pattern_core_reset_ntf)))
136 return -EINVAL;
137
138 nfc_info(priv->dev, "BootROM reset, start fw download\n");
139
140 /* Start FW download state machine */
141 priv->fw_dnld.state = STATE_INIT;
142 nci_send_cmd(priv->ndev, NCI_OP_CORE_INIT_CMD, 0, NULL);
143
144 return 0;
145 }
146
process_state_init(struct nfcmrvl_private * priv,const struct sk_buff * skb)147 static int process_state_init(struct nfcmrvl_private *priv,
148 const struct sk_buff *skb)
149 {
150 struct nci_core_set_config_cmd cmd;
151
152 if (sizeof(nci_pattern_core_init_rsp) >= skb->len ||
153 memcmp(skb->data, nci_pattern_core_init_rsp,
154 sizeof(nci_pattern_core_init_rsp)))
155 return -EINVAL;
156
157 cmd.num_params = 1;
158 cmd.param.id = NFCMRVL_PROP_REF_CLOCK;
159 cmd.param.len = 4;
160 memcpy(cmd.param.val, &priv->fw_dnld.header->ref_clock, 4);
161
162 nci_send_cmd(priv->ndev, NCI_OP_CORE_SET_CONFIG_CMD, 3 + cmd.param.len,
163 &cmd);
164
165 priv->fw_dnld.state = STATE_SET_REF_CLOCK;
166 return 0;
167 }
168
create_lc(struct nfcmrvl_private * priv)169 static void create_lc(struct nfcmrvl_private *priv)
170 {
171 uint8_t param[2] = { NCI_CORE_LC_PROP_FW_DL, 0x0 };
172
173 priv->fw_dnld.state = STATE_OPEN_LC;
174 nci_send_cmd(priv->ndev, NCI_OP_CORE_CONN_CREATE_CMD, 2, param);
175 }
176
process_state_set_ref_clock(struct nfcmrvl_private * priv,const struct sk_buff * skb)177 static int process_state_set_ref_clock(struct nfcmrvl_private *priv,
178 const struct sk_buff *skb)
179 {
180 struct nci_core_set_config_cmd cmd;
181
182 if (sizeof(nci_pattern_core_set_config_rsp) != skb->len ||
183 memcmp(skb->data, nci_pattern_core_set_config_rsp, skb->len))
184 return -EINVAL;
185
186 cmd.num_params = 1;
187 cmd.param.id = NFCMRVL_PROP_SET_HI_CONFIG;
188
189 switch (priv->phy) {
190 case NFCMRVL_PHY_UART:
191 cmd.param.len = 5;
192 memcpy(cmd.param.val,
193 &priv->fw_dnld.binary_config->uart.baudrate,
194 4);
195 cmd.param.val[4] =
196 priv->fw_dnld.binary_config->uart.flow_control;
197 break;
198 case NFCMRVL_PHY_I2C:
199 cmd.param.len = 5;
200 memcpy(cmd.param.val,
201 &priv->fw_dnld.binary_config->i2c.clk,
202 4);
203 cmd.param.val[4] = 0;
204 break;
205 case NFCMRVL_PHY_SPI:
206 cmd.param.len = 5;
207 memcpy(cmd.param.val,
208 &priv->fw_dnld.binary_config->spi.clk,
209 4);
210 cmd.param.val[4] = 0;
211 break;
212 default:
213 create_lc(priv);
214 return 0;
215 }
216
217 priv->fw_dnld.state = STATE_SET_HI_CONFIG;
218 nci_send_cmd(priv->ndev, NCI_OP_CORE_SET_CONFIG_CMD, 3 + cmd.param.len,
219 &cmd);
220 return 0;
221 }
222
process_state_set_hi_config(struct nfcmrvl_private * priv,const struct sk_buff * skb)223 static int process_state_set_hi_config(struct nfcmrvl_private *priv,
224 const struct sk_buff *skb)
225 {
226 if (sizeof(nci_pattern_core_set_config_rsp) != skb->len ||
227 memcmp(skb->data, nci_pattern_core_set_config_rsp, skb->len))
228 return -EINVAL;
229
230 create_lc(priv);
231 return 0;
232 }
233
process_state_open_lc(struct nfcmrvl_private * priv,const struct sk_buff * skb)234 static int process_state_open_lc(struct nfcmrvl_private *priv,
235 const struct sk_buff *skb)
236 {
237 if (sizeof(nci_pattern_core_conn_create_rsp) >= skb->len ||
238 memcmp(skb->data, nci_pattern_core_conn_create_rsp,
239 sizeof(nci_pattern_core_conn_create_rsp)))
240 return -EINVAL;
241
242 priv->fw_dnld.state = STATE_FW_DNLD;
243 priv->fw_dnld.substate = SUBSTATE_WAIT_COMMAND;
244 priv->fw_dnld.offset = priv->fw_dnld.binary_config->offset;
245 return 0;
246 }
247
process_state_fw_dnld(struct nfcmrvl_private * priv,struct sk_buff * skb)248 static int process_state_fw_dnld(struct nfcmrvl_private *priv,
249 struct sk_buff *skb)
250 {
251 uint16_t len;
252 uint16_t comp_len;
253 struct sk_buff *out_skb;
254
255 switch (priv->fw_dnld.substate) {
256 case SUBSTATE_WAIT_COMMAND:
257 /*
258 * Command format:
259 * B0..2: NCI header
260 * B3 : Helper command (0xA5)
261 * B4..5: le16 data size
262 * B6..7: le16 data size complement (~)
263 * B8..N: payload
264 */
265
266 /* Remove NCI HDR */
267 skb_pull(skb, 3);
268 if (skb->data[0] != HELPER_CMD_PACKET_FORMAT || skb->len != 5) {
269 nfc_err(priv->dev, "bad command");
270 return -EINVAL;
271 }
272 skb_pull(skb, 1);
273 len = get_unaligned_le16(skb->data);
274 skb_pull(skb, 2);
275 comp_len = get_unaligned_le16(skb->data);
276 memcpy(&comp_len, skb->data, 2);
277 skb_pull(skb, 2);
278 if (((~len) & 0xFFFF) != comp_len) {
279 nfc_err(priv->dev, "bad len complement: %x %x %x",
280 len, comp_len, (~len & 0xFFFF));
281 out_skb = alloc_lc_skb(priv, 1);
282 if (!out_skb)
283 return -ENOMEM;
284 skb_put_u8(out_skb, 0xBF);
285 nci_send_frame(priv->ndev, out_skb);
286 priv->fw_dnld.substate = SUBSTATE_WAIT_NACK_CREDIT;
287 return 0;
288 }
289 priv->fw_dnld.chunk_len = len;
290 out_skb = alloc_lc_skb(priv, 1);
291 if (!out_skb)
292 return -ENOMEM;
293 skb_put_u8(out_skb, HELPER_ACK_PACKET_FORMAT);
294 nci_send_frame(priv->ndev, out_skb);
295 priv->fw_dnld.substate = SUBSTATE_WAIT_ACK_CREDIT;
296 break;
297
298 case SUBSTATE_WAIT_ACK_CREDIT:
299 if (sizeof(nci_pattern_core_conn_credits_ntf) != skb->len ||
300 memcmp(nci_pattern_core_conn_credits_ntf, skb->data,
301 skb->len)) {
302 nfc_err(priv->dev, "bad packet: waiting for credit");
303 return -EINVAL;
304 }
305 if (priv->fw_dnld.chunk_len == 0) {
306 /* FW Loading is done */
307 uint8_t conn_id = NCI_CORE_LC_CONNID_PROP_FW_DL;
308
309 priv->fw_dnld.state = STATE_CLOSE_LC;
310 nci_send_cmd(priv->ndev, NCI_OP_CORE_CONN_CLOSE_CMD,
311 1, &conn_id);
312 } else {
313 out_skb = alloc_lc_skb(priv, priv->fw_dnld.chunk_len);
314 if (!out_skb)
315 return -ENOMEM;
316 skb_put_data(out_skb,
317 ((uint8_t *)priv->fw_dnld.fw->data) + priv->fw_dnld.offset,
318 priv->fw_dnld.chunk_len);
319 nci_send_frame(priv->ndev, out_skb);
320 priv->fw_dnld.substate = SUBSTATE_WAIT_DATA_CREDIT;
321 }
322 break;
323
324 case SUBSTATE_WAIT_DATA_CREDIT:
325 if (sizeof(nci_pattern_core_conn_credits_ntf) != skb->len ||
326 memcmp(nci_pattern_core_conn_credits_ntf, skb->data,
327 skb->len)) {
328 nfc_err(priv->dev, "bad packet: waiting for credit");
329 return -EINVAL;
330 }
331 priv->fw_dnld.offset += priv->fw_dnld.chunk_len;
332 priv->fw_dnld.chunk_len = 0;
333 priv->fw_dnld.substate = SUBSTATE_WAIT_COMMAND;
334 break;
335
336 case SUBSTATE_WAIT_NACK_CREDIT:
337 if (sizeof(nci_pattern_core_conn_credits_ntf) != skb->len ||
338 memcmp(nci_pattern_core_conn_credits_ntf, skb->data,
339 skb->len)) {
340 nfc_err(priv->dev, "bad packet: waiting for credit");
341 return -EINVAL;
342 }
343 priv->fw_dnld.substate = SUBSTATE_WAIT_COMMAND;
344 break;
345 }
346 return 0;
347 }
348
process_state_close_lc(struct nfcmrvl_private * priv,const struct sk_buff * skb)349 static int process_state_close_lc(struct nfcmrvl_private *priv,
350 const struct sk_buff *skb)
351 {
352 if (sizeof(nci_pattern_core_conn_close_rsp) != skb->len ||
353 memcmp(skb->data, nci_pattern_core_conn_close_rsp, skb->len))
354 return -EINVAL;
355
356 priv->fw_dnld.state = STATE_BOOT;
357 nci_send_cmd(priv->ndev, NCI_OP_PROPRIETARY_BOOT_CMD, 0, NULL);
358 return 0;
359 }
360
process_state_boot(struct nfcmrvl_private * priv,const struct sk_buff * skb)361 static int process_state_boot(struct nfcmrvl_private *priv,
362 const struct sk_buff *skb)
363 {
364 if (sizeof(nci_pattern_proprietary_boot_rsp) != skb->len ||
365 memcmp(skb->data, nci_pattern_proprietary_boot_rsp, skb->len))
366 return -EINVAL;
367
368 /*
369 * Update HI config to use the right configuration for the next
370 * data exchanges.
371 */
372 priv->if_ops->nci_update_config(priv,
373 &priv->fw_dnld.binary_config->config);
374
375 if (priv->fw_dnld.binary_config == &priv->fw_dnld.header->helper) {
376 /*
377 * This is the case where an helper was needed and we have
378 * uploaded it. Now we have to wait the next RESET NTF to start
379 * FW download.
380 */
381 priv->fw_dnld.state = STATE_RESET;
382 priv->fw_dnld.binary_config = &priv->fw_dnld.header->firmware;
383 nfc_info(priv->dev, "FW loading: helper loaded");
384 } else {
385 nfc_info(priv->dev, "FW loading: firmware loaded");
386 fw_dnld_over(priv, 0);
387 }
388 return 0;
389 }
390
fw_dnld_rx_work(struct work_struct * work)391 static void fw_dnld_rx_work(struct work_struct *work)
392 {
393 int ret;
394 struct sk_buff *skb;
395 struct nfcmrvl_fw_dnld *fw_dnld = container_of(work,
396 struct nfcmrvl_fw_dnld,
397 rx_work);
398 struct nfcmrvl_private *priv = container_of(fw_dnld,
399 struct nfcmrvl_private,
400 fw_dnld);
401
402 while ((skb = skb_dequeue(&fw_dnld->rx_q))) {
403 nfc_send_to_raw_sock(priv->ndev->nfc_dev, skb,
404 RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
405 switch (fw_dnld->state) {
406 case STATE_RESET:
407 ret = process_state_reset(priv, skb);
408 break;
409 case STATE_INIT:
410 ret = process_state_init(priv, skb);
411 break;
412 case STATE_SET_REF_CLOCK:
413 ret = process_state_set_ref_clock(priv, skb);
414 break;
415 case STATE_SET_HI_CONFIG:
416 ret = process_state_set_hi_config(priv, skb);
417 break;
418 case STATE_OPEN_LC:
419 ret = process_state_open_lc(priv, skb);
420 break;
421 case STATE_FW_DNLD:
422 ret = process_state_fw_dnld(priv, skb);
423 break;
424 case STATE_CLOSE_LC:
425 ret = process_state_close_lc(priv, skb);
426 break;
427 case STATE_BOOT:
428 ret = process_state_boot(priv, skb);
429 break;
430 default:
431 ret = -EFAULT;
432 }
433
434 kfree_skb(skb);
435
436 if (ret != 0) {
437 nfc_err(priv->dev, "FW loading error");
438 fw_dnld_over(priv, ret);
439 break;
440 }
441 }
442 }
443
nfcmrvl_fw_dnld_init(struct nfcmrvl_private * priv)444 int nfcmrvl_fw_dnld_init(struct nfcmrvl_private *priv)
445 {
446 char name[32];
447
448 INIT_WORK(&priv->fw_dnld.rx_work, fw_dnld_rx_work);
449 snprintf(name, sizeof(name), "%s_nfcmrvl_fw_dnld_rx_wq",
450 dev_name(&priv->ndev->nfc_dev->dev));
451 priv->fw_dnld.rx_wq = create_singlethread_workqueue(name);
452 if (!priv->fw_dnld.rx_wq)
453 return -ENOMEM;
454 skb_queue_head_init(&priv->fw_dnld.rx_q);
455 return 0;
456 }
457
nfcmrvl_fw_dnld_deinit(struct nfcmrvl_private * priv)458 void nfcmrvl_fw_dnld_deinit(struct nfcmrvl_private *priv)
459 {
460 destroy_workqueue(priv->fw_dnld.rx_wq);
461 }
462
nfcmrvl_fw_dnld_recv_frame(struct nfcmrvl_private * priv,struct sk_buff * skb)463 void nfcmrvl_fw_dnld_recv_frame(struct nfcmrvl_private *priv,
464 struct sk_buff *skb)
465 {
466 /* Discard command timer */
467 if (timer_pending(&priv->ndev->cmd_timer))
468 timer_delete_sync(&priv->ndev->cmd_timer);
469
470 /* Allow next command */
471 atomic_set(&priv->ndev->cmd_cnt, 1);
472
473 /* Queue and trigger rx work */
474 skb_queue_tail(&priv->fw_dnld.rx_q, skb);
475 queue_work(priv->fw_dnld.rx_wq, &priv->fw_dnld.rx_work);
476 }
477
nfcmrvl_fw_dnld_abort(struct nfcmrvl_private * priv)478 void nfcmrvl_fw_dnld_abort(struct nfcmrvl_private *priv)
479 {
480 fw_dnld_over(priv, -EHOSTDOWN);
481 }
482
nfcmrvl_fw_dnld_start(struct nci_dev * ndev,const char * firmware_name)483 int nfcmrvl_fw_dnld_start(struct nci_dev *ndev, const char *firmware_name)
484 {
485 struct nfcmrvl_private *priv = nci_get_drvdata(ndev);
486 struct nfcmrvl_fw_dnld *fw_dnld = &priv->fw_dnld;
487 int res;
488
489 if (!priv->support_fw_dnld)
490 return -ENOTSUPP;
491
492 if (!firmware_name || !firmware_name[0])
493 return -EINVAL;
494
495 strcpy(fw_dnld->name, firmware_name);
496
497 /*
498 * Retrieve FW binary file and parse it to initialize FW download
499 * state machine.
500 */
501
502 /* Retrieve FW binary */
503 res = request_firmware(&fw_dnld->fw, firmware_name,
504 &ndev->nfc_dev->dev);
505 if (res < 0) {
506 nfc_err(priv->dev, "failed to retrieve FW %s", firmware_name);
507 return -ENOENT;
508 }
509
510 fw_dnld->header = (const struct nfcmrvl_fw *) priv->fw_dnld.fw->data;
511
512 if (fw_dnld->header->magic != NFCMRVL_FW_MAGIC ||
513 fw_dnld->header->phy != priv->phy) {
514 nfc_err(priv->dev, "bad firmware binary %s magic=0x%x phy=%d",
515 firmware_name, fw_dnld->header->magic,
516 fw_dnld->header->phy);
517 release_firmware(fw_dnld->fw);
518 fw_dnld->header = NULL;
519 return -EINVAL;
520 }
521
522 if (fw_dnld->header->helper.offset != 0) {
523 nfc_info(priv->dev, "loading helper");
524 fw_dnld->binary_config = &fw_dnld->header->helper;
525 } else {
526 nfc_info(priv->dev, "loading firmware");
527 fw_dnld->binary_config = &fw_dnld->header->firmware;
528 }
529
530 /* Configure a timer for timeout */
531 timer_setup(&priv->fw_dnld.timer, fw_dnld_timeout, 0);
532 mod_timer(&priv->fw_dnld.timer,
533 jiffies + msecs_to_jiffies(FW_DNLD_TIMEOUT));
534
535 /* Ronfigure HI to be sure that it is the bootrom values */
536 priv->if_ops->nci_update_config(priv,
537 &fw_dnld->header->bootrom.config);
538
539 /* Allow first command */
540 atomic_set(&priv->ndev->cmd_cnt, 1);
541
542 /* First, reset the chip */
543 priv->fw_dnld.state = STATE_RESET;
544 nfcmrvl_chip_reset(priv);
545
546 /* Now wait for CORE_RESET_NTF or timeout */
547
548 return 0;
549 }
550