1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2019-2020 Linaro Limited */
3
4 #include <linux/acpi.h>
5 #include <linux/firmware.h>
6 #include <linux/module.h>
7 #include <linux/pci.h>
8 #include <linux/slab.h>
9 #include <linux/unaligned.h>
10
11 #include "xhci.h"
12 #include "xhci-trace.h"
13 #include "xhci-pci.h"
14
15 #define RENESAS_FW_VERSION 0x6C
16 #define RENESAS_ROM_CONFIG 0xF0
17 #define RENESAS_FW_STATUS 0xF4
18 #define RENESAS_FW_STATUS_MSB 0xF5
19 #define RENESAS_ROM_STATUS 0xF6
20 #define RENESAS_ROM_STATUS_MSB 0xF7
21 #define RENESAS_DATA0 0xF8
22 #define RENESAS_DATA1 0xFC
23
24 #define RENESAS_FW_VERSION_FIELD GENMASK(23, 7)
25 #define RENESAS_FW_VERSION_OFFSET 8
26
27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE BIT(0)
28 #define RENESAS_FW_STATUS_LOCK BIT(1)
29 #define RENESAS_FW_STATUS_RESULT GENMASK(6, 4)
30 #define RENESAS_FW_STATUS_INVALID 0
31 #define RENESAS_FW_STATUS_SUCCESS BIT(4)
32 #define RENESAS_FW_STATUS_ERROR BIT(5)
33 #define RENESAS_FW_STATUS_SET_DATA0 BIT(8)
34 #define RENESAS_FW_STATUS_SET_DATA1 BIT(9)
35
36 #define RENESAS_ROM_STATUS_ACCESS BIT(0)
37 #define RENESAS_ROM_STATUS_ERASE BIT(1)
38 #define RENESAS_ROM_STATUS_RELOAD BIT(2)
39 #define RENESAS_ROM_STATUS_RESULT GENMASK(6, 4)
40 #define RENESAS_ROM_STATUS_NO_RESULT 0
41 #define RENESAS_ROM_STATUS_SUCCESS BIT(4)
42 #define RENESAS_ROM_STATUS_ERROR BIT(5)
43 #define RENESAS_ROM_STATUS_SET_DATA0 BIT(8)
44 #define RENESAS_ROM_STATUS_SET_DATA1 BIT(9)
45 #define RENESAS_ROM_STATUS_ROM_EXISTS BIT(15)
46
47 #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F
48 #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D
49
50 #define RENESAS_RETRY 50000 /* 50000 * RENESAS_DELAY ~= 500ms */
51 #define RENESAS_CHIP_ERASE_RETRY 500000 /* 500000 * RENESAS_DELAY ~= 5s */
52 #define RENESAS_DELAY 10
53
54 #define RENESAS_FW_NAME "renesas_usb_fw.mem"
55
renesas_fw_download_image(struct pci_dev * dev,const u32 * fw,size_t step,bool rom)56 static int renesas_fw_download_image(struct pci_dev *dev,
57 const u32 *fw, size_t step, bool rom)
58 {
59 size_t i;
60 int err;
61 u8 fw_status;
62 bool data0_or_data1;
63 u32 status_reg;
64
65 if (rom)
66 status_reg = RENESAS_ROM_STATUS_MSB;
67 else
68 status_reg = RENESAS_FW_STATUS_MSB;
69
70 /*
71 * The hardware does alternate between two 32-bit pages.
72 * (This is because each row of the firmware is 8 bytes).
73 *
74 * for even steps we use DATA0, for odd steps DATA1.
75 */
76 data0_or_data1 = (step & 1) == 1;
77
78 /* step+1. Read "Set DATAX" and confirm it is cleared. */
79 for (i = 0; i < RENESAS_RETRY; i++) {
80 err = pci_read_config_byte(dev, status_reg, &fw_status);
81 if (err) {
82 dev_err(&dev->dev, "Read Status failed: %d\n",
83 pcibios_err_to_errno(err));
84 return pcibios_err_to_errno(err);
85 }
86 if (!(fw_status & BIT(data0_or_data1)))
87 break;
88
89 udelay(RENESAS_DELAY);
90 }
91 if (i == RENESAS_RETRY) {
92 dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step);
93 return -ETIMEDOUT;
94 }
95
96 /*
97 * step+2. Write FW data to "DATAX".
98 * "LSB is left" => force little endian
99 */
100 err = pci_write_config_dword(dev, data0_or_data1 ?
101 RENESAS_DATA1 : RENESAS_DATA0,
102 (__force u32)cpu_to_le32(fw[step]));
103 if (err) {
104 dev_err(&dev->dev, "Write to DATAX failed: %d\n",
105 pcibios_err_to_errno(err));
106 return pcibios_err_to_errno(err);
107 }
108
109 udelay(100);
110
111 /* step+3. Set "Set DATAX". */
112 err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1));
113 if (err) {
114 dev_err(&dev->dev, "Write config for DATAX failed: %d\n",
115 pcibios_err_to_errno(err));
116 return pcibios_err_to_errno(err);
117 }
118
119 return 0;
120 }
121
renesas_fw_verify(const void * fw_data,size_t length)122 static int renesas_fw_verify(const void *fw_data,
123 size_t length)
124 {
125 u16 fw_version_pointer;
126
127 /*
128 * The Firmware's Data Format is describe in
129 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124
130 */
131
132 /*
133 * The bootrom chips of the big brother have sizes up to 64k, let's
134 * assume that's the biggest the firmware can get.
135 */
136 if (length < 0x1000 || length >= 0x10000) {
137 pr_err("firmware is size %zd is not (4k - 64k).",
138 length);
139 return -EINVAL;
140 }
141
142 /* The First 2 bytes are fixed value (55aa). "LSB on Left" */
143 if (get_unaligned_le16(fw_data) != 0x55aa) {
144 pr_err("no valid firmware header found.");
145 return -EINVAL;
146 }
147
148 /* verify the firmware version position and print it. */
149 fw_version_pointer = get_unaligned_le16(fw_data + 4);
150 if (fw_version_pointer + 2 >= length) {
151 pr_err("fw ver pointer is outside of the firmware image");
152 return -EINVAL;
153 }
154
155 return 0;
156 }
157
renesas_check_rom(struct pci_dev * pdev)158 static bool renesas_check_rom(struct pci_dev *pdev)
159 {
160 u16 rom_status;
161 int retval;
162
163 /* Check if external ROM exists */
164 retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status);
165 if (retval)
166 return false;
167
168 rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS;
169 if (rom_status) {
170 dev_dbg(&pdev->dev, "External ROM exists\n");
171 return true; /* External ROM exists */
172 }
173
174 return false;
175 }
176
renesas_check_rom_state(struct pci_dev * pdev)177 static int renesas_check_rom_state(struct pci_dev *pdev)
178 {
179 u16 rom_state;
180 u32 version;
181 int err;
182
183 /* check FW version */
184 err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version);
185 if (err)
186 return pcibios_err_to_errno(err);
187
188 version &= RENESAS_FW_VERSION_FIELD;
189 version = version >> RENESAS_FW_VERSION_OFFSET;
190 dev_dbg(&pdev->dev, "Found ROM version: %x\n", version);
191
192 /*
193 * Test if ROM is present and loaded, if so we can skip everything
194 */
195 err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state);
196 if (err)
197 return pcibios_err_to_errno(err);
198
199 if (rom_state & RENESAS_ROM_STATUS_ROM_EXISTS) {
200 /* ROM exists */
201 dev_dbg(&pdev->dev, "ROM exists\n");
202
203 /* Check the "Result Code" Bits (6:4) and act accordingly */
204 switch (rom_state & RENESAS_ROM_STATUS_RESULT) {
205 case RENESAS_ROM_STATUS_SUCCESS:
206 return 0;
207
208 case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */
209 dev_dbg(&pdev->dev, "Unknown ROM status ...\n");
210 return -ENOENT;
211
212 case RENESAS_ROM_STATUS_ERROR: /* Error State */
213 default: /* All other states are marked as "Reserved states" */
214 dev_err(&pdev->dev, "Invalid ROM..");
215 break;
216 }
217 }
218
219 return -EIO;
220 }
221
renesas_fw_check_running(struct pci_dev * pdev)222 static int renesas_fw_check_running(struct pci_dev *pdev)
223 {
224 u8 fw_state;
225 int err;
226
227 /*
228 * Test if the device is actually needing the firmware. As most
229 * BIOSes will initialize the device for us. If the device is
230 * initialized.
231 */
232 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state);
233 if (err)
234 return pcibios_err_to_errno(err);
235
236 /*
237 * Check if "FW Download Lock" is locked. If it is and the FW is
238 * ready we can simply continue. If the FW is not ready, we have
239 * to give up.
240 */
241 if (fw_state & RENESAS_FW_STATUS_LOCK) {
242 dev_dbg(&pdev->dev, "FW Download Lock is engaged.");
243
244 if (fw_state & RENESAS_FW_STATUS_SUCCESS)
245 return 0;
246
247 dev_err(&pdev->dev,
248 "FW Download Lock is set and FW is not ready. Giving Up.");
249 return -EIO;
250 }
251
252 /*
253 * Check if "FW Download Enable" is set. If someone (us?) tampered
254 * with it and it can't be reset, we have to give up too... and
255 * ask for a forgiveness and a reboot.
256 */
257 if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) {
258 dev_err(&pdev->dev,
259 "FW Download Enable is stale. Giving Up (poweroff/reboot needed).");
260 return -EIO;
261 }
262
263 /* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */
264 switch (fw_state & RENESAS_FW_STATUS_RESULT) {
265 case 0: /* No result yet */
266 dev_dbg(&pdev->dev, "FW is not ready/loaded yet.");
267
268 /* tell the caller, that this device needs the firmware. */
269 return 1;
270
271 case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */
272 dev_dbg(&pdev->dev, "FW is ready.");
273 return 0;
274
275 case RENESAS_FW_STATUS_ERROR: /* Error State */
276 dev_err(&pdev->dev,
277 "hardware is in an error state. Giving up (poweroff/reboot needed).");
278 return -ENODEV;
279
280 default: /* All other states are marked as "Reserved states" */
281 dev_err(&pdev->dev,
282 "hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).",
283 (fw_state & RENESAS_FW_STATUS_RESULT) >> 4);
284 return -EINVAL;
285 }
286 }
287
renesas_fw_download(struct pci_dev * pdev,const struct firmware * fw)288 static int renesas_fw_download(struct pci_dev *pdev,
289 const struct firmware *fw)
290 {
291 const u32 *fw_data = (const u32 *)fw->data;
292 size_t i;
293 int err;
294 u8 fw_status;
295
296 /*
297 * For more information and the big picture: please look at the
298 * "Firmware Download Sequence" in "7.1 FW Download Interface"
299 * of R19UH0078EJ0500 Rev.5.00 page 131
300 */
301
302 /*
303 * 0. Set "FW Download Enable" bit in the
304 * "FW Download Control & Status Register" at 0xF4
305 */
306 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS,
307 RENESAS_FW_STATUS_DOWNLOAD_ENABLE);
308 if (err)
309 return pcibios_err_to_errno(err);
310
311 /* 1 - 10 follow one step after the other. */
312 for (i = 0; i < fw->size / 4; i++) {
313 err = renesas_fw_download_image(pdev, fw_data, i, false);
314 if (err) {
315 dev_err(&pdev->dev,
316 "Firmware Download Step %zd failed at position %zd bytes with (%d).",
317 i, i * 4, err);
318 return err;
319 }
320 }
321
322 /*
323 * This sequence continues until the last data is written to
324 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1"
325 * is cleared by the hardware beforehand.
326 */
327 for (i = 0; i < RENESAS_RETRY; i++) {
328 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB,
329 &fw_status);
330 if (err)
331 return pcibios_err_to_errno(err);
332 if (!(fw_status & (BIT(0) | BIT(1))))
333 break;
334
335 udelay(RENESAS_DELAY);
336 }
337 if (i == RENESAS_RETRY)
338 dev_warn(&pdev->dev, "Final Firmware Download step timed out.");
339
340 /*
341 * 11. After finishing writing the last data of FW, the
342 * System Software must clear "FW Download Enable"
343 */
344 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0);
345 if (err)
346 return pcibios_err_to_errno(err);
347
348 /* 12. Read "Result Code" and confirm it is good. */
349 for (i = 0; i < RENESAS_RETRY; i++) {
350 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status);
351 if (err)
352 return pcibios_err_to_errno(err);
353 if (fw_status & RENESAS_FW_STATUS_SUCCESS)
354 break;
355
356 udelay(RENESAS_DELAY);
357 }
358 if (i == RENESAS_RETRY) {
359 /* Timed out / Error - let's see if we can fix this */
360 err = renesas_fw_check_running(pdev);
361 switch (err) {
362 case 0: /*
363 * we shouldn't end up here.
364 * maybe it took a little bit longer.
365 * But all should be well?
366 */
367 break;
368
369 case 1: /* (No result yet! */
370 dev_err(&pdev->dev, "FW Load timedout");
371 return -ETIMEDOUT;
372
373 default:
374 return err;
375 }
376 }
377
378 return 0;
379 }
380
renesas_rom_erase(struct pci_dev * pdev)381 static void renesas_rom_erase(struct pci_dev *pdev)
382 {
383 int retval, i;
384 u8 status;
385
386 dev_dbg(&pdev->dev, "Performing ROM Erase...\n");
387 retval = pci_write_config_dword(pdev, RENESAS_DATA0,
388 RENESAS_ROM_ERASE_MAGIC);
389 if (retval) {
390 dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n",
391 pcibios_err_to_errno(retval));
392 return;
393 }
394
395 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
396 if (retval) {
397 dev_err(&pdev->dev, "ROM status read failed: %d\n",
398 pcibios_err_to_errno(retval));
399 return;
400 }
401 status |= RENESAS_ROM_STATUS_ERASE;
402 retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status);
403 if (retval) {
404 dev_err(&pdev->dev, "ROM erase set word write failed\n");
405 return;
406 }
407
408 /* sleep a bit while ROM is erased */
409 msleep(20);
410
411 for (i = 0; i < RENESAS_CHIP_ERASE_RETRY; i++) {
412 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS,
413 &status);
414 status &= RENESAS_ROM_STATUS_ERASE;
415 if (!status)
416 break;
417
418 mdelay(RENESAS_DELAY);
419 }
420
421 if (i == RENESAS_RETRY)
422 dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status);
423
424 dev_dbg(&pdev->dev, "ROM Erase... Done success\n");
425 }
426
renesas_setup_rom(struct pci_dev * pdev,const struct firmware * fw)427 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw)
428 {
429 const u32 *fw_data = (const u32 *)fw->data;
430 int err, i;
431 u8 status;
432
433 /* 2. Write magic word to Data0 */
434 err = pci_write_config_dword(pdev, RENESAS_DATA0,
435 RENESAS_ROM_WRITE_MAGIC);
436 if (err)
437 return false;
438
439 /* 3. Set External ROM access */
440 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
441 RENESAS_ROM_STATUS_ACCESS);
442 if (err)
443 goto remove_bypass;
444
445 /* 4. Check the result */
446 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
447 if (err)
448 goto remove_bypass;
449 status &= GENMASK(6, 4);
450 if (status) {
451 dev_err(&pdev->dev,
452 "setting external rom failed: %x\n", status);
453 goto remove_bypass;
454 }
455
456 /* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */
457 for (i = 0; i < fw->size / 4; i++) {
458 err = renesas_fw_download_image(pdev, fw_data, i, true);
459 if (err) {
460 dev_err(&pdev->dev,
461 "ROM Download Step %d failed at position %d bytes with (%d)\n",
462 i, i * 4, err);
463 goto remove_bypass;
464 }
465 }
466
467 /*
468 * wait till DATA0/1 is cleared
469 */
470 for (i = 0; i < RENESAS_RETRY; i++) {
471 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB,
472 &status);
473 if (err)
474 goto remove_bypass;
475 if (!(status & (BIT(0) | BIT(1))))
476 break;
477
478 udelay(RENESAS_DELAY);
479 }
480 if (i == RENESAS_RETRY) {
481 dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n");
482 goto remove_bypass;
483 }
484
485 /* 17. Remove bypass */
486 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
487 if (err)
488 return false;
489
490 udelay(10);
491
492 /* 18. check result */
493 for (i = 0; i < RENESAS_RETRY; i++) {
494 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
495 if (err) {
496 dev_err(&pdev->dev, "Read ROM status failed:%d\n",
497 pcibios_err_to_errno(err));
498 return false;
499 }
500 status &= RENESAS_ROM_STATUS_RESULT;
501 if (status == RENESAS_ROM_STATUS_SUCCESS) {
502 dev_dbg(&pdev->dev, "Download ROM success\n");
503 break;
504 }
505 udelay(RENESAS_DELAY);
506 }
507 if (i == RENESAS_RETRY) { /* Timed out */
508 dev_err(&pdev->dev,
509 "Download to external ROM TO: %x\n", status);
510 return false;
511 }
512
513 dev_dbg(&pdev->dev, "Download to external ROM succeeded\n");
514
515 /* Last step set Reload */
516 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS,
517 RENESAS_ROM_STATUS_RELOAD);
518 if (err) {
519 dev_err(&pdev->dev, "Set ROM execute failed: %d\n",
520 pcibios_err_to_errno(err));
521 return false;
522 }
523
524 /*
525 * wait till Reload is cleared
526 */
527 for (i = 0; i < RENESAS_RETRY; i++) {
528 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status);
529 if (err)
530 return false;
531 if (!(status & RENESAS_ROM_STATUS_RELOAD))
532 break;
533
534 udelay(RENESAS_DELAY);
535 }
536 if (i == RENESAS_RETRY) {
537 dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status);
538 return false;
539 }
540
541 return true;
542
543 remove_bypass:
544 pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0);
545 return false;
546 }
547
renesas_load_fw(struct pci_dev * pdev,const struct firmware * fw)548 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw)
549 {
550 int err = 0;
551 bool rom;
552
553 /* Check if the device has external ROM */
554 rom = renesas_check_rom(pdev);
555 if (rom) {
556 /* perform chip erase first */
557 renesas_rom_erase(pdev);
558
559 /* lets try loading fw on ROM first */
560 rom = renesas_setup_rom(pdev, fw);
561 if (!rom) {
562 dev_dbg(&pdev->dev,
563 "ROM load failed, falling back on FW load\n");
564 } else {
565 dev_dbg(&pdev->dev,
566 "ROM load success\n");
567 goto exit;
568 }
569 }
570
571 err = renesas_fw_download(pdev, fw);
572
573 exit:
574 if (err)
575 dev_err(&pdev->dev, "firmware failed to download (%d).", err);
576 return err;
577 }
578
renesas_xhci_check_request_fw(struct pci_dev * pdev,const struct pci_device_id * id)579 static int renesas_xhci_check_request_fw(struct pci_dev *pdev,
580 const struct pci_device_id *id)
581 {
582 const char fw_name[] = RENESAS_FW_NAME;
583 const struct firmware *fw;
584 bool has_rom;
585 int err;
586
587 /* Check if device has ROM and loaded, if so skip everything */
588 has_rom = renesas_check_rom(pdev);
589 if (has_rom) {
590 err = renesas_check_rom_state(pdev);
591 if (!err)
592 return 0;
593 else if (err != -ENOENT)
594 has_rom = false;
595 }
596
597 err = renesas_fw_check_running(pdev);
598 /* Continue ahead, if the firmware is already running. */
599 if (!err)
600 return 0;
601
602 /* no firmware interface available */
603 if (err != 1)
604 return has_rom ? 0 : err;
605
606 pci_dev_get(pdev);
607 err = firmware_request_nowarn(&fw, fw_name, &pdev->dev);
608 pci_dev_put(pdev);
609 if (err) {
610 if (has_rom) {
611 dev_info(&pdev->dev, "failed to load firmware %s, fallback to ROM\n",
612 fw_name);
613 return 0;
614 }
615 dev_err(&pdev->dev, "failed to load firmware %s: %d\n",
616 fw_name, err);
617 return err;
618 }
619
620 err = renesas_fw_verify(fw->data, fw->size);
621 if (err)
622 goto exit;
623
624 err = renesas_load_fw(pdev, fw);
625 exit:
626 release_firmware(fw);
627 return err;
628 }
629
630 static int
xhci_pci_renesas_probe(struct pci_dev * dev,const struct pci_device_id * id)631 xhci_pci_renesas_probe(struct pci_dev *dev, const struct pci_device_id *id)
632 {
633 int retval;
634
635 retval = renesas_xhci_check_request_fw(dev, id);
636 if (retval)
637 return retval;
638
639 return xhci_pci_common_probe(dev, id);
640 }
641
642 static const struct pci_device_id pci_ids[] = {
643 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0014) },
644 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0015) },
645 { /* end: all zeroes */ }
646 };
647 MODULE_DEVICE_TABLE(pci, pci_ids);
648
649 static struct pci_driver xhci_renesas_pci_driver = {
650 .name = "xhci-pci-renesas",
651 .id_table = pci_ids,
652
653 .probe = xhci_pci_renesas_probe,
654 .remove = xhci_pci_remove,
655
656 .shutdown = usb_hcd_pci_shutdown,
657 .driver = {
658 .pm = pm_ptr(&usb_hcd_pci_pm_ops),
659 },
660 };
661 module_pci_driver(xhci_renesas_pci_driver);
662
663 MODULE_DESCRIPTION("Renesas xHCI PCI Host Controller Driver");
664 MODULE_FIRMWARE(RENESAS_FW_NAME);
665 MODULE_IMPORT_NS("xhci");
666 MODULE_LICENSE("GPL v2");
667