1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 /* 3 * Copyright (C) 2012-2014, 2018-2019, 2021 Intel Corporation 4 * Copyright (C) 2013-2015 Intel Mobile Communications GmbH 5 * Copyright (C) 2016-2017 Intel Deutschland GmbH 6 */ 7 #include <linux/firmware.h> 8 #if defined(__linux__) 9 #include <linux/rtnetlink.h> 10 #endif 11 #include "iwl-trans.h" 12 #include "iwl-csr.h" 13 #include "mvm.h" 14 #include "iwl-eeprom-parse.h" 15 #include "iwl-eeprom-read.h" 16 #include "iwl-nvm-parse.h" 17 #include "iwl-prph.h" 18 #include "fw/acpi.h" 19 20 /* Default NVM size to read */ 21 #define IWL_NVM_DEFAULT_CHUNK_SIZE (2 * 1024) 22 23 #define NVM_WRITE_OPCODE 1 24 #define NVM_READ_OPCODE 0 25 26 /* load nvm chunk response */ 27 enum { 28 READ_NVM_CHUNK_SUCCEED = 0, 29 READ_NVM_CHUNK_NOT_VALID_ADDRESS = 1 30 }; 31 32 /* 33 * prepare the NVM host command w/ the pointers to the nvm buffer 34 * and send it to fw 35 */ 36 static int iwl_nvm_write_chunk(struct iwl_mvm *mvm, u16 section, 37 u16 offset, u16 length, const u8 *data) 38 { 39 struct iwl_nvm_access_cmd nvm_access_cmd = { 40 .offset = cpu_to_le16(offset), 41 .length = cpu_to_le16(length), 42 .type = cpu_to_le16(section), 43 .op_code = NVM_WRITE_OPCODE, 44 }; 45 struct iwl_host_cmd cmd = { 46 .id = NVM_ACCESS_CMD, 47 .len = { sizeof(struct iwl_nvm_access_cmd), length }, 48 .flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL, 49 .data = { &nvm_access_cmd, data }, 50 /* data may come from vmalloc, so use _DUP */ 51 .dataflags = { 0, IWL_HCMD_DFL_DUP }, 52 }; 53 struct iwl_rx_packet *pkt; 54 struct iwl_nvm_access_resp *nvm_resp; 55 int ret; 56 57 ret = iwl_mvm_send_cmd(mvm, &cmd); 58 if (ret) 59 return ret; 60 61 pkt = cmd.resp_pkt; 62 /* Extract & check NVM write response */ 63 nvm_resp = (void *)pkt->data; 64 if (le16_to_cpu(nvm_resp->status) != READ_NVM_CHUNK_SUCCEED) { 65 IWL_ERR(mvm, 66 "NVM access write command failed for section %u (status = 0x%x)\n", 67 section, le16_to_cpu(nvm_resp->status)); 68 ret = -EIO; 69 } 70 71 iwl_free_resp(&cmd); 72 return ret; 73 } 74 75 static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section, 76 u16 offset, u16 length, u8 *data) 77 { 78 struct iwl_nvm_access_cmd nvm_access_cmd = { 79 .offset = cpu_to_le16(offset), 80 .length = cpu_to_le16(length), 81 .type = cpu_to_le16(section), 82 .op_code = NVM_READ_OPCODE, 83 }; 84 struct iwl_nvm_access_resp *nvm_resp; 85 struct iwl_rx_packet *pkt; 86 struct iwl_host_cmd cmd = { 87 .id = NVM_ACCESS_CMD, 88 .flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL, 89 .data = { &nvm_access_cmd, }, 90 }; 91 int ret, bytes_read, offset_read; 92 u8 *resp_data; 93 94 cmd.len[0] = sizeof(struct iwl_nvm_access_cmd); 95 96 ret = iwl_mvm_send_cmd(mvm, &cmd); 97 if (ret) 98 return ret; 99 100 pkt = cmd.resp_pkt; 101 102 /* Extract NVM response */ 103 nvm_resp = (void *)pkt->data; 104 ret = le16_to_cpu(nvm_resp->status); 105 bytes_read = le16_to_cpu(nvm_resp->length); 106 offset_read = le16_to_cpu(nvm_resp->offset); 107 resp_data = nvm_resp->data; 108 if (ret) { 109 if ((offset != 0) && 110 (ret == READ_NVM_CHUNK_NOT_VALID_ADDRESS)) { 111 /* 112 * meaning of NOT_VALID_ADDRESS: 113 * driver try to read chunk from address that is 114 * multiple of 2K and got an error since addr is empty. 115 * meaning of (offset != 0): driver already 116 * read valid data from another chunk so this case 117 * is not an error. 118 */ 119 IWL_DEBUG_EEPROM(mvm->trans->dev, 120 "NVM access command failed on offset 0x%x since that section size is multiple 2K\n", 121 offset); 122 ret = 0; 123 } else { 124 IWL_DEBUG_EEPROM(mvm->trans->dev, 125 "NVM access command failed with status %d (device: %s)\n", 126 ret, mvm->trans->name); 127 ret = -ENODATA; 128 } 129 goto exit; 130 } 131 132 if (offset_read != offset) { 133 IWL_ERR(mvm, "NVM ACCESS response with invalid offset %d\n", 134 offset_read); 135 ret = -EINVAL; 136 goto exit; 137 } 138 139 /* Write data to NVM */ 140 memcpy(data + offset, resp_data, bytes_read); 141 ret = bytes_read; 142 143 exit: 144 iwl_free_resp(&cmd); 145 return ret; 146 } 147 148 static int iwl_nvm_write_section(struct iwl_mvm *mvm, u16 section, 149 const u8 *data, u16 length) 150 { 151 int offset = 0; 152 153 /* copy data in chunks of 2k (and remainder if any) */ 154 155 while (offset < length) { 156 int chunk_size, ret; 157 158 chunk_size = min(IWL_NVM_DEFAULT_CHUNK_SIZE, 159 length - offset); 160 161 ret = iwl_nvm_write_chunk(mvm, section, offset, 162 chunk_size, data + offset); 163 if (ret < 0) 164 return ret; 165 166 offset += chunk_size; 167 } 168 169 return 0; 170 } 171 172 /* 173 * Reads an NVM section completely. 174 * NICs prior to 7000 family doesn't have a real NVM, but just read 175 * section 0 which is the EEPROM. Because the EEPROM reading is unlimited 176 * by uCode, we need to manually check in this case that we don't 177 * overflow and try to read more than the EEPROM size. 178 * For 7000 family NICs, we supply the maximal size we can read, and 179 * the uCode fills the response with as much data as we can, 180 * without overflowing, so no check is needed. 181 */ 182 static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section, 183 u8 *data, u32 size_read) 184 { 185 u16 length, offset = 0; 186 int ret; 187 188 /* Set nvm section read length */ 189 length = IWL_NVM_DEFAULT_CHUNK_SIZE; 190 191 ret = length; 192 193 /* Read the NVM until exhausted (reading less than requested) */ 194 while (ret == length) { 195 /* Check no memory assumptions fail and cause an overflow */ 196 if ((size_read + offset + length) > 197 mvm->trans->trans_cfg->base_params->eeprom_size) { 198 IWL_ERR(mvm, "EEPROM size is too small for NVM\n"); 199 return -ENOBUFS; 200 } 201 202 ret = iwl_nvm_read_chunk(mvm, section, offset, length, data); 203 if (ret < 0) { 204 IWL_DEBUG_EEPROM(mvm->trans->dev, 205 "Cannot read NVM from section %d offset %d, length %d\n", 206 section, offset, length); 207 return ret; 208 } 209 offset += ret; 210 } 211 212 iwl_nvm_fixups(mvm->trans->hw_id, section, data, offset); 213 214 IWL_DEBUG_EEPROM(mvm->trans->dev, 215 "NVM section %d read completed\n", section); 216 return offset; 217 } 218 219 static struct iwl_nvm_data * 220 iwl_parse_nvm_sections(struct iwl_mvm *mvm) 221 { 222 struct iwl_nvm_section *sections = mvm->nvm_sections; 223 const __be16 *hw; 224 const __le16 *sw, *calib, *regulatory, *mac_override, *phy_sku; 225 int regulatory_type; 226 227 /* Checking for required sections */ 228 if (mvm->trans->cfg->nvm_type == IWL_NVM) { 229 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data || 230 !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) { 231 IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n"); 232 return NULL; 233 } 234 } else { 235 if (mvm->trans->cfg->nvm_type == IWL_NVM_SDP) 236 regulatory_type = NVM_SECTION_TYPE_REGULATORY_SDP; 237 else 238 regulatory_type = NVM_SECTION_TYPE_REGULATORY; 239 240 /* SW and REGULATORY sections are mandatory */ 241 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data || 242 !mvm->nvm_sections[regulatory_type].data) { 243 IWL_ERR(mvm, 244 "Can't parse empty family 8000 OTP/NVM sections\n"); 245 return NULL; 246 } 247 /* MAC_OVERRIDE or at least HW section must exist */ 248 if (!mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data && 249 !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data) { 250 IWL_ERR(mvm, 251 "Can't parse mac_address, empty sections\n"); 252 return NULL; 253 } 254 255 /* PHY_SKU section is mandatory in B0 */ 256 if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT && 257 !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { 258 IWL_ERR(mvm, 259 "Can't parse phy_sku in B0, empty sections\n"); 260 return NULL; 261 } 262 } 263 264 hw = (const __be16 *)sections[mvm->cfg->nvm_hw_section_num].data; 265 sw = (const __le16 *)sections[NVM_SECTION_TYPE_SW].data; 266 calib = (const __le16 *)sections[NVM_SECTION_TYPE_CALIBRATION].data; 267 mac_override = 268 (const __le16 *)sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data; 269 phy_sku = (const __le16 *)sections[NVM_SECTION_TYPE_PHY_SKU].data; 270 271 regulatory = mvm->trans->cfg->nvm_type == IWL_NVM_SDP ? 272 (const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY_SDP].data : 273 (const __le16 *)sections[NVM_SECTION_TYPE_REGULATORY].data; 274 275 return iwl_parse_nvm_data(mvm->trans, mvm->cfg, mvm->fw, hw, sw, calib, 276 regulatory, mac_override, phy_sku, 277 mvm->fw->valid_tx_ant, mvm->fw->valid_rx_ant); 278 } 279 280 /* Loads the NVM data stored in mvm->nvm_sections into the NIC */ 281 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm) 282 { 283 int i, ret = 0; 284 struct iwl_nvm_section *sections = mvm->nvm_sections; 285 286 IWL_DEBUG_EEPROM(mvm->trans->dev, "'Write to NVM\n"); 287 288 for (i = 0; i < ARRAY_SIZE(mvm->nvm_sections); i++) { 289 if (!mvm->nvm_sections[i].data || !mvm->nvm_sections[i].length) 290 continue; 291 ret = iwl_nvm_write_section(mvm, i, sections[i].data, 292 sections[i].length); 293 if (ret < 0) { 294 IWL_ERR(mvm, "iwl_mvm_send_cmd failed: %d\n", ret); 295 break; 296 } 297 } 298 return ret; 299 } 300 301 int iwl_nvm_init(struct iwl_mvm *mvm) 302 { 303 int ret, section; 304 u32 size_read = 0; 305 u8 *nvm_buffer, *temp; 306 const char *nvm_file_C = mvm->cfg->default_nvm_file_C_step; 307 308 if (WARN_ON_ONCE(mvm->cfg->nvm_hw_section_num >= NVM_MAX_NUM_SECTIONS)) 309 return -EINVAL; 310 311 /* load NVM values from nic */ 312 /* Read From FW NVM */ 313 IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from NVM\n"); 314 315 nvm_buffer = kmalloc(mvm->trans->trans_cfg->base_params->eeprom_size, 316 GFP_KERNEL); 317 if (!nvm_buffer) 318 return -ENOMEM; 319 for (section = 0; section < NVM_MAX_NUM_SECTIONS; section++) { 320 /* we override the constness for initial read */ 321 ret = iwl_nvm_read_section(mvm, section, nvm_buffer, 322 size_read); 323 if (ret == -ENODATA) { 324 ret = 0; 325 continue; 326 } 327 if (ret < 0) 328 break; 329 size_read += ret; 330 temp = kmemdup(nvm_buffer, ret, GFP_KERNEL); 331 if (!temp) { 332 ret = -ENOMEM; 333 break; 334 } 335 336 iwl_nvm_fixups(mvm->trans->hw_id, section, temp, ret); 337 338 mvm->nvm_sections[section].data = temp; 339 mvm->nvm_sections[section].length = ret; 340 341 #ifdef CONFIG_IWLWIFI_DEBUGFS 342 switch (section) { 343 case NVM_SECTION_TYPE_SW: 344 mvm->nvm_sw_blob.data = temp; 345 mvm->nvm_sw_blob.size = ret; 346 break; 347 case NVM_SECTION_TYPE_CALIBRATION: 348 mvm->nvm_calib_blob.data = temp; 349 mvm->nvm_calib_blob.size = ret; 350 break; 351 case NVM_SECTION_TYPE_PRODUCTION: 352 mvm->nvm_prod_blob.data = temp; 353 mvm->nvm_prod_blob.size = ret; 354 break; 355 case NVM_SECTION_TYPE_PHY_SKU: 356 mvm->nvm_phy_sku_blob.data = temp; 357 mvm->nvm_phy_sku_blob.size = ret; 358 break; 359 case NVM_SECTION_TYPE_REGULATORY_SDP: 360 case NVM_SECTION_TYPE_REGULATORY: 361 mvm->nvm_reg_blob.data = temp; 362 mvm->nvm_reg_blob.size = ret; 363 break; 364 default: 365 if (section == mvm->cfg->nvm_hw_section_num) { 366 mvm->nvm_hw_blob.data = temp; 367 mvm->nvm_hw_blob.size = ret; 368 break; 369 } 370 } 371 #endif 372 } 373 if (!size_read) 374 IWL_ERR(mvm, "OTP is blank\n"); 375 kfree(nvm_buffer); 376 377 /* Only if PNVM selected in the mod param - load external NVM */ 378 if (mvm->nvm_file_name) { 379 /* read External NVM file from the mod param */ 380 ret = iwl_read_external_nvm(mvm->trans, mvm->nvm_file_name, 381 mvm->nvm_sections); 382 if (ret) { 383 mvm->nvm_file_name = nvm_file_C; 384 385 if ((ret == -EFAULT || ret == -ENOENT) && 386 mvm->nvm_file_name) { 387 /* in case nvm file was failed try again */ 388 ret = iwl_read_external_nvm(mvm->trans, 389 mvm->nvm_file_name, 390 mvm->nvm_sections); 391 if (ret) 392 return ret; 393 } else { 394 return ret; 395 } 396 } 397 } 398 399 /* parse the relevant nvm sections */ 400 mvm->nvm_data = iwl_parse_nvm_sections(mvm); 401 if (!mvm->nvm_data) 402 return -ENODATA; 403 IWL_DEBUG_EEPROM(mvm->trans->dev, "nvm version = %x\n", 404 mvm->nvm_data->nvm_version); 405 406 return ret < 0 ? ret : 0; 407 } 408 409 struct iwl_mcc_update_resp * 410 iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2, 411 enum iwl_mcc_source src_id) 412 { 413 struct iwl_mcc_update_cmd mcc_update_cmd = { 414 .mcc = cpu_to_le16(alpha2[0] << 8 | alpha2[1]), 415 .source_id = (u8)src_id, 416 }; 417 struct iwl_mcc_update_resp *resp_cp; 418 struct iwl_rx_packet *pkt; 419 struct iwl_host_cmd cmd = { 420 .id = MCC_UPDATE_CMD, 421 .flags = CMD_WANT_SKB | CMD_SEND_IN_RFKILL, 422 .data = { &mcc_update_cmd }, 423 }; 424 425 int ret; 426 u32 status; 427 int resp_len, n_channels; 428 u16 mcc; 429 430 if (WARN_ON_ONCE(!iwl_mvm_is_lar_supported(mvm))) 431 return ERR_PTR(-EOPNOTSUPP); 432 433 cmd.len[0] = sizeof(struct iwl_mcc_update_cmd); 434 435 IWL_DEBUG_LAR(mvm, "send MCC update to FW with '%c%c' src = %d\n", 436 alpha2[0], alpha2[1], src_id); 437 438 ret = iwl_mvm_send_cmd(mvm, &cmd); 439 if (ret) 440 return ERR_PTR(ret); 441 442 pkt = cmd.resp_pkt; 443 444 /* Extract MCC response */ 445 if (fw_has_capa(&mvm->fw->ucode_capa, 446 IWL_UCODE_TLV_CAPA_MCC_UPDATE_11AX_SUPPORT)) { 447 struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data; 448 449 n_channels = __le32_to_cpu(mcc_resp->n_channels); 450 resp_len = sizeof(struct iwl_mcc_update_resp) + 451 n_channels * sizeof(__le32); 452 resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL); 453 if (!resp_cp) { 454 resp_cp = ERR_PTR(-ENOMEM); 455 goto exit; 456 } 457 } else { 458 struct iwl_mcc_update_resp_v3 *mcc_resp_v3 = (void *)pkt->data; 459 460 n_channels = __le32_to_cpu(mcc_resp_v3->n_channels); 461 resp_len = sizeof(struct iwl_mcc_update_resp) + 462 n_channels * sizeof(__le32); 463 resp_cp = kzalloc(resp_len, GFP_KERNEL); 464 if (!resp_cp) { 465 resp_cp = ERR_PTR(-ENOMEM); 466 goto exit; 467 } 468 469 resp_cp->status = mcc_resp_v3->status; 470 resp_cp->mcc = mcc_resp_v3->mcc; 471 resp_cp->cap = cpu_to_le16(mcc_resp_v3->cap); 472 resp_cp->source_id = mcc_resp_v3->source_id; 473 resp_cp->time = mcc_resp_v3->time; 474 resp_cp->geo_info = mcc_resp_v3->geo_info; 475 resp_cp->n_channels = mcc_resp_v3->n_channels; 476 memcpy(resp_cp->channels, mcc_resp_v3->channels, 477 n_channels * sizeof(__le32)); 478 } 479 480 status = le32_to_cpu(resp_cp->status); 481 482 mcc = le16_to_cpu(resp_cp->mcc); 483 484 /* W/A for a FW/NVM issue - returns 0x00 for the world domain */ 485 if (mcc == 0) { 486 mcc = 0x3030; /* "00" - world */ 487 resp_cp->mcc = cpu_to_le16(mcc); 488 } 489 490 IWL_DEBUG_LAR(mvm, 491 "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n", 492 status, mcc, mcc >> 8, mcc & 0xff, n_channels); 493 494 exit: 495 iwl_free_resp(&cmd); 496 return resp_cp; 497 } 498 499 int iwl_mvm_init_mcc(struct iwl_mvm *mvm) 500 { 501 bool tlv_lar; 502 bool nvm_lar; 503 int retval; 504 struct ieee80211_regdomain *regd; 505 char mcc[3]; 506 507 if (mvm->cfg->nvm_type == IWL_NVM_EXT) { 508 tlv_lar = fw_has_capa(&mvm->fw->ucode_capa, 509 IWL_UCODE_TLV_CAPA_LAR_SUPPORT); 510 nvm_lar = mvm->nvm_data->lar_enabled; 511 if (tlv_lar != nvm_lar) 512 IWL_INFO(mvm, 513 "Conflict between TLV & NVM regarding enabling LAR (TLV = %s NVM =%s)\n", 514 tlv_lar ? "enabled" : "disabled", 515 nvm_lar ? "enabled" : "disabled"); 516 } 517 518 if (!iwl_mvm_is_lar_supported(mvm)) 519 return 0; 520 521 /* 522 * try to replay the last set MCC to FW. If it doesn't exist, 523 * queue an update to cfg80211 to retrieve the default alpha2 from FW. 524 */ 525 retval = iwl_mvm_init_fw_regd(mvm); 526 if (retval != -ENOENT) 527 return retval; 528 529 /* 530 * Driver regulatory hint for initial update, this also informs the 531 * firmware we support wifi location updates. 532 * Disallow scans that might crash the FW while the LAR regdomain 533 * is not set. 534 */ 535 mvm->lar_regdom_set = false; 536 537 regd = iwl_mvm_get_current_regdomain(mvm, NULL); 538 if (IS_ERR_OR_NULL(regd)) 539 return -EIO; 540 541 if (iwl_mvm_is_wifi_mcc_supported(mvm) && 542 !iwl_acpi_get_mcc(mvm->dev, mcc)) { 543 kfree(regd); 544 regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, mcc, 545 MCC_SOURCE_BIOS, NULL); 546 if (IS_ERR_OR_NULL(regd)) 547 return -EIO; 548 } 549 550 retval = regulatory_set_wiphy_regd_sync(mvm->hw->wiphy, regd); 551 kfree(regd); 552 return retval; 553 } 554 555 void iwl_mvm_rx_chub_update_mcc(struct iwl_mvm *mvm, 556 struct iwl_rx_cmd_buffer *rxb) 557 { 558 struct iwl_rx_packet *pkt = rxb_addr(rxb); 559 struct iwl_mcc_chub_notif *notif = (void *)pkt->data; 560 enum iwl_mcc_source src; 561 char mcc[3]; 562 struct ieee80211_regdomain *regd; 563 int wgds_tbl_idx; 564 565 lockdep_assert_held(&mvm->mutex); 566 567 if (iwl_mvm_is_vif_assoc(mvm) && notif->source_id == MCC_SOURCE_WIFI) { 568 IWL_DEBUG_LAR(mvm, "Ignore mcc update while associated\n"); 569 return; 570 } 571 572 if (WARN_ON_ONCE(!iwl_mvm_is_lar_supported(mvm))) 573 return; 574 575 mcc[0] = le16_to_cpu(notif->mcc) >> 8; 576 mcc[1] = le16_to_cpu(notif->mcc) & 0xff; 577 mcc[2] = '\0'; 578 src = notif->source_id; 579 580 IWL_DEBUG_LAR(mvm, 581 "RX: received chub update mcc cmd (mcc '%s' src %d)\n", 582 mcc, src); 583 regd = iwl_mvm_get_regdomain(mvm->hw->wiphy, mcc, src, NULL); 584 if (IS_ERR_OR_NULL(regd)) 585 return; 586 587 wgds_tbl_idx = iwl_mvm_get_sar_geo_profile(mvm); 588 if (wgds_tbl_idx < 1) 589 IWL_DEBUG_INFO(mvm, 590 "SAR WGDS is disabled or error received (%d)\n", 591 wgds_tbl_idx); 592 else 593 IWL_DEBUG_INFO(mvm, "SAR WGDS: geo profile %d is configured\n", 594 wgds_tbl_idx); 595 596 regulatory_set_wiphy_regd(mvm->hw->wiphy, regd); 597 kfree(regd); 598 } 599