1 // SPDX-License-Identifier: GPL-2.0-only 2 3 /* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ 4 5 #include <linux/devcoredump.h> 6 #include <linux/firmware.h> 7 #include <linux/limits.h> 8 #include <linux/mhi.h> 9 #include <linux/minmax.h> 10 #include <linux/overflow.h> 11 #include <linux/types.h> 12 #include <linux/vmalloc.h> 13 #include <linux/workqueue.h> 14 15 #include "sahara.h" 16 17 #define SAHARA_HELLO_CMD 0x1 /* Min protocol version 1.0 */ 18 #define SAHARA_HELLO_RESP_CMD 0x2 /* Min protocol version 1.0 */ 19 #define SAHARA_READ_DATA_CMD 0x3 /* Min protocol version 1.0 */ 20 #define SAHARA_END_OF_IMAGE_CMD 0x4 /* Min protocol version 1.0 */ 21 #define SAHARA_DONE_CMD 0x5 /* Min protocol version 1.0 */ 22 #define SAHARA_DONE_RESP_CMD 0x6 /* Min protocol version 1.0 */ 23 #define SAHARA_RESET_CMD 0x7 /* Min protocol version 1.0 */ 24 #define SAHARA_RESET_RESP_CMD 0x8 /* Min protocol version 1.0 */ 25 #define SAHARA_MEM_DEBUG_CMD 0x9 /* Min protocol version 2.0 */ 26 #define SAHARA_MEM_READ_CMD 0xa /* Min protocol version 2.0 */ 27 #define SAHARA_CMD_READY_CMD 0xb /* Min protocol version 2.1 */ 28 #define SAHARA_SWITCH_MODE_CMD 0xc /* Min protocol version 2.1 */ 29 #define SAHARA_EXECUTE_CMD 0xd /* Min protocol version 2.1 */ 30 #define SAHARA_EXECUTE_RESP_CMD 0xe /* Min protocol version 2.1 */ 31 #define SAHARA_EXECUTE_DATA_CMD 0xf /* Min protocol version 2.1 */ 32 #define SAHARA_MEM_DEBUG64_CMD 0x10 /* Min protocol version 2.5 */ 33 #define SAHARA_MEM_READ64_CMD 0x11 /* Min protocol version 2.5 */ 34 #define SAHARA_READ_DATA64_CMD 0x12 /* Min protocol version 2.8 */ 35 #define SAHARA_RESET_STATE_CMD 0x13 /* Min protocol version 2.9 */ 36 #define SAHARA_WRITE_DATA_CMD 0x14 /* Min protocol version 3.0 */ 37 38 #define SAHARA_PACKET_MAX_SIZE 0xffffU /* MHI_MAX_MTU */ 39 #define SAHARA_TRANSFER_MAX_SIZE 0x80000 40 #define SAHARA_READ_MAX_SIZE 0xfff0U /* Avoid unaligned requests */ 41 #define SAHARA_NUM_TX_BUF DIV_ROUND_UP(SAHARA_TRANSFER_MAX_SIZE,\ 42 SAHARA_PACKET_MAX_SIZE) 43 #define SAHARA_IMAGE_ID_NONE U32_MAX 44 45 #define SAHARA_VERSION 2 46 #define SAHARA_SUCCESS 0 47 #define SAHARA_TABLE_ENTRY_STR_LEN 20 48 49 #define SAHARA_MODE_IMAGE_TX_PENDING 0x0 50 #define SAHARA_MODE_IMAGE_TX_COMPLETE 0x1 51 #define SAHARA_MODE_MEMORY_DEBUG 0x2 52 #define SAHARA_MODE_COMMAND 0x3 53 54 #define SAHARA_HELLO_LENGTH 0x30 55 #define SAHARA_READ_DATA_LENGTH 0x14 56 #define SAHARA_END_OF_IMAGE_LENGTH 0x10 57 #define SAHARA_DONE_LENGTH 0x8 58 #define SAHARA_RESET_LENGTH 0x8 59 #define SAHARA_MEM_DEBUG64_LENGTH 0x18 60 #define SAHARA_MEM_READ64_LENGTH 0x18 61 62 struct sahara_packet { 63 __le32 cmd; 64 __le32 length; 65 66 union { 67 struct { 68 __le32 version; 69 __le32 version_compat; 70 __le32 max_length; 71 __le32 mode; 72 } hello; 73 struct { 74 __le32 version; 75 __le32 version_compat; 76 __le32 status; 77 __le32 mode; 78 } hello_resp; 79 struct { 80 __le32 image; 81 __le32 offset; 82 __le32 length; 83 } read_data; 84 struct { 85 __le32 image; 86 __le32 status; 87 } end_of_image; 88 struct { 89 __le64 table_address; 90 __le64 table_length; 91 } memory_debug64; 92 struct { 93 __le64 memory_address; 94 __le64 memory_length; 95 } memory_read64; 96 }; 97 }; 98 99 struct sahara_debug_table_entry64 { 100 __le64 type; 101 __le64 address; 102 __le64 length; 103 char description[SAHARA_TABLE_ENTRY_STR_LEN]; 104 char filename[SAHARA_TABLE_ENTRY_STR_LEN]; 105 }; 106 107 struct sahara_dump_table_entry { 108 u64 type; 109 u64 address; 110 u64 length; 111 char description[SAHARA_TABLE_ENTRY_STR_LEN]; 112 char filename[SAHARA_TABLE_ENTRY_STR_LEN]; 113 }; 114 115 #define SAHARA_DUMP_V1_MAGIC 0x1234567890abcdef 116 #define SAHARA_DUMP_V1_VER 1 117 struct sahara_memory_dump_meta_v1 { 118 u64 magic; 119 u64 version; 120 u64 dump_size; 121 u64 table_size; 122 }; 123 124 /* 125 * Layout of crashdump provided to user via devcoredump 126 * +------------------------------------------+ 127 * | Crashdump Meta structure | 128 * | type: struct sahara_memory_dump_meta_v1 | 129 * +------------------------------------------+ 130 * | Crashdump Table | 131 * | type: array of struct | 132 * | sahara_dump_table_entry | 133 * | | 134 * | | 135 * +------------------------------------------+ 136 * | Crashdump | 137 * | | 138 * | | 139 * | | 140 * | | 141 * | | 142 * +------------------------------------------+ 143 * 144 * First is the metadata header. Userspace can use the magic number to verify 145 * the content type, and then check the version for the rest of the format. 146 * New versions should keep the magic number location/value, and version 147 * location, but increment the version value. 148 * 149 * For v1, the metadata lists the size of the entire dump (header + table + 150 * dump) and the size of the table. Then the dump image table, which describes 151 * the contents of the dump. Finally all the images are listed in order, with 152 * no deadspace in between. Userspace can use the sizes listed in the image 153 * table to reconstruct the individual images. 154 */ 155 156 struct sahara_context { 157 struct sahara_packet *tx[SAHARA_NUM_TX_BUF]; 158 struct sahara_packet *rx; 159 struct work_struct fw_work; 160 struct work_struct dump_work; 161 struct work_struct read_data_work; 162 struct mhi_device *mhi_dev; 163 const char * const *image_table; 164 u32 table_size; 165 u32 active_image_id; 166 const struct firmware *firmware; 167 u64 dump_table_address; 168 u64 dump_table_length; 169 size_t rx_size; 170 size_t rx_size_requested; 171 void *mem_dump; 172 size_t mem_dump_sz; 173 struct sahara_dump_table_entry *dump_image; 174 u64 dump_image_offset; 175 void *mem_dump_freespace; 176 u64 dump_images_left; 177 u32 read_data_offset; 178 u32 read_data_length; 179 bool is_mem_dump_mode; 180 bool non_streaming; 181 }; 182 183 static const char * const aic100_image_table[] = { 184 [1] = "qcom/aic100/fw1.bin", 185 [2] = "qcom/aic100/fw2.bin", 186 [4] = "qcom/aic100/fw4.bin", 187 [5] = "qcom/aic100/fw5.bin", 188 [6] = "qcom/aic100/fw6.bin", 189 [8] = "qcom/aic100/fw8.bin", 190 [9] = "qcom/aic100/fw9.bin", 191 [10] = "qcom/aic100/fw10.bin", 192 }; 193 194 static const char * const aic200_image_table[] = { 195 [5] = "qcom/aic200/uefi.elf", 196 [12] = "qcom/aic200/aic200-nsp.bin", 197 [23] = "qcom/aic200/aop.mbn", 198 [32] = "qcom/aic200/tz.mbn", 199 [33] = "qcom/aic200/hypvm.mbn", 200 [38] = "qcom/aic200/xbl_config.elf", 201 [39] = "qcom/aic200/aic200_abl.elf", 202 [40] = "qcom/aic200/apdp.mbn", 203 [41] = "qcom/aic200/devcfg.mbn", 204 [42] = "qcom/aic200/sec.elf", 205 [43] = "qcom/aic200/aic200-hlos.elf", 206 [49] = "qcom/aic200/shrm.elf", 207 [50] = "qcom/aic200/cpucp.elf", 208 [51] = "qcom/aic200/aop_devcfg.mbn", 209 [54] = "qcom/aic200/qupv3fw.elf", 210 [57] = "qcom/aic200/cpucp_dtbs.elf", 211 [62] = "qcom/aic200/uefi_dtbs.elf", 212 [63] = "qcom/aic200/xbl_ac_config.mbn", 213 [64] = "qcom/aic200/tz_ac_config.mbn", 214 [65] = "qcom/aic200/hyp_ac_config.mbn", 215 [66] = "qcom/aic200/pdp.elf", 216 [67] = "qcom/aic200/pdp_cdb.elf", 217 [68] = "qcom/aic200/sdi.mbn", 218 [69] = "qcom/aic200/dcd.mbn", 219 [73] = "qcom/aic200/gearvm.mbn", 220 [74] = "qcom/aic200/sti.bin", 221 [76] = "qcom/aic200/tz_qti_config.mbn", 222 [78] = "qcom/aic200/pvs.bin", 223 }; 224 225 static bool is_streaming(struct sahara_context *context) 226 { 227 return !context->non_streaming; 228 } 229 230 static int sahara_find_image(struct sahara_context *context, u32 image_id) 231 { 232 int ret; 233 234 if (image_id == context->active_image_id) 235 return 0; 236 237 if (context->active_image_id != SAHARA_IMAGE_ID_NONE) { 238 dev_err(&context->mhi_dev->dev, "image id %d is not valid as %d is active\n", 239 image_id, context->active_image_id); 240 return -EINVAL; 241 } 242 243 if (image_id >= context->table_size || !context->image_table[image_id]) { 244 dev_err(&context->mhi_dev->dev, "request for unknown image: %d\n", image_id); 245 return -EINVAL; 246 } 247 248 /* 249 * This image might be optional. The device may continue without it. 250 * Only the device knows. Suppress error messages that could suggest an 251 * a problem when we were actually able to continue. 252 */ 253 ret = firmware_request_nowarn(&context->firmware, 254 context->image_table[image_id], 255 &context->mhi_dev->dev); 256 if (ret) { 257 dev_dbg(&context->mhi_dev->dev, "request for image id %d / file %s failed %d\n", 258 image_id, context->image_table[image_id], ret); 259 return ret; 260 } 261 262 context->active_image_id = image_id; 263 264 return 0; 265 } 266 267 static void sahara_release_image(struct sahara_context *context) 268 { 269 if (context->active_image_id != SAHARA_IMAGE_ID_NONE) 270 release_firmware(context->firmware); 271 context->active_image_id = SAHARA_IMAGE_ID_NONE; 272 } 273 274 static void sahara_send_reset(struct sahara_context *context) 275 { 276 int ret; 277 278 context->is_mem_dump_mode = false; 279 context->read_data_offset = 0; 280 context->read_data_length = 0; 281 282 context->tx[0]->cmd = cpu_to_le32(SAHARA_RESET_CMD); 283 context->tx[0]->length = cpu_to_le32(SAHARA_RESET_LENGTH); 284 285 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 286 SAHARA_RESET_LENGTH, MHI_EOT); 287 if (ret) 288 dev_err(&context->mhi_dev->dev, "Unable to send reset response %d\n", ret); 289 } 290 291 static void sahara_hello(struct sahara_context *context) 292 { 293 int ret; 294 295 dev_dbg(&context->mhi_dev->dev, 296 "HELLO cmd received. length:%d version:%d version_compat:%d max_length:%d mode:%d\n", 297 le32_to_cpu(context->rx->length), 298 le32_to_cpu(context->rx->hello.version), 299 le32_to_cpu(context->rx->hello.version_compat), 300 le32_to_cpu(context->rx->hello.max_length), 301 le32_to_cpu(context->rx->hello.mode)); 302 303 if (le32_to_cpu(context->rx->length) != SAHARA_HELLO_LENGTH) { 304 dev_err(&context->mhi_dev->dev, "Malformed hello packet - length %d\n", 305 le32_to_cpu(context->rx->length)); 306 return; 307 } 308 if (le32_to_cpu(context->rx->hello.version) != SAHARA_VERSION) { 309 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - version %d\n", 310 le32_to_cpu(context->rx->hello.version)); 311 return; 312 } 313 314 if (le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_PENDING && 315 le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_IMAGE_TX_COMPLETE && 316 le32_to_cpu(context->rx->hello.mode) != SAHARA_MODE_MEMORY_DEBUG) { 317 dev_err(&context->mhi_dev->dev, "Unsupported hello packet - mode %d\n", 318 le32_to_cpu(context->rx->hello.mode)); 319 return; 320 } 321 322 context->tx[0]->cmd = cpu_to_le32(SAHARA_HELLO_RESP_CMD); 323 context->tx[0]->length = cpu_to_le32(SAHARA_HELLO_LENGTH); 324 context->tx[0]->hello_resp.version = cpu_to_le32(SAHARA_VERSION); 325 context->tx[0]->hello_resp.version_compat = cpu_to_le32(SAHARA_VERSION); 326 context->tx[0]->hello_resp.status = cpu_to_le32(SAHARA_SUCCESS); 327 context->tx[0]->hello_resp.mode = context->rx->hello_resp.mode; 328 329 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 330 SAHARA_HELLO_LENGTH, MHI_EOT); 331 if (ret) 332 dev_err(&context->mhi_dev->dev, "Unable to send hello response %d\n", ret); 333 } 334 335 static int read_data_helper(struct sahara_context *context, int buf_index) 336 { 337 enum mhi_flags mhi_flag; 338 u32 pkt_data_len; 339 int ret; 340 341 pkt_data_len = min(context->read_data_length, SAHARA_PACKET_MAX_SIZE); 342 343 memcpy(context->tx[buf_index], 344 &context->firmware->data[context->read_data_offset], 345 pkt_data_len); 346 347 context->read_data_offset += pkt_data_len; 348 context->read_data_length -= pkt_data_len; 349 350 if (is_streaming(context) || !context->read_data_length) 351 mhi_flag = MHI_EOT; 352 else 353 mhi_flag = MHI_CHAIN; 354 355 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, 356 context->tx[buf_index], pkt_data_len, mhi_flag); 357 if (ret) { 358 dev_err(&context->mhi_dev->dev, "Unable to send read_data response %d\n", ret); 359 return ret; 360 } 361 362 return 0; 363 } 364 365 static void sahara_read_data(struct sahara_context *context) 366 { 367 u32 image_id, data_offset, data_len; 368 int ret; 369 int i; 370 371 dev_dbg(&context->mhi_dev->dev, 372 "READ_DATA cmd received. length:%d image:%d offset:%d data_length:%d\n", 373 le32_to_cpu(context->rx->length), 374 le32_to_cpu(context->rx->read_data.image), 375 le32_to_cpu(context->rx->read_data.offset), 376 le32_to_cpu(context->rx->read_data.length)); 377 378 if (le32_to_cpu(context->rx->length) != SAHARA_READ_DATA_LENGTH) { 379 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - length %d\n", 380 le32_to_cpu(context->rx->length)); 381 return; 382 } 383 384 image_id = le32_to_cpu(context->rx->read_data.image); 385 data_offset = le32_to_cpu(context->rx->read_data.offset); 386 data_len = le32_to_cpu(context->rx->read_data.length); 387 388 ret = sahara_find_image(context, image_id); 389 if (ret) { 390 sahara_send_reset(context); 391 return; 392 } 393 394 /* 395 * Image is released when the device is done with it via 396 * SAHARA_END_OF_IMAGE_CMD. sahara_send_reset() will either cause the 397 * device to retry the operation with a modification, or decide to be 398 * done with the image and trigger SAHARA_END_OF_IMAGE_CMD. 399 * release_image() is called from SAHARA_END_OF_IMAGE_CMD. processing 400 * and is not needed here on error. 401 */ 402 403 if (context->non_streaming && data_len > SAHARA_TRANSFER_MAX_SIZE) { 404 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data len %d exceeds max xfer size %d\n", 405 data_len, SAHARA_TRANSFER_MAX_SIZE); 406 sahara_send_reset(context); 407 return; 408 } 409 410 if (data_offset >= context->firmware->size) { 411 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d exceeds file size %zu\n", 412 data_offset, context->firmware->size); 413 sahara_send_reset(context); 414 return; 415 } 416 417 if (size_add(data_offset, data_len) > context->firmware->size) { 418 dev_err(&context->mhi_dev->dev, "Malformed read_data packet - data offset %d and length %d exceeds file size %zu\n", 419 data_offset, data_len, context->firmware->size); 420 sahara_send_reset(context); 421 return; 422 } 423 424 context->read_data_offset = data_offset; 425 context->read_data_length = data_len; 426 427 if (is_streaming(context)) { 428 schedule_work(&context->read_data_work); 429 return; 430 } 431 432 for (i = 0; i < SAHARA_NUM_TX_BUF && context->read_data_length; ++i) { 433 ret = read_data_helper(context, i); 434 if (ret) 435 break; 436 } 437 } 438 439 static void sahara_end_of_image(struct sahara_context *context) 440 { 441 int ret; 442 443 dev_dbg(&context->mhi_dev->dev, 444 "END_OF_IMAGE cmd received. length:%d image:%d status:%d\n", 445 le32_to_cpu(context->rx->length), 446 le32_to_cpu(context->rx->end_of_image.image), 447 le32_to_cpu(context->rx->end_of_image.status)); 448 449 if (le32_to_cpu(context->rx->length) != SAHARA_END_OF_IMAGE_LENGTH) { 450 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - length %d\n", 451 le32_to_cpu(context->rx->length)); 452 return; 453 } 454 455 if (context->active_image_id != SAHARA_IMAGE_ID_NONE && 456 le32_to_cpu(context->rx->end_of_image.image) != context->active_image_id) { 457 dev_err(&context->mhi_dev->dev, "Malformed end_of_image packet - image %d is not the active image\n", 458 le32_to_cpu(context->rx->end_of_image.image)); 459 return; 460 } 461 462 sahara_release_image(context); 463 464 if (le32_to_cpu(context->rx->end_of_image.status)) 465 return; 466 467 context->tx[0]->cmd = cpu_to_le32(SAHARA_DONE_CMD); 468 context->tx[0]->length = cpu_to_le32(SAHARA_DONE_LENGTH); 469 470 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 471 SAHARA_DONE_LENGTH, MHI_EOT); 472 if (ret) 473 dev_dbg(&context->mhi_dev->dev, "Unable to send done response %d\n", ret); 474 } 475 476 static void sahara_memory_debug64(struct sahara_context *context) 477 { 478 int ret; 479 480 dev_dbg(&context->mhi_dev->dev, 481 "MEMORY DEBUG64 cmd received. length:%d table_address:%#llx table_length:%#llx\n", 482 le32_to_cpu(context->rx->length), 483 le64_to_cpu(context->rx->memory_debug64.table_address), 484 le64_to_cpu(context->rx->memory_debug64.table_length)); 485 486 if (le32_to_cpu(context->rx->length) != SAHARA_MEM_DEBUG64_LENGTH) { 487 dev_err(&context->mhi_dev->dev, "Malformed memory debug64 packet - length %d\n", 488 le32_to_cpu(context->rx->length)); 489 return; 490 } 491 492 context->dump_table_address = le64_to_cpu(context->rx->memory_debug64.table_address); 493 context->dump_table_length = le64_to_cpu(context->rx->memory_debug64.table_length); 494 495 if (context->dump_table_length % sizeof(struct sahara_debug_table_entry64) != 0 || 496 !context->dump_table_length) { 497 dev_err(&context->mhi_dev->dev, "Malformed memory debug64 packet - table length %lld\n", 498 context->dump_table_length); 499 return; 500 } 501 502 /* 503 * From this point, the protocol flips. We make memory_read requests to 504 * the device, and the device responds with the raw data. If the device 505 * has an error, it will send an End of Image command. First we need to 506 * request the memory dump table so that we know where all the pieces 507 * of the dump are that we can consume. 508 */ 509 510 context->is_mem_dump_mode = true; 511 512 /* 513 * Assume that the table is smaller than our MTU so that we can read it 514 * in one shot. The spec does not put an upper limit on the table, but 515 * no known device will exceed this. 516 */ 517 if (context->dump_table_length > SAHARA_PACKET_MAX_SIZE) { 518 dev_err(&context->mhi_dev->dev, "Memory dump table length %lld exceeds supported size. Discarding dump\n", 519 context->dump_table_length); 520 sahara_send_reset(context); 521 return; 522 } 523 524 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD); 525 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH); 526 context->tx[0]->memory_read64.memory_address = cpu_to_le64(context->dump_table_address); 527 context->tx[0]->memory_read64.memory_length = cpu_to_le64(context->dump_table_length); 528 529 context->rx_size_requested = context->dump_table_length; 530 531 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 532 SAHARA_MEM_READ64_LENGTH, MHI_EOT); 533 if (ret) 534 dev_err(&context->mhi_dev->dev, "Unable to send read for dump table %d\n", ret); 535 } 536 537 static void sahara_processing(struct work_struct *work) 538 { 539 struct sahara_context *context = container_of(work, struct sahara_context, fw_work); 540 int ret; 541 542 switch (le32_to_cpu(context->rx->cmd)) { 543 case SAHARA_HELLO_CMD: 544 sahara_hello(context); 545 break; 546 case SAHARA_READ_DATA_CMD: 547 sahara_read_data(context); 548 break; 549 case SAHARA_END_OF_IMAGE_CMD: 550 sahara_end_of_image(context); 551 break; 552 case SAHARA_DONE_RESP_CMD: 553 /* Intentional do nothing as we don't need to exit an app */ 554 break; 555 case SAHARA_RESET_RESP_CMD: 556 /* Intentional do nothing as we don't need to exit an app */ 557 break; 558 case SAHARA_MEM_DEBUG64_CMD: 559 sahara_memory_debug64(context); 560 break; 561 default: 562 dev_err(&context->mhi_dev->dev, "Unknown command %d\n", 563 le32_to_cpu(context->rx->cmd)); 564 break; 565 } 566 567 ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE, context->rx, 568 SAHARA_PACKET_MAX_SIZE, MHI_EOT); 569 if (ret) 570 dev_err(&context->mhi_dev->dev, "Unable to requeue rx buf %d\n", ret); 571 } 572 573 static void sahara_parse_dump_table(struct sahara_context *context) 574 { 575 struct sahara_dump_table_entry *image_out_table; 576 struct sahara_debug_table_entry64 *dev_table; 577 struct sahara_memory_dump_meta_v1 *dump_meta; 578 u64 table_nents; 579 u64 dump_length; 580 u64 mul_bytes; 581 int ret; 582 u64 i; 583 584 table_nents = context->dump_table_length / sizeof(*dev_table); 585 context->dump_images_left = table_nents; 586 dump_length = 0; 587 588 dev_table = (struct sahara_debug_table_entry64 *)(context->rx); 589 for (i = 0; i < table_nents; ++i) { 590 /* Do not trust the device, ensure the strings are terminated */ 591 dev_table[i].description[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0; 592 dev_table[i].filename[SAHARA_TABLE_ENTRY_STR_LEN - 1] = 0; 593 594 if (check_add_overflow(dump_length, 595 le64_to_cpu(dev_table[i].length), 596 &dump_length)) { 597 /* Discard the dump */ 598 sahara_send_reset(context); 599 return; 600 } 601 602 dev_dbg(&context->mhi_dev->dev, 603 "Memory dump table entry %lld type: %lld address: %#llx length: %#llx description: \"%s\" filename \"%s\"\n", 604 i, 605 le64_to_cpu(dev_table[i].type), 606 le64_to_cpu(dev_table[i].address), 607 le64_to_cpu(dev_table[i].length), 608 dev_table[i].description, 609 dev_table[i].filename); 610 } 611 612 if (check_add_overflow(dump_length, (u64)sizeof(*dump_meta), &dump_length)) { 613 /* Discard the dump */ 614 sahara_send_reset(context); 615 return; 616 } 617 if (check_mul_overflow((u64)sizeof(*image_out_table), table_nents, &mul_bytes)) { 618 /* Discard the dump */ 619 sahara_send_reset(context); 620 return; 621 } 622 if (check_add_overflow(dump_length, mul_bytes, &dump_length)) { 623 /* Discard the dump */ 624 sahara_send_reset(context); 625 return; 626 } 627 628 context->mem_dump_sz = dump_length; 629 context->mem_dump = vzalloc(dump_length); 630 if (!context->mem_dump) { 631 /* Discard the dump */ 632 sahara_send_reset(context); 633 return; 634 } 635 636 /* Populate the dump metadata and table for userspace */ 637 dump_meta = context->mem_dump; 638 dump_meta->magic = SAHARA_DUMP_V1_MAGIC; 639 dump_meta->version = SAHARA_DUMP_V1_VER; 640 dump_meta->dump_size = dump_length; 641 dump_meta->table_size = context->dump_table_length; 642 643 image_out_table = context->mem_dump + sizeof(*dump_meta); 644 for (i = 0; i < table_nents; ++i) { 645 image_out_table[i].type = le64_to_cpu(dev_table[i].type); 646 image_out_table[i].address = le64_to_cpu(dev_table[i].address); 647 image_out_table[i].length = le64_to_cpu(dev_table[i].length); 648 strscpy(image_out_table[i].description, dev_table[i].description, 649 SAHARA_TABLE_ENTRY_STR_LEN); 650 strscpy(image_out_table[i].filename, 651 dev_table[i].filename, 652 SAHARA_TABLE_ENTRY_STR_LEN); 653 } 654 655 context->mem_dump_freespace = &image_out_table[i]; 656 657 /* Done parsing the table, switch to image dump mode */ 658 context->dump_table_length = 0; 659 660 /* Request the first chunk of the first image */ 661 context->dump_image = &image_out_table[0]; 662 dump_length = min_t(u64, context->dump_image->length, SAHARA_READ_MAX_SIZE); 663 /* Avoid requesting EOI sized data so that we can identify errors */ 664 if (dump_length == SAHARA_END_OF_IMAGE_LENGTH) 665 dump_length = SAHARA_END_OF_IMAGE_LENGTH / 2; 666 667 context->dump_image_offset = dump_length; 668 669 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD); 670 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH); 671 context->tx[0]->memory_read64.memory_address = cpu_to_le64(context->dump_image->address); 672 context->tx[0]->memory_read64.memory_length = cpu_to_le64(dump_length); 673 674 context->rx_size_requested = dump_length; 675 676 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 677 SAHARA_MEM_READ64_LENGTH, MHI_EOT); 678 if (ret) 679 dev_err(&context->mhi_dev->dev, "Unable to send read for dump content %d\n", ret); 680 } 681 682 static void sahara_parse_dump_image(struct sahara_context *context) 683 { 684 u64 dump_length; 685 int ret; 686 687 memcpy(context->mem_dump_freespace, context->rx, context->rx_size); 688 context->mem_dump_freespace += context->rx_size; 689 690 if (context->dump_image_offset >= context->dump_image->length) { 691 /* Need to move to next image */ 692 context->dump_image++; 693 context->dump_images_left--; 694 context->dump_image_offset = 0; 695 696 if (!context->dump_images_left) { 697 /* Dump done */ 698 dev_coredumpv(context->mhi_dev->mhi_cntrl->cntrl_dev, 699 context->mem_dump, 700 context->mem_dump_sz, 701 GFP_KERNEL); 702 context->mem_dump = NULL; 703 sahara_send_reset(context); 704 return; 705 } 706 } 707 708 /* Get next image chunk */ 709 dump_length = context->dump_image->length - context->dump_image_offset; 710 dump_length = min_t(u64, dump_length, SAHARA_READ_MAX_SIZE); 711 /* Avoid requesting EOI sized data so that we can identify errors */ 712 if (dump_length == SAHARA_END_OF_IMAGE_LENGTH) 713 dump_length = SAHARA_END_OF_IMAGE_LENGTH / 2; 714 715 context->tx[0]->cmd = cpu_to_le32(SAHARA_MEM_READ64_CMD); 716 context->tx[0]->length = cpu_to_le32(SAHARA_MEM_READ64_LENGTH); 717 context->tx[0]->memory_read64.memory_address = 718 cpu_to_le64(context->dump_image->address + context->dump_image_offset); 719 context->tx[0]->memory_read64.memory_length = cpu_to_le64(dump_length); 720 721 context->dump_image_offset += dump_length; 722 context->rx_size_requested = dump_length; 723 724 ret = mhi_queue_buf(context->mhi_dev, DMA_TO_DEVICE, context->tx[0], 725 SAHARA_MEM_READ64_LENGTH, MHI_EOT); 726 if (ret) 727 dev_err(&context->mhi_dev->dev, 728 "Unable to send read for dump content %d\n", ret); 729 } 730 731 static void sahara_dump_processing(struct work_struct *work) 732 { 733 struct sahara_context *context = container_of(work, struct sahara_context, dump_work); 734 int ret; 735 736 /* 737 * We should get the expected raw data, but if the device has an error 738 * it is supposed to send EOI with an error code. 739 */ 740 if (context->rx_size != context->rx_size_requested && 741 context->rx_size != SAHARA_END_OF_IMAGE_LENGTH) { 742 dev_err(&context->mhi_dev->dev, 743 "Unexpected response to read_data. Expected size: %#zx got: %#zx\n", 744 context->rx_size_requested, 745 context->rx_size); 746 goto error; 747 } 748 749 if (context->rx_size == SAHARA_END_OF_IMAGE_LENGTH && 750 le32_to_cpu(context->rx->cmd) == SAHARA_END_OF_IMAGE_CMD) { 751 dev_err(&context->mhi_dev->dev, 752 "Unexpected EOI response to read_data. Status: %d\n", 753 le32_to_cpu(context->rx->end_of_image.status)); 754 goto error; 755 } 756 757 if (context->rx_size == SAHARA_END_OF_IMAGE_LENGTH && 758 le32_to_cpu(context->rx->cmd) != SAHARA_END_OF_IMAGE_CMD) { 759 dev_err(&context->mhi_dev->dev, 760 "Invalid EOI response to read_data. CMD: %d\n", 761 le32_to_cpu(context->rx->cmd)); 762 goto error; 763 } 764 765 /* 766 * Need to know if we received the dump table, or part of a dump image. 767 * Since we get raw data, we cannot tell from the data itself. Instead, 768 * we use the stored dump_table_length, which we zero after we read and 769 * process the entire table. 770 */ 771 if (context->dump_table_length) 772 sahara_parse_dump_table(context); 773 else 774 sahara_parse_dump_image(context); 775 776 ret = mhi_queue_buf(context->mhi_dev, DMA_FROM_DEVICE, context->rx, 777 SAHARA_PACKET_MAX_SIZE, MHI_EOT); 778 if (ret) 779 dev_err(&context->mhi_dev->dev, "Unable to requeue rx buf %d\n", ret); 780 781 return; 782 783 error: 784 vfree(context->mem_dump); 785 context->mem_dump = NULL; 786 sahara_send_reset(context); 787 } 788 789 static void sahara_read_data_processing(struct work_struct *work) 790 { 791 struct sahara_context *context = container_of(work, struct sahara_context, read_data_work); 792 793 read_data_helper(context, 0); 794 } 795 796 static int sahara_mhi_probe(struct mhi_device *mhi_dev, const struct mhi_device_id *id) 797 { 798 struct sahara_context *context; 799 int ret; 800 int i; 801 802 context = devm_kzalloc(&mhi_dev->dev, sizeof(*context), GFP_KERNEL); 803 if (!context) 804 return -ENOMEM; 805 806 context->rx = devm_kzalloc(&mhi_dev->dev, SAHARA_PACKET_MAX_SIZE, GFP_KERNEL); 807 if (!context->rx) 808 return -ENOMEM; 809 810 if (!strcmp(mhi_dev->mhi_cntrl->name, "AIC200")) { 811 context->image_table = aic200_image_table; 812 context->table_size = ARRAY_SIZE(aic200_image_table); 813 } else { 814 context->image_table = aic100_image_table; 815 context->table_size = ARRAY_SIZE(aic100_image_table); 816 context->non_streaming = true; 817 } 818 819 /* 820 * There are two firmware implementations for READ_DATA handling. 821 * The older "SBL" implementation defines a Sahara transfer size, and 822 * expects that the response is a single transport transfer. If the 823 * FW wants to transfer a file that is larger than the transfer size, 824 * the FW will issue multiple READ_DATA commands. For this 825 * implementation, we need to allocate enough buffers to contain the 826 * entire Sahara transfer size. 827 * 828 * The newer "XBL" implementation does not define a maximum transfer 829 * size and instead expects the data to be streamed over using the 830 * transport level MTU. The FW will issue a single READ_DATA command 831 * of whatever size, and consume multiple transport level transfers 832 * until the expected amount of data is consumed. For this 833 * implementation we only need a single buffer of the transport MTU 834 * but we'll need to be able to use it multiple times for a single 835 * READ_DATA request. 836 * 837 * AIC100 is the SBL implementation and defines SAHARA_TRANSFER_MAX_SIZE 838 * and we need 9x SAHARA_PACKET_MAX_SIZE to cover that. We can use 839 * MHI_CHAIN to link multiple buffers into a single transfer but the 840 * remote side will not consume the buffers until it sees an EOT, thus 841 * we need to allocate enough buffers to put in the tx fifo to cover an 842 * entire READ_DATA request of the max size. 843 * 844 * AIC200 is the XBL implementation, and so a single buffer will work. 845 */ 846 for (i = 0; i < SAHARA_NUM_TX_BUF; ++i) { 847 context->tx[i] = devm_kzalloc(&mhi_dev->dev, 848 SAHARA_PACKET_MAX_SIZE, 849 GFP_KERNEL); 850 if (!context->tx[i]) 851 return -ENOMEM; 852 if (is_streaming(context)) 853 break; 854 } 855 856 context->mhi_dev = mhi_dev; 857 INIT_WORK(&context->fw_work, sahara_processing); 858 INIT_WORK(&context->dump_work, sahara_dump_processing); 859 INIT_WORK(&context->read_data_work, sahara_read_data_processing); 860 861 context->active_image_id = SAHARA_IMAGE_ID_NONE; 862 dev_set_drvdata(&mhi_dev->dev, context); 863 864 ret = mhi_prepare_for_transfer(mhi_dev); 865 if (ret) 866 return ret; 867 868 ret = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, context->rx, SAHARA_PACKET_MAX_SIZE, MHI_EOT); 869 if (ret) { 870 mhi_unprepare_from_transfer(mhi_dev); 871 return ret; 872 } 873 874 return 0; 875 } 876 877 static void sahara_mhi_remove(struct mhi_device *mhi_dev) 878 { 879 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev); 880 881 cancel_work_sync(&context->fw_work); 882 cancel_work_sync(&context->dump_work); 883 vfree(context->mem_dump); 884 sahara_release_image(context); 885 mhi_unprepare_from_transfer(mhi_dev); 886 } 887 888 static void sahara_mhi_ul_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result) 889 { 890 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev); 891 892 if (!mhi_result->transaction_status && context->read_data_length && is_streaming(context)) 893 schedule_work(&context->read_data_work); 894 } 895 896 static void sahara_mhi_dl_xfer_cb(struct mhi_device *mhi_dev, struct mhi_result *mhi_result) 897 { 898 struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev); 899 900 if (!mhi_result->transaction_status) { 901 context->rx_size = mhi_result->bytes_xferd; 902 if (context->is_mem_dump_mode) 903 schedule_work(&context->dump_work); 904 else 905 schedule_work(&context->fw_work); 906 } 907 908 } 909 910 static const struct mhi_device_id sahara_mhi_match_table[] = { 911 { .chan = "QAIC_SAHARA", }, 912 {}, 913 }; 914 915 static struct mhi_driver sahara_mhi_driver = { 916 .id_table = sahara_mhi_match_table, 917 .remove = sahara_mhi_remove, 918 .probe = sahara_mhi_probe, 919 .ul_xfer_cb = sahara_mhi_ul_xfer_cb, 920 .dl_xfer_cb = sahara_mhi_dl_xfer_cb, 921 .driver = { 922 .name = "sahara", 923 }, 924 }; 925 926 int sahara_register(void) 927 { 928 return mhi_driver_register(&sahara_mhi_driver); 929 } 930 931 void sahara_unregister(void) 932 { 933 mhi_driver_unregister(&sahara_mhi_driver); 934 } 935