1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (c) 2018-2020, The Linux Foundation. All rights reserved. 4 * 5 */ 6 7 #include <linux/delay.h> 8 #include <linux/device.h> 9 #include <linux/dma-direction.h> 10 #include <linux/dma-mapping.h> 11 #include <linux/firmware.h> 12 #include <linux/interrupt.h> 13 #include <linux/list.h> 14 #include <linux/mhi.h> 15 #include <linux/module.h> 16 #include <linux/random.h> 17 #include <linux/slab.h> 18 #include <linux/wait.h> 19 #include "internal.h" 20 21 /* Setup RDDM vector table for RDDM transfer and program RXVEC */ 22 int mhi_rddm_prepare(struct mhi_controller *mhi_cntrl, 23 struct image_info *img_info) 24 { 25 struct mhi_buf *mhi_buf = img_info->mhi_buf; 26 struct bhi_vec_entry *bhi_vec = img_info->bhi_vec; 27 void __iomem *base = mhi_cntrl->bhie; 28 struct device *dev = &mhi_cntrl->mhi_dev->dev; 29 u32 sequence_id; 30 unsigned int i; 31 int ret; 32 33 for (i = 0; i < img_info->entries - 1; i++, mhi_buf++, bhi_vec++) { 34 bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); 35 bhi_vec->size = cpu_to_le64(mhi_buf->len); 36 } 37 38 dev_dbg(dev, "BHIe programming for RDDM\n"); 39 40 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECADDR_HIGH_OFFS, 41 upper_32_bits(mhi_buf->dma_addr)); 42 43 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECADDR_LOW_OFFS, 44 lower_32_bits(mhi_buf->dma_addr)); 45 46 mhi_write_reg(mhi_cntrl, base, BHIE_RXVECSIZE_OFFS, mhi_buf->len); 47 sequence_id = MHI_RANDOM_U32_NONZERO(BHIE_RXVECSTATUS_SEQNUM_BMSK); 48 49 ret = mhi_write_reg_field(mhi_cntrl, base, BHIE_RXVECDB_OFFS, 50 BHIE_RXVECDB_SEQNUM_BMSK, sequence_id); 51 if (ret) { 52 dev_err(dev, "Failed to write sequence ID for BHIE_RXVECDB\n"); 53 return ret; 54 } 55 56 dev_dbg(dev, "Address: %p and len: 0x%zx sequence: %u\n", 57 &mhi_buf->dma_addr, mhi_buf->len, sequence_id); 58 59 return 0; 60 } 61 62 /* Collect RDDM buffer during kernel panic */ 63 static int __mhi_download_rddm_in_panic(struct mhi_controller *mhi_cntrl) 64 { 65 int ret; 66 u32 rx_status; 67 enum mhi_ee_type ee; 68 const u32 delayus = 2000; 69 u32 retry = (mhi_cntrl->timeout_ms * 1000) / delayus; 70 const u32 rddm_timeout_us = 200000; 71 int rddm_retry = rddm_timeout_us / delayus; 72 void __iomem *base = mhi_cntrl->bhie; 73 struct device *dev = &mhi_cntrl->mhi_dev->dev; 74 75 dev_dbg(dev, "Entered with pm_state:%s dev_state:%s ee:%s\n", 76 to_mhi_pm_state_str(mhi_cntrl->pm_state), 77 mhi_state_str(mhi_cntrl->dev_state), 78 TO_MHI_EXEC_STR(mhi_cntrl->ee)); 79 80 /* 81 * This should only be executing during a kernel panic, we expect all 82 * other cores to shutdown while we're collecting RDDM buffer. After 83 * returning from this function, we expect the device to reset. 84 * 85 * Normally, we read/write pm_state only after grabbing the 86 * pm_lock, since we're in a panic, skipping it. Also there is no 87 * guarantee that this state change would take effect since 88 * we're setting it w/o grabbing pm_lock 89 */ 90 mhi_cntrl->pm_state = MHI_PM_LD_ERR_FATAL_DETECT; 91 /* update should take the effect immediately */ 92 smp_wmb(); 93 94 /* 95 * Make sure device is not already in RDDM. In case the device asserts 96 * and a kernel panic follows, device will already be in RDDM. 97 * Do not trigger SYS ERR again and proceed with waiting for 98 * image download completion. 99 */ 100 ee = mhi_get_exec_env(mhi_cntrl); 101 if (ee == MHI_EE_MAX) 102 goto error_exit_rddm; 103 104 if (ee != MHI_EE_RDDM) { 105 dev_dbg(dev, "Trigger device into RDDM mode using SYS ERR\n"); 106 mhi_set_mhi_state(mhi_cntrl, MHI_STATE_SYS_ERR); 107 108 dev_dbg(dev, "Waiting for device to enter RDDM\n"); 109 while (rddm_retry--) { 110 ee = mhi_get_exec_env(mhi_cntrl); 111 if (ee == MHI_EE_RDDM) 112 break; 113 114 udelay(delayus); 115 } 116 117 if (rddm_retry <= 0) { 118 /* Hardware reset so force device to enter RDDM */ 119 dev_dbg(dev, 120 "Did not enter RDDM, do a host req reset\n"); 121 mhi_soc_reset(mhi_cntrl); 122 udelay(delayus); 123 } 124 125 ee = mhi_get_exec_env(mhi_cntrl); 126 } 127 128 dev_dbg(dev, 129 "Waiting for RDDM image download via BHIe, current EE:%s\n", 130 TO_MHI_EXEC_STR(ee)); 131 132 while (retry--) { 133 ret = mhi_read_reg_field(mhi_cntrl, base, BHIE_RXVECSTATUS_OFFS, 134 BHIE_RXVECSTATUS_STATUS_BMSK, &rx_status); 135 if (ret) 136 return -EIO; 137 138 if (rx_status == BHIE_RXVECSTATUS_STATUS_XFER_COMPL) 139 return 0; 140 141 udelay(delayus); 142 } 143 144 ee = mhi_get_exec_env(mhi_cntrl); 145 ret = mhi_read_reg(mhi_cntrl, base, BHIE_RXVECSTATUS_OFFS, &rx_status); 146 147 dev_err(dev, "RXVEC_STATUS: 0x%x\n", rx_status); 148 149 error_exit_rddm: 150 dev_err(dev, "RDDM transfer failed. Current EE: %s\n", 151 TO_MHI_EXEC_STR(ee)); 152 153 return -EIO; 154 } 155 156 /* Download RDDM image from device */ 157 int mhi_download_rddm_image(struct mhi_controller *mhi_cntrl, bool in_panic) 158 { 159 void __iomem *base = mhi_cntrl->bhie; 160 struct device *dev = &mhi_cntrl->mhi_dev->dev; 161 u32 rx_status; 162 163 if (in_panic) 164 return __mhi_download_rddm_in_panic(mhi_cntrl); 165 166 dev_dbg(dev, "Waiting for RDDM image download via BHIe\n"); 167 168 /* Wait for the image download to complete */ 169 wait_event_timeout(mhi_cntrl->state_event, 170 mhi_read_reg_field(mhi_cntrl, base, 171 BHIE_RXVECSTATUS_OFFS, 172 BHIE_RXVECSTATUS_STATUS_BMSK, 173 &rx_status) || rx_status, 174 msecs_to_jiffies(mhi_cntrl->timeout_ms)); 175 176 return (rx_status == BHIE_RXVECSTATUS_STATUS_XFER_COMPL) ? 0 : -EIO; 177 } 178 EXPORT_SYMBOL_GPL(mhi_download_rddm_image); 179 180 static void mhi_fw_load_error_dump(struct mhi_controller *mhi_cntrl) 181 { 182 struct device *dev = &mhi_cntrl->mhi_dev->dev; 183 rwlock_t *pm_lock = &mhi_cntrl->pm_lock; 184 void __iomem *base = mhi_cntrl->bhi; 185 int ret, i; 186 u32 val; 187 struct { 188 char *name; 189 u32 offset; 190 } error_reg[] = { 191 { "ERROR_CODE", BHI_ERRCODE }, 192 { "ERROR_DBG1", BHI_ERRDBG1 }, 193 { "ERROR_DBG2", BHI_ERRDBG2 }, 194 { "ERROR_DBG3", BHI_ERRDBG3 }, 195 { NULL }, 196 }; 197 198 read_lock_bh(pm_lock); 199 if (MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) { 200 for (i = 0; error_reg[i].name; i++) { 201 ret = mhi_read_reg(mhi_cntrl, base, error_reg[i].offset, &val); 202 if (ret) 203 break; 204 dev_err(dev, "Reg: %s value: 0x%x\n", error_reg[i].name, val); 205 } 206 } 207 read_unlock_bh(pm_lock); 208 } 209 210 static int mhi_fw_load_bhie(struct mhi_controller *mhi_cntrl, 211 const struct mhi_buf *mhi_buf) 212 { 213 void __iomem *base = mhi_cntrl->bhie; 214 struct device *dev = &mhi_cntrl->mhi_dev->dev; 215 rwlock_t *pm_lock = &mhi_cntrl->pm_lock; 216 u32 tx_status, sequence_id; 217 int ret; 218 219 read_lock_bh(pm_lock); 220 if (!MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) { 221 read_unlock_bh(pm_lock); 222 return -EIO; 223 } 224 225 sequence_id = MHI_RANDOM_U32_NONZERO(BHIE_TXVECSTATUS_SEQNUM_BMSK); 226 dev_dbg(dev, "Starting image download via BHIe. Sequence ID: %u\n", 227 sequence_id); 228 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECADDR_HIGH_OFFS, 229 upper_32_bits(mhi_buf->dma_addr)); 230 231 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECADDR_LOW_OFFS, 232 lower_32_bits(mhi_buf->dma_addr)); 233 234 mhi_write_reg(mhi_cntrl, base, BHIE_TXVECSIZE_OFFS, mhi_buf->len); 235 236 ret = mhi_write_reg_field(mhi_cntrl, base, BHIE_TXVECDB_OFFS, 237 BHIE_TXVECDB_SEQNUM_BMSK, sequence_id); 238 read_unlock_bh(pm_lock); 239 240 if (ret) 241 return ret; 242 243 /* Wait for the image download to complete */ 244 ret = wait_event_timeout(mhi_cntrl->state_event, 245 MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) || 246 mhi_read_reg_field(mhi_cntrl, base, 247 BHIE_TXVECSTATUS_OFFS, 248 BHIE_TXVECSTATUS_STATUS_BMSK, 249 &tx_status) || tx_status, 250 msecs_to_jiffies(mhi_cntrl->timeout_ms)); 251 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) || 252 tx_status != BHIE_TXVECSTATUS_STATUS_XFER_COMPL) 253 return -EIO; 254 255 return (!ret) ? -ETIMEDOUT : 0; 256 } 257 258 static int mhi_fw_load_bhi(struct mhi_controller *mhi_cntrl, 259 const struct mhi_buf *mhi_buf) 260 { 261 struct device *dev = &mhi_cntrl->mhi_dev->dev; 262 rwlock_t *pm_lock = &mhi_cntrl->pm_lock; 263 void __iomem *base = mhi_cntrl->bhi; 264 u32 tx_status, session_id; 265 int ret; 266 267 read_lock_bh(pm_lock); 268 if (!MHI_REG_ACCESS_VALID(mhi_cntrl->pm_state)) { 269 read_unlock_bh(pm_lock); 270 goto invalid_pm_state; 271 } 272 273 session_id = MHI_RANDOM_U32_NONZERO(BHI_TXDB_SEQNUM_BMSK); 274 dev_dbg(dev, "Starting image download via BHI. Session ID: %u\n", 275 session_id); 276 mhi_write_reg(mhi_cntrl, base, BHI_STATUS, 0); 277 mhi_write_reg(mhi_cntrl, base, BHI_IMGADDR_HIGH, upper_32_bits(mhi_buf->dma_addr)); 278 mhi_write_reg(mhi_cntrl, base, BHI_IMGADDR_LOW, lower_32_bits(mhi_buf->dma_addr)); 279 mhi_write_reg(mhi_cntrl, base, BHI_IMGSIZE, mhi_buf->len); 280 mhi_write_reg(mhi_cntrl, base, BHI_IMGTXDB, session_id); 281 read_unlock_bh(pm_lock); 282 283 /* Wait for the image download to complete */ 284 ret = wait_event_timeout(mhi_cntrl->state_event, 285 MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state) || 286 mhi_read_reg_field(mhi_cntrl, base, BHI_STATUS, 287 BHI_STATUS_MASK, &tx_status) || tx_status, 288 msecs_to_jiffies(mhi_cntrl->timeout_ms)); 289 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state)) 290 goto invalid_pm_state; 291 292 if (tx_status == BHI_STATUS_ERROR) { 293 dev_err(dev, "Image transfer failed\n"); 294 mhi_fw_load_error_dump(mhi_cntrl); 295 goto invalid_pm_state; 296 } 297 298 return (!ret) ? -ETIMEDOUT : 0; 299 300 invalid_pm_state: 301 302 return -EIO; 303 } 304 305 static void mhi_free_bhi_buffer(struct mhi_controller *mhi_cntrl, 306 struct image_info *image_info) 307 { 308 struct mhi_buf *mhi_buf = image_info->mhi_buf; 309 310 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len, mhi_buf->buf, mhi_buf->dma_addr); 311 kfree(image_info->mhi_buf); 312 kfree(image_info); 313 } 314 315 void mhi_free_bhie_table(struct mhi_controller *mhi_cntrl, 316 struct image_info *image_info) 317 { 318 int i; 319 struct mhi_buf *mhi_buf = image_info->mhi_buf; 320 321 for (i = 0; i < image_info->entries; i++, mhi_buf++) 322 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len, 323 mhi_buf->buf, mhi_buf->dma_addr); 324 325 kfree(image_info->mhi_buf); 326 kfree(image_info); 327 } 328 329 static int mhi_alloc_bhi_buffer(struct mhi_controller *mhi_cntrl, 330 struct image_info **image_info, 331 size_t alloc_size) 332 { 333 struct image_info *img_info; 334 struct mhi_buf *mhi_buf; 335 336 img_info = kzalloc_obj(*img_info); 337 if (!img_info) 338 return -ENOMEM; 339 340 /* Allocate memory for entry */ 341 img_info->mhi_buf = kzalloc_obj(*img_info->mhi_buf); 342 if (!img_info->mhi_buf) 343 goto error_alloc_mhi_buf; 344 345 /* Allocate and populate vector table */ 346 mhi_buf = img_info->mhi_buf; 347 348 mhi_buf->len = alloc_size; 349 mhi_buf->buf = dma_alloc_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len, 350 &mhi_buf->dma_addr, GFP_KERNEL); 351 if (!mhi_buf->buf) 352 goto error_alloc_segment; 353 354 img_info->bhi_vec = NULL; 355 img_info->entries = 1; 356 *image_info = img_info; 357 358 return 0; 359 360 error_alloc_segment: 361 kfree(mhi_buf); 362 error_alloc_mhi_buf: 363 kfree(img_info); 364 365 return -ENOMEM; 366 } 367 368 int mhi_alloc_bhie_table(struct mhi_controller *mhi_cntrl, 369 struct image_info **image_info, 370 size_t alloc_size) 371 { 372 size_t seg_size = mhi_cntrl->seg_len; 373 int segments = DIV_ROUND_UP(alloc_size, seg_size) + 1; 374 int i; 375 struct image_info *img_info; 376 struct mhi_buf *mhi_buf; 377 378 img_info = kzalloc_obj(*img_info); 379 if (!img_info) 380 return -ENOMEM; 381 382 /* Allocate memory for entries */ 383 img_info->mhi_buf = kzalloc_objs(*img_info->mhi_buf, segments); 384 if (!img_info->mhi_buf) 385 goto error_alloc_mhi_buf; 386 387 /* Allocate and populate vector table */ 388 mhi_buf = img_info->mhi_buf; 389 for (i = 0; i < segments; i++, mhi_buf++) { 390 size_t vec_size = seg_size; 391 392 /* Vector table is the last entry */ 393 if (i == segments - 1) 394 vec_size = sizeof(struct bhi_vec_entry) * i; 395 396 mhi_buf->len = vec_size; 397 mhi_buf->buf = dma_alloc_coherent(mhi_cntrl->cntrl_dev, 398 vec_size, &mhi_buf->dma_addr, 399 GFP_KERNEL); 400 if (!mhi_buf->buf) 401 goto error_alloc_segment; 402 } 403 404 img_info->bhi_vec = img_info->mhi_buf[segments - 1].buf; 405 img_info->entries = segments; 406 *image_info = img_info; 407 408 return 0; 409 410 error_alloc_segment: 411 for (--i, --mhi_buf; i >= 0; i--, mhi_buf--) 412 dma_free_coherent(mhi_cntrl->cntrl_dev, mhi_buf->len, 413 mhi_buf->buf, mhi_buf->dma_addr); 414 kfree(img_info->mhi_buf); 415 416 error_alloc_mhi_buf: 417 kfree(img_info); 418 419 return -ENOMEM; 420 } 421 422 static void mhi_firmware_copy_bhie(struct mhi_controller *mhi_cntrl, 423 const u8 *buf, size_t remainder, 424 struct image_info *img_info) 425 { 426 size_t to_cpy; 427 struct mhi_buf *mhi_buf = img_info->mhi_buf; 428 struct bhi_vec_entry *bhi_vec = img_info->bhi_vec; 429 430 while (remainder) { 431 to_cpy = min(remainder, mhi_buf->len); 432 memcpy(mhi_buf->buf, buf, to_cpy); 433 bhi_vec->dma_addr = cpu_to_le64(mhi_buf->dma_addr); 434 bhi_vec->size = cpu_to_le64(to_cpy); 435 436 buf += to_cpy; 437 remainder -= to_cpy; 438 bhi_vec++; 439 mhi_buf++; 440 } 441 } 442 443 static enum mhi_fw_load_type mhi_fw_load_type_get(const struct mhi_controller *mhi_cntrl) 444 { 445 if (mhi_cntrl->fbc_download) { 446 return MHI_FW_LOAD_FBC; 447 } else { 448 if (mhi_cntrl->seg_len) 449 return MHI_FW_LOAD_BHIE; 450 else 451 return MHI_FW_LOAD_BHI; 452 } 453 } 454 455 static int mhi_load_image_bhi(struct mhi_controller *mhi_cntrl, const u8 *fw_data, size_t size) 456 { 457 struct image_info *image; 458 int ret; 459 460 ret = mhi_alloc_bhi_buffer(mhi_cntrl, &image, size); 461 if (ret) 462 return ret; 463 464 /* Load the firmware into BHI vec table */ 465 memcpy(image->mhi_buf->buf, fw_data, size); 466 467 ret = mhi_fw_load_bhi(mhi_cntrl, &image->mhi_buf[image->entries - 1]); 468 mhi_free_bhi_buffer(mhi_cntrl, image); 469 470 return ret; 471 } 472 473 static int mhi_load_image_bhie(struct mhi_controller *mhi_cntrl, const u8 *fw_data, size_t size) 474 { 475 struct image_info *image; 476 int ret; 477 478 ret = mhi_alloc_bhie_table(mhi_cntrl, &image, size); 479 if (ret) 480 return ret; 481 482 mhi_firmware_copy_bhie(mhi_cntrl, fw_data, size, image); 483 484 ret = mhi_fw_load_bhie(mhi_cntrl, &image->mhi_buf[image->entries - 1]); 485 mhi_free_bhie_table(mhi_cntrl, image); 486 487 return ret; 488 } 489 490 void mhi_fw_load_handler(struct mhi_controller *mhi_cntrl) 491 { 492 const struct firmware *firmware = NULL; 493 struct device *dev = &mhi_cntrl->mhi_dev->dev; 494 enum mhi_fw_load_type fw_load_type; 495 enum mhi_pm_state new_state; 496 const char *fw_name; 497 const u8 *fw_data; 498 size_t size, fw_sz; 499 int ret; 500 501 if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state)) { 502 dev_err(dev, "Device MHI is not in valid state\n"); 503 return; 504 } 505 506 /* save hardware info from BHI */ 507 ret = mhi_read_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_SERIALNU, 508 &mhi_cntrl->serial_number); 509 if (ret) 510 dev_err(dev, "Could not capture serial number via BHI\n"); 511 512 /* wait for ready on pass through or any other execution environment */ 513 if (!MHI_FW_LOAD_CAPABLE(mhi_cntrl->ee)) 514 goto fw_load_ready_state; 515 516 fw_name = (mhi_cntrl->ee == MHI_EE_EDL) ? 517 mhi_cntrl->edl_image : mhi_cntrl->fw_image; 518 519 /* check if the driver has already provided the firmware data */ 520 if (!fw_name && mhi_cntrl->fbc_download && 521 mhi_cntrl->fw_data && mhi_cntrl->fw_sz) { 522 if (!mhi_cntrl->sbl_size) { 523 dev_err(dev, "fw_data provided but no sbl_size\n"); 524 goto error_fw_load; 525 } 526 527 size = mhi_cntrl->sbl_size; 528 fw_data = mhi_cntrl->fw_data; 529 fw_sz = mhi_cntrl->fw_sz; 530 goto skip_req_fw; 531 } 532 533 if (!fw_name || (mhi_cntrl->fbc_download && (!mhi_cntrl->sbl_size || 534 !mhi_cntrl->seg_len))) { 535 dev_err(dev, 536 "No firmware image defined or !sbl_size || !seg_len\n"); 537 goto error_fw_load; 538 } 539 540 ret = request_firmware(&firmware, fw_name, dev); 541 if (ret) { 542 dev_err(dev, "Error loading firmware: %d\n", ret); 543 goto error_fw_load; 544 } 545 546 size = (mhi_cntrl->fbc_download) ? mhi_cntrl->sbl_size : firmware->size; 547 548 /* SBL size provided is maximum size, not necessarily the image size */ 549 if (size > firmware->size) 550 size = firmware->size; 551 552 fw_data = firmware->data; 553 fw_sz = firmware->size; 554 555 skip_req_fw: 556 fw_load_type = mhi_fw_load_type_get(mhi_cntrl); 557 if (fw_load_type == MHI_FW_LOAD_BHIE) 558 ret = mhi_load_image_bhie(mhi_cntrl, fw_data, size); 559 else 560 ret = mhi_load_image_bhi(mhi_cntrl, fw_data, size); 561 562 /* Error or in EDL mode, we're done */ 563 if (ret) { 564 dev_err(dev, "MHI did not load image over BHI%s, ret: %d\n", 565 fw_load_type == MHI_FW_LOAD_BHIE ? "e" : "", 566 ret); 567 release_firmware(firmware); 568 goto error_fw_load; 569 } 570 571 /* Wait for ready since EDL image was loaded */ 572 if (fw_name && fw_name == mhi_cntrl->edl_image) { 573 release_firmware(firmware); 574 goto fw_load_ready_state; 575 } 576 577 write_lock_irq(&mhi_cntrl->pm_lock); 578 mhi_cntrl->dev_state = MHI_STATE_RESET; 579 write_unlock_irq(&mhi_cntrl->pm_lock); 580 581 /* 582 * If we're doing fbc, populate vector tables while 583 * device transitioning into MHI READY state 584 */ 585 if (fw_load_type == MHI_FW_LOAD_FBC) { 586 /* 587 * Some FW combine two separate ELF images (SBL + WLAN FW) in a single 588 * file. Hence, check for the existence of the second ELF header after 589 * SBL. If present, load the second image separately. 590 */ 591 if (!memcmp(fw_data + mhi_cntrl->sbl_size, ELFMAG, SELFMAG)) { 592 fw_data += mhi_cntrl->sbl_size; 593 fw_sz -= mhi_cntrl->sbl_size; 594 } 595 596 ret = mhi_alloc_bhie_table(mhi_cntrl, &mhi_cntrl->fbc_image, fw_sz); 597 if (ret) { 598 release_firmware(firmware); 599 goto error_fw_load; 600 } 601 602 /* Load the firmware into BHIE vec table */ 603 mhi_firmware_copy_bhie(mhi_cntrl, fw_data, fw_sz, mhi_cntrl->fbc_image); 604 } 605 606 release_firmware(firmware); 607 608 fw_load_ready_state: 609 /* Transitioning into MHI RESET->READY state */ 610 ret = mhi_ready_state_transition(mhi_cntrl); 611 if (ret) { 612 dev_err(dev, "MHI did not enter READY state\n"); 613 goto error_ready_state; 614 } 615 616 dev_info(dev, "Wait for device to enter SBL or Mission mode\n"); 617 return; 618 619 error_ready_state: 620 if (mhi_cntrl->fbc_image) { 621 mhi_free_bhie_table(mhi_cntrl, mhi_cntrl->fbc_image); 622 mhi_cntrl->fbc_image = NULL; 623 } 624 625 error_fw_load: 626 write_lock_irq(&mhi_cntrl->pm_lock); 627 new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); 628 write_unlock_irq(&mhi_cntrl->pm_lock); 629 if (new_state == MHI_PM_FW_DL_ERR) 630 wake_up_all(&mhi_cntrl->state_event); 631 } 632 633 int mhi_download_amss_image(struct mhi_controller *mhi_cntrl) 634 { 635 struct image_info *image_info = mhi_cntrl->fbc_image; 636 struct device *dev = &mhi_cntrl->mhi_dev->dev; 637 enum mhi_pm_state new_state; 638 int ret; 639 640 if (!image_info) 641 return -EIO; 642 643 ret = mhi_fw_load_bhie(mhi_cntrl, 644 /* Vector table is the last entry */ 645 &image_info->mhi_buf[image_info->entries - 1]); 646 if (ret) { 647 dev_err(dev, "MHI did not load AMSS, ret:%d\n", ret); 648 write_lock_irq(&mhi_cntrl->pm_lock); 649 new_state = mhi_tryset_pm_state(mhi_cntrl, MHI_PM_FW_DL_ERR); 650 write_unlock_irq(&mhi_cntrl->pm_lock); 651 if (new_state == MHI_PM_FW_DL_ERR) 652 wake_up_all(&mhi_cntrl->state_event); 653 } 654 655 return ret; 656 } 657