1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * ISHTP firmware loader function 4 * 5 * Copyright (c) 2024, Intel Corporation. 6 * 7 * This module implements the functionality to load the main ISH firmware from the host, starting 8 * with the Lunar Lake generation. It leverages a new method that enhances space optimization and 9 * flexibility by dividing the ISH firmware into a bootloader and main firmware. 10 * 11 * Please refer to the [Documentation](Documentation/hid/intel-ish-hid.rst) for the details on 12 * flows. 13 * 14 * Additionally, address potential error scenarios to ensure graceful failure handling. 15 * - Firmware Image Not Found: 16 * Occurs when `request_firmware()` cannot locate the firmware image. The ISH firmware will 17 * remain in a state awaiting firmware loading from the host, with no further action from 18 * the ISHTP driver. 19 * Recovery: Re-insmod the ISH drivers allows for a retry of the firmware loading from the host. 20 * 21 * - DMA Buffer Allocation Failure: 22 * This happens if allocating a DMA buffer during `prepare_dma_bufs()` fails. The ISH firmware 23 * will stay in a waiting state, and the ISHTP driver will release any allocated DMA buffers and 24 * firmware without further actions. 25 * Recovery: Re-insmod the ISH drivers allows for a retry of the firmware loading from the host. 26 * 27 * - Incorrect Firmware Image: 28 * Using an incorrect firmware image will initiate the firmware loading process but will 29 * eventually be refused by the ISH firmware after three unsuccessful attempts, indicated by 30 * returning an error code. The ISHTP driver will stop attempting after three tries. 31 * Recovery: A platform reset is required to retry firmware loading from the host. 32 */ 33 34 #define dev_fmt(fmt) "ISH loader: " fmt 35 36 #include <linux/cacheflush.h> 37 #include <linux/container_of.h> 38 #include <linux/crc32.h> 39 #include <linux/dev_printk.h> 40 #include <linux/dma-mapping.h> 41 #include <linux/dmi.h> 42 #include <linux/errno.h> 43 #include <linux/firmware.h> 44 #include <linux/gfp_types.h> 45 #include <linux/math.h> 46 #include <linux/module.h> 47 #include <linux/pfn.h> 48 #include <linux/sprintf.h> 49 #include <linux/string.h> 50 #include <linux/types.h> 51 #include <linux/wait.h> 52 53 #include "hbm.h" 54 #include "loader.h" 55 56 /** 57 * loader_write_message() - Write a message to the ISHTP device 58 * @dev: The ISHTP device 59 * @buf: The buffer containing the message 60 * @len: The length of the message 61 * 62 * Return: 0 on success, negative error code on failure 63 */ 64 static int loader_write_message(struct ishtp_device *dev, void *buf, int len) 65 { 66 struct ishtp_msg_hdr ishtp_hdr = { 67 .fw_addr = ISHTP_LOADER_CLIENT_ADDR, 68 .length = len, 69 .msg_complete = 1, 70 }; 71 72 dev->fw_loader_received = false; 73 74 return ishtp_write_message(dev, &ishtp_hdr, buf); 75 } 76 77 /** 78 * loader_xfer_cmd() - Transfer a command to the ISHTP device 79 * @dev: The ISHTP device 80 * @req: The request buffer 81 * @req_len: The length of the request 82 * @resp: The response buffer 83 * @resp_len: The length of the response 84 * 85 * Return: 0 on success, negative error code on failure 86 */ 87 static int loader_xfer_cmd(struct ishtp_device *dev, void *req, int req_len, 88 void *resp, int resp_len) 89 { 90 union loader_msg_header req_hdr; 91 union loader_msg_header resp_hdr; 92 struct device *devc = dev->devc; 93 int rv; 94 95 dev->fw_loader_rx_buf = resp; 96 dev->fw_loader_rx_size = resp_len; 97 98 rv = loader_write_message(dev, req, req_len); 99 req_hdr.val32 = le32_to_cpup(req); 100 101 if (rv < 0) { 102 dev_err(devc, "write cmd %u failed:%d\n", req_hdr.command, rv); 103 return rv; 104 } 105 106 /* Wait the ACK */ 107 wait_event_interruptible_timeout(dev->wait_loader_recvd_msg, dev->fw_loader_received, 108 ISHTP_LOADER_TIMEOUT); 109 resp_hdr.val32 = le32_to_cpup(resp); 110 dev->fw_loader_rx_size = 0; 111 dev->fw_loader_rx_buf = NULL; 112 if (!dev->fw_loader_received) { 113 dev_err(devc, "wait response of cmd %u timeout\n", req_hdr.command); 114 return -ETIMEDOUT; 115 } 116 117 if (!resp_hdr.is_response) { 118 dev_err(devc, "not a response for %u\n", req_hdr.command); 119 return -EBADMSG; 120 } 121 122 if (req_hdr.command != resp_hdr.command) { 123 dev_err(devc, "unexpected cmd response %u:%u\n", req_hdr.command, 124 resp_hdr.command); 125 return -EBADMSG; 126 } 127 128 if (resp_hdr.status) { 129 dev_err(devc, "cmd %u failed %u\n", req_hdr.command, resp_hdr.status); 130 return -EIO; 131 } 132 133 return 0; 134 } 135 136 /** 137 * release_dma_bufs() - Release the DMA buffer for transferring firmware fragments 138 * @dev: The ISHTP device 139 * @fragment: The ISHTP firmware fragment descriptor 140 * @dma_bufs: The array of DMA fragment buffers 141 * @fragment_size: The size of a single DMA fragment 142 */ 143 static void release_dma_bufs(struct ishtp_device *dev, 144 struct loader_xfer_dma_fragment *fragment, 145 void **dma_bufs, u32 fragment_size) 146 { 147 dma_addr_t dma_addr; 148 int i; 149 150 for (i = 0; i < FRAGMENT_MAX_NUM; i++) { 151 if (dma_bufs[i]) { 152 dma_addr = le64_to_cpu(fragment->fragment_tbl[i].ddr_adrs); 153 dma_free_coherent(dev->devc, fragment_size, dma_bufs[i], dma_addr); 154 dma_bufs[i] = NULL; 155 } 156 } 157 } 158 159 /** 160 * prepare_dma_bufs() - Prepare the DMA buffer for transferring firmware fragments 161 * @dev: The ISHTP device 162 * @ish_fw: The ISH firmware 163 * @fragment: The ISHTP firmware fragment descriptor 164 * @dma_bufs: The array of DMA fragment buffers 165 * @fragment_size: The size of a single DMA fragment 166 * @fragment_count: Number of fragments 167 * 168 * Return: 0 on success, negative error code on failure 169 */ 170 static int prepare_dma_bufs(struct ishtp_device *dev, 171 const struct firmware *ish_fw, 172 struct loader_xfer_dma_fragment *fragment, 173 void **dma_bufs, u32 fragment_size, u32 fragment_count) 174 { 175 dma_addr_t dma_addr; 176 u32 offset = 0; 177 u32 length; 178 int i; 179 180 for (i = 0; i < fragment_count && offset < ish_fw->size; i++) { 181 dma_bufs[i] = dma_alloc_coherent(dev->devc, fragment_size, &dma_addr, GFP_KERNEL); 182 if (!dma_bufs[i]) 183 return -ENOMEM; 184 185 fragment->fragment_tbl[i].ddr_adrs = cpu_to_le64(dma_addr); 186 length = clamp(ish_fw->size - offset, 0, fragment_size); 187 fragment->fragment_tbl[i].length = cpu_to_le32(length); 188 fragment->fragment_tbl[i].fw_off = cpu_to_le32(offset); 189 memcpy(dma_bufs[i], ish_fw->data + offset, length); 190 clflush_cache_range(dma_bufs[i], fragment_size); 191 192 offset += length; 193 } 194 195 return 0; 196 } 197 198 /* Patterns with PRODUCT_FAMILY */ 199 #define ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x_%08x.bin" 200 #define ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin" 201 #define ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin" 202 #define ISH_FW_FILE_VENDOR_FAMILY_FMT "intel/ish/ish_%s_%08x_%08x.bin" 203 204 #define ISH_FW_FILE_VENDOR_NAME_SKU_FMT "intel/ish/ish_%s_%08x_%08x_%08x.bin" 205 #define ISH_FW_FILE_VENDOR_SKU_FMT "intel/ish/ish_%s_%08x_%08x.bin" 206 #define ISH_FW_FILE_VENDOR_NAME_FMT "intel/ish/ish_%s_%08x_%08x.bin" 207 #define ISH_FW_FILE_VENDOR_FMT "intel/ish/ish_%s_%08x.bin" 208 #define ISH_FW_FILE_DEFAULT_FMT "intel/ish/ish_%s.bin" 209 210 #define ISH_FW_FILENAME_LEN_MAX 72 211 212 #define ISH_CRC_INIT (~0u) 213 #define ISH_CRC_XOROUT (~0u) 214 215 static int _request_ish_firmware(const struct firmware **firmware_p, 216 const char *name, struct device *dev) 217 { 218 int ret; 219 220 dev_dbg(dev, "Try to load firmware: %s\n", name); 221 ret = firmware_request_nowarn(firmware_p, name, dev); 222 if (!ret) 223 dev_info(dev, "load firmware: %s\n", name); 224 225 return ret; 226 } 227 228 /** 229 * request_ish_firmware() - Request and load the ISH firmware. 230 * @firmware_p: Pointer to the firmware image. 231 * @dev: Device for which firmware is being requested. 232 * 233 * This function attempts to load the Integrated Sensor Hub (ISH) firmware 234 * for the given device in the following order, prioritizing custom firmware 235 * with more precise matching patterns: 236 * 237 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_FAMILY_CRC32) 238 * _$(PRODUCT_NAME_CRC32)_${PRODUCT_SKU_CRC32}.bin 239 * 240 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_FAMILY_CRC32)_${PRODUCT_SKU_CRC32}.bin 241 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_FAMILY_CRC32)_$(PRODUCT_NAME_CRC32).bin 242 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_FAMILY_CRC32).bin 243 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_NAME_CRC32)_${PRODUCT_SKU_CRC32}.bin 244 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_${PRODUCT_SKU_CRC32}.bin 245 * ish_${fw_generation}_${SYS_VENDOR_CRC32}_$(PRODUCT_NAME_CRC32).bin 246 * ish_${fw_generation}_${SYS_VENDOR_CRC32}.bin 247 * ish_${fw_generation}.bin 248 * 249 * The driver will load the first matching firmware and skip the rest. If no 250 * matching firmware is found, it will proceed to the next pattern in the 251 * specified order. If all searches fail, the default Intel firmware, listed 252 * last in the order above, will be loaded. 253 * 254 * The firmware file name is constructed using CRC32 checksums of strings. 255 * This is done to create a valid file name that does not contain spaces 256 * or special characters which may be present in the original strings. 257 * 258 * The CRC-32 algorithm uses the following parameters: 259 * Poly: 0x04C11DB7 260 * Init: 0xFFFFFFFF 261 * RefIn: true 262 * RefOut: true 263 * XorOut: 0xFFFFFFFF 264 * 265 * Return: 0 on success, negative error code on failure. 266 */ 267 static int request_ish_firmware(const struct firmware **firmware_p, 268 struct device *dev) 269 { 270 const char *gen, *sys_vendor, *product_name, *product_sku; 271 const char *product_family; 272 struct ishtp_device *ishtp = dev_get_drvdata(dev); 273 u32 vendor_crc, name_crc, sku_crc, family_crc; 274 char filename[ISH_FW_FILENAME_LEN_MAX]; 275 int ret; 276 277 gen = ishtp->driver_data->fw_generation; 278 sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR); 279 product_name = dmi_get_system_info(DMI_PRODUCT_NAME); 280 product_sku = dmi_get_system_info(DMI_PRODUCT_SKU); 281 product_family = dmi_get_system_info(DMI_PRODUCT_FAMILY); 282 283 if (sys_vendor) 284 vendor_crc = crc32(ISH_CRC_INIT, sys_vendor, strlen(sys_vendor)) ^ ISH_CRC_XOROUT; 285 if (product_family) 286 family_crc = crc32(ISH_CRC_INIT, product_family, 287 strlen(product_family)) ^ ISH_CRC_XOROUT; 288 if (product_name) 289 name_crc = crc32(ISH_CRC_INIT, product_name, strlen(product_name)) ^ ISH_CRC_XOROUT; 290 if (product_sku) 291 sku_crc = crc32(ISH_CRC_INIT, product_sku, strlen(product_sku)) ^ ISH_CRC_XOROUT; 292 293 /* PRODUCT_FAMILY-extended matching */ 294 if (sys_vendor && product_family && product_name && product_sku) { 295 snprintf(filename, sizeof(filename), 296 ISH_FW_FILE_VENDOR_FAMILY_NAME_SKU_FMT, 297 gen, vendor_crc, family_crc, name_crc, sku_crc); 298 ret = _request_ish_firmware(firmware_p, filename, dev); 299 if (!ret) 300 return 0; 301 } 302 303 if (sys_vendor && product_family && product_sku) { 304 snprintf(filename, sizeof(filename), 305 ISH_FW_FILE_VENDOR_FAMILY_SKU_FMT, 306 gen, vendor_crc, family_crc, sku_crc); 307 ret = _request_ish_firmware(firmware_p, filename, dev); 308 if (!ret) 309 return 0; 310 } 311 312 if (sys_vendor && product_family && product_name) { 313 snprintf(filename, sizeof(filename), 314 ISH_FW_FILE_VENDOR_FAMILY_NAME_FMT, 315 gen, vendor_crc, family_crc, name_crc); 316 ret = _request_ish_firmware(firmware_p, filename, dev); 317 if (!ret) 318 return 0; 319 } 320 321 if (sys_vendor && product_family) { 322 snprintf(filename, sizeof(filename), 323 ISH_FW_FILE_VENDOR_FAMILY_FMT, 324 gen, vendor_crc, family_crc); 325 ret = _request_ish_firmware(firmware_p, filename, dev); 326 if (!ret) 327 return 0; 328 } 329 330 if (sys_vendor && product_name && product_sku) { 331 snprintf(filename, sizeof(filename), ISH_FW_FILE_VENDOR_NAME_SKU_FMT, gen, 332 vendor_crc, name_crc, sku_crc); 333 ret = _request_ish_firmware(firmware_p, filename, dev); 334 if (!ret) 335 return 0; 336 } 337 338 if (sys_vendor && product_sku) { 339 snprintf(filename, sizeof(filename), ISH_FW_FILE_VENDOR_SKU_FMT, gen, vendor_crc, 340 sku_crc); 341 ret = _request_ish_firmware(firmware_p, filename, dev); 342 if (!ret) 343 return 0; 344 } 345 346 if (sys_vendor && product_name) { 347 snprintf(filename, sizeof(filename), ISH_FW_FILE_VENDOR_NAME_FMT, gen, vendor_crc, 348 name_crc); 349 ret = _request_ish_firmware(firmware_p, filename, dev); 350 if (!ret) 351 return 0; 352 } 353 354 if (sys_vendor) { 355 snprintf(filename, sizeof(filename), ISH_FW_FILE_VENDOR_FMT, gen, vendor_crc); 356 ret = _request_ish_firmware(firmware_p, filename, dev); 357 if (!ret) 358 return 0; 359 } 360 361 snprintf(filename, sizeof(filename), ISH_FW_FILE_DEFAULT_FMT, gen); 362 return _request_ish_firmware(firmware_p, filename, dev); 363 } 364 365 static int copy_manifest(const struct firmware *fw, struct ish_global_manifest *manifest) 366 { 367 u32 offset; 368 369 for (offset = 0; offset + sizeof(*manifest) < fw->size; offset += ISH_MANIFEST_ALIGNMENT) { 370 memcpy(manifest, fw->data + offset, sizeof(*manifest)); 371 372 if (le32_to_cpu(manifest->sig_fourcc) == ISH_GLOBAL_SIG) 373 return 0; 374 } 375 376 return -1; 377 } 378 379 static void copy_ish_version(struct version_in_manifest *src, struct ish_version *dst) 380 { 381 dst->major = le16_to_cpu(src->major); 382 dst->minor = le16_to_cpu(src->minor); 383 dst->hotfix = le16_to_cpu(src->hotfix); 384 dst->build = le16_to_cpu(src->build); 385 } 386 387 /** 388 * ishtp_loader_work() - Load the ISHTP firmware 389 * @work: The work structure 390 * 391 * The ISH Loader attempts to load firmware by sending a series of commands 392 * to the ISH device. If a command fails to be acknowledged by the ISH device, 393 * the loader will retry sending the command, up to a maximum of 394 * ISHTP_LOADER_RETRY_TIMES. 395 * 396 * After the maximum number of retries has been reached without success, the 397 * ISH bootloader will return an error status code and will no longer respond 398 * to the driver's commands. This behavior indicates that the ISH Loader has 399 * encountered a critical error during the firmware loading process. 400 * 401 * In such a case, where the ISH bootloader is unresponsive after all retries 402 * have been exhausted, a platform reset is required to restore communication 403 * with the ISH device and to recover from this error state. 404 */ 405 void ishtp_loader_work(struct work_struct *work) 406 { 407 DEFINE_RAW_FLEX(struct loader_xfer_dma_fragment, fragment, fragment_tbl, FRAGMENT_MAX_NUM); 408 struct ishtp_device *dev = container_of(work, struct ishtp_device, work_fw_loader); 409 union loader_msg_header query_hdr = { .command = LOADER_CMD_XFER_QUERY, }; 410 union loader_msg_header start_hdr = { .command = LOADER_CMD_START, }; 411 union loader_msg_header fragment_hdr = { .command = LOADER_CMD_XFER_FRAGMENT, }; 412 struct loader_xfer_query query = { .header = cpu_to_le32(query_hdr.val32), }; 413 struct loader_start start = { .header = cpu_to_le32(start_hdr.val32), }; 414 union loader_recv_message recv_msg; 415 struct ish_global_manifest manifest; 416 const struct firmware *ish_fw; 417 void *dma_bufs[FRAGMENT_MAX_NUM] = {}; 418 u32 fragment_size; 419 u32 fragment_count; 420 int retry = ISHTP_LOADER_RETRY_TIMES; 421 int rv; 422 423 rv = request_ish_firmware(&ish_fw, dev->devc); 424 if (rv < 0) { 425 dev_err(dev->devc, "request ISH firmware failed:%d\n", rv); 426 return; 427 } 428 429 fragment->fragment.header = cpu_to_le32(fragment_hdr.val32); 430 fragment->fragment.xfer_mode = cpu_to_le32(LOADER_XFER_MODE_DMA); 431 fragment->fragment.is_last = cpu_to_le32(1); 432 fragment->fragment.size = cpu_to_le32(ish_fw->size); 433 /* Calculate the size of a single DMA fragment */ 434 fragment_size = PFN_ALIGN(DIV_ROUND_UP(ish_fw->size, FRAGMENT_MAX_NUM)); 435 /* Calculate the count of DMA fragments */ 436 fragment_count = DIV_ROUND_UP(ish_fw->size, fragment_size); 437 fragment->fragment_cnt = cpu_to_le32(fragment_count); 438 439 rv = prepare_dma_bufs(dev, ish_fw, fragment, dma_bufs, fragment_size, fragment_count); 440 if (rv) { 441 dev_err(dev->devc, "prepare DMA buffer failed.\n"); 442 goto out; 443 } 444 445 do { 446 query.image_size = cpu_to_le32(ish_fw->size); 447 rv = loader_xfer_cmd(dev, &query, sizeof(query), recv_msg.raw_data, 448 sizeof(struct loader_xfer_query_ack)); 449 if (rv) 450 continue; /* try again if failed */ 451 452 dev_dbg(dev->devc, "ISH Bootloader Version %u.%u.%u.%u\n", 453 recv_msg.query_ack.version_major, 454 recv_msg.query_ack.version_minor, 455 recv_msg.query_ack.version_hotfix, 456 recv_msg.query_ack.version_build); 457 458 rv = loader_xfer_cmd(dev, fragment, 459 struct_size(fragment, fragment_tbl, fragment_count), 460 recv_msg.raw_data, sizeof(struct loader_xfer_fragment_ack)); 461 if (rv) 462 continue; /* try again if failed */ 463 464 rv = loader_xfer_cmd(dev, &start, sizeof(start), recv_msg.raw_data, 465 sizeof(struct loader_start_ack)); 466 if (rv) 467 continue; /* try again if failed */ 468 469 dev_info(dev->devc, "firmware loaded. size:%zu\n", ish_fw->size); 470 if (!copy_manifest(ish_fw, &manifest)) { 471 copy_ish_version(&manifest.base_ver, &dev->base_ver); 472 copy_ish_version(&manifest.prj_ver, &dev->prj_ver); 473 dev_info(dev->devc, "FW base version: %u.%u.%u.%u\n", 474 dev->base_ver.major, dev->base_ver.minor, 475 dev->base_ver.hotfix, dev->base_ver.build); 476 dev_info(dev->devc, "FW project version: %u.%u.%u.%u\n", 477 dev->prj_ver.major, dev->prj_ver.minor, 478 dev->prj_ver.hotfix, dev->prj_ver.build); 479 } 480 break; 481 } while (--retry); 482 483 out: 484 release_dma_bufs(dev, fragment, dma_bufs, fragment_size); 485 release_firmware(ish_fw); 486 } 487