1 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause 2 /* 3 * Copyright(c) 2020-2025 Intel Corporation 4 */ 5 6 #include "iwl-drv.h" 7 #include "pnvm.h" 8 #include "iwl-prph.h" 9 #include "iwl-io.h" 10 #include "fw/api/commands.h" 11 #include "fw/api/nvm-reg.h" 12 #include "fw/api/alive.h" 13 #include "fw/uefi.h" 14 15 #define IWL_PNVM_REDUCED_CAP_BIT BIT(25) 16 17 struct iwl_pnvm_section { 18 __le32 offset; 19 const u8 data[]; 20 } __packed; 21 22 static bool iwl_pnvm_complete_fn(struct iwl_notif_wait_data *notif_wait, 23 struct iwl_rx_packet *pkt, void *data) 24 { 25 struct iwl_trans *trans = (struct iwl_trans *)data; 26 struct iwl_pnvm_init_complete_ntfy *pnvm_ntf = (void *)pkt->data; 27 28 IWL_DEBUG_FW(trans, 29 "PNVM complete notification received with status 0x%0x\n", 30 le32_to_cpu(pnvm_ntf->status)); 31 32 return true; 33 } 34 35 static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data, 36 size_t len, 37 struct iwl_pnvm_image *pnvm_data) 38 { 39 const struct iwl_ucode_tlv *tlv; 40 u32 sha1 = 0; 41 u16 mac_type = 0, rf_id = 0; 42 bool hw_match = false; 43 44 IWL_DEBUG_FW(trans, "Handling PNVM section\n"); 45 46 memset(pnvm_data, 0, sizeof(*pnvm_data)); 47 48 while (len >= sizeof(*tlv)) { 49 u32 tlv_len, tlv_type; 50 51 len -= sizeof(*tlv); 52 tlv = (const void *)data; 53 54 tlv_len = le32_to_cpu(tlv->length); 55 tlv_type = le32_to_cpu(tlv->type); 56 57 if (len < tlv_len) { 58 IWL_ERR(trans, "invalid TLV len: %zd/%u\n", 59 len, tlv_len); 60 return -EINVAL; 61 } 62 63 data += sizeof(*tlv); 64 65 switch (tlv_type) { 66 case IWL_UCODE_TLV_PNVM_VERSION: 67 if (tlv_len < sizeof(__le32)) { 68 IWL_DEBUG_FW(trans, 69 "Invalid size for IWL_UCODE_TLV_PNVM_VERSION (expected %zd, got %d)\n", 70 sizeof(__le32), tlv_len); 71 break; 72 } 73 74 sha1 = le32_to_cpup((const __le32 *)data); 75 76 IWL_DEBUG_FW(trans, 77 "Got IWL_UCODE_TLV_PNVM_VERSION %0x\n", 78 sha1); 79 pnvm_data->version = sha1; 80 break; 81 case IWL_UCODE_TLV_HW_TYPE: 82 if (tlv_len < 2 * sizeof(__le16)) { 83 IWL_DEBUG_FW(trans, 84 "Invalid size for IWL_UCODE_TLV_HW_TYPE (expected %zd, got %d)\n", 85 2 * sizeof(__le16), tlv_len); 86 break; 87 } 88 89 if (hw_match) 90 break; 91 92 mac_type = le16_to_cpup((const __le16 *)data); 93 rf_id = le16_to_cpup((const __le16 *)(data + sizeof(__le16))); 94 95 IWL_DEBUG_FW(trans, 96 "Got IWL_UCODE_TLV_HW_TYPE mac_type 0x%0x rf_id 0x%0x\n", 97 mac_type, rf_id); 98 99 if (mac_type == CSR_HW_REV_TYPE(trans->info.hw_rev) && 100 rf_id == CSR_HW_RFID_TYPE(trans->info.hw_rf_id)) 101 hw_match = true; 102 break; 103 case IWL_UCODE_TLV_SEC_RT: { 104 const struct iwl_pnvm_section *section = (const void *)data; 105 u32 data_len = tlv_len - sizeof(*section); 106 107 IWL_DEBUG_FW(trans, 108 "Got IWL_UCODE_TLV_SEC_RT len %d\n", 109 tlv_len); 110 111 /* TODO: remove, this is a deprecated separator */ 112 if (le32_to_cpup((const __le32 *)data) == 0xddddeeee) { 113 IWL_DEBUG_FW(trans, "Ignoring separator.\n"); 114 break; 115 } 116 117 if (pnvm_data->n_chunks == IPC_DRAM_MAP_ENTRY_NUM_MAX) { 118 IWL_DEBUG_FW(trans, 119 "too many payloads to allocate in DRAM.\n"); 120 return -EINVAL; 121 } 122 123 IWL_DEBUG_FW(trans, "Adding data (size %d)\n", 124 data_len); 125 126 pnvm_data->chunks[pnvm_data->n_chunks].data = section->data; 127 pnvm_data->chunks[pnvm_data->n_chunks].len = data_len; 128 pnvm_data->n_chunks++; 129 130 break; 131 } 132 case IWL_UCODE_TLV_MEM_DESC: 133 if (iwl_uefi_handle_tlv_mem_desc(trans, data, tlv_len, 134 pnvm_data)) 135 return -EINVAL; 136 break; 137 case IWL_UCODE_TLV_PNVM_SKU: 138 IWL_DEBUG_FW(trans, 139 "New PNVM section started, stop parsing.\n"); 140 goto done; 141 default: 142 IWL_DEBUG_FW(trans, "Found TLV 0x%0x, len %d\n", 143 tlv_type, tlv_len); 144 break; 145 } 146 147 len -= ALIGN(tlv_len, 4); 148 data += ALIGN(tlv_len, 4); 149 } 150 151 done: 152 if (!hw_match) { 153 IWL_DEBUG_FW(trans, 154 "HW mismatch, skipping PNVM section (need mac_type 0x%x rf_id 0x%x)\n", 155 CSR_HW_REV_TYPE(trans->info.hw_rev), 156 CSR_HW_RFID_TYPE(trans->info.hw_rf_id)); 157 return -ENOENT; 158 } 159 160 if (!pnvm_data->n_chunks) { 161 IWL_DEBUG_FW(trans, "Empty PNVM, skipping.\n"); 162 return -ENOENT; 163 } 164 165 return 0; 166 } 167 168 static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data, 169 size_t len, 170 struct iwl_pnvm_image *pnvm_data, 171 __le32 sku_id[3]) 172 { 173 const struct iwl_ucode_tlv *tlv; 174 175 IWL_DEBUG_FW(trans, "Parsing PNVM file\n"); 176 177 while (len >= sizeof(*tlv)) { 178 u32 tlv_len, tlv_type; 179 u32 rf_type; 180 181 len -= sizeof(*tlv); 182 tlv = (const void *)data; 183 184 tlv_len = le32_to_cpu(tlv->length); 185 tlv_type = le32_to_cpu(tlv->type); 186 187 if (len < tlv_len) { 188 IWL_ERR(trans, "invalid TLV len: %zd/%u\n", 189 len, tlv_len); 190 return -EINVAL; 191 } 192 193 if (tlv_type == IWL_UCODE_TLV_PNVM_SKU) { 194 const struct iwl_sku_id *tlv_sku_id = 195 (const void *)(data + sizeof(*tlv)); 196 197 IWL_DEBUG_FW(trans, 198 "Got IWL_UCODE_TLV_PNVM_SKU len %d\n", 199 tlv_len); 200 IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n", 201 le32_to_cpu(tlv_sku_id->data[0]), 202 le32_to_cpu(tlv_sku_id->data[1]), 203 le32_to_cpu(tlv_sku_id->data[2])); 204 205 data += sizeof(*tlv) + ALIGN(tlv_len, 4); 206 len -= ALIGN(tlv_len, 4); 207 208 trans->reduced_cap_sku = false; 209 rf_type = CSR_HW_RFID_TYPE(trans->info.hw_rf_id); 210 if ((sku_id[0] & cpu_to_le32(IWL_PNVM_REDUCED_CAP_BIT)) && 211 rf_type == IWL_CFG_RF_TYPE_FM) 212 trans->reduced_cap_sku = true; 213 214 IWL_DEBUG_FW(trans, 215 "Reduced SKU device %d\n", 216 trans->reduced_cap_sku); 217 218 if (sku_id[0] == tlv_sku_id->data[0] && 219 sku_id[1] == tlv_sku_id->data[1] && 220 sku_id[2] == tlv_sku_id->data[2]) { 221 int ret; 222 223 ret = iwl_pnvm_handle_section(trans, data, len, 224 pnvm_data); 225 if (!ret) 226 return 0; 227 } else { 228 IWL_DEBUG_FW(trans, "SKU ID didn't match!\n"); 229 } 230 } else { 231 data += sizeof(*tlv) + ALIGN(tlv_len, 4); 232 len -= ALIGN(tlv_len, 4); 233 } 234 } 235 236 return -ENOENT; 237 } 238 239 static int iwl_pnvm_get_from_fs(struct iwl_trans *trans, u8 **data, size_t *len) 240 { 241 const struct firmware *pnvm; 242 char pnvm_name[MAX_PNVM_NAME]; 243 size_t new_len; 244 int ret; 245 246 iwl_pnvm_get_fs_name(trans, pnvm_name, sizeof(pnvm_name)); 247 248 ret = firmware_request_nowarn(&pnvm, pnvm_name, trans->dev); 249 if (ret) { 250 IWL_DEBUG_FW(trans, "PNVM file %s not found %d\n", 251 pnvm_name, ret); 252 return ret; 253 } 254 255 new_len = pnvm->size; 256 *data = kvmemdup(pnvm->data, pnvm->size, GFP_KERNEL); 257 release_firmware(pnvm); 258 259 if (!*data) 260 return -ENOMEM; 261 262 *len = new_len; 263 264 return 0; 265 } 266 267 static u8 *iwl_get_pnvm_image(struct iwl_trans *trans_p, size_t *len, 268 __le32 sku_id[3]) 269 { 270 struct pnvm_sku_package *package; 271 u8 *image = NULL; 272 273 /* Get PNVM from BIOS for non-Intel SKU */ 274 if (sku_id[2]) { 275 package = iwl_uefi_get_pnvm(trans_p, len); 276 if (!IS_ERR_OR_NULL(package)) { 277 if (*len >= sizeof(*package)) { 278 /* we need only the data */ 279 *len -= sizeof(*package); 280 image = kvmemdup(package->data, 281 *len, GFP_KERNEL); 282 } 283 /* 284 * free package regardless of whether kmemdup 285 * succeeded 286 */ 287 kfree(package); 288 if (image) 289 return image; 290 } 291 } 292 293 /* If it's not available, or for Intel SKU, try from the filesystem */ 294 if (iwl_pnvm_get_from_fs(trans_p, &image, len)) 295 return NULL; 296 return image; 297 } 298 299 static void 300 iwl_pnvm_load_pnvm_to_trans(struct iwl_trans *trans, 301 const struct iwl_ucode_capabilities *capa, 302 __le32 sku_id[3]) 303 { 304 struct iwl_pnvm_image *pnvm_data = NULL; 305 u8 *data = NULL; 306 size_t length; 307 int ret; 308 309 /* failed to get/parse the image in the past, no use trying again */ 310 if (trans->fail_to_parse_pnvm_image) 311 return; 312 313 if (trans->pnvm_loaded) 314 goto set; 315 316 data = iwl_get_pnvm_image(trans, &length, sku_id); 317 if (!data) { 318 trans->fail_to_parse_pnvm_image = true; 319 return; 320 } 321 322 pnvm_data = kzalloc(sizeof(*pnvm_data), GFP_KERNEL); 323 if (!pnvm_data) 324 goto free; 325 326 ret = iwl_pnvm_parse(trans, data, length, pnvm_data, sku_id); 327 if (ret) { 328 trans->fail_to_parse_pnvm_image = true; 329 goto free; 330 } 331 332 ret = iwl_trans_load_pnvm(trans, pnvm_data, capa); 333 if (ret) 334 goto free; 335 IWL_INFO(trans, "loaded PNVM version %08x\n", pnvm_data->version); 336 337 set: 338 iwl_trans_set_pnvm(trans, capa); 339 free: 340 kvfree(data); 341 kfree(pnvm_data); 342 } 343 344 static void 345 iwl_pnvm_load_reduce_power_to_trans(struct iwl_trans *trans, 346 const struct iwl_ucode_capabilities *capa, 347 __le32 sku_id[3]) 348 { 349 struct iwl_pnvm_image *pnvm_data = NULL; 350 u8 *data = NULL; 351 size_t length; 352 int ret; 353 354 if (trans->failed_to_load_reduce_power_image) 355 return; 356 357 if (trans->reduce_power_loaded) 358 goto set; 359 360 data = iwl_uefi_get_reduced_power(trans, &length); 361 if (IS_ERR(data)) { 362 trans->failed_to_load_reduce_power_image = true; 363 return; 364 } 365 366 pnvm_data = kzalloc(sizeof(*pnvm_data), GFP_KERNEL); 367 if (!pnvm_data) 368 goto free; 369 370 ret = iwl_uefi_reduce_power_parse(trans, data, length, pnvm_data, 371 sku_id); 372 if (ret) { 373 trans->failed_to_load_reduce_power_image = true; 374 goto free; 375 } 376 377 ret = iwl_trans_load_reduce_power(trans, pnvm_data, capa); 378 if (ret) { 379 IWL_DEBUG_FW(trans, 380 "Failed to load reduce power table %d\n", 381 ret); 382 trans->failed_to_load_reduce_power_image = true; 383 goto free; 384 } 385 386 set: 387 iwl_trans_set_reduce_power(trans, capa); 388 free: 389 kfree(data); 390 kfree(pnvm_data); 391 } 392 393 int iwl_pnvm_load(struct iwl_trans *trans, 394 struct iwl_notif_wait_data *notif_wait, 395 const struct iwl_ucode_capabilities *capa, 396 __le32 sku_id[3]) 397 { 398 struct iwl_notification_wait pnvm_wait; 399 static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP, 400 PNVM_INIT_COMPLETE_NTFY) }; 401 402 /* if the SKU_ID is empty, there's nothing to do */ 403 if (!sku_id[0] && !sku_id[1] && !sku_id[2]) 404 return 0; 405 406 iwl_pnvm_load_pnvm_to_trans(trans, capa, sku_id); 407 iwl_pnvm_load_reduce_power_to_trans(trans, capa, sku_id); 408 409 iwl_init_notification_wait(notif_wait, &pnvm_wait, 410 ntf_cmds, ARRAY_SIZE(ntf_cmds), 411 iwl_pnvm_complete_fn, trans); 412 413 /* kick the doorbell */ 414 iwl_write_umac_prph(trans, UREG_DOORBELL_TO_ISR6, 415 UREG_DOORBELL_TO_ISR6_PNVM); 416 417 return iwl_wait_notification(notif_wait, &pnvm_wait, 418 MVM_UCODE_PNVM_TIMEOUT); 419 } 420 IWL_EXPORT_SYMBOL(iwl_pnvm_load); 421