1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (C) 2019-2020 Linaro Limited */ 3 4 #include <linux/acpi.h> 5 #include <linux/firmware.h> 6 #include <linux/module.h> 7 #include <linux/pci.h> 8 #include <linux/slab.h> 9 #include <linux/unaligned.h> 10 11 #include "xhci.h" 12 #include "xhci-trace.h" 13 #include "xhci-pci.h" 14 15 #define RENESAS_FW_VERSION 0x6C 16 #define RENESAS_ROM_CONFIG 0xF0 17 #define RENESAS_FW_STATUS 0xF4 18 #define RENESAS_FW_STATUS_MSB 0xF5 19 #define RENESAS_ROM_STATUS 0xF6 20 #define RENESAS_ROM_STATUS_MSB 0xF7 21 #define RENESAS_DATA0 0xF8 22 #define RENESAS_DATA1 0xFC 23 24 #define RENESAS_FW_VERSION_FIELD GENMASK(23, 7) 25 #define RENESAS_FW_VERSION_OFFSET 8 26 27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE BIT(0) 28 #define RENESAS_FW_STATUS_LOCK BIT(1) 29 #define RENESAS_FW_STATUS_RESULT GENMASK(6, 4) 30 #define RENESAS_FW_STATUS_INVALID 0 31 #define RENESAS_FW_STATUS_SUCCESS BIT(4) 32 #define RENESAS_FW_STATUS_ERROR BIT(5) 33 #define RENESAS_FW_STATUS_SET_DATA0 BIT(8) 34 #define RENESAS_FW_STATUS_SET_DATA1 BIT(9) 35 36 #define RENESAS_ROM_STATUS_ACCESS BIT(0) 37 #define RENESAS_ROM_STATUS_ERASE BIT(1) 38 #define RENESAS_ROM_STATUS_RELOAD BIT(2) 39 #define RENESAS_ROM_STATUS_RESULT GENMASK(6, 4) 40 #define RENESAS_ROM_STATUS_NO_RESULT 0 41 #define RENESAS_ROM_STATUS_SUCCESS BIT(4) 42 #define RENESAS_ROM_STATUS_ERROR BIT(5) 43 #define RENESAS_ROM_STATUS_SET_DATA0 BIT(8) 44 #define RENESAS_ROM_STATUS_SET_DATA1 BIT(9) 45 #define RENESAS_ROM_STATUS_ROM_EXISTS BIT(15) 46 47 #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F 48 #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D 49 50 #define RENESAS_RETRY 50000 /* 50000 * RENESAS_DELAY ~= 500ms */ 51 #define RENESAS_CHIP_ERASE_RETRY 500000 /* 500000 * RENESAS_DELAY ~= 5s */ 52 #define RENESAS_DELAY 10 53 54 #define RENESAS_FW_NAME "renesas_usb_fw.mem" 55 56 static int renesas_fw_download_image(struct pci_dev *dev, 57 const u32 *fw, size_t step, bool rom) 58 { 59 size_t i; 60 int err; 61 u8 fw_status; 62 bool data0_or_data1; 63 u32 status_reg; 64 65 if (rom) 66 status_reg = RENESAS_ROM_STATUS_MSB; 67 else 68 status_reg = RENESAS_FW_STATUS_MSB; 69 70 /* 71 * The hardware does alternate between two 32-bit pages. 72 * (This is because each row of the firmware is 8 bytes). 73 * 74 * for even steps we use DATA0, for odd steps DATA1. 75 */ 76 data0_or_data1 = (step & 1) == 1; 77 78 /* step+1. Read "Set DATAX" and confirm it is cleared. */ 79 for (i = 0; i < RENESAS_RETRY; i++) { 80 err = pci_read_config_byte(dev, status_reg, &fw_status); 81 if (err) { 82 dev_err(&dev->dev, "Read Status failed: %d\n", 83 pcibios_err_to_errno(err)); 84 return pcibios_err_to_errno(err); 85 } 86 if (!(fw_status & BIT(data0_or_data1))) 87 break; 88 89 udelay(RENESAS_DELAY); 90 } 91 if (i == RENESAS_RETRY) { 92 dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step); 93 return -ETIMEDOUT; 94 } 95 96 /* 97 * step+2. Write FW data to "DATAX". 98 * "LSB is left" => force little endian 99 */ 100 err = pci_write_config_dword(dev, data0_or_data1 ? 101 RENESAS_DATA1 : RENESAS_DATA0, 102 (__force u32)cpu_to_le32(fw[step])); 103 if (err) { 104 dev_err(&dev->dev, "Write to DATAX failed: %d\n", 105 pcibios_err_to_errno(err)); 106 return pcibios_err_to_errno(err); 107 } 108 109 udelay(100); 110 111 /* step+3. Set "Set DATAX". */ 112 err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1)); 113 if (err) { 114 dev_err(&dev->dev, "Write config for DATAX failed: %d\n", 115 pcibios_err_to_errno(err)); 116 return pcibios_err_to_errno(err); 117 } 118 119 return 0; 120 } 121 122 static int renesas_fw_verify(const void *fw_data, 123 size_t length) 124 { 125 u16 fw_version_pointer; 126 127 /* 128 * The Firmware's Data Format is describe in 129 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124 130 */ 131 132 /* 133 * The bootrom chips of the big brother have sizes up to 64k, let's 134 * assume that's the biggest the firmware can get. 135 */ 136 if (length < 0x1000 || length >= 0x10000) { 137 pr_err("firmware is size %zd is not (4k - 64k).", 138 length); 139 return -EINVAL; 140 } 141 142 /* The First 2 bytes are fixed value (55aa). "LSB on Left" */ 143 if (get_unaligned_le16(fw_data) != 0x55aa) { 144 pr_err("no valid firmware header found."); 145 return -EINVAL; 146 } 147 148 /* verify the firmware version position and print it. */ 149 fw_version_pointer = get_unaligned_le16(fw_data + 4); 150 if (fw_version_pointer + 2 >= length) { 151 pr_err("fw ver pointer is outside of the firmware image"); 152 return -EINVAL; 153 } 154 155 return 0; 156 } 157 158 static bool renesas_check_rom(struct pci_dev *pdev) 159 { 160 u16 rom_status; 161 int retval; 162 163 /* Check if external ROM exists */ 164 retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status); 165 if (retval) 166 return false; 167 168 rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS; 169 if (rom_status) { 170 dev_dbg(&pdev->dev, "External ROM exists\n"); 171 return true; /* External ROM exists */ 172 } 173 174 return false; 175 } 176 177 static int renesas_check_rom_state(struct pci_dev *pdev) 178 { 179 u16 rom_state; 180 u32 version; 181 int err; 182 183 /* check FW version */ 184 err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version); 185 if (err) 186 return pcibios_err_to_errno(err); 187 188 version &= RENESAS_FW_VERSION_FIELD; 189 version = version >> RENESAS_FW_VERSION_OFFSET; 190 dev_dbg(&pdev->dev, "Found ROM version: %x\n", version); 191 192 /* 193 * Test if ROM is present and loaded, if so we can skip everything 194 */ 195 err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state); 196 if (err) 197 return pcibios_err_to_errno(err); 198 199 if (rom_state & RENESAS_ROM_STATUS_ROM_EXISTS) { 200 /* ROM exists */ 201 dev_dbg(&pdev->dev, "ROM exists\n"); 202 203 /* Check the "Result Code" Bits (6:4) and act accordingly */ 204 switch (rom_state & RENESAS_ROM_STATUS_RESULT) { 205 case RENESAS_ROM_STATUS_SUCCESS: 206 return 0; 207 208 case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */ 209 dev_dbg(&pdev->dev, "Unknown ROM status ...\n"); 210 return -ENOENT; 211 212 case RENESAS_ROM_STATUS_ERROR: /* Error State */ 213 default: /* All other states are marked as "Reserved states" */ 214 dev_err(&pdev->dev, "Invalid ROM.."); 215 break; 216 } 217 } 218 219 return -EIO; 220 } 221 222 static int renesas_fw_check_running(struct pci_dev *pdev) 223 { 224 u8 fw_state; 225 int err; 226 227 /* 228 * Test if the device is actually needing the firmware. As most 229 * BIOSes will initialize the device for us. If the device is 230 * initialized. 231 */ 232 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state); 233 if (err) 234 return pcibios_err_to_errno(err); 235 236 /* 237 * Check if "FW Download Lock" is locked. If it is and the FW is 238 * ready we can simply continue. If the FW is not ready, we have 239 * to give up. 240 */ 241 if (fw_state & RENESAS_FW_STATUS_LOCK) { 242 dev_dbg(&pdev->dev, "FW Download Lock is engaged."); 243 244 if (fw_state & RENESAS_FW_STATUS_SUCCESS) 245 return 0; 246 247 dev_err(&pdev->dev, 248 "FW Download Lock is set and FW is not ready. Giving Up."); 249 return -EIO; 250 } 251 252 /* 253 * Check if "FW Download Enable" is set. If someone (us?) tampered 254 * with it and it can't be reset, we have to give up too... and 255 * ask for a forgiveness and a reboot. 256 */ 257 if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) { 258 dev_err(&pdev->dev, 259 "FW Download Enable is stale. Giving Up (poweroff/reboot needed)."); 260 return -EIO; 261 } 262 263 /* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */ 264 switch (fw_state & RENESAS_FW_STATUS_RESULT) { 265 case 0: /* No result yet */ 266 dev_dbg(&pdev->dev, "FW is not ready/loaded yet."); 267 268 /* tell the caller, that this device needs the firmware. */ 269 return 1; 270 271 case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */ 272 dev_dbg(&pdev->dev, "FW is ready."); 273 return 0; 274 275 case RENESAS_FW_STATUS_ERROR: /* Error State */ 276 dev_err(&pdev->dev, 277 "hardware is in an error state. Giving up (poweroff/reboot needed)."); 278 return -ENODEV; 279 280 default: /* All other states are marked as "Reserved states" */ 281 dev_err(&pdev->dev, 282 "hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).", 283 (fw_state & RENESAS_FW_STATUS_RESULT) >> 4); 284 return -EINVAL; 285 } 286 } 287 288 static int renesas_fw_download(struct pci_dev *pdev, 289 const struct firmware *fw) 290 { 291 const u32 *fw_data = (const u32 *)fw->data; 292 size_t i; 293 int err; 294 u8 fw_status; 295 296 /* 297 * For more information and the big picture: please look at the 298 * "Firmware Download Sequence" in "7.1 FW Download Interface" 299 * of R19UH0078EJ0500 Rev.5.00 page 131 300 */ 301 302 /* 303 * 0. Set "FW Download Enable" bit in the 304 * "FW Download Control & Status Register" at 0xF4 305 */ 306 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 307 RENESAS_FW_STATUS_DOWNLOAD_ENABLE); 308 if (err) 309 return pcibios_err_to_errno(err); 310 311 /* 1 - 10 follow one step after the other. */ 312 for (i = 0; i < fw->size / 4; i++) { 313 err = renesas_fw_download_image(pdev, fw_data, i, false); 314 if (err) { 315 dev_err(&pdev->dev, 316 "Firmware Download Step %zd failed at position %zd bytes with (%d).", 317 i, i * 4, err); 318 return err; 319 } 320 } 321 322 /* 323 * This sequence continues until the last data is written to 324 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1" 325 * is cleared by the hardware beforehand. 326 */ 327 for (i = 0; i < RENESAS_RETRY; i++) { 328 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB, 329 &fw_status); 330 if (err) 331 return pcibios_err_to_errno(err); 332 if (!(fw_status & (BIT(0) | BIT(1)))) 333 break; 334 335 udelay(RENESAS_DELAY); 336 } 337 if (i == RENESAS_RETRY) 338 dev_warn(&pdev->dev, "Final Firmware Download step timed out."); 339 340 /* 341 * 11. After finishing writing the last data of FW, the 342 * System Software must clear "FW Download Enable" 343 */ 344 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0); 345 if (err) 346 return pcibios_err_to_errno(err); 347 348 /* 12. Read "Result Code" and confirm it is good. */ 349 for (i = 0; i < RENESAS_RETRY; i++) { 350 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status); 351 if (err) 352 return pcibios_err_to_errno(err); 353 if (fw_status & RENESAS_FW_STATUS_SUCCESS) 354 break; 355 356 udelay(RENESAS_DELAY); 357 } 358 if (i == RENESAS_RETRY) { 359 /* Timed out / Error - let's see if we can fix this */ 360 err = renesas_fw_check_running(pdev); 361 switch (err) { 362 case 0: /* 363 * we shouldn't end up here. 364 * maybe it took a little bit longer. 365 * But all should be well? 366 */ 367 break; 368 369 case 1: /* (No result yet! */ 370 dev_err(&pdev->dev, "FW Load timedout"); 371 return -ETIMEDOUT; 372 373 default: 374 return err; 375 } 376 } 377 378 return 0; 379 } 380 381 static void renesas_rom_erase(struct pci_dev *pdev) 382 { 383 int retval, i; 384 u8 status; 385 386 dev_dbg(&pdev->dev, "Performing ROM Erase...\n"); 387 retval = pci_write_config_dword(pdev, RENESAS_DATA0, 388 RENESAS_ROM_ERASE_MAGIC); 389 if (retval) { 390 dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n", 391 pcibios_err_to_errno(retval)); 392 return; 393 } 394 395 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 396 if (retval) { 397 dev_err(&pdev->dev, "ROM status read failed: %d\n", 398 pcibios_err_to_errno(retval)); 399 return; 400 } 401 status |= RENESAS_ROM_STATUS_ERASE; 402 retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status); 403 if (retval) { 404 dev_err(&pdev->dev, "ROM erase set word write failed\n"); 405 return; 406 } 407 408 /* sleep a bit while ROM is erased */ 409 msleep(20); 410 411 for (i = 0; i < RENESAS_CHIP_ERASE_RETRY; i++) { 412 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, 413 &status); 414 status &= RENESAS_ROM_STATUS_ERASE; 415 if (!status) 416 break; 417 418 mdelay(RENESAS_DELAY); 419 } 420 421 if (i == RENESAS_RETRY) 422 dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status); 423 424 dev_dbg(&pdev->dev, "ROM Erase... Done success\n"); 425 } 426 427 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw) 428 { 429 const u32 *fw_data = (const u32 *)fw->data; 430 int err, i; 431 u8 status; 432 433 /* 2. Write magic word to Data0 */ 434 err = pci_write_config_dword(pdev, RENESAS_DATA0, 435 RENESAS_ROM_WRITE_MAGIC); 436 if (err) 437 return false; 438 439 /* 3. Set External ROM access */ 440 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 441 RENESAS_ROM_STATUS_ACCESS); 442 if (err) 443 goto remove_bypass; 444 445 /* 4. Check the result */ 446 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 447 if (err) 448 goto remove_bypass; 449 status &= GENMASK(6, 4); 450 if (status) { 451 dev_err(&pdev->dev, 452 "setting external rom failed: %x\n", status); 453 goto remove_bypass; 454 } 455 456 /* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */ 457 for (i = 0; i < fw->size / 4; i++) { 458 err = renesas_fw_download_image(pdev, fw_data, i, true); 459 if (err) { 460 dev_err(&pdev->dev, 461 "ROM Download Step %d failed at position %d bytes with (%d)\n", 462 i, i * 4, err); 463 goto remove_bypass; 464 } 465 } 466 467 /* 468 * wait till DATA0/1 is cleared 469 */ 470 for (i = 0; i < RENESAS_RETRY; i++) { 471 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB, 472 &status); 473 if (err) 474 goto remove_bypass; 475 if (!(status & (BIT(0) | BIT(1)))) 476 break; 477 478 udelay(RENESAS_DELAY); 479 } 480 if (i == RENESAS_RETRY) { 481 dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n"); 482 goto remove_bypass; 483 } 484 485 /* 17. Remove bypass */ 486 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 487 if (err) 488 return false; 489 490 udelay(10); 491 492 /* 18. check result */ 493 for (i = 0; i < RENESAS_RETRY; i++) { 494 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 495 if (err) { 496 dev_err(&pdev->dev, "Read ROM status failed:%d\n", 497 pcibios_err_to_errno(err)); 498 return false; 499 } 500 status &= RENESAS_ROM_STATUS_RESULT; 501 if (status == RENESAS_ROM_STATUS_SUCCESS) { 502 dev_dbg(&pdev->dev, "Download ROM success\n"); 503 break; 504 } 505 udelay(RENESAS_DELAY); 506 } 507 if (i == RENESAS_RETRY) { /* Timed out */ 508 dev_err(&pdev->dev, 509 "Download to external ROM TO: %x\n", status); 510 return false; 511 } 512 513 dev_dbg(&pdev->dev, "Download to external ROM succeeded\n"); 514 515 /* Last step set Reload */ 516 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 517 RENESAS_ROM_STATUS_RELOAD); 518 if (err) { 519 dev_err(&pdev->dev, "Set ROM execute failed: %d\n", 520 pcibios_err_to_errno(err)); 521 return false; 522 } 523 524 /* 525 * wait till Reload is cleared 526 */ 527 for (i = 0; i < RENESAS_RETRY; i++) { 528 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 529 if (err) 530 return false; 531 if (!(status & RENESAS_ROM_STATUS_RELOAD)) 532 break; 533 534 udelay(RENESAS_DELAY); 535 } 536 if (i == RENESAS_RETRY) { 537 dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status); 538 return false; 539 } 540 541 return true; 542 543 remove_bypass: 544 pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 545 return false; 546 } 547 548 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw) 549 { 550 int err = 0; 551 bool rom; 552 553 /* Check if the device has external ROM */ 554 rom = renesas_check_rom(pdev); 555 if (rom) { 556 /* perform chip erase first */ 557 renesas_rom_erase(pdev); 558 559 /* lets try loading fw on ROM first */ 560 rom = renesas_setup_rom(pdev, fw); 561 if (!rom) { 562 dev_dbg(&pdev->dev, 563 "ROM load failed, falling back on FW load\n"); 564 } else { 565 dev_dbg(&pdev->dev, 566 "ROM load success\n"); 567 goto exit; 568 } 569 } 570 571 err = renesas_fw_download(pdev, fw); 572 573 exit: 574 if (err) 575 dev_err(&pdev->dev, "firmware failed to download (%d).", err); 576 return err; 577 } 578 579 static int renesas_xhci_check_request_fw(struct pci_dev *pdev, 580 const struct pci_device_id *id) 581 { 582 const char fw_name[] = RENESAS_FW_NAME; 583 const struct firmware *fw; 584 bool has_rom; 585 int err; 586 587 /* Check if device has ROM and loaded, if so skip everything */ 588 has_rom = renesas_check_rom(pdev); 589 if (has_rom) { 590 err = renesas_check_rom_state(pdev); 591 if (!err) 592 return 0; 593 else if (err != -ENOENT) 594 has_rom = false; 595 } 596 597 err = renesas_fw_check_running(pdev); 598 /* Continue ahead, if the firmware is already running. */ 599 if (!err) 600 return 0; 601 602 /* no firmware interface available */ 603 if (err != 1) 604 return has_rom ? 0 : err; 605 606 pci_dev_get(pdev); 607 err = firmware_request_nowarn(&fw, fw_name, &pdev->dev); 608 pci_dev_put(pdev); 609 if (err) { 610 if (has_rom) { 611 dev_info(&pdev->dev, "failed to load firmware %s, fallback to ROM\n", 612 fw_name); 613 return 0; 614 } 615 dev_err(&pdev->dev, "failed to load firmware %s: %d\n", 616 fw_name, err); 617 return err; 618 } 619 620 err = renesas_fw_verify(fw->data, fw->size); 621 if (err) 622 goto exit; 623 624 err = renesas_load_fw(pdev, fw); 625 exit: 626 release_firmware(fw); 627 return err; 628 } 629 630 static int 631 xhci_pci_renesas_probe(struct pci_dev *dev, const struct pci_device_id *id) 632 { 633 int retval; 634 635 retval = renesas_xhci_check_request_fw(dev, id); 636 if (retval) 637 return retval; 638 639 return xhci_pci_common_probe(dev, id); 640 } 641 642 static const struct pci_device_id pci_ids[] = { 643 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0014) }, 644 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0015) }, 645 { /* end: all zeroes */ } 646 }; 647 MODULE_DEVICE_TABLE(pci, pci_ids); 648 649 static struct pci_driver xhci_renesas_pci_driver = { 650 .name = "xhci-pci-renesas", 651 .id_table = pci_ids, 652 653 .probe = xhci_pci_renesas_probe, 654 .remove = xhci_pci_remove, 655 656 .shutdown = usb_hcd_pci_shutdown, 657 .driver = { 658 .pm = pm_ptr(&usb_hcd_pci_pm_ops), 659 }, 660 }; 661 module_pci_driver(xhci_renesas_pci_driver); 662 663 MODULE_DESCRIPTION("Renesas xHCI PCI Host Controller Driver"); 664 MODULE_FIRMWARE(RENESAS_FW_NAME); 665 MODULE_IMPORT_NS("xhci"); 666 MODULE_LICENSE("GPL v2"); 667