1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (C) 2019-2020 Linaro Limited */ 3 4 #include <linux/acpi.h> 5 #include <linux/firmware.h> 6 #include <linux/module.h> 7 #include <linux/pci.h> 8 #include <linux/slab.h> 9 #include <linux/unaligned.h> 10 11 #include "xhci.h" 12 #include "xhci-trace.h" 13 #include "xhci-pci.h" 14 15 #define RENESAS_FW_VERSION 0x6C 16 #define RENESAS_ROM_CONFIG 0xF0 17 #define RENESAS_FW_STATUS 0xF4 18 #define RENESAS_FW_STATUS_MSB 0xF5 19 #define RENESAS_ROM_STATUS 0xF6 20 #define RENESAS_ROM_STATUS_MSB 0xF7 21 #define RENESAS_DATA0 0xF8 22 #define RENESAS_DATA1 0xFC 23 24 #define RENESAS_FW_VERSION_FIELD GENMASK(23, 7) 25 #define RENESAS_FW_VERSION_OFFSET 8 26 27 #define RENESAS_FW_STATUS_DOWNLOAD_ENABLE BIT(0) 28 #define RENESAS_FW_STATUS_LOCK BIT(1) 29 #define RENESAS_FW_STATUS_RESULT GENMASK(6, 4) 30 #define RENESAS_FW_STATUS_INVALID 0 31 #define RENESAS_FW_STATUS_SUCCESS BIT(4) 32 #define RENESAS_FW_STATUS_ERROR BIT(5) 33 #define RENESAS_FW_STATUS_SET_DATA0 BIT(8) 34 #define RENESAS_FW_STATUS_SET_DATA1 BIT(9) 35 36 #define RENESAS_ROM_STATUS_ACCESS BIT(0) 37 #define RENESAS_ROM_STATUS_ERASE BIT(1) 38 #define RENESAS_ROM_STATUS_RELOAD BIT(2) 39 #define RENESAS_ROM_STATUS_RESULT GENMASK(6, 4) 40 #define RENESAS_ROM_STATUS_NO_RESULT 0 41 #define RENESAS_ROM_STATUS_SUCCESS BIT(4) 42 #define RENESAS_ROM_STATUS_ERROR BIT(5) 43 #define RENESAS_ROM_STATUS_SET_DATA0 BIT(8) 44 #define RENESAS_ROM_STATUS_SET_DATA1 BIT(9) 45 #define RENESAS_ROM_STATUS_ROM_EXISTS BIT(15) 46 47 #define RENESAS_ROM_ERASE_MAGIC 0x5A65726F 48 #define RENESAS_ROM_WRITE_MAGIC 0x53524F4D 49 50 #define RENESAS_RETRY 10000 51 #define RENESAS_DELAY 10 52 53 #define RENESAS_FW_NAME "renesas_usb_fw.mem" 54 55 static int renesas_fw_download_image(struct pci_dev *dev, 56 const u32 *fw, size_t step, bool rom) 57 { 58 size_t i; 59 int err; 60 u8 fw_status; 61 bool data0_or_data1; 62 u32 status_reg; 63 64 if (rom) 65 status_reg = RENESAS_ROM_STATUS_MSB; 66 else 67 status_reg = RENESAS_FW_STATUS_MSB; 68 69 /* 70 * The hardware does alternate between two 32-bit pages. 71 * (This is because each row of the firmware is 8 bytes). 72 * 73 * for even steps we use DATA0, for odd steps DATA1. 74 */ 75 data0_or_data1 = (step & 1) == 1; 76 77 /* step+1. Read "Set DATAX" and confirm it is cleared. */ 78 for (i = 0; i < RENESAS_RETRY; i++) { 79 err = pci_read_config_byte(dev, status_reg, &fw_status); 80 if (err) { 81 dev_err(&dev->dev, "Read Status failed: %d\n", 82 pcibios_err_to_errno(err)); 83 return pcibios_err_to_errno(err); 84 } 85 if (!(fw_status & BIT(data0_or_data1))) 86 break; 87 88 udelay(RENESAS_DELAY); 89 } 90 if (i == RENESAS_RETRY) { 91 dev_err(&dev->dev, "Timeout for Set DATAX step: %zd\n", step); 92 return -ETIMEDOUT; 93 } 94 95 /* 96 * step+2. Write FW data to "DATAX". 97 * "LSB is left" => force little endian 98 */ 99 err = pci_write_config_dword(dev, data0_or_data1 ? 100 RENESAS_DATA1 : RENESAS_DATA0, 101 (__force u32)cpu_to_le32(fw[step])); 102 if (err) { 103 dev_err(&dev->dev, "Write to DATAX failed: %d\n", 104 pcibios_err_to_errno(err)); 105 return pcibios_err_to_errno(err); 106 } 107 108 udelay(100); 109 110 /* step+3. Set "Set DATAX". */ 111 err = pci_write_config_byte(dev, status_reg, BIT(data0_or_data1)); 112 if (err) { 113 dev_err(&dev->dev, "Write config for DATAX failed: %d\n", 114 pcibios_err_to_errno(err)); 115 return pcibios_err_to_errno(err); 116 } 117 118 return 0; 119 } 120 121 static int renesas_fw_verify(const void *fw_data, 122 size_t length) 123 { 124 u16 fw_version_pointer; 125 126 /* 127 * The Firmware's Data Format is describe in 128 * "6.3 Data Format" R19UH0078EJ0500 Rev.5.00 page 124 129 */ 130 131 /* 132 * The bootrom chips of the big brother have sizes up to 64k, let's 133 * assume that's the biggest the firmware can get. 134 */ 135 if (length < 0x1000 || length >= 0x10000) { 136 pr_err("firmware is size %zd is not (4k - 64k).", 137 length); 138 return -EINVAL; 139 } 140 141 /* The First 2 bytes are fixed value (55aa). "LSB on Left" */ 142 if (get_unaligned_le16(fw_data) != 0x55aa) { 143 pr_err("no valid firmware header found."); 144 return -EINVAL; 145 } 146 147 /* verify the firmware version position and print it. */ 148 fw_version_pointer = get_unaligned_le16(fw_data + 4); 149 if (fw_version_pointer + 2 >= length) { 150 pr_err("fw ver pointer is outside of the firmware image"); 151 return -EINVAL; 152 } 153 154 return 0; 155 } 156 157 static bool renesas_check_rom(struct pci_dev *pdev) 158 { 159 u16 rom_status; 160 int retval; 161 162 /* Check if external ROM exists */ 163 retval = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_status); 164 if (retval) 165 return false; 166 167 rom_status &= RENESAS_ROM_STATUS_ROM_EXISTS; 168 if (rom_status) { 169 dev_dbg(&pdev->dev, "External ROM exists\n"); 170 return true; /* External ROM exists */ 171 } 172 173 return false; 174 } 175 176 static int renesas_check_rom_state(struct pci_dev *pdev) 177 { 178 u16 rom_state; 179 u32 version; 180 int err; 181 182 /* check FW version */ 183 err = pci_read_config_dword(pdev, RENESAS_FW_VERSION, &version); 184 if (err) 185 return pcibios_err_to_errno(err); 186 187 version &= RENESAS_FW_VERSION_FIELD; 188 version = version >> RENESAS_FW_VERSION_OFFSET; 189 dev_dbg(&pdev->dev, "Found ROM version: %x\n", version); 190 191 /* 192 * Test if ROM is present and loaded, if so we can skip everything 193 */ 194 err = pci_read_config_word(pdev, RENESAS_ROM_STATUS, &rom_state); 195 if (err) 196 return pcibios_err_to_errno(err); 197 198 if (rom_state & RENESAS_ROM_STATUS_ROM_EXISTS) { 199 /* ROM exists */ 200 dev_dbg(&pdev->dev, "ROM exists\n"); 201 202 /* Check the "Result Code" Bits (6:4) and act accordingly */ 203 switch (rom_state & RENESAS_ROM_STATUS_RESULT) { 204 case RENESAS_ROM_STATUS_SUCCESS: 205 return 0; 206 207 case RENESAS_ROM_STATUS_NO_RESULT: /* No result yet */ 208 dev_dbg(&pdev->dev, "Unknown ROM status ...\n"); 209 return -ENOENT; 210 211 case RENESAS_ROM_STATUS_ERROR: /* Error State */ 212 default: /* All other states are marked as "Reserved states" */ 213 dev_err(&pdev->dev, "Invalid ROM.."); 214 break; 215 } 216 } 217 218 return -EIO; 219 } 220 221 static int renesas_fw_check_running(struct pci_dev *pdev) 222 { 223 u8 fw_state; 224 int err; 225 226 /* 227 * Test if the device is actually needing the firmware. As most 228 * BIOSes will initialize the device for us. If the device is 229 * initialized. 230 */ 231 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_state); 232 if (err) 233 return pcibios_err_to_errno(err); 234 235 /* 236 * Check if "FW Download Lock" is locked. If it is and the FW is 237 * ready we can simply continue. If the FW is not ready, we have 238 * to give up. 239 */ 240 if (fw_state & RENESAS_FW_STATUS_LOCK) { 241 dev_dbg(&pdev->dev, "FW Download Lock is engaged."); 242 243 if (fw_state & RENESAS_FW_STATUS_SUCCESS) 244 return 0; 245 246 dev_err(&pdev->dev, 247 "FW Download Lock is set and FW is not ready. Giving Up."); 248 return -EIO; 249 } 250 251 /* 252 * Check if "FW Download Enable" is set. If someone (us?) tampered 253 * with it and it can't be reset, we have to give up too... and 254 * ask for a forgiveness and a reboot. 255 */ 256 if (fw_state & RENESAS_FW_STATUS_DOWNLOAD_ENABLE) { 257 dev_err(&pdev->dev, 258 "FW Download Enable is stale. Giving Up (poweroff/reboot needed)."); 259 return -EIO; 260 } 261 262 /* Otherwise, Check the "Result Code" Bits (6:4) and act accordingly */ 263 switch (fw_state & RENESAS_FW_STATUS_RESULT) { 264 case 0: /* No result yet */ 265 dev_dbg(&pdev->dev, "FW is not ready/loaded yet."); 266 267 /* tell the caller, that this device needs the firmware. */ 268 return 1; 269 270 case RENESAS_FW_STATUS_SUCCESS: /* Success, device should be working. */ 271 dev_dbg(&pdev->dev, "FW is ready."); 272 return 0; 273 274 case RENESAS_FW_STATUS_ERROR: /* Error State */ 275 dev_err(&pdev->dev, 276 "hardware is in an error state. Giving up (poweroff/reboot needed)."); 277 return -ENODEV; 278 279 default: /* All other states are marked as "Reserved states" */ 280 dev_err(&pdev->dev, 281 "hardware is in an invalid state %lx. Giving up (poweroff/reboot needed).", 282 (fw_state & RENESAS_FW_STATUS_RESULT) >> 4); 283 return -EINVAL; 284 } 285 } 286 287 static int renesas_fw_download(struct pci_dev *pdev, 288 const struct firmware *fw) 289 { 290 const u32 *fw_data = (const u32 *)fw->data; 291 size_t i; 292 int err; 293 u8 fw_status; 294 295 /* 296 * For more information and the big picture: please look at the 297 * "Firmware Download Sequence" in "7.1 FW Download Interface" 298 * of R19UH0078EJ0500 Rev.5.00 page 131 299 */ 300 301 /* 302 * 0. Set "FW Download Enable" bit in the 303 * "FW Download Control & Status Register" at 0xF4 304 */ 305 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 306 RENESAS_FW_STATUS_DOWNLOAD_ENABLE); 307 if (err) 308 return pcibios_err_to_errno(err); 309 310 /* 1 - 10 follow one step after the other. */ 311 for (i = 0; i < fw->size / 4; i++) { 312 err = renesas_fw_download_image(pdev, fw_data, i, false); 313 if (err) { 314 dev_err(&pdev->dev, 315 "Firmware Download Step %zd failed at position %zd bytes with (%d).", 316 i, i * 4, err); 317 return err; 318 } 319 } 320 321 /* 322 * This sequence continues until the last data is written to 323 * "DATA0" or "DATA1". Naturally, we wait until "SET DATA0/1" 324 * is cleared by the hardware beforehand. 325 */ 326 for (i = 0; i < RENESAS_RETRY; i++) { 327 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS_MSB, 328 &fw_status); 329 if (err) 330 return pcibios_err_to_errno(err); 331 if (!(fw_status & (BIT(0) | BIT(1)))) 332 break; 333 334 udelay(RENESAS_DELAY); 335 } 336 if (i == RENESAS_RETRY) 337 dev_warn(&pdev->dev, "Final Firmware Download step timed out."); 338 339 /* 340 * 11. After finishing writing the last data of FW, the 341 * System Software must clear "FW Download Enable" 342 */ 343 err = pci_write_config_byte(pdev, RENESAS_FW_STATUS, 0); 344 if (err) 345 return pcibios_err_to_errno(err); 346 347 /* 12. Read "Result Code" and confirm it is good. */ 348 for (i = 0; i < RENESAS_RETRY; i++) { 349 err = pci_read_config_byte(pdev, RENESAS_FW_STATUS, &fw_status); 350 if (err) 351 return pcibios_err_to_errno(err); 352 if (fw_status & RENESAS_FW_STATUS_SUCCESS) 353 break; 354 355 udelay(RENESAS_DELAY); 356 } 357 if (i == RENESAS_RETRY) { 358 /* Timed out / Error - let's see if we can fix this */ 359 err = renesas_fw_check_running(pdev); 360 switch (err) { 361 case 0: /* 362 * we shouldn't end up here. 363 * maybe it took a little bit longer. 364 * But all should be well? 365 */ 366 break; 367 368 case 1: /* (No result yet! */ 369 dev_err(&pdev->dev, "FW Load timedout"); 370 return -ETIMEDOUT; 371 372 default: 373 return err; 374 } 375 } 376 377 return 0; 378 } 379 380 static void renesas_rom_erase(struct pci_dev *pdev) 381 { 382 int retval, i; 383 u8 status; 384 385 dev_dbg(&pdev->dev, "Performing ROM Erase...\n"); 386 retval = pci_write_config_dword(pdev, RENESAS_DATA0, 387 RENESAS_ROM_ERASE_MAGIC); 388 if (retval) { 389 dev_err(&pdev->dev, "ROM erase, magic word write failed: %d\n", 390 pcibios_err_to_errno(retval)); 391 return; 392 } 393 394 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 395 if (retval) { 396 dev_err(&pdev->dev, "ROM status read failed: %d\n", 397 pcibios_err_to_errno(retval)); 398 return; 399 } 400 status |= RENESAS_ROM_STATUS_ERASE; 401 retval = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, status); 402 if (retval) { 403 dev_err(&pdev->dev, "ROM erase set word write failed\n"); 404 return; 405 } 406 407 /* sleep a bit while ROM is erased */ 408 msleep(20); 409 410 for (i = 0; i < RENESAS_RETRY; i++) { 411 retval = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, 412 &status); 413 status &= RENESAS_ROM_STATUS_ERASE; 414 if (!status) 415 break; 416 417 mdelay(RENESAS_DELAY); 418 } 419 420 if (i == RENESAS_RETRY) 421 dev_dbg(&pdev->dev, "Chip erase timedout: %x\n", status); 422 423 dev_dbg(&pdev->dev, "ROM Erase... Done success\n"); 424 } 425 426 static bool renesas_setup_rom(struct pci_dev *pdev, const struct firmware *fw) 427 { 428 const u32 *fw_data = (const u32 *)fw->data; 429 int err, i; 430 u8 status; 431 432 /* 2. Write magic word to Data0 */ 433 err = pci_write_config_dword(pdev, RENESAS_DATA0, 434 RENESAS_ROM_WRITE_MAGIC); 435 if (err) 436 return false; 437 438 /* 3. Set External ROM access */ 439 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 440 RENESAS_ROM_STATUS_ACCESS); 441 if (err) 442 goto remove_bypass; 443 444 /* 4. Check the result */ 445 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 446 if (err) 447 goto remove_bypass; 448 status &= GENMASK(6, 4); 449 if (status) { 450 dev_err(&pdev->dev, 451 "setting external rom failed: %x\n", status); 452 goto remove_bypass; 453 } 454 455 /* 5 to 16 Write FW to DATA0/1 while checking SetData0/1 */ 456 for (i = 0; i < fw->size / 4; i++) { 457 err = renesas_fw_download_image(pdev, fw_data, i, true); 458 if (err) { 459 dev_err(&pdev->dev, 460 "ROM Download Step %d failed at position %d bytes with (%d)\n", 461 i, i * 4, err); 462 goto remove_bypass; 463 } 464 } 465 466 /* 467 * wait till DATA0/1 is cleared 468 */ 469 for (i = 0; i < RENESAS_RETRY; i++) { 470 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS_MSB, 471 &status); 472 if (err) 473 goto remove_bypass; 474 if (!(status & (BIT(0) | BIT(1)))) 475 break; 476 477 udelay(RENESAS_DELAY); 478 } 479 if (i == RENESAS_RETRY) { 480 dev_err(&pdev->dev, "Final Firmware ROM Download step timed out\n"); 481 goto remove_bypass; 482 } 483 484 /* 17. Remove bypass */ 485 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 486 if (err) 487 return false; 488 489 udelay(10); 490 491 /* 18. check result */ 492 for (i = 0; i < RENESAS_RETRY; i++) { 493 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 494 if (err) { 495 dev_err(&pdev->dev, "Read ROM status failed:%d\n", 496 pcibios_err_to_errno(err)); 497 return false; 498 } 499 status &= RENESAS_ROM_STATUS_RESULT; 500 if (status == RENESAS_ROM_STATUS_SUCCESS) { 501 dev_dbg(&pdev->dev, "Download ROM success\n"); 502 break; 503 } 504 udelay(RENESAS_DELAY); 505 } 506 if (i == RENESAS_RETRY) { /* Timed out */ 507 dev_err(&pdev->dev, 508 "Download to external ROM TO: %x\n", status); 509 return false; 510 } 511 512 dev_dbg(&pdev->dev, "Download to external ROM succeeded\n"); 513 514 /* Last step set Reload */ 515 err = pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 516 RENESAS_ROM_STATUS_RELOAD); 517 if (err) { 518 dev_err(&pdev->dev, "Set ROM execute failed: %d\n", 519 pcibios_err_to_errno(err)); 520 return false; 521 } 522 523 /* 524 * wait till Reload is cleared 525 */ 526 for (i = 0; i < RENESAS_RETRY; i++) { 527 err = pci_read_config_byte(pdev, RENESAS_ROM_STATUS, &status); 528 if (err) 529 return false; 530 if (!(status & RENESAS_ROM_STATUS_RELOAD)) 531 break; 532 533 udelay(RENESAS_DELAY); 534 } 535 if (i == RENESAS_RETRY) { 536 dev_err(&pdev->dev, "ROM Exec timed out: %x\n", status); 537 return false; 538 } 539 540 return true; 541 542 remove_bypass: 543 pci_write_config_byte(pdev, RENESAS_ROM_STATUS, 0); 544 return false; 545 } 546 547 static int renesas_load_fw(struct pci_dev *pdev, const struct firmware *fw) 548 { 549 int err = 0; 550 bool rom; 551 552 /* Check if the device has external ROM */ 553 rom = renesas_check_rom(pdev); 554 if (rom) { 555 /* perform chip erase first */ 556 renesas_rom_erase(pdev); 557 558 /* lets try loading fw on ROM first */ 559 rom = renesas_setup_rom(pdev, fw); 560 if (!rom) { 561 dev_dbg(&pdev->dev, 562 "ROM load failed, falling back on FW load\n"); 563 } else { 564 dev_dbg(&pdev->dev, 565 "ROM load success\n"); 566 goto exit; 567 } 568 } 569 570 err = renesas_fw_download(pdev, fw); 571 572 exit: 573 if (err) 574 dev_err(&pdev->dev, "firmware failed to download (%d).", err); 575 return err; 576 } 577 578 static int renesas_xhci_check_request_fw(struct pci_dev *pdev, 579 const struct pci_device_id *id) 580 { 581 const char fw_name[] = RENESAS_FW_NAME; 582 const struct firmware *fw; 583 bool has_rom; 584 int err; 585 586 /* Check if device has ROM and loaded, if so skip everything */ 587 has_rom = renesas_check_rom(pdev); 588 if (has_rom) { 589 err = renesas_check_rom_state(pdev); 590 if (!err) 591 return 0; 592 else if (err != -ENOENT) 593 has_rom = false; 594 } 595 596 err = renesas_fw_check_running(pdev); 597 /* Continue ahead, if the firmware is already running. */ 598 if (!err) 599 return 0; 600 601 /* no firmware interface available */ 602 if (err != 1) 603 return has_rom ? 0 : err; 604 605 pci_dev_get(pdev); 606 err = firmware_request_nowarn(&fw, fw_name, &pdev->dev); 607 pci_dev_put(pdev); 608 if (err) { 609 if (has_rom) { 610 dev_info(&pdev->dev, "failed to load firmware %s, fallback to ROM\n", 611 fw_name); 612 return 0; 613 } 614 dev_err(&pdev->dev, "failed to load firmware %s: %d\n", 615 fw_name, err); 616 return err; 617 } 618 619 err = renesas_fw_verify(fw->data, fw->size); 620 if (err) 621 goto exit; 622 623 err = renesas_load_fw(pdev, fw); 624 exit: 625 release_firmware(fw); 626 return err; 627 } 628 629 static int 630 xhci_pci_renesas_probe(struct pci_dev *dev, const struct pci_device_id *id) 631 { 632 int retval; 633 634 retval = renesas_xhci_check_request_fw(dev, id); 635 if (retval) 636 return retval; 637 638 return xhci_pci_common_probe(dev, id); 639 } 640 641 static const struct pci_device_id pci_ids[] = { 642 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0014) }, 643 { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, 0x0015) }, 644 { /* end: all zeroes */ } 645 }; 646 MODULE_DEVICE_TABLE(pci, pci_ids); 647 648 static struct pci_driver xhci_renesas_pci_driver = { 649 .name = "xhci-pci-renesas", 650 .id_table = pci_ids, 651 652 .probe = xhci_pci_renesas_probe, 653 .remove = xhci_pci_remove, 654 655 .shutdown = usb_hcd_pci_shutdown, 656 .driver = { 657 .pm = pm_ptr(&usb_hcd_pci_pm_ops), 658 }, 659 }; 660 module_pci_driver(xhci_renesas_pci_driver); 661 662 MODULE_DESCRIPTION("Renesas xHCI PCI Host Controller Driver"); 663 MODULE_FIRMWARE(RENESAS_FW_NAME); 664 MODULE_IMPORT_NS(xhci); 665 MODULE_LICENSE("GPL v2"); 666