2 * Intel Wireless WiMAX Connection 2400m
6 * Copyright (C) 2007-2008 Intel Corporation. All rights reserved.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * * Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * * Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in
16 * the documentation and/or other materials provided with the
18 * * Neither the name of Intel Corporation nor the names of its
19 * contributors may be used to endorse or promote products derived
20 * from this software without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 * Intel Corporation <linux-wimax@intel.com>
36 * Yanir Lubetkin <yanirx.lubetkin@intel.com>
37 * Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
38 * - Initial implementation
43 * The 2400m and derived devices work in two modes: boot-mode or
44 * normal mode. In boot mode we can execute only a handful of commands
45 * targeted at uploading the firmware and launching it.
47 * The 2400m enters boot mode when it is first connected to the
48 * system, when it crashes and when you ask it to reboot. There are
49 * two submodes of the boot mode: signed and non-signed. Signed takes
50 * firmwares signed with a certain private key, non-signed takes any
51 * firmware. Normal hardware takes only signed firmware.
53 * On boot mode, in USB, we write to the device using the bulk out
54 * endpoint and read from it in the notification endpoint.
56 * Upon entrance to boot mode, the device sends (preceded with a few
57 * zero length packets (ZLPs) on the notification endpoint in USB) a
58 * reboot barker (4 le32 words with the same value). We ack it by
59 * sending the same barker to the device. The device acks with a
60 * reboot ack barker (4 le32 words with value I2400M_ACK_BARKER) and
61 * then is fully booted. At this point we can upload the firmware.
63 * Note that different iterations of the device and EEPROM
64 * configurations will send different [re]boot barkers; these are
65 * collected in i2400m_barker_db along with the firmware
66 * characteristics they require.
68 * This process is accomplished by the i2400m_bootrom_init()
69 * function. All the device interaction happens through the
70 * i2400m_bm_cmd() [boot mode command]. Special return values will
71 * indicate if the device did reset during the process.
73 * After this, we read the MAC address and then (if needed)
74 * reinitialize the device. We need to read it ahead of time because
75 * in the future, we might not upload the firmware until userspace
76 * 'ifconfig up's the device.
78 * We can then upload the firmware file. The file is composed of a BCF
79 * header (basic data, keys and signatures) and a list of write
80 * commands and payloads. Optionally more BCF headers might follow the
81 * main payload. We first upload the header [i2400m_dnload_init()] and
82 * then pass the commands and payloads verbatim to the i2400m_bm_cmd()
83 * function [i2400m_dnload_bcf()]. Then we tell the device to jump to
84 * the new firmware [i2400m_dnload_finalize()].
86 * Once firmware is uploaded, we are good to go :)
88 * When we don't know in which mode we are, we first try by sending a
89 * warm reset request that will take us to boot-mode. If we time out
90 * waiting for a reboot barker, that means maybe we are already in
91 * boot mode, so we send a reboot barker.
95 * This code (and process) is single threaded; for executing commands,
96 * we post a URB to the notification endpoint, post the command, wait
97 * for data on the notification buffer. We don't need to worry about
98 * others as we know we are the only ones in there.
100 * BACKEND IMPLEMENTATION
102 * This code is bus-generic; the bus-specific driver provides back end
103 * implementations to send a boot mode command to the device and to
104 * read an acknolwedgement from it (or an asynchronous notification)
109 * Note that in some cases, we can't just load a firmware file (for
110 * example, when resuming). For that, we might cache the firmware
111 * file. Thus, when doing the bootstrap, if there is a cache firmware
112 * file, it is used; if not, loading from disk is attempted.
116 * i2400m_barker_db_init Called by i2400m_driver_init()
117 * i2400m_barker_db_add
119 * i2400m_barker_db_exit Called by i2400m_driver_exit()
121 * i2400m_dev_bootstrap Called by __i2400m_dev_start()
123 * i2400m_fw_bootstrap
125 * i2400m_fw_hdr_check
130 * i2400m_bootrom_init
134 * i2400m_dnload_init_signed
135 * i2400m_dnload_init_nonsigned
136 * i2400m_download_chunk
140 * i2400m_dnload_finalize
144 * i2400m->bus_bm_cmd_send()
145 * i2400m->bus_bm_wait_for_ack
146 * __i2400m_bm_ack_verify
147 * i2400m_is_boot_barker
149 * i2400m_bm_cmd_prepare Used by bus-drivers to prep
150 * commands before sending
152 * i2400m_pm_notifier Called on Power Management events
156 #include <linux/firmware.h>
157 #include <linux/sched.h>
158 #include <linux/slab.h>
159 #include <linux/usb.h>
160 #include <linux/export.h>
164 #define D_SUBMODULE fw
165 #include "debug-levels.h"
168 static const __le32 i2400m_ACK_BARKER
[4] = {
169 cpu_to_le32(I2400M_ACK_BARKER
),
170 cpu_to_le32(I2400M_ACK_BARKER
),
171 cpu_to_le32(I2400M_ACK_BARKER
),
172 cpu_to_le32(I2400M_ACK_BARKER
)
177 * Prepare a boot-mode command for delivery
179 * @cmd: pointer to bootrom header to prepare
181 * Computes checksum if so needed. After calling this function, DO NOT
182 * modify the command or header as the checksum won't work anymore.
184 * We do it from here because some times we cannot do it in the
185 * original context the command was sent (it is a const), so when we
186 * copy it to our staging buffer, we add the checksum there.
188 void i2400m_bm_cmd_prepare(struct i2400m_bootrom_header
*cmd
)
190 if (i2400m_brh_get_use_checksum(cmd
)) {
193 const u32
*checksum_ptr
= (void *) cmd
->payload
;
194 for (i
= 0; i
< cmd
->data_size
/ 4; i
++)
195 checksum
+= cpu_to_le32(*checksum_ptr
++);
196 checksum
+= cmd
->command
+ cmd
->target_addr
+ cmd
->data_size
;
197 cmd
->block_checksum
= cpu_to_le32(checksum
);
200 EXPORT_SYMBOL_GPL(i2400m_bm_cmd_prepare
);
204 * Database of known barkers.
206 * A barker is what the device sends indicating he is ready to be
207 * bootloaded. Different versions of the device will send different
208 * barkers. Depending on the barker, it might mean the device wants
209 * some kind of firmware or the other.
211 static struct i2400m_barker_db
{
214 static size_t i2400m_barker_db_used
, i2400m_barker_db_size
;
218 int i2400m_zrealloc_2x(void **ptr
, size_t *_count
, size_t el_size
,
221 size_t old_count
= *_count
,
222 new_count
= old_count
? 2 * old_count
: 2,
223 old_size
= el_size
* old_count
,
224 new_size
= el_size
* new_count
;
225 void *nptr
= krealloc(*ptr
, new_size
, gfp_flags
);
227 /* zero the other half or the whole thing if old_count
230 memset(nptr
, 0, new_size
);
232 memset(nptr
+ old_size
, 0, old_size
);
242 * Add a barker to the database
244 * This cannot used outside of this module and only at at module_init
245 * time. This is to avoid the need to do locking.
248 int i2400m_barker_db_add(u32 barker_id
)
252 struct i2400m_barker_db
*barker
;
253 if (i2400m_barker_db_used
>= i2400m_barker_db_size
) {
254 result
= i2400m_zrealloc_2x(
255 (void **) &i2400m_barker_db
, &i2400m_barker_db_size
,
256 sizeof(i2400m_barker_db
[0]), GFP_KERNEL
);
260 barker
= i2400m_barker_db
+ i2400m_barker_db_used
++;
261 barker
->data
[0] = le32_to_cpu(barker_id
);
262 barker
->data
[1] = le32_to_cpu(barker_id
);
263 barker
->data
[2] = le32_to_cpu(barker_id
);
264 barker
->data
[3] = le32_to_cpu(barker_id
);
269 void i2400m_barker_db_exit(void)
271 kfree(i2400m_barker_db
);
272 i2400m_barker_db
= NULL
;
273 i2400m_barker_db_size
= 0;
274 i2400m_barker_db_used
= 0;
279 * Helper function to add all the known stable barkers to the barker
283 int i2400m_barker_db_known_barkers(void)
287 result
= i2400m_barker_db_add(I2400M_NBOOT_BARKER
);
290 result
= i2400m_barker_db_add(I2400M_SBOOT_BARKER
);
293 result
= i2400m_barker_db_add(I2400M_SBOOT_BARKER_6050
);
302 * Initialize the barker database
304 * This can only be used from the module_init function for this
305 * module; this is to avoid the need to do locking.
307 * @options: command line argument with extra barkers to
308 * recognize. This is a comma-separated list of 32-bit hex
309 * numbers. They are appended to the existing list. Setting 0
310 * cleans the existing list and starts a new one.
312 int i2400m_barker_db_init(const char *_options
)
315 char *options
= NULL
, *options_orig
, *token
;
317 i2400m_barker_db
= NULL
;
318 i2400m_barker_db_size
= 0;
319 i2400m_barker_db_used
= 0;
321 result
= i2400m_barker_db_known_barkers();
324 /* parse command line options from i2400m.barkers */
325 if (_options
!= NULL
) {
328 options_orig
= kstrdup(_options
, GFP_KERNEL
);
329 if (options_orig
== NULL
) {
333 options
= options_orig
;
335 while ((token
= strsep(&options
, ",")) != NULL
) {
336 if (*token
== '\0') /* eat joint commas */
338 if (sscanf(token
, "%x", &barker
) != 1
339 || barker
> 0xffffffff) {
340 printk(KERN_ERR
"%s: can't recognize "
341 "i2400m.barkers value '%s' as "
348 /* clean list and start new */
349 i2400m_barker_db_exit();
352 result
= i2400m_barker_db_add(barker
);
354 goto error_parse_add
;
364 kfree(i2400m_barker_db
);
370 * Recognize a boot barker
372 * @buf: buffer where the boot barker.
373 * @buf_size: size of the buffer (has to be 16 bytes). It is passed
374 * here so the function can check it for the caller.
376 * Note that as a side effect, upon identifying the obtained boot
377 * barker, this function will set i2400m->barker to point to the right
378 * barker database entry. Subsequent calls to the function will result
379 * in verifying that the same type of boot barker is returned when the
380 * device [re]boots (as long as the same device instance is used).
382 * Return: 0 if @buf matches a known boot barker. -ENOENT if the
383 * buffer in @buf doesn't match any boot barker in the database or
384 * -EILSEQ if the buffer doesn't have the right size.
386 int i2400m_is_boot_barker(struct i2400m
*i2400m
,
387 const void *buf
, size_t buf_size
)
390 struct device
*dev
= i2400m_dev(i2400m
);
391 struct i2400m_barker_db
*barker
;
395 if (buf_size
!= sizeof(i2400m_barker_db
[i
].data
))
398 /* Short circuit if we have already discovered the barker
399 * associated with the device. */
401 && !memcmp(buf
, i2400m
->barker
, sizeof(i2400m
->barker
->data
))) {
402 unsigned index
= (i2400m
->barker
- i2400m_barker_db
)
403 / sizeof(*i2400m
->barker
);
404 d_printf(2, dev
, "boot barker cache-confirmed #%u/%08x\n",
405 index
, le32_to_cpu(i2400m
->barker
->data
[0]));
409 for (i
= 0; i
< i2400m_barker_db_used
; i
++) {
410 barker
= &i2400m_barker_db
[i
];
411 BUILD_BUG_ON(sizeof(barker
->data
) != 16);
412 if (memcmp(buf
, barker
->data
, sizeof(barker
->data
)))
415 if (i2400m
->barker
== NULL
) {
416 i2400m
->barker
= barker
;
417 d_printf(1, dev
, "boot barker set to #%u/%08x\n",
418 i
, le32_to_cpu(barker
->data
[0]));
419 if (barker
->data
[0] == le32_to_cpu(I2400M_NBOOT_BARKER
))
423 } else if (i2400m
->barker
!= barker
) {
424 dev_err(dev
, "HW inconsistency: device "
425 "reports a different boot barker "
426 "than set (from %08x to %08x)\n",
427 le32_to_cpu(i2400m
->barker
->data
[0]),
428 le32_to_cpu(barker
->data
[0]));
431 d_printf(2, dev
, "boot barker confirmed #%u/%08x\n",
432 i
, le32_to_cpu(barker
->data
[0]));
438 EXPORT_SYMBOL_GPL(i2400m_is_boot_barker
);
442 * Verify the ack data received
444 * Given a reply to a boot mode command, chew it and verify everything
447 * @opcode: opcode which generated this ack. For error messages.
448 * @ack: pointer to ack data we received
449 * @ack_size: size of that data buffer
450 * @flags: I2400M_BM_CMD_* flags we called the command with.
452 * Way too long function -- maybe it should be further split
455 ssize_t
__i2400m_bm_ack_verify(struct i2400m
*i2400m
, int opcode
,
456 struct i2400m_bootrom_header
*ack
,
457 size_t ack_size
, int flags
)
459 ssize_t result
= -ENOMEM
;
460 struct device
*dev
= i2400m_dev(i2400m
);
462 d_fnstart(8, dev
, "(i2400m %p opcode %d ack %p size %zu)\n",
463 i2400m
, opcode
, ack
, ack_size
);
464 if (ack_size
< sizeof(*ack
)) {
466 dev_err(dev
, "boot-mode cmd %d: HW BUG? notification didn't "
467 "return enough data (%zu bytes vs %zu expected)\n",
468 opcode
, ack_size
, sizeof(*ack
));
469 goto error_ack_short
;
471 result
= i2400m_is_boot_barker(i2400m
, ack
, ack_size
);
473 result
= -ERESTARTSYS
;
474 d_printf(6, dev
, "boot-mode cmd %d: HW boot barker\n", opcode
);
477 if (ack_size
== sizeof(i2400m_ACK_BARKER
)
478 && memcmp(ack
, i2400m_ACK_BARKER
, sizeof(*ack
)) == 0) {
480 d_printf(3, dev
, "boot-mode cmd %d: HW reboot ack barker\n",
482 goto error_reboot_ack
;
485 if (flags
& I2400M_BM_CMD_RAW
)
487 ack
->data_size
= le32_to_cpu(ack
->data_size
);
488 ack
->target_addr
= le32_to_cpu(ack
->target_addr
);
489 ack
->block_checksum
= le32_to_cpu(ack
->block_checksum
);
490 d_printf(5, dev
, "boot-mode cmd %d: notification for opcode %u "
491 "response %u csum %u rr %u da %u\n",
492 opcode
, i2400m_brh_get_opcode(ack
),
493 i2400m_brh_get_response(ack
),
494 i2400m_brh_get_use_checksum(ack
),
495 i2400m_brh_get_response_required(ack
),
496 i2400m_brh_get_direct_access(ack
));
498 if (i2400m_brh_get_signature(ack
) != 0xcbbc) {
499 dev_err(dev
, "boot-mode cmd %d: HW BUG? wrong signature "
500 "0x%04x\n", opcode
, i2400m_brh_get_signature(ack
));
501 goto error_ack_signature
;
503 if (opcode
!= -1 && opcode
!= i2400m_brh_get_opcode(ack
)) {
504 dev_err(dev
, "boot-mode cmd %d: HW BUG? "
505 "received response for opcode %u, expected %u\n",
506 opcode
, i2400m_brh_get_opcode(ack
), opcode
);
507 goto error_ack_opcode
;
509 if (i2400m_brh_get_response(ack
) != 0) { /* failed? */
510 dev_err(dev
, "boot-mode cmd %d: error; hw response %u\n",
511 opcode
, i2400m_brh_get_response(ack
));
512 goto error_ack_failed
;
514 if (ack_size
< ack
->data_size
+ sizeof(*ack
)) {
515 dev_err(dev
, "boot-mode cmd %d: SW BUG "
516 "driver provided only %zu bytes for %zu bytes "
517 "of data\n", opcode
, ack_size
,
518 (size_t) le32_to_cpu(ack
->data_size
) + sizeof(*ack
));
519 goto error_ack_short_buffer
;
522 /* Don't you love this stack of empty targets? Well, I don't
523 * either, but it helps track exactly who comes in here and
525 error_ack_short_buffer
:
533 d_fnend(8, dev
, "(i2400m %p opcode %d ack %p size %zu) = %d\n",
534 i2400m
, opcode
, ack
, ack_size
, (int) result
);
540 * i2400m_bm_cmd - Execute a boot mode command
542 * @cmd: buffer containing the command data (pointing at the header).
543 * This data can be ANYWHERE (for USB, we will copy it to an
544 * specific buffer). Make sure everything is in proper little
547 * A raw buffer can be also sent, just cast it and set flags to
550 * This function will generate a checksum for you if the
551 * checksum bit in the command is set (unless I2400M_BM_CMD_RAW
554 * You can use the i2400m->bm_cmd_buf to stage your commands and
557 * If NULL, no command is sent (we just wait for an ack).
559 * @cmd_size: size of the command. Will be auto padded to the
560 * bus-specific drivers padding requirements.
562 * @ack: buffer where to place the acknowledgement. If it is a regular
563 * command response, all fields will be returned with the right,
566 * You *cannot* use i2400m->bm_ack_buf for this buffer.
568 * @ack_size: size of @ack, 16 aligned; you need to provide at least
569 * sizeof(*ack) bytes and then enough to contain the return data
572 * @flags: see I2400M_BM_CMD_* above.
574 * @returns: bytes received by the notification; if < 0, an errno code
575 * denoting an error or:
577 * -ERESTARTSYS The device has rebooted
579 * Executes a boot-mode command and waits for a response, doing basic
580 * validation on it; if a zero length response is received, it retries
581 * waiting for a response until a non-zero one is received (timing out
582 * after %I2400M_BOOT_RETRIES retries).
585 ssize_t
i2400m_bm_cmd(struct i2400m
*i2400m
,
586 const struct i2400m_bootrom_header
*cmd
, size_t cmd_size
,
587 struct i2400m_bootrom_header
*ack
, size_t ack_size
,
590 ssize_t result
= -ENOMEM
, rx_bytes
;
591 struct device
*dev
= i2400m_dev(i2400m
);
592 int opcode
= cmd
== NULL
? -1 : i2400m_brh_get_opcode(cmd
);
594 d_fnstart(6, dev
, "(i2400m %p cmd %p size %zu ack %p size %zu)\n",
595 i2400m
, cmd
, cmd_size
, ack
, ack_size
);
596 BUG_ON(ack_size
< sizeof(*ack
));
597 BUG_ON(i2400m
->boot_mode
== 0);
599 if (cmd
!= NULL
) { /* send the command */
600 result
= i2400m
->bus_bm_cmd_send(i2400m
, cmd
, cmd_size
, flags
);
603 if ((flags
& I2400M_BM_CMD_RAW
) == 0)
605 "boot-mode cmd %d csum %u rr %u da %u: "
606 "addr 0x%04x size %u block csum 0x%04x\n",
607 opcode
, i2400m_brh_get_use_checksum(cmd
),
608 i2400m_brh_get_response_required(cmd
),
609 i2400m_brh_get_direct_access(cmd
),
610 cmd
->target_addr
, cmd
->data_size
,
611 cmd
->block_checksum
);
613 result
= i2400m
->bus_bm_wait_for_ack(i2400m
, ack
, ack_size
);
615 dev_err(dev
, "boot-mode cmd %d: error waiting for an ack: %d\n",
616 opcode
, (int) result
); /* bah, %zd doesn't work */
617 goto error_wait_for_ack
;
620 /* verify the ack and read more if necessary [result is the
621 * final amount of bytes we get in the ack] */
622 result
= __i2400m_bm_ack_verify(i2400m
, opcode
, ack
, ack_size
, flags
);
625 /* Don't you love this stack of empty targets? Well, I don't
626 * either, but it helps track exactly who comes in here and
632 d_fnend(6, dev
, "(i2400m %p cmd %p size %zu ack %p size %zu) = %d\n",
633 i2400m
, cmd
, cmd_size
, ack
, ack_size
, (int) result
);
639 * i2400m_download_chunk - write a single chunk of data to the device's memory
641 * @i2400m: device descriptor
642 * @buf: the buffer to write
643 * @buf_len: length of the buffer to write
644 * @addr: address in the device memory space
645 * @direct: bootrom write mode
646 * @do_csum: should a checksum validation be performed
648 static int i2400m_download_chunk(struct i2400m
*i2400m
, const void *chunk
,
649 size_t __chunk_len
, unsigned long addr
,
650 unsigned int direct
, unsigned int do_csum
)
653 size_t chunk_len
= ALIGN(__chunk_len
, I2400M_PL_ALIGN
);
654 struct device
*dev
= i2400m_dev(i2400m
);
656 struct i2400m_bootrom_header cmd
;
659 struct i2400m_bootrom_header ack
;
661 d_fnstart(5, dev
, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
662 "direct %u do_csum %u)\n", i2400m
, chunk
, __chunk_len
,
663 addr
, direct
, do_csum
);
664 buf
= i2400m
->bm_cmd_buf
;
665 memcpy(buf
->cmd_payload
, chunk
, __chunk_len
);
666 memset(buf
->cmd_payload
+ __chunk_len
, 0xad, chunk_len
- __chunk_len
);
668 buf
->cmd
.command
= i2400m_brh_command(I2400M_BRH_WRITE
,
669 __chunk_len
& 0x3 ? 0 : do_csum
,
670 __chunk_len
& 0xf ? 0 : direct
);
671 buf
->cmd
.target_addr
= cpu_to_le32(addr
);
672 buf
->cmd
.data_size
= cpu_to_le32(__chunk_len
);
673 ret
= i2400m_bm_cmd(i2400m
, &buf
->cmd
, sizeof(buf
->cmd
) + chunk_len
,
674 &ack
, sizeof(ack
), 0);
677 d_fnend(5, dev
, "(i2400m %p chunk %p __chunk_len %zu addr 0x%08lx "
678 "direct %u do_csum %u) = %d\n", i2400m
, chunk
, __chunk_len
,
679 addr
, direct
, do_csum
, ret
);
685 * Download a BCF file's sections to the device
687 * @i2400m: device descriptor
688 * @bcf: pointer to firmware data (first header followed by the
689 * payloads). Assumed verified and consistent.
690 * @bcf_len: length (in bytes) of the @bcf buffer.
692 * Returns: < 0 errno code on error or the offset to the jump instruction.
694 * Given a BCF file, downloads each section (a command and a payload)
695 * to the device's address space. Actually, it just executes each
696 * command i the BCF file.
698 * The section size has to be aligned to 4 bytes AND the padding has
699 * to be taken from the firmware file, as the signature takes it into
703 ssize_t
i2400m_dnload_bcf(struct i2400m
*i2400m
,
704 const struct i2400m_bcf_hdr
*bcf
, size_t bcf_len
)
707 struct device
*dev
= i2400m_dev(i2400m
);
708 size_t offset
, /* iterator offset */
709 data_size
, /* Size of the data payload */
710 section_size
, /* Size of the whole section (cmd + payload) */
712 const struct i2400m_bootrom_header
*bh
;
713 struct i2400m_bootrom_header ack
;
715 d_fnstart(3, dev
, "(i2400m %p bcf %p bcf_len %zu)\n",
716 i2400m
, bcf
, bcf_len
);
717 /* Iterate over the command blocks in the BCF file that start
718 * after the header */
719 offset
= le32_to_cpu(bcf
->header_len
) * sizeof(u32
);
720 while (1) { /* start sending the file */
721 bh
= (void *) bcf
+ offset
;
722 data_size
= le32_to_cpu(bh
->data_size
);
723 section_size
= ALIGN(sizeof(*bh
) + data_size
, 4);
725 "downloading section #%zu (@%zu %zu B) to 0x%08x\n",
726 section
, offset
, sizeof(*bh
) + data_size
,
727 le32_to_cpu(bh
->target_addr
));
729 * We look for JUMP cmd from the bootmode header,
730 * either I2400M_BRH_SIGNED_JUMP for secure boot
731 * or I2400M_BRH_JUMP for unsecure boot, the last chunk
732 * should be the bootmode header with JUMP cmd.
734 if (i2400m_brh_get_opcode(bh
) == I2400M_BRH_SIGNED_JUMP
||
735 i2400m_brh_get_opcode(bh
) == I2400M_BRH_JUMP
) {
736 d_printf(5, dev
, "jump found @%zu\n", offset
);
739 if (offset
+ section_size
> bcf_len
) {
740 dev_err(dev
, "fw %s: bad section #%zu, "
741 "end (@%zu) beyond EOF (@%zu)\n",
742 i2400m
->fw_name
, section
,
743 offset
+ section_size
, bcf_len
);
745 goto error_section_beyond_eof
;
748 ret
= i2400m_bm_cmd(i2400m
, bh
, section_size
,
749 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
751 dev_err(dev
, "fw %s: section #%zu (@%zu %zu B) "
752 "failed %d\n", i2400m
->fw_name
, section
,
753 offset
, sizeof(*bh
) + data_size
, (int) ret
);
756 offset
+= section_size
;
760 error_section_beyond_eof
:
762 d_fnend(3, dev
, "(i2400m %p bcf %p bcf_len %zu) = %d\n",
763 i2400m
, bcf
, bcf_len
, (int) ret
);
769 * Indicate if the device emitted a reboot barker that indicates
773 unsigned i2400m_boot_is_signed(struct i2400m
*i2400m
)
775 return likely(i2400m
->sboot
);
780 * Do the final steps of uploading firmware
782 * @bcf_hdr: BCF header we are actually using
783 * @bcf: pointer to the firmware image (which matches the first header
784 * that is followed by the actual payloads).
785 * @offset: [byte] offset into @bcf for the command we need to send.
787 * Depending on the boot mode (signed vs non-signed), different
788 * actions need to be taken.
791 int i2400m_dnload_finalize(struct i2400m
*i2400m
,
792 const struct i2400m_bcf_hdr
*bcf_hdr
,
793 const struct i2400m_bcf_hdr
*bcf
, size_t offset
)
796 struct device
*dev
= i2400m_dev(i2400m
);
797 struct i2400m_bootrom_header
*cmd
, ack
;
799 struct i2400m_bootrom_header cmd
;
802 size_t signature_block_offset
, signature_block_size
;
804 d_fnstart(3, dev
, "offset %zu\n", offset
);
805 cmd
= (void *) bcf
+ offset
;
806 if (i2400m_boot_is_signed(i2400m
) == 0) {
807 struct i2400m_bootrom_header jump_ack
;
808 d_printf(1, dev
, "unsecure boot, jumping to 0x%08x\n",
809 le32_to_cpu(cmd
->target_addr
));
810 cmd_buf
= i2400m
->bm_cmd_buf
;
811 memcpy(&cmd_buf
->cmd
, cmd
, sizeof(*cmd
));
813 /* now cmd points to the actual bootrom_header in cmd_buf */
814 i2400m_brh_set_opcode(cmd
, I2400M_BRH_JUMP
);
816 ret
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
817 &jump_ack
, sizeof(jump_ack
), 0);
819 d_printf(1, dev
, "secure boot, jumping to 0x%08x\n",
820 le32_to_cpu(cmd
->target_addr
));
821 cmd_buf
= i2400m
->bm_cmd_buf
;
822 memcpy(&cmd_buf
->cmd
, cmd
, sizeof(*cmd
));
823 signature_block_offset
=
825 + le32_to_cpu(bcf_hdr
->key_size
) * sizeof(u32
)
826 + le32_to_cpu(bcf_hdr
->exponent_size
) * sizeof(u32
);
827 signature_block_size
=
828 le32_to_cpu(bcf_hdr
->modulus_size
) * sizeof(u32
);
829 memcpy(cmd_buf
->cmd_pl
,
830 (void *) bcf_hdr
+ signature_block_offset
,
831 signature_block_size
);
832 ret
= i2400m_bm_cmd(i2400m
, &cmd_buf
->cmd
,
833 sizeof(cmd_buf
->cmd
) + signature_block_size
,
834 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
836 d_fnend(3, dev
, "returning %d\n", ret
);
842 * i2400m_bootrom_init - Reboots a powered device into boot mode
844 * @i2400m: device descriptor
846 * I2400M_BRI_SOFT: a reboot barker has been seen
847 * already, so don't wait for it.
849 * I2400M_BRI_NO_REBOOT: Don't send a reboot command, but wait
850 * for a reboot barker notification. This is a one shot; if
851 * the state machine needs to send a reboot command it will.
855 * < 0 errno code on error, 0 if ok.
859 * Tries hard enough to put the device in boot-mode. There are two
860 * main phases to this:
862 * a. (1) send a reboot command and (2) get a reboot barker
864 * b. (1) echo/ack the reboot sending the reboot barker back and (2)
865 * getting an ack barker in return
867 * We want to skip (a) in some cases [soft]. The state machine is
868 * horrible, but it is basically: on each phase, send what has to be
869 * sent (if any), wait for the answer and act on the answer. We might
870 * have to backtrack and retry, so we keep a max tries counter for
873 * It sucks because we don't know ahead of time which is going to be
874 * the reboot barker (the device might send different ones depending
875 * on its EEPROM config) and once the device reboots and waits for the
876 * echo/ack reboot barker being sent back, it doesn't understand
877 * anything else. So we can be left at the point where we don't know
878 * what to send to it -- cold reset and bus reset seem to have little
879 * effect. So the function iterates (in this case) through all the
880 * known barkers and tries them all until an ACK is
881 * received. Otherwise, it gives up.
883 * If we get a timeout after sending a warm reset, we do it again.
885 int i2400m_bootrom_init(struct i2400m
*i2400m
, enum i2400m_bri flags
)
888 struct device
*dev
= i2400m_dev(i2400m
);
889 struct i2400m_bootrom_header
*cmd
;
890 struct i2400m_bootrom_header ack
;
891 int count
= i2400m
->bus_bm_retries
;
892 int ack_timeout_cnt
= 1;
895 BUILD_BUG_ON(sizeof(*cmd
) != sizeof(i2400m_barker_db
[0].data
));
896 BUILD_BUG_ON(sizeof(ack
) != sizeof(i2400m_ACK_BARKER
));
898 d_fnstart(4, dev
, "(i2400m %p flags 0x%08x)\n", i2400m
, flags
);
900 cmd
= i2400m
->bm_cmd_buf
;
901 if (flags
& I2400M_BRI_SOFT
)
907 d_printf(4, dev
, "device reboot: reboot command [%d # left]\n",
909 if ((flags
& I2400M_BRI_NO_REBOOT
) == 0)
910 i2400m_reset(i2400m
, I2400M_RT_WARM
);
911 result
= i2400m_bm_cmd(i2400m
, NULL
, 0, &ack
, sizeof(ack
),
913 flags
&= ~I2400M_BRI_NO_REBOOT
;
917 * at this point, i2400m_bm_cmd(), through
918 * __i2400m_bm_ack_process(), has updated
919 * i2400m->barker and we are good to go.
921 d_printf(4, dev
, "device reboot: got reboot barker\n");
923 case -EISCONN
: /* we don't know how it got here...but we follow it */
924 d_printf(4, dev
, "device reboot: got ack barker - whatever\n");
928 * Device has timed out, we might be in boot mode
929 * already and expecting an ack; if we don't know what
930 * the barker is, we just send them all. Cold reset
931 * and bus reset don't work. Beats me.
933 if (i2400m
->barker
!= NULL
) {
934 dev_err(dev
, "device boot: reboot barker timed out, "
935 "trying (set) %08x echo/ack\n",
936 le32_to_cpu(i2400m
->barker
->data
[0]));
939 for (i
= 0; i
< i2400m_barker_db_used
; i
++) {
940 struct i2400m_barker_db
*barker
= &i2400m_barker_db
[i
];
941 memcpy(cmd
, barker
->data
, sizeof(barker
->data
));
942 result
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
945 if (result
== -EISCONN
) {
946 dev_warn(dev
, "device boot: got ack barker "
947 "after sending echo/ack barker "
948 "#%d/%08x; rebooting j.i.c.\n",
949 i
, le32_to_cpu(barker
->data
[0]));
950 flags
&= ~I2400M_BRI_NO_REBOOT
;
954 dev_err(dev
, "device boot: tried all the echo/acks, could "
955 "not get device to respond; giving up");
958 case -ESHUTDOWN
: /* dev is gone */
959 case -EINTR
: /* user cancelled */
962 dev_err(dev
, "device reboot: error %d while waiting "
963 "for reboot barker - rebooting\n", result
);
964 d_dump(1, dev
, &ack
, result
);
967 /* At this point we ack back with 4 REBOOT barkers and expect
968 * 4 ACK barkers. This is ugly, as we send a raw command --
969 * hence the cast. _bm_cmd() will catch the reboot ack
970 * notification and report it as -EISCONN. */
972 d_printf(4, dev
, "device reboot ack: sending ack [%d # left]\n", count
);
973 memcpy(cmd
, i2400m
->barker
->data
, sizeof(i2400m
->barker
->data
));
974 result
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
975 &ack
, sizeof(ack
), I2400M_BM_CMD_RAW
);
978 d_printf(4, dev
, "reboot ack: got reboot barker - retrying\n");
983 d_printf(4, dev
, "reboot ack: got ack barker - good\n");
985 case -ETIMEDOUT
: /* no response, maybe it is the other type? */
986 if (ack_timeout_cnt
-- < 0) {
987 d_printf(4, dev
, "reboot ack timedout: retrying\n");
990 dev_err(dev
, "reboot ack timedout too long: "
996 case -ESHUTDOWN
: /* dev is gone */
999 dev_err(dev
, "device reboot ack: error %d while waiting for "
1000 "reboot ack barker - rebooting\n", result
);
1003 d_printf(2, dev
, "device reboot ack: got ack barker - boot done\n");
1007 d_fnend(4, dev
, "(i2400m %p flags 0x%08x) = %d\n",
1008 i2400m
, flags
, result
);
1012 dev_err(dev
, "Timed out waiting for reboot ack\n");
1013 result
= -ETIMEDOUT
;
1021 * The position this function reads is fixed in device memory and
1022 * always available, even without firmware.
1024 * Note we specify we want to read only six bytes, but provide space
1025 * for 16, as we always get it rounded up.
1027 int i2400m_read_mac_addr(struct i2400m
*i2400m
)
1030 struct device
*dev
= i2400m_dev(i2400m
);
1031 struct net_device
*net_dev
= i2400m
->wimax_dev
.net_dev
;
1032 struct i2400m_bootrom_header
*cmd
;
1034 struct i2400m_bootrom_header ack
;
1038 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1039 cmd
= i2400m
->bm_cmd_buf
;
1040 cmd
->command
= i2400m_brh_command(I2400M_BRH_READ
, 0, 1);
1041 cmd
->target_addr
= cpu_to_le32(0x00203fe8);
1042 cmd
->data_size
= cpu_to_le32(6);
1043 result
= i2400m_bm_cmd(i2400m
, cmd
, sizeof(*cmd
),
1044 &ack_buf
.ack
, sizeof(ack_buf
), 0);
1046 dev_err(dev
, "BM: read mac addr failed: %d\n", result
);
1047 goto error_read_mac
;
1049 d_printf(2, dev
, "mac addr is %pM\n", ack_buf
.ack_pl
);
1050 if (i2400m
->bus_bm_mac_addr_impaired
== 1) {
1051 ack_buf
.ack_pl
[0] = 0x00;
1052 ack_buf
.ack_pl
[1] = 0x16;
1053 ack_buf
.ack_pl
[2] = 0xd3;
1054 get_random_bytes(&ack_buf
.ack_pl
[3], 3);
1055 dev_err(dev
, "BM is MAC addr impaired, faking MAC addr to "
1056 "mac addr is %pM\n", ack_buf
.ack_pl
);
1059 net_dev
->addr_len
= ETH_ALEN
;
1060 memcpy(net_dev
->dev_addr
, ack_buf
.ack_pl
, ETH_ALEN
);
1062 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, result
);
1068 * Initialize a non signed boot
1070 * This implies sending some magic values to the device's memory. Note
1071 * we convert the values to little endian in the same array
1075 int i2400m_dnload_init_nonsigned(struct i2400m
*i2400m
)
1079 struct device
*dev
= i2400m_dev(i2400m
);
1080 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1081 if (i2400m
->bus_bm_pokes_table
) {
1082 while (i2400m
->bus_bm_pokes_table
[i
].address
) {
1083 ret
= i2400m_download_chunk(
1085 &i2400m
->bus_bm_pokes_table
[i
].data
,
1086 sizeof(i2400m
->bus_bm_pokes_table
[i
].data
),
1087 i2400m
->bus_bm_pokes_table
[i
].address
, 1, 1);
1093 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, ret
);
1099 * Initialize the signed boot process
1101 * @i2400m: device descriptor
1103 * @bcf_hdr: pointer to the firmware header; assumes it is fully in
1104 * memory (it has gone through basic validation).
1106 * Returns: 0 if ok, < 0 errno code on error, -ERESTARTSYS if the hw
1109 * This writes the firmware BCF header to the device using the
1110 * HASH_PAYLOAD_ONLY command.
1113 int i2400m_dnload_init_signed(struct i2400m
*i2400m
,
1114 const struct i2400m_bcf_hdr
*bcf_hdr
)
1117 struct device
*dev
= i2400m_dev(i2400m
);
1119 struct i2400m_bootrom_header cmd
;
1120 struct i2400m_bcf_hdr cmd_pl
;
1121 } __packed
*cmd_buf
;
1122 struct i2400m_bootrom_header ack
;
1124 d_fnstart(5, dev
, "(i2400m %p bcf_hdr %p)\n", i2400m
, bcf_hdr
);
1125 cmd_buf
= i2400m
->bm_cmd_buf
;
1126 cmd_buf
->cmd
.command
=
1127 i2400m_brh_command(I2400M_BRH_HASH_PAYLOAD_ONLY
, 0, 0);
1128 cmd_buf
->cmd
.target_addr
= 0;
1129 cmd_buf
->cmd
.data_size
= cpu_to_le32(sizeof(cmd_buf
->cmd_pl
));
1130 memcpy(&cmd_buf
->cmd_pl
, bcf_hdr
, sizeof(*bcf_hdr
));
1131 ret
= i2400m_bm_cmd(i2400m
, &cmd_buf
->cmd
, sizeof(*cmd_buf
),
1132 &ack
, sizeof(ack
), 0);
1135 d_fnend(5, dev
, "(i2400m %p bcf_hdr %p) = %d\n", i2400m
, bcf_hdr
, ret
);
1141 * Initialize the firmware download at the device size
1143 * Multiplex to the one that matters based on the device's mode
1144 * (signed or non-signed).
1147 int i2400m_dnload_init(struct i2400m
*i2400m
,
1148 const struct i2400m_bcf_hdr
*bcf_hdr
)
1151 struct device
*dev
= i2400m_dev(i2400m
);
1153 if (i2400m_boot_is_signed(i2400m
)) {
1154 d_printf(1, dev
, "signed boot\n");
1155 result
= i2400m_dnload_init_signed(i2400m
, bcf_hdr
);
1156 if (result
== -ERESTARTSYS
)
1159 dev_err(dev
, "firmware %s: signed boot download "
1160 "initialization failed: %d\n",
1161 i2400m
->fw_name
, result
);
1163 /* non-signed boot process without pokes */
1164 d_printf(1, dev
, "non-signed boot\n");
1165 result
= i2400m_dnload_init_nonsigned(i2400m
);
1166 if (result
== -ERESTARTSYS
)
1169 dev_err(dev
, "firmware %s: non-signed download "
1170 "initialization failed: %d\n",
1171 i2400m
->fw_name
, result
);
1178 * Run consistency tests on the firmware file and load up headers
1180 * Check for the firmware being made for the i2400m device,
1181 * etc...These checks are mostly informative, as the device will make
1182 * them too; but the driver's response is more informative on what
1185 * This will also look at all the headers present on the firmware
1186 * file, and update i2400m->fw_bcf_hdr to point to them.
1189 int i2400m_fw_hdr_check(struct i2400m
*i2400m
,
1190 const struct i2400m_bcf_hdr
*bcf_hdr
,
1191 size_t index
, size_t offset
)
1193 struct device
*dev
= i2400m_dev(i2400m
);
1195 unsigned module_type
, header_len
, major_version
, minor_version
,
1196 module_id
, module_vendor
, date
, size
;
1198 module_type
= le32_to_cpu(bcf_hdr
->module_type
);
1199 header_len
= sizeof(u32
) * le32_to_cpu(bcf_hdr
->header_len
);
1200 major_version
= (le32_to_cpu(bcf_hdr
->header_version
) & 0xffff0000)
1202 minor_version
= le32_to_cpu(bcf_hdr
->header_version
) & 0x0000ffff;
1203 module_id
= le32_to_cpu(bcf_hdr
->module_id
);
1204 module_vendor
= le32_to_cpu(bcf_hdr
->module_vendor
);
1205 date
= le32_to_cpu(bcf_hdr
->date
);
1206 size
= sizeof(u32
) * le32_to_cpu(bcf_hdr
->size
);
1208 d_printf(1, dev
, "firmware %s #%zd@%08zx: BCF header "
1209 "type:vendor:id 0x%x:%x:%x v%u.%u (%u/%u B) built %08x\n",
1210 i2400m
->fw_name
, index
, offset
,
1211 module_type
, module_vendor
, module_id
,
1212 major_version
, minor_version
, header_len
, size
, date
);
1215 if (major_version
!= 1) {
1216 dev_err(dev
, "firmware %s #%zd@%08zx: major header version "
1217 "v%u.%u not supported\n",
1218 i2400m
->fw_name
, index
, offset
,
1219 major_version
, minor_version
);
1223 if (module_type
!= 6) { /* built for the right hardware? */
1224 dev_err(dev
, "firmware %s #%zd@%08zx: unexpected module "
1225 "type 0x%x; aborting\n",
1226 i2400m
->fw_name
, index
, offset
,
1231 if (module_vendor
!= 0x8086) {
1232 dev_err(dev
, "firmware %s #%zd@%08zx: unexpected module "
1233 "vendor 0x%x; aborting\n",
1234 i2400m
->fw_name
, index
, offset
, module_vendor
);
1238 if (date
< 0x20080300)
1239 dev_warn(dev
, "firmware %s #%zd@%08zx: build date %08x "
1240 "too old; unsupported\n",
1241 i2400m
->fw_name
, index
, offset
, date
);
1247 * Run consistency tests on the firmware file and load up headers
1249 * Check for the firmware being made for the i2400m device,
1250 * etc...These checks are mostly informative, as the device will make
1251 * them too; but the driver's response is more informative on what
1254 * This will also look at all the headers present on the firmware
1255 * file, and update i2400m->fw_hdrs to point to them.
1258 int i2400m_fw_check(struct i2400m
*i2400m
, const void *bcf
, size_t bcf_size
)
1261 struct device
*dev
= i2400m_dev(i2400m
);
1263 const struct i2400m_bcf_hdr
*bcf_hdr
;
1264 const void *itr
, *next
, *top
;
1265 size_t slots
= 0, used_slots
= 0;
1267 for (itr
= bcf
, top
= itr
+ bcf_size
;
1269 headers
++, itr
= next
) {
1270 size_t leftover
, offset
, header_len
, size
;
1272 leftover
= top
- itr
;
1274 if (leftover
<= sizeof(*bcf_hdr
)) {
1275 dev_err(dev
, "firmware %s: %zu B left at @%zx, "
1276 "not enough for BCF header\n",
1277 i2400m
->fw_name
, leftover
, offset
);
1281 /* Only the first header is supposed to be followed by
1283 header_len
= sizeof(u32
) * le32_to_cpu(bcf_hdr
->header_len
);
1284 size
= sizeof(u32
) * le32_to_cpu(bcf_hdr
->size
);
1288 next
= itr
+ header_len
;
1290 result
= i2400m_fw_hdr_check(i2400m
, bcf_hdr
, headers
, offset
);
1293 if (used_slots
+ 1 >= slots
) {
1294 /* +1 -> we need to account for the one we'll
1295 * occupy and at least an extra one for
1296 * always being NULL */
1297 result
= i2400m_zrealloc_2x(
1298 (void **) &i2400m
->fw_hdrs
, &slots
,
1299 sizeof(i2400m
->fw_hdrs
[0]),
1302 goto error_zrealloc
;
1304 i2400m
->fw_hdrs
[used_slots
] = bcf_hdr
;
1308 dev_err(dev
, "firmware %s: no usable headers found\n",
1319 * Match a barker to a BCF header module ID
1321 * The device sends a barker which tells the firmware loader which
1322 * header in the BCF file has to be used. This does the matching.
1325 unsigned i2400m_bcf_hdr_match(struct i2400m
*i2400m
,
1326 const struct i2400m_bcf_hdr
*bcf_hdr
)
1328 u32 barker
= le32_to_cpu(i2400m
->barker
->data
[0])
1330 u32 module_id
= le32_to_cpu(bcf_hdr
->module_id
)
1331 & 0x7fffffff; /* high bit used for something else */
1333 /* special case for 5x50 */
1334 if (barker
== I2400M_SBOOT_BARKER
&& module_id
== 0)
1336 if (module_id
== barker
)
1342 const struct i2400m_bcf_hdr
*i2400m_bcf_hdr_find(struct i2400m
*i2400m
)
1344 struct device
*dev
= i2400m_dev(i2400m
);
1345 const struct i2400m_bcf_hdr
**bcf_itr
, *bcf_hdr
;
1347 u32 barker
= le32_to_cpu(i2400m
->barker
->data
[0]);
1349 d_printf(2, dev
, "finding BCF header for barker %08x\n", barker
);
1350 if (barker
== I2400M_NBOOT_BARKER
) {
1351 bcf_hdr
= i2400m
->fw_hdrs
[0];
1352 d_printf(1, dev
, "using BCF header #%u/%08x for non-signed "
1353 "barker\n", 0, le32_to_cpu(bcf_hdr
->module_id
));
1356 for (bcf_itr
= i2400m
->fw_hdrs
; *bcf_itr
!= NULL
; bcf_itr
++, i
++) {
1358 if (i2400m_bcf_hdr_match(i2400m
, bcf_hdr
)) {
1359 d_printf(1, dev
, "hit on BCF hdr #%u/%08x\n",
1360 i
, le32_to_cpu(bcf_hdr
->module_id
));
1363 d_printf(1, dev
, "miss on BCF hdr #%u/%08x\n",
1364 i
, le32_to_cpu(bcf_hdr
->module_id
));
1366 dev_err(dev
, "cannot find a matching BCF header for barker %08x\n",
1373 * Download the firmware to the device
1375 * @i2400m: device descriptor
1376 * @bcf: pointer to loaded (and minimally verified for consistency)
1378 * @bcf_size: size of the @bcf buffer (header plus payloads)
1380 * The process for doing this is described in this file's header.
1382 * Note we only reinitialize boot-mode if the flags say so. Some hw
1383 * iterations need it, some don't. In any case, if we loop, we always
1384 * need to reinitialize the boot room, hence the flags modification.
1387 int i2400m_fw_dnload(struct i2400m
*i2400m
, const struct i2400m_bcf_hdr
*bcf
,
1388 size_t fw_size
, enum i2400m_bri flags
)
1391 struct device
*dev
= i2400m_dev(i2400m
);
1392 int count
= i2400m
->bus_bm_retries
;
1393 const struct i2400m_bcf_hdr
*bcf_hdr
;
1396 d_fnstart(5, dev
, "(i2400m %p bcf %p fw size %zu)\n",
1397 i2400m
, bcf
, fw_size
);
1398 i2400m
->boot_mode
= 1;
1399 wmb(); /* Make sure other readers see it */
1403 dev_err(dev
, "device rebooted too many times, aborting\n");
1404 goto error_too_many_reboots
;
1406 if (flags
& I2400M_BRI_MAC_REINIT
) {
1407 ret
= i2400m_bootrom_init(i2400m
, flags
);
1409 dev_err(dev
, "bootrom init failed: %d\n", ret
);
1410 goto error_bootrom_init
;
1413 flags
|= I2400M_BRI_MAC_REINIT
;
1416 * Initialize the download, push the bytes to the device and
1417 * then jump to the new firmware. Note @ret is passed with the
1418 * offset of the jump instruction to _dnload_finalize()
1420 * Note we need to use the BCF header in the firmware image
1421 * that matches the barker that the device sent when it
1422 * rebooted, so it has to be passed along.
1425 bcf_hdr
= i2400m_bcf_hdr_find(i2400m
);
1426 if (bcf_hdr
== NULL
)
1427 goto error_bcf_hdr_find
;
1429 ret
= i2400m_dnload_init(i2400m
, bcf_hdr
);
1430 if (ret
== -ERESTARTSYS
)
1431 goto error_dev_rebooted
;
1433 goto error_dnload_init
;
1436 * bcf_size refers to one header size plus the fw sections size
1437 * indicated by the header,ie. if there are other extended headers
1438 * at the tail, they are not counted
1440 bcf_size
= sizeof(u32
) * le32_to_cpu(bcf_hdr
->size
);
1441 ret
= i2400m_dnload_bcf(i2400m
, bcf
, bcf_size
);
1442 if (ret
== -ERESTARTSYS
)
1443 goto error_dev_rebooted
;
1445 dev_err(dev
, "fw %s: download failed: %d\n",
1446 i2400m
->fw_name
, ret
);
1447 goto error_dnload_bcf
;
1450 ret
= i2400m_dnload_finalize(i2400m
, bcf_hdr
, bcf
, ret
);
1451 if (ret
== -ERESTARTSYS
)
1452 goto error_dev_rebooted
;
1454 dev_err(dev
, "fw %s: "
1455 "download finalization failed: %d\n",
1456 i2400m
->fw_name
, ret
);
1457 goto error_dnload_finalize
;
1460 d_printf(2, dev
, "fw %s successfully uploaded\n",
1462 i2400m
->boot_mode
= 0;
1463 wmb(); /* Make sure i2400m_msg_to_dev() sees boot_mode */
1464 error_dnload_finalize
:
1469 error_too_many_reboots
:
1470 d_fnend(5, dev
, "(i2400m %p bcf %p size %zu) = %d\n",
1471 i2400m
, bcf
, fw_size
, ret
);
1475 dev_err(dev
, "device rebooted, %d tries left\n", count
);
1476 /* we got the notification already, no need to wait for it again */
1477 flags
|= I2400M_BRI_SOFT
;
1482 int i2400m_fw_bootstrap(struct i2400m
*i2400m
, const struct firmware
*fw
,
1483 enum i2400m_bri flags
)
1486 struct device
*dev
= i2400m_dev(i2400m
);
1487 const struct i2400m_bcf_hdr
*bcf
; /* Firmware data */
1489 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1490 bcf
= (void *) fw
->data
;
1491 ret
= i2400m_fw_check(i2400m
, bcf
, fw
->size
);
1493 ret
= i2400m_fw_dnload(i2400m
, bcf
, fw
->size
, flags
);
1495 dev_err(dev
, "%s: cannot use: %d, skipping\n",
1496 i2400m
->fw_name
, ret
);
1497 kfree(i2400m
->fw_hdrs
);
1498 i2400m
->fw_hdrs
= NULL
;
1499 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, ret
);
1504 /* Refcounted container for firmware data */
1507 const struct firmware
*fw
;
1512 void i2400m_fw_destroy(struct kref
*kref
)
1514 struct i2400m_fw
*i2400m_fw
=
1515 container_of(kref
, struct i2400m_fw
, kref
);
1516 release_firmware(i2400m_fw
->fw
);
1522 struct i2400m_fw
*i2400m_fw_get(struct i2400m_fw
*i2400m_fw
)
1524 if (i2400m_fw
!= NULL
&& i2400m_fw
!= (void *) ~0)
1525 kref_get(&i2400m_fw
->kref
);
1531 void i2400m_fw_put(struct i2400m_fw
*i2400m_fw
)
1533 kref_put(&i2400m_fw
->kref
, i2400m_fw_destroy
);
1538 * i2400m_dev_bootstrap - Bring the device to a known state and upload firmware
1540 * @i2400m: device descriptor
1542 * Returns: >= 0 if ok, < 0 errno code on error.
1544 * This sets up the firmware upload environment, loads the firmware
1545 * file from disk, verifies and then calls the firmware upload process
1548 * Can be called either from probe, or after a warm reset. Can not be
1549 * called from within an interrupt. All the flow in this code is
1550 * single-threade; all I/Os are synchronous.
1552 int i2400m_dev_bootstrap(struct i2400m
*i2400m
, enum i2400m_bri flags
)
1555 struct device
*dev
= i2400m_dev(i2400m
);
1556 struct i2400m_fw
*i2400m_fw
;
1557 const struct i2400m_bcf_hdr
*bcf
; /* Firmware data */
1558 const struct firmware
*fw
;
1559 const char *fw_name
;
1561 d_fnstart(5, dev
, "(i2400m %p)\n", i2400m
);
1564 spin_lock(&i2400m
->rx_lock
);
1565 i2400m_fw
= i2400m_fw_get(i2400m
->fw_cached
);
1566 spin_unlock(&i2400m
->rx_lock
);
1567 if (i2400m_fw
== (void *) ~0) {
1568 dev_err(dev
, "can't load firmware now!");
1570 } else if (i2400m_fw
!= NULL
) {
1571 dev_info(dev
, "firmware %s: loading from cache\n",
1573 ret
= i2400m_fw_bootstrap(i2400m
, i2400m_fw
->fw
, flags
);
1574 i2400m_fw_put(i2400m_fw
);
1578 /* Load firmware files to memory. */
1579 for (itr
= 0, bcf
= NULL
, ret
= -ENOENT
; ; itr
++) {
1580 fw_name
= i2400m
->bus_fw_names
[itr
];
1581 if (fw_name
== NULL
) {
1582 dev_err(dev
, "Could not find a usable firmware image\n");
1585 d_printf(1, dev
, "trying firmware %s (%d)\n", fw_name
, itr
);
1586 ret
= request_firmware(&fw
, fw_name
, dev
);
1588 dev_err(dev
, "fw %s: cannot load file: %d\n",
1592 i2400m
->fw_name
= fw_name
;
1593 ret
= i2400m_fw_bootstrap(i2400m
, fw
, flags
);
1594 release_firmware(fw
);
1595 if (ret
>= 0) /* firmware loaded successfully */
1597 i2400m
->fw_name
= NULL
;
1600 d_fnend(5, dev
, "(i2400m %p) = %d\n", i2400m
, ret
);
1603 EXPORT_SYMBOL_GPL(i2400m_dev_bootstrap
);
1606 void i2400m_fw_cache(struct i2400m
*i2400m
)
1609 struct i2400m_fw
*i2400m_fw
;
1610 struct device
*dev
= i2400m_dev(i2400m
);
1612 /* if there is anything there, free it -- now, this'd be weird */
1613 spin_lock(&i2400m
->rx_lock
);
1614 i2400m_fw
= i2400m
->fw_cached
;
1615 spin_unlock(&i2400m
->rx_lock
);
1616 if (i2400m_fw
!= NULL
&& i2400m_fw
!= (void *) ~0) {
1617 i2400m_fw_put(i2400m_fw
);
1618 WARN(1, "%s:%u: still cached fw still present?\n",
1619 __func__
, __LINE__
);
1622 if (i2400m
->fw_name
== NULL
) {
1623 dev_err(dev
, "firmware n/a: can't cache\n");
1624 i2400m_fw
= (void *) ~0;
1628 i2400m_fw
= kzalloc(sizeof(*i2400m_fw
), GFP_ATOMIC
);
1629 if (i2400m_fw
== NULL
)
1631 kref_init(&i2400m_fw
->kref
);
1632 result
= request_firmware(&i2400m_fw
->fw
, i2400m
->fw_name
, dev
);
1634 dev_err(dev
, "firmware %s: failed to cache: %d\n",
1635 i2400m
->fw_name
, result
);
1637 i2400m_fw
= (void *) ~0;
1639 dev_info(dev
, "firmware %s: cached\n", i2400m
->fw_name
);
1641 spin_lock(&i2400m
->rx_lock
);
1642 i2400m
->fw_cached
= i2400m_fw
;
1643 spin_unlock(&i2400m
->rx_lock
);
1647 void i2400m_fw_uncache(struct i2400m
*i2400m
)
1649 struct i2400m_fw
*i2400m_fw
;
1651 spin_lock(&i2400m
->rx_lock
);
1652 i2400m_fw
= i2400m
->fw_cached
;
1653 i2400m
->fw_cached
= NULL
;
1654 spin_unlock(&i2400m
->rx_lock
);
1656 if (i2400m_fw
!= NULL
&& i2400m_fw
!= (void *) ~0)
1657 i2400m_fw_put(i2400m_fw
);