// SPDX-License-Identifier: GPL-2.0
|
/*
|
* Greybus Firmware Download Protocol Driver.
|
*
|
* Copyright 2016 Google Inc.
|
* Copyright 2016 Linaro Ltd.
|
*/
|
|
#include <linux/firmware.h>
|
#include <linux/jiffies.h>
|
#include <linux/mutex.h>
|
#include <linux/workqueue.h>
|
#include <linux/greybus.h>
|
#include "firmware.h"
|
|
/* Estimated minimum buffer size, actual size can be smaller than this */
|
#define MIN_FETCH_SIZE 512
|
/* Timeout, in jiffies, within which fetch or release firmware must be called */
|
#define NEXT_REQ_TIMEOUT_J msecs_to_jiffies(1000)
|
|
struct fw_request {
|
u8 firmware_id;
|
bool disabled;
|
bool timedout;
|
char name[FW_NAME_SIZE];
|
const struct firmware *fw;
|
struct list_head node;
|
|
struct delayed_work dwork;
|
/* Timeout, in jiffies, within which the firmware shall download */
|
unsigned long release_timeout_j;
|
struct kref kref;
|
struct fw_download *fw_download;
|
};
|
|
struct fw_download {
|
struct device *parent;
|
struct gb_connection *connection;
|
struct list_head fw_requests;
|
struct ida id_map;
|
struct mutex mutex;
|
};
|
|
static void fw_req_release(struct kref *kref)
|
{
|
struct fw_request *fw_req = container_of(kref, struct fw_request, kref);
|
|
dev_dbg(fw_req->fw_download->parent, "firmware %s released\n",
|
fw_req->name);
|
|
release_firmware(fw_req->fw);
|
|
/*
|
* The request timed out and the module may send a fetch-fw or
|
* release-fw request later. Lets block the id we allocated for this
|
* request, so that the AP doesn't refer to a later fw-request (with
|
* same firmware_id) for the old timedout fw-request.
|
*
|
* NOTE:
|
*
|
* This also means that after 255 timeouts we will fail to service new
|
* firmware downloads. But what else can we do in that case anyway? Lets
|
* just hope that it never happens.
|
*/
|
if (!fw_req->timedout)
|
ida_simple_remove(&fw_req->fw_download->id_map,
|
fw_req->firmware_id);
|
|
kfree(fw_req);
|
}
|
|
/*
|
* Incoming requests are serialized for a connection, and the only race possible
|
* is between the timeout handler freeing this and an incoming request.
|
*
|
* The operations on the fw-request list are protected by the mutex and
|
* get_fw_req() increments the reference count before returning a fw_req pointer
|
* to the users.
|
*
|
* free_firmware() also takes the mutex while removing an entry from the list,
|
* it guarantees that every user of fw_req has taken a kref-reference by now and
|
* we wouldn't have any new users.
|
*
|
* Once the last user drops the reference, the fw_req structure is freed.
|
*/
|
static void put_fw_req(struct fw_request *fw_req)
|
{
|
kref_put(&fw_req->kref, fw_req_release);
|
}
|
|
/* Caller must call put_fw_req() after using struct fw_request */
|
static struct fw_request *get_fw_req(struct fw_download *fw_download,
|
u8 firmware_id)
|
{
|
struct fw_request *fw_req;
|
|
mutex_lock(&fw_download->mutex);
|
|
list_for_each_entry(fw_req, &fw_download->fw_requests, node) {
|
if (fw_req->firmware_id == firmware_id) {
|
kref_get(&fw_req->kref);
|
goto unlock;
|
}
|
}
|
|
fw_req = NULL;
|
|
unlock:
|
mutex_unlock(&fw_download->mutex);
|
|
return fw_req;
|
}
|
|
static void free_firmware(struct fw_download *fw_download,
|
struct fw_request *fw_req)
|
{
|
/* Already disabled from timeout handlers */
|
if (fw_req->disabled)
|
return;
|
|
mutex_lock(&fw_download->mutex);
|
list_del(&fw_req->node);
|
mutex_unlock(&fw_download->mutex);
|
|
fw_req->disabled = true;
|
put_fw_req(fw_req);
|
}
|
|
static void fw_request_timedout(struct work_struct *work)
|
{
|
struct delayed_work *dwork = to_delayed_work(work);
|
struct fw_request *fw_req = container_of(dwork,
|
struct fw_request, dwork);
|
struct fw_download *fw_download = fw_req->fw_download;
|
|
dev_err(fw_download->parent,
|
"Timed out waiting for fetch / release firmware requests: %u\n",
|
fw_req->firmware_id);
|
|
fw_req->timedout = true;
|
free_firmware(fw_download, fw_req);
|
}
|
|
static int exceeds_release_timeout(struct fw_request *fw_req)
|
{
|
struct fw_download *fw_download = fw_req->fw_download;
|
|
if (time_before(jiffies, fw_req->release_timeout_j))
|
return 0;
|
|
dev_err(fw_download->parent,
|
"Firmware download didn't finish in time, abort: %d\n",
|
fw_req->firmware_id);
|
|
fw_req->timedout = true;
|
free_firmware(fw_download, fw_req);
|
|
return -ETIMEDOUT;
|
}
|
|
/* This returns path of the firmware blob on the disk */
|
static struct fw_request *find_firmware(struct fw_download *fw_download,
|
const char *tag)
|
{
|
struct gb_interface *intf = fw_download->connection->bundle->intf;
|
struct fw_request *fw_req;
|
int ret, req_count;
|
|
fw_req = kzalloc(sizeof(*fw_req), GFP_KERNEL);
|
if (!fw_req)
|
return ERR_PTR(-ENOMEM);
|
|
/* Allocate ids from 1 to 255 (u8-max), 0 is an invalid id */
|
ret = ida_simple_get(&fw_download->id_map, 1, 256, GFP_KERNEL);
|
if (ret < 0) {
|
dev_err(fw_download->parent,
|
"failed to allocate firmware id (%d)\n", ret);
|
goto err_free_req;
|
}
|
fw_req->firmware_id = ret;
|
|
snprintf(fw_req->name, sizeof(fw_req->name),
|
FW_NAME_PREFIX "%08x_%08x_%08x_%08x_%s.tftf",
|
intf->ddbl1_manufacturer_id, intf->ddbl1_product_id,
|
intf->vendor_id, intf->product_id, tag);
|
|
dev_info(fw_download->parent, "Requested firmware package '%s'\n",
|
fw_req->name);
|
|
ret = request_firmware(&fw_req->fw, fw_req->name, fw_download->parent);
|
if (ret) {
|
dev_err(fw_download->parent,
|
"firmware request failed for %s (%d)\n", fw_req->name,
|
ret);
|
goto err_free_id;
|
}
|
|
fw_req->fw_download = fw_download;
|
kref_init(&fw_req->kref);
|
|
mutex_lock(&fw_download->mutex);
|
list_add(&fw_req->node, &fw_download->fw_requests);
|
mutex_unlock(&fw_download->mutex);
|
|
/* Timeout, in jiffies, within which firmware should get loaded */
|
req_count = DIV_ROUND_UP(fw_req->fw->size, MIN_FETCH_SIZE);
|
fw_req->release_timeout_j = jiffies + req_count * NEXT_REQ_TIMEOUT_J;
|
|
INIT_DELAYED_WORK(&fw_req->dwork, fw_request_timedout);
|
schedule_delayed_work(&fw_req->dwork, NEXT_REQ_TIMEOUT_J);
|
|
return fw_req;
|
|
err_free_id:
|
ida_simple_remove(&fw_download->id_map, fw_req->firmware_id);
|
err_free_req:
|
kfree(fw_req);
|
|
return ERR_PTR(ret);
|
}
|
|
static int fw_download_find_firmware(struct gb_operation *op)
|
{
|
struct gb_connection *connection = op->connection;
|
struct fw_download *fw_download = gb_connection_get_data(connection);
|
struct gb_fw_download_find_firmware_request *request;
|
struct gb_fw_download_find_firmware_response *response;
|
struct fw_request *fw_req;
|
const char *tag;
|
|
if (op->request->payload_size != sizeof(*request)) {
|
dev_err(fw_download->parent,
|
"illegal size of find firmware request (%zu != %zu)\n",
|
op->request->payload_size, sizeof(*request));
|
return -EINVAL;
|
}
|
|
request = op->request->payload;
|
tag = (const char *)request->firmware_tag;
|
|
/* firmware_tag must be null-terminated */
|
if (strnlen(tag, GB_FIRMWARE_TAG_MAX_SIZE) ==
|
GB_FIRMWARE_TAG_MAX_SIZE) {
|
dev_err(fw_download->parent,
|
"firmware-tag is not null-terminated\n");
|
return -EINVAL;
|
}
|
|
fw_req = find_firmware(fw_download, tag);
|
if (IS_ERR(fw_req))
|
return PTR_ERR(fw_req);
|
|
if (!gb_operation_response_alloc(op, sizeof(*response), GFP_KERNEL)) {
|
dev_err(fw_download->parent, "error allocating response\n");
|
free_firmware(fw_download, fw_req);
|
return -ENOMEM;
|
}
|
|
response = op->response->payload;
|
response->firmware_id = fw_req->firmware_id;
|
response->size = cpu_to_le32(fw_req->fw->size);
|
|
dev_dbg(fw_download->parent,
|
"firmware size is %zu bytes\n", fw_req->fw->size);
|
|
return 0;
|
}
|
|
static int fw_download_fetch_firmware(struct gb_operation *op)
|
{
|
struct gb_connection *connection = op->connection;
|
struct fw_download *fw_download = gb_connection_get_data(connection);
|
struct gb_fw_download_fetch_firmware_request *request;
|
struct gb_fw_download_fetch_firmware_response *response;
|
struct fw_request *fw_req;
|
const struct firmware *fw;
|
unsigned int offset, size;
|
u8 firmware_id;
|
int ret = 0;
|
|
if (op->request->payload_size != sizeof(*request)) {
|
dev_err(fw_download->parent,
|
"Illegal size of fetch firmware request (%zu %zu)\n",
|
op->request->payload_size, sizeof(*request));
|
return -EINVAL;
|
}
|
|
request = op->request->payload;
|
offset = le32_to_cpu(request->offset);
|
size = le32_to_cpu(request->size);
|
firmware_id = request->firmware_id;
|
|
fw_req = get_fw_req(fw_download, firmware_id);
|
if (!fw_req) {
|
dev_err(fw_download->parent,
|
"firmware not available for id: %02u\n", firmware_id);
|
return -EINVAL;
|
}
|
|
/* Make sure work handler isn't running in parallel */
|
cancel_delayed_work_sync(&fw_req->dwork);
|
|
/* We timed-out before reaching here ? */
|
if (fw_req->disabled) {
|
ret = -ETIMEDOUT;
|
goto put_fw;
|
}
|
|
/*
|
* Firmware download must finish within a limited time interval. If it
|
* doesn't, then we might have a buggy Module on the other side. Abort
|
* download.
|
*/
|
ret = exceeds_release_timeout(fw_req);
|
if (ret)
|
goto put_fw;
|
|
fw = fw_req->fw;
|
|
if (offset >= fw->size || size > fw->size - offset) {
|
dev_err(fw_download->parent,
|
"bad fetch firmware request (offs = %u, size = %u)\n",
|
offset, size);
|
ret = -EINVAL;
|
goto put_fw;
|
}
|
|
if (!gb_operation_response_alloc(op, sizeof(*response) + size,
|
GFP_KERNEL)) {
|
dev_err(fw_download->parent,
|
"error allocating fetch firmware response\n");
|
ret = -ENOMEM;
|
goto put_fw;
|
}
|
|
response = op->response->payload;
|
memcpy(response->data, fw->data + offset, size);
|
|
dev_dbg(fw_download->parent,
|
"responding with firmware (offs = %u, size = %u)\n", offset,
|
size);
|
|
/* Refresh timeout */
|
schedule_delayed_work(&fw_req->dwork, NEXT_REQ_TIMEOUT_J);
|
|
put_fw:
|
put_fw_req(fw_req);
|
|
return ret;
|
}
|
|
static int fw_download_release_firmware(struct gb_operation *op)
|
{
|
struct gb_connection *connection = op->connection;
|
struct fw_download *fw_download = gb_connection_get_data(connection);
|
struct gb_fw_download_release_firmware_request *request;
|
struct fw_request *fw_req;
|
u8 firmware_id;
|
|
if (op->request->payload_size != sizeof(*request)) {
|
dev_err(fw_download->parent,
|
"Illegal size of release firmware request (%zu %zu)\n",
|
op->request->payload_size, sizeof(*request));
|
return -EINVAL;
|
}
|
|
request = op->request->payload;
|
firmware_id = request->firmware_id;
|
|
fw_req = get_fw_req(fw_download, firmware_id);
|
if (!fw_req) {
|
dev_err(fw_download->parent,
|
"firmware not available for id: %02u\n", firmware_id);
|
return -EINVAL;
|
}
|
|
cancel_delayed_work_sync(&fw_req->dwork);
|
|
free_firmware(fw_download, fw_req);
|
put_fw_req(fw_req);
|
|
dev_dbg(fw_download->parent, "release firmware\n");
|
|
return 0;
|
}
|
|
int gb_fw_download_request_handler(struct gb_operation *op)
|
{
|
u8 type = op->type;
|
|
switch (type) {
|
case GB_FW_DOWNLOAD_TYPE_FIND_FIRMWARE:
|
return fw_download_find_firmware(op);
|
case GB_FW_DOWNLOAD_TYPE_FETCH_FIRMWARE:
|
return fw_download_fetch_firmware(op);
|
case GB_FW_DOWNLOAD_TYPE_RELEASE_FIRMWARE:
|
return fw_download_release_firmware(op);
|
default:
|
dev_err(&op->connection->bundle->dev,
|
"unsupported request: %u\n", type);
|
return -EINVAL;
|
}
|
}
|
|
int gb_fw_download_connection_init(struct gb_connection *connection)
|
{
|
struct fw_download *fw_download;
|
int ret;
|
|
if (!connection)
|
return 0;
|
|
fw_download = kzalloc(sizeof(*fw_download), GFP_KERNEL);
|
if (!fw_download)
|
return -ENOMEM;
|
|
fw_download->parent = &connection->bundle->dev;
|
INIT_LIST_HEAD(&fw_download->fw_requests);
|
ida_init(&fw_download->id_map);
|
gb_connection_set_data(connection, fw_download);
|
fw_download->connection = connection;
|
mutex_init(&fw_download->mutex);
|
|
ret = gb_connection_enable(connection);
|
if (ret)
|
goto err_destroy_id_map;
|
|
return 0;
|
|
err_destroy_id_map:
|
ida_destroy(&fw_download->id_map);
|
kfree(fw_download);
|
|
return ret;
|
}
|
|
void gb_fw_download_connection_exit(struct gb_connection *connection)
|
{
|
struct fw_download *fw_download;
|
struct fw_request *fw_req, *tmp;
|
|
if (!connection)
|
return;
|
|
fw_download = gb_connection_get_data(connection);
|
gb_connection_disable(fw_download->connection);
|
|
/*
|
* Make sure we have a reference to the pending requests, before they
|
* are freed from the timeout handler.
|
*/
|
mutex_lock(&fw_download->mutex);
|
list_for_each_entry(fw_req, &fw_download->fw_requests, node)
|
kref_get(&fw_req->kref);
|
mutex_unlock(&fw_download->mutex);
|
|
/* Release pending firmware packages */
|
list_for_each_entry_safe(fw_req, tmp, &fw_download->fw_requests, node) {
|
cancel_delayed_work_sync(&fw_req->dwork);
|
free_firmware(fw_download, fw_req);
|
put_fw_req(fw_req);
|
}
|
|
ida_destroy(&fw_download->id_map);
|
kfree(fw_download);
|
}
|
