1 From e93984ebc1c82bd34f7a1b3391efaceee0a8ae96 Mon Sep 17 00:00:00 2001
2 From: Robert Marko <robimarko@gmail.com>
3 Date: Tue, 14 Nov 2023 15:08:43 +0100
4 Subject: [PATCH 3/3] net: phy: aquantia: add firmware load support
6 Aquantia PHY-s require firmware to be loaded before they start operating.
7 It can be automatically loaded in case when there is a SPI-NOR connected
8 to Aquantia PHY-s or can be loaded from the host via MDIO.
10 This patch adds support for loading the firmware via MDIO as in most cases
11 there is no SPI-NOR being used to save on cost.
12 Firmware loading code itself is ported from mainline U-boot with cleanups.
14 The firmware has mixed values both in big and little endian.
15 PHY core itself is big-endian but it expects values to be in little-endian.
16 The firmware is little-endian but CRC-16 value for it is stored at the end
17 of firmware in big-endian.
19 It seems the PHY does the conversion internally from firmware that is
20 little-endian to the PHY that is big-endian on using the mailbox
21 but mailbox returns a big-endian CRC-16 to verify the written data
24 Co-developed-by: Christian Marangi <ansuelsmth@gmail.com>
25 Signed-off-by: Robert Marko <robimarko@gmail.com>
26 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
27 Reviewed-by: Andrew Lunn <andrew@lunn.ch>
28 Signed-off-by: David S. Miller <davem@davemloft.net>
30 drivers/net/phy/aquantia/Kconfig | 1 +
31 drivers/net/phy/aquantia/Makefile | 2 +-
32 drivers/net/phy/aquantia/aquantia.h | 32 ++
33 drivers/net/phy/aquantia/aquantia_firmware.c | 370 +++++++++++++++++++
34 drivers/net/phy/aquantia/aquantia_main.c | 6 +
35 5 files changed, 410 insertions(+), 1 deletion(-)
36 create mode 100644 drivers/net/phy/aquantia/aquantia_firmware.c
38 --- a/drivers/net/phy/aquantia/Kconfig
39 +++ b/drivers/net/phy/aquantia/Kconfig
41 # SPDX-License-Identifier: GPL-2.0-only
43 tristate "Aquantia PHYs"
46 Currently supports the Aquantia AQ1202, AQ2104, AQR105, AQR405
47 --- a/drivers/net/phy/aquantia/Makefile
48 +++ b/drivers/net/phy/aquantia/Makefile
50 # SPDX-License-Identifier: GPL-2.0
51 -aquantia-objs += aquantia_main.o
52 +aquantia-objs += aquantia_main.o aquantia_firmware.o
54 aquantia-objs += aquantia_hwmon.o
56 --- a/drivers/net/phy/aquantia/aquantia.h
57 +++ b/drivers/net/phy/aquantia/aquantia.h
59 #include <linux/phy.h>
61 /* Vendor specific 1, MDIO_MMD_VEND1 */
62 +#define VEND1_GLOBAL_SC 0x0
63 +#define VEND1_GLOBAL_SC_SOFT_RESET BIT(15)
64 +#define VEND1_GLOBAL_SC_LOW_POWER BIT(11)
66 #define VEND1_GLOBAL_FW_ID 0x0020
67 #define VEND1_GLOBAL_FW_ID_MAJOR GENMASK(15, 8)
68 #define VEND1_GLOBAL_FW_ID_MINOR GENMASK(7, 0)
70 +#define VEND1_GLOBAL_MAILBOX_INTERFACE1 0x0200
71 +#define VEND1_GLOBAL_MAILBOX_INTERFACE1_EXECUTE BIT(15)
72 +#define VEND1_GLOBAL_MAILBOX_INTERFACE1_WRITE BIT(14)
73 +#define VEND1_GLOBAL_MAILBOX_INTERFACE1_CRC_RESET BIT(12)
74 +#define VEND1_GLOBAL_MAILBOX_INTERFACE1_BUSY BIT(8)
76 +#define VEND1_GLOBAL_MAILBOX_INTERFACE2 0x0201
77 +#define VEND1_GLOBAL_MAILBOX_INTERFACE3 0x0202
78 +#define VEND1_GLOBAL_MAILBOX_INTERFACE3_MSW_ADDR_MASK GENMASK(15, 0)
79 +#define VEND1_GLOBAL_MAILBOX_INTERFACE3_MSW_ADDR(x) FIELD_PREP(VEND1_GLOBAL_MAILBOX_INTERFACE3_MSW_ADDR_MASK, (u16)((x) >> 16))
80 +#define VEND1_GLOBAL_MAILBOX_INTERFACE4 0x0203
81 +#define VEND1_GLOBAL_MAILBOX_INTERFACE4_LSW_ADDR_MASK GENMASK(15, 2)
82 +#define VEND1_GLOBAL_MAILBOX_INTERFACE4_LSW_ADDR(x) FIELD_PREP(VEND1_GLOBAL_MAILBOX_INTERFACE4_LSW_ADDR_MASK, (u16)(x))
84 +#define VEND1_GLOBAL_MAILBOX_INTERFACE5 0x0204
85 +#define VEND1_GLOBAL_MAILBOX_INTERFACE5_MSW_DATA_MASK GENMASK(15, 0)
86 +#define VEND1_GLOBAL_MAILBOX_INTERFACE5_MSW_DATA(x) FIELD_PREP(VEND1_GLOBAL_MAILBOX_INTERFACE5_MSW_DATA_MASK, (u16)((x) >> 16))
87 +#define VEND1_GLOBAL_MAILBOX_INTERFACE6 0x0205
88 +#define VEND1_GLOBAL_MAILBOX_INTERFACE6_LSW_DATA_MASK GENMASK(15, 0)
89 +#define VEND1_GLOBAL_MAILBOX_INTERFACE6_LSW_DATA(x) FIELD_PREP(VEND1_GLOBAL_MAILBOX_INTERFACE6_LSW_DATA_MASK, (u16)(x))
91 /* The following registers all have similar layouts; first the registers... */
92 #define VEND1_GLOBAL_CFG_10M 0x0310
93 #define VEND1_GLOBAL_CFG_100M 0x031b
95 #define VEND1_GLOBAL_CFG_RATE_ADAPT_PAUSE 2
97 /* Vendor specific 1, MDIO_MMD_VEND2 */
98 +#define VEND1_GLOBAL_CONTROL2 0xc001
99 +#define VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_RST BIT(15)
100 +#define VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_OVD BIT(6)
101 +#define VEND1_GLOBAL_CONTROL2_UP_RUN_STALL BIT(0)
103 #define VEND1_THERMAL_PROV_HIGH_TEMP_FAIL 0xc421
104 #define VEND1_THERMAL_PROV_LOW_TEMP_FAIL 0xc422
105 #define VEND1_THERMAL_PROV_HIGH_TEMP_WARN 0xc423
106 @@ -83,3 +113,5 @@ int aqr_hwmon_probe(struct phy_device *p
108 static inline int aqr_hwmon_probe(struct phy_device *phydev) { return 0; }
111 +int aqr_firmware_load(struct phy_device *phydev);
113 +++ b/drivers/net/phy/aquantia/aquantia_firmware.c
115 +// SPDX-License-Identifier: GPL-2.0
117 +#include <linux/bitfield.h>
118 +#include <linux/of.h>
119 +#include <linux/firmware.h>
120 +#include <linux/crc-ccitt.h>
121 +#include <linux/nvmem-consumer.h>
123 +#include <asm/unaligned.h>
125 +#include "aquantia.h"
127 +#define UP_RESET_SLEEP 100
129 +/* addresses of memory segments in the phy */
130 +#define DRAM_BASE_ADDR 0x3FFE0000
131 +#define IRAM_BASE_ADDR 0x40000000
133 +/* firmware image format constants */
134 +#define VERSION_STRING_SIZE 0x40
135 +#define VERSION_STRING_OFFSET 0x0200
136 +/* primary offset is written at an offset from the start of the fw blob */
137 +#define PRIMARY_OFFSET_OFFSET 0x8
138 +/* primary offset needs to be then added to a base offset */
139 +#define PRIMARY_OFFSET_SHIFT 12
140 +#define PRIMARY_OFFSET(x) ((x) << PRIMARY_OFFSET_SHIFT)
141 +#define HEADER_OFFSET 0x300
143 +struct aqr_fw_header {
152 + AQR_FW_SRC_NVMEM = 0,
156 +static const char * const aqr_fw_src_string[] = {
157 + [AQR_FW_SRC_NVMEM] = "NVMEM",
158 + [AQR_FW_SRC_FS] = "FS",
161 +/* AQR firmware doesn't have fixed offsets for iram and dram section
162 + * but instead provide an header with the offset to use on reading
163 + * and parsing the firmware.
165 + * AQR firmware can't be trusted and each offset is validated to be
166 + * not negative and be in the size of the firmware itself.
168 +static bool aqr_fw_validate_get(size_t size, size_t offset, size_t get_size)
170 + return offset + get_size <= size;
173 +static int aqr_fw_get_be16(const u8 *data, size_t offset, size_t size, u16 *value)
175 + if (!aqr_fw_validate_get(size, offset, sizeof(u16)))
178 + *value = get_unaligned_be16(data + offset);
183 +static int aqr_fw_get_le16(const u8 *data, size_t offset, size_t size, u16 *value)
185 + if (!aqr_fw_validate_get(size, offset, sizeof(u16)))
188 + *value = get_unaligned_le16(data + offset);
193 +static int aqr_fw_get_le24(const u8 *data, size_t offset, size_t size, u32 *value)
195 + if (!aqr_fw_validate_get(size, offset, sizeof(u8) * 3))
198 + *value = get_unaligned_le24(data + offset);
203 +/* load data into the phy's memory */
204 +static int aqr_fw_load_memory(struct phy_device *phydev, u32 addr,
205 + const u8 *data, size_t len)
207 + u16 crc = 0, up_crc;
210 + /* PHY expect addr in LE */
211 + addr = (__force u32)cpu_to_le32(addr);
213 + phy_write_mmd(phydev, MDIO_MMD_VEND1,
214 + VEND1_GLOBAL_MAILBOX_INTERFACE1,
215 + VEND1_GLOBAL_MAILBOX_INTERFACE1_CRC_RESET);
216 + phy_write_mmd(phydev, MDIO_MMD_VEND1,
217 + VEND1_GLOBAL_MAILBOX_INTERFACE3,
218 + VEND1_GLOBAL_MAILBOX_INTERFACE3_MSW_ADDR(addr));
219 + phy_write_mmd(phydev, MDIO_MMD_VEND1,
220 + VEND1_GLOBAL_MAILBOX_INTERFACE4,
221 + VEND1_GLOBAL_MAILBOX_INTERFACE4_LSW_ADDR(addr));
223 + /* We assume and enforce the size to be word aligned.
224 + * If a firmware that is not word aligned is found, please report upstream.
226 + for (pos = 0; pos < len; pos += sizeof(u32)) {
229 + /* FW data is always stored in little-endian */
230 + word = get_unaligned((const u32 *)(data + pos));
232 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_MAILBOX_INTERFACE5,
233 + VEND1_GLOBAL_MAILBOX_INTERFACE5_MSW_DATA(word));
234 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_MAILBOX_INTERFACE6,
235 + VEND1_GLOBAL_MAILBOX_INTERFACE6_LSW_DATA(word));
237 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_MAILBOX_INTERFACE1,
238 + VEND1_GLOBAL_MAILBOX_INTERFACE1_EXECUTE |
239 + VEND1_GLOBAL_MAILBOX_INTERFACE1_WRITE);
241 + /* calculate CRC as we load data to the mailbox.
242 + * We convert word to big-endian as PHY is BE and mailbox will
245 + word = (__force u32)cpu_to_be32(word);
246 + crc = crc_ccitt_false(crc, (u8 *)&word, sizeof(word));
249 + up_crc = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_MAILBOX_INTERFACE2);
250 + if (crc != up_crc) {
251 + phydev_err(phydev, "CRC mismatch: calculated 0x%04x PHY 0x%04x\n",
259 +static int aqr_fw_boot(struct phy_device *phydev, const u8 *data, size_t size,
260 + enum aqr_fw_src fw_src)
262 + u16 calculated_crc, read_crc, read_primary_offset;
263 + u32 iram_offset = 0, iram_size = 0;
264 + u32 dram_offset = 0, dram_size = 0;
265 + char version[VERSION_STRING_SIZE];
266 + u32 primary_offset = 0;
269 + /* extract saved CRC at the end of the fw
270 + * CRC is saved in big-endian as PHY is BE
272 + ret = aqr_fw_get_be16(data, size - sizeof(u16), size, &read_crc);
274 + phydev_err(phydev, "bad firmware CRC in firmware\n");
277 + calculated_crc = crc_ccitt_false(0, data, size - sizeof(u16));
278 + if (read_crc != calculated_crc) {
279 + phydev_err(phydev, "bad firmware CRC: file 0x%04x calculated 0x%04x\n",
280 + read_crc, calculated_crc);
284 + /* Get the primary offset to extract DRAM and IRAM sections. */
285 + ret = aqr_fw_get_le16(data, PRIMARY_OFFSET_OFFSET, size, &read_primary_offset);
287 + phydev_err(phydev, "bad primary offset in firmware\n");
290 + primary_offset = PRIMARY_OFFSET(read_primary_offset);
292 + /* Find the DRAM and IRAM sections within the firmware file.
293 + * Make sure the fw_header is correctly in the firmware.
295 + if (!aqr_fw_validate_get(size, primary_offset + HEADER_OFFSET,
296 + sizeof(struct aqr_fw_header))) {
297 + phydev_err(phydev, "bad fw_header in firmware\n");
301 + /* offset are in LE and values needs to be converted to cpu endian */
302 + ret = aqr_fw_get_le24(data, primary_offset + HEADER_OFFSET +
303 + offsetof(struct aqr_fw_header, iram_offset),
304 + size, &iram_offset);
306 + phydev_err(phydev, "bad iram offset in firmware\n");
309 + ret = aqr_fw_get_le24(data, primary_offset + HEADER_OFFSET +
310 + offsetof(struct aqr_fw_header, iram_size),
313 + phydev_err(phydev, "invalid iram size in firmware\n");
316 + ret = aqr_fw_get_le24(data, primary_offset + HEADER_OFFSET +
317 + offsetof(struct aqr_fw_header, dram_offset),
318 + size, &dram_offset);
320 + phydev_err(phydev, "bad dram offset in firmware\n");
323 + ret = aqr_fw_get_le24(data, primary_offset + HEADER_OFFSET +
324 + offsetof(struct aqr_fw_header, dram_size),
327 + phydev_err(phydev, "invalid dram size in firmware\n");
331 + /* Increment the offset with the primary offset.
332 + * Validate iram/dram offset and size.
334 + iram_offset += primary_offset;
335 + if (iram_size % sizeof(u32)) {
336 + phydev_err(phydev, "iram size if not aligned to word size. Please report this upstream!\n");
339 + if (!aqr_fw_validate_get(size, iram_offset, iram_size)) {
340 + phydev_err(phydev, "invalid iram offset for iram size\n");
344 + dram_offset += primary_offset;
345 + if (dram_size % sizeof(u32)) {
346 + phydev_err(phydev, "dram size if not aligned to word size. Please report this upstream!\n");
349 + if (!aqr_fw_validate_get(size, dram_offset, dram_size)) {
350 + phydev_err(phydev, "invalid iram offset for iram size\n");
354 + phydev_dbg(phydev, "primary %d IRAM offset=%d size=%d DRAM offset=%d size=%d\n",
355 + primary_offset, iram_offset, iram_size, dram_offset, dram_size);
357 + if (!aqr_fw_validate_get(size, dram_offset + VERSION_STRING_OFFSET,
358 + VERSION_STRING_SIZE)) {
359 + phydev_err(phydev, "invalid version in firmware\n");
362 + strscpy(version, (char *)data + dram_offset + VERSION_STRING_OFFSET,
363 + VERSION_STRING_SIZE);
364 + if (version[0] == '\0') {
365 + phydev_err(phydev, "invalid version in firmware\n");
368 + phydev_info(phydev, "loading firmware version '%s' from '%s'\n", version,
369 + aqr_fw_src_string[fw_src]);
371 + /* stall the microcprocessor */
372 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_CONTROL2,
373 + VEND1_GLOBAL_CONTROL2_UP_RUN_STALL | VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_OVD);
375 + phydev_dbg(phydev, "loading DRAM 0x%08x from offset=%d size=%d\n",
376 + DRAM_BASE_ADDR, dram_offset, dram_size);
377 + ret = aqr_fw_load_memory(phydev, DRAM_BASE_ADDR, data + dram_offset,
382 + phydev_dbg(phydev, "loading IRAM 0x%08x from offset=%d size=%d\n",
383 + IRAM_BASE_ADDR, iram_offset, iram_size);
384 + ret = aqr_fw_load_memory(phydev, IRAM_BASE_ADDR, data + iram_offset,
389 + /* make sure soft reset and low power mode are clear */
390 + phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_SC,
391 + VEND1_GLOBAL_SC_SOFT_RESET | VEND1_GLOBAL_SC_LOW_POWER);
393 + /* Release the microprocessor. UP_RESET must be held for 100 usec. */
394 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_CONTROL2,
395 + VEND1_GLOBAL_CONTROL2_UP_RUN_STALL |
396 + VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_OVD |
397 + VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_RST);
398 + usleep_range(UP_RESET_SLEEP, UP_RESET_SLEEP * 2);
400 + phy_write_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_CONTROL2,
401 + VEND1_GLOBAL_CONTROL2_UP_RUN_STALL_OVD);
406 +static int aqr_firmware_load_nvmem(struct phy_device *phydev)
408 + struct nvmem_cell *cell;
413 + cell = nvmem_cell_get(&phydev->mdio.dev, "firmware");
415 + return PTR_ERR(cell);
417 + buf = nvmem_cell_read(cell, &size);
419 + ret = PTR_ERR(buf);
423 + ret = aqr_fw_boot(phydev, buf, size, AQR_FW_SRC_NVMEM);
425 + phydev_err(phydev, "firmware loading failed: %d\n", ret);
429 + nvmem_cell_put(cell);
434 +static int aqr_firmware_load_fs(struct phy_device *phydev)
436 + struct device *dev = &phydev->mdio.dev;
437 + const struct firmware *fw;
438 + const char *fw_name;
441 + ret = of_property_read_string(dev->of_node, "firmware-name",
446 + ret = request_firmware(&fw, fw_name, dev);
448 + phydev_err(phydev, "failed to find FW file %s (%d)\n",
453 + ret = aqr_fw_boot(phydev, fw->data, fw->size, AQR_FW_SRC_FS);
455 + phydev_err(phydev, "firmware loading failed: %d\n", ret);
457 + release_firmware(fw);
462 +int aqr_firmware_load(struct phy_device *phydev)
466 + /* Check if the firmware is not already loaded by pooling
467 + * the current version returned by the PHY. If 0 is returned,
468 + * no firmware is loaded.
470 + ret = phy_read_mmd(phydev, MDIO_MMD_VEND1, VEND1_GLOBAL_FW_ID);
474 + ret = aqr_firmware_load_nvmem(phydev);
478 + ret = aqr_firmware_load_fs(phydev);
485 --- a/drivers/net/phy/aquantia/aquantia_main.c
486 +++ b/drivers/net/phy/aquantia/aquantia_main.c
487 @@ -658,11 +658,17 @@ static int aqr107_resume(struct phy_devi
489 static int aqr107_probe(struct phy_device *phydev)
493 phydev->priv = devm_kzalloc(&phydev->mdio.dev,
494 sizeof(struct aqr107_priv), GFP_KERNEL);
498 + ret = aqr_firmware_load(phydev);
502 return aqr_hwmon_probe(phydev);