3 * Bios Update driver for Dell systems
5 * Abhay Salunke <abhay_salunke@dell.com>
7 * Copyright (C) 2005 Dell Inc.
9 * Remote BIOS Update (rbu) driver is used for updating DELL BIOS by
10 * creating entries in the /sys file systems on Linux 2.6 and higher
11 * kernels. The driver supports two mechanism to update the BIOS namely
12 * contiguous and packetized. Both these methods still require having some
13 * application to set the CMOS bit indicating the BIOS to update itself
17 * This driver writes the incoming data in a monolithic image by allocating
18 * contiguous physical pages large enough to accommodate the incoming BIOS
22 * The driver writes the incoming packet image by allocating a new packet
23 * on every time the packet data is written. This driver requires an
24 * application to break the BIOS image in to fixed sized packet chunks.
26 * See Documentation/dell_rbu.txt for more info.
28 * This program is free software; you can redistribute it and/or modify
29 * it under the terms of the GNU General Public License v2.0 as published by
30 * the Free Software Foundation
32 * This program is distributed in the hope that it will be useful,
33 * but WITHOUT ANY WARRANTY; without even the implied warranty of
34 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
35 * GNU General Public License for more details.
37 #include <linux/version.h>
38 #include <linux/config.h>
39 #include <linux/init.h>
40 #include <linux/module.h>
41 #include <linux/string.h>
42 #include <linux/errno.h>
43 #include <linux/blkdev.h>
44 #include <linux/platform_device.h>
45 #include <linux/spinlock.h>
46 #include <linux/moduleparam.h>
47 #include <linux/firmware.h>
48 #include <linux/dma-mapping.h>
50 MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
51 MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
52 MODULE_LICENSE("GPL");
53 MODULE_VERSION("3.1");
55 #define BIOS_SCAN_LIMIT 0xffffffff
56 #define MAX_IMAGE_LENGTH 16
57 static struct _rbu_data
{
58 void *image_update_buffer
;
59 unsigned long image_update_buffer_size
;
60 unsigned long bios_image_size
;
61 int image_update_ordernum
;
64 unsigned long packet_read_count
;
65 unsigned long num_packets
;
66 unsigned long packetsize
;
67 unsigned long imagesize
;
71 static char image_type
[MAX_IMAGE_LENGTH
+ 1] = "mono";
72 module_param_string(image_type
, image_type
, sizeof (image_type
), 0);
73 MODULE_PARM_DESC(image_type
,
74 "BIOS image type. choose- mono or packet or init");
76 static unsigned long allocation_floor
= 0x100000;
77 module_param(allocation_floor
, ulong
, 0644);
78 MODULE_PARM_DESC(allocation_floor
,
79 "Minimum address for allocations when using Packet mode");
82 struct list_head list
;
88 static struct packet_data packet_data_head
;
90 static struct platform_device
*rbu_device
;
92 static dma_addr_t dell_rbu_dmaaddr
;
94 static void init_packet_head(void)
96 INIT_LIST_HEAD(&packet_data_head
.list
);
97 rbu_data
.packet_read_count
= 0;
98 rbu_data
.num_packets
= 0;
99 rbu_data
.packetsize
= 0;
100 rbu_data
.imagesize
= 0;
103 static int create_packet(void *data
, size_t length
)
105 struct packet_data
*newpacket
;
108 unsigned int packet_array_size
= 0;
109 void **invalid_addr_packet_array
= 0;
110 void *packet_data_temp_buf
= 0;
111 unsigned int idx
= 0;
113 pr_debug("create_packet: entry \n");
115 if (!rbu_data
.packetsize
) {
116 pr_debug("create_packet: packetsize not specified\n");
121 spin_unlock(&rbu_data
.lock
);
123 newpacket
= kzalloc(sizeof (struct packet_data
), GFP_KERNEL
);
127 "dell_rbu:%s: failed to allocate new "
128 "packet\n", __FUNCTION__
);
130 spin_lock(&rbu_data
.lock
);
134 ordernum
= get_order(length
);
137 * BIOS errata mean we cannot allocate packets below 1MB or they will
138 * be overwritten by BIOS.
140 * array to temporarily hold packets
141 * that are below the allocation floor
143 * NOTE: very simplistic because we only need the floor to be at 1MB
144 * due to BIOS errata. This shouldn't be used for higher floors
145 * or you will run out of mem trying to allocate the array.
147 packet_array_size
= max(
148 (unsigned int)(allocation_floor
/ rbu_data
.packetsize
),
150 invalid_addr_packet_array
= kzalloc(packet_array_size
* sizeof(void*),
153 if (!invalid_addr_packet_array
) {
155 "dell_rbu:%s: failed to allocate "
156 "invalid_addr_packet_array \n",
159 spin_lock(&rbu_data
.lock
);
160 goto out_alloc_packet
;
163 while (!packet_data_temp_buf
) {
164 packet_data_temp_buf
= (unsigned char *)
165 __get_free_pages(GFP_KERNEL
, ordernum
);
166 if (!packet_data_temp_buf
) {
168 "dell_rbu:%s: failed to allocate new "
169 "packet\n", __FUNCTION__
);
171 spin_lock(&rbu_data
.lock
);
172 goto out_alloc_packet_array
;
175 if ((unsigned long)virt_to_phys(packet_data_temp_buf
)
176 < allocation_floor
) {
177 pr_debug("packet 0x%lx below floor at 0x%lx.\n",
178 (unsigned long)virt_to_phys(
179 packet_data_temp_buf
),
181 invalid_addr_packet_array
[idx
++] = packet_data_temp_buf
;
182 packet_data_temp_buf
= 0;
185 spin_lock(&rbu_data
.lock
);
187 newpacket
->data
= packet_data_temp_buf
;
189 pr_debug("create_packet: newpacket at physical addr %lx\n",
190 (unsigned long)virt_to_phys(newpacket
->data
));
192 /* packets may not have fixed size */
193 newpacket
->length
= length
;
194 newpacket
->ordernum
= ordernum
;
195 ++rbu_data
.num_packets
;
197 /* initialize the newly created packet headers */
198 INIT_LIST_HEAD(&newpacket
->list
);
199 list_add_tail(&newpacket
->list
, &packet_data_head
.list
);
201 memcpy(newpacket
->data
, data
, length
);
203 pr_debug("create_packet: exit \n");
205 out_alloc_packet_array
:
206 /* always free packet array */
208 pr_debug("freeing unused packet below floor 0x%lx.\n",
209 (unsigned long)virt_to_phys(
210 invalid_addr_packet_array
[idx
-1]));
211 free_pages((unsigned long)invalid_addr_packet_array
[idx
-1],
214 kfree(invalid_addr_packet_array
);
217 /* if error, free data */
225 static int packetize_data(void *data
, size_t length
)
231 u8
*end
= (u8
*) data
+ length
;
232 pr_debug("packetize_data: data length %d\n", length
);
233 if (!rbu_data
.packetsize
) {
235 "dell_rbu: packetsize not specified\n");
241 /* packetize the hunk */
243 if ((temp
+ rbu_data
.packetsize
) < end
)
244 packet_length
= rbu_data
.packetsize
;
246 /* this is the last packet */
247 packet_length
= end
- temp
;
251 if ((rc
= create_packet(temp
, packet_length
)))
254 pr_debug("%lu:%lu\n", temp
, (end
- temp
));
255 temp
+= packet_length
;
258 rbu_data
.imagesize
= length
;
263 static int do_packet_read(char *data
, struct list_head
*ptemp_list
,
264 int length
, int bytes_read
, int *list_read_count
)
267 struct packet_data
*newpacket
= NULL
;
268 int bytes_copied
= 0;
271 newpacket
= list_entry(ptemp_list
, struct packet_data
, list
);
272 *list_read_count
+= newpacket
->length
;
274 if (*list_read_count
> bytes_read
) {
275 /* point to the start of unread data */
276 j
= newpacket
->length
- (*list_read_count
- bytes_read
);
277 /* point to the offset in the packet buffer */
278 ptemp_buf
= (u8
*) newpacket
->data
+ j
;
280 * check if there is enough room in
281 * * the incoming buffer
283 if (length
> (*list_read_count
- bytes_read
))
285 * copy what ever is there in this
288 bytes_copied
= (*list_read_count
- bytes_read
);
290 /* copy the remaining */
291 bytes_copied
= length
;
292 memcpy(data
, ptemp_buf
, bytes_copied
);
297 static int packet_read_list(char *data
, size_t * pread_length
)
299 struct list_head
*ptemp_list
;
301 int bytes_copied
= 0;
303 int remaining_bytes
= 0;
306 /* check if we have any packets */
307 if (0 == rbu_data
.num_packets
)
310 remaining_bytes
= *pread_length
;
311 bytes_read
= rbu_data
.packet_read_count
;
313 ptemp_list
= (&packet_data_head
.list
)->next
;
314 while (!list_empty(ptemp_list
)) {
315 bytes_copied
= do_packet_read(pdest
, ptemp_list
,
316 remaining_bytes
, bytes_read
, &temp_count
);
317 remaining_bytes
-= bytes_copied
;
318 bytes_read
+= bytes_copied
;
319 pdest
+= bytes_copied
;
321 * check if we reached end of buffer before reaching the
324 if (remaining_bytes
== 0)
327 ptemp_list
= ptemp_list
->next
;
329 /*finally set the bytes read */
330 *pread_length
= bytes_read
- rbu_data
.packet_read_count
;
331 rbu_data
.packet_read_count
= bytes_read
;
335 static void packet_empty_list(void)
337 struct list_head
*ptemp_list
;
338 struct list_head
*pnext_list
;
339 struct packet_data
*newpacket
;
341 ptemp_list
= (&packet_data_head
.list
)->next
;
342 while (!list_empty(ptemp_list
)) {
344 list_entry(ptemp_list
, struct packet_data
, list
);
345 pnext_list
= ptemp_list
->next
;
346 list_del(ptemp_list
);
347 ptemp_list
= pnext_list
;
349 * zero out the RBU packet memory before freeing
350 * to make sure there are no stale RBU packets left in memory
352 memset(newpacket
->data
, 0, rbu_data
.packetsize
);
353 free_pages((unsigned long) newpacket
->data
,
354 newpacket
->ordernum
);
357 rbu_data
.packet_read_count
= 0;
358 rbu_data
.num_packets
= 0;
359 rbu_data
.imagesize
= 0;
363 * img_update_free: Frees the buffer allocated for storing BIOS image
364 * Always called with lock held and returned with lock held
366 static void img_update_free(void)
368 if (!rbu_data
.image_update_buffer
)
371 * zero out this buffer before freeing it to get rid of any stale
372 * BIOS image copied in memory.
374 memset(rbu_data
.image_update_buffer
, 0,
375 rbu_data
.image_update_buffer_size
);
376 if (rbu_data
.dma_alloc
== 1)
377 dma_free_coherent(NULL
, rbu_data
.bios_image_size
,
378 rbu_data
.image_update_buffer
, dell_rbu_dmaaddr
);
380 free_pages((unsigned long) rbu_data
.image_update_buffer
,
381 rbu_data
.image_update_ordernum
);
384 * Re-initialize the rbu_data variables after a free
386 rbu_data
.image_update_ordernum
= -1;
387 rbu_data
.image_update_buffer
= NULL
;
388 rbu_data
.image_update_buffer_size
= 0;
389 rbu_data
.bios_image_size
= 0;
390 rbu_data
.dma_alloc
= 0;
394 * img_update_realloc: This function allocates the contiguous pages to
395 * accommodate the requested size of data. The memory address and size
396 * values are stored globally and on every call to this function the new
397 * size is checked to see if more data is required than the existing size.
398 * If true the previous memory is freed and new allocation is done to
399 * accommodate the new size. If the incoming size is less then than the
400 * already allocated size, then that memory is reused. This function is
401 * called with lock held and returns with lock held.
403 static int img_update_realloc(unsigned long size
)
405 unsigned char *image_update_buffer
= NULL
;
407 unsigned long img_buf_phys_addr
;
412 * check if the buffer of sufficient size has been
415 if (rbu_data
.image_update_buffer_size
>= size
) {
417 * check for corruption
419 if ((size
!= 0) && (rbu_data
.image_update_buffer
== NULL
)) {
420 printk(KERN_ERR
"dell_rbu:%s: corruption "
421 "check failed\n", __FUNCTION__
);
425 * we have a valid pre-allocated buffer with
432 * free any previously allocated buffer
436 spin_unlock(&rbu_data
.lock
);
438 ordernum
= get_order(size
);
439 image_update_buffer
=
440 (unsigned char *) __get_free_pages(GFP_KERNEL
, ordernum
);
443 (unsigned long) virt_to_phys(image_update_buffer
);
445 if (img_buf_phys_addr
> BIOS_SCAN_LIMIT
) {
446 free_pages((unsigned long) image_update_buffer
, ordernum
);
448 image_update_buffer
= dma_alloc_coherent(NULL
, size
,
449 &dell_rbu_dmaaddr
, GFP_KERNEL
);
453 spin_lock(&rbu_data
.lock
);
455 if (image_update_buffer
!= NULL
) {
456 rbu_data
.image_update_buffer
= image_update_buffer
;
457 rbu_data
.image_update_buffer_size
= size
;
458 rbu_data
.bios_image_size
=
459 rbu_data
.image_update_buffer_size
;
460 rbu_data
.image_update_ordernum
= ordernum
;
461 rbu_data
.dma_alloc
= dma_alloc
;
464 pr_debug("Not enough memory for image update:"
465 "size = %ld\n", size
);
472 static ssize_t
read_packet_data(char *buffer
, loff_t pos
, size_t count
)
477 char *ptempBuf
= buffer
;
479 /* check to see if we have something to return */
480 if (rbu_data
.num_packets
== 0) {
481 pr_debug("read_packet_data: no packets written\n");
483 goto read_rbu_data_exit
;
486 if (pos
> rbu_data
.imagesize
) {
488 printk(KERN_WARNING
"dell_rbu:read_packet_data: "
490 goto read_rbu_data_exit
;
493 bytes_left
= rbu_data
.imagesize
- pos
;
494 data_length
= min(bytes_left
, count
);
496 if ((retval
= packet_read_list(ptempBuf
, &data_length
)) < 0)
497 goto read_rbu_data_exit
;
499 if ((pos
+ count
) > rbu_data
.imagesize
) {
500 rbu_data
.packet_read_count
= 0;
501 /* this was the last copy */
510 static ssize_t
read_rbu_mono_data(char *buffer
, loff_t pos
, size_t count
)
512 unsigned char *ptemp
= NULL
;
513 size_t bytes_left
= 0;
514 size_t data_length
= 0;
515 ssize_t ret_count
= 0;
517 /* check to see if we have something to return */
518 if ((rbu_data
.image_update_buffer
== NULL
) ||
519 (rbu_data
.bios_image_size
== 0)) {
520 pr_debug("read_rbu_data_mono: image_update_buffer %p ,"
521 "bios_image_size %lu\n",
522 rbu_data
.image_update_buffer
,
523 rbu_data
.bios_image_size
);
525 goto read_rbu_data_exit
;
528 if (pos
> rbu_data
.bios_image_size
) {
530 goto read_rbu_data_exit
;
533 bytes_left
= rbu_data
.bios_image_size
- pos
;
534 data_length
= min(bytes_left
, count
);
536 ptemp
= rbu_data
.image_update_buffer
;
537 memcpy(buffer
, (ptemp
+ pos
), data_length
);
539 if ((pos
+ count
) > rbu_data
.bios_image_size
)
540 /* this was the last copy */
541 ret_count
= bytes_left
;
548 static ssize_t
read_rbu_data(struct kobject
*kobj
, char *buffer
,
549 loff_t pos
, size_t count
)
551 ssize_t ret_count
= 0;
553 spin_lock(&rbu_data
.lock
);
555 if (!strcmp(image_type
, "mono"))
556 ret_count
= read_rbu_mono_data(buffer
, pos
, count
);
557 else if (!strcmp(image_type
, "packet"))
558 ret_count
= read_packet_data(buffer
, pos
, count
);
560 pr_debug("read_rbu_data: invalid image type specified\n");
562 spin_unlock(&rbu_data
.lock
);
566 static void callbackfn_rbu(const struct firmware
*fw
, void *context
)
570 if (!fw
|| !fw
->size
) {
571 rbu_data
.entry_created
= 0;
575 spin_lock(&rbu_data
.lock
);
576 if (!strcmp(image_type
, "mono")) {
577 if (!img_update_realloc(fw
->size
))
578 memcpy(rbu_data
.image_update_buffer
,
580 } else if (!strcmp(image_type
, "packet")) {
582 * we need to free previous packets if a
583 * new hunk of packets needs to be downloaded
586 if (packetize_data(fw
->data
, fw
->size
))
587 /* Incase something goes wrong when we are
588 * in middle of packetizing the data, we
589 * need to free up whatever packets might
590 * have been created before we quit.
594 pr_debug("invalid image type specified.\n");
595 spin_unlock(&rbu_data
.lock
);
597 rc
= request_firmware_nowait(THIS_MODULE
, FW_ACTION_NOHOTPLUG
,
598 "dell_rbu", &rbu_device
->dev
, &context
, callbackfn_rbu
);
601 "dell_rbu:%s request_firmware_nowait failed"
602 " %d\n", __FUNCTION__
, rc
);
604 rbu_data
.entry_created
= 1;
607 static ssize_t
read_rbu_image_type(struct kobject
*kobj
, char *buffer
,
608 loff_t pos
, size_t count
)
612 size
= sprintf(buffer
, "%s\n", image_type
);
616 static ssize_t
write_rbu_image_type(struct kobject
*kobj
, char *buffer
,
617 loff_t pos
, size_t count
)
622 spin_lock(&rbu_data
.lock
);
624 * Find the first newline or space
626 for (i
= 0; i
< count
; ++i
)
627 if (buffer
[i
] == '\n' || buffer
[i
] == ' ') {
632 buffer
[count
] = '\0';
634 if (strstr(buffer
, "mono"))
635 strcpy(image_type
, "mono");
636 else if (strstr(buffer
, "packet"))
637 strcpy(image_type
, "packet");
638 else if (strstr(buffer
, "init")) {
640 * If due to the user error the driver gets in a bad
641 * state where even though it is loaded , the
642 * /sys/class/firmware/dell_rbu entries are missing.
643 * to cover this situation the user can recreate entries
644 * by writing init to image_type.
646 if (!rbu_data
.entry_created
) {
647 spin_unlock(&rbu_data
.lock
);
648 req_firm_rc
= request_firmware_nowait(THIS_MODULE
,
649 FW_ACTION_NOHOTPLUG
, "dell_rbu",
650 &rbu_device
->dev
, &context
,
654 "dell_rbu:%s request_firmware_nowait"
655 " failed %d\n", __FUNCTION__
, rc
);
658 rbu_data
.entry_created
= 1;
660 spin_lock(&rbu_data
.lock
);
663 printk(KERN_WARNING
"dell_rbu: image_type is invalid\n");
664 spin_unlock(&rbu_data
.lock
);
668 /* we must free all previous allocations */
671 spin_unlock(&rbu_data
.lock
);
676 static ssize_t
read_rbu_packet_size(struct kobject
*kobj
, char *buffer
,
677 loff_t pos
, size_t count
)
681 spin_lock(&rbu_data
.lock
);
682 size
= sprintf(buffer
, "%lu\n", rbu_data
.packetsize
);
683 spin_unlock(&rbu_data
.lock
);
688 static ssize_t
write_rbu_packet_size(struct kobject
*kobj
, char *buffer
,
689 loff_t pos
, size_t count
)
692 spin_lock(&rbu_data
.lock
);
694 sscanf(buffer
, "%lu", &temp
);
695 if (temp
< 0xffffffff)
696 rbu_data
.packetsize
= temp
;
698 spin_unlock(&rbu_data
.lock
);
702 static struct bin_attribute rbu_data_attr
= {
703 .attr
= {.name
= "data",.owner
= THIS_MODULE
,.mode
= 0444},
704 .read
= read_rbu_data
,
707 static struct bin_attribute rbu_image_type_attr
= {
708 .attr
= {.name
= "image_type",.owner
= THIS_MODULE
,.mode
= 0644},
709 .read
= read_rbu_image_type
,
710 .write
= write_rbu_image_type
,
713 static struct bin_attribute rbu_packet_size_attr
= {
714 .attr
= {.name
= "packet_size",.owner
= THIS_MODULE
,.mode
= 0644},
715 .read
= read_rbu_packet_size
,
716 .write
= write_rbu_packet_size
,
719 static int __init
dcdrbu_init(void)
722 spin_lock_init(&rbu_data
.lock
);
726 platform_device_register_simple("dell_rbu", -1, NULL
, 0);
729 "dell_rbu:%s:platform_device_register_simple "
730 "failed\n", __FUNCTION__
);
734 sysfs_create_bin_file(&rbu_device
->dev
.kobj
, &rbu_data_attr
);
735 sysfs_create_bin_file(&rbu_device
->dev
.kobj
, &rbu_image_type_attr
);
736 sysfs_create_bin_file(&rbu_device
->dev
.kobj
,
737 &rbu_packet_size_attr
);
739 rc
= request_firmware_nowait(THIS_MODULE
, FW_ACTION_NOHOTPLUG
,
740 "dell_rbu", &rbu_device
->dev
, &context
, callbackfn_rbu
);
742 printk(KERN_ERR
"dell_rbu:%s:request_firmware_nowait"
743 " failed %d\n", __FUNCTION__
, rc
);
745 rbu_data
.entry_created
= 1;
751 static __exit
void dcdrbu_exit(void)
753 spin_lock(&rbu_data
.lock
);
756 spin_unlock(&rbu_data
.lock
);
757 platform_device_unregister(rbu_device
);
760 module_exit(dcdrbu_exit
);
761 module_init(dcdrbu_init
);
763 /* vim:noet:ts=8:sw=8