3 * Bios Update driver for Dell systems
5 * Abhay Salunke <abhay_salunke@dell.com>
7 * Copyright (C) 2005 Dell Inc.
9 * Remote BIOS Update (rbu) driver is used for updating DELL BIOS by
10 * creating entries in the /sys file systems on Linux 2.6 and higher
11 * kernels. The driver supports two mechanism to update the BIOS namely
12 * contiguous and packetized. Both these methods still require having some
13 * application to set the CMOS bit indicating the BIOS to update itself
17 * This driver writes the incoming data in a monolithic image by allocating
18 * contiguous physical pages large enough to accommodate the incoming BIOS
22 * The driver writes the incoming packet image by allocating a new packet
23 * on every time the packet data is written. This driver requires an
24 * application to break the BIOS image in to fixed sized packet chunks.
26 * See Documentation/dell_rbu.txt for more info.
28 * This program is free software; you can redistribute it and/or modify
29 * it under the terms of the GNU General Public License v2.0 as published by
30 * the Free Software Foundation
32 * This program is distributed in the hope that it will be useful,
33 * but WITHOUT ANY WARRANTY; without even the implied warranty of
34 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
35 * GNU General Public License for more details.
37 #include <linux/version.h>
38 #include <linux/config.h>
39 #include <linux/init.h>
40 #include <linux/module.h>
41 #include <linux/string.h>
42 #include <linux/errno.h>
43 #include <linux/blkdev.h>
44 #include <linux/device.h>
45 #include <linux/spinlock.h>
46 #include <linux/moduleparam.h>
47 #include <linux/firmware.h>
48 #include <linux/dma-mapping.h>
50 MODULE_AUTHOR("Abhay Salunke <abhay_salunke@dell.com>");
51 MODULE_DESCRIPTION("Driver for updating BIOS image on DELL systems");
52 MODULE_LICENSE("GPL");
53 MODULE_VERSION("2.0");
55 #define BIOS_SCAN_LIMIT 0xffffffff
56 #define MAX_IMAGE_LENGTH 16
57 static struct _rbu_data {
58 void *image_update_buffer;
59 unsigned long image_update_buffer_size;
60 unsigned long bios_image_size;
61 int image_update_ordernum;
64 unsigned long packet_read_count;
65 unsigned long packet_write_count;
66 unsigned long num_packets;
67 unsigned long packetsize;
71 static char image_type[MAX_IMAGE_LENGTH + 1] = "mono";
72 module_param_string(image_type, image_type, sizeof (image_type), 0);
73 MODULE_PARM_DESC(image_type, "BIOS image type. choose- mono or packet");
76 struct list_head list;
82 static struct packet_data packet_data_head;
84 static struct platform_device *rbu_device;
86 static dma_addr_t dell_rbu_dmaaddr;
89 init_packet_head(void)
91 INIT_LIST_HEAD(&packet_data_head.list);
92 rbu_data.packet_write_count = 0;
93 rbu_data.packet_read_count = 0;
94 rbu_data.num_packets = 0;
95 rbu_data.packetsize = 0;
99 fill_last_packet(void *data, size_t length)
101 struct list_head *ptemp_list;
102 struct packet_data *packet = NULL;
103 int packet_count = 0;
105 pr_debug("fill_last_packet: entry \n");
107 if (!rbu_data.num_packets) {
108 pr_debug("fill_last_packet: num_packets=0\n");
112 packet_count = rbu_data.num_packets;
114 ptemp_list = (&packet_data_head.list)->prev;
116 packet = list_entry(ptemp_list, struct packet_data, list);
118 if ((rbu_data.packet_write_count + length) > rbu_data.packetsize) {
119 pr_debug("dell_rbu:%s: packet size data "
120 "overrun\n", __FUNCTION__);
124 pr_debug("fill_last_packet : buffer = %p\n", packet->data);
126 memcpy((packet->data + rbu_data.packet_write_count), data, length);
128 if ((rbu_data.packet_write_count + length) == rbu_data.packetsize) {
130 * this was the last data chunk in the packet
131 * so reinitialize the packet data counter to zero
133 rbu_data.packet_write_count = 0;
135 rbu_data.packet_write_count += length;
137 pr_debug("fill_last_packet: exit \n");
142 create_packet(size_t length)
144 struct packet_data *newpacket;
147 pr_debug("create_packet: entry \n");
149 if (!rbu_data.packetsize) {
150 pr_debug("create_packet: packetsize not specified\n");
153 spin_unlock(&rbu_data.lock);
154 newpacket = kmalloc(sizeof (struct packet_data), GFP_KERNEL);
155 spin_lock(&rbu_data.lock);
159 "dell_rbu:%s: failed to allocate new "
160 "packet\n", __FUNCTION__);
164 ordernum = get_order(length);
166 * there is no upper limit on memory
167 * address for packetized mechanism
169 spin_unlock(&rbu_data.lock);
170 newpacket->data = (unsigned char *) __get_free_pages(GFP_KERNEL,
172 spin_lock(&rbu_data.lock);
174 pr_debug("create_packet: newpacket %p\n", newpacket->data);
176 if (!newpacket->data) {
178 "dell_rbu:%s: failed to allocate new "
179 "packet\n", __FUNCTION__);
184 newpacket->ordernum = ordernum;
185 ++rbu_data.num_packets;
187 * initialize the newly created packet headers
189 INIT_LIST_HEAD(&newpacket->list);
190 list_add_tail(&newpacket->list, &packet_data_head.list);
192 * packets have fixed size
194 newpacket->length = rbu_data.packetsize;
196 pr_debug("create_packet: exit \n");
202 packetize_data(void *data, size_t length)
206 if (!rbu_data.packet_write_count) {
207 if ((rc = create_packet(length)))
210 if ((rc = fill_last_packet(data, length)))
217 do_packet_read(char *data, struct list_head *ptemp_list,
218 int length, int bytes_read, int *list_read_count)
221 struct packet_data *newpacket = NULL;
222 int bytes_copied = 0;
225 newpacket = list_entry(ptemp_list, struct packet_data, list);
226 *list_read_count += newpacket->length;
228 if (*list_read_count > bytes_read) {
229 /* point to the start of unread data */
230 j = newpacket->length - (*list_read_count - bytes_read);
231 /* point to the offset in the packet buffer */
232 ptemp_buf = (u8 *) newpacket->data + j;
234 * check if there is enough room in
235 * * the incoming buffer
237 if (length > (*list_read_count - bytes_read))
239 * copy what ever is there in this
242 bytes_copied = (*list_read_count - bytes_read);
244 /* copy the remaining */
245 bytes_copied = length;
246 memcpy(data, ptemp_buf, bytes_copied);
252 packet_read_list(char *data, size_t * pread_length)
254 struct list_head *ptemp_list;
256 int bytes_copied = 0;
258 int remaining_bytes = 0;
261 /* check if we have any packets */
262 if (0 == rbu_data.num_packets)
265 remaining_bytes = *pread_length;
266 bytes_read = rbu_data.packet_read_count;
268 ptemp_list = (&packet_data_head.list)->next;
269 while (!list_empty(ptemp_list)) {
270 bytes_copied = do_packet_read(pdest, ptemp_list,
271 remaining_bytes, bytes_read, &temp_count);
272 remaining_bytes -= bytes_copied;
273 bytes_read += bytes_copied;
274 pdest += bytes_copied;
276 * check if we reached end of buffer before reaching the
279 if (remaining_bytes == 0)
282 ptemp_list = ptemp_list->next;
284 /*finally set the bytes read */
285 *pread_length = bytes_read - rbu_data.packet_read_count;
286 rbu_data.packet_read_count = bytes_read;
291 packet_empty_list(void)
293 struct list_head *ptemp_list;
294 struct list_head *pnext_list;
295 struct packet_data *newpacket;
297 ptemp_list = (&packet_data_head.list)->next;
298 while (!list_empty(ptemp_list)) {
300 list_entry(ptemp_list, struct packet_data, list);
301 pnext_list = ptemp_list->next;
302 list_del(ptemp_list);
303 ptemp_list = pnext_list;
305 * zero out the RBU packet memory before freeing
306 * to make sure there are no stale RBU packets left in memory
308 memset(newpacket->data, 0, rbu_data.packetsize);
309 free_pages((unsigned long) newpacket->data,
310 newpacket->ordernum);
313 rbu_data.packet_write_count = 0;
314 rbu_data.packet_read_count = 0;
315 rbu_data.num_packets = 0;
316 rbu_data.packetsize = 0;
320 * img_update_free: Frees the buffer allocated for storing BIOS image
321 * Always called with lock held and returned with lock held
324 img_update_free(void)
326 if (!rbu_data.image_update_buffer)
329 * zero out this buffer before freeing it to get rid of any stale
330 * BIOS image copied in memory.
332 memset(rbu_data.image_update_buffer, 0,
333 rbu_data.image_update_buffer_size);
334 if (rbu_data.dma_alloc == 1)
335 dma_free_coherent(NULL, rbu_data.bios_image_size,
336 rbu_data.image_update_buffer, dell_rbu_dmaaddr);
338 free_pages((unsigned long) rbu_data.image_update_buffer,
339 rbu_data.image_update_ordernum);
342 * Re-initialize the rbu_data variables after a free
344 rbu_data.image_update_ordernum = -1;
345 rbu_data.image_update_buffer = NULL;
346 rbu_data.image_update_buffer_size = 0;
347 rbu_data.bios_image_size = 0;
348 rbu_data.dma_alloc = 0;
352 * img_update_realloc: This function allocates the contiguous pages to
353 * accommodate the requested size of data. The memory address and size
354 * values are stored globally and on every call to this function the new
355 * size is checked to see if more data is required than the existing size.
356 * If true the previous memory is freed and new allocation is done to
357 * accommodate the new size. If the incoming size is less then than the
358 * already allocated size, then that memory is reused. This function is
359 * called with lock held and returns with lock held.
362 img_update_realloc(unsigned long size)
364 unsigned char *image_update_buffer = NULL;
366 unsigned long img_buf_phys_addr;
371 * check if the buffer of sufficient size has been
374 if (rbu_data.image_update_buffer_size >= size) {
376 * check for corruption
378 if ((size != 0) && (rbu_data.image_update_buffer == NULL)) {
379 printk(KERN_ERR "dell_rbu:%s: corruption "
380 "check failed\n", __FUNCTION__);
384 * we have a valid pre-allocated buffer with
391 * free any previously allocated buffer
395 spin_unlock(&rbu_data.lock);
397 ordernum = get_order(size);
398 image_update_buffer =
399 (unsigned char *) __get_free_pages(GFP_KERNEL, ordernum);
402 (unsigned long) virt_to_phys(image_update_buffer);
404 if (img_buf_phys_addr > BIOS_SCAN_LIMIT) {
405 free_pages((unsigned long) image_update_buffer, ordernum);
407 image_update_buffer = dma_alloc_coherent(NULL, size,
408 &dell_rbu_dmaaddr, GFP_KERNEL);
412 spin_lock(&rbu_data.lock);
414 if (image_update_buffer != NULL) {
415 rbu_data.image_update_buffer = image_update_buffer;
416 rbu_data.image_update_buffer_size = size;
417 rbu_data.bios_image_size =
418 rbu_data.image_update_buffer_size;
419 rbu_data.image_update_ordernum = ordernum;
420 rbu_data.dma_alloc = dma_alloc;
423 pr_debug("Not enough memory for image update:"
424 "size = %ld\n", size);
432 read_packet_data(char *buffer, loff_t pos, size_t count)
437 char *ptempBuf = buffer;
438 unsigned long imagesize;
440 /* check to see if we have something to return */
441 if (rbu_data.num_packets == 0) {
442 pr_debug("read_packet_data: no packets written\n");
444 goto read_rbu_data_exit;
447 imagesize = rbu_data.num_packets * rbu_data.packetsize;
449 if (pos > imagesize) {
451 printk(KERN_WARNING "dell_rbu:read_packet_data: "
453 goto read_rbu_data_exit;
456 bytes_left = imagesize - pos;
457 data_length = min(bytes_left, count);
459 if ((retval = packet_read_list(ptempBuf, &data_length)) < 0)
460 goto read_rbu_data_exit;
462 if ((pos + count) > imagesize) {
463 rbu_data.packet_read_count = 0;
464 /* this was the last copy */
474 read_rbu_mono_data(char *buffer, loff_t pos, size_t count)
476 unsigned char *ptemp = NULL;
477 size_t bytes_left = 0;
478 size_t data_length = 0;
479 ssize_t ret_count = 0;
481 /* check to see if we have something to return */
482 if ((rbu_data.image_update_buffer == NULL) ||
483 (rbu_data.bios_image_size == 0)) {
484 pr_debug("read_rbu_data_mono: image_update_buffer %p ,"
485 "bios_image_size %lu\n",
486 rbu_data.image_update_buffer,
487 rbu_data.bios_image_size);
489 goto read_rbu_data_exit;
492 if (pos > rbu_data.bios_image_size) {
494 goto read_rbu_data_exit;
497 bytes_left = rbu_data.bios_image_size - pos;
498 data_length = min(bytes_left, count);
500 ptemp = rbu_data.image_update_buffer;
501 memcpy(buffer, (ptemp + pos), data_length);
503 if ((pos + count) > rbu_data.bios_image_size)
504 /* this was the last copy */
505 ret_count = bytes_left;
513 read_rbu_data(struct kobject *kobj, char *buffer, loff_t pos, size_t count)
515 ssize_t ret_count = 0;
517 spin_lock(&rbu_data.lock);
519 if (!strcmp(image_type, "mono"))
520 ret_count = read_rbu_mono_data(buffer, pos, count);
521 else if (!strcmp(image_type, "packet"))
522 ret_count = read_packet_data(buffer, pos, count);
524 pr_debug("read_rbu_data: invalid image type specified\n");
526 spin_unlock(&rbu_data.lock);
531 callbackfn_rbu(const struct firmware *fw, void *context)
535 if (!fw || !fw->size) {
536 rbu_data.entry_created = 0;
540 spin_lock(&rbu_data.lock);
541 if (!strcmp(image_type, "mono")) {
542 if (!img_update_realloc(fw->size))
543 memcpy(rbu_data.image_update_buffer,
545 } else if (!strcmp(image_type, "packet")) {
546 if (!rbu_data.packetsize)
547 rbu_data.packetsize = fw->size;
548 else if (rbu_data.packetsize != fw->size) {
550 rbu_data.packetsize = fw->size;
552 packetize_data(fw->data, fw->size);
554 pr_debug("invalid image type specified.\n");
555 spin_unlock(&rbu_data.lock);
557 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG,
558 "dell_rbu", &rbu_device->dev, &context, callbackfn_rbu);
561 "dell_rbu:%s request_firmware_nowait failed"
562 " %d\n", __FUNCTION__, rc);
564 rbu_data.entry_created = 1;
568 read_rbu_image_type(struct kobject *kobj, char *buffer, loff_t pos,
573 size = sprintf(buffer, "%s\n", image_type);
578 write_rbu_image_type(struct kobject *kobj, char *buffer, loff_t pos,
584 spin_lock(&rbu_data.lock);
586 * Find the first newline or space
588 for (i = 0; i < count; ++i)
589 if (buffer[i] == '\n' || buffer[i] == ' ') {
594 buffer[count] = '\0';
596 if (strstr(buffer, "mono"))
597 strcpy(image_type, "mono");
598 else if (strstr(buffer, "packet"))
599 strcpy(image_type, "packet");
600 else if (strstr(buffer, "init")) {
602 * If due to the user error the driver gets in a bad
603 * state where even though it is loaded , the
604 * /sys/class/firmware/dell_rbu entries are missing.
605 * to cover this situation the user can recreate entries
606 * by writing init to image_type.
608 if (!rbu_data.entry_created) {
609 spin_unlock(&rbu_data.lock);
610 req_firm_rc = request_firmware_nowait(THIS_MODULE,
611 FW_ACTION_NOHOTPLUG, "dell_rbu",
612 &rbu_device->dev, &context,
616 "dell_rbu:%s request_firmware_nowait"
617 " failed %d\n", __FUNCTION__, rc);
620 rbu_data.entry_created = 1;
622 spin_lock(&rbu_data.lock);
625 printk(KERN_WARNING "dell_rbu: image_type is invalid\n");
626 spin_unlock(&rbu_data.lock);
630 /* we must free all previous allocations */
633 spin_unlock(&rbu_data.lock);
638 static struct bin_attribute rbu_data_attr = {
639 .attr = {.name = "data",.owner = THIS_MODULE,.mode = 0444},
640 .read = read_rbu_data,
643 static struct bin_attribute rbu_image_type_attr = {
644 .attr = {.name = "image_type",.owner = THIS_MODULE,.mode = 0644},
645 .read = read_rbu_image_type,
646 .write = write_rbu_image_type,
653 spin_lock_init(&rbu_data.lock);
657 platform_device_register_simple("dell_rbu", -1, NULL, 0);
660 "dell_rbu:%s:platform_device_register_simple "
661 "failed\n", __FUNCTION__);
665 sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
666 sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
668 rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG,
669 "dell_rbu", &rbu_device->dev, &context, callbackfn_rbu);
671 printk(KERN_ERR "dell_rbu:%s:request_firmware_nowait"
672 " failed %d\n", __FUNCTION__, rc);
674 rbu_data.entry_created = 1;
683 spin_lock(&rbu_data.lock);
686 spin_unlock(&rbu_data.lock);
687 platform_device_unregister(rbu_device);
690 module_exit(dcdrbu_exit);
691 module_init(dcdrbu_init);