drivers/usb/typec/ucsi/ucsi_ccg.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * UCSI driver for Cypress CCGx Type-C controller
   4  *
   5  * Copyright (C) 2017-2018 NVIDIA Corporation. All rights reserved.
   6  * Author: Ajay Gupta <ajayg@nvidia.com>
   7  *
   8  * Some code borrowed from drivers/usb/typec/ucsi/ucsi_acpi.c
   9  */
  10 #include <linux/acpi.h>
  11 #include <linux/delay.h>
  12 #include <linux/firmware.h>
  13 #include <linux/i2c.h>
  14 #include <linux/module.h>
  15 #include <linux/pci.h>
  16 #include <linux/platform_device.h>
  17
  18 #include <asm/unaligned.h>
  19 #include "ucsi.h"
  20
  21 enum enum_fw_mode {
  22         BOOT,   /* bootloader */
  23         FW1,    /* FW partition-1 (contains secondary fw) */
  24         FW2,    /* FW partition-2 (contains primary fw) */
  25         FW_INVALID,
  26 };
  27
  28 #define CCGX_RAB_DEVICE_MODE                    0x0000
  29 #define CCGX_RAB_INTR_REG                       0x0006
  30 #define  DEV_INT                                BIT(0)
  31 #define  PORT0_INT                              BIT(1)
  32 #define  PORT1_INT                              BIT(2)
  33 #define  UCSI_READ_INT                          BIT(7)
  34 #define CCGX_RAB_JUMP_TO_BOOT                   0x0007
  35 #define  TO_BOOT                                'J'
  36 #define  TO_ALT_FW                              'A'
  37 #define CCGX_RAB_RESET_REQ                      0x0008
  38 #define  RESET_SIG                              'R'
  39 #define  CMD_RESET_I2C                          0x0
  40 #define  CMD_RESET_DEV                          0x1
  41 #define CCGX_RAB_ENTER_FLASHING                 0x000A
  42 #define  FLASH_ENTER_SIG                        'P'
  43 #define CCGX_RAB_VALIDATE_FW                    0x000B
  44 #define CCGX_RAB_FLASH_ROW_RW                   0x000C
  45 #define  FLASH_SIG                              'F'
  46 #define  FLASH_RD_CMD                           0x0
  47 #define  FLASH_WR_CMD                           0x1
  48 #define  FLASH_FWCT1_WR_CMD                     0x2
  49 #define  FLASH_FWCT2_WR_CMD                     0x3
  50 #define  FLASH_FWCT_SIG_WR_CMD                  0x4
  51 #define CCGX_RAB_READ_ALL_VER                   0x0010
  52 #define CCGX_RAB_READ_FW2_VER                   0x0020
  53 #define CCGX_RAB_UCSI_CONTROL                   0x0039
  54 #define CCGX_RAB_UCSI_CONTROL_START             BIT(0)
  55 #define CCGX_RAB_UCSI_CONTROL_STOP              BIT(1)
  56 #define CCGX_RAB_UCSI_DATA_BLOCK(offset)        (0xf000 | ((offset) & 0xff))
  57 #define REG_FLASH_RW_MEM        0x0200
  58 #define DEV_REG_IDX                             CCGX_RAB_DEVICE_MODE
  59 #define CCGX_RAB_PDPORT_ENABLE                  0x002C
  60 #define  PDPORT_1               BIT(0)
  61 #define  PDPORT_2               BIT(1)
  62 #define CCGX_RAB_RESPONSE                       0x007E
  63 #define  ASYNC_EVENT                            BIT(7)
  64
  65 /* CCGx events & async msg codes */
  66 #define RESET_COMPLETE          0x80
  67 #define EVENT_INDEX             RESET_COMPLETE
  68 #define PORT_CONNECT_DET        0x84
  69 #define PORT_DISCONNECT_DET     0x85
  70 #define ROLE_SWAP_COMPELETE     0x87
  71
  72 /* ccg firmware */
  73 #define CYACD_LINE_SIZE         527
  74 #define CCG4_ROW_SIZE           256
  75 #define FW1_METADATA_ROW        0x1FF
  76 #define FW2_METADATA_ROW        0x1FE
  77 #define FW_CFG_TABLE_SIG_SIZE   256
  78
  79 static int secondary_fw_min_ver = 41;
  80
  81 enum enum_flash_mode {
  82         SECONDARY_BL,   /* update secondary using bootloader */
  83         PRIMARY,        /* update primary using secondary */
  84         SECONDARY,      /* update secondary using primary */
  85         FLASH_NOT_NEEDED,       /* update not required */
  86         FLASH_INVALID,
  87 };
  88
  89 static const char * const ccg_fw_names[] = {
  90         "ccg_boot.cyacd",
  91         "ccg_primary.cyacd",
  92         "ccg_secondary.cyacd"
  93 };
  94
  95 struct ccg_dev_info {
  96 #define CCG_DEVINFO_FWMODE_SHIFT (0)
  97 #define CCG_DEVINFO_FWMODE_MASK (0x3 << CCG_DEVINFO_FWMODE_SHIFT)
  98 #define CCG_DEVINFO_PDPORTS_SHIFT (2)
  99 #define CCG_DEVINFO_PDPORTS_MASK (0x3 << CCG_DEVINFO_PDPORTS_SHIFT)
 100         u8 mode;
 101         u8 bl_mode;
 102         __le16 silicon_id;
 103         __le16 bl_last_row;
 104 } __packed;
 105
 106 struct version_format {
 107         __le16 build;
 108         u8 patch;
 109         u8 ver;
 110 #define CCG_VERSION_MIN_SHIFT (0)
 111 #define CCG_VERSION_MIN_MASK (0xf << CCG_VERSION_MIN_SHIFT)
 112 #define CCG_VERSION_MAJ_SHIFT (4)
 113 #define CCG_VERSION_MAJ_MASK (0xf << CCG_VERSION_MAJ_SHIFT)
 114 } __packed;
 115
 116 struct version_info {
 117         struct version_format base;
 118         struct version_format app;
 119 };
 120
 121 struct fw_config_table {
 122         u32 identity;
 123         u16 table_size;
 124         u8 fwct_version;
 125         u8 is_key_change;
 126         u8 guid[16];
 127         struct version_format base;
 128         struct version_format app;
 129         u8 primary_fw_digest[32];
 130         u32 key_exp_length;
 131         u8 key_modulus[256];
 132         u8 key_exp[4];
 133 };
 134
 135 /* CCGx response codes */
 136 enum ccg_resp_code {
 137         CMD_NO_RESP             = 0x00,
 138         CMD_SUCCESS             = 0x02,
 139         FLASH_DATA_AVAILABLE    = 0x03,
 140         CMD_INVALID             = 0x05,
 141         FLASH_UPDATE_FAIL       = 0x07,
 142         INVALID_FW              = 0x08,
 143         INVALID_ARG             = 0x09,
 144         CMD_NOT_SUPPORT         = 0x0A,
 145         TRANSACTION_FAIL        = 0x0C,
 146         PD_CMD_FAIL             = 0x0D,
 147         UNDEF_ERROR             = 0x0F,
 148         INVALID_RESP            = 0x10,
 149 };
 150
 151 #define CCG_EVENT_MAX   (EVENT_INDEX + 43)
 152
 153 struct ccg_cmd {
 154         u16 reg;
 155         u32 data;
 156         int len;
 157         u32 delay; /* ms delay for cmd timeout  */
 158 };
 159
 160 struct ccg_resp {
 161         u8 code;
 162         u8 length;
 163 };
 164
 165 struct ucsi_ccg {
 166         struct device *dev;
 167         struct ucsi *ucsi;
 168         struct ucsi_ppm ppm;
 169         struct i2c_client *client;
 170         struct ccg_dev_info info;
 171         /* version info for boot, primary and secondary */
 172         struct version_info version[FW2 + 1];
 173         /* CCG HPI communication flags */
 174         unsigned long flags;
 175 #define RESET_PENDING   0
 176 #define DEV_CMD_PENDING 1
 177         struct ccg_resp dev_resp;
 178         u8 cmd_resp;
 179         int port_num;
 180         int irq;
 181         struct work_struct work;
 182         struct mutex lock; /* to sync between user and driver thread */
 183
 184         /* fw build with vendor information */
 185         u16 fw_build;
 186 };
 187
 188 static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 189 {
 190         struct i2c_client *client = uc->client;
 191         const struct i2c_adapter_quirks *quirks = client->adapter->quirks;
 192         unsigned char buf[2];
 193         struct i2c_msg msgs[] = {
 194                 {
 195                         .addr   = client->addr,
 196                         .flags  = 0x0,
 197                         .len    = sizeof(buf),
 198                         .buf    = buf,
 199                 },
 200                 {
 201                         .addr   = client->addr,
 202                         .flags  = I2C_M_RD,
 203                         .buf    = data,
 204                 },
 205         };
 206         u32 rlen, rem_len = len, max_read_len = len;
 207         int status;
 208
 209         /* check any max_read_len limitation on i2c adapter */
 210         if (quirks && quirks->max_read_len)
 211                 max_read_len = quirks->max_read_len;
 212
 213         while (rem_len > 0) {
 214                 msgs[1].buf = &data[len - rem_len];
 215                 rlen = min_t(u16, rem_len, max_read_len);
 216                 msgs[1].len = rlen;
 217                 put_unaligned_le16(rab, buf);
 218                 status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
 219                 if (status < 0) {
 220                         dev_err(uc->dev, "i2c_transfer failed %d\n", status);
 221                         return status;
 222                 }
 223                 rab += rlen;
 224                 rem_len -= rlen;
 225         }
 226
 227         return 0;
 228 }
 229
 230 static int ccg_write(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 231 {
 232         struct i2c_client *client = uc->client;
 233         unsigned char *buf;
 234         struct i2c_msg msgs[] = {
 235                 {
 236                         .addr   = client->addr,
 237                         .flags  = 0x0,
 238                 }
 239         };
 240         int status;
 241
 242         buf = kzalloc(len + sizeof(rab), GFP_KERNEL);
 243         if (!buf)
 244                 return -ENOMEM;
 245
 246         put_unaligned_le16(rab, buf);
 247         memcpy(buf + sizeof(rab), data, len);
 248
 249         msgs[0].len = len + sizeof(rab);
 250         msgs[0].buf = buf;
 251
 252         status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
 253         if (status < 0) {
 254                 dev_err(uc->dev, "i2c_transfer failed %d\n", status);
 255                 kfree(buf);
 256                 return status;
 257         }
 258
 259         kfree(buf);
 260         return 0;
 261 }
 262
 263 static int ucsi_ccg_init(struct ucsi_ccg *uc)
 264 {
 265         unsigned int count = 10;
 266         u8 data;
 267         int status;
 268
 269         data = CCGX_RAB_UCSI_CONTROL_STOP;
 270         status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
 271         if (status < 0)
 272                 return status;
 273
 274         data = CCGX_RAB_UCSI_CONTROL_START;
 275         status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
 276         if (status < 0)
 277                 return status;
 278
 279         /*
 280          * Flush CCGx RESPONSE queue by acking interrupts. Above ucsi control
 281          * register write will push response which must be cleared.
 282          */
 283         do {
 284                 status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 285                 if (status < 0)
 286                         return status;
 287
 288                 if (!data)
 289                         return 0;
 290
 291                 status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 292                 if (status < 0)
 293                         return status;
 294
 295                 usleep_range(10000, 11000);
 296         } while (--count);
 297
 298         return -ETIMEDOUT;
 299 }
 300
 301 static int ucsi_ccg_send_data(struct ucsi_ccg *uc)
 302 {
 303         u8 *ppm = (u8 *)uc->ppm.data;
 304         int status;
 305         u16 rab;
 306
 307         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_out));
 308         status = ccg_write(uc, rab, ppm +
 309                            offsetof(struct ucsi_data, message_out),
 310                            sizeof(uc->ppm.data->message_out));
 311         if (status < 0)
 312                 return status;
 313
 314         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, ctrl));
 315         return ccg_write(uc, rab, ppm + offsetof(struct ucsi_data, ctrl),
 316                          sizeof(uc->ppm.data->ctrl));
 317 }
 318
 319 static int ucsi_ccg_recv_data(struct ucsi_ccg *uc)
 320 {
 321         u8 *ppm = (u8 *)uc->ppm.data;
 322         int status;
 323         u16 rab;
 324
 325         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, cci));
 326         status = ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, cci),
 327                           sizeof(uc->ppm.data->cci));
 328         if (status < 0)
 329                 return status;
 330
 331         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_in));
 332         return ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, message_in),
 333                         sizeof(uc->ppm.data->message_in));
 334 }
 335
 336 static int ucsi_ccg_ack_interrupt(struct ucsi_ccg *uc)
 337 {
 338         int status;
 339         unsigned char data;
 340
 341         status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 342         if (status < 0)
 343                 return status;
 344
 345         return ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 346 }
 347
 348 static int ucsi_ccg_sync(struct ucsi_ppm *ppm)
 349 {
 350         struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
 351         int status;
 352
 353         status = ucsi_ccg_recv_data(uc);
 354         if (status < 0)
 355                 return status;
 356
 357         /* ack interrupt to allow next command to run */
 358         return ucsi_ccg_ack_interrupt(uc);
 359 }
 360
 361 static int ucsi_ccg_cmd(struct ucsi_ppm *ppm, struct ucsi_control *ctrl)
 362 {
 363         struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
 364
 365         ppm->data->ctrl.raw_cmd = ctrl->raw_cmd;
 366         return ucsi_ccg_send_data(uc);
 367 }
 368
 369 static irqreturn_t ccg_irq_handler(int irq, void *data)
 370 {
 371         struct ucsi_ccg *uc = data;
 372
 373         ucsi_notify(uc->ucsi);
 374
 375         return IRQ_HANDLED;
 376 }
 377
 378 static int get_fw_info(struct ucsi_ccg *uc)
 379 {
 380         int err;
 381
 382         err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)(&uc->version),
 383                        sizeof(uc->version));
 384         if (err < 0)
 385                 return err;
 386
 387         err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info),
 388                        sizeof(uc->info));
 389         if (err < 0)
 390                 return err;
 391
 392         return 0;
 393 }
 394
 395 static inline bool invalid_async_evt(int code)
 396 {
 397         return (code >= CCG_EVENT_MAX) || (code < EVENT_INDEX);
 398 }
 399
 400 static void ccg_process_response(struct ucsi_ccg *uc)
 401 {
 402         struct device *dev = uc->dev;
 403
 404         if (uc->dev_resp.code & ASYNC_EVENT) {
 405                 if (uc->dev_resp.code == RESET_COMPLETE) {
 406                         if (test_bit(RESET_PENDING, &uc->flags))
 407                                 uc->cmd_resp = uc->dev_resp.code;
 408                         get_fw_info(uc);
 409                 }
 410                 if (invalid_async_evt(uc->dev_resp.code))
 411                         dev_err(dev, "invalid async evt %d\n",
 412                                 uc->dev_resp.code);
 413         } else {
 414                 if (test_bit(DEV_CMD_PENDING, &uc->flags)) {
 415                         uc->cmd_resp = uc->dev_resp.code;
 416                         clear_bit(DEV_CMD_PENDING, &uc->flags);
 417                 } else {
 418                         dev_err(dev, "dev resp 0x%04x but no cmd pending\n",
 419                                 uc->dev_resp.code);
 420                 }
 421         }
 422 }
 423
 424 static int ccg_read_response(struct ucsi_ccg *uc)
 425 {
 426         unsigned long target = jiffies + msecs_to_jiffies(1000);
 427         struct device *dev = uc->dev;
 428         u8 intval;
 429         int status;
 430
 431         /* wait for interrupt status to get updated */
 432         do {
 433                 status = ccg_read(uc, CCGX_RAB_INTR_REG, &intval,
 434                                   sizeof(intval));
 435                 if (status < 0)
 436                         return status;
 437
 438                 if (intval & DEV_INT)
 439                         break;
 440                 usleep_range(500, 600);
 441         } while (time_is_after_jiffies(target));
 442
 443         if (time_is_before_jiffies(target)) {
 444                 dev_err(dev, "response timeout error\n");
 445                 return -ETIME;
 446         }
 447
 448         status = ccg_read(uc, CCGX_RAB_RESPONSE, (u8 *)&uc->dev_resp,
 449                           sizeof(uc->dev_resp));
 450         if (status < 0)
 451                 return status;
 452
 453         status = ccg_write(uc, CCGX_RAB_INTR_REG, &intval, sizeof(intval));
 454         if (status < 0)
 455                 return status;
 456
 457         return 0;
 458 }
 459
 460 /* Caller must hold uc->lock */
 461 static int ccg_send_command(struct ucsi_ccg *uc, struct ccg_cmd *cmd)
 462 {
 463         struct device *dev = uc->dev;
 464         int ret;
 465
 466         switch (cmd->reg & 0xF000) {
 467         case DEV_REG_IDX:
 468                 set_bit(DEV_CMD_PENDING, &uc->flags);
 469                 break;
 470         default:
 471                 dev_err(dev, "invalid cmd register\n");
 472                 break;
 473         }
 474
 475         ret = ccg_write(uc, cmd->reg, (u8 *)&cmd->data, cmd->len);
 476         if (ret < 0)
 477                 return ret;
 478
 479         msleep(cmd->delay);
 480
 481         ret = ccg_read_response(uc);
 482         if (ret < 0) {
 483                 dev_err(dev, "response read error\n");
 484                 switch (cmd->reg & 0xF000) {
 485                 case DEV_REG_IDX:
 486                         clear_bit(DEV_CMD_PENDING, &uc->flags);
 487                         break;
 488                 default:
 489                         dev_err(dev, "invalid cmd register\n");
 490                         break;
 491                 }
 492                 return -EIO;
 493         }
 494         ccg_process_response(uc);
 495
 496         return uc->cmd_resp;
 497 }
 498
 499 static int ccg_cmd_enter_flashing(struct ucsi_ccg *uc)
 500 {
 501         struct ccg_cmd cmd;
 502         int ret;
 503
 504         cmd.reg = CCGX_RAB_ENTER_FLASHING;
 505         cmd.data = FLASH_ENTER_SIG;
 506         cmd.len = 1;
 507         cmd.delay = 50;
 508
 509         mutex_lock(&uc->lock);
 510
 511         ret = ccg_send_command(uc, &cmd);
 512
 513         mutex_unlock(&uc->lock);
 514
 515         if (ret != CMD_SUCCESS) {
 516                 dev_err(uc->dev, "enter flashing failed ret=%d\n", ret);
 517                 return ret;
 518         }
 519
 520         return 0;
 521 }
 522
 523 static int ccg_cmd_reset(struct ucsi_ccg *uc)
 524 {
 525         struct ccg_cmd cmd;
 526         u8 *p;
 527         int ret;
 528
 529         p = (u8 *)&cmd.data;
 530         cmd.reg = CCGX_RAB_RESET_REQ;
 531         p[0] = RESET_SIG;
 532         p[1] = CMD_RESET_DEV;
 533         cmd.len = 2;
 534         cmd.delay = 5000;
 535
 536         mutex_lock(&uc->lock);
 537
 538         set_bit(RESET_PENDING, &uc->flags);
 539
 540         ret = ccg_send_command(uc, &cmd);
 541         if (ret != RESET_COMPLETE)
 542                 goto err_clear_flag;
 543
 544         ret = 0;
 545
 546 err_clear_flag:
 547         clear_bit(RESET_PENDING, &uc->flags);
 548
 549         mutex_unlock(&uc->lock);
 550
 551         return ret;
 552 }
 553
 554 static int ccg_cmd_port_control(struct ucsi_ccg *uc, bool enable)
 555 {
 556         struct ccg_cmd cmd;
 557         int ret;
 558
 559         cmd.reg = CCGX_RAB_PDPORT_ENABLE;
 560         if (enable)
 561                 cmd.data = (uc->port_num == 1) ?
 562                             PDPORT_1 : (PDPORT_1 | PDPORT_2);
 563         else
 564                 cmd.data = 0x0;
 565         cmd.len = 1;
 566         cmd.delay = 10;
 567
 568         mutex_lock(&uc->lock);
 569
 570         ret = ccg_send_command(uc, &cmd);
 571
 572         mutex_unlock(&uc->lock);
 573
 574         if (ret != CMD_SUCCESS) {
 575                 dev_err(uc->dev, "port control failed ret=%d\n", ret);
 576                 return ret;
 577         }
 578         return 0;
 579 }
 580
 581 static int ccg_cmd_jump_boot_mode(struct ucsi_ccg *uc, int bl_mode)
 582 {
 583         struct ccg_cmd cmd;
 584         int ret;
 585
 586         cmd.reg = CCGX_RAB_JUMP_TO_BOOT;
 587
 588         if (bl_mode)
 589                 cmd.data = TO_BOOT;
 590         else
 591                 cmd.data = TO_ALT_FW;
 592
 593         cmd.len = 1;
 594         cmd.delay = 100;
 595
 596         mutex_lock(&uc->lock);
 597
 598         set_bit(RESET_PENDING, &uc->flags);
 599
 600         ret = ccg_send_command(uc, &cmd);
 601         if (ret != RESET_COMPLETE)
 602                 goto err_clear_flag;
 603
 604         ret = 0;
 605
 606 err_clear_flag:
 607         clear_bit(RESET_PENDING, &uc->flags);
 608
 609         mutex_unlock(&uc->lock);
 610
 611         return ret;
 612 }
 613
 614 static int
 615 ccg_cmd_write_flash_row(struct ucsi_ccg *uc, u16 row,
 616                         const void *data, u8 fcmd)
 617 {
 618         struct i2c_client *client = uc->client;
 619         struct ccg_cmd cmd;
 620         u8 buf[CCG4_ROW_SIZE + 2];
 621         u8 *p;
 622         int ret;
 623
 624         /* Copy the data into the flash read/write memory. */
 625         put_unaligned_le16(REG_FLASH_RW_MEM, buf);
 626
 627         memcpy(buf + 2, data, CCG4_ROW_SIZE);
 628
 629         mutex_lock(&uc->lock);
 630
 631         ret = i2c_master_send(client, buf, CCG4_ROW_SIZE + 2);
 632         if (ret != CCG4_ROW_SIZE + 2) {
 633                 dev_err(uc->dev, "REG_FLASH_RW_MEM write fail %d\n", ret);
 634                 mutex_unlock(&uc->lock);
 635                 return ret < 0 ? ret : -EIO;
 636         }
 637
 638         /* Use the FLASH_ROW_READ_WRITE register to trigger */
 639         /* writing of data to the desired flash row */
 640         p = (u8 *)&cmd.data;
 641         cmd.reg = CCGX_RAB_FLASH_ROW_RW;
 642         p[0] = FLASH_SIG;
 643         p[1] = fcmd;
 644         put_unaligned_le16(row, &p[2]);
 645         cmd.len = 4;
 646         cmd.delay = 50;
 647         if (fcmd == FLASH_FWCT_SIG_WR_CMD)
 648                 cmd.delay += 400;
 649         if (row == 510)
 650                 cmd.delay += 220;
 651         ret = ccg_send_command(uc, &cmd);
 652
 653         mutex_unlock(&uc->lock);
 654
 655         if (ret != CMD_SUCCESS) {
 656                 dev_err(uc->dev, "write flash row failed ret=%d\n", ret);
 657                 return ret;
 658         }
 659
 660         return 0;
 661 }
 662
 663 static int ccg_cmd_validate_fw(struct ucsi_ccg *uc, unsigned int fwid)
 664 {
 665         struct ccg_cmd cmd;
 666         int ret;
 667
 668         cmd.reg = CCGX_RAB_VALIDATE_FW;
 669         cmd.data = fwid;
 670         cmd.len = 1;
 671         cmd.delay = 500;
 672
 673         mutex_lock(&uc->lock);
 674
 675         ret = ccg_send_command(uc, &cmd);
 676
 677         mutex_unlock(&uc->lock);
 678
 679         if (ret != CMD_SUCCESS)
 680                 return ret;
 681
 682         return 0;
 683 }
 684
 685 static bool ccg_check_vendor_version(struct ucsi_ccg *uc,
 686                                      struct version_format *app,
 687                                      struct fw_config_table *fw_cfg)
 688 {
 689         struct device *dev = uc->dev;
 690
 691         /* Check if the fw build is for supported vendors */
 692         if (le16_to_cpu(app->build) != uc->fw_build) {
 693                 dev_info(dev, "current fw is not from supported vendor\n");
 694                 return false;
 695         }
 696
 697         /* Check if the new fw build is for supported vendors */
 698         if (le16_to_cpu(fw_cfg->app.build) != uc->fw_build) {
 699                 dev_info(dev, "new fw is not from supported vendor\n");
 700                 return false;
 701         }
 702         return true;
 703 }
 704
 705 static bool ccg_check_fw_version(struct ucsi_ccg *uc, const char *fw_name,
 706                                  struct version_format *app)
 707 {
 708         const struct firmware *fw = NULL;
 709         struct device *dev = uc->dev;
 710         struct fw_config_table fw_cfg;
 711         u32 cur_version, new_version;
 712         bool is_later = false;
 713
 714         if (request_firmware(&fw, fw_name, dev) != 0) {
 715                 dev_err(dev, "error: Failed to open cyacd file %s\n", fw_name);
 716                 return false;
 717         }
 718
 719         /*
 720          * check if signed fw
 721          * last part of fw image is fw cfg table and signature
 722          */
 723         if (fw->size < sizeof(fw_cfg) + FW_CFG_TABLE_SIG_SIZE)
 724                 goto out_release_firmware;
 725
 726         memcpy((uint8_t *)&fw_cfg, fw->data + fw->size -
 727                sizeof(fw_cfg) - FW_CFG_TABLE_SIG_SIZE, sizeof(fw_cfg));
 728
 729         if (fw_cfg.identity != ('F' | 'W' << 8 | 'C' << 16 | 'T' << 24)) {
 730                 dev_info(dev, "not a signed image\n");
 731                 goto out_release_firmware;
 732         }
 733
 734         /* compare input version with FWCT version */
 735         cur_version = le16_to_cpu(app->build) | app->patch << 16 |
 736                         app->ver << 24;
 737
 738         new_version = le16_to_cpu(fw_cfg.app.build) | fw_cfg.app.patch << 16 |
 739                         fw_cfg.app.ver << 24;
 740
 741         if (!ccg_check_vendor_version(uc, app, &fw_cfg))
 742                 goto out_release_firmware;
 743
 744         if (new_version > cur_version)
 745                 is_later = true;
 746
 747 out_release_firmware:
 748         release_firmware(fw);
 749         return is_later;
 750 }
 751
 752 static int ccg_fw_update_needed(struct ucsi_ccg *uc,
 753                                 enum enum_flash_mode *mode)
 754 {
 755         struct device *dev = uc->dev;
 756         int err;
 757         struct version_info version[3];
 758
 759         err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info),
 760                        sizeof(uc->info));
 761         if (err) {
 762                 dev_err(dev, "read device mode failed\n");
 763                 return err;
 764         }
 765
 766         err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)version,
 767                        sizeof(version));
 768         if (err) {
 769                 dev_err(dev, "read device mode failed\n");
 770                 return err;
 771         }
 772
 773         if (memcmp(&version[FW1], "\0\0\0\0\0\0\0\0",
 774                    sizeof(struct version_info)) == 0) {
 775                 dev_info(dev, "secondary fw is not flashed\n");
 776                 *mode = SECONDARY_BL;
 777         } else if (le16_to_cpu(version[FW1].base.build) <
 778                 secondary_fw_min_ver) {
 779                 dev_info(dev, "secondary fw version is too low (< %d)\n",
 780                          secondary_fw_min_ver);
 781                 *mode = SECONDARY;
 782         } else if (memcmp(&version[FW2], "\0\0\0\0\0\0\0\0",
 783                    sizeof(struct version_info)) == 0) {
 784                 dev_info(dev, "primary fw is not flashed\n");
 785                 *mode = PRIMARY;
 786         } else if (ccg_check_fw_version(uc, ccg_fw_names[PRIMARY],
 787                    &version[FW2].app)) {
 788                 dev_info(dev, "found primary fw with later version\n");
 789                 *mode = PRIMARY;
 790         } else {
 791                 dev_info(dev, "secondary and primary fw are the latest\n");
 792                 *mode = FLASH_NOT_NEEDED;
 793         }
 794         return 0;
 795 }
 796
 797 static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode)
 798 {
 799         struct device *dev = uc->dev;
 800         const struct firmware *fw = NULL;
 801         const char *p, *s;
 802         const char *eof;
 803         int err, row, len, line_sz, line_cnt = 0;
 804         unsigned long start_time = jiffies;
 805         struct fw_config_table  fw_cfg;
 806         u8 fw_cfg_sig[FW_CFG_TABLE_SIG_SIZE];
 807         u8 *wr_buf;
 808
 809         err = request_firmware(&fw, ccg_fw_names[mode], dev);
 810         if (err) {
 811                 dev_err(dev, "request %s failed err=%d\n",
 812                         ccg_fw_names[mode], err);
 813                 return err;
 814         }
 815
 816         if (((uc->info.mode & CCG_DEVINFO_FWMODE_MASK) >>
 817                         CCG_DEVINFO_FWMODE_SHIFT) == FW2) {
 818                 err = ccg_cmd_port_control(uc, false);
 819                 if (err < 0)
 820                         goto release_fw;
 821                 err = ccg_cmd_jump_boot_mode(uc, 0);
 822                 if (err < 0)
 823                         goto release_fw;
 824         }
 825
 826         eof = fw->data + fw->size;
 827
 828         /*
 829          * check if signed fw
 830          * last part of fw image is fw cfg table and signature
 831          */
 832         if (fw->size < sizeof(fw_cfg) + sizeof(fw_cfg_sig))
 833                 goto not_signed_fw;
 834
 835         memcpy((uint8_t *)&fw_cfg, fw->data + fw->size -
 836                sizeof(fw_cfg) - sizeof(fw_cfg_sig), sizeof(fw_cfg));
 837
 838         if (fw_cfg.identity != ('F' | ('W' << 8) | ('C' << 16) | ('T' << 24))) {
 839                 dev_info(dev, "not a signed image\n");
 840                 goto not_signed_fw;
 841         }
 842         eof = fw->data + fw->size - sizeof(fw_cfg) - sizeof(fw_cfg_sig);
 843
 844         memcpy((uint8_t *)&fw_cfg_sig,
 845                fw->data + fw->size - sizeof(fw_cfg_sig), sizeof(fw_cfg_sig));
 846
 847         /* flash fw config table and signature first */
 848         err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg,
 849                                       FLASH_FWCT1_WR_CMD);
 850         if (err)
 851                 goto release_fw;
 852
 853         err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg + CCG4_ROW_SIZE,
 854                                       FLASH_FWCT2_WR_CMD);
 855         if (err)
 856                 goto release_fw;
 857
 858         err = ccg_cmd_write_flash_row(uc, 0, &fw_cfg_sig,
 859                                       FLASH_FWCT_SIG_WR_CMD);
 860         if (err)
 861                 goto release_fw;
 862
 863 not_signed_fw:
 864         wr_buf = kzalloc(CCG4_ROW_SIZE + 4, GFP_KERNEL);
 865         if (!wr_buf) {
 866                 err = -ENOMEM;
 867                 goto release_fw;
 868         }
 869
 870         err = ccg_cmd_enter_flashing(uc);
 871         if (err)
 872                 goto release_mem;
 873
 874         /*****************************************************************
 875          * CCG firmware image (.cyacd) file line format
 876          *
 877          * :00rrrrllll[dd....]cc/r/n
 878          *
 879          * :00   header
 880          * rrrr is row number to flash                          (4 char)
 881          * llll is data len to flash                            (4 char)
 882          * dd   is a data field represents one byte of data     (512 char)
 883          * cc   is checksum                                     (2 char)
 884          * \r\n newline
 885          *
 886          * Total length: 3 + 4 + 4 + 512 + 2 + 2 = 527
 887          *
 888          *****************************************************************/
 889
 890         p = strnchr(fw->data, fw->size, ':');
 891         while (p < eof) {
 892                 s = strnchr(p + 1, eof - p - 1, ':');
 893
 894                 if (!s)
 895                         s = eof;
 896
 897                 line_sz = s - p;
 898
 899                 if (line_sz != CYACD_LINE_SIZE) {
 900                         dev_err(dev, "Bad FW format line_sz=%d\n", line_sz);
 901                         err =  -EINVAL;
 902                         goto release_mem;
 903                 }
 904
 905                 if (hex2bin(wr_buf, p + 3, CCG4_ROW_SIZE + 4)) {
 906                         err =  -EINVAL;
 907                         goto release_mem;
 908                 }
 909
 910                 row = get_unaligned_be16(wr_buf);
 911                 len = get_unaligned_be16(&wr_buf[2]);
 912
 913                 if (len != CCG4_ROW_SIZE) {
 914                         err =  -EINVAL;
 915                         goto release_mem;
 916                 }
 917
 918                 err = ccg_cmd_write_flash_row(uc, row, wr_buf + 4,
 919                                               FLASH_WR_CMD);
 920                 if (err)
 921                         goto release_mem;
 922
 923                 line_cnt++;
 924                 p = s;
 925         }
 926
 927         dev_info(dev, "total %d row flashed. time: %dms\n",
 928                  line_cnt, jiffies_to_msecs(jiffies - start_time));
 929
 930         err = ccg_cmd_validate_fw(uc, (mode == PRIMARY) ? FW2 :  FW1);
 931         if (err)
 932                 dev_err(dev, "%s validation failed err=%d\n",
 933                         (mode == PRIMARY) ? "FW2" :  "FW1", err);
 934         else
 935                 dev_info(dev, "%s validated\n",
 936                          (mode == PRIMARY) ? "FW2" :  "FW1");
 937
 938         err = ccg_cmd_port_control(uc, false);
 939         if (err < 0)
 940                 goto release_mem;
 941
 942         err = ccg_cmd_reset(uc);
 943         if (err < 0)
 944                 goto release_mem;
 945
 946         err = ccg_cmd_port_control(uc, true);
 947         if (err < 0)
 948                 goto release_mem;
 949
 950 release_mem:
 951         kfree(wr_buf);
 952
 953 release_fw:
 954         release_firmware(fw);
 955         return err;
 956 }
 957
 958 /*******************************************************************************
 959  * CCG4 has two copies of the firmware in addition to the bootloader.
 960  * If the device is running FW1, FW2 can be updated with the new version.
 961  * Dual firmware mode allows the CCG device to stay in a PD contract and support
 962  * USB PD and Type-C functionality while a firmware update is in progress.
 963  ******************************************************************************/
 964 static int ccg_fw_update(struct ucsi_ccg *uc, enum enum_flash_mode flash_mode)
 965 {
 966         int err;
 967
 968         while (flash_mode != FLASH_NOT_NEEDED) {
 969                 err = do_flash(uc, flash_mode);
 970                 if (err < 0)
 971                         return err;
 972                 err = ccg_fw_update_needed(uc, &flash_mode);
 973                 if (err < 0)
 974                         return err;
 975         }
 976         dev_info(uc->dev, "CCG FW update successful\n");
 977
 978         return err;
 979 }
 980
 981 static int ccg_restart(struct ucsi_ccg *uc)
 982 {
 983         struct device *dev = uc->dev;
 984         int status;
 985
 986         status = ucsi_ccg_init(uc);
 987         if (status < 0) {
 988                 dev_err(dev, "ucsi_ccg_start fail, err=%d\n", status);
 989                 return status;
 990         }
 991
 992         status = request_threaded_irq(uc->irq, NULL, ccg_irq_handler,
 993                                       IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
 994                                       dev_name(dev), uc);
 995         if (status < 0) {
 996                 dev_err(dev, "request_threaded_irq failed - %d\n", status);
 997                 return status;
 998         }
 999
1000         uc->ucsi = ucsi_register_ppm(dev, &uc->ppm);
1001         if (IS_ERR(uc->ucsi)) {
1002                 dev_err(uc->dev, "ucsi_register_ppm failed\n");
1003                 return PTR_ERR(uc->ucsi);
1004         }
1005
1006         return 0;
1007 }
1008
1009 static void ccg_update_firmware(struct work_struct *work)
1010 {
1011         struct ucsi_ccg *uc = container_of(work, struct ucsi_ccg, work);
1012         enum enum_flash_mode flash_mode;
1013         int status;
1014
1015         status = ccg_fw_update_needed(uc, &flash_mode);
1016         if (status < 0)
1017                 return;
1018
1019         if (flash_mode != FLASH_NOT_NEEDED) {
1020                 ucsi_unregister_ppm(uc->ucsi);
1021                 free_irq(uc->irq, uc);
1022
1023                 ccg_fw_update(uc, flash_mode);
1024                 ccg_restart(uc);
1025         }
1026 }
1027
1028 static ssize_t do_flash_store(struct device *dev,
1029                               struct device_attribute *attr,
1030                               const char *buf, size_t n)
1031 {
1032         struct ucsi_ccg *uc = i2c_get_clientdata(to_i2c_client(dev));
1033         bool flash;
1034
1035         if (kstrtobool(buf, &flash))
1036                 return -EINVAL;
1037
1038         if (!flash)
1039                 return n;
1040
1041         if (uc->fw_build == 0x0) {
1042                 dev_err(dev, "fail to flash FW due to missing FW build info\n");
1043                 return -EINVAL;
1044         }
1045
1046         schedule_work(&uc->work);
1047         return n;
1048 }
1049
1050 static DEVICE_ATTR_WO(do_flash);
1051
1052 static struct attribute *ucsi_ccg_sysfs_attrs[] = {
1053         &dev_attr_do_flash.attr,
1054         NULL,
1055 };
1056
1057 static struct attribute_group ucsi_ccg_attr_group = {
1058         .attrs = ucsi_ccg_sysfs_attrs,
1059 };
1060
1061 static int ucsi_ccg_probe(struct i2c_client *client,
1062                           const struct i2c_device_id *id)
1063 {
1064         struct device *dev = &client->dev;
1065         struct ucsi_ccg *uc;
1066         int status;
1067         u16 rab;
1068
1069         uc = devm_kzalloc(dev, sizeof(*uc), GFP_KERNEL);
1070         if (!uc)
1071                 return -ENOMEM;
1072
1073         uc->ppm.data = devm_kzalloc(dev, sizeof(struct ucsi_data), GFP_KERNEL);
1074         if (!uc->ppm.data)
1075                 return -ENOMEM;
1076
1077         uc->ppm.cmd = ucsi_ccg_cmd;
1078         uc->ppm.sync = ucsi_ccg_sync;
1079         uc->dev = dev;
1080         uc->client = client;
1081         mutex_init(&uc->lock);
1082         INIT_WORK(&uc->work, ccg_update_firmware);
1083
1084         /* Only fail FW flashing when FW build information is not provided */
1085         status = device_property_read_u16(dev, "ccgx,firmware-build",
1086                                           &uc->fw_build);
1087         if (status)
1088                 dev_err(uc->dev, "failed to get FW build information\n");
1089
1090         /* reset ccg device and initialize ucsi */
1091         status = ucsi_ccg_init(uc);
1092         if (status < 0) {
1093                 dev_err(uc->dev, "ucsi_ccg_init failed - %d\n", status);
1094                 return status;
1095         }
1096
1097         status = get_fw_info(uc);
1098         if (status < 0) {
1099                 dev_err(uc->dev, "get_fw_info failed - %d\n", status);
1100                 return status;
1101         }
1102
1103         uc->port_num = 1;
1104
1105         if (uc->info.mode & CCG_DEVINFO_PDPORTS_MASK)
1106                 uc->port_num++;
1107
1108         status = request_threaded_irq(client->irq, NULL, ccg_irq_handler,
1109                                       IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
1110                                       dev_name(dev), uc);
1111         if (status < 0) {
1112                 dev_err(uc->dev, "request_threaded_irq failed - %d\n", status);
1113                 return status;
1114         }
1115
1116         uc->irq = client->irq;
1117
1118         uc->ucsi = ucsi_register_ppm(dev, &uc->ppm);
1119         if (IS_ERR(uc->ucsi)) {
1120                 dev_err(uc->dev, "ucsi_register_ppm failed\n");
1121                 return PTR_ERR(uc->ucsi);
1122         }
1123
1124         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, version));
1125         status = ccg_read(uc, rab, (u8 *)(uc->ppm.data) +
1126                           offsetof(struct ucsi_data, version),
1127                           sizeof(uc->ppm.data->version));
1128         if (status < 0) {
1129                 ucsi_unregister_ppm(uc->ucsi);
1130                 return status;
1131         }
1132
1133         i2c_set_clientdata(client, uc);
1134
1135         status = sysfs_create_group(&uc->dev->kobj, &ucsi_ccg_attr_group);
1136         if (status)
1137                 dev_err(uc->dev, "cannot create sysfs group: %d\n", status);
1138
1139         return 0;
1140 }
1141
1142 static int ucsi_ccg_remove(struct i2c_client *client)
1143 {
1144         struct ucsi_ccg *uc = i2c_get_clientdata(client);
1145
1146         cancel_work_sync(&uc->work);
1147         ucsi_unregister_ppm(uc->ucsi);
1148         free_irq(uc->irq, uc);
1149         sysfs_remove_group(&uc->dev->kobj, &ucsi_ccg_attr_group);
1150
1151         return 0;
1152 }
1153
1154 static const struct i2c_device_id ucsi_ccg_device_id[] = {
1155         {"ccgx-ucsi", 0},
1156         {}
1157 };
1158 MODULE_DEVICE_TABLE(i2c, ucsi_ccg_device_id);
1159
1160 static struct i2c_driver ucsi_ccg_driver = {
1161         .driver = {
1162                 .name = "ucsi_ccg",
1163         },
1164         .probe = ucsi_ccg_probe,
1165         .remove = ucsi_ccg_remove,
1166         .id_table = ucsi_ccg_device_id,
1167 };
1168
1169 module_i2c_driver(ucsi_ccg_driver);
1170
1171 MODULE_AUTHOR("Ajay Gupta <ajayg@nvidia.com>");
1172 MODULE_DESCRIPTION("UCSI driver for Cypress CCGx Type-C controller");
1173 MODULE_LICENSE("GPL v2");