drivers/usb/typec/ucsi/ucsi_ccg.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * UCSI driver for Cypress CCGx Type-C controller
   4  *
   5  * Copyright (C) 2017-2018 NVIDIA Corporation. All rights reserved.
   6  * Author: Ajay Gupta <ajayg@nvidia.com>
   7  *
   8  * Some code borrowed from drivers/usb/typec/ucsi/ucsi_acpi.c
   9  */
  10 #include <linux/acpi.h>
  11 #include <linux/delay.h>
  12 #include <linux/firmware.h>
  13 #include <linux/i2c.h>
  14 #include <linux/module.h>
  15 #include <linux/pci.h>
  16 #include <linux/platform_device.h>
  17 #include <linux/pm.h>
  18 #include <linux/pm_runtime.h>
  19
  20 #include <asm/unaligned.h>
  21 #include "ucsi.h"
  22
  23 enum enum_fw_mode {
  24         BOOT,   /* bootloader */
  25         FW1,    /* FW partition-1 (contains secondary fw) */
  26         FW2,    /* FW partition-2 (contains primary fw) */
  27         FW_INVALID,
  28 };
  29
  30 #define CCGX_RAB_DEVICE_MODE                    0x0000
  31 #define CCGX_RAB_INTR_REG                       0x0006
  32 #define  DEV_INT                                BIT(0)
  33 #define  PORT0_INT                              BIT(1)
  34 #define  PORT1_INT                              BIT(2)
  35 #define  UCSI_READ_INT                          BIT(7)
  36 #define CCGX_RAB_JUMP_TO_BOOT                   0x0007
  37 #define  TO_BOOT                                'J'
  38 #define  TO_ALT_FW                              'A'
  39 #define CCGX_RAB_RESET_REQ                      0x0008
  40 #define  RESET_SIG                              'R'
  41 #define  CMD_RESET_I2C                          0x0
  42 #define  CMD_RESET_DEV                          0x1
  43 #define CCGX_RAB_ENTER_FLASHING                 0x000A
  44 #define  FLASH_ENTER_SIG                        'P'
  45 #define CCGX_RAB_VALIDATE_FW                    0x000B
  46 #define CCGX_RAB_FLASH_ROW_RW                   0x000C
  47 #define  FLASH_SIG                              'F'
  48 #define  FLASH_RD_CMD                           0x0
  49 #define  FLASH_WR_CMD                           0x1
  50 #define  FLASH_FWCT1_WR_CMD                     0x2
  51 #define  FLASH_FWCT2_WR_CMD                     0x3
  52 #define  FLASH_FWCT_SIG_WR_CMD                  0x4
  53 #define CCGX_RAB_READ_ALL_VER                   0x0010
  54 #define CCGX_RAB_READ_FW2_VER                   0x0020
  55 #define CCGX_RAB_UCSI_CONTROL                   0x0039
  56 #define CCGX_RAB_UCSI_CONTROL_START             BIT(0)
  57 #define CCGX_RAB_UCSI_CONTROL_STOP              BIT(1)
  58 #define CCGX_RAB_UCSI_DATA_BLOCK(offset)        (0xf000 | ((offset) & 0xff))
  59 #define REG_FLASH_RW_MEM        0x0200
  60 #define DEV_REG_IDX                             CCGX_RAB_DEVICE_MODE
  61 #define CCGX_RAB_PDPORT_ENABLE                  0x002C
  62 #define  PDPORT_1               BIT(0)
  63 #define  PDPORT_2               BIT(1)
  64 #define CCGX_RAB_RESPONSE                       0x007E
  65 #define  ASYNC_EVENT                            BIT(7)
  66
  67 /* CCGx events & async msg codes */
  68 #define RESET_COMPLETE          0x80
  69 #define EVENT_INDEX             RESET_COMPLETE
  70 #define PORT_CONNECT_DET        0x84
  71 #define PORT_DISCONNECT_DET     0x85
  72 #define ROLE_SWAP_COMPELETE     0x87
  73
  74 /* ccg firmware */
  75 #define CYACD_LINE_SIZE         527
  76 #define CCG4_ROW_SIZE           256
  77 #define FW1_METADATA_ROW        0x1FF
  78 #define FW2_METADATA_ROW        0x1FE
  79 #define FW_CFG_TABLE_SIG_SIZE   256
  80
  81 static int secondary_fw_min_ver = 41;
  82
  83 enum enum_flash_mode {
  84         SECONDARY_BL,   /* update secondary using bootloader */
  85         PRIMARY,        /* update primary using secondary */
  86         SECONDARY,      /* update secondary using primary */
  87         FLASH_NOT_NEEDED,       /* update not required */
  88         FLASH_INVALID,
  89 };
  90
  91 static const char * const ccg_fw_names[] = {
  92         "/*(DEBLOBBED)*/",
  93         "/*(DEBLOBBED)*/",
  94         "/*(DEBLOBBED)*/"
  95 };
  96
  97 struct ccg_dev_info {
  98 #define CCG_DEVINFO_FWMODE_SHIFT (0)
  99 #define CCG_DEVINFO_FWMODE_MASK (0x3 << CCG_DEVINFO_FWMODE_SHIFT)
 100 #define CCG_DEVINFO_PDPORTS_SHIFT (2)
 101 #define CCG_DEVINFO_PDPORTS_MASK (0x3 << CCG_DEVINFO_PDPORTS_SHIFT)
 102         u8 mode;
 103         u8 bl_mode;
 104         __le16 silicon_id;
 105         __le16 bl_last_row;
 106 } __packed;
 107
 108 struct version_format {
 109         __le16 build;
 110         u8 patch;
 111         u8 ver;
 112 #define CCG_VERSION_PATCH(x) ((x) << 16)
 113 #define CCG_VERSION(x)  ((x) << 24)
 114 #define CCG_VERSION_MIN_SHIFT (0)
 115 #define CCG_VERSION_MIN_MASK (0xf << CCG_VERSION_MIN_SHIFT)
 116 #define CCG_VERSION_MAJ_SHIFT (4)
 117 #define CCG_VERSION_MAJ_MASK (0xf << CCG_VERSION_MAJ_SHIFT)
 118 } __packed;
 119
 120 /*
 121  * Firmware version 3.1.10 or earlier, built for NVIDIA has known issue
 122  * of missing interrupt when a device is connected for runtime resume
 123  */
 124 #define CCG_FW_BUILD_NVIDIA     (('n' << 8) | 'v')
 125 #define CCG_OLD_FW_VERSION      (CCG_VERSION(0x31) | CCG_VERSION_PATCH(10))
 126
 127 struct version_info {
 128         struct version_format base;
 129         struct version_format app;
 130 };
 131
 132 struct fw_config_table {
 133         u32 identity;
 134         u16 table_size;
 135         u8 fwct_version;
 136         u8 is_key_change;
 137         u8 guid[16];
 138         struct version_format base;
 139         struct version_format app;
 140         u8 primary_fw_digest[32];
 141         u32 key_exp_length;
 142         u8 key_modulus[256];
 143         u8 key_exp[4];
 144 };
 145
 146 /* CCGx response codes */
 147 enum ccg_resp_code {
 148         CMD_NO_RESP             = 0x00,
 149         CMD_SUCCESS             = 0x02,
 150         FLASH_DATA_AVAILABLE    = 0x03,
 151         CMD_INVALID             = 0x05,
 152         FLASH_UPDATE_FAIL       = 0x07,
 153         INVALID_FW              = 0x08,
 154         INVALID_ARG             = 0x09,
 155         CMD_NOT_SUPPORT         = 0x0A,
 156         TRANSACTION_FAIL        = 0x0C,
 157         PD_CMD_FAIL             = 0x0D,
 158         UNDEF_ERROR             = 0x0F,
 159         INVALID_RESP            = 0x10,
 160 };
 161
 162 #define CCG_EVENT_MAX   (EVENT_INDEX + 43)
 163
 164 struct ccg_cmd {
 165         u16 reg;
 166         u32 data;
 167         int len;
 168         u32 delay; /* ms delay for cmd timeout  */
 169 };
 170
 171 struct ccg_resp {
 172         u8 code;
 173         u8 length;
 174 };
 175
 176 struct ucsi_ccg {
 177         struct device *dev;
 178         struct ucsi *ucsi;
 179         struct ucsi_ppm ppm;
 180         struct i2c_client *client;
 181         struct ccg_dev_info info;
 182         /* version info for boot, primary and secondary */
 183         struct version_info version[FW2 + 1];
 184         u32 fw_version;
 185         /* CCG HPI communication flags */
 186         unsigned long flags;
 187 #define RESET_PENDING   0
 188 #define DEV_CMD_PENDING 1
 189         struct ccg_resp dev_resp;
 190         u8 cmd_resp;
 191         int port_num;
 192         int irq;
 193         struct work_struct work;
 194         struct mutex lock; /* to sync between user and driver thread */
 195
 196         /* fw build with vendor information */
 197         u16 fw_build;
 198         struct work_struct pm_work;
 199 };
 200
 201 static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 202 {
 203         struct i2c_client *client = uc->client;
 204         const struct i2c_adapter_quirks *quirks = client->adapter->quirks;
 205         unsigned char buf[2];
 206         struct i2c_msg msgs[] = {
 207                 {
 208                         .addr   = client->addr,
 209                         .flags  = 0x0,
 210                         .len    = sizeof(buf),
 211                         .buf    = buf,
 212                 },
 213                 {
 214                         .addr   = client->addr,
 215                         .flags  = I2C_M_RD,
 216                         .buf    = data,
 217                 },
 218         };
 219         u32 rlen, rem_len = len, max_read_len = len;
 220         int status;
 221
 222         /* check any max_read_len limitation on i2c adapter */
 223         if (quirks && quirks->max_read_len)
 224                 max_read_len = quirks->max_read_len;
 225
 226         pm_runtime_get_sync(uc->dev);
 227         while (rem_len > 0) {
 228                 msgs[1].buf = &data[len - rem_len];
 229                 rlen = min_t(u16, rem_len, max_read_len);
 230                 msgs[1].len = rlen;
 231                 put_unaligned_le16(rab, buf);
 232                 status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
 233                 if (status < 0) {
 234                         dev_err(uc->dev, "i2c_transfer failed %d\n", status);
 235                         pm_runtime_put_sync(uc->dev);
 236                         return status;
 237                 }
 238                 rab += rlen;
 239                 rem_len -= rlen;
 240         }
 241
 242         pm_runtime_put_sync(uc->dev);
 243         return 0;
 244 }
 245
 246 static int ccg_write(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len)
 247 {
 248         struct i2c_client *client = uc->client;
 249         unsigned char *buf;
 250         struct i2c_msg msgs[] = {
 251                 {
 252                         .addr   = client->addr,
 253                         .flags  = 0x0,
 254                 }
 255         };
 256         int status;
 257
 258         buf = kzalloc(len + sizeof(rab), GFP_KERNEL);
 259         if (!buf)
 260                 return -ENOMEM;
 261
 262         put_unaligned_le16(rab, buf);
 263         memcpy(buf + sizeof(rab), data, len);
 264
 265         msgs[0].len = len + sizeof(rab);
 266         msgs[0].buf = buf;
 267
 268         pm_runtime_get_sync(uc->dev);
 269         status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs));
 270         if (status < 0) {
 271                 dev_err(uc->dev, "i2c_transfer failed %d\n", status);
 272                 pm_runtime_put_sync(uc->dev);
 273                 kfree(buf);
 274                 return status;
 275         }
 276
 277         pm_runtime_put_sync(uc->dev);
 278         kfree(buf);
 279         return 0;
 280 }
 281
 282 static int ucsi_ccg_init(struct ucsi_ccg *uc)
 283 {
 284         unsigned int count = 10;
 285         u8 data;
 286         int status;
 287
 288         data = CCGX_RAB_UCSI_CONTROL_STOP;
 289         status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
 290         if (status < 0)
 291                 return status;
 292
 293         data = CCGX_RAB_UCSI_CONTROL_START;
 294         status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data));
 295         if (status < 0)
 296                 return status;
 297
 298         /*
 299          * Flush CCGx RESPONSE queue by acking interrupts. Above ucsi control
 300          * register write will push response which must be cleared.
 301          */
 302         do {
 303                 status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 304                 if (status < 0)
 305                         return status;
 306
 307                 if (!data)
 308                         return 0;
 309
 310                 status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 311                 if (status < 0)
 312                         return status;
 313
 314                 usleep_range(10000, 11000);
 315         } while (--count);
 316
 317         return -ETIMEDOUT;
 318 }
 319
 320 static int ucsi_ccg_send_data(struct ucsi_ccg *uc)
 321 {
 322         u8 *ppm = (u8 *)uc->ppm.data;
 323         int status;
 324         u16 rab;
 325
 326         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_out));
 327         status = ccg_write(uc, rab, ppm +
 328                            offsetof(struct ucsi_data, message_out),
 329                            sizeof(uc->ppm.data->message_out));
 330         if (status < 0)
 331                 return status;
 332
 333         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, ctrl));
 334         return ccg_write(uc, rab, ppm + offsetof(struct ucsi_data, ctrl),
 335                          sizeof(uc->ppm.data->ctrl));
 336 }
 337
 338 static int ucsi_ccg_recv_data(struct ucsi_ccg *uc)
 339 {
 340         u8 *ppm = (u8 *)uc->ppm.data;
 341         int status;
 342         u16 rab;
 343
 344         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, cci));
 345         status = ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, cci),
 346                           sizeof(uc->ppm.data->cci));
 347         if (status < 0)
 348                 return status;
 349
 350         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_in));
 351         return ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, message_in),
 352                         sizeof(uc->ppm.data->message_in));
 353 }
 354
 355 static int ucsi_ccg_ack_interrupt(struct ucsi_ccg *uc)
 356 {
 357         int status;
 358         unsigned char data;
 359
 360         status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 361         if (status < 0)
 362                 return status;
 363
 364         return ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data));
 365 }
 366
 367 static int ucsi_ccg_sync(struct ucsi_ppm *ppm)
 368 {
 369         struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
 370         int status;
 371
 372         status = ucsi_ccg_recv_data(uc);
 373         if (status < 0)
 374                 return status;
 375
 376         /* ack interrupt to allow next command to run */
 377         return ucsi_ccg_ack_interrupt(uc);
 378 }
 379
 380 static int ucsi_ccg_cmd(struct ucsi_ppm *ppm, struct ucsi_control *ctrl)
 381 {
 382         struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm);
 383
 384         ppm->data->ctrl.raw_cmd = ctrl->raw_cmd;
 385         return ucsi_ccg_send_data(uc);
 386 }
 387
 388 static irqreturn_t ccg_irq_handler(int irq, void *data)
 389 {
 390         struct ucsi_ccg *uc = data;
 391
 392         ucsi_notify(uc->ucsi);
 393
 394         return IRQ_HANDLED;
 395 }
 396
 397 static void ccg_pm_workaround_work(struct work_struct *pm_work)
 398 {
 399         struct ucsi_ccg *uc = container_of(pm_work, struct ucsi_ccg, pm_work);
 400
 401         ucsi_notify(uc->ucsi);
 402 }
 403
 404 static int get_fw_info(struct ucsi_ccg *uc)
 405 {
 406         int err;
 407
 408         err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)(&uc->version),
 409                        sizeof(uc->version));
 410         if (err < 0)
 411                 return err;
 412
 413         uc->fw_version = CCG_VERSION(uc->version[FW2].app.ver) |
 414                         CCG_VERSION_PATCH(uc->version[FW2].app.patch);
 415
 416         err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info),
 417                        sizeof(uc->info));
 418         if (err < 0)
 419                 return err;
 420
 421         return 0;
 422 }
 423
 424 static inline bool invalid_async_evt(int code)
 425 {
 426         return (code >= CCG_EVENT_MAX) || (code < EVENT_INDEX);
 427 }
 428
 429 static void ccg_process_response(struct ucsi_ccg *uc)
 430 {
 431         struct device *dev = uc->dev;
 432
 433         if (uc->dev_resp.code & ASYNC_EVENT) {
 434                 if (uc->dev_resp.code == RESET_COMPLETE) {
 435                         if (test_bit(RESET_PENDING, &uc->flags))
 436                                 uc->cmd_resp = uc->dev_resp.code;
 437                         get_fw_info(uc);
 438                 }
 439                 if (invalid_async_evt(uc->dev_resp.code))
 440                         dev_err(dev, "invalid async evt %d\n",
 441                                 uc->dev_resp.code);
 442         } else {
 443                 if (test_bit(DEV_CMD_PENDING, &uc->flags)) {
 444                         uc->cmd_resp = uc->dev_resp.code;
 445                         clear_bit(DEV_CMD_PENDING, &uc->flags);
 446                 } else {
 447                         dev_err(dev, "dev resp 0x%04x but no cmd pending\n",
 448                                 uc->dev_resp.code);
 449                 }
 450         }
 451 }
 452
 453 static int ccg_read_response(struct ucsi_ccg *uc)
 454 {
 455         unsigned long target = jiffies + msecs_to_jiffies(1000);
 456         struct device *dev = uc->dev;
 457         u8 intval;
 458         int status;
 459
 460         /* wait for interrupt status to get updated */
 461         do {
 462                 status = ccg_read(uc, CCGX_RAB_INTR_REG, &intval,
 463                                   sizeof(intval));
 464                 if (status < 0)
 465                         return status;
 466
 467                 if (intval & DEV_INT)
 468                         break;
 469                 usleep_range(500, 600);
 470         } while (time_is_after_jiffies(target));
 471
 472         if (time_is_before_jiffies(target)) {
 473                 dev_err(dev, "response timeout error\n");
 474                 return -ETIME;
 475         }
 476
 477         status = ccg_read(uc, CCGX_RAB_RESPONSE, (u8 *)&uc->dev_resp,
 478                           sizeof(uc->dev_resp));
 479         if (status < 0)
 480                 return status;
 481
 482         status = ccg_write(uc, CCGX_RAB_INTR_REG, &intval, sizeof(intval));
 483         if (status < 0)
 484                 return status;
 485
 486         return 0;
 487 }
 488
 489 /* Caller must hold uc->lock */
 490 static int ccg_send_command(struct ucsi_ccg *uc, struct ccg_cmd *cmd)
 491 {
 492         struct device *dev = uc->dev;
 493         int ret;
 494
 495         switch (cmd->reg & 0xF000) {
 496         case DEV_REG_IDX:
 497                 set_bit(DEV_CMD_PENDING, &uc->flags);
 498                 break;
 499         default:
 500                 dev_err(dev, "invalid cmd register\n");
 501                 break;
 502         }
 503
 504         ret = ccg_write(uc, cmd->reg, (u8 *)&cmd->data, cmd->len);
 505         if (ret < 0)
 506                 return ret;
 507
 508         msleep(cmd->delay);
 509
 510         ret = ccg_read_response(uc);
 511         if (ret < 0) {
 512                 dev_err(dev, "response read error\n");
 513                 switch (cmd->reg & 0xF000) {
 514                 case DEV_REG_IDX:
 515                         clear_bit(DEV_CMD_PENDING, &uc->flags);
 516                         break;
 517                 default:
 518                         dev_err(dev, "invalid cmd register\n");
 519                         break;
 520                 }
 521                 return -EIO;
 522         }
 523         ccg_process_response(uc);
 524
 525         return uc->cmd_resp;
 526 }
 527
 528 static int ccg_cmd_enter_flashing(struct ucsi_ccg *uc)
 529 {
 530         struct ccg_cmd cmd;
 531         int ret;
 532
 533         cmd.reg = CCGX_RAB_ENTER_FLASHING;
 534         cmd.data = FLASH_ENTER_SIG;
 535         cmd.len = 1;
 536         cmd.delay = 50;
 537
 538         mutex_lock(&uc->lock);
 539
 540         ret = ccg_send_command(uc, &cmd);
 541
 542         mutex_unlock(&uc->lock);
 543
 544         if (ret != CMD_SUCCESS) {
 545                 dev_err(uc->dev, "enter flashing failed ret=%d\n", ret);
 546                 return ret;
 547         }
 548
 549         return 0;
 550 }
 551
 552 static int ccg_cmd_reset(struct ucsi_ccg *uc)
 553 {
 554         struct ccg_cmd cmd;
 555         u8 *p;
 556         int ret;
 557
 558         p = (u8 *)&cmd.data;
 559         cmd.reg = CCGX_RAB_RESET_REQ;
 560         p[0] = RESET_SIG;
 561         p[1] = CMD_RESET_DEV;
 562         cmd.len = 2;
 563         cmd.delay = 5000;
 564
 565         mutex_lock(&uc->lock);
 566
 567         set_bit(RESET_PENDING, &uc->flags);
 568
 569         ret = ccg_send_command(uc, &cmd);
 570         if (ret != RESET_COMPLETE)
 571                 goto err_clear_flag;
 572
 573         ret = 0;
 574
 575 err_clear_flag:
 576         clear_bit(RESET_PENDING, &uc->flags);
 577
 578         mutex_unlock(&uc->lock);
 579
 580         return ret;
 581 }
 582
 583 static int ccg_cmd_port_control(struct ucsi_ccg *uc, bool enable)
 584 {
 585         struct ccg_cmd cmd;
 586         int ret;
 587
 588         cmd.reg = CCGX_RAB_PDPORT_ENABLE;
 589         if (enable)
 590                 cmd.data = (uc->port_num == 1) ?
 591                             PDPORT_1 : (PDPORT_1 | PDPORT_2);
 592         else
 593                 cmd.data = 0x0;
 594         cmd.len = 1;
 595         cmd.delay = 10;
 596
 597         mutex_lock(&uc->lock);
 598
 599         ret = ccg_send_command(uc, &cmd);
 600
 601         mutex_unlock(&uc->lock);
 602
 603         if (ret != CMD_SUCCESS) {
 604                 dev_err(uc->dev, "port control failed ret=%d\n", ret);
 605                 return ret;
 606         }
 607         return 0;
 608 }
 609
 610 static int ccg_cmd_jump_boot_mode(struct ucsi_ccg *uc, int bl_mode)
 611 {
 612         struct ccg_cmd cmd;
 613         int ret;
 614
 615         cmd.reg = CCGX_RAB_JUMP_TO_BOOT;
 616
 617         if (bl_mode)
 618                 cmd.data = TO_BOOT;
 619         else
 620                 cmd.data = TO_ALT_FW;
 621
 622         cmd.len = 1;
 623         cmd.delay = 100;
 624
 625         mutex_lock(&uc->lock);
 626
 627         set_bit(RESET_PENDING, &uc->flags);
 628
 629         ret = ccg_send_command(uc, &cmd);
 630         if (ret != RESET_COMPLETE)
 631                 goto err_clear_flag;
 632
 633         ret = 0;
 634
 635 err_clear_flag:
 636         clear_bit(RESET_PENDING, &uc->flags);
 637
 638         mutex_unlock(&uc->lock);
 639
 640         return ret;
 641 }
 642
 643 static int
 644 ccg_cmd_write_flash_row(struct ucsi_ccg *uc, u16 row,
 645                         const void *data, u8 fcmd)
 646 {
 647         struct i2c_client *client = uc->client;
 648         struct ccg_cmd cmd;
 649         u8 buf[CCG4_ROW_SIZE + 2];
 650         u8 *p;
 651         int ret;
 652
 653         /* Copy the data into the flash read/write memory. */
 654         put_unaligned_le16(REG_FLASH_RW_MEM, buf);
 655
 656         memcpy(buf + 2, data, CCG4_ROW_SIZE);
 657
 658         mutex_lock(&uc->lock);
 659
 660         ret = i2c_master_send(client, buf, CCG4_ROW_SIZE + 2);
 661         if (ret != CCG4_ROW_SIZE + 2) {
 662                 dev_err(uc->dev, "REG_FLASH_RW_MEM write fail %d\n", ret);
 663                 mutex_unlock(&uc->lock);
 664                 return ret < 0 ? ret : -EIO;
 665         }
 666
 667         /* Use the FLASH_ROW_READ_WRITE register to trigger */
 668         /* writing of data to the desired flash row */
 669         p = (u8 *)&cmd.data;
 670         cmd.reg = CCGX_RAB_FLASH_ROW_RW;
 671         p[0] = FLASH_SIG;
 672         p[1] = fcmd;
 673         put_unaligned_le16(row, &p[2]);
 674         cmd.len = 4;
 675         cmd.delay = 50;
 676         if (fcmd == FLASH_FWCT_SIG_WR_CMD)
 677                 cmd.delay += 400;
 678         if (row == 510)
 679                 cmd.delay += 220;
 680         ret = ccg_send_command(uc, &cmd);
 681
 682         mutex_unlock(&uc->lock);
 683
 684         if (ret != CMD_SUCCESS) {
 685                 dev_err(uc->dev, "write flash row failed ret=%d\n", ret);
 686                 return ret;
 687         }
 688
 689         return 0;
 690 }
 691
 692 static int ccg_cmd_validate_fw(struct ucsi_ccg *uc, unsigned int fwid)
 693 {
 694         struct ccg_cmd cmd;
 695         int ret;
 696
 697         cmd.reg = CCGX_RAB_VALIDATE_FW;
 698         cmd.data = fwid;
 699         cmd.len = 1;
 700         cmd.delay = 500;
 701
 702         mutex_lock(&uc->lock);
 703
 704         ret = ccg_send_command(uc, &cmd);
 705
 706         mutex_unlock(&uc->lock);
 707
 708         if (ret != CMD_SUCCESS)
 709                 return ret;
 710
 711         return 0;
 712 }
 713
 714 static bool ccg_check_vendor_version(struct ucsi_ccg *uc,
 715                                      struct version_format *app,
 716                                      struct fw_config_table *fw_cfg)
 717 {
 718         struct device *dev = uc->dev;
 719
 720         /* Check if the fw build is for supported vendors */
 721         if (le16_to_cpu(app->build) != uc->fw_build) {
 722                 dev_info(dev, "current fw is not from supported vendor\n");
 723                 return false;
 724         }
 725
 726         /* Check if the new fw build is for supported vendors */
 727         if (le16_to_cpu(fw_cfg->app.build) != uc->fw_build) {
 728                 dev_info(dev, "new fw is not from supported vendor\n");
 729                 return false;
 730         }
 731         return true;
 732 }
 733
 734 static bool ccg_check_fw_version(struct ucsi_ccg *uc, const char *fw_name,
 735                                  struct version_format *app)
 736 {
 737         const struct firmware *fw = NULL;
 738         struct device *dev = uc->dev;
 739         struct fw_config_table fw_cfg;
 740         u32 cur_version, new_version;
 741         bool is_later = false;
 742
 743         if (reject_firmware(&fw, fw_name, dev) != 0) {
 744                 dev_err(dev, "error: Failed to open cyacd file %s\n", fw_name);
 745                 return false;
 746         }
 747
 748         /*
 749          * check if signed fw
 750          * last part of fw image is fw cfg table and signature
 751          */
 752         if (fw->size < sizeof(fw_cfg) + FW_CFG_TABLE_SIG_SIZE)
 753                 goto out_release_firmware;
 754
 755         memcpy((uint8_t *)&fw_cfg, fw->data + fw->size -
 756                sizeof(fw_cfg) - FW_CFG_TABLE_SIG_SIZE, sizeof(fw_cfg));
 757
 758         if (fw_cfg.identity != ('F' | 'W' << 8 | 'C' << 16 | 'T' << 24)) {
 759                 dev_info(dev, "not a signed image\n");
 760                 goto out_release_firmware;
 761         }
 762
 763         /* compare input version with FWCT version */
 764         cur_version = le16_to_cpu(app->build) | CCG_VERSION_PATCH(app->patch) |
 765                         CCG_VERSION(app->ver);
 766
 767         new_version = le16_to_cpu(fw_cfg.app.build) |
 768                         CCG_VERSION_PATCH(fw_cfg.app.patch) |
 769                         CCG_VERSION(fw_cfg.app.ver);
 770
 771         if (!ccg_check_vendor_version(uc, app, &fw_cfg))
 772                 goto out_release_firmware;
 773
 774         if (new_version > cur_version)
 775                 is_later = true;
 776
 777 out_release_firmware:
 778         release_firmware(fw);
 779         return is_later;
 780 }
 781
 782 static int ccg_fw_update_needed(struct ucsi_ccg *uc,
 783                                 enum enum_flash_mode *mode)
 784 {
 785         struct device *dev = uc->dev;
 786         int err;
 787         struct version_info version[3];
 788
 789         err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info),
 790                        sizeof(uc->info));
 791         if (err) {
 792                 dev_err(dev, "read device mode failed\n");
 793                 return err;
 794         }
 795
 796         err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)version,
 797                        sizeof(version));
 798         if (err) {
 799                 dev_err(dev, "read device mode failed\n");
 800                 return err;
 801         }
 802
 803         if (memcmp(&version[FW1], "\0\0\0\0\0\0\0\0",
 804                    sizeof(struct version_info)) == 0) {
 805                 dev_info(dev, "secondary fw is not flashed\n");
 806                 *mode = SECONDARY_BL;
 807         } else if (le16_to_cpu(version[FW1].base.build) <
 808                 secondary_fw_min_ver) {
 809                 dev_info(dev, "secondary fw version is too low (< %d)\n",
 810                          secondary_fw_min_ver);
 811                 *mode = SECONDARY;
 812         } else if (memcmp(&version[FW2], "\0\0\0\0\0\0\0\0",
 813                    sizeof(struct version_info)) == 0) {
 814                 dev_info(dev, "primary fw is not flashed\n");
 815                 *mode = PRIMARY;
 816         } else if (ccg_check_fw_version(uc, ccg_fw_names[PRIMARY],
 817                    &version[FW2].app)) {
 818                 dev_info(dev, "found primary fw with later version\n");
 819                 *mode = PRIMARY;
 820         } else {
 821                 dev_info(dev, "secondary and primary fw are the latest\n");
 822                 *mode = FLASH_NOT_NEEDED;
 823         }
 824         return 0;
 825 }
 826
 827 static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode)
 828 {
 829         struct device *dev = uc->dev;
 830         const struct firmware *fw = NULL;
 831         const char *p, *s;
 832         const char *eof;
 833         int err, row, len, line_sz, line_cnt = 0;
 834         unsigned long start_time = jiffies;
 835         struct fw_config_table  fw_cfg;
 836         u8 fw_cfg_sig[FW_CFG_TABLE_SIG_SIZE];
 837         u8 *wr_buf;
 838
 839         err = reject_firmware(&fw, ccg_fw_names[mode], dev);
 840         if (err) {
 841                 dev_err(dev, "request %s failed err=%d\n",
 842                         ccg_fw_names[mode], err);
 843                 return err;
 844         }
 845
 846         if (((uc->info.mode & CCG_DEVINFO_FWMODE_MASK) >>
 847                         CCG_DEVINFO_FWMODE_SHIFT) == FW2) {
 848                 err = ccg_cmd_port_control(uc, false);
 849                 if (err < 0)
 850                         goto release_fw;
 851                 err = ccg_cmd_jump_boot_mode(uc, 0);
 852                 if (err < 0)
 853                         goto release_fw;
 854         }
 855
 856         eof = fw->data + fw->size;
 857
 858         /*
 859          * check if signed fw
 860          * last part of fw image is fw cfg table and signature
 861          */
 862         if (fw->size < sizeof(fw_cfg) + sizeof(fw_cfg_sig))
 863                 goto not_signed_fw;
 864
 865         memcpy((uint8_t *)&fw_cfg, fw->data + fw->size -
 866                sizeof(fw_cfg) - sizeof(fw_cfg_sig), sizeof(fw_cfg));
 867
 868         if (fw_cfg.identity != ('F' | ('W' << 8) | ('C' << 16) | ('T' << 24))) {
 869                 dev_info(dev, "not a signed image\n");
 870                 goto not_signed_fw;
 871         }
 872         eof = fw->data + fw->size - sizeof(fw_cfg) - sizeof(fw_cfg_sig);
 873
 874         memcpy((uint8_t *)&fw_cfg_sig,
 875                fw->data + fw->size - sizeof(fw_cfg_sig), sizeof(fw_cfg_sig));
 876
 877         /* flash fw config table and signature first */
 878         err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg,
 879                                       FLASH_FWCT1_WR_CMD);
 880         if (err)
 881                 goto release_fw;
 882
 883         err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg + CCG4_ROW_SIZE,
 884                                       FLASH_FWCT2_WR_CMD);
 885         if (err)
 886                 goto release_fw;
 887
 888         err = ccg_cmd_write_flash_row(uc, 0, &fw_cfg_sig,
 889                                       FLASH_FWCT_SIG_WR_CMD);
 890         if (err)
 891                 goto release_fw;
 892
 893 not_signed_fw:
 894         wr_buf = kzalloc(CCG4_ROW_SIZE + 4, GFP_KERNEL);
 895         if (!wr_buf) {
 896                 err = -ENOMEM;
 897                 goto release_fw;
 898         }
 899
 900         err = ccg_cmd_enter_flashing(uc);
 901         if (err)
 902                 goto release_mem;
 903
 904         /*****************************************************************
 905          * CCG firmware image (.cyacd) file line format
 906          *
 907          * :00rrrrllll[dd....]cc/r/n
 908          *
 909          * :00   header
 910          * rrrr is row number to flash                          (4 char)
 911          * llll is data len to flash                            (4 char)
 912          * dd   is a data field represents one byte of data     (512 char)
 913          * cc   is checksum                                     (2 char)
 914          * \r\n newline
 915          *
 916          * Total length: 3 + 4 + 4 + 512 + 2 + 2 = 527
 917          *
 918          *****************************************************************/
 919
 920         p = strnchr(fw->data, fw->size, ':');
 921         while (p < eof) {
 922                 s = strnchr(p + 1, eof - p - 1, ':');
 923
 924                 if (!s)
 925                         s = eof;
 926
 927                 line_sz = s - p;
 928
 929                 if (line_sz != CYACD_LINE_SIZE) {
 930                         dev_err(dev, "Bad FW format line_sz=%d\n", line_sz);
 931                         err =  -EINVAL;
 932                         goto release_mem;
 933                 }
 934
 935                 if (hex2bin(wr_buf, p + 3, CCG4_ROW_SIZE + 4)) {
 936                         err =  -EINVAL;
 937                         goto release_mem;
 938                 }
 939
 940                 row = get_unaligned_be16(wr_buf);
 941                 len = get_unaligned_be16(&wr_buf[2]);
 942
 943                 if (len != CCG4_ROW_SIZE) {
 944                         err =  -EINVAL;
 945                         goto release_mem;
 946                 }
 947
 948                 err = ccg_cmd_write_flash_row(uc, row, wr_buf + 4,
 949                                               FLASH_WR_CMD);
 950                 if (err)
 951                         goto release_mem;
 952
 953                 line_cnt++;
 954                 p = s;
 955         }
 956
 957         dev_info(dev, "total %d row flashed. time: %dms\n",
 958                  line_cnt, jiffies_to_msecs(jiffies - start_time));
 959
 960         err = ccg_cmd_validate_fw(uc, (mode == PRIMARY) ? FW2 :  FW1);
 961         if (err)
 962                 dev_err(dev, "%s validation failed err=%d\n",
 963                         (mode == PRIMARY) ? "FW2" :  "FW1", err);
 964         else
 965                 dev_info(dev, "%s validated\n",
 966                          (mode == PRIMARY) ? "FW2" :  "FW1");
 967
 968         err = ccg_cmd_port_control(uc, false);
 969         if (err < 0)
 970                 goto release_mem;
 971
 972         err = ccg_cmd_reset(uc);
 973         if (err < 0)
 974                 goto release_mem;
 975
 976         err = ccg_cmd_port_control(uc, true);
 977         if (err < 0)
 978                 goto release_mem;
 979
 980 release_mem:
 981         kfree(wr_buf);
 982
 983 release_fw:
 984         release_firmware(fw);
 985         return err;
 986 }
 987
 988 /*******************************************************************************
 989  * CCG4 has two copies of the firmware in addition to the bootloader.
 990  * If the device is running FW1, FW2 can be updated with the new version.
 991  * Dual firmware mode allows the CCG device to stay in a PD contract and support
 992  * USB PD and Type-C functionality while a firmware update is in progress.
 993  ******************************************************************************/
 994 static int ccg_fw_update(struct ucsi_ccg *uc, enum enum_flash_mode flash_mode)
 995 {
 996         int err = 0;
 997
 998         while (flash_mode != FLASH_NOT_NEEDED) {
 999                 err = do_flash(uc, flash_mode);
1000                 if (err < 0)
1001                         return err;
1002                 err = ccg_fw_update_needed(uc, &flash_mode);
1003                 if (err < 0)
1004                         return err;
1005         }
1006         dev_info(uc->dev, "CCG FW update successful\n");
1007
1008         return err;
1009 }
1010
1011 static int ccg_restart(struct ucsi_ccg *uc)
1012 {
1013         struct device *dev = uc->dev;
1014         int status;
1015
1016         status = ucsi_ccg_init(uc);
1017         if (status < 0) {
1018                 dev_err(dev, "ucsi_ccg_start fail, err=%d\n", status);
1019                 return status;
1020         }
1021
1022         status = request_threaded_irq(uc->irq, NULL, ccg_irq_handler,
1023                                       IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
1024                                       dev_name(dev), uc);
1025         if (status < 0) {
1026                 dev_err(dev, "request_threaded_irq failed - %d\n", status);
1027                 return status;
1028         }
1029
1030         uc->ucsi = ucsi_register_ppm(dev, &uc->ppm);
1031         if (IS_ERR(uc->ucsi)) {
1032                 dev_err(uc->dev, "ucsi_register_ppm failed\n");
1033                 return PTR_ERR(uc->ucsi);
1034         }
1035
1036         return 0;
1037 }
1038
1039 static void ccg_update_firmware(struct work_struct *work)
1040 {
1041         struct ucsi_ccg *uc = container_of(work, struct ucsi_ccg, work);
1042         enum enum_flash_mode flash_mode;
1043         int status;
1044
1045         status = ccg_fw_update_needed(uc, &flash_mode);
1046         if (status < 0)
1047                 return;
1048
1049         if (flash_mode != FLASH_NOT_NEEDED) {
1050                 ucsi_unregister_ppm(uc->ucsi);
1051                 free_irq(uc->irq, uc);
1052
1053                 ccg_fw_update(uc, flash_mode);
1054                 ccg_restart(uc);
1055         }
1056 }
1057
1058 static ssize_t do_flash_store(struct device *dev,
1059                               struct device_attribute *attr,
1060                               const char *buf, size_t n)
1061 {
1062         struct ucsi_ccg *uc = i2c_get_clientdata(to_i2c_client(dev));
1063         bool flash;
1064
1065         if (kstrtobool(buf, &flash))
1066                 return -EINVAL;
1067
1068         if (!flash)
1069                 return n;
1070
1071         if (uc->fw_build == 0x0) {
1072                 dev_err(dev, "fail to flash FW due to missing FW build info\n");
1073                 return -EINVAL;
1074         }
1075
1076         schedule_work(&uc->work);
1077         return n;
1078 }
1079
1080 static DEVICE_ATTR_WO(do_flash);
1081
1082 static struct attribute *ucsi_ccg_sysfs_attrs[] = {
1083         &dev_attr_do_flash.attr,
1084         NULL,
1085 };
1086
1087 static struct attribute_group ucsi_ccg_attr_group = {
1088         .attrs = ucsi_ccg_sysfs_attrs,
1089 };
1090
1091 static int ucsi_ccg_probe(struct i2c_client *client,
1092                           const struct i2c_device_id *id)
1093 {
1094         struct device *dev = &client->dev;
1095         struct ucsi_ccg *uc;
1096         int status;
1097         u16 rab;
1098
1099         uc = devm_kzalloc(dev, sizeof(*uc), GFP_KERNEL);
1100         if (!uc)
1101                 return -ENOMEM;
1102
1103         uc->ppm.data = devm_kzalloc(dev, sizeof(struct ucsi_data), GFP_KERNEL);
1104         if (!uc->ppm.data)
1105                 return -ENOMEM;
1106
1107         uc->ppm.cmd = ucsi_ccg_cmd;
1108         uc->ppm.sync = ucsi_ccg_sync;
1109         uc->dev = dev;
1110         uc->client = client;
1111         mutex_init(&uc->lock);
1112         INIT_WORK(&uc->work, ccg_update_firmware);
1113         INIT_WORK(&uc->pm_work, ccg_pm_workaround_work);
1114
1115         /* Only fail FW flashing when FW build information is not provided */
1116         status = device_property_read_u16(dev, "ccgx,firmware-build",
1117                                           &uc->fw_build);
1118         if (status)
1119                 dev_err(uc->dev, "failed to get FW build information\n");
1120
1121         /* reset ccg device and initialize ucsi */
1122         status = ucsi_ccg_init(uc);
1123         if (status < 0) {
1124                 dev_err(uc->dev, "ucsi_ccg_init failed - %d\n", status);
1125                 return status;
1126         }
1127
1128         status = get_fw_info(uc);
1129         if (status < 0) {
1130                 dev_err(uc->dev, "get_fw_info failed - %d\n", status);
1131                 return status;
1132         }
1133
1134         uc->port_num = 1;
1135
1136         if (uc->info.mode & CCG_DEVINFO_PDPORTS_MASK)
1137                 uc->port_num++;
1138
1139         status = request_threaded_irq(client->irq, NULL, ccg_irq_handler,
1140                                       IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
1141                                       dev_name(dev), uc);
1142         if (status < 0) {
1143                 dev_err(uc->dev, "request_threaded_irq failed - %d\n", status);
1144                 return status;
1145         }
1146
1147         uc->irq = client->irq;
1148
1149         uc->ucsi = ucsi_register_ppm(dev, &uc->ppm);
1150         if (IS_ERR(uc->ucsi)) {
1151                 dev_err(uc->dev, "ucsi_register_ppm failed\n");
1152                 return PTR_ERR(uc->ucsi);
1153         }
1154
1155         rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, version));
1156         status = ccg_read(uc, rab, (u8 *)(uc->ppm.data) +
1157                           offsetof(struct ucsi_data, version),
1158                           sizeof(uc->ppm.data->version));
1159         if (status < 0) {
1160                 ucsi_unregister_ppm(uc->ucsi);
1161                 return status;
1162         }
1163
1164         i2c_set_clientdata(client, uc);
1165
1166         status = sysfs_create_group(&uc->dev->kobj, &ucsi_ccg_attr_group);
1167         if (status)
1168                 dev_err(uc->dev, "cannot create sysfs group: %d\n", status);
1169
1170         pm_runtime_set_active(uc->dev);
1171         pm_runtime_enable(uc->dev);
1172         pm_runtime_use_autosuspend(uc->dev);
1173         pm_runtime_set_autosuspend_delay(uc->dev, 5000);
1174         pm_runtime_idle(uc->dev);
1175
1176         return 0;
1177 }
1178
1179 static int ucsi_ccg_remove(struct i2c_client *client)
1180 {
1181         struct ucsi_ccg *uc = i2c_get_clientdata(client);
1182
1183         cancel_work_sync(&uc->pm_work);
1184         cancel_work_sync(&uc->work);
1185         ucsi_unregister_ppm(uc->ucsi);
1186         pm_runtime_disable(uc->dev);
1187         free_irq(uc->irq, uc);
1188         sysfs_remove_group(&uc->dev->kobj, &ucsi_ccg_attr_group);
1189
1190         return 0;
1191 }
1192
1193 static const struct i2c_device_id ucsi_ccg_device_id[] = {
1194         {"ccgx-ucsi", 0},
1195         {}
1196 };
1197 MODULE_DEVICE_TABLE(i2c, ucsi_ccg_device_id);
1198
1199 static int ucsi_ccg_resume(struct device *dev)
1200 {
1201         struct i2c_client *client = to_i2c_client(dev);
1202         struct ucsi_ccg *uc = i2c_get_clientdata(client);
1203
1204         return ucsi_resume(uc->ucsi);
1205 }
1206
1207 static int ucsi_ccg_runtime_suspend(struct device *dev)
1208 {
1209         return 0;
1210 }
1211
1212 static int ucsi_ccg_runtime_resume(struct device *dev)
1213 {
1214         struct i2c_client *client = to_i2c_client(dev);
1215         struct ucsi_ccg *uc = i2c_get_clientdata(client);
1216
1217         /*
1218          * Firmware version 3.1.10 or earlier, built for NVIDIA has known issue
1219          * of missing interrupt when a device is connected for runtime resume.
1220          * Schedule a work to call ISR as a workaround.
1221          */
1222         if (uc->fw_build == CCG_FW_BUILD_NVIDIA &&
1223             uc->fw_version <= CCG_OLD_FW_VERSION)
1224                 schedule_work(&uc->pm_work);
1225
1226         return 0;
1227 }
1228
1229 static const struct dev_pm_ops ucsi_ccg_pm = {
1230         .resume = ucsi_ccg_resume,
1231         .runtime_suspend = ucsi_ccg_runtime_suspend,
1232         .runtime_resume = ucsi_ccg_runtime_resume,
1233 };
1234
1235 static struct i2c_driver ucsi_ccg_driver = {
1236         .driver = {
1237                 .name = "ucsi_ccg",
1238                 .pm = &ucsi_ccg_pm,
1239         },
1240         .probe = ucsi_ccg_probe,
1241         .remove = ucsi_ccg_remove,
1242         .id_table = ucsi_ccg_device_id,
1243 };
1244
1245 module_i2c_driver(ucsi_ccg_driver);
1246
1247 MODULE_AUTHOR("Ajay Gupta <ajayg@nvidia.com>");
1248 MODULE_DESCRIPTION("UCSI driver for Cypress CCGx Type-C controller");
1249 MODULE_LICENSE("GPL v2");