xref: /openbmc/linux/drivers/input/rmi4/rmi_f34v7.c (revision 87d3d1b1)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2016, Zodiac Inflight Innovations
4  * Copyright (c) 2007-2016, Synaptics Incorporated
5  * Copyright (C) 2012 Alexandra Chin <alexandra.chin@tw.synaptics.com>
6  * Copyright (C) 2012 Scott Lin <scott.lin@tw.synaptics.com>
7  */
8 
9 #include <linux/bitops.h>
10 #include <linux/kernel.h>
11 #include <linux/rmi.h>
12 #include <linux/firmware.h>
13 #include <linux/delay.h>
14 #include <linux/slab.h>
15 #include <linux/jiffies.h>
16 #include <asm/unaligned.h>
17 
18 #include "rmi_driver.h"
19 #include "rmi_f34.h"
20 
rmi_f34v7_read_flash_status(struct f34_data * f34)21 static int rmi_f34v7_read_flash_status(struct f34_data *f34)
22 {
23 	u8 status;
24 	u8 command;
25 	int ret;
26 
27 	ret = rmi_read_block(f34->fn->rmi_dev,
28 			f34->fn->fd.data_base_addr + V7_FLASH_STATUS_OFFSET,
29 			&status,
30 			sizeof(status));
31 	if (ret < 0) {
32 		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
33 			"%s: Error %d reading flash status\n", __func__, ret);
34 		return ret;
35 	}
36 
37 	f34->v7.in_bl_mode = status >> 7;
38 	f34->v7.flash_status = status & 0x1f;
39 
40 	if (f34->v7.flash_status != 0x00) {
41 		dev_err(&f34->fn->dev, "%s: status=%d, command=0x%02x\n",
42 			__func__, f34->v7.flash_status, f34->v7.command);
43 	}
44 
45 	ret = rmi_read_block(f34->fn->rmi_dev,
46 			f34->fn->fd.data_base_addr + V7_COMMAND_OFFSET,
47 			&command,
48 			sizeof(command));
49 	if (ret < 0) {
50 		dev_err(&f34->fn->dev, "%s: Failed to read flash command\n",
51 			__func__);
52 		return ret;
53 	}
54 
55 	f34->v7.command = command;
56 
57 	return 0;
58 }
59 
rmi_f34v7_wait_for_idle(struct f34_data * f34,int timeout_ms)60 static int rmi_f34v7_wait_for_idle(struct f34_data *f34, int timeout_ms)
61 {
62 	unsigned long timeout;
63 
64 	timeout = msecs_to_jiffies(timeout_ms);
65 
66 	if (!wait_for_completion_timeout(&f34->v7.cmd_done, timeout)) {
67 		dev_warn(&f34->fn->dev, "%s: Timed out waiting for idle status\n",
68 			 __func__);
69 		return -ETIMEDOUT;
70 	}
71 
72 	return 0;
73 }
74 
rmi_f34v7_check_command_status(struct f34_data * f34,int timeout_ms)75 static int rmi_f34v7_check_command_status(struct f34_data *f34, int timeout_ms)
76 {
77 	int ret;
78 
79 	ret = rmi_f34v7_wait_for_idle(f34, timeout_ms);
80 	if (ret < 0)
81 		return ret;
82 
83 	ret = rmi_f34v7_read_flash_status(f34);
84 	if (ret < 0)
85 		return ret;
86 
87 	if (f34->v7.flash_status != 0x00)
88 		return -EIO;
89 
90 	return 0;
91 }
92 
rmi_f34v7_write_command_single_transaction(struct f34_data * f34,u8 cmd)93 static int rmi_f34v7_write_command_single_transaction(struct f34_data *f34,
94 						      u8 cmd)
95 {
96 	int ret;
97 	u8 base;
98 	struct f34v7_data_1_5 data_1_5;
99 
100 	base = f34->fn->fd.data_base_addr;
101 
102 	memset(&data_1_5, 0, sizeof(data_1_5));
103 
104 	switch (cmd) {
105 	case v7_CMD_ERASE_ALL:
106 		data_1_5.partition_id = CORE_CODE_PARTITION;
107 		data_1_5.command = CMD_V7_ERASE_AP;
108 		break;
109 	case v7_CMD_ERASE_UI_FIRMWARE:
110 		data_1_5.partition_id = CORE_CODE_PARTITION;
111 		data_1_5.command = CMD_V7_ERASE;
112 		break;
113 	case v7_CMD_ERASE_BL_CONFIG:
114 		data_1_5.partition_id = GLOBAL_PARAMETERS_PARTITION;
115 		data_1_5.command = CMD_V7_ERASE;
116 		break;
117 	case v7_CMD_ERASE_UI_CONFIG:
118 		data_1_5.partition_id = CORE_CONFIG_PARTITION;
119 		data_1_5.command = CMD_V7_ERASE;
120 		break;
121 	case v7_CMD_ERASE_DISP_CONFIG:
122 		data_1_5.partition_id = DISPLAY_CONFIG_PARTITION;
123 		data_1_5.command = CMD_V7_ERASE;
124 		break;
125 	case v7_CMD_ERASE_FLASH_CONFIG:
126 		data_1_5.partition_id = FLASH_CONFIG_PARTITION;
127 		data_1_5.command = CMD_V7_ERASE;
128 		break;
129 	case v7_CMD_ERASE_GUEST_CODE:
130 		data_1_5.partition_id = GUEST_CODE_PARTITION;
131 		data_1_5.command = CMD_V7_ERASE;
132 		break;
133 	case v7_CMD_ENABLE_FLASH_PROG:
134 		data_1_5.partition_id = BOOTLOADER_PARTITION;
135 		data_1_5.command = CMD_V7_ENTER_BL;
136 		break;
137 	}
138 
139 	data_1_5.payload[0] = f34->bootloader_id[0];
140 	data_1_5.payload[1] = f34->bootloader_id[1];
141 
142 	ret = rmi_write_block(f34->fn->rmi_dev,
143 			base + V7_PARTITION_ID_OFFSET,
144 			&data_1_5, sizeof(data_1_5));
145 	if (ret < 0) {
146 		dev_err(&f34->fn->dev,
147 			"%s: Failed to write single transaction command\n",
148 			__func__);
149 		return ret;
150 	}
151 
152 	return 0;
153 }
154 
rmi_f34v7_write_command(struct f34_data * f34,u8 cmd)155 static int rmi_f34v7_write_command(struct f34_data *f34, u8 cmd)
156 {
157 	int ret;
158 	u8 base;
159 	u8 command;
160 
161 	base = f34->fn->fd.data_base_addr;
162 
163 	switch (cmd) {
164 	case v7_CMD_WRITE_FW:
165 	case v7_CMD_WRITE_CONFIG:
166 	case v7_CMD_WRITE_GUEST_CODE:
167 		command = CMD_V7_WRITE;
168 		break;
169 	case v7_CMD_READ_CONFIG:
170 		command = CMD_V7_READ;
171 		break;
172 	case v7_CMD_ERASE_ALL:
173 		command = CMD_V7_ERASE_AP;
174 		break;
175 	case v7_CMD_ERASE_UI_FIRMWARE:
176 	case v7_CMD_ERASE_BL_CONFIG:
177 	case v7_CMD_ERASE_UI_CONFIG:
178 	case v7_CMD_ERASE_DISP_CONFIG:
179 	case v7_CMD_ERASE_FLASH_CONFIG:
180 	case v7_CMD_ERASE_GUEST_CODE:
181 		command = CMD_V7_ERASE;
182 		break;
183 	case v7_CMD_ENABLE_FLASH_PROG:
184 		command = CMD_V7_ENTER_BL;
185 		break;
186 	default:
187 		dev_err(&f34->fn->dev, "%s: Invalid command 0x%02x\n",
188 			__func__, cmd);
189 		return -EINVAL;
190 	}
191 
192 	f34->v7.command = command;
193 
194 	switch (cmd) {
195 	case v7_CMD_ERASE_ALL:
196 	case v7_CMD_ERASE_UI_FIRMWARE:
197 	case v7_CMD_ERASE_BL_CONFIG:
198 	case v7_CMD_ERASE_UI_CONFIG:
199 	case v7_CMD_ERASE_DISP_CONFIG:
200 	case v7_CMD_ERASE_FLASH_CONFIG:
201 	case v7_CMD_ERASE_GUEST_CODE:
202 	case v7_CMD_ENABLE_FLASH_PROG:
203 		ret = rmi_f34v7_write_command_single_transaction(f34, cmd);
204 		if (ret < 0)
205 			return ret;
206 		else
207 			return 0;
208 	default:
209 		break;
210 	}
211 
212 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: writing cmd %02X\n",
213 		__func__, command);
214 
215 	ret = rmi_write_block(f34->fn->rmi_dev,
216 			base + V7_COMMAND_OFFSET,
217 			&command, sizeof(command));
218 	if (ret < 0) {
219 		dev_err(&f34->fn->dev, "%s: Failed to write flash command\n",
220 			__func__);
221 		return ret;
222 	}
223 
224 	return 0;
225 }
226 
rmi_f34v7_write_partition_id(struct f34_data * f34,u8 cmd)227 static int rmi_f34v7_write_partition_id(struct f34_data *f34, u8 cmd)
228 {
229 	int ret;
230 	u8 base;
231 	u8 partition;
232 
233 	base = f34->fn->fd.data_base_addr;
234 
235 	switch (cmd) {
236 	case v7_CMD_WRITE_FW:
237 		partition = CORE_CODE_PARTITION;
238 		break;
239 	case v7_CMD_WRITE_CONFIG:
240 	case v7_CMD_READ_CONFIG:
241 		if (f34->v7.config_area == v7_UI_CONFIG_AREA)
242 			partition = CORE_CONFIG_PARTITION;
243 		else if (f34->v7.config_area == v7_DP_CONFIG_AREA)
244 			partition = DISPLAY_CONFIG_PARTITION;
245 		else if (f34->v7.config_area == v7_PM_CONFIG_AREA)
246 			partition = GUEST_SERIALIZATION_PARTITION;
247 		else if (f34->v7.config_area == v7_BL_CONFIG_AREA)
248 			partition = GLOBAL_PARAMETERS_PARTITION;
249 		else if (f34->v7.config_area == v7_FLASH_CONFIG_AREA)
250 			partition = FLASH_CONFIG_PARTITION;
251 		break;
252 	case v7_CMD_WRITE_GUEST_CODE:
253 		partition = GUEST_CODE_PARTITION;
254 		break;
255 	case v7_CMD_ERASE_ALL:
256 		partition = CORE_CODE_PARTITION;
257 		break;
258 	case v7_CMD_ERASE_BL_CONFIG:
259 		partition = GLOBAL_PARAMETERS_PARTITION;
260 		break;
261 	case v7_CMD_ERASE_UI_CONFIG:
262 		partition = CORE_CONFIG_PARTITION;
263 		break;
264 	case v7_CMD_ERASE_DISP_CONFIG:
265 		partition = DISPLAY_CONFIG_PARTITION;
266 		break;
267 	case v7_CMD_ERASE_FLASH_CONFIG:
268 		partition = FLASH_CONFIG_PARTITION;
269 		break;
270 	case v7_CMD_ERASE_GUEST_CODE:
271 		partition = GUEST_CODE_PARTITION;
272 		break;
273 	case v7_CMD_ENABLE_FLASH_PROG:
274 		partition = BOOTLOADER_PARTITION;
275 		break;
276 	default:
277 		dev_err(&f34->fn->dev, "%s: Invalid command 0x%02x\n",
278 			__func__, cmd);
279 		return -EINVAL;
280 	}
281 
282 	ret = rmi_write_block(f34->fn->rmi_dev,
283 			base + V7_PARTITION_ID_OFFSET,
284 			&partition, sizeof(partition));
285 	if (ret < 0) {
286 		dev_err(&f34->fn->dev, "%s: Failed to write partition ID\n",
287 			__func__);
288 		return ret;
289 	}
290 
291 	return 0;
292 }
293 
rmi_f34v7_read_partition_table(struct f34_data * f34)294 static int rmi_f34v7_read_partition_table(struct f34_data *f34)
295 {
296 	int ret;
297 	unsigned long timeout;
298 	u8 base;
299 	__le16 length;
300 	u16 block_number = 0;
301 
302 	base = f34->fn->fd.data_base_addr;
303 
304 	f34->v7.config_area = v7_FLASH_CONFIG_AREA;
305 
306 	ret = rmi_f34v7_write_partition_id(f34, v7_CMD_READ_CONFIG);
307 	if (ret < 0)
308 		return ret;
309 
310 	ret = rmi_write_block(f34->fn->rmi_dev,
311 			base + V7_BLOCK_NUMBER_OFFSET,
312 			&block_number, sizeof(block_number));
313 	if (ret < 0) {
314 		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
315 			__func__);
316 		return ret;
317 	}
318 
319 	put_unaligned_le16(f34->v7.flash_config_length, &length);
320 
321 	ret = rmi_write_block(f34->fn->rmi_dev,
322 			base + V7_TRANSFER_LENGTH_OFFSET,
323 			&length, sizeof(length));
324 	if (ret < 0) {
325 		dev_err(&f34->fn->dev, "%s: Failed to write transfer length\n",
326 			__func__);
327 		return ret;
328 	}
329 
330 	init_completion(&f34->v7.cmd_done);
331 
332 	ret = rmi_f34v7_write_command(f34, v7_CMD_READ_CONFIG);
333 	if (ret < 0) {
334 		dev_err(&f34->fn->dev, "%s: Failed to write command\n",
335 			__func__);
336 		return ret;
337 	}
338 
339 	/*
340 	 * rmi_f34v7_check_command_status() can't be used here, as this
341 	 * function is called before IRQs are available
342 	 */
343 	timeout = msecs_to_jiffies(F34_WRITE_WAIT_MS);
344 	while (time_before(jiffies, timeout)) {
345 		usleep_range(5000, 6000);
346 		rmi_f34v7_read_flash_status(f34);
347 
348 		if (f34->v7.command == v7_CMD_IDLE &&
349 		    f34->v7.flash_status == 0x00) {
350 			break;
351 		}
352 	}
353 
354 	ret = rmi_read_block(f34->fn->rmi_dev,
355 			base + V7_PAYLOAD_OFFSET,
356 			f34->v7.read_config_buf,
357 			f34->v7.partition_table_bytes);
358 	if (ret < 0) {
359 		dev_err(&f34->fn->dev, "%s: Failed to read block data\n",
360 			__func__);
361 		return ret;
362 	}
363 
364 	return 0;
365 }
366 
rmi_f34v7_parse_partition_table(struct f34_data * f34,const void * partition_table,struct block_count * blkcount,struct physical_address * phyaddr)367 static void rmi_f34v7_parse_partition_table(struct f34_data *f34,
368 					    const void *partition_table,
369 					    struct block_count *blkcount,
370 					    struct physical_address *phyaddr)
371 {
372 	int i;
373 	int index;
374 	u16 partition_length;
375 	u16 physical_address;
376 	const struct partition_table *ptable;
377 
378 	for (i = 0; i < f34->v7.partitions; i++) {
379 		index = i * 8 + 2;
380 		ptable = partition_table + index;
381 		partition_length = le16_to_cpu(ptable->partition_length);
382 		physical_address = le16_to_cpu(ptable->start_physical_address);
383 		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
384 			"%s: Partition entry %d: %*ph\n",
385 			__func__, i, sizeof(struct partition_table), ptable);
386 		switch (ptable->partition_id & 0x1f) {
387 		case CORE_CODE_PARTITION:
388 			blkcount->ui_firmware = partition_length;
389 			phyaddr->ui_firmware = physical_address;
390 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
391 				"%s: Core code block count: %d\n",
392 				__func__, blkcount->ui_firmware);
393 			break;
394 		case CORE_CONFIG_PARTITION:
395 			blkcount->ui_config = partition_length;
396 			phyaddr->ui_config = physical_address;
397 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
398 				"%s: Core config block count: %d\n",
399 				__func__, blkcount->ui_config);
400 			break;
401 		case DISPLAY_CONFIG_PARTITION:
402 			blkcount->dp_config = partition_length;
403 			phyaddr->dp_config = physical_address;
404 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
405 				"%s: Display config block count: %d\n",
406 				__func__, blkcount->dp_config);
407 			break;
408 		case FLASH_CONFIG_PARTITION:
409 			blkcount->fl_config = partition_length;
410 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
411 				"%s: Flash config block count: %d\n",
412 				__func__, blkcount->fl_config);
413 			break;
414 		case GUEST_CODE_PARTITION:
415 			blkcount->guest_code = partition_length;
416 			phyaddr->guest_code = physical_address;
417 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
418 				"%s: Guest code block count: %d\n",
419 				__func__, blkcount->guest_code);
420 			break;
421 		case GUEST_SERIALIZATION_PARTITION:
422 			blkcount->pm_config = partition_length;
423 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
424 				"%s: Guest serialization block count: %d\n",
425 				__func__, blkcount->pm_config);
426 			break;
427 		case GLOBAL_PARAMETERS_PARTITION:
428 			blkcount->bl_config = partition_length;
429 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
430 				"%s: Global parameters block count: %d\n",
431 				__func__, blkcount->bl_config);
432 			break;
433 		case DEVICE_CONFIG_PARTITION:
434 			blkcount->lockdown = partition_length;
435 			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
436 				"%s: Device config block count: %d\n",
437 				__func__, blkcount->lockdown);
438 			break;
439 		}
440 	}
441 }
442 
rmi_f34v7_read_queries_bl_version(struct f34_data * f34)443 static int rmi_f34v7_read_queries_bl_version(struct f34_data *f34)
444 {
445 	int ret;
446 	u8 base;
447 	int offset;
448 	u8 query_0;
449 	struct f34v7_query_1_7 query_1_7;
450 
451 	base = f34->fn->fd.query_base_addr;
452 
453 	ret = rmi_read_block(f34->fn->rmi_dev,
454 			base,
455 			&query_0,
456 			sizeof(query_0));
457 	if (ret < 0) {
458 		dev_err(&f34->fn->dev,
459 			"%s: Failed to read query 0\n", __func__);
460 		return ret;
461 	}
462 
463 	offset = (query_0 & 0x7) + 1;
464 
465 	ret = rmi_read_block(f34->fn->rmi_dev,
466 			base + offset,
467 			&query_1_7,
468 			sizeof(query_1_7));
469 	if (ret < 0) {
470 		dev_err(&f34->fn->dev, "%s: Failed to read queries 1 to 7\n",
471 			__func__);
472 		return ret;
473 	}
474 
475 	f34->bootloader_id[0] = query_1_7.bl_minor_revision;
476 	f34->bootloader_id[1] = query_1_7.bl_major_revision;
477 
478 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "Bootloader V%d.%d\n",
479 		f34->bootloader_id[1], f34->bootloader_id[0]);
480 
481 	return 0;
482 }
483 
rmi_f34v7_read_queries(struct f34_data * f34)484 static int rmi_f34v7_read_queries(struct f34_data *f34)
485 {
486 	int ret;
487 	int i;
488 	u8 base;
489 	int offset;
490 	u8 *ptable;
491 	u8 query_0;
492 	struct f34v7_query_1_7 query_1_7;
493 
494 	base = f34->fn->fd.query_base_addr;
495 
496 	ret = rmi_read_block(f34->fn->rmi_dev,
497 			base,
498 			&query_0,
499 			sizeof(query_0));
500 	if (ret < 0) {
501 		dev_err(&f34->fn->dev,
502 			"%s: Failed to read query 0\n", __func__);
503 		return ret;
504 	}
505 
506 	offset = (query_0 & 0x07) + 1;
507 
508 	ret = rmi_read_block(f34->fn->rmi_dev,
509 			base + offset,
510 			&query_1_7,
511 			sizeof(query_1_7));
512 	if (ret < 0) {
513 		dev_err(&f34->fn->dev, "%s: Failed to read queries 1 to 7\n",
514 			__func__);
515 		return ret;
516 	}
517 
518 	f34->bootloader_id[0] = query_1_7.bl_minor_revision;
519 	f34->bootloader_id[1] = query_1_7.bl_major_revision;
520 
521 	f34->v7.block_size = le16_to_cpu(query_1_7.block_size);
522 	f34->v7.flash_config_length =
523 			le16_to_cpu(query_1_7.flash_config_length);
524 	f34->v7.payload_length = le16_to_cpu(query_1_7.payload_length);
525 
526 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: f34->v7.block_size = %d\n",
527 		 __func__, f34->v7.block_size);
528 
529 	f34->v7.has_display_cfg = query_1_7.partition_support[1] & HAS_DISP_CFG;
530 	f34->v7.has_guest_code =
531 			query_1_7.partition_support[1] & HAS_GUEST_CODE;
532 
533 	if (query_0 & HAS_CONFIG_ID) {
534 		u8 f34_ctrl[CONFIG_ID_SIZE];
535 
536 		ret = rmi_read_block(f34->fn->rmi_dev,
537 				f34->fn->fd.control_base_addr,
538 				f34_ctrl,
539 				sizeof(f34_ctrl));
540 		if (ret)
541 			return ret;
542 
543 		/* Eat leading zeros */
544 		for (i = 0; i < sizeof(f34_ctrl) - 1 && !f34_ctrl[i]; i++)
545 			/* Empty */;
546 
547 		snprintf(f34->configuration_id, sizeof(f34->configuration_id),
548 			 "%*phN", (int)sizeof(f34_ctrl) - i, f34_ctrl + i);
549 
550 		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "Configuration ID: %s\n",
551 			f34->configuration_id);
552 	}
553 
554 	f34->v7.partitions = 0;
555 	for (i = 0; i < sizeof(query_1_7.partition_support); i++)
556 		f34->v7.partitions += hweight8(query_1_7.partition_support[i]);
557 
558 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: Supported partitions: %*ph\n",
559 		__func__, sizeof(query_1_7.partition_support),
560 		query_1_7.partition_support);
561 
562 
563 	f34->v7.partition_table_bytes = f34->v7.partitions * 8 + 2;
564 
565 	f34->v7.read_config_buf = devm_kzalloc(&f34->fn->dev,
566 			f34->v7.partition_table_bytes,
567 			GFP_KERNEL);
568 	if (!f34->v7.read_config_buf) {
569 		f34->v7.read_config_buf_size = 0;
570 		return -ENOMEM;
571 	}
572 
573 	f34->v7.read_config_buf_size = f34->v7.partition_table_bytes;
574 	ptable = f34->v7.read_config_buf;
575 
576 	ret = rmi_f34v7_read_partition_table(f34);
577 	if (ret < 0) {
578 		dev_err(&f34->fn->dev, "%s: Failed to read partition table\n",
579 				__func__);
580 		return ret;
581 	}
582 
583 	rmi_f34v7_parse_partition_table(f34, ptable,
584 					&f34->v7.blkcount, &f34->v7.phyaddr);
585 
586 	return 0;
587 }
588 
rmi_f34v7_check_bl_config_size(struct f34_data * f34)589 static int rmi_f34v7_check_bl_config_size(struct f34_data *f34)
590 {
591 	u16 block_count;
592 
593 	block_count = f34->v7.img.bl_config.size / f34->v7.block_size;
594 	f34->update_size += block_count;
595 
596 	if (block_count != f34->v7.blkcount.bl_config) {
597 		dev_err(&f34->fn->dev, "Bootloader config size mismatch\n");
598 		return -EINVAL;
599 	}
600 
601 	return 0;
602 }
603 
rmi_f34v7_erase_all(struct f34_data * f34)604 static int rmi_f34v7_erase_all(struct f34_data *f34)
605 {
606 	int ret;
607 
608 	dev_info(&f34->fn->dev, "Erasing firmware...\n");
609 
610 	init_completion(&f34->v7.cmd_done);
611 
612 	ret = rmi_f34v7_write_command(f34, v7_CMD_ERASE_ALL);
613 	if (ret < 0)
614 		return ret;
615 
616 	ret = rmi_f34v7_check_command_status(f34, F34_ERASE_WAIT_MS);
617 	if (ret < 0)
618 		return ret;
619 
620 	return 0;
621 }
622 
rmi_f34v7_read_blocks(struct f34_data * f34,u16 block_cnt,u8 command)623 static int rmi_f34v7_read_blocks(struct f34_data *f34,
624 				 u16 block_cnt, u8 command)
625 {
626 	int ret;
627 	u8 base;
628 	__le16 length;
629 	u16 transfer;
630 	u16 max_transfer;
631 	u16 remaining = block_cnt;
632 	u16 block_number = 0;
633 	u16 index = 0;
634 
635 	base = f34->fn->fd.data_base_addr;
636 
637 	ret = rmi_f34v7_write_partition_id(f34, command);
638 	if (ret < 0)
639 		return ret;
640 
641 	ret = rmi_write_block(f34->fn->rmi_dev,
642 			base + V7_BLOCK_NUMBER_OFFSET,
643 			&block_number, sizeof(block_number));
644 	if (ret < 0) {
645 		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
646 			__func__);
647 		return ret;
648 	}
649 
650 	max_transfer = min(f34->v7.payload_length,
651 			   (u16)(PAGE_SIZE / f34->v7.block_size));
652 
653 	do {
654 		transfer = min(remaining, max_transfer);
655 		put_unaligned_le16(transfer, &length);
656 
657 		ret = rmi_write_block(f34->fn->rmi_dev,
658 				base + V7_TRANSFER_LENGTH_OFFSET,
659 				&length, sizeof(length));
660 		if (ret < 0) {
661 			dev_err(&f34->fn->dev,
662 				"%s: Write transfer length fail (%d remaining)\n",
663 				__func__, remaining);
664 			return ret;
665 		}
666 
667 		init_completion(&f34->v7.cmd_done);
668 
669 		ret = rmi_f34v7_write_command(f34, command);
670 		if (ret < 0)
671 			return ret;
672 
673 		ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
674 		if (ret < 0)
675 			return ret;
676 
677 		ret = rmi_read_block(f34->fn->rmi_dev,
678 				base + V7_PAYLOAD_OFFSET,
679 				&f34->v7.read_config_buf[index],
680 				transfer * f34->v7.block_size);
681 		if (ret < 0) {
682 			dev_err(&f34->fn->dev,
683 				"%s: Read block failed (%d blks remaining)\n",
684 				__func__, remaining);
685 			return ret;
686 		}
687 
688 		index += (transfer * f34->v7.block_size);
689 		remaining -= transfer;
690 	} while (remaining);
691 
692 	return 0;
693 }
694 
rmi_f34v7_write_f34v7_blocks(struct f34_data * f34,const void * block_ptr,u16 block_cnt,u8 command)695 static int rmi_f34v7_write_f34v7_blocks(struct f34_data *f34,
696 					const void *block_ptr, u16 block_cnt,
697 					u8 command)
698 {
699 	int ret;
700 	u8 base;
701 	__le16 length;
702 	u16 transfer;
703 	u16 max_transfer;
704 	u16 remaining = block_cnt;
705 	u16 block_number = 0;
706 
707 	base = f34->fn->fd.data_base_addr;
708 
709 	ret = rmi_f34v7_write_partition_id(f34, command);
710 	if (ret < 0)
711 		return ret;
712 
713 	ret = rmi_write_block(f34->fn->rmi_dev,
714 			base + V7_BLOCK_NUMBER_OFFSET,
715 			&block_number, sizeof(block_number));
716 	if (ret < 0) {
717 		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
718 			__func__);
719 		return ret;
720 	}
721 
722 	if (f34->v7.payload_length > (PAGE_SIZE / f34->v7.block_size))
723 		max_transfer = PAGE_SIZE / f34->v7.block_size;
724 	else
725 		max_transfer = f34->v7.payload_length;
726 
727 	do {
728 		transfer = min(remaining, max_transfer);
729 		put_unaligned_le16(transfer, &length);
730 
731 		init_completion(&f34->v7.cmd_done);
732 
733 		ret = rmi_write_block(f34->fn->rmi_dev,
734 				base + V7_TRANSFER_LENGTH_OFFSET,
735 				&length, sizeof(length));
736 		if (ret < 0) {
737 			dev_err(&f34->fn->dev,
738 				"%s: Write transfer length fail (%d remaining)\n",
739 				__func__, remaining);
740 			return ret;
741 		}
742 
743 		ret = rmi_f34v7_write_command(f34, command);
744 		if (ret < 0)
745 			return ret;
746 
747 		ret = rmi_write_block(f34->fn->rmi_dev,
748 				base + V7_PAYLOAD_OFFSET,
749 				block_ptr, transfer * f34->v7.block_size);
750 		if (ret < 0) {
751 			dev_err(&f34->fn->dev,
752 				"%s: Failed writing data (%d blks remaining)\n",
753 				__func__, remaining);
754 			return ret;
755 		}
756 
757 		ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
758 		if (ret < 0)
759 			return ret;
760 
761 		block_ptr += (transfer * f34->v7.block_size);
762 		remaining -= transfer;
763 		f34->update_progress += transfer;
764 		f34->update_status = (f34->update_progress * 100) /
765 				     f34->update_size;
766 	} while (remaining);
767 
768 	return 0;
769 }
770 
rmi_f34v7_write_config(struct f34_data * f34)771 static int rmi_f34v7_write_config(struct f34_data *f34)
772 {
773 	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.config_data,
774 					    f34->v7.config_block_count,
775 					    v7_CMD_WRITE_CONFIG);
776 }
777 
rmi_f34v7_write_ui_config(struct f34_data * f34)778 static int rmi_f34v7_write_ui_config(struct f34_data *f34)
779 {
780 	f34->v7.config_area = v7_UI_CONFIG_AREA;
781 	f34->v7.config_data = f34->v7.img.ui_config.data;
782 	f34->v7.config_size = f34->v7.img.ui_config.size;
783 	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
784 
785 	return rmi_f34v7_write_config(f34);
786 }
787 
rmi_f34v7_write_dp_config(struct f34_data * f34)788 static int rmi_f34v7_write_dp_config(struct f34_data *f34)
789 {
790 	f34->v7.config_area = v7_DP_CONFIG_AREA;
791 	f34->v7.config_data = f34->v7.img.dp_config.data;
792 	f34->v7.config_size = f34->v7.img.dp_config.size;
793 	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
794 
795 	return rmi_f34v7_write_config(f34);
796 }
797 
rmi_f34v7_write_guest_code(struct f34_data * f34)798 static int rmi_f34v7_write_guest_code(struct f34_data *f34)
799 {
800 	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.img.guest_code.data,
801 					    f34->v7.img.guest_code.size /
802 							f34->v7.block_size,
803 					    v7_CMD_WRITE_GUEST_CODE);
804 }
805 
rmi_f34v7_write_flash_config(struct f34_data * f34)806 static int rmi_f34v7_write_flash_config(struct f34_data *f34)
807 {
808 	int ret;
809 
810 	f34->v7.config_area = v7_FLASH_CONFIG_AREA;
811 	f34->v7.config_data = f34->v7.img.fl_config.data;
812 	f34->v7.config_size = f34->v7.img.fl_config.size;
813 	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
814 
815 	if (f34->v7.config_block_count != f34->v7.blkcount.fl_config) {
816 		dev_err(&f34->fn->dev, "%s: Flash config size mismatch\n",
817 			__func__);
818 		return -EINVAL;
819 	}
820 
821 	init_completion(&f34->v7.cmd_done);
822 
823 	ret = rmi_f34v7_write_config(f34);
824 	if (ret < 0)
825 		return ret;
826 
827 	return 0;
828 }
829 
rmi_f34v7_write_partition_table(struct f34_data * f34)830 static int rmi_f34v7_write_partition_table(struct f34_data *f34)
831 {
832 	u16 block_count;
833 	int ret;
834 
835 	block_count = f34->v7.blkcount.bl_config;
836 	f34->v7.config_area = v7_BL_CONFIG_AREA;
837 	f34->v7.config_size = f34->v7.block_size * block_count;
838 	devm_kfree(&f34->fn->dev, f34->v7.read_config_buf);
839 	f34->v7.read_config_buf = devm_kzalloc(&f34->fn->dev,
840 					       f34->v7.config_size, GFP_KERNEL);
841 	if (!f34->v7.read_config_buf) {
842 		f34->v7.read_config_buf_size = 0;
843 		return -ENOMEM;
844 	}
845 
846 	f34->v7.read_config_buf_size = f34->v7.config_size;
847 
848 	ret = rmi_f34v7_read_blocks(f34, block_count, v7_CMD_READ_CONFIG);
849 	if (ret < 0)
850 		return ret;
851 
852 	ret = rmi_f34v7_write_flash_config(f34);
853 	if (ret < 0)
854 		return ret;
855 
856 	f34->v7.config_area = v7_BL_CONFIG_AREA;
857 	f34->v7.config_data = f34->v7.read_config_buf;
858 	f34->v7.config_size = f34->v7.img.bl_config.size;
859 	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
860 
861 	ret = rmi_f34v7_write_config(f34);
862 	if (ret < 0)
863 		return ret;
864 
865 	return 0;
866 }
867 
rmi_f34v7_write_firmware(struct f34_data * f34)868 static int rmi_f34v7_write_firmware(struct f34_data *f34)
869 {
870 	u16 blk_count;
871 
872 	blk_count = f34->v7.img.ui_firmware.size / f34->v7.block_size;
873 
874 	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.img.ui_firmware.data,
875 					    blk_count, v7_CMD_WRITE_FW);
876 }
877 
rmi_f34v7_parse_img_header_10_bl_container(struct f34_data * f34,const void * image)878 static void rmi_f34v7_parse_img_header_10_bl_container(struct f34_data *f34,
879 						       const void *image)
880 {
881 	int i;
882 	int num_of_containers;
883 	unsigned int addr;
884 	unsigned int container_id;
885 	unsigned int length;
886 	const void *content;
887 	const struct container_descriptor *descriptor;
888 
889 	num_of_containers = f34->v7.img.bootloader.size / 4 - 1;
890 
891 	for (i = 1; i <= num_of_containers; i++) {
892 		addr = get_unaligned_le32(f34->v7.img.bootloader.data + i * 4);
893 		descriptor = image + addr;
894 		container_id = le16_to_cpu(descriptor->container_id);
895 		content = image + le32_to_cpu(descriptor->content_address);
896 		length = le32_to_cpu(descriptor->content_length);
897 		switch (container_id) {
898 		case BL_CONFIG_CONTAINER:
899 		case GLOBAL_PARAMETERS_CONTAINER:
900 			f34->v7.img.bl_config.data = content;
901 			f34->v7.img.bl_config.size = length;
902 			break;
903 		case BL_LOCKDOWN_INFO_CONTAINER:
904 		case DEVICE_CONFIG_CONTAINER:
905 			f34->v7.img.lockdown.data = content;
906 			f34->v7.img.lockdown.size = length;
907 			break;
908 		default:
909 			break;
910 		}
911 	}
912 }
913 
rmi_f34v7_parse_image_header_10(struct f34_data * f34)914 static void rmi_f34v7_parse_image_header_10(struct f34_data *f34)
915 {
916 	unsigned int i;
917 	unsigned int num_of_containers;
918 	unsigned int addr;
919 	unsigned int offset;
920 	unsigned int container_id;
921 	unsigned int length;
922 	const void *image = f34->v7.image;
923 	const u8 *content;
924 	const struct container_descriptor *descriptor;
925 	const struct image_header_10 *header = image;
926 
927 	f34->v7.img.checksum = le32_to_cpu(header->checksum);
928 
929 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: f34->v7.img.checksum=%X\n",
930 		__func__, f34->v7.img.checksum);
931 
932 	/* address of top level container */
933 	offset = le32_to_cpu(header->top_level_container_start_addr);
934 	descriptor = image + offset;
935 
936 	/* address of top level container content */
937 	offset = le32_to_cpu(descriptor->content_address);
938 	num_of_containers = le32_to_cpu(descriptor->content_length) / 4;
939 
940 	for (i = 0; i < num_of_containers; i++) {
941 		addr = get_unaligned_le32(image + offset);
942 		offset += 4;
943 		descriptor = image + addr;
944 		container_id = le16_to_cpu(descriptor->container_id);
945 		content = image + le32_to_cpu(descriptor->content_address);
946 		length = le32_to_cpu(descriptor->content_length);
947 
948 		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
949 			"%s: container_id=%d, length=%d\n", __func__,
950 			container_id, length);
951 
952 		switch (container_id) {
953 		case UI_CONTAINER:
954 		case CORE_CODE_CONTAINER:
955 			f34->v7.img.ui_firmware.data = content;
956 			f34->v7.img.ui_firmware.size = length;
957 			break;
958 		case UI_CONFIG_CONTAINER:
959 		case CORE_CONFIG_CONTAINER:
960 			f34->v7.img.ui_config.data = content;
961 			f34->v7.img.ui_config.size = length;
962 			break;
963 		case BL_CONTAINER:
964 			f34->v7.img.bl_version = *content;
965 			f34->v7.img.bootloader.data = content;
966 			f34->v7.img.bootloader.size = length;
967 			rmi_f34v7_parse_img_header_10_bl_container(f34, image);
968 			break;
969 		case GUEST_CODE_CONTAINER:
970 			f34->v7.img.contains_guest_code = true;
971 			f34->v7.img.guest_code.data = content;
972 			f34->v7.img.guest_code.size = length;
973 			break;
974 		case DISPLAY_CONFIG_CONTAINER:
975 			f34->v7.img.contains_display_cfg = true;
976 			f34->v7.img.dp_config.data = content;
977 			f34->v7.img.dp_config.size = length;
978 			break;
979 		case FLASH_CONFIG_CONTAINER:
980 			f34->v7.img.contains_flash_config = true;
981 			f34->v7.img.fl_config.data = content;
982 			f34->v7.img.fl_config.size = length;
983 			break;
984 		case GENERAL_INFORMATION_CONTAINER:
985 			f34->v7.img.contains_firmware_id = true;
986 			f34->v7.img.firmware_id =
987 				get_unaligned_le32(content + 4);
988 			break;
989 		default:
990 			break;
991 		}
992 	}
993 }
994 
rmi_f34v7_parse_image_info(struct f34_data * f34)995 static int rmi_f34v7_parse_image_info(struct f34_data *f34)
996 {
997 	const struct image_header_10 *header = f34->v7.image;
998 
999 	memset(&f34->v7.img, 0x00, sizeof(f34->v7.img));
1000 
1001 	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
1002 		"%s: header->major_header_version = %d\n",
1003 		__func__, header->major_header_version);
1004 
1005 	switch (header->major_header_version) {
1006 	case IMAGE_HEADER_VERSION_10:
1007 		rmi_f34v7_parse_image_header_10(f34);
1008 		break;
1009 	default:
1010 		dev_err(&f34->fn->dev, "Unsupported image file format %02X\n",
1011 			header->major_header_version);
1012 		return -EINVAL;
1013 	}
1014 
1015 	if (!f34->v7.img.contains_flash_config) {
1016 		dev_err(&f34->fn->dev, "%s: No flash config in fw image\n",
1017 			__func__);
1018 		return -EINVAL;
1019 	}
1020 
1021 	rmi_f34v7_parse_partition_table(f34, f34->v7.img.fl_config.data,
1022 			&f34->v7.img.blkcount, &f34->v7.img.phyaddr);
1023 
1024 	return 0;
1025 }
1026 
rmi_f34v7_do_reflash(struct f34_data * f34,const struct firmware * fw)1027 int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw)
1028 {
1029 	int ret;
1030 
1031 	f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev,
1032 					       f34->fn->irq_mask);
1033 
1034 	rmi_f34v7_read_queries_bl_version(f34);
1035 
1036 	f34->v7.image = fw->data;
1037 	f34->update_progress = 0;
1038 	f34->update_size = 0;
1039 
1040 	ret = rmi_f34v7_parse_image_info(f34);
1041 	if (ret < 0)
1042 		return ret;
1043 
1044 	ret = rmi_f34v7_check_bl_config_size(f34);
1045 	if (ret < 0)
1046 		return ret;
1047 
1048 	ret = rmi_f34v7_erase_all(f34);
1049 	if (ret < 0)
1050 		return ret;
1051 
1052 	ret = rmi_f34v7_write_partition_table(f34);
1053 	if (ret < 0)
1054 		return ret;
1055 	dev_info(&f34->fn->dev, "%s: Partition table programmed\n", __func__);
1056 
1057 	/*
1058 	 * Reset to reload partition table - as the previous firmware has been
1059 	 * erased, we remain in bootloader mode.
1060 	 */
1061 	ret = rmi_scan_pdt(f34->fn->rmi_dev, NULL, rmi_initial_reset);
1062 	if (ret < 0)
1063 		dev_warn(&f34->fn->dev, "RMI reset failed!\n");
1064 
1065 	dev_info(&f34->fn->dev, "Writing firmware (%d bytes)...\n",
1066 		 f34->v7.img.ui_firmware.size);
1067 
1068 	ret = rmi_f34v7_write_firmware(f34);
1069 	if (ret < 0)
1070 		return ret;
1071 
1072 	dev_info(&f34->fn->dev, "Writing config (%d bytes)...\n",
1073 		 f34->v7.img.ui_config.size);
1074 
1075 	f34->v7.config_area = v7_UI_CONFIG_AREA;
1076 	ret = rmi_f34v7_write_ui_config(f34);
1077 	if (ret < 0)
1078 		return ret;
1079 
1080 	if (f34->v7.has_display_cfg && f34->v7.img.contains_display_cfg) {
1081 		dev_info(&f34->fn->dev, "Writing display config...\n");
1082 
1083 		ret = rmi_f34v7_write_dp_config(f34);
1084 		if (ret < 0)
1085 			return ret;
1086 	}
1087 
1088 	if (f34->v7.has_guest_code && f34->v7.img.contains_guest_code) {
1089 		dev_info(&f34->fn->dev, "Writing guest code...\n");
1090 
1091 		ret = rmi_f34v7_write_guest_code(f34);
1092 		if (ret < 0)
1093 			return ret;
1094 	}
1095 
1096 	return 0;
1097 }
1098 
rmi_f34v7_enter_flash_prog(struct f34_data * f34)1099 static int rmi_f34v7_enter_flash_prog(struct f34_data *f34)
1100 {
1101 	int ret;
1102 
1103 	f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev, f34->fn->irq_mask);
1104 
1105 	ret = rmi_f34v7_read_flash_status(f34);
1106 	if (ret < 0)
1107 		return ret;
1108 
1109 	if (f34->v7.in_bl_mode) {
1110 		dev_info(&f34->fn->dev, "%s: Device in bootloader mode\n",
1111 			 __func__);
1112 		return 0;
1113 	}
1114 
1115 	init_completion(&f34->v7.cmd_done);
1116 
1117 	ret = rmi_f34v7_write_command(f34, v7_CMD_ENABLE_FLASH_PROG);
1118 	if (ret < 0)
1119 		return ret;
1120 
1121 	ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
1122 	if (ret < 0)
1123 		return ret;
1124 
1125 	return 0;
1126 }
1127 
rmi_f34v7_start_reflash(struct f34_data * f34,const struct firmware * fw)1128 int rmi_f34v7_start_reflash(struct f34_data *f34, const struct firmware *fw)
1129 {
1130 	int ret = 0;
1131 
1132 	f34->v7.config_area = v7_UI_CONFIG_AREA;
1133 	f34->v7.image = fw->data;
1134 
1135 	ret = rmi_f34v7_parse_image_info(f34);
1136 	if (ret < 0)
1137 		return ret;
1138 
1139 	dev_info(&f34->fn->dev, "Firmware image OK\n");
1140 
1141 	return rmi_f34v7_enter_flash_prog(f34);
1142 }
1143 
rmi_f34v7_probe(struct f34_data * f34)1144 int rmi_f34v7_probe(struct f34_data *f34)
1145 {
1146 	int ret;
1147 
1148 	/* Read bootloader version */
1149 	ret = rmi_read_block(f34->fn->rmi_dev,
1150 			f34->fn->fd.query_base_addr + V7_BOOTLOADER_ID_OFFSET,
1151 			f34->bootloader_id,
1152 			sizeof(f34->bootloader_id));
1153 	if (ret < 0) {
1154 		dev_err(&f34->fn->dev, "%s: Failed to read bootloader ID\n",
1155 			__func__);
1156 		return ret;
1157 	}
1158 
1159 	if (f34->bootloader_id[1] == '5') {
1160 		f34->bl_version = 5;
1161 	} else if (f34->bootloader_id[1] == '6') {
1162 		f34->bl_version = 6;
1163 	} else if (f34->bootloader_id[1] == 7) {
1164 		f34->bl_version = 7;
1165 	} else if (f34->bootloader_id[1] == 8) {
1166 		f34->bl_version = 8;
1167 	} else {
1168 		dev_err(&f34->fn->dev,
1169 			"%s: Unrecognized bootloader version: %d (%c) %d (%c)\n",
1170 			__func__,
1171 			f34->bootloader_id[0], f34->bootloader_id[0],
1172 			f34->bootloader_id[1], f34->bootloader_id[1]);
1173 		return -EINVAL;
1174 	}
1175 
1176 	memset(&f34->v7.blkcount, 0x00, sizeof(f34->v7.blkcount));
1177 	memset(&f34->v7.phyaddr, 0x00, sizeof(f34->v7.phyaddr));
1178 
1179 	init_completion(&f34->v7.cmd_done);
1180 
1181 	ret = rmi_f34v7_read_queries(f34);
1182 	if (ret < 0)
1183 		return ret;
1184 
1185 	return 0;
1186 }
1187