1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Goodix Touchscreen firmware upload support
4  *
5  * Copyright (c) 2021 Hans de Goede <hdegoede@redhat.com>
6  *
7  * This is a rewrite of gt9xx_update.c from the Allwinner H3 BSP which is:
8  * Copyright (c) 2010 - 2012 Goodix Technology.
9  * Author: andrew@goodix.com
10  */
11 
12 #include <linux/device.h>
13 #include <linux/firmware.h>
14 #include <linux/i2c.h>
15 #include "goodix.h"
16 
17 #define GOODIX_FW_HEADER_LENGTH		sizeof(struct goodix_fw_header)
18 #define GOODIX_FW_SECTION_LENGTH	0x2000
19 #define GOODIX_FW_DSP_LENGTH		0x1000
20 #define GOODIX_FW_UPLOAD_ADDRESS	0xc000
21 
22 #define GOODIX_CFG_LOC_HAVE_KEY		 7
23 #define GOODIX_CFG_LOC_DRVA_NUM		27
24 #define GOODIX_CFG_LOC_DRVB_NUM		28
25 #define GOODIX_CFG_LOC_SENS_NUM		29
26 
27 struct goodix_fw_header {
28 	u8 hw_info[4];
29 	u8 pid[8];
30 	u8 vid[2];
31 } __packed;
32 
goodix_firmware_checksum(const u8 * data,int size)33 static u16 goodix_firmware_checksum(const u8 *data, int size)
34 {
35 	u16 checksum = 0;
36 	int i;
37 
38 	for (i = 0; i < size; i += 2)
39 		checksum += (data[i] << 8) + data[i + 1];
40 
41 	return checksum;
42 }
43 
goodix_firmware_verify(struct device * dev,const struct firmware * fw)44 static int goodix_firmware_verify(struct device *dev, const struct firmware *fw)
45 {
46 	const struct goodix_fw_header *fw_header;
47 	size_t expected_size;
48 	const u8 *data;
49 	u16 checksum;
50 	char buf[9];
51 
52 	expected_size = GOODIX_FW_HEADER_LENGTH + 4 * GOODIX_FW_SECTION_LENGTH +
53 			GOODIX_FW_DSP_LENGTH;
54 	if (fw->size != expected_size) {
55 		dev_err(dev, "Firmware has wrong size, expected %zu got %zu\n",
56 			expected_size, fw->size);
57 		return -EINVAL;
58 	}
59 
60 	data = fw->data + GOODIX_FW_HEADER_LENGTH;
61 	checksum = goodix_firmware_checksum(data, 4 * GOODIX_FW_SECTION_LENGTH);
62 	if (checksum) {
63 		dev_err(dev, "Main firmware checksum error\n");
64 		return -EINVAL;
65 	}
66 
67 	data += 4 * GOODIX_FW_SECTION_LENGTH;
68 	checksum = goodix_firmware_checksum(data, GOODIX_FW_DSP_LENGTH);
69 	if (checksum) {
70 		dev_err(dev, "DSP firmware checksum error\n");
71 		return -EINVAL;
72 	}
73 
74 	fw_header = (const struct goodix_fw_header *)fw->data;
75 	dev_info(dev, "Firmware hardware info %02x%02x%02x%02x\n",
76 		 fw_header->hw_info[0], fw_header->hw_info[1],
77 		 fw_header->hw_info[2], fw_header->hw_info[3]);
78 	/* pid is a 8 byte buffer containing a string, weird I know */
79 	memcpy(buf, fw_header->pid, 8);
80 	buf[8] = 0;
81 	dev_info(dev, "Firmware PID: %s VID: %02x%02x\n", buf,
82 		 fw_header->vid[0], fw_header->vid[1]);
83 	return 0;
84 }
85 
goodix_enter_upload_mode(struct i2c_client * client)86 static int goodix_enter_upload_mode(struct i2c_client *client)
87 {
88 	int tries, error;
89 	u8 val;
90 
91 	tries = 200;
92 	do {
93 		error = goodix_i2c_write_u8(client,
94 					    GOODIX_REG_MISCTL_SWRST, 0x0c);
95 		if (error)
96 			return error;
97 
98 		error = goodix_i2c_read(client,
99 					GOODIX_REG_MISCTL_SWRST, &val, 1);
100 		if (error)
101 			return error;
102 
103 		if (val == 0x0c)
104 			break;
105 	} while (--tries);
106 
107 	if (!tries) {
108 		dev_err(&client->dev, "Error could not hold ss51 & dsp\n");
109 		return -EIO;
110 	}
111 
112 	/* DSP_CK and DSP_ALU_CK PowerOn */
113 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_DSP_CTL, 0x00);
114 	if (error)
115 		return error;
116 
117 	/* Disable watchdog */
118 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_TMR0_EN, 0x00);
119 	if (error)
120 		return error;
121 
122 	/* Clear cache enable */
123 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_CACHE_EN, 0x00);
124 	if (error)
125 		return error;
126 
127 	/* Set boot from SRAM */
128 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_BOOTCTL, 0x02);
129 	if (error)
130 		return error;
131 
132 	/* Software reboot */
133 	error = goodix_i2c_write_u8(client,
134 				    GOODIX_REG_MISCTL_CPU_SWRST_PULSE, 0x01);
135 	if (error)
136 		return error;
137 
138 	/* Clear control flag */
139 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_BOOTCTL, 0x00);
140 	if (error)
141 		return error;
142 
143 	/* Set scramble */
144 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_BOOT_OPT, 0x00);
145 	if (error)
146 		return error;
147 
148 	/* Enable accessing code */
149 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_MEM_CD_EN, 0x01);
150 	if (error)
151 		return error;
152 
153 	return 0;
154 }
155 
goodix_start_firmware(struct i2c_client * client)156 static int goodix_start_firmware(struct i2c_client *client)
157 {
158 	int error;
159 	u8 val;
160 
161 	/* Init software watchdog */
162 	error = goodix_i2c_write_u8(client, GOODIX_REG_SW_WDT, 0xaa);
163 	if (error)
164 		return error;
165 
166 	/* Release SS51 & DSP */
167 	error = goodix_i2c_write_u8(client, GOODIX_REG_MISCTL_SWRST, 0x00);
168 	if (error)
169 		return error;
170 
171 	error = goodix_i2c_read(client, GOODIX_REG_SW_WDT, &val, 1);
172 	if (error)
173 		return error;
174 
175 	/* The value we've written to SW_WDT should have been cleared now */
176 	if (val == 0xaa) {
177 		dev_err(&client->dev, "Error SW_WDT reg not cleared on fw startup\n");
178 		return -EIO;
179 	}
180 
181 	/* Re-init software watchdog */
182 	error = goodix_i2c_write_u8(client, GOODIX_REG_SW_WDT, 0xaa);
183 	if (error)
184 		return error;
185 
186 	return 0;
187 }
188 
goodix_firmware_upload(struct goodix_ts_data * ts)189 static int goodix_firmware_upload(struct goodix_ts_data *ts)
190 {
191 	const struct firmware *fw;
192 	char fw_name[64];
193 	const u8 *data;
194 	int error;
195 
196 	snprintf(fw_name, sizeof(fw_name), "goodix/%s", ts->firmware_name);
197 
198 	error = request_firmware(&fw, fw_name, &ts->client->dev);
199 	if (error) {
200 		dev_err(&ts->client->dev, "Firmware request error %d\n", error);
201 		return error;
202 	}
203 
204 	error = goodix_firmware_verify(&ts->client->dev, fw);
205 	if (error)
206 		goto release;
207 
208 	error = goodix_reset_no_int_sync(ts);
209 	if (error)
210 		goto release;
211 
212 	error = goodix_enter_upload_mode(ts->client);
213 	if (error)
214 		goto release;
215 
216 	/* Select SRAM bank 0 and upload section 1 & 2 */
217 	error = goodix_i2c_write_u8(ts->client,
218 				    GOODIX_REG_MISCTL_SRAM_BANK, 0x00);
219 	if (error)
220 		goto release;
221 
222 	data = fw->data + GOODIX_FW_HEADER_LENGTH;
223 	error = goodix_i2c_write(ts->client, GOODIX_FW_UPLOAD_ADDRESS,
224 				 data, 2 * GOODIX_FW_SECTION_LENGTH);
225 	if (error)
226 		goto release;
227 
228 	/* Select SRAM bank 1 and upload section 3 & 4 */
229 	error = goodix_i2c_write_u8(ts->client,
230 				    GOODIX_REG_MISCTL_SRAM_BANK, 0x01);
231 	if (error)
232 		goto release;
233 
234 	data += 2 * GOODIX_FW_SECTION_LENGTH;
235 	error = goodix_i2c_write(ts->client, GOODIX_FW_UPLOAD_ADDRESS,
236 				 data, 2 * GOODIX_FW_SECTION_LENGTH);
237 	if (error)
238 		goto release;
239 
240 	/* Select SRAM bank 2 and upload the DSP firmware */
241 	error = goodix_i2c_write_u8(ts->client,
242 				    GOODIX_REG_MISCTL_SRAM_BANK, 0x02);
243 	if (error)
244 		goto release;
245 
246 	data += 2 * GOODIX_FW_SECTION_LENGTH;
247 	error = goodix_i2c_write(ts->client, GOODIX_FW_UPLOAD_ADDRESS,
248 				 data, GOODIX_FW_DSP_LENGTH);
249 	if (error)
250 		goto release;
251 
252 	error = goodix_start_firmware(ts->client);
253 	if (error)
254 		goto release;
255 
256 	error = goodix_int_sync(ts);
257 release:
258 	release_firmware(fw);
259 	return error;
260 }
261 
goodix_prepare_bak_ref(struct goodix_ts_data * ts)262 static int goodix_prepare_bak_ref(struct goodix_ts_data *ts)
263 {
264 	u8 have_key, driver_num, sensor_num;
265 
266 	if (ts->bak_ref)
267 		return 0; /* Already done */
268 
269 	have_key = (ts->config[GOODIX_CFG_LOC_HAVE_KEY] & 0x01);
270 
271 	driver_num = (ts->config[GOODIX_CFG_LOC_DRVA_NUM] & 0x1f) +
272 		     (ts->config[GOODIX_CFG_LOC_DRVB_NUM] & 0x1f);
273 	if (have_key)
274 		driver_num--;
275 
276 	sensor_num = (ts->config[GOODIX_CFG_LOC_SENS_NUM] & 0x0f) +
277 		     ((ts->config[GOODIX_CFG_LOC_SENS_NUM] >> 4) & 0x0f);
278 
279 	dev_dbg(&ts->client->dev, "Drv %d Sen %d Key %d\n",
280 		driver_num, sensor_num, have_key);
281 
282 	ts->bak_ref_len = (driver_num * (sensor_num - 2) + 2) * 2;
283 
284 	ts->bak_ref = devm_kzalloc(&ts->client->dev,
285 				   ts->bak_ref_len, GFP_KERNEL);
286 	if (!ts->bak_ref)
287 		return -ENOMEM;
288 
289 	/*
290 	 * The bak_ref array contains the backup of an array of (self/auto)
291 	 * calibration related values which the Android version of the driver
292 	 * stores on the filesystem so that it can be restored after reboot.
293 	 * The mainline kernel never writes directly to the filesystem like
294 	 * this, we always start will all the values which give a correction
295 	 * factor in approx. the -20 - +20 range (in 2s complement) set to 0.
296 	 *
297 	 * Note the touchscreen works fine without restoring the reference
298 	 * values after a reboot / power-cycle.
299 	 *
300 	 * The last 2 bytes are a 16 bits unsigned checksum which is expected
301 	 * to make the addition al all 16 bit unsigned values in the array add
302 	 * up to 1 (rather then the usual 0), so we must set the last byte to 1.
303 	 */
304 	ts->bak_ref[ts->bak_ref_len - 1] = 1;
305 
306 	return 0;
307 }
308 
goodix_send_main_clock(struct goodix_ts_data * ts)309 static int goodix_send_main_clock(struct goodix_ts_data *ts)
310 {
311 	u32 main_clk = 54; /* Default main clock */
312 	u8 checksum = 0;
313 	int i;
314 
315 	device_property_read_u32(&ts->client->dev,
316 				 "goodix,main-clk", &main_clk);
317 
318 	for (i = 0; i < (GOODIX_MAIN_CLK_LEN - 1); i++) {
319 		ts->main_clk[i] = main_clk;
320 		checksum += main_clk;
321 	}
322 
323 	/* The value of all bytes combines must be 0 */
324 	ts->main_clk[GOODIX_MAIN_CLK_LEN - 1] = 256 - checksum;
325 
326 	return goodix_i2c_write(ts->client, GOODIX_REG_MAIN_CLK,
327 				ts->main_clk, GOODIX_MAIN_CLK_LEN);
328 }
329 
goodix_firmware_check(struct goodix_ts_data * ts)330 int goodix_firmware_check(struct goodix_ts_data *ts)
331 {
332 	device_property_read_string(&ts->client->dev,
333 				    "firmware-name", &ts->firmware_name);
334 	if (!ts->firmware_name)
335 		return 0;
336 
337 	if (ts->irq_pin_access_method == IRQ_PIN_ACCESS_NONE) {
338 		dev_err(&ts->client->dev, "Error no IRQ-pin access method, cannot upload fw.\n");
339 		return -EINVAL;
340 	}
341 
342 	dev_info(&ts->client->dev, "Touchscreen controller needs fw-upload\n");
343 	ts->load_cfg_from_disk = true;
344 
345 	return goodix_firmware_upload(ts);
346 }
347 
goodix_handle_fw_request(struct goodix_ts_data * ts)348 bool goodix_handle_fw_request(struct goodix_ts_data *ts)
349 {
350 	int error;
351 	u8 val;
352 
353 	error = goodix_i2c_read(ts->client, GOODIX_REG_REQUEST, &val, 1);
354 	if (error)
355 		return false;
356 
357 	switch (val) {
358 	case GOODIX_RQST_RESPONDED:
359 		/*
360 		 * If we read back our own last ack the IRQ was not for
361 		 * a request.
362 		 */
363 		return false;
364 	case GOODIX_RQST_CONFIG:
365 		error = goodix_send_cfg(ts, ts->config, ts->chip->config_len);
366 		if (error)
367 			return false;
368 
369 		break;
370 	case GOODIX_RQST_BAK_REF:
371 		error = goodix_prepare_bak_ref(ts);
372 		if (error)
373 			return false;
374 
375 		error = goodix_i2c_write(ts->client, GOODIX_REG_BAK_REF,
376 					 ts->bak_ref, ts->bak_ref_len);
377 		if (error)
378 			return false;
379 
380 		break;
381 	case GOODIX_RQST_RESET:
382 		error = goodix_firmware_upload(ts);
383 		if (error)
384 			return false;
385 
386 		break;
387 	case GOODIX_RQST_MAIN_CLOCK:
388 		error = goodix_send_main_clock(ts);
389 		if (error)
390 			return false;
391 
392 		break;
393 	case GOODIX_RQST_UNKNOWN:
394 	case GOODIX_RQST_IDLE:
395 		break;
396 	default:
397 		dev_err_ratelimited(&ts->client->dev, "Unknown Request: 0x%02x\n", val);
398 	}
399 
400 	/* Ack the request */
401 	goodix_i2c_write_u8(ts->client,
402 			    GOODIX_REG_REQUEST, GOODIX_RQST_RESPONDED);
403 	return true;
404 }
405 
goodix_save_bak_ref(struct goodix_ts_data * ts)406 void goodix_save_bak_ref(struct goodix_ts_data *ts)
407 {
408 	int error;
409 	u8 val;
410 
411 	if (!ts->firmware_name)
412 		return;
413 
414 	error = goodix_i2c_read(ts->client, GOODIX_REG_STATUS, &val, 1);
415 	if (error)
416 		return;
417 
418 	if (!(val & 0x80))
419 		return;
420 
421 	error = goodix_i2c_read(ts->client, GOODIX_REG_BAK_REF,
422 				ts->bak_ref, ts->bak_ref_len);
423 	if (error) {
424 		memset(ts->bak_ref, 0, ts->bak_ref_len);
425 		ts->bak_ref[ts->bak_ref_len - 1] = 1;
426 	}
427 }
428