1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * UCSI driver for Cypress CCGx Type-C controller 4 * 5 * Copyright (C) 2017-2018 NVIDIA Corporation. All rights reserved. 6 * Author: Ajay Gupta <ajayg@nvidia.com> 7 * 8 * Some code borrowed from drivers/usb/typec/ucsi/ucsi_acpi.c 9 */ 10 #include <linux/acpi.h> 11 #include <linux/delay.h> 12 #include <linux/firmware.h> 13 #include <linux/i2c.h> 14 #include <linux/module.h> 15 #include <linux/pci.h> 16 #include <linux/platform_device.h> 17 18 #include <asm/unaligned.h> 19 #include "ucsi.h" 20 21 enum enum_fw_mode { 22 BOOT, /* bootloader */ 23 FW1, /* FW partition-1 (contains secondary fw) */ 24 FW2, /* FW partition-2 (contains primary fw) */ 25 FW_INVALID, 26 }; 27 28 #define CCGX_RAB_DEVICE_MODE 0x0000 29 #define CCGX_RAB_INTR_REG 0x0006 30 #define DEV_INT BIT(0) 31 #define PORT0_INT BIT(1) 32 #define PORT1_INT BIT(2) 33 #define UCSI_READ_INT BIT(7) 34 #define CCGX_RAB_JUMP_TO_BOOT 0x0007 35 #define TO_BOOT 'J' 36 #define TO_ALT_FW 'A' 37 #define CCGX_RAB_RESET_REQ 0x0008 38 #define RESET_SIG 'R' 39 #define CMD_RESET_I2C 0x0 40 #define CMD_RESET_DEV 0x1 41 #define CCGX_RAB_ENTER_FLASHING 0x000A 42 #define FLASH_ENTER_SIG 'P' 43 #define CCGX_RAB_VALIDATE_FW 0x000B 44 #define CCGX_RAB_FLASH_ROW_RW 0x000C 45 #define FLASH_SIG 'F' 46 #define FLASH_RD_CMD 0x0 47 #define FLASH_WR_CMD 0x1 48 #define FLASH_FWCT1_WR_CMD 0x2 49 #define FLASH_FWCT2_WR_CMD 0x3 50 #define FLASH_FWCT_SIG_WR_CMD 0x4 51 #define CCGX_RAB_READ_ALL_VER 0x0010 52 #define CCGX_RAB_READ_FW2_VER 0x0020 53 #define CCGX_RAB_UCSI_CONTROL 0x0039 54 #define CCGX_RAB_UCSI_CONTROL_START BIT(0) 55 #define CCGX_RAB_UCSI_CONTROL_STOP BIT(1) 56 #define CCGX_RAB_UCSI_DATA_BLOCK(offset) (0xf000 | ((offset) & 0xff)) 57 #define REG_FLASH_RW_MEM 0x0200 58 #define DEV_REG_IDX CCGX_RAB_DEVICE_MODE 59 #define CCGX_RAB_PDPORT_ENABLE 0x002C 60 #define PDPORT_1 BIT(0) 61 #define PDPORT_2 BIT(1) 62 #define CCGX_RAB_RESPONSE 0x007E 63 #define ASYNC_EVENT BIT(7) 64 65 /* CCGx events & async msg codes */ 66 #define RESET_COMPLETE 0x80 67 #define EVENT_INDEX RESET_COMPLETE 68 #define PORT_CONNECT_DET 0x84 69 #define PORT_DISCONNECT_DET 0x85 70 #define ROLE_SWAP_COMPELETE 0x87 71 72 /* ccg firmware */ 73 #define CYACD_LINE_SIZE 527 74 #define CCG4_ROW_SIZE 256 75 #define FW1_METADATA_ROW 0x1FF 76 #define FW2_METADATA_ROW 0x1FE 77 #define FW_CFG_TABLE_SIG_SIZE 256 78 79 static int secondary_fw_min_ver = 41; 80 81 enum enum_flash_mode { 82 SECONDARY_BL, /* update secondary using bootloader */ 83 PRIMARY, /* update primary using secondary */ 84 SECONDARY, /* update secondary using primary */ 85 FLASH_NOT_NEEDED, /* update not required */ 86 FLASH_INVALID, 87 }; 88 89 static const char * const ccg_fw_names[] = { 90 "ccg_boot.cyacd", 91 "ccg_primary.cyacd", 92 "ccg_secondary.cyacd" 93 }; 94 95 struct ccg_dev_info { 96 #define CCG_DEVINFO_FWMODE_SHIFT (0) 97 #define CCG_DEVINFO_FWMODE_MASK (0x3 << CCG_DEVINFO_FWMODE_SHIFT) 98 #define CCG_DEVINFO_PDPORTS_SHIFT (2) 99 #define CCG_DEVINFO_PDPORTS_MASK (0x3 << CCG_DEVINFO_PDPORTS_SHIFT) 100 u8 mode; 101 u8 bl_mode; 102 __le16 silicon_id; 103 __le16 bl_last_row; 104 } __packed; 105 106 struct version_format { 107 __le16 build; 108 u8 patch; 109 u8 ver; 110 #define CCG_VERSION_MIN_SHIFT (0) 111 #define CCG_VERSION_MIN_MASK (0xf << CCG_VERSION_MIN_SHIFT) 112 #define CCG_VERSION_MAJ_SHIFT (4) 113 #define CCG_VERSION_MAJ_MASK (0xf << CCG_VERSION_MAJ_SHIFT) 114 } __packed; 115 116 struct version_info { 117 struct version_format base; 118 struct version_format app; 119 }; 120 121 struct fw_config_table { 122 u32 identity; 123 u16 table_size; 124 u8 fwct_version; 125 u8 is_key_change; 126 u8 guid[16]; 127 struct version_format base; 128 struct version_format app; 129 u8 primary_fw_digest[32]; 130 u32 key_exp_length; 131 u8 key_modulus[256]; 132 u8 key_exp[4]; 133 }; 134 135 /* CCGx response codes */ 136 enum ccg_resp_code { 137 CMD_NO_RESP = 0x00, 138 CMD_SUCCESS = 0x02, 139 FLASH_DATA_AVAILABLE = 0x03, 140 CMD_INVALID = 0x05, 141 FLASH_UPDATE_FAIL = 0x07, 142 INVALID_FW = 0x08, 143 INVALID_ARG = 0x09, 144 CMD_NOT_SUPPORT = 0x0A, 145 TRANSACTION_FAIL = 0x0C, 146 PD_CMD_FAIL = 0x0D, 147 UNDEF_ERROR = 0x0F, 148 INVALID_RESP = 0x10, 149 }; 150 151 #define CCG_EVENT_MAX (EVENT_INDEX + 43) 152 153 struct ccg_cmd { 154 u16 reg; 155 u32 data; 156 int len; 157 u32 delay; /* ms delay for cmd timeout */ 158 }; 159 160 struct ccg_resp { 161 u8 code; 162 u8 length; 163 }; 164 165 struct ucsi_ccg { 166 struct device *dev; 167 struct ucsi *ucsi; 168 struct ucsi_ppm ppm; 169 struct i2c_client *client; 170 struct ccg_dev_info info; 171 /* version info for boot, primary and secondary */ 172 struct version_info version[FW2 + 1]; 173 /* CCG HPI communication flags */ 174 unsigned long flags; 175 #define RESET_PENDING 0 176 #define DEV_CMD_PENDING 1 177 struct ccg_resp dev_resp; 178 u8 cmd_resp; 179 int port_num; 180 int irq; 181 struct work_struct work; 182 struct mutex lock; /* to sync between user and driver thread */ 183 184 /* fw build with vendor information */ 185 u16 fw_build; 186 }; 187 188 static int ccg_read(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len) 189 { 190 struct i2c_client *client = uc->client; 191 const struct i2c_adapter_quirks *quirks = client->adapter->quirks; 192 unsigned char buf[2]; 193 struct i2c_msg msgs[] = { 194 { 195 .addr = client->addr, 196 .flags = 0x0, 197 .len = sizeof(buf), 198 .buf = buf, 199 }, 200 { 201 .addr = client->addr, 202 .flags = I2C_M_RD, 203 .buf = data, 204 }, 205 }; 206 u32 rlen, rem_len = len, max_read_len = len; 207 int status; 208 209 /* check any max_read_len limitation on i2c adapter */ 210 if (quirks && quirks->max_read_len) 211 max_read_len = quirks->max_read_len; 212 213 while (rem_len > 0) { 214 msgs[1].buf = &data[len - rem_len]; 215 rlen = min_t(u16, rem_len, max_read_len); 216 msgs[1].len = rlen; 217 put_unaligned_le16(rab, buf); 218 status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs)); 219 if (status < 0) { 220 dev_err(uc->dev, "i2c_transfer failed %d\n", status); 221 return status; 222 } 223 rab += rlen; 224 rem_len -= rlen; 225 } 226 227 return 0; 228 } 229 230 static int ccg_write(struct ucsi_ccg *uc, u16 rab, u8 *data, u32 len) 231 { 232 struct i2c_client *client = uc->client; 233 unsigned char *buf; 234 struct i2c_msg msgs[] = { 235 { 236 .addr = client->addr, 237 .flags = 0x0, 238 } 239 }; 240 int status; 241 242 buf = kzalloc(len + sizeof(rab), GFP_KERNEL); 243 if (!buf) 244 return -ENOMEM; 245 246 put_unaligned_le16(rab, buf); 247 memcpy(buf + sizeof(rab), data, len); 248 249 msgs[0].len = len + sizeof(rab); 250 msgs[0].buf = buf; 251 252 status = i2c_transfer(client->adapter, msgs, ARRAY_SIZE(msgs)); 253 if (status < 0) { 254 dev_err(uc->dev, "i2c_transfer failed %d\n", status); 255 kfree(buf); 256 return status; 257 } 258 259 kfree(buf); 260 return 0; 261 } 262 263 static int ucsi_ccg_init(struct ucsi_ccg *uc) 264 { 265 unsigned int count = 10; 266 u8 data; 267 int status; 268 269 data = CCGX_RAB_UCSI_CONTROL_STOP; 270 status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data)); 271 if (status < 0) 272 return status; 273 274 data = CCGX_RAB_UCSI_CONTROL_START; 275 status = ccg_write(uc, CCGX_RAB_UCSI_CONTROL, &data, sizeof(data)); 276 if (status < 0) 277 return status; 278 279 /* 280 * Flush CCGx RESPONSE queue by acking interrupts. Above ucsi control 281 * register write will push response which must be cleared. 282 */ 283 do { 284 status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data)); 285 if (status < 0) 286 return status; 287 288 if (!data) 289 return 0; 290 291 status = ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data)); 292 if (status < 0) 293 return status; 294 295 usleep_range(10000, 11000); 296 } while (--count); 297 298 return -ETIMEDOUT; 299 } 300 301 static int ucsi_ccg_send_data(struct ucsi_ccg *uc) 302 { 303 u8 *ppm = (u8 *)uc->ppm.data; 304 int status; 305 u16 rab; 306 307 rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_out)); 308 status = ccg_write(uc, rab, ppm + 309 offsetof(struct ucsi_data, message_out), 310 sizeof(uc->ppm.data->message_out)); 311 if (status < 0) 312 return status; 313 314 rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, ctrl)); 315 return ccg_write(uc, rab, ppm + offsetof(struct ucsi_data, ctrl), 316 sizeof(uc->ppm.data->ctrl)); 317 } 318 319 static int ucsi_ccg_recv_data(struct ucsi_ccg *uc) 320 { 321 u8 *ppm = (u8 *)uc->ppm.data; 322 int status; 323 u16 rab; 324 325 rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, cci)); 326 status = ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, cci), 327 sizeof(uc->ppm.data->cci)); 328 if (status < 0) 329 return status; 330 331 rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, message_in)); 332 return ccg_read(uc, rab, ppm + offsetof(struct ucsi_data, message_in), 333 sizeof(uc->ppm.data->message_in)); 334 } 335 336 static int ucsi_ccg_ack_interrupt(struct ucsi_ccg *uc) 337 { 338 int status; 339 unsigned char data; 340 341 status = ccg_read(uc, CCGX_RAB_INTR_REG, &data, sizeof(data)); 342 if (status < 0) 343 return status; 344 345 return ccg_write(uc, CCGX_RAB_INTR_REG, &data, sizeof(data)); 346 } 347 348 static int ucsi_ccg_sync(struct ucsi_ppm *ppm) 349 { 350 struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm); 351 int status; 352 353 status = ucsi_ccg_recv_data(uc); 354 if (status < 0) 355 return status; 356 357 /* ack interrupt to allow next command to run */ 358 return ucsi_ccg_ack_interrupt(uc); 359 } 360 361 static int ucsi_ccg_cmd(struct ucsi_ppm *ppm, struct ucsi_control *ctrl) 362 { 363 struct ucsi_ccg *uc = container_of(ppm, struct ucsi_ccg, ppm); 364 365 ppm->data->ctrl.raw_cmd = ctrl->raw_cmd; 366 return ucsi_ccg_send_data(uc); 367 } 368 369 static irqreturn_t ccg_irq_handler(int irq, void *data) 370 { 371 struct ucsi_ccg *uc = data; 372 373 ucsi_notify(uc->ucsi); 374 375 return IRQ_HANDLED; 376 } 377 378 static int get_fw_info(struct ucsi_ccg *uc) 379 { 380 int err; 381 382 err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)(&uc->version), 383 sizeof(uc->version)); 384 if (err < 0) 385 return err; 386 387 err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info), 388 sizeof(uc->info)); 389 if (err < 0) 390 return err; 391 392 return 0; 393 } 394 395 static inline bool invalid_async_evt(int code) 396 { 397 return (code >= CCG_EVENT_MAX) || (code < EVENT_INDEX); 398 } 399 400 static void ccg_process_response(struct ucsi_ccg *uc) 401 { 402 struct device *dev = uc->dev; 403 404 if (uc->dev_resp.code & ASYNC_EVENT) { 405 if (uc->dev_resp.code == RESET_COMPLETE) { 406 if (test_bit(RESET_PENDING, &uc->flags)) 407 uc->cmd_resp = uc->dev_resp.code; 408 get_fw_info(uc); 409 } 410 if (invalid_async_evt(uc->dev_resp.code)) 411 dev_err(dev, "invalid async evt %d\n", 412 uc->dev_resp.code); 413 } else { 414 if (test_bit(DEV_CMD_PENDING, &uc->flags)) { 415 uc->cmd_resp = uc->dev_resp.code; 416 clear_bit(DEV_CMD_PENDING, &uc->flags); 417 } else { 418 dev_err(dev, "dev resp 0x%04x but no cmd pending\n", 419 uc->dev_resp.code); 420 } 421 } 422 } 423 424 static int ccg_read_response(struct ucsi_ccg *uc) 425 { 426 unsigned long target = jiffies + msecs_to_jiffies(1000); 427 struct device *dev = uc->dev; 428 u8 intval; 429 int status; 430 431 /* wait for interrupt status to get updated */ 432 do { 433 status = ccg_read(uc, CCGX_RAB_INTR_REG, &intval, 434 sizeof(intval)); 435 if (status < 0) 436 return status; 437 438 if (intval & DEV_INT) 439 break; 440 usleep_range(500, 600); 441 } while (time_is_after_jiffies(target)); 442 443 if (time_is_before_jiffies(target)) { 444 dev_err(dev, "response timeout error\n"); 445 return -ETIME; 446 } 447 448 status = ccg_read(uc, CCGX_RAB_RESPONSE, (u8 *)&uc->dev_resp, 449 sizeof(uc->dev_resp)); 450 if (status < 0) 451 return status; 452 453 status = ccg_write(uc, CCGX_RAB_INTR_REG, &intval, sizeof(intval)); 454 if (status < 0) 455 return status; 456 457 return 0; 458 } 459 460 /* Caller must hold uc->lock */ 461 static int ccg_send_command(struct ucsi_ccg *uc, struct ccg_cmd *cmd) 462 { 463 struct device *dev = uc->dev; 464 int ret; 465 466 switch (cmd->reg & 0xF000) { 467 case DEV_REG_IDX: 468 set_bit(DEV_CMD_PENDING, &uc->flags); 469 break; 470 default: 471 dev_err(dev, "invalid cmd register\n"); 472 break; 473 } 474 475 ret = ccg_write(uc, cmd->reg, (u8 *)&cmd->data, cmd->len); 476 if (ret < 0) 477 return ret; 478 479 msleep(cmd->delay); 480 481 ret = ccg_read_response(uc); 482 if (ret < 0) { 483 dev_err(dev, "response read error\n"); 484 switch (cmd->reg & 0xF000) { 485 case DEV_REG_IDX: 486 clear_bit(DEV_CMD_PENDING, &uc->flags); 487 break; 488 default: 489 dev_err(dev, "invalid cmd register\n"); 490 break; 491 } 492 return -EIO; 493 } 494 ccg_process_response(uc); 495 496 return uc->cmd_resp; 497 } 498 499 static int ccg_cmd_enter_flashing(struct ucsi_ccg *uc) 500 { 501 struct ccg_cmd cmd; 502 int ret; 503 504 cmd.reg = CCGX_RAB_ENTER_FLASHING; 505 cmd.data = FLASH_ENTER_SIG; 506 cmd.len = 1; 507 cmd.delay = 50; 508 509 mutex_lock(&uc->lock); 510 511 ret = ccg_send_command(uc, &cmd); 512 513 mutex_unlock(&uc->lock); 514 515 if (ret != CMD_SUCCESS) { 516 dev_err(uc->dev, "enter flashing failed ret=%d\n", ret); 517 return ret; 518 } 519 520 return 0; 521 } 522 523 static int ccg_cmd_reset(struct ucsi_ccg *uc) 524 { 525 struct ccg_cmd cmd; 526 u8 *p; 527 int ret; 528 529 p = (u8 *)&cmd.data; 530 cmd.reg = CCGX_RAB_RESET_REQ; 531 p[0] = RESET_SIG; 532 p[1] = CMD_RESET_DEV; 533 cmd.len = 2; 534 cmd.delay = 5000; 535 536 mutex_lock(&uc->lock); 537 538 set_bit(RESET_PENDING, &uc->flags); 539 540 ret = ccg_send_command(uc, &cmd); 541 if (ret != RESET_COMPLETE) 542 goto err_clear_flag; 543 544 ret = 0; 545 546 err_clear_flag: 547 clear_bit(RESET_PENDING, &uc->flags); 548 549 mutex_unlock(&uc->lock); 550 551 return ret; 552 } 553 554 static int ccg_cmd_port_control(struct ucsi_ccg *uc, bool enable) 555 { 556 struct ccg_cmd cmd; 557 int ret; 558 559 cmd.reg = CCGX_RAB_PDPORT_ENABLE; 560 if (enable) 561 cmd.data = (uc->port_num == 1) ? 562 PDPORT_1 : (PDPORT_1 | PDPORT_2); 563 else 564 cmd.data = 0x0; 565 cmd.len = 1; 566 cmd.delay = 10; 567 568 mutex_lock(&uc->lock); 569 570 ret = ccg_send_command(uc, &cmd); 571 572 mutex_unlock(&uc->lock); 573 574 if (ret != CMD_SUCCESS) { 575 dev_err(uc->dev, "port control failed ret=%d\n", ret); 576 return ret; 577 } 578 return 0; 579 } 580 581 static int ccg_cmd_jump_boot_mode(struct ucsi_ccg *uc, int bl_mode) 582 { 583 struct ccg_cmd cmd; 584 int ret; 585 586 cmd.reg = CCGX_RAB_JUMP_TO_BOOT; 587 588 if (bl_mode) 589 cmd.data = TO_BOOT; 590 else 591 cmd.data = TO_ALT_FW; 592 593 cmd.len = 1; 594 cmd.delay = 100; 595 596 mutex_lock(&uc->lock); 597 598 set_bit(RESET_PENDING, &uc->flags); 599 600 ret = ccg_send_command(uc, &cmd); 601 if (ret != RESET_COMPLETE) 602 goto err_clear_flag; 603 604 ret = 0; 605 606 err_clear_flag: 607 clear_bit(RESET_PENDING, &uc->flags); 608 609 mutex_unlock(&uc->lock); 610 611 return ret; 612 } 613 614 static int 615 ccg_cmd_write_flash_row(struct ucsi_ccg *uc, u16 row, 616 const void *data, u8 fcmd) 617 { 618 struct i2c_client *client = uc->client; 619 struct ccg_cmd cmd; 620 u8 buf[CCG4_ROW_SIZE + 2]; 621 u8 *p; 622 int ret; 623 624 /* Copy the data into the flash read/write memory. */ 625 put_unaligned_le16(REG_FLASH_RW_MEM, buf); 626 627 memcpy(buf + 2, data, CCG4_ROW_SIZE); 628 629 mutex_lock(&uc->lock); 630 631 ret = i2c_master_send(client, buf, CCG4_ROW_SIZE + 2); 632 if (ret != CCG4_ROW_SIZE + 2) { 633 dev_err(uc->dev, "REG_FLASH_RW_MEM write fail %d\n", ret); 634 mutex_unlock(&uc->lock); 635 return ret < 0 ? ret : -EIO; 636 } 637 638 /* Use the FLASH_ROW_READ_WRITE register to trigger */ 639 /* writing of data to the desired flash row */ 640 p = (u8 *)&cmd.data; 641 cmd.reg = CCGX_RAB_FLASH_ROW_RW; 642 p[0] = FLASH_SIG; 643 p[1] = fcmd; 644 put_unaligned_le16(row, &p[2]); 645 cmd.len = 4; 646 cmd.delay = 50; 647 if (fcmd == FLASH_FWCT_SIG_WR_CMD) 648 cmd.delay += 400; 649 if (row == 510) 650 cmd.delay += 220; 651 ret = ccg_send_command(uc, &cmd); 652 653 mutex_unlock(&uc->lock); 654 655 if (ret != CMD_SUCCESS) { 656 dev_err(uc->dev, "write flash row failed ret=%d\n", ret); 657 return ret; 658 } 659 660 return 0; 661 } 662 663 static int ccg_cmd_validate_fw(struct ucsi_ccg *uc, unsigned int fwid) 664 { 665 struct ccg_cmd cmd; 666 int ret; 667 668 cmd.reg = CCGX_RAB_VALIDATE_FW; 669 cmd.data = fwid; 670 cmd.len = 1; 671 cmd.delay = 500; 672 673 mutex_lock(&uc->lock); 674 675 ret = ccg_send_command(uc, &cmd); 676 677 mutex_unlock(&uc->lock); 678 679 if (ret != CMD_SUCCESS) 680 return ret; 681 682 return 0; 683 } 684 685 static bool ccg_check_vendor_version(struct ucsi_ccg *uc, 686 struct version_format *app, 687 struct fw_config_table *fw_cfg) 688 { 689 struct device *dev = uc->dev; 690 691 /* Check if the fw build is for supported vendors */ 692 if (le16_to_cpu(app->build) != uc->fw_build) { 693 dev_info(dev, "current fw is not from supported vendor\n"); 694 return false; 695 } 696 697 /* Check if the new fw build is for supported vendors */ 698 if (le16_to_cpu(fw_cfg->app.build) != uc->fw_build) { 699 dev_info(dev, "new fw is not from supported vendor\n"); 700 return false; 701 } 702 return true; 703 } 704 705 static bool ccg_check_fw_version(struct ucsi_ccg *uc, const char *fw_name, 706 struct version_format *app) 707 { 708 const struct firmware *fw = NULL; 709 struct device *dev = uc->dev; 710 struct fw_config_table fw_cfg; 711 u32 cur_version, new_version; 712 bool is_later = false; 713 714 if (request_firmware(&fw, fw_name, dev) != 0) { 715 dev_err(dev, "error: Failed to open cyacd file %s\n", fw_name); 716 return false; 717 } 718 719 /* 720 * check if signed fw 721 * last part of fw image is fw cfg table and signature 722 */ 723 if (fw->size < sizeof(fw_cfg) + FW_CFG_TABLE_SIG_SIZE) 724 goto out_release_firmware; 725 726 memcpy((uint8_t *)&fw_cfg, fw->data + fw->size - 727 sizeof(fw_cfg) - FW_CFG_TABLE_SIG_SIZE, sizeof(fw_cfg)); 728 729 if (fw_cfg.identity != ('F' | 'W' << 8 | 'C' << 16 | 'T' << 24)) { 730 dev_info(dev, "not a signed image\n"); 731 goto out_release_firmware; 732 } 733 734 /* compare input version with FWCT version */ 735 cur_version = le16_to_cpu(app->build) | app->patch << 16 | 736 app->ver << 24; 737 738 new_version = le16_to_cpu(fw_cfg.app.build) | fw_cfg.app.patch << 16 | 739 fw_cfg.app.ver << 24; 740 741 if (!ccg_check_vendor_version(uc, app, &fw_cfg)) 742 goto out_release_firmware; 743 744 if (new_version > cur_version) 745 is_later = true; 746 747 out_release_firmware: 748 release_firmware(fw); 749 return is_later; 750 } 751 752 static int ccg_fw_update_needed(struct ucsi_ccg *uc, 753 enum enum_flash_mode *mode) 754 { 755 struct device *dev = uc->dev; 756 int err; 757 struct version_info version[3]; 758 759 err = ccg_read(uc, CCGX_RAB_DEVICE_MODE, (u8 *)(&uc->info), 760 sizeof(uc->info)); 761 if (err) { 762 dev_err(dev, "read device mode failed\n"); 763 return err; 764 } 765 766 err = ccg_read(uc, CCGX_RAB_READ_ALL_VER, (u8 *)version, 767 sizeof(version)); 768 if (err) { 769 dev_err(dev, "read device mode failed\n"); 770 return err; 771 } 772 773 if (memcmp(&version[FW1], "\0\0\0\0\0\0\0\0", 774 sizeof(struct version_info)) == 0) { 775 dev_info(dev, "secondary fw is not flashed\n"); 776 *mode = SECONDARY_BL; 777 } else if (le16_to_cpu(version[FW1].base.build) < 778 secondary_fw_min_ver) { 779 dev_info(dev, "secondary fw version is too low (< %d)\n", 780 secondary_fw_min_ver); 781 *mode = SECONDARY; 782 } else if (memcmp(&version[FW2], "\0\0\0\0\0\0\0\0", 783 sizeof(struct version_info)) == 0) { 784 dev_info(dev, "primary fw is not flashed\n"); 785 *mode = PRIMARY; 786 } else if (ccg_check_fw_version(uc, ccg_fw_names[PRIMARY], 787 &version[FW2].app)) { 788 dev_info(dev, "found primary fw with later version\n"); 789 *mode = PRIMARY; 790 } else { 791 dev_info(dev, "secondary and primary fw are the latest\n"); 792 *mode = FLASH_NOT_NEEDED; 793 } 794 return 0; 795 } 796 797 static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode) 798 { 799 struct device *dev = uc->dev; 800 const struct firmware *fw = NULL; 801 const char *p, *s; 802 const char *eof; 803 int err, row, len, line_sz, line_cnt = 0; 804 unsigned long start_time = jiffies; 805 struct fw_config_table fw_cfg; 806 u8 fw_cfg_sig[FW_CFG_TABLE_SIG_SIZE]; 807 u8 *wr_buf; 808 809 err = request_firmware(&fw, ccg_fw_names[mode], dev); 810 if (err) { 811 dev_err(dev, "request %s failed err=%d\n", 812 ccg_fw_names[mode], err); 813 return err; 814 } 815 816 if (((uc->info.mode & CCG_DEVINFO_FWMODE_MASK) >> 817 CCG_DEVINFO_FWMODE_SHIFT) == FW2) { 818 err = ccg_cmd_port_control(uc, false); 819 if (err < 0) 820 goto release_fw; 821 err = ccg_cmd_jump_boot_mode(uc, 0); 822 if (err < 0) 823 goto release_fw; 824 } 825 826 eof = fw->data + fw->size; 827 828 /* 829 * check if signed fw 830 * last part of fw image is fw cfg table and signature 831 */ 832 if (fw->size < sizeof(fw_cfg) + sizeof(fw_cfg_sig)) 833 goto not_signed_fw; 834 835 memcpy((uint8_t *)&fw_cfg, fw->data + fw->size - 836 sizeof(fw_cfg) - sizeof(fw_cfg_sig), sizeof(fw_cfg)); 837 838 if (fw_cfg.identity != ('F' | ('W' << 8) | ('C' << 16) | ('T' << 24))) { 839 dev_info(dev, "not a signed image\n"); 840 goto not_signed_fw; 841 } 842 eof = fw->data + fw->size - sizeof(fw_cfg) - sizeof(fw_cfg_sig); 843 844 memcpy((uint8_t *)&fw_cfg_sig, 845 fw->data + fw->size - sizeof(fw_cfg_sig), sizeof(fw_cfg_sig)); 846 847 /* flash fw config table and signature first */ 848 err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg, 849 FLASH_FWCT1_WR_CMD); 850 if (err) 851 goto release_fw; 852 853 err = ccg_cmd_write_flash_row(uc, 0, (u8 *)&fw_cfg + CCG4_ROW_SIZE, 854 FLASH_FWCT2_WR_CMD); 855 if (err) 856 goto release_fw; 857 858 err = ccg_cmd_write_flash_row(uc, 0, &fw_cfg_sig, 859 FLASH_FWCT_SIG_WR_CMD); 860 if (err) 861 goto release_fw; 862 863 not_signed_fw: 864 wr_buf = kzalloc(CCG4_ROW_SIZE + 4, GFP_KERNEL); 865 if (!wr_buf) 866 return -ENOMEM; 867 868 err = ccg_cmd_enter_flashing(uc); 869 if (err) 870 goto release_mem; 871 872 /***************************************************************** 873 * CCG firmware image (.cyacd) file line format 874 * 875 * :00rrrrllll[dd....]cc/r/n 876 * 877 * :00 header 878 * rrrr is row number to flash (4 char) 879 * llll is data len to flash (4 char) 880 * dd is a data field represents one byte of data (512 char) 881 * cc is checksum (2 char) 882 * \r\n newline 883 * 884 * Total length: 3 + 4 + 4 + 512 + 2 + 2 = 527 885 * 886 *****************************************************************/ 887 888 p = strnchr(fw->data, fw->size, ':'); 889 while (p < eof) { 890 s = strnchr(p + 1, eof - p - 1, ':'); 891 892 if (!s) 893 s = eof; 894 895 line_sz = s - p; 896 897 if (line_sz != CYACD_LINE_SIZE) { 898 dev_err(dev, "Bad FW format line_sz=%d\n", line_sz); 899 err = -EINVAL; 900 goto release_mem; 901 } 902 903 if (hex2bin(wr_buf, p + 3, CCG4_ROW_SIZE + 4)) { 904 err = -EINVAL; 905 goto release_mem; 906 } 907 908 row = get_unaligned_be16(wr_buf); 909 len = get_unaligned_be16(&wr_buf[2]); 910 911 if (len != CCG4_ROW_SIZE) { 912 err = -EINVAL; 913 goto release_mem; 914 } 915 916 err = ccg_cmd_write_flash_row(uc, row, wr_buf + 4, 917 FLASH_WR_CMD); 918 if (err) 919 goto release_mem; 920 921 line_cnt++; 922 p = s; 923 } 924 925 dev_info(dev, "total %d row flashed. time: %dms\n", 926 line_cnt, jiffies_to_msecs(jiffies - start_time)); 927 928 err = ccg_cmd_validate_fw(uc, (mode == PRIMARY) ? FW2 : FW1); 929 if (err) 930 dev_err(dev, "%s validation failed err=%d\n", 931 (mode == PRIMARY) ? "FW2" : "FW1", err); 932 else 933 dev_info(dev, "%s validated\n", 934 (mode == PRIMARY) ? "FW2" : "FW1"); 935 936 err = ccg_cmd_port_control(uc, false); 937 if (err < 0) 938 goto release_mem; 939 940 err = ccg_cmd_reset(uc); 941 if (err < 0) 942 goto release_mem; 943 944 err = ccg_cmd_port_control(uc, true); 945 if (err < 0) 946 goto release_mem; 947 948 release_mem: 949 kfree(wr_buf); 950 951 release_fw: 952 release_firmware(fw); 953 return err; 954 } 955 956 /******************************************************************************* 957 * CCG4 has two copies of the firmware in addition to the bootloader. 958 * If the device is running FW1, FW2 can be updated with the new version. 959 * Dual firmware mode allows the CCG device to stay in a PD contract and support 960 * USB PD and Type-C functionality while a firmware update is in progress. 961 ******************************************************************************/ 962 static int ccg_fw_update(struct ucsi_ccg *uc, enum enum_flash_mode flash_mode) 963 { 964 int err; 965 966 while (flash_mode != FLASH_NOT_NEEDED) { 967 err = do_flash(uc, flash_mode); 968 if (err < 0) 969 return err; 970 err = ccg_fw_update_needed(uc, &flash_mode); 971 if (err < 0) 972 return err; 973 } 974 dev_info(uc->dev, "CCG FW update successful\n"); 975 976 return err; 977 } 978 979 static int ccg_restart(struct ucsi_ccg *uc) 980 { 981 struct device *dev = uc->dev; 982 int status; 983 984 status = ucsi_ccg_init(uc); 985 if (status < 0) { 986 dev_err(dev, "ucsi_ccg_start fail, err=%d\n", status); 987 return status; 988 } 989 990 status = request_threaded_irq(uc->irq, NULL, ccg_irq_handler, 991 IRQF_ONESHOT | IRQF_TRIGGER_HIGH, 992 dev_name(dev), uc); 993 if (status < 0) { 994 dev_err(dev, "request_threaded_irq failed - %d\n", status); 995 return status; 996 } 997 998 uc->ucsi = ucsi_register_ppm(dev, &uc->ppm); 999 if (IS_ERR(uc->ucsi)) { 1000 dev_err(uc->dev, "ucsi_register_ppm failed\n"); 1001 return PTR_ERR(uc->ucsi); 1002 } 1003 1004 return 0; 1005 } 1006 1007 static void ccg_update_firmware(struct work_struct *work) 1008 { 1009 struct ucsi_ccg *uc = container_of(work, struct ucsi_ccg, work); 1010 enum enum_flash_mode flash_mode; 1011 int status; 1012 1013 status = ccg_fw_update_needed(uc, &flash_mode); 1014 if (status < 0) 1015 return; 1016 1017 if (flash_mode != FLASH_NOT_NEEDED) { 1018 ucsi_unregister_ppm(uc->ucsi); 1019 free_irq(uc->irq, uc); 1020 1021 ccg_fw_update(uc, flash_mode); 1022 ccg_restart(uc); 1023 } 1024 } 1025 1026 static ssize_t do_flash_store(struct device *dev, 1027 struct device_attribute *attr, 1028 const char *buf, size_t n) 1029 { 1030 struct ucsi_ccg *uc = i2c_get_clientdata(to_i2c_client(dev)); 1031 bool flash; 1032 1033 if (kstrtobool(buf, &flash)) 1034 return -EINVAL; 1035 1036 if (!flash) 1037 return n; 1038 1039 if (uc->fw_build == 0x0) { 1040 dev_err(dev, "fail to flash FW due to missing FW build info\n"); 1041 return -EINVAL; 1042 } 1043 1044 schedule_work(&uc->work); 1045 return n; 1046 } 1047 1048 static DEVICE_ATTR_WO(do_flash); 1049 1050 static struct attribute *ucsi_ccg_sysfs_attrs[] = { 1051 &dev_attr_do_flash.attr, 1052 NULL, 1053 }; 1054 1055 static struct attribute_group ucsi_ccg_attr_group = { 1056 .attrs = ucsi_ccg_sysfs_attrs, 1057 }; 1058 1059 static int ucsi_ccg_probe(struct i2c_client *client, 1060 const struct i2c_device_id *id) 1061 { 1062 struct device *dev = &client->dev; 1063 struct ucsi_ccg *uc; 1064 int status; 1065 u16 rab; 1066 1067 uc = devm_kzalloc(dev, sizeof(*uc), GFP_KERNEL); 1068 if (!uc) 1069 return -ENOMEM; 1070 1071 uc->ppm.data = devm_kzalloc(dev, sizeof(struct ucsi_data), GFP_KERNEL); 1072 if (!uc->ppm.data) 1073 return -ENOMEM; 1074 1075 uc->ppm.cmd = ucsi_ccg_cmd; 1076 uc->ppm.sync = ucsi_ccg_sync; 1077 uc->dev = dev; 1078 uc->client = client; 1079 mutex_init(&uc->lock); 1080 INIT_WORK(&uc->work, ccg_update_firmware); 1081 1082 /* Only fail FW flashing when FW build information is not provided */ 1083 status = device_property_read_u16(dev, "ccgx,firmware-build", 1084 &uc->fw_build); 1085 if (status) 1086 dev_err(uc->dev, "failed to get FW build information\n"); 1087 1088 /* reset ccg device and initialize ucsi */ 1089 status = ucsi_ccg_init(uc); 1090 if (status < 0) { 1091 dev_err(uc->dev, "ucsi_ccg_init failed - %d\n", status); 1092 return status; 1093 } 1094 1095 status = get_fw_info(uc); 1096 if (status < 0) { 1097 dev_err(uc->dev, "get_fw_info failed - %d\n", status); 1098 return status; 1099 } 1100 1101 uc->port_num = 1; 1102 1103 if (uc->info.mode & CCG_DEVINFO_PDPORTS_MASK) 1104 uc->port_num++; 1105 1106 status = request_threaded_irq(client->irq, NULL, ccg_irq_handler, 1107 IRQF_ONESHOT | IRQF_TRIGGER_HIGH, 1108 dev_name(dev), uc); 1109 if (status < 0) { 1110 dev_err(uc->dev, "request_threaded_irq failed - %d\n", status); 1111 return status; 1112 } 1113 1114 uc->irq = client->irq; 1115 1116 uc->ucsi = ucsi_register_ppm(dev, &uc->ppm); 1117 if (IS_ERR(uc->ucsi)) { 1118 dev_err(uc->dev, "ucsi_register_ppm failed\n"); 1119 return PTR_ERR(uc->ucsi); 1120 } 1121 1122 rab = CCGX_RAB_UCSI_DATA_BLOCK(offsetof(struct ucsi_data, version)); 1123 status = ccg_read(uc, rab, (u8 *)(uc->ppm.data) + 1124 offsetof(struct ucsi_data, version), 1125 sizeof(uc->ppm.data->version)); 1126 if (status < 0) { 1127 ucsi_unregister_ppm(uc->ucsi); 1128 return status; 1129 } 1130 1131 i2c_set_clientdata(client, uc); 1132 1133 status = sysfs_create_group(&uc->dev->kobj, &ucsi_ccg_attr_group); 1134 if (status) 1135 dev_err(uc->dev, "cannot create sysfs group: %d\n", status); 1136 1137 return 0; 1138 } 1139 1140 static int ucsi_ccg_remove(struct i2c_client *client) 1141 { 1142 struct ucsi_ccg *uc = i2c_get_clientdata(client); 1143 1144 cancel_work_sync(&uc->work); 1145 ucsi_unregister_ppm(uc->ucsi); 1146 free_irq(uc->irq, uc); 1147 sysfs_remove_group(&uc->dev->kobj, &ucsi_ccg_attr_group); 1148 1149 return 0; 1150 } 1151 1152 static const struct i2c_device_id ucsi_ccg_device_id[] = { 1153 {"ccgx-ucsi", 0}, 1154 {} 1155 }; 1156 MODULE_DEVICE_TABLE(i2c, ucsi_ccg_device_id); 1157 1158 static struct i2c_driver ucsi_ccg_driver = { 1159 .driver = { 1160 .name = "ucsi_ccg", 1161 }, 1162 .probe = ucsi_ccg_probe, 1163 .remove = ucsi_ccg_remove, 1164 .id_table = ucsi_ccg_device_id, 1165 }; 1166 1167 module_i2c_driver(ucsi_ccg_driver); 1168 1169 MODULE_AUTHOR("Ajay Gupta <ajayg@nvidia.com>"); 1170 MODULE_DESCRIPTION("UCSI driver for Cypress CCGx Type-C controller"); 1171 MODULE_LICENSE("GPL v2"); 1172