1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2016, Zodiac Inflight Innovations
   4 * Copyright (c) 2007-2016, Synaptics Incorporated
   5 * Copyright (C) 2012 Alexandra Chin <alexandra.chin@tw.synaptics.com>
   6 * Copyright (C) 2012 Scott Lin <scott.lin@tw.synaptics.com>
   7 */
   8
   9#include <linux/bitops.h>
  10#include <linux/kernel.h>
  11#include <linux/rmi.h>
  12#include <linux/firmware.h>
  13#include <linux/delay.h>
  14#include <linux/slab.h>
  15#include <linux/jiffies.h>
  16#include <linux/unaligned.h>
  17
  18#include "rmi_driver.h"
  19#include "rmi_f34.h"
  20
  21static int rmi_f34v7_read_flash_status(struct f34_data *f34)
  22{
  23	u8 status;
  24	u8 command;
  25	int ret;
  26
  27	ret = rmi_read_block(f34->fn->rmi_dev,
  28			f34->fn->fd.data_base_addr + V7_FLASH_STATUS_OFFSET,
  29			&status,
  30			sizeof(status));
  31	if (ret < 0) {
  32		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
  33			"%s: Error %d reading flash status\n", __func__, ret);
  34		return ret;
  35	}
  36
  37	f34->v7.in_bl_mode = status >> 7;
  38	f34->v7.flash_status = status & 0x1f;
  39
  40	if (f34->v7.flash_status != 0x00) {
  41		dev_err(&f34->fn->dev, "%s: status=%d, command=0x%02x\n",
  42			__func__, f34->v7.flash_status, f34->v7.command);
  43	}
  44
  45	ret = rmi_read_block(f34->fn->rmi_dev,
  46			f34->fn->fd.data_base_addr + V7_COMMAND_OFFSET,
  47			&command,
  48			sizeof(command));
  49	if (ret < 0) {
  50		dev_err(&f34->fn->dev, "%s: Failed to read flash command\n",
  51			__func__);
  52		return ret;
  53	}
  54
  55	f34->v7.command = command;
  56
  57	return 0;
  58}
  59
  60static int rmi_f34v7_wait_for_idle(struct f34_data *f34, int timeout_ms)
  61{
  62	unsigned long timeout;
  63
  64	timeout = msecs_to_jiffies(timeout_ms);
  65
  66	if (!wait_for_completion_timeout(&f34->v7.cmd_done, timeout)) {
  67		dev_warn(&f34->fn->dev, "%s: Timed out waiting for idle status\n",
  68			 __func__);
  69		return -ETIMEDOUT;
  70	}
  71
  72	return 0;
  73}
  74
  75static int rmi_f34v7_check_command_status(struct f34_data *f34, int timeout_ms)
  76{
  77	int ret;
  78
  79	ret = rmi_f34v7_wait_for_idle(f34, timeout_ms);
  80	if (ret < 0)
  81		return ret;
  82
  83	ret = rmi_f34v7_read_flash_status(f34);
  84	if (ret < 0)
  85		return ret;
  86
  87	if (f34->v7.flash_status != 0x00)
  88		return -EIO;
  89
  90	return 0;
  91}
  92
  93static int rmi_f34v7_write_command_single_transaction(struct f34_data *f34,
  94						      u8 cmd)
  95{
  96	int ret;
  97	u8 base;
  98	struct f34v7_data_1_5 data_1_5;
  99
 100	base = f34->fn->fd.data_base_addr;
 101
 102	memset(&data_1_5, 0, sizeof(data_1_5));
 103
 104	switch (cmd) {
 105	case v7_CMD_ERASE_ALL:
 106		data_1_5.partition_id = CORE_CODE_PARTITION;
 107		data_1_5.command = CMD_V7_ERASE_AP;
 108		break;
 109	case v7_CMD_ERASE_UI_FIRMWARE:
 110		data_1_5.partition_id = CORE_CODE_PARTITION;
 111		data_1_5.command = CMD_V7_ERASE;
 112		break;
 113	case v7_CMD_ERASE_BL_CONFIG:
 114		data_1_5.partition_id = GLOBAL_PARAMETERS_PARTITION;
 115		data_1_5.command = CMD_V7_ERASE;
 116		break;
 117	case v7_CMD_ERASE_UI_CONFIG:
 118		data_1_5.partition_id = CORE_CONFIG_PARTITION;
 119		data_1_5.command = CMD_V7_ERASE;
 120		break;
 121	case v7_CMD_ERASE_DISP_CONFIG:
 122		data_1_5.partition_id = DISPLAY_CONFIG_PARTITION;
 123		data_1_5.command = CMD_V7_ERASE;
 124		break;
 125	case v7_CMD_ERASE_FLASH_CONFIG:
 126		data_1_5.partition_id = FLASH_CONFIG_PARTITION;
 127		data_1_5.command = CMD_V7_ERASE;
 128		break;
 129	case v7_CMD_ERASE_GUEST_CODE:
 130		data_1_5.partition_id = GUEST_CODE_PARTITION;
 131		data_1_5.command = CMD_V7_ERASE;
 132		break;
 133	case v7_CMD_ENABLE_FLASH_PROG:
 134		data_1_5.partition_id = BOOTLOADER_PARTITION;
 135		data_1_5.command = CMD_V7_ENTER_BL;
 136		break;
 137	}
 138
 139	data_1_5.payload[0] = f34->bootloader_id[0];
 140	data_1_5.payload[1] = f34->bootloader_id[1];
 141
 142	ret = rmi_write_block(f34->fn->rmi_dev,
 143			base + V7_PARTITION_ID_OFFSET,
 144			&data_1_5, sizeof(data_1_5));
 145	if (ret < 0) {
 146		dev_err(&f34->fn->dev,
 147			"%s: Failed to write single transaction command\n",
 148			__func__);
 149		return ret;
 150	}
 151
 152	return 0;
 153}
 154
 155static int rmi_f34v7_write_command(struct f34_data *f34, u8 cmd)
 156{
 157	int ret;
 158	u8 base;
 159	u8 command;
 160
 161	base = f34->fn->fd.data_base_addr;
 162
 163	switch (cmd) {
 164	case v7_CMD_WRITE_FW:
 165	case v7_CMD_WRITE_CONFIG:
 166	case v7_CMD_WRITE_GUEST_CODE:
 167		command = CMD_V7_WRITE;
 168		break;
 169	case v7_CMD_READ_CONFIG:
 170		command = CMD_V7_READ;
 171		break;
 172	case v7_CMD_ERASE_ALL:
 173		command = CMD_V7_ERASE_AP;
 174		break;
 175	case v7_CMD_ERASE_UI_FIRMWARE:
 176	case v7_CMD_ERASE_BL_CONFIG:
 177	case v7_CMD_ERASE_UI_CONFIG:
 178	case v7_CMD_ERASE_DISP_CONFIG:
 179	case v7_CMD_ERASE_FLASH_CONFIG:
 180	case v7_CMD_ERASE_GUEST_CODE:
 181		command = CMD_V7_ERASE;
 182		break;
 183	case v7_CMD_ENABLE_FLASH_PROG:
 184		command = CMD_V7_ENTER_BL;
 185		break;
 186	default:
 187		dev_err(&f34->fn->dev, "%s: Invalid command 0x%02x\n",
 188			__func__, cmd);
 189		return -EINVAL;
 190	}
 191
 192	f34->v7.command = command;
 193
 194	switch (cmd) {
 195	case v7_CMD_ERASE_ALL:
 196	case v7_CMD_ERASE_UI_FIRMWARE:
 197	case v7_CMD_ERASE_BL_CONFIG:
 198	case v7_CMD_ERASE_UI_CONFIG:
 199	case v7_CMD_ERASE_DISP_CONFIG:
 200	case v7_CMD_ERASE_FLASH_CONFIG:
 201	case v7_CMD_ERASE_GUEST_CODE:
 202	case v7_CMD_ENABLE_FLASH_PROG:
 203		ret = rmi_f34v7_write_command_single_transaction(f34, cmd);
 204		if (ret < 0)
 205			return ret;
 206		else
 207			return 0;
 208	default:
 209		break;
 210	}
 211
 212	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: writing cmd %02X\n",
 213		__func__, command);
 214
 215	ret = rmi_write_block(f34->fn->rmi_dev,
 216			base + V7_COMMAND_OFFSET,
 217			&command, sizeof(command));
 218	if (ret < 0) {
 219		dev_err(&f34->fn->dev, "%s: Failed to write flash command\n",
 220			__func__);
 221		return ret;
 222	}
 223
 224	return 0;
 225}
 226
 227static int rmi_f34v7_write_partition_id(struct f34_data *f34, u8 cmd)
 228{
 229	int ret;
 230	u8 base;
 231	u8 partition;
 232
 233	base = f34->fn->fd.data_base_addr;
 234
 235	switch (cmd) {
 236	case v7_CMD_WRITE_FW:
 237		partition = CORE_CODE_PARTITION;
 238		break;
 239	case v7_CMD_WRITE_CONFIG:
 240	case v7_CMD_READ_CONFIG:
 241		if (f34->v7.config_area == v7_UI_CONFIG_AREA)
 242			partition = CORE_CONFIG_PARTITION;
 243		else if (f34->v7.config_area == v7_DP_CONFIG_AREA)
 244			partition = DISPLAY_CONFIG_PARTITION;
 245		else if (f34->v7.config_area == v7_PM_CONFIG_AREA)
 246			partition = GUEST_SERIALIZATION_PARTITION;
 247		else if (f34->v7.config_area == v7_BL_CONFIG_AREA)
 248			partition = GLOBAL_PARAMETERS_PARTITION;
 249		else if (f34->v7.config_area == v7_FLASH_CONFIG_AREA)
 250			partition = FLASH_CONFIG_PARTITION;
 251		break;
 252	case v7_CMD_WRITE_GUEST_CODE:
 253		partition = GUEST_CODE_PARTITION;
 254		break;
 255	case v7_CMD_ERASE_ALL:
 256		partition = CORE_CODE_PARTITION;
 257		break;
 258	case v7_CMD_ERASE_BL_CONFIG:
 259		partition = GLOBAL_PARAMETERS_PARTITION;
 260		break;
 261	case v7_CMD_ERASE_UI_CONFIG:
 262		partition = CORE_CONFIG_PARTITION;
 263		break;
 264	case v7_CMD_ERASE_DISP_CONFIG:
 265		partition = DISPLAY_CONFIG_PARTITION;
 266		break;
 267	case v7_CMD_ERASE_FLASH_CONFIG:
 268		partition = FLASH_CONFIG_PARTITION;
 269		break;
 270	case v7_CMD_ERASE_GUEST_CODE:
 271		partition = GUEST_CODE_PARTITION;
 272		break;
 273	case v7_CMD_ENABLE_FLASH_PROG:
 274		partition = BOOTLOADER_PARTITION;
 275		break;
 276	default:
 277		dev_err(&f34->fn->dev, "%s: Invalid command 0x%02x\n",
 278			__func__, cmd);
 279		return -EINVAL;
 280	}
 281
 282	ret = rmi_write_block(f34->fn->rmi_dev,
 283			base + V7_PARTITION_ID_OFFSET,
 284			&partition, sizeof(partition));
 285	if (ret < 0) {
 286		dev_err(&f34->fn->dev, "%s: Failed to write partition ID\n",
 287			__func__);
 288		return ret;
 289	}
 290
 291	return 0;
 292}
 293
 294static int rmi_f34v7_read_partition_table(struct f34_data *f34)
 295{
 296	int ret;
 297	unsigned long timeout;
 298	u8 base;
 299	__le16 length;
 300	u16 block_number = 0;
 301
 302	base = f34->fn->fd.data_base_addr;
 303
 304	f34->v7.config_area = v7_FLASH_CONFIG_AREA;
 305
 306	ret = rmi_f34v7_write_partition_id(f34, v7_CMD_READ_CONFIG);
 307	if (ret < 0)
 308		return ret;
 309
 310	ret = rmi_write_block(f34->fn->rmi_dev,
 311			base + V7_BLOCK_NUMBER_OFFSET,
 312			&block_number, sizeof(block_number));
 313	if (ret < 0) {
 314		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
 315			__func__);
 316		return ret;
 317	}
 318
 319	put_unaligned_le16(f34->v7.flash_config_length, &length);
 320
 321	ret = rmi_write_block(f34->fn->rmi_dev,
 322			base + V7_TRANSFER_LENGTH_OFFSET,
 323			&length, sizeof(length));
 324	if (ret < 0) {
 325		dev_err(&f34->fn->dev, "%s: Failed to write transfer length\n",
 326			__func__);
 327		return ret;
 328	}
 329
 330	init_completion(&f34->v7.cmd_done);
 331
 332	ret = rmi_f34v7_write_command(f34, v7_CMD_READ_CONFIG);
 333	if (ret < 0) {
 334		dev_err(&f34->fn->dev, "%s: Failed to write command\n",
 335			__func__);
 336		return ret;
 337	}
 338
 339	/*
 340	 * rmi_f34v7_check_command_status() can't be used here, as this
 341	 * function is called before IRQs are available
 342	 */
 343	timeout = msecs_to_jiffies(F34_WRITE_WAIT_MS);
 344	while (time_before(jiffies, timeout)) {
 345		usleep_range(5000, 6000);
 346		rmi_f34v7_read_flash_status(f34);
 347
 348		if (f34->v7.command == v7_CMD_IDLE &&
 349		    f34->v7.flash_status == 0x00) {
 350			break;
 351		}
 352	}
 353
 354	ret = rmi_read_block(f34->fn->rmi_dev,
 355			base + V7_PAYLOAD_OFFSET,
 356			f34->v7.read_config_buf,
 357			f34->v7.partition_table_bytes);
 358	if (ret < 0) {
 359		dev_err(&f34->fn->dev, "%s: Failed to read block data\n",
 360			__func__);
 361		return ret;
 362	}
 363
 364	return 0;
 365}
 366
 367static void rmi_f34v7_parse_partition_table(struct f34_data *f34,
 368					    const void *partition_table,
 369					    struct block_count *blkcount,
 370					    struct physical_address *phyaddr)
 371{
 372	int i;
 373	int index;
 374	u16 partition_length;
 375	u16 physical_address;
 376	const struct partition_table *ptable;
 377
 378	for (i = 0; i < f34->v7.partitions; i++) {
 379		index = i * 8 + 2;
 380		ptable = partition_table + index;
 381		partition_length = le16_to_cpu(ptable->partition_length);
 382		physical_address = le16_to_cpu(ptable->start_physical_address);
 383		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 384			"%s: Partition entry %d: %*ph\n",
 385			__func__, i, sizeof(struct partition_table), ptable);
 386		switch (ptable->partition_id & 0x1f) {
 387		case CORE_CODE_PARTITION:
 388			blkcount->ui_firmware = partition_length;
 389			phyaddr->ui_firmware = physical_address;
 390			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 391				"%s: Core code block count: %d\n",
 392				__func__, blkcount->ui_firmware);
 393			break;
 394		case CORE_CONFIG_PARTITION:
 395			blkcount->ui_config = partition_length;
 396			phyaddr->ui_config = physical_address;
 397			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 398				"%s: Core config block count: %d\n",
 399				__func__, blkcount->ui_config);
 400			break;
 401		case DISPLAY_CONFIG_PARTITION:
 402			blkcount->dp_config = partition_length;
 403			phyaddr->dp_config = physical_address;
 404			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 405				"%s: Display config block count: %d\n",
 406				__func__, blkcount->dp_config);
 407			break;
 408		case FLASH_CONFIG_PARTITION:
 409			blkcount->fl_config = partition_length;
 410			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 411				"%s: Flash config block count: %d\n",
 412				__func__, blkcount->fl_config);
 413			break;
 414		case GUEST_CODE_PARTITION:
 415			blkcount->guest_code = partition_length;
 416			phyaddr->guest_code = physical_address;
 417			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 418				"%s: Guest code block count: %d\n",
 419				__func__, blkcount->guest_code);
 420			break;
 421		case GUEST_SERIALIZATION_PARTITION:
 422			blkcount->pm_config = partition_length;
 423			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 424				"%s: Guest serialization block count: %d\n",
 425				__func__, blkcount->pm_config);
 426			break;
 427		case GLOBAL_PARAMETERS_PARTITION:
 428			blkcount->bl_config = partition_length;
 429			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 430				"%s: Global parameters block count: %d\n",
 431				__func__, blkcount->bl_config);
 432			break;
 433		case DEVICE_CONFIG_PARTITION:
 434			blkcount->lockdown = partition_length;
 435			rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 436				"%s: Device config block count: %d\n",
 437				__func__, blkcount->lockdown);
 438			break;
 439		}
 440	}
 441}
 442
 443static int rmi_f34v7_read_queries_bl_version(struct f34_data *f34)
 444{
 445	int ret;
 446	u8 base;
 447	int offset;
 448	u8 query_0;
 449	struct f34v7_query_1_7 query_1_7;
 450
 451	base = f34->fn->fd.query_base_addr;
 452
 453	ret = rmi_read_block(f34->fn->rmi_dev,
 454			base,
 455			&query_0,
 456			sizeof(query_0));
 457	if (ret < 0) {
 458		dev_err(&f34->fn->dev,
 459			"%s: Failed to read query 0\n", __func__);
 460		return ret;
 461	}
 462
 463	offset = (query_0 & 0x7) + 1;
 464
 465	ret = rmi_read_block(f34->fn->rmi_dev,
 466			base + offset,
 467			&query_1_7,
 468			sizeof(query_1_7));
 469	if (ret < 0) {
 470		dev_err(&f34->fn->dev, "%s: Failed to read queries 1 to 7\n",
 471			__func__);
 472		return ret;
 473	}
 474
 475	f34->bootloader_id[0] = query_1_7.bl_minor_revision;
 476	f34->bootloader_id[1] = query_1_7.bl_major_revision;
 477
 478	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "Bootloader V%d.%d\n",
 479		f34->bootloader_id[1], f34->bootloader_id[0]);
 480
 481	return 0;
 482}
 483
 484static int rmi_f34v7_read_queries(struct f34_data *f34)
 485{
 486	int ret;
 487	int i;
 488	u8 base;
 489	int offset;
 490	u8 *ptable;
 491	u8 query_0;
 492	struct f34v7_query_1_7 query_1_7;
 493
 494	base = f34->fn->fd.query_base_addr;
 495
 496	ret = rmi_read_block(f34->fn->rmi_dev,
 497			base,
 498			&query_0,
 499			sizeof(query_0));
 500	if (ret < 0) {
 501		dev_err(&f34->fn->dev,
 502			"%s: Failed to read query 0\n", __func__);
 503		return ret;
 504	}
 505
 506	offset = (query_0 & 0x07) + 1;
 507
 508	ret = rmi_read_block(f34->fn->rmi_dev,
 509			base + offset,
 510			&query_1_7,
 511			sizeof(query_1_7));
 512	if (ret < 0) {
 513		dev_err(&f34->fn->dev, "%s: Failed to read queries 1 to 7\n",
 514			__func__);
 515		return ret;
 516	}
 517
 518	f34->bootloader_id[0] = query_1_7.bl_minor_revision;
 519	f34->bootloader_id[1] = query_1_7.bl_major_revision;
 520
 521	f34->v7.block_size = le16_to_cpu(query_1_7.block_size);
 522	f34->v7.flash_config_length =
 523			le16_to_cpu(query_1_7.flash_config_length);
 524	f34->v7.payload_length = le16_to_cpu(query_1_7.payload_length);
 525
 526	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: f34->v7.block_size = %d\n",
 527		 __func__, f34->v7.block_size);
 528
 529	f34->v7.has_display_cfg = query_1_7.partition_support[1] & HAS_DISP_CFG;
 530	f34->v7.has_guest_code =
 531			query_1_7.partition_support[1] & HAS_GUEST_CODE;
 532
 533	if (query_0 & HAS_CONFIG_ID) {
 534		u8 f34_ctrl[CONFIG_ID_SIZE];
 535
 536		ret = rmi_read_block(f34->fn->rmi_dev,
 537				f34->fn->fd.control_base_addr,
 538				f34_ctrl,
 539				sizeof(f34_ctrl));
 540		if (ret)
 541			return ret;
 542
 543		/* Eat leading zeros */
 544		for (i = 0; i < sizeof(f34_ctrl) - 1 && !f34_ctrl[i]; i++)
 545			/* Empty */;
 546
 547		snprintf(f34->configuration_id, sizeof(f34->configuration_id),
 548			 "%*phN", (int)sizeof(f34_ctrl) - i, f34_ctrl + i);
 549
 550		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "Configuration ID: %s\n",
 551			f34->configuration_id);
 552	}
 553
 554	f34->v7.partitions = 0;
 555	for (i = 0; i < sizeof(query_1_7.partition_support); i++)
 556		f34->v7.partitions += hweight8(query_1_7.partition_support[i]);
 557
 558	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: Supported partitions: %*ph\n",
 559		__func__, sizeof(query_1_7.partition_support),
 560		query_1_7.partition_support);
 561
 562
 563	f34->v7.partition_table_bytes = f34->v7.partitions * 8 + 2;
 564
 565	f34->v7.read_config_buf = devm_kzalloc(&f34->fn->dev,
 566			f34->v7.partition_table_bytes,
 567			GFP_KERNEL);
 568	if (!f34->v7.read_config_buf) {
 569		f34->v7.read_config_buf_size = 0;
 570		return -ENOMEM;
 571	}
 572
 573	f34->v7.read_config_buf_size = f34->v7.partition_table_bytes;
 574	ptable = f34->v7.read_config_buf;
 575
 576	ret = rmi_f34v7_read_partition_table(f34);
 577	if (ret < 0) {
 578		dev_err(&f34->fn->dev, "%s: Failed to read partition table\n",
 579				__func__);
 580		return ret;
 581	}
 582
 583	rmi_f34v7_parse_partition_table(f34, ptable,
 584					&f34->v7.blkcount, &f34->v7.phyaddr);
 585
 586	return 0;
 587}
 588
 589static int rmi_f34v7_check_bl_config_size(struct f34_data *f34)
 590{
 591	u16 block_count;
 592
 593	block_count = f34->v7.img.bl_config.size / f34->v7.block_size;
 594	f34->update_size += block_count;
 595
 596	if (block_count != f34->v7.blkcount.bl_config) {
 597		dev_err(&f34->fn->dev, "Bootloader config size mismatch\n");
 598		return -EINVAL;
 599	}
 600
 601	return 0;
 602}
 603
 604static int rmi_f34v7_erase_all(struct f34_data *f34)
 605{
 606	int ret;
 607
 608	dev_info(&f34->fn->dev, "Erasing firmware...\n");
 609
 610	init_completion(&f34->v7.cmd_done);
 611
 612	ret = rmi_f34v7_write_command(f34, v7_CMD_ERASE_ALL);
 613	if (ret < 0)
 614		return ret;
 615
 616	ret = rmi_f34v7_check_command_status(f34, F34_ERASE_WAIT_MS);
 617	if (ret < 0)
 618		return ret;
 619
 620	return 0;
 621}
 622
 623static int rmi_f34v7_read_blocks(struct f34_data *f34,
 624				 u16 block_cnt, u8 command)
 625{
 626	int ret;
 627	u8 base;
 628	__le16 length;
 629	u16 transfer;
 630	u16 max_transfer;
 631	u16 remaining = block_cnt;
 632	u16 block_number = 0;
 633	u16 index = 0;
 634
 635	base = f34->fn->fd.data_base_addr;
 636
 637	ret = rmi_f34v7_write_partition_id(f34, command);
 638	if (ret < 0)
 639		return ret;
 640
 641	ret = rmi_write_block(f34->fn->rmi_dev,
 642			base + V7_BLOCK_NUMBER_OFFSET,
 643			&block_number, sizeof(block_number));
 644	if (ret < 0) {
 645		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
 646			__func__);
 647		return ret;
 648	}
 649
 650	max_transfer = min(f34->v7.payload_length,
 651			   (u16)(PAGE_SIZE / f34->v7.block_size));
 652
 653	do {
 654		transfer = min(remaining, max_transfer);
 655		put_unaligned_le16(transfer, &length);
 656
 657		ret = rmi_write_block(f34->fn->rmi_dev,
 658				base + V7_TRANSFER_LENGTH_OFFSET,
 659				&length, sizeof(length));
 660		if (ret < 0) {
 661			dev_err(&f34->fn->dev,
 662				"%s: Write transfer length fail (%d remaining)\n",
 663				__func__, remaining);
 664			return ret;
 665		}
 666
 667		init_completion(&f34->v7.cmd_done);
 668
 669		ret = rmi_f34v7_write_command(f34, command);
 670		if (ret < 0)
 671			return ret;
 672
 673		ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
 674		if (ret < 0)
 675			return ret;
 676
 677		ret = rmi_read_block(f34->fn->rmi_dev,
 678				base + V7_PAYLOAD_OFFSET,
 679				&f34->v7.read_config_buf[index],
 680				transfer * f34->v7.block_size);
 681		if (ret < 0) {
 682			dev_err(&f34->fn->dev,
 683				"%s: Read block failed (%d blks remaining)\n",
 684				__func__, remaining);
 685			return ret;
 686		}
 687
 688		index += (transfer * f34->v7.block_size);
 689		remaining -= transfer;
 690	} while (remaining);
 691
 692	return 0;
 693}
 694
 695static int rmi_f34v7_write_f34v7_blocks(struct f34_data *f34,
 696					const void *block_ptr, u16 block_cnt,
 697					u8 command)
 698{
 699	int ret;
 700	u8 base;
 701	__le16 length;
 702	u16 transfer;
 703	u16 max_transfer;
 704	u16 remaining = block_cnt;
 705	u16 block_number = 0;
 706
 707	base = f34->fn->fd.data_base_addr;
 708
 709	ret = rmi_f34v7_write_partition_id(f34, command);
 710	if (ret < 0)
 711		return ret;
 712
 713	ret = rmi_write_block(f34->fn->rmi_dev,
 714			base + V7_BLOCK_NUMBER_OFFSET,
 715			&block_number, sizeof(block_number));
 716	if (ret < 0) {
 717		dev_err(&f34->fn->dev, "%s: Failed to write block number\n",
 718			__func__);
 719		return ret;
 720	}
 721
 722	if (f34->v7.payload_length > (PAGE_SIZE / f34->v7.block_size))
 723		max_transfer = PAGE_SIZE / f34->v7.block_size;
 724	else
 725		max_transfer = f34->v7.payload_length;
 726
 727	do {
 728		transfer = min(remaining, max_transfer);
 729		put_unaligned_le16(transfer, &length);
 730
 731		init_completion(&f34->v7.cmd_done);
 732
 733		ret = rmi_write_block(f34->fn->rmi_dev,
 734				base + V7_TRANSFER_LENGTH_OFFSET,
 735				&length, sizeof(length));
 736		if (ret < 0) {
 737			dev_err(&f34->fn->dev,
 738				"%s: Write transfer length fail (%d remaining)\n",
 739				__func__, remaining);
 740			return ret;
 741		}
 742
 743		ret = rmi_f34v7_write_command(f34, command);
 744		if (ret < 0)
 745			return ret;
 746
 747		ret = rmi_write_block(f34->fn->rmi_dev,
 748				base + V7_PAYLOAD_OFFSET,
 749				block_ptr, transfer * f34->v7.block_size);
 750		if (ret < 0) {
 751			dev_err(&f34->fn->dev,
 752				"%s: Failed writing data (%d blks remaining)\n",
 753				__func__, remaining);
 754			return ret;
 755		}
 756
 757		ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
 758		if (ret < 0)
 759			return ret;
 760
 761		block_ptr += (transfer * f34->v7.block_size);
 762		remaining -= transfer;
 763		f34->update_progress += transfer;
 764		f34->update_status = (f34->update_progress * 100) /
 765				     f34->update_size;
 766	} while (remaining);
 767
 768	return 0;
 769}
 770
 771static int rmi_f34v7_write_config(struct f34_data *f34)
 772{
 773	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.config_data,
 774					    f34->v7.config_block_count,
 775					    v7_CMD_WRITE_CONFIG);
 776}
 777
 778static int rmi_f34v7_write_ui_config(struct f34_data *f34)
 779{
 780	f34->v7.config_area = v7_UI_CONFIG_AREA;
 781	f34->v7.config_data = f34->v7.img.ui_config.data;
 782	f34->v7.config_size = f34->v7.img.ui_config.size;
 783	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
 784
 785	return rmi_f34v7_write_config(f34);
 786}
 787
 788static int rmi_f34v7_write_dp_config(struct f34_data *f34)
 789{
 790	f34->v7.config_area = v7_DP_CONFIG_AREA;
 791	f34->v7.config_data = f34->v7.img.dp_config.data;
 792	f34->v7.config_size = f34->v7.img.dp_config.size;
 793	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
 794
 795	return rmi_f34v7_write_config(f34);
 796}
 797
 798static int rmi_f34v7_write_guest_code(struct f34_data *f34)
 799{
 800	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.img.guest_code.data,
 801					    f34->v7.img.guest_code.size /
 802							f34->v7.block_size,
 803					    v7_CMD_WRITE_GUEST_CODE);
 804}
 805
 806static int rmi_f34v7_write_flash_config(struct f34_data *f34)
 807{
 808	int ret;
 809
 810	f34->v7.config_area = v7_FLASH_CONFIG_AREA;
 811	f34->v7.config_data = f34->v7.img.fl_config.data;
 812	f34->v7.config_size = f34->v7.img.fl_config.size;
 813	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
 814
 815	if (f34->v7.config_block_count != f34->v7.blkcount.fl_config) {
 816		dev_err(&f34->fn->dev, "%s: Flash config size mismatch\n",
 817			__func__);
 818		return -EINVAL;
 819	}
 820
 821	init_completion(&f34->v7.cmd_done);
 822
 823	ret = rmi_f34v7_write_config(f34);
 824	if (ret < 0)
 825		return ret;
 826
 827	return 0;
 828}
 829
 830static int rmi_f34v7_write_partition_table(struct f34_data *f34)
 831{
 832	u16 block_count;
 833	int ret;
 834
 835	block_count = f34->v7.blkcount.bl_config;
 836	f34->v7.config_area = v7_BL_CONFIG_AREA;
 837	f34->v7.config_size = f34->v7.block_size * block_count;
 838	devm_kfree(&f34->fn->dev, f34->v7.read_config_buf);
 839	f34->v7.read_config_buf = devm_kzalloc(&f34->fn->dev,
 840					       f34->v7.config_size, GFP_KERNEL);
 841	if (!f34->v7.read_config_buf) {
 842		f34->v7.read_config_buf_size = 0;
 843		return -ENOMEM;
 844	}
 845
 846	f34->v7.read_config_buf_size = f34->v7.config_size;
 847
 848	ret = rmi_f34v7_read_blocks(f34, block_count, v7_CMD_READ_CONFIG);
 849	if (ret < 0)
 850		return ret;
 851
 852	ret = rmi_f34v7_write_flash_config(f34);
 853	if (ret < 0)
 854		return ret;
 855
 856	f34->v7.config_area = v7_BL_CONFIG_AREA;
 857	f34->v7.config_data = f34->v7.read_config_buf;
 858	f34->v7.config_size = f34->v7.img.bl_config.size;
 859	f34->v7.config_block_count = f34->v7.config_size / f34->v7.block_size;
 860
 861	ret = rmi_f34v7_write_config(f34);
 862	if (ret < 0)
 863		return ret;
 864
 865	return 0;
 866}
 867
 868static int rmi_f34v7_write_firmware(struct f34_data *f34)
 869{
 870	u16 blk_count;
 871
 872	blk_count = f34->v7.img.ui_firmware.size / f34->v7.block_size;
 873
 874	return rmi_f34v7_write_f34v7_blocks(f34, f34->v7.img.ui_firmware.data,
 875					    blk_count, v7_CMD_WRITE_FW);
 876}
 877
 878static void rmi_f34v7_parse_img_header_10_bl_container(struct f34_data *f34,
 879						       const void *image)
 880{
 881	int i;
 882	int num_of_containers;
 883	unsigned int addr;
 884	unsigned int container_id;
 885	unsigned int length;
 886	const void *content;
 887	const struct container_descriptor *descriptor;
 888
 889	num_of_containers = f34->v7.img.bootloader.size / 4 - 1;
 890
 891	for (i = 1; i <= num_of_containers; i++) {
 892		addr = get_unaligned_le32(f34->v7.img.bootloader.data + i * 4);
 893		descriptor = image + addr;
 894		container_id = le16_to_cpu(descriptor->container_id);
 895		content = image + le32_to_cpu(descriptor->content_address);
 896		length = le32_to_cpu(descriptor->content_length);
 897		switch (container_id) {
 898		case BL_CONFIG_CONTAINER:
 899		case GLOBAL_PARAMETERS_CONTAINER:
 900			f34->v7.img.bl_config.data = content;
 901			f34->v7.img.bl_config.size = length;
 902			break;
 903		case BL_LOCKDOWN_INFO_CONTAINER:
 904		case DEVICE_CONFIG_CONTAINER:
 905			f34->v7.img.lockdown.data = content;
 906			f34->v7.img.lockdown.size = length;
 907			break;
 908		default:
 909			break;
 910		}
 911	}
 912}
 913
 914static void rmi_f34v7_parse_image_header_10(struct f34_data *f34)
 915{
 916	unsigned int i;
 917	unsigned int num_of_containers;
 918	unsigned int addr;
 919	unsigned int offset;
 920	unsigned int container_id;
 921	unsigned int length;
 922	const void *image = f34->v7.image;
 923	const u8 *content;
 924	const struct container_descriptor *descriptor;
 925	const struct image_header_10 *header = image;
 926
 927	f34->v7.img.checksum = le32_to_cpu(header->checksum);
 928
 929	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev, "%s: f34->v7.img.checksum=%X\n",
 930		__func__, f34->v7.img.checksum);
 931
 932	/* address of top level container */
 933	offset = le32_to_cpu(header->top_level_container_start_addr);
 934	descriptor = image + offset;
 935
 936	/* address of top level container content */
 937	offset = le32_to_cpu(descriptor->content_address);
 938	num_of_containers = le32_to_cpu(descriptor->content_length) / 4;
 939
 940	for (i = 0; i < num_of_containers; i++) {
 941		addr = get_unaligned_le32(image + offset);
 942		offset += 4;
 943		descriptor = image + addr;
 944		container_id = le16_to_cpu(descriptor->container_id);
 945		content = image + le32_to_cpu(descriptor->content_address);
 946		length = le32_to_cpu(descriptor->content_length);
 947
 948		rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
 949			"%s: container_id=%d, length=%d\n", __func__,
 950			container_id, length);
 951
 952		switch (container_id) {
 953		case UI_CONTAINER:
 954		case CORE_CODE_CONTAINER:
 955			f34->v7.img.ui_firmware.data = content;
 956			f34->v7.img.ui_firmware.size = length;
 957			break;
 958		case UI_CONFIG_CONTAINER:
 959		case CORE_CONFIG_CONTAINER:
 960			f34->v7.img.ui_config.data = content;
 961			f34->v7.img.ui_config.size = length;
 962			break;
 963		case BL_CONTAINER:
 964			f34->v7.img.bl_version = *content;
 965			f34->v7.img.bootloader.data = content;
 966			f34->v7.img.bootloader.size = length;
 967			rmi_f34v7_parse_img_header_10_bl_container(f34, image);
 968			break;
 969		case GUEST_CODE_CONTAINER:
 970			f34->v7.img.contains_guest_code = true;
 971			f34->v7.img.guest_code.data = content;
 972			f34->v7.img.guest_code.size = length;
 973			break;
 974		case DISPLAY_CONFIG_CONTAINER:
 975			f34->v7.img.contains_display_cfg = true;
 976			f34->v7.img.dp_config.data = content;
 977			f34->v7.img.dp_config.size = length;
 978			break;
 979		case FLASH_CONFIG_CONTAINER:
 980			f34->v7.img.contains_flash_config = true;
 981			f34->v7.img.fl_config.data = content;
 982			f34->v7.img.fl_config.size = length;
 983			break;
 984		case GENERAL_INFORMATION_CONTAINER:
 985			f34->v7.img.contains_firmware_id = true;
 986			f34->v7.img.firmware_id =
 987				get_unaligned_le32(content + 4);
 988			break;
 989		default:
 990			break;
 991		}
 992	}
 993}
 994
 995static int rmi_f34v7_parse_image_info(struct f34_data *f34)
 996{
 997	const struct image_header_10 *header = f34->v7.image;
 998
 999	memset(&f34->v7.img, 0x00, sizeof(f34->v7.img));
1000
1001	rmi_dbg(RMI_DEBUG_FN, &f34->fn->dev,
1002		"%s: header->major_header_version = %d\n",
1003		__func__, header->major_header_version);
1004
1005	switch (header->major_header_version) {
1006	case IMAGE_HEADER_VERSION_10:
1007		rmi_f34v7_parse_image_header_10(f34);
1008		break;
1009	default:
1010		dev_err(&f34->fn->dev, "Unsupported image file format %02X\n",
1011			header->major_header_version);
1012		return -EINVAL;
1013	}
1014
1015	if (!f34->v7.img.contains_flash_config) {
1016		dev_err(&f34->fn->dev, "%s: No flash config in fw image\n",
1017			__func__);
1018		return -EINVAL;
1019	}
1020
1021	rmi_f34v7_parse_partition_table(f34, f34->v7.img.fl_config.data,
1022			&f34->v7.img.blkcount, &f34->v7.img.phyaddr);
1023
1024	return 0;
1025}
1026
1027int rmi_f34v7_do_reflash(struct f34_data *f34, const struct firmware *fw)
1028{
1029	int ret;
1030
1031	f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev,
1032					       f34->fn->irq_mask);
1033
1034	rmi_f34v7_read_queries_bl_version(f34);
1035
1036	f34->v7.image = fw->data;
1037	f34->update_progress = 0;
1038	f34->update_size = 0;
1039
1040	ret = rmi_f34v7_parse_image_info(f34);
1041	if (ret < 0)
1042		return ret;
1043
1044	ret = rmi_f34v7_check_bl_config_size(f34);
1045	if (ret < 0)
1046		return ret;
1047
1048	ret = rmi_f34v7_erase_all(f34);
1049	if (ret < 0)
1050		return ret;
1051
1052	ret = rmi_f34v7_write_partition_table(f34);
1053	if (ret < 0)
1054		return ret;
1055	dev_info(&f34->fn->dev, "%s: Partition table programmed\n", __func__);
1056
1057	/*
1058	 * Reset to reload partition table - as the previous firmware has been
1059	 * erased, we remain in bootloader mode.
1060	 */
1061	ret = rmi_scan_pdt(f34->fn->rmi_dev, NULL, rmi_initial_reset);
1062	if (ret < 0)
1063		dev_warn(&f34->fn->dev, "RMI reset failed!\n");
1064
1065	dev_info(&f34->fn->dev, "Writing firmware (%d bytes)...\n",
1066		 f34->v7.img.ui_firmware.size);
1067
1068	ret = rmi_f34v7_write_firmware(f34);
1069	if (ret < 0)
1070		return ret;
1071
1072	dev_info(&f34->fn->dev, "Writing config (%d bytes)...\n",
1073		 f34->v7.img.ui_config.size);
1074
1075	f34->v7.config_area = v7_UI_CONFIG_AREA;
1076	ret = rmi_f34v7_write_ui_config(f34);
1077	if (ret < 0)
1078		return ret;
1079
1080	if (f34->v7.has_display_cfg && f34->v7.img.contains_display_cfg) {
1081		dev_info(&f34->fn->dev, "Writing display config...\n");
1082
1083		ret = rmi_f34v7_write_dp_config(f34);
1084		if (ret < 0)
1085			return ret;
1086	}
1087
1088	if (f34->v7.has_guest_code && f34->v7.img.contains_guest_code) {
1089		dev_info(&f34->fn->dev, "Writing guest code...\n");
1090
1091		ret = rmi_f34v7_write_guest_code(f34);
1092		if (ret < 0)
1093			return ret;
1094	}
1095
1096	return 0;
1097}
1098
1099static int rmi_f34v7_enter_flash_prog(struct f34_data *f34)
1100{
1101	int ret;
1102
1103	f34->fn->rmi_dev->driver->set_irq_bits(f34->fn->rmi_dev, f34->fn->irq_mask);
1104
1105	ret = rmi_f34v7_read_flash_status(f34);
1106	if (ret < 0)
1107		return ret;
1108
1109	if (f34->v7.in_bl_mode) {
1110		dev_info(&f34->fn->dev, "%s: Device in bootloader mode\n",
1111			 __func__);
1112		return 0;
1113	}
1114
1115	init_completion(&f34->v7.cmd_done);
1116
1117	ret = rmi_f34v7_write_command(f34, v7_CMD_ENABLE_FLASH_PROG);
1118	if (ret < 0)
1119		return ret;
1120
1121	ret = rmi_f34v7_check_command_status(f34, F34_ENABLE_WAIT_MS);
1122	if (ret < 0)
1123		return ret;
1124
1125	return 0;
1126}
1127
1128int rmi_f34v7_start_reflash(struct f34_data *f34, const struct firmware *fw)
1129{
1130	int ret = 0;
1131
1132	f34->v7.config_area = v7_UI_CONFIG_AREA;
1133	f34->v7.image = fw->data;
1134
1135	ret = rmi_f34v7_parse_image_info(f34);
1136	if (ret < 0)
1137		return ret;
1138
1139	dev_info(&f34->fn->dev, "Firmware image OK\n");
1140
1141	return rmi_f34v7_enter_flash_prog(f34);
1142}
1143
1144int rmi_f34v7_probe(struct f34_data *f34)
1145{
1146	int ret;
1147
1148	/* Read bootloader version */
1149	ret = rmi_read_block(f34->fn->rmi_dev,
1150			f34->fn->fd.query_base_addr + V7_BOOTLOADER_ID_OFFSET,
1151			f34->bootloader_id,
1152			sizeof(f34->bootloader_id));
1153	if (ret < 0) {
1154		dev_err(&f34->fn->dev, "%s: Failed to read bootloader ID\n",
1155			__func__);
1156		return ret;
1157	}
1158
1159	if (f34->bootloader_id[1] == '5') {
1160		f34->bl_version = 5;
1161	} else if (f34->bootloader_id[1] == '6') {
1162		f34->bl_version = 6;
1163	} else if (f34->bootloader_id[1] == 7) {
1164		f34->bl_version = 7;
1165	} else if (f34->bootloader_id[1] == 8) {
1166		f34->bl_version = 8;
1167	} else {
1168		dev_err(&f34->fn->dev,
1169			"%s: Unrecognized bootloader version: %d (%c) %d (%c)\n",
1170			__func__,
1171			f34->bootloader_id[0], f34->bootloader_id[0],
1172			f34->bootloader_id[1], f34->bootloader_id[1]);
1173		return -EINVAL;
1174	}
1175
1176	memset(&f34->v7.blkcount, 0x00, sizeof(f34->v7.blkcount));
1177	memset(&f34->v7.phyaddr, 0x00, sizeof(f34->v7.phyaddr));
1178
1179	init_completion(&f34->v7.cmd_done);
1180
1181	ret = rmi_f34v7_read_queries(f34);
1182	if (ret < 0)
1183		return ret;
1184
1185	return 0;
1186}