Loading...
Note: File does not exist in v3.1.
1// SPDX-License-Identifier: GPL-2.0+
2
3/*
4 * Multifunction core driver for Zodiac Inflight Innovations RAVE
5 * Supervisory Processor(SP) MCU that is connected via dedicated UART
6 * port
7 *
8 * Copyright (C) 2017 Zodiac Inflight Innovations
9 */
10
11#include <linux/atomic.h>
12#include <linux/crc-ccitt.h>
13#include <linux/delay.h>
14#include <linux/export.h>
15#include <linux/init.h>
16#include <linux/slab.h>
17#include <linux/kernel.h>
18#include <linux/mfd/rave-sp.h>
19#include <linux/module.h>
20#include <linux/of.h>
21#include <linux/of_device.h>
22#include <linux/sched.h>
23#include <linux/serdev.h>
24#include <asm/unaligned.h>
25
26/*
27 * UART protocol using following entities:
28 * - message to MCU => ACK response
29 * - event from MCU => event ACK
30 *
31 * Frame structure:
32 * <STX> <DATA> <CHECKSUM> <ETX>
33 * Where:
34 * - STX - is start of transmission character
35 * - ETX - end of transmission
36 * - DATA - payload
37 * - CHECKSUM - checksum calculated on <DATA>
38 *
39 * If <DATA> or <CHECKSUM> contain one of control characters, then it is
40 * escaped using <DLE> control code. Added <DLE> does not participate in
41 * checksum calculation.
42 */
43#define RAVE_SP_STX 0x02
44#define RAVE_SP_ETX 0x03
45#define RAVE_SP_DLE 0x10
46
47#define RAVE_SP_MAX_DATA_SIZE 64
48#define RAVE_SP_CHECKSUM_SIZE 2 /* Worst case scenario on RDU2 */
49/*
50 * We don't store STX, ETX and unescaped bytes, so Rx is only
51 * DATA + CSUM
52 */
53#define RAVE_SP_RX_BUFFER_SIZE \
54 (RAVE_SP_MAX_DATA_SIZE + RAVE_SP_CHECKSUM_SIZE)
55
56#define RAVE_SP_STX_ETX_SIZE 2
57/*
58 * For Tx we have to have space for everything, STX, EXT and
59 * potentially stuffed DATA + CSUM data + csum
60 */
61#define RAVE_SP_TX_BUFFER_SIZE \
62 (RAVE_SP_STX_ETX_SIZE + 2 * RAVE_SP_RX_BUFFER_SIZE)
63
64#define RAVE_SP_BOOT_SOURCE_GET 0
65#define RAVE_SP_BOOT_SOURCE_SET 1
66
67#define RAVE_SP_RDU2_BOARD_TYPE_RMB 0
68#define RAVE_SP_RDU2_BOARD_TYPE_DEB 1
69
70#define RAVE_SP_BOOT_SOURCE_SD 0
71#define RAVE_SP_BOOT_SOURCE_EMMC 1
72#define RAVE_SP_BOOT_SOURCE_NOR 2
73
74/**
75 * enum rave_sp_deframer_state - Possible state for de-framer
76 *
77 * @RAVE_SP_EXPECT_SOF: Scanning input for start-of-frame marker
78 * @RAVE_SP_EXPECT_DATA: Got start of frame marker, collecting frame
79 * @RAVE_SP_EXPECT_ESCAPED_DATA: Got escape character, collecting escaped byte
80 */
81enum rave_sp_deframer_state {
82 RAVE_SP_EXPECT_SOF,
83 RAVE_SP_EXPECT_DATA,
84 RAVE_SP_EXPECT_ESCAPED_DATA,
85};
86
87/**
88 * struct rave_sp_deframer - Device protocol deframer
89 *
90 * @state: Current state of the deframer
91 * @data: Buffer used to collect deframed data
92 * @length: Number of bytes de-framed so far
93 */
94struct rave_sp_deframer {
95 enum rave_sp_deframer_state state;
96 unsigned char data[RAVE_SP_RX_BUFFER_SIZE];
97 size_t length;
98};
99
100/**
101 * struct rave_sp_reply - Reply as per RAVE device protocol
102 *
103 * @length: Expected reply length
104 * @data: Buffer to store reply payload in
105 * @code: Expected reply code
106 * @ackid: Expected reply ACK ID
107 * @completion: Successful reply reception completion
108 */
109struct rave_sp_reply {
110 size_t length;
111 void *data;
112 u8 code;
113 u8 ackid;
114 struct completion received;
115};
116
117/**
118 * struct rave_sp_checksum - Variant specific checksum implementation details
119 *
120 * @length: Caculated checksum length
121 * @subroutine: Utilized checksum algorithm implementation
122 */
123struct rave_sp_checksum {
124 size_t length;
125 void (*subroutine)(const u8 *, size_t, u8 *);
126};
127
128/**
129 * struct rave_sp_variant_cmds - Variant specific command routines
130 *
131 * @translate: Generic to variant specific command mapping routine
132 *
133 */
134struct rave_sp_variant_cmds {
135 int (*translate)(enum rave_sp_command);
136};
137
138/**
139 * struct rave_sp_variant - RAVE supervisory processor core variant
140 *
141 * @checksum: Variant specific checksum implementation
142 * @cmd: Variant specific command pointer table
143 *
144 */
145struct rave_sp_variant {
146 const struct rave_sp_checksum *checksum;
147 struct rave_sp_variant_cmds cmd;
148};
149
150/**
151 * struct rave_sp - RAVE supervisory processor core
152 *
153 * @serdev: Pointer to underlying serdev
154 * @deframer: Stored state of the protocol deframer
155 * @ackid: ACK ID used in last reply sent to the device
156 * @bus_lock: Lock to serialize access to the device
157 * @reply_lock: Lock protecting @reply
158 * @reply: Pointer to memory to store reply payload
159 *
160 * @variant: Device variant specific information
161 * @event_notifier_list: Input event notification chain
162 *
163 */
164struct rave_sp {
165 struct serdev_device *serdev;
166 struct rave_sp_deframer deframer;
167 atomic_t ackid;
168 struct mutex bus_lock;
169 struct mutex reply_lock;
170 struct rave_sp_reply *reply;
171
172 const struct rave_sp_variant *variant;
173 struct blocking_notifier_head event_notifier_list;
174};
175
176static bool rave_sp_id_is_event(u8 code)
177{
178 return (code & 0xF0) == RAVE_SP_EVNT_BASE;
179}
180
181static void rave_sp_unregister_event_notifier(struct device *dev, void *res)
182{
183 struct rave_sp *sp = dev_get_drvdata(dev->parent);
184 struct notifier_block *nb = *(struct notifier_block **)res;
185 struct blocking_notifier_head *bnh = &sp->event_notifier_list;
186
187 WARN_ON(blocking_notifier_chain_unregister(bnh, nb));
188}
189
190int devm_rave_sp_register_event_notifier(struct device *dev,
191 struct notifier_block *nb)
192{
193 struct rave_sp *sp = dev_get_drvdata(dev->parent);
194 struct notifier_block **rcnb;
195 int ret;
196
197 rcnb = devres_alloc(rave_sp_unregister_event_notifier,
198 sizeof(*rcnb), GFP_KERNEL);
199 if (!rcnb)
200 return -ENOMEM;
201
202 ret = blocking_notifier_chain_register(&sp->event_notifier_list, nb);
203 if (!ret) {
204 *rcnb = nb;
205 devres_add(dev, rcnb);
206 } else {
207 devres_free(rcnb);
208 }
209
210 return ret;
211}
212EXPORT_SYMBOL_GPL(devm_rave_sp_register_event_notifier);
213
214static void csum_8b2c(const u8 *buf, size_t size, u8 *crc)
215{
216 *crc = *buf++;
217 size--;
218
219 while (size--)
220 *crc += *buf++;
221
222 *crc = 1 + ~(*crc);
223}
224
225static void csum_ccitt(const u8 *buf, size_t size, u8 *crc)
226{
227 const u16 calculated = crc_ccitt_false(0xffff, buf, size);
228
229 /*
230 * While the rest of the wire protocol is little-endian,
231 * CCITT-16 CRC in RDU2 device is sent out in big-endian order.
232 */
233 put_unaligned_be16(calculated, crc);
234}
235
236static void *stuff(unsigned char *dest, const unsigned char *src, size_t n)
237{
238 while (n--) {
239 const unsigned char byte = *src++;
240
241 switch (byte) {
242 case RAVE_SP_STX:
243 case RAVE_SP_ETX:
244 case RAVE_SP_DLE:
245 *dest++ = RAVE_SP_DLE;
246 /* FALLTHROUGH */
247 default:
248 *dest++ = byte;
249 }
250 }
251
252 return dest;
253}
254
255static int rave_sp_write(struct rave_sp *sp, const u8 *data, u8 data_size)
256{
257 const size_t checksum_length = sp->variant->checksum->length;
258 unsigned char frame[RAVE_SP_TX_BUFFER_SIZE];
259 unsigned char crc[RAVE_SP_CHECKSUM_SIZE];
260 unsigned char *dest = frame;
261 size_t length;
262
263 if (WARN_ON(checksum_length > sizeof(crc)))
264 return -ENOMEM;
265
266 if (WARN_ON(data_size > sizeof(frame)))
267 return -ENOMEM;
268
269 sp->variant->checksum->subroutine(data, data_size, crc);
270
271 *dest++ = RAVE_SP_STX;
272 dest = stuff(dest, data, data_size);
273 dest = stuff(dest, crc, checksum_length);
274 *dest++ = RAVE_SP_ETX;
275
276 length = dest - frame;
277
278 print_hex_dump(KERN_DEBUG, "rave-sp tx: ", DUMP_PREFIX_NONE,
279 16, 1, frame, length, false);
280
281 return serdev_device_write(sp->serdev, frame, length, HZ);
282}
283
284static u8 rave_sp_reply_code(u8 command)
285{
286 /*
287 * There isn't a single rule that describes command code ->
288 * ACK code transformation, but, going through various
289 * versions of ICDs, there appear to be three distinct groups
290 * that can be described by simple transformation.
291 */
292 switch (command) {
293 case 0xA0 ... 0xBE:
294 /*
295 * Commands implemented by firmware found in RDU1 and
296 * older devices all seem to obey the following rule
297 */
298 return command + 0x20;
299 case 0xE0 ... 0xEF:
300 /*
301 * Events emitted by all versions of the firmare use
302 * least significant bit to get an ACK code
303 */
304 return command | 0x01;
305 default:
306 /*
307 * Commands implemented by firmware found in RDU2 are
308 * similar to "old" commands, but they use slightly
309 * different offset
310 */
311 return command + 0x40;
312 }
313}
314
315int rave_sp_exec(struct rave_sp *sp,
316 void *__data, size_t data_size,
317 void *reply_data, size_t reply_data_size)
318{
319 struct rave_sp_reply reply = {
320 .data = reply_data,
321 .length = reply_data_size,
322 .received = COMPLETION_INITIALIZER_ONSTACK(reply.received),
323 };
324 unsigned char *data = __data;
325 int command, ret = 0;
326 u8 ackid;
327
328 command = sp->variant->cmd.translate(data[0]);
329 if (command < 0)
330 return command;
331
332 ackid = atomic_inc_return(&sp->ackid);
333 reply.ackid = ackid;
334 reply.code = rave_sp_reply_code((u8)command),
335
336 mutex_lock(&sp->bus_lock);
337
338 mutex_lock(&sp->reply_lock);
339 sp->reply = &reply;
340 mutex_unlock(&sp->reply_lock);
341
342 data[0] = command;
343 data[1] = ackid;
344
345 rave_sp_write(sp, data, data_size);
346
347 if (!wait_for_completion_timeout(&reply.received, HZ)) {
348 dev_err(&sp->serdev->dev, "Command timeout\n");
349 ret = -ETIMEDOUT;
350
351 mutex_lock(&sp->reply_lock);
352 sp->reply = NULL;
353 mutex_unlock(&sp->reply_lock);
354 }
355
356 mutex_unlock(&sp->bus_lock);
357 return ret;
358}
359EXPORT_SYMBOL_GPL(rave_sp_exec);
360
361static void rave_sp_receive_event(struct rave_sp *sp,
362 const unsigned char *data, size_t length)
363{
364 u8 cmd[] = {
365 [0] = rave_sp_reply_code(data[0]),
366 [1] = data[1],
367 };
368
369 rave_sp_write(sp, cmd, sizeof(cmd));
370
371 blocking_notifier_call_chain(&sp->event_notifier_list,
372 rave_sp_action_pack(data[0], data[2]),
373 NULL);
374}
375
376static void rave_sp_receive_reply(struct rave_sp *sp,
377 const unsigned char *data, size_t length)
378{
379 struct device *dev = &sp->serdev->dev;
380 struct rave_sp_reply *reply;
381 const size_t payload_length = length - 2;
382
383 mutex_lock(&sp->reply_lock);
384 reply = sp->reply;
385
386 if (reply) {
387 if (reply->code == data[0] && reply->ackid == data[1] &&
388 payload_length >= reply->length) {
389 /*
390 * We are relying on memcpy(dst, src, 0) to be a no-op
391 * when handling commands that have a no-payload reply
392 */
393 memcpy(reply->data, &data[2], reply->length);
394 complete(&reply->received);
395 sp->reply = NULL;
396 } else {
397 dev_err(dev, "Ignoring incorrect reply\n");
398 dev_dbg(dev, "Code: expected = 0x%08x received = 0x%08x\n",
399 reply->code, data[0]);
400 dev_dbg(dev, "ACK ID: expected = 0x%08x received = 0x%08x\n",
401 reply->ackid, data[1]);
402 dev_dbg(dev, "Length: expected = %zu received = %zu\n",
403 reply->length, payload_length);
404 }
405 }
406
407 mutex_unlock(&sp->reply_lock);
408}
409
410static void rave_sp_receive_frame(struct rave_sp *sp,
411 const unsigned char *data,
412 size_t length)
413{
414 const size_t checksum_length = sp->variant->checksum->length;
415 const size_t payload_length = length - checksum_length;
416 const u8 *crc_reported = &data[payload_length];
417 struct device *dev = &sp->serdev->dev;
418 u8 crc_calculated[checksum_length];
419
420 print_hex_dump(KERN_DEBUG, "rave-sp rx: ", DUMP_PREFIX_NONE,
421 16, 1, data, length, false);
422
423 if (unlikely(length <= checksum_length)) {
424 dev_warn(dev, "Dropping short frame\n");
425 return;
426 }
427
428 sp->variant->checksum->subroutine(data, payload_length,
429 crc_calculated);
430
431 if (memcmp(crc_calculated, crc_reported, checksum_length)) {
432 dev_warn(dev, "Dropping bad frame\n");
433 return;
434 }
435
436 if (rave_sp_id_is_event(data[0]))
437 rave_sp_receive_event(sp, data, length);
438 else
439 rave_sp_receive_reply(sp, data, length);
440}
441
442static int rave_sp_receive_buf(struct serdev_device *serdev,
443 const unsigned char *buf, size_t size)
444{
445 struct device *dev = &serdev->dev;
446 struct rave_sp *sp = dev_get_drvdata(dev);
447 struct rave_sp_deframer *deframer = &sp->deframer;
448 const unsigned char *src = buf;
449 const unsigned char *end = buf + size;
450
451 while (src < end) {
452 const unsigned char byte = *src++;
453
454 switch (deframer->state) {
455 case RAVE_SP_EXPECT_SOF:
456 if (byte == RAVE_SP_STX)
457 deframer->state = RAVE_SP_EXPECT_DATA;
458 break;
459
460 case RAVE_SP_EXPECT_DATA:
461 /*
462 * Treat special byte values first
463 */
464 switch (byte) {
465 case RAVE_SP_ETX:
466 rave_sp_receive_frame(sp,
467 deframer->data,
468 deframer->length);
469 /*
470 * Once we extracted a complete frame
471 * out of a stream, we call it done
472 * and proceed to bailing out while
473 * resetting the framer to initial
474 * state, regardless if we've consumed
475 * all of the stream or not.
476 */
477 goto reset_framer;
478 case RAVE_SP_STX:
479 dev_warn(dev, "Bad frame: STX before ETX\n");
480 /*
481 * If we encounter second "start of
482 * the frame" marker before seeing
483 * corresponding "end of frame", we
484 * reset the framer and ignore both:
485 * frame started by first SOF and
486 * frame started by current SOF.
487 *
488 * NOTE: The above means that only the
489 * frame started by third SOF, sent
490 * after this one will have a chance
491 * to get throught.
492 */
493 goto reset_framer;
494 case RAVE_SP_DLE:
495 deframer->state = RAVE_SP_EXPECT_ESCAPED_DATA;
496 /*
497 * If we encounter escape sequence we
498 * need to skip it and collect the
499 * byte that follows. We do it by
500 * forcing the next iteration of the
501 * encompassing while loop.
502 */
503 continue;
504 }
505 /*
506 * For the rest of the bytes, that are not
507 * speical snoflakes, we do the same thing
508 * that we do to escaped data - collect it in
509 * deframer buffer
510 */
511
512 /* FALLTHROUGH */
513
514 case RAVE_SP_EXPECT_ESCAPED_DATA:
515 deframer->data[deframer->length++] = byte;
516
517 if (deframer->length == sizeof(deframer->data)) {
518 dev_warn(dev, "Bad frame: Too long\n");
519 /*
520 * If the amount of data we've
521 * accumulated for current frame so
522 * far starts to exceed the capacity
523 * of deframer's buffer, there's
524 * nothing else we can do but to
525 * discard that data and start
526 * assemblying a new frame again
527 */
528 goto reset_framer;
529 }
530
531 /*
532 * We've extracted out special byte, now we
533 * can go back to regular data collecting
534 */
535 deframer->state = RAVE_SP_EXPECT_DATA;
536 break;
537 }
538 }
539
540 /*
541 * The only way to get out of the above loop and end up here
542 * is throught consuming all of the supplied data, so here we
543 * report that we processed it all.
544 */
545 return size;
546
547reset_framer:
548 /*
549 * NOTE: A number of codepaths that will drop us here will do
550 * so before consuming all 'size' bytes of the data passed by
551 * serdev layer. We rely on the fact that serdev layer will
552 * re-execute this handler with the remainder of the Rx bytes
553 * once we report actual number of bytes that we processed.
554 */
555 deframer->state = RAVE_SP_EXPECT_SOF;
556 deframer->length = 0;
557
558 return src - buf;
559}
560
561static int rave_sp_rdu1_cmd_translate(enum rave_sp_command command)
562{
563 if (command >= RAVE_SP_CMD_STATUS &&
564 command <= RAVE_SP_CMD_CONTROL_EVENTS)
565 return command;
566
567 return -EINVAL;
568}
569
570static int rave_sp_rdu2_cmd_translate(enum rave_sp_command command)
571{
572 if (command >= RAVE_SP_CMD_GET_FIRMWARE_VERSION &&
573 command <= RAVE_SP_CMD_GET_GPIO_STATE)
574 return command;
575
576 if (command == RAVE_SP_CMD_REQ_COPPER_REV) {
577 /*
578 * As per RDU2 ICD 3.4.47 CMD_GET_COPPER_REV code is
579 * different from that for RDU1 and it is set to 0x28.
580 */
581 return 0x28;
582 }
583
584 return rave_sp_rdu1_cmd_translate(command);
585}
586
587static int rave_sp_default_cmd_translate(enum rave_sp_command command)
588{
589 /*
590 * All of the following command codes were taken from "Table :
591 * Communications Protocol Message Types" in section 3.3
592 * "MESSAGE TYPES" of Rave PIC24 ICD.
593 */
594 switch (command) {
595 case RAVE_SP_CMD_GET_FIRMWARE_VERSION:
596 return 0x11;
597 case RAVE_SP_CMD_GET_BOOTLOADER_VERSION:
598 return 0x12;
599 case RAVE_SP_CMD_BOOT_SOURCE:
600 return 0x14;
601 case RAVE_SP_CMD_SW_WDT:
602 return 0x1C;
603 case RAVE_SP_CMD_RESET:
604 return 0x1E;
605 case RAVE_SP_CMD_RESET_REASON:
606 return 0x1F;
607 default:
608 return -EINVAL;
609 }
610}
611
612static const struct rave_sp_checksum rave_sp_checksum_8b2c = {
613 .length = 1,
614 .subroutine = csum_8b2c,
615};
616
617static const struct rave_sp_checksum rave_sp_checksum_ccitt = {
618 .length = 2,
619 .subroutine = csum_ccitt,
620};
621
622static const struct rave_sp_variant rave_sp_legacy = {
623 .checksum = &rave_sp_checksum_8b2c,
624 .cmd = {
625 .translate = rave_sp_default_cmd_translate,
626 },
627};
628
629static const struct rave_sp_variant rave_sp_rdu1 = {
630 .checksum = &rave_sp_checksum_8b2c,
631 .cmd = {
632 .translate = rave_sp_rdu1_cmd_translate,
633 },
634};
635
636static const struct rave_sp_variant rave_sp_rdu2 = {
637 .checksum = &rave_sp_checksum_ccitt,
638 .cmd = {
639 .translate = rave_sp_rdu2_cmd_translate,
640 },
641};
642
643static const struct of_device_id rave_sp_dt_ids[] = {
644 { .compatible = "zii,rave-sp-niu", .data = &rave_sp_legacy },
645 { .compatible = "zii,rave-sp-mezz", .data = &rave_sp_legacy },
646 { .compatible = "zii,rave-sp-esb", .data = &rave_sp_legacy },
647 { .compatible = "zii,rave-sp-rdu1", .data = &rave_sp_rdu1 },
648 { .compatible = "zii,rave-sp-rdu2", .data = &rave_sp_rdu2 },
649 { /* sentinel */ }
650};
651
652static const struct serdev_device_ops rave_sp_serdev_device_ops = {
653 .receive_buf = rave_sp_receive_buf,
654 .write_wakeup = serdev_device_write_wakeup,
655};
656
657static int rave_sp_probe(struct serdev_device *serdev)
658{
659 struct device *dev = &serdev->dev;
660 struct rave_sp *sp;
661 u32 baud;
662 int ret;
663
664 if (of_property_read_u32(dev->of_node, "current-speed", &baud)) {
665 dev_err(dev,
666 "'current-speed' is not specified in device node\n");
667 return -EINVAL;
668 }
669
670 sp = devm_kzalloc(dev, sizeof(*sp), GFP_KERNEL);
671 if (!sp)
672 return -ENOMEM;
673
674 sp->serdev = serdev;
675 dev_set_drvdata(dev, sp);
676
677 sp->variant = of_device_get_match_data(dev);
678 if (!sp->variant)
679 return -ENODEV;
680
681 mutex_init(&sp->bus_lock);
682 mutex_init(&sp->reply_lock);
683 BLOCKING_INIT_NOTIFIER_HEAD(&sp->event_notifier_list);
684
685 serdev_device_set_client_ops(serdev, &rave_sp_serdev_device_ops);
686 ret = devm_serdev_device_open(dev, serdev);
687 if (ret)
688 return ret;
689
690 serdev_device_set_baudrate(serdev, baud);
691
692 return devm_of_platform_populate(dev);
693}
694
695MODULE_DEVICE_TABLE(of, rave_sp_dt_ids);
696
697static struct serdev_device_driver rave_sp_drv = {
698 .probe = rave_sp_probe,
699 .driver = {
700 .name = "rave-sp",
701 .of_match_table = rave_sp_dt_ids,
702 },
703};
704module_serdev_device_driver(rave_sp_drv);
705
706MODULE_LICENSE("GPL");
707MODULE_AUTHOR("Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>");
708MODULE_AUTHOR("Nikita Yushchenko <nikita.yoush@cogentembedded.com>");
709MODULE_AUTHOR("Andrey Smirnov <andrew.smirnov@gmail.com>");
710MODULE_DESCRIPTION("RAVE SP core driver");