Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * I2C Link Layer for PN544 HCI based Driver
4 *
5 * Copyright (C) 2012 Intel Corporation. All rights reserved.
6 */
7
8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9
10#include <linux/crc-ccitt.h>
11#include <linux/module.h>
12#include <linux/i2c.h>
13#include <linux/acpi.h>
14#include <linux/interrupt.h>
15#include <linux/delay.h>
16#include <linux/nfc.h>
17#include <linux/firmware.h>
18#include <linux/gpio/consumer.h>
19
20#include <linux/unaligned.h>
21
22#include <net/nfc/hci.h>
23#include <net/nfc/llc.h>
24#include <net/nfc/nfc.h>
25
26#include "pn544.h"
27
28#define PN544_I2C_FRAME_HEADROOM 1
29#define PN544_I2C_FRAME_TAILROOM 2
30
31/* GPIO names */
32#define PN544_GPIO_NAME_IRQ "pn544_irq"
33#define PN544_GPIO_NAME_FW "pn544_fw"
34#define PN544_GPIO_NAME_EN "pn544_en"
35
36/* framing in HCI mode */
37#define PN544_HCI_I2C_LLC_LEN 1
38#define PN544_HCI_I2C_LLC_CRC 2
39#define PN544_HCI_I2C_LLC_LEN_CRC (PN544_HCI_I2C_LLC_LEN + \
40 PN544_HCI_I2C_LLC_CRC)
41#define PN544_HCI_I2C_LLC_MIN_SIZE (1 + PN544_HCI_I2C_LLC_LEN_CRC)
42#define PN544_HCI_I2C_LLC_MAX_PAYLOAD 29
43#define PN544_HCI_I2C_LLC_MAX_SIZE (PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
44 PN544_HCI_I2C_LLC_MAX_PAYLOAD)
45
46static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
47 { "pn544" },
48 {}
49};
50
51MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
52
53static const struct acpi_device_id pn544_hci_i2c_acpi_match[] __maybe_unused = {
54 {"NXP5440", 0},
55 {}
56};
57
58MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
59
60#define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
61
62/*
63 * Exposed through the 4 most significant bytes
64 * from the HCI SW_VERSION first byte, a.k.a.
65 * SW RomLib.
66 */
67#define PN544_HW_VARIANT_C2 0xa
68#define PN544_HW_VARIANT_C3 0xb
69
70#define PN544_FW_CMD_RESET 0x01
71#define PN544_FW_CMD_WRITE 0x08
72#define PN544_FW_CMD_CHECK 0x06
73#define PN544_FW_CMD_SECURE_WRITE 0x0C
74#define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
75
76struct pn544_i2c_fw_frame_write {
77 u8 cmd;
78 u16 be_length;
79 u8 be_dest_addr[3];
80 u16 be_datalen;
81 u8 data[];
82} __packed;
83
84struct pn544_i2c_fw_frame_check {
85 u8 cmd;
86 u16 be_length;
87 u8 be_start_addr[3];
88 u16 be_datalen;
89 u16 be_crc;
90} __packed;
91
92struct pn544_i2c_fw_frame_response {
93 u8 status;
94 u16 be_length;
95} __packed;
96
97struct pn544_i2c_fw_blob {
98 u32 be_size;
99 u32 be_destaddr;
100 u8 data[];
101};
102
103struct pn544_i2c_fw_secure_frame {
104 u8 cmd;
105 u16 be_datalen;
106 u8 data[];
107} __packed;
108
109struct pn544_i2c_fw_secure_blob {
110 u64 header;
111 u8 data[];
112};
113
114#define PN544_FW_CMD_RESULT_TIMEOUT 0x01
115#define PN544_FW_CMD_RESULT_BAD_CRC 0x02
116#define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
117#define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
118#define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
119#define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
120#define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
121#define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
122#define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
123#define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
124#define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
125#define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
126#define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
127#define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
128
129#define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
130#define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
131#define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
132#define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
133 PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
134 PN544_FW_WRITE_BUFFER_MAX_LEN)
135#define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
136#define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
137 PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
138#define PN544_FW_SECURE_FRAME_HEADER_LEN 3
139#define PN544_FW_SECURE_BLOB_HEADER_LEN 8
140
141#define FW_WORK_STATE_IDLE 1
142#define FW_WORK_STATE_START 2
143#define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
144#define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
145#define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
146
147struct pn544_i2c_phy {
148 struct i2c_client *i2c_dev;
149 struct nfc_hci_dev *hdev;
150
151 struct gpio_desc *gpiod_en;
152 struct gpio_desc *gpiod_fw;
153
154 unsigned int en_polarity;
155
156 u8 hw_variant;
157
158 struct work_struct fw_work;
159 int fw_work_state;
160 char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
161 const struct firmware *fw;
162 u32 fw_blob_dest_addr;
163 size_t fw_blob_size;
164 const u8 *fw_blob_data;
165 size_t fw_written;
166 size_t fw_size;
167
168 int fw_cmd_result;
169
170 int powered;
171 int run_mode;
172
173 int hard_fault; /*
174 * < 0 if hardware error occured (e.g. i2c err)
175 * and prevents normal operation.
176 */
177};
178
179#define I2C_DUMP_SKB(info, skb) \
180do { \
181 pr_debug("%s:\n", info); \
182 print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
183 16, 1, (skb)->data, (skb)->len, 0); \
184} while (0)
185
186static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
187{
188 int polarity, retry, ret;
189 static const char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
190 int count = sizeof(rset_cmd);
191
192 nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
193
194 /* Disable fw download */
195 gpiod_set_value_cansleep(phy->gpiod_fw, 0);
196
197 for (polarity = 0; polarity < 2; polarity++) {
198 phy->en_polarity = polarity;
199 retry = 3;
200 while (retry--) {
201 /* power off */
202 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
203 usleep_range(10000, 15000);
204
205 /* power on */
206 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
207 usleep_range(10000, 15000);
208
209 /* send reset */
210 dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
211 ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
212 if (ret == count) {
213 nfc_info(&phy->i2c_dev->dev,
214 "nfc_en polarity : active %s\n",
215 (polarity == 0 ? "low" : "high"));
216 goto out;
217 }
218 }
219 }
220
221 nfc_err(&phy->i2c_dev->dev,
222 "Could not detect nfc_en polarity, fallback to active high\n");
223
224out:
225 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
226 usleep_range(10000, 15000);
227}
228
229static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
230{
231 gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
232 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
233 usleep_range(10000, 15000);
234
235 phy->run_mode = run_mode;
236}
237
238static int pn544_hci_i2c_enable(void *phy_id)
239{
240 struct pn544_i2c_phy *phy = phy_id;
241
242 pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
243
244 phy->powered = 1;
245
246 return 0;
247}
248
249static void pn544_hci_i2c_disable(void *phy_id)
250{
251 struct pn544_i2c_phy *phy = phy_id;
252
253 gpiod_set_value_cansleep(phy->gpiod_fw, 0);
254 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
255 usleep_range(10000, 15000);
256
257 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
258 usleep_range(10000, 15000);
259
260 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
261 usleep_range(10000, 15000);
262
263 phy->powered = 0;
264}
265
266static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
267{
268 u16 crc;
269 int len;
270
271 len = skb->len + 2;
272 *(u8 *)skb_push(skb, 1) = len;
273
274 crc = crc_ccitt(0xffff, skb->data, skb->len);
275 crc = ~crc;
276 skb_put_u8(skb, crc & 0xff);
277 skb_put_u8(skb, crc >> 8);
278}
279
280static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
281{
282 skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
283 skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
284}
285
286/*
287 * Writing a frame must not return the number of written bytes.
288 * It must return either zero for success, or <0 for error.
289 * In addition, it must not alter the skb
290 */
291static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
292{
293 int r;
294 struct pn544_i2c_phy *phy = phy_id;
295 struct i2c_client *client = phy->i2c_dev;
296
297 if (phy->hard_fault != 0)
298 return phy->hard_fault;
299
300 usleep_range(3000, 6000);
301
302 pn544_hci_i2c_add_len_crc(skb);
303
304 I2C_DUMP_SKB("i2c frame written", skb);
305
306 r = i2c_master_send(client, skb->data, skb->len);
307
308 if (r == -EREMOTEIO) { /* Retry, chip was in standby */
309 usleep_range(6000, 10000);
310 r = i2c_master_send(client, skb->data, skb->len);
311 }
312
313 if (r >= 0) {
314 if (r != skb->len)
315 r = -EREMOTEIO;
316 else
317 r = 0;
318 }
319
320 pn544_hci_i2c_remove_len_crc(skb);
321
322 return r;
323}
324
325static int check_crc(u8 *buf, int buflen)
326{
327 int len;
328 u16 crc;
329
330 len = buf[0] + 1;
331 crc = crc_ccitt(0xffff, buf, len - 2);
332 crc = ~crc;
333
334 if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
335 pr_err("CRC error 0x%x != 0x%x 0x%x\n",
336 crc, buf[len - 1], buf[len - 2]);
337 pr_info("%s: BAD CRC\n", __func__);
338 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
339 16, 2, buf, buflen, false);
340 return -EPERM;
341 }
342 return 0;
343}
344
345/*
346 * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
347 * that i2c bus will be flushed and that next read will start on a new frame.
348 * returned skb contains only LLC header and payload.
349 * returns:
350 * -EREMOTEIO : i2c read error (fatal)
351 * -EBADMSG : frame was incorrect and discarded
352 * -ENOMEM : cannot allocate skb, frame dropped
353 */
354static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
355{
356 int r;
357 u8 len;
358 u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
359 struct i2c_client *client = phy->i2c_dev;
360
361 r = i2c_master_recv(client, &len, 1);
362 if (r != 1) {
363 nfc_err(&client->dev, "cannot read len byte\n");
364 return -EREMOTEIO;
365 }
366
367 if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
368 (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
369 nfc_err(&client->dev, "invalid len byte\n");
370 r = -EBADMSG;
371 goto flush;
372 }
373
374 *skb = alloc_skb(1 + len, GFP_KERNEL);
375 if (*skb == NULL) {
376 r = -ENOMEM;
377 goto flush;
378 }
379
380 skb_put_u8(*skb, len);
381
382 r = i2c_master_recv(client, skb_put(*skb, len), len);
383 if (r != len) {
384 kfree_skb(*skb);
385 return -EREMOTEIO;
386 }
387
388 I2C_DUMP_SKB("i2c frame read", *skb);
389
390 r = check_crc((*skb)->data, (*skb)->len);
391 if (r != 0) {
392 kfree_skb(*skb);
393 r = -EBADMSG;
394 goto flush;
395 }
396
397 skb_pull(*skb, 1);
398 skb_trim(*skb, (*skb)->len - 2);
399
400 usleep_range(3000, 6000);
401
402 return 0;
403
404flush:
405 if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
406 r = -EREMOTEIO;
407
408 usleep_range(3000, 6000);
409
410 return r;
411}
412
413static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
414{
415 int r;
416 struct pn544_i2c_fw_frame_response response;
417 struct i2c_client *client = phy->i2c_dev;
418
419 r = i2c_master_recv(client, (char *) &response, sizeof(response));
420 if (r != sizeof(response)) {
421 nfc_err(&client->dev, "cannot read fw status\n");
422 return -EIO;
423 }
424
425 usleep_range(3000, 6000);
426
427 switch (response.status) {
428 case 0:
429 return 0;
430 case PN544_FW_CMD_RESULT_CHUNK_OK:
431 return response.status;
432 case PN544_FW_CMD_RESULT_TIMEOUT:
433 return -ETIMEDOUT;
434 case PN544_FW_CMD_RESULT_BAD_CRC:
435 return -ENODATA;
436 case PN544_FW_CMD_RESULT_ACCESS_DENIED:
437 return -EACCES;
438 case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
439 return -EPROTO;
440 case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
441 return -EINVAL;
442 case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
443 return -ENOTSUPP;
444 case PN544_FW_CMD_RESULT_INVALID_LENGTH:
445 return -EBADMSG;
446 case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
447 return -ENOKEY;
448 case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
449 return -EINVAL;
450 case PN544_FW_CMD_RESULT_MEMORY_ERROR:
451 return -ENOMEM;
452 case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
453 return -EACCES;
454 case PN544_FW_CMD_RESULT_WRITE_FAILED:
455 case PN544_FW_CMD_RESULT_CHUNK_ERROR:
456 return -EIO;
457 default:
458 return -EIO;
459 }
460}
461
462/*
463 * Reads an shdlc frame from the chip. This is not as straightforward as it
464 * seems. There are cases where we could loose the frame start synchronization.
465 * The frame format is len-data-crc, and corruption can occur anywhere while
466 * transiting on i2c bus, such that we could read an invalid len.
467 * In order to recover synchronization with the next frame, we must be sure
468 * to read the real amount of data without using the len byte. We do this by
469 * assuming the following:
470 * - the chip will always present only one single complete frame on the bus
471 * before triggering the interrupt
472 * - the chip will not present a new frame until we have completely read
473 * the previous one (or until we have handled the interrupt).
474 * The tricky case is when we read a corrupted len that is less than the real
475 * len. We must detect this here in order to determine that we need to flush
476 * the bus. This is the reason why we check the crc here.
477 */
478static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
479{
480 struct pn544_i2c_phy *phy = phy_id;
481 struct i2c_client *client;
482 struct sk_buff *skb = NULL;
483 int r;
484
485 if (!phy || irq != phy->i2c_dev->irq) {
486 WARN_ON_ONCE(1);
487 return IRQ_NONE;
488 }
489
490 client = phy->i2c_dev;
491 dev_dbg(&client->dev, "IRQ\n");
492
493 if (phy->hard_fault != 0)
494 return IRQ_HANDLED;
495
496 if (phy->run_mode == PN544_FW_MODE) {
497 phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
498 schedule_work(&phy->fw_work);
499 } else {
500 r = pn544_hci_i2c_read(phy, &skb);
501 if (r == -EREMOTEIO) {
502 phy->hard_fault = r;
503
504 nfc_hci_recv_frame(phy->hdev, NULL);
505
506 return IRQ_HANDLED;
507 } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
508 return IRQ_HANDLED;
509 }
510
511 nfc_hci_recv_frame(phy->hdev, skb);
512 }
513 return IRQ_HANDLED;
514}
515
516static const struct nfc_phy_ops i2c_phy_ops = {
517 .write = pn544_hci_i2c_write,
518 .enable = pn544_hci_i2c_enable,
519 .disable = pn544_hci_i2c_disable,
520};
521
522static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
523 u8 hw_variant)
524{
525 struct pn544_i2c_phy *phy = phy_id;
526
527 pr_info("Starting Firmware Download (%s)\n", firmware_name);
528
529 strcpy(phy->firmware_name, firmware_name);
530
531 phy->hw_variant = hw_variant;
532 phy->fw_work_state = FW_WORK_STATE_START;
533
534 schedule_work(&phy->fw_work);
535
536 return 0;
537}
538
539static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
540 int result)
541{
542 pr_info("Firmware Download Complete, result=%d\n", result);
543
544 pn544_hci_i2c_disable(phy);
545
546 phy->fw_work_state = FW_WORK_STATE_IDLE;
547
548 if (phy->fw) {
549 release_firmware(phy->fw);
550 phy->fw = NULL;
551 }
552
553 nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
554}
555
556static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
557 const u8 *data, u16 datalen)
558{
559 u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
560 struct pn544_i2c_fw_frame_write *framep;
561 u16 params_len;
562 int framelen;
563 int r;
564
565 if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
566 datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
567
568 framep = (struct pn544_i2c_fw_frame_write *) frame;
569
570 params_len = sizeof(framep->be_dest_addr) +
571 sizeof(framep->be_datalen) + datalen;
572 framelen = params_len + sizeof(framep->cmd) +
573 sizeof(framep->be_length);
574
575 framep->cmd = PN544_FW_CMD_WRITE;
576
577 put_unaligned_be16(params_len, &framep->be_length);
578
579 framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
580 framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
581 framep->be_dest_addr[2] = dest_addr & 0xff;
582
583 put_unaligned_be16(datalen, &framep->be_datalen);
584
585 memcpy(framep->data, data, datalen);
586
587 r = i2c_master_send(client, frame, framelen);
588
589 if (r == framelen)
590 return datalen;
591 else if (r < 0)
592 return r;
593 else
594 return -EIO;
595}
596
597static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
598 const u8 *data, u16 datalen)
599{
600 struct pn544_i2c_fw_frame_check frame;
601 int r;
602 u16 crc;
603
604 /* calculate local crc for the data we want to check */
605 crc = crc_ccitt(0xffff, data, datalen);
606
607 frame.cmd = PN544_FW_CMD_CHECK;
608
609 put_unaligned_be16(sizeof(frame.be_start_addr) +
610 sizeof(frame.be_datalen) + sizeof(frame.be_crc),
611 &frame.be_length);
612
613 /* tell the chip the memory region to which our crc applies */
614 frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
615 frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
616 frame.be_start_addr[2] = start_addr & 0xff;
617
618 put_unaligned_be16(datalen, &frame.be_datalen);
619
620 /*
621 * and give our local crc. Chip will calculate its own crc for the
622 * region and compare with ours.
623 */
624 put_unaligned_be16(crc, &frame.be_crc);
625
626 r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
627
628 if (r == sizeof(frame))
629 return 0;
630 else if (r < 0)
631 return r;
632 else
633 return -EIO;
634}
635
636static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
637{
638 int r;
639
640 r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
641 phy->fw_blob_dest_addr + phy->fw_written,
642 phy->fw_blob_data + phy->fw_written,
643 phy->fw_blob_size - phy->fw_written);
644 if (r < 0)
645 return r;
646
647 phy->fw_written += r;
648 phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
649
650 return 0;
651}
652
653static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
654 const u8 *data, u16 datalen)
655{
656 u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
657 struct pn544_i2c_fw_secure_frame *chunk;
658 int chunklen;
659 int r;
660
661 if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
662 datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
663
664 chunk = (struct pn544_i2c_fw_secure_frame *) buf;
665
666 chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
667
668 put_unaligned_be16(datalen, &chunk->be_datalen);
669
670 memcpy(chunk->data, data, datalen);
671
672 chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
673
674 r = i2c_master_send(phy->i2c_dev, buf, chunklen);
675
676 if (r == chunklen)
677 return datalen;
678 else if (r < 0)
679 return r;
680 else
681 return -EIO;
682
683}
684
685static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
686{
687 struct pn544_i2c_fw_secure_frame *framep;
688 int r;
689
690 framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
691 if (phy->fw_written == 0)
692 phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
693 + PN544_FW_SECURE_FRAME_HEADER_LEN;
694
695 /* Only secure write command can be chunked*/
696 if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
697 framep->cmd != PN544_FW_CMD_SECURE_WRITE)
698 return -EINVAL;
699
700 /* The firmware also have other commands, we just send them directly */
701 if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
702 r = i2c_master_send(phy->i2c_dev,
703 (const char *) phy->fw_blob_data, phy->fw_blob_size);
704
705 if (r == phy->fw_blob_size)
706 goto exit;
707 else if (r < 0)
708 return r;
709 else
710 return -EIO;
711 }
712
713 r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
714 phy->fw_blob_data + phy->fw_written,
715 phy->fw_blob_size - phy->fw_written);
716 if (r < 0)
717 return r;
718
719exit:
720 phy->fw_written += r;
721 phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
722
723 /* SW reset command will not trig any response from PN544 */
724 if (framep->cmd == PN544_FW_CMD_RESET) {
725 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
726 phy->fw_cmd_result = 0;
727 schedule_work(&phy->fw_work);
728 }
729
730 return 0;
731}
732
733static void pn544_hci_i2c_fw_work(struct work_struct *work)
734{
735 struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
736 fw_work);
737 int r;
738 struct pn544_i2c_fw_blob *blob;
739 struct pn544_i2c_fw_secure_blob *secure_blob;
740
741 switch (phy->fw_work_state) {
742 case FW_WORK_STATE_START:
743 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
744
745 r = request_firmware(&phy->fw, phy->firmware_name,
746 &phy->i2c_dev->dev);
747 if (r < 0)
748 goto exit_state_start;
749
750 phy->fw_written = 0;
751
752 switch (phy->hw_variant) {
753 case PN544_HW_VARIANT_C2:
754 blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
755 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
756 phy->fw_blob_dest_addr = get_unaligned_be32(
757 &blob->be_destaddr);
758 phy->fw_blob_data = blob->data;
759
760 r = pn544_hci_i2c_fw_write_chunk(phy);
761 break;
762 case PN544_HW_VARIANT_C3:
763 secure_blob = (struct pn544_i2c_fw_secure_blob *)
764 phy->fw->data;
765 phy->fw_blob_data = secure_blob->data;
766 phy->fw_size = phy->fw->size;
767 r = pn544_hci_i2c_fw_secure_write_frame(phy);
768 break;
769 default:
770 r = -ENOTSUPP;
771 break;
772 }
773
774exit_state_start:
775 if (r < 0)
776 pn544_hci_i2c_fw_work_complete(phy, r);
777 break;
778
779 case FW_WORK_STATE_WAIT_WRITE_ANSWER:
780 r = phy->fw_cmd_result;
781 if (r < 0)
782 goto exit_state_wait_write_answer;
783
784 if (phy->fw_written == phy->fw_blob_size) {
785 r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
786 phy->fw_blob_dest_addr,
787 phy->fw_blob_data,
788 phy->fw_blob_size);
789 if (r < 0)
790 goto exit_state_wait_write_answer;
791 phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
792 break;
793 }
794
795 r = pn544_hci_i2c_fw_write_chunk(phy);
796
797exit_state_wait_write_answer:
798 if (r < 0)
799 pn544_hci_i2c_fw_work_complete(phy, r);
800 break;
801
802 case FW_WORK_STATE_WAIT_CHECK_ANSWER:
803 r = phy->fw_cmd_result;
804 if (r < 0)
805 goto exit_state_wait_check_answer;
806
807 blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
808 phy->fw_blob_size);
809 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
810 if (phy->fw_blob_size != 0) {
811 phy->fw_blob_dest_addr =
812 get_unaligned_be32(&blob->be_destaddr);
813 phy->fw_blob_data = blob->data;
814
815 phy->fw_written = 0;
816 r = pn544_hci_i2c_fw_write_chunk(phy);
817 }
818
819exit_state_wait_check_answer:
820 if (r < 0 || phy->fw_blob_size == 0)
821 pn544_hci_i2c_fw_work_complete(phy, r);
822 break;
823
824 case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
825 r = phy->fw_cmd_result;
826 if (r < 0)
827 goto exit_state_wait_secure_write_answer;
828
829 if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
830 r = pn544_hci_i2c_fw_secure_write_frame(phy);
831 goto exit_state_wait_secure_write_answer;
832 }
833
834 if (phy->fw_written == phy->fw_blob_size) {
835 secure_blob = (struct pn544_i2c_fw_secure_blob *)
836 (phy->fw_blob_data + phy->fw_blob_size);
837 phy->fw_size -= phy->fw_blob_size +
838 PN544_FW_SECURE_BLOB_HEADER_LEN;
839 if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
840 + PN544_FW_SECURE_FRAME_HEADER_LEN) {
841 phy->fw_blob_data = secure_blob->data;
842
843 phy->fw_written = 0;
844 r = pn544_hci_i2c_fw_secure_write_frame(phy);
845 }
846 }
847
848exit_state_wait_secure_write_answer:
849 if (r < 0 || phy->fw_size == 0)
850 pn544_hci_i2c_fw_work_complete(phy, r);
851 break;
852
853 default:
854 break;
855 }
856}
857
858static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
859static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
860
861static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
862 { "enable-gpios", &enable_gpios, 1 },
863 { "firmware-gpios", &firmware_gpios, 1 },
864 { },
865};
866
867static int pn544_hci_i2c_probe(struct i2c_client *client)
868{
869 struct device *dev = &client->dev;
870 struct pn544_i2c_phy *phy;
871 int r = 0;
872
873 if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
874 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
875 return -ENODEV;
876 }
877
878 phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
879 GFP_KERNEL);
880 if (!phy)
881 return -ENOMEM;
882
883 INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
884 phy->fw_work_state = FW_WORK_STATE_IDLE;
885
886 phy->i2c_dev = client;
887 i2c_set_clientdata(client, phy);
888
889 r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
890 if (r)
891 dev_dbg(dev, "Unable to add GPIO mapping table\n");
892
893 /* Get EN GPIO */
894 phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
895 if (IS_ERR(phy->gpiod_en)) {
896 nfc_err(dev, "Unable to get EN GPIO\n");
897 return PTR_ERR(phy->gpiod_en);
898 }
899
900 /* Get FW GPIO */
901 phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
902 if (IS_ERR(phy->gpiod_fw)) {
903 nfc_err(dev, "Unable to get FW GPIO\n");
904 return PTR_ERR(phy->gpiod_fw);
905 }
906
907 pn544_hci_i2c_platform_init(phy);
908
909 r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
910 pn544_hci_i2c_irq_thread_fn,
911 IRQF_TRIGGER_RISING | IRQF_ONESHOT,
912 PN544_HCI_I2C_DRIVER_NAME, phy);
913 if (r < 0) {
914 nfc_err(&client->dev, "Unable to register IRQ handler\n");
915 return r;
916 }
917
918 r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
919 PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
920 PN544_HCI_I2C_LLC_MAX_PAYLOAD,
921 pn544_hci_i2c_fw_download, &phy->hdev);
922 if (r < 0)
923 return r;
924
925 return 0;
926}
927
928static void pn544_hci_i2c_remove(struct i2c_client *client)
929{
930 struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
931
932 cancel_work_sync(&phy->fw_work);
933 if (phy->fw_work_state != FW_WORK_STATE_IDLE)
934 pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
935
936 pn544_hci_remove(phy->hdev);
937
938 if (phy->powered)
939 pn544_hci_i2c_disable(phy);
940}
941
942static const struct of_device_id of_pn544_i2c_match[] __maybe_unused = {
943 { .compatible = "nxp,pn544-i2c", },
944 {},
945};
946MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
947
948static struct i2c_driver pn544_hci_i2c_driver = {
949 .driver = {
950 .name = PN544_HCI_I2C_DRIVER_NAME,
951 .of_match_table = of_match_ptr(of_pn544_i2c_match),
952 .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
953 },
954 .probe = pn544_hci_i2c_probe,
955 .id_table = pn544_hci_i2c_id_table,
956 .remove = pn544_hci_i2c_remove,
957};
958
959module_i2c_driver(pn544_hci_i2c_driver);
960
961MODULE_LICENSE("GPL");
962MODULE_DESCRIPTION(DRIVER_DESC);
1/*
2 * I2C Link Layer for PN544 HCI based Driver
3 *
4 * Copyright (C) 2012 Intel Corporation. All rights reserved.
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms and conditions of the GNU General Public License,
8 * version 2, as published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20
21#include <linux/crc-ccitt.h>
22#include <linux/module.h>
23#include <linux/i2c.h>
24#include <linux/acpi.h>
25#include <linux/interrupt.h>
26#include <linux/delay.h>
27#include <linux/nfc.h>
28#include <linux/firmware.h>
29#include <linux/gpio/consumer.h>
30
31#include <asm/unaligned.h>
32
33#include <net/nfc/hci.h>
34#include <net/nfc/llc.h>
35#include <net/nfc/nfc.h>
36
37#include "pn544.h"
38
39#define PN544_I2C_FRAME_HEADROOM 1
40#define PN544_I2C_FRAME_TAILROOM 2
41
42/* GPIO names */
43#define PN544_GPIO_NAME_IRQ "pn544_irq"
44#define PN544_GPIO_NAME_FW "pn544_fw"
45#define PN544_GPIO_NAME_EN "pn544_en"
46
47/* framing in HCI mode */
48#define PN544_HCI_I2C_LLC_LEN 1
49#define PN544_HCI_I2C_LLC_CRC 2
50#define PN544_HCI_I2C_LLC_LEN_CRC (PN544_HCI_I2C_LLC_LEN + \
51 PN544_HCI_I2C_LLC_CRC)
52#define PN544_HCI_I2C_LLC_MIN_SIZE (1 + PN544_HCI_I2C_LLC_LEN_CRC)
53#define PN544_HCI_I2C_LLC_MAX_PAYLOAD 29
54#define PN544_HCI_I2C_LLC_MAX_SIZE (PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
55 PN544_HCI_I2C_LLC_MAX_PAYLOAD)
56
57static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
58 {"pn544", 0},
59 {}
60};
61
62MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
63
64static const struct acpi_device_id pn544_hci_i2c_acpi_match[] = {
65 {"NXP5440", 0},
66 {}
67};
68
69MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
70
71#define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
72
73/*
74 * Exposed through the 4 most significant bytes
75 * from the HCI SW_VERSION first byte, a.k.a.
76 * SW RomLib.
77 */
78#define PN544_HW_VARIANT_C2 0xa
79#define PN544_HW_VARIANT_C3 0xb
80
81#define PN544_FW_CMD_RESET 0x01
82#define PN544_FW_CMD_WRITE 0x08
83#define PN544_FW_CMD_CHECK 0x06
84#define PN544_FW_CMD_SECURE_WRITE 0x0C
85#define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
86
87struct pn544_i2c_fw_frame_write {
88 u8 cmd;
89 u16 be_length;
90 u8 be_dest_addr[3];
91 u16 be_datalen;
92 u8 data[];
93} __packed;
94
95struct pn544_i2c_fw_frame_check {
96 u8 cmd;
97 u16 be_length;
98 u8 be_start_addr[3];
99 u16 be_datalen;
100 u16 be_crc;
101} __packed;
102
103struct pn544_i2c_fw_frame_response {
104 u8 status;
105 u16 be_length;
106} __packed;
107
108struct pn544_i2c_fw_blob {
109 u32 be_size;
110 u32 be_destaddr;
111 u8 data[];
112};
113
114struct pn544_i2c_fw_secure_frame {
115 u8 cmd;
116 u16 be_datalen;
117 u8 data[];
118} __packed;
119
120struct pn544_i2c_fw_secure_blob {
121 u64 header;
122 u8 data[];
123};
124
125#define PN544_FW_CMD_RESULT_TIMEOUT 0x01
126#define PN544_FW_CMD_RESULT_BAD_CRC 0x02
127#define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
128#define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
129#define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
130#define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
131#define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
132#define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
133#define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
134#define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
135#define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
136#define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
137#define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
138#define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
139
140#define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
141
142#define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
143#define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
144#define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
145#define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
146 PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
147 PN544_FW_WRITE_BUFFER_MAX_LEN)
148#define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
149#define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
150 PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
151#define PN544_FW_SECURE_FRAME_HEADER_LEN 3
152#define PN544_FW_SECURE_BLOB_HEADER_LEN 8
153
154#define FW_WORK_STATE_IDLE 1
155#define FW_WORK_STATE_START 2
156#define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
157#define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
158#define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
159
160struct pn544_i2c_phy {
161 struct i2c_client *i2c_dev;
162 struct nfc_hci_dev *hdev;
163
164 struct gpio_desc *gpiod_en;
165 struct gpio_desc *gpiod_fw;
166
167 unsigned int en_polarity;
168
169 u8 hw_variant;
170
171 struct work_struct fw_work;
172 int fw_work_state;
173 char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
174 const struct firmware *fw;
175 u32 fw_blob_dest_addr;
176 size_t fw_blob_size;
177 const u8 *fw_blob_data;
178 size_t fw_written;
179 size_t fw_size;
180
181 int fw_cmd_result;
182
183 int powered;
184 int run_mode;
185
186 int hard_fault; /*
187 * < 0 if hardware error occured (e.g. i2c err)
188 * and prevents normal operation.
189 */
190};
191
192#define I2C_DUMP_SKB(info, skb) \
193do { \
194 pr_debug("%s:\n", info); \
195 print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
196 16, 1, (skb)->data, (skb)->len, 0); \
197} while (0)
198
199static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
200{
201 int polarity, retry, ret;
202 char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
203 int count = sizeof(rset_cmd);
204
205 nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
206
207 /* Disable fw download */
208 gpiod_set_value_cansleep(phy->gpiod_fw, 0);
209
210 for (polarity = 0; polarity < 2; polarity++) {
211 phy->en_polarity = polarity;
212 retry = 3;
213 while (retry--) {
214 /* power off */
215 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
216 usleep_range(10000, 15000);
217
218 /* power on */
219 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
220 usleep_range(10000, 15000);
221
222 /* send reset */
223 dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
224 ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
225 if (ret == count) {
226 nfc_info(&phy->i2c_dev->dev,
227 "nfc_en polarity : active %s\n",
228 (polarity == 0 ? "low" : "high"));
229 goto out;
230 }
231 }
232 }
233
234 nfc_err(&phy->i2c_dev->dev,
235 "Could not detect nfc_en polarity, fallback to active high\n");
236
237out:
238 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
239}
240
241static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
242{
243 gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
244 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
245 usleep_range(10000, 15000);
246
247 phy->run_mode = run_mode;
248}
249
250static int pn544_hci_i2c_enable(void *phy_id)
251{
252 struct pn544_i2c_phy *phy = phy_id;
253
254 pr_info("%s\n", __func__);
255
256 pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
257
258 phy->powered = 1;
259
260 return 0;
261}
262
263static void pn544_hci_i2c_disable(void *phy_id)
264{
265 struct pn544_i2c_phy *phy = phy_id;
266
267 gpiod_set_value_cansleep(phy->gpiod_fw, 0);
268 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
269 usleep_range(10000, 15000);
270
271 gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
272 usleep_range(10000, 15000);
273
274 gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
275 usleep_range(10000, 15000);
276
277 phy->powered = 0;
278}
279
280static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
281{
282 u16 crc;
283 int len;
284
285 len = skb->len + 2;
286 *(u8 *)skb_push(skb, 1) = len;
287
288 crc = crc_ccitt(0xffff, skb->data, skb->len);
289 crc = ~crc;
290 skb_put_u8(skb, crc & 0xff);
291 skb_put_u8(skb, crc >> 8);
292}
293
294static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
295{
296 skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
297 skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
298}
299
300/*
301 * Writing a frame must not return the number of written bytes.
302 * It must return either zero for success, or <0 for error.
303 * In addition, it must not alter the skb
304 */
305static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
306{
307 int r;
308 struct pn544_i2c_phy *phy = phy_id;
309 struct i2c_client *client = phy->i2c_dev;
310
311 if (phy->hard_fault != 0)
312 return phy->hard_fault;
313
314 usleep_range(3000, 6000);
315
316 pn544_hci_i2c_add_len_crc(skb);
317
318 I2C_DUMP_SKB("i2c frame written", skb);
319
320 r = i2c_master_send(client, skb->data, skb->len);
321
322 if (r == -EREMOTEIO) { /* Retry, chip was in standby */
323 usleep_range(6000, 10000);
324 r = i2c_master_send(client, skb->data, skb->len);
325 }
326
327 if (r >= 0) {
328 if (r != skb->len)
329 r = -EREMOTEIO;
330 else
331 r = 0;
332 }
333
334 pn544_hci_i2c_remove_len_crc(skb);
335
336 return r;
337}
338
339static int check_crc(u8 *buf, int buflen)
340{
341 int len;
342 u16 crc;
343
344 len = buf[0] + 1;
345 crc = crc_ccitt(0xffff, buf, len - 2);
346 crc = ~crc;
347
348 if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
349 pr_err("CRC error 0x%x != 0x%x 0x%x\n",
350 crc, buf[len - 1], buf[len - 2]);
351 pr_info("%s: BAD CRC\n", __func__);
352 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
353 16, 2, buf, buflen, false);
354 return -EPERM;
355 }
356 return 0;
357}
358
359/*
360 * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
361 * that i2c bus will be flushed and that next read will start on a new frame.
362 * returned skb contains only LLC header and payload.
363 * returns:
364 * -EREMOTEIO : i2c read error (fatal)
365 * -EBADMSG : frame was incorrect and discarded
366 * -ENOMEM : cannot allocate skb, frame dropped
367 */
368static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
369{
370 int r;
371 u8 len;
372 u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
373 struct i2c_client *client = phy->i2c_dev;
374
375 r = i2c_master_recv(client, &len, 1);
376 if (r != 1) {
377 nfc_err(&client->dev, "cannot read len byte\n");
378 return -EREMOTEIO;
379 }
380
381 if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
382 (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
383 nfc_err(&client->dev, "invalid len byte\n");
384 r = -EBADMSG;
385 goto flush;
386 }
387
388 *skb = alloc_skb(1 + len, GFP_KERNEL);
389 if (*skb == NULL) {
390 r = -ENOMEM;
391 goto flush;
392 }
393
394 skb_put_u8(*skb, len);
395
396 r = i2c_master_recv(client, skb_put(*skb, len), len);
397 if (r != len) {
398 kfree_skb(*skb);
399 return -EREMOTEIO;
400 }
401
402 I2C_DUMP_SKB("i2c frame read", *skb);
403
404 r = check_crc((*skb)->data, (*skb)->len);
405 if (r != 0) {
406 kfree_skb(*skb);
407 r = -EBADMSG;
408 goto flush;
409 }
410
411 skb_pull(*skb, 1);
412 skb_trim(*skb, (*skb)->len - 2);
413
414 usleep_range(3000, 6000);
415
416 return 0;
417
418flush:
419 if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
420 r = -EREMOTEIO;
421
422 usleep_range(3000, 6000);
423
424 return r;
425}
426
427static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
428{
429 int r;
430 struct pn544_i2c_fw_frame_response response;
431 struct i2c_client *client = phy->i2c_dev;
432
433 r = i2c_master_recv(client, (char *) &response, sizeof(response));
434 if (r != sizeof(response)) {
435 nfc_err(&client->dev, "cannot read fw status\n");
436 return -EIO;
437 }
438
439 usleep_range(3000, 6000);
440
441 switch (response.status) {
442 case 0:
443 return 0;
444 case PN544_FW_CMD_RESULT_CHUNK_OK:
445 return response.status;
446 case PN544_FW_CMD_RESULT_TIMEOUT:
447 return -ETIMEDOUT;
448 case PN544_FW_CMD_RESULT_BAD_CRC:
449 return -ENODATA;
450 case PN544_FW_CMD_RESULT_ACCESS_DENIED:
451 return -EACCES;
452 case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
453 return -EPROTO;
454 case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
455 return -EINVAL;
456 case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
457 return -ENOTSUPP;
458 case PN544_FW_CMD_RESULT_INVALID_LENGTH:
459 return -EBADMSG;
460 case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
461 return -ENOKEY;
462 case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
463 return -EINVAL;
464 case PN544_FW_CMD_RESULT_MEMORY_ERROR:
465 return -ENOMEM;
466 case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
467 return -EACCES;
468 case PN544_FW_CMD_RESULT_WRITE_FAILED:
469 case PN544_FW_CMD_RESULT_CHUNK_ERROR:
470 return -EIO;
471 default:
472 return -EIO;
473 }
474}
475
476/*
477 * Reads an shdlc frame from the chip. This is not as straightforward as it
478 * seems. There are cases where we could loose the frame start synchronization.
479 * The frame format is len-data-crc, and corruption can occur anywhere while
480 * transiting on i2c bus, such that we could read an invalid len.
481 * In order to recover synchronization with the next frame, we must be sure
482 * to read the real amount of data without using the len byte. We do this by
483 * assuming the following:
484 * - the chip will always present only one single complete frame on the bus
485 * before triggering the interrupt
486 * - the chip will not present a new frame until we have completely read
487 * the previous one (or until we have handled the interrupt).
488 * The tricky case is when we read a corrupted len that is less than the real
489 * len. We must detect this here in order to determine that we need to flush
490 * the bus. This is the reason why we check the crc here.
491 */
492static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
493{
494 struct pn544_i2c_phy *phy = phy_id;
495 struct i2c_client *client;
496 struct sk_buff *skb = NULL;
497 int r;
498
499 if (!phy || irq != phy->i2c_dev->irq) {
500 WARN_ON_ONCE(1);
501 return IRQ_NONE;
502 }
503
504 client = phy->i2c_dev;
505 dev_dbg(&client->dev, "IRQ\n");
506
507 if (phy->hard_fault != 0)
508 return IRQ_HANDLED;
509
510 if (phy->run_mode == PN544_FW_MODE) {
511 phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
512 schedule_work(&phy->fw_work);
513 } else {
514 r = pn544_hci_i2c_read(phy, &skb);
515 if (r == -EREMOTEIO) {
516 phy->hard_fault = r;
517
518 nfc_hci_recv_frame(phy->hdev, NULL);
519
520 return IRQ_HANDLED;
521 } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
522 return IRQ_HANDLED;
523 }
524
525 nfc_hci_recv_frame(phy->hdev, skb);
526 }
527 return IRQ_HANDLED;
528}
529
530static struct nfc_phy_ops i2c_phy_ops = {
531 .write = pn544_hci_i2c_write,
532 .enable = pn544_hci_i2c_enable,
533 .disable = pn544_hci_i2c_disable,
534};
535
536static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
537 u8 hw_variant)
538{
539 struct pn544_i2c_phy *phy = phy_id;
540
541 pr_info("Starting Firmware Download (%s)\n", firmware_name);
542
543 strcpy(phy->firmware_name, firmware_name);
544
545 phy->hw_variant = hw_variant;
546 phy->fw_work_state = FW_WORK_STATE_START;
547
548 schedule_work(&phy->fw_work);
549
550 return 0;
551}
552
553static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
554 int result)
555{
556 pr_info("Firmware Download Complete, result=%d\n", result);
557
558 pn544_hci_i2c_disable(phy);
559
560 phy->fw_work_state = FW_WORK_STATE_IDLE;
561
562 if (phy->fw) {
563 release_firmware(phy->fw);
564 phy->fw = NULL;
565 }
566
567 nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
568}
569
570static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
571 const u8 *data, u16 datalen)
572{
573 u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
574 struct pn544_i2c_fw_frame_write *framep;
575 u16 params_len;
576 int framelen;
577 int r;
578
579 if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
580 datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
581
582 framep = (struct pn544_i2c_fw_frame_write *) frame;
583
584 params_len = sizeof(framep->be_dest_addr) +
585 sizeof(framep->be_datalen) + datalen;
586 framelen = params_len + sizeof(framep->cmd) +
587 sizeof(framep->be_length);
588
589 framep->cmd = PN544_FW_CMD_WRITE;
590
591 put_unaligned_be16(params_len, &framep->be_length);
592
593 framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
594 framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
595 framep->be_dest_addr[2] = dest_addr & 0xff;
596
597 put_unaligned_be16(datalen, &framep->be_datalen);
598
599 memcpy(framep->data, data, datalen);
600
601 r = i2c_master_send(client, frame, framelen);
602
603 if (r == framelen)
604 return datalen;
605 else if (r < 0)
606 return r;
607 else
608 return -EIO;
609}
610
611static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
612 const u8 *data, u16 datalen)
613{
614 struct pn544_i2c_fw_frame_check frame;
615 int r;
616 u16 crc;
617
618 /* calculate local crc for the data we want to check */
619 crc = crc_ccitt(0xffff, data, datalen);
620
621 frame.cmd = PN544_FW_CMD_CHECK;
622
623 put_unaligned_be16(sizeof(frame.be_start_addr) +
624 sizeof(frame.be_datalen) + sizeof(frame.be_crc),
625 &frame.be_length);
626
627 /* tell the chip the memory region to which our crc applies */
628 frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
629 frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
630 frame.be_start_addr[2] = start_addr & 0xff;
631
632 put_unaligned_be16(datalen, &frame.be_datalen);
633
634 /*
635 * and give our local crc. Chip will calculate its own crc for the
636 * region and compare with ours.
637 */
638 put_unaligned_be16(crc, &frame.be_crc);
639
640 r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
641
642 if (r == sizeof(frame))
643 return 0;
644 else if (r < 0)
645 return r;
646 else
647 return -EIO;
648}
649
650static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
651{
652 int r;
653
654 r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
655 phy->fw_blob_dest_addr + phy->fw_written,
656 phy->fw_blob_data + phy->fw_written,
657 phy->fw_blob_size - phy->fw_written);
658 if (r < 0)
659 return r;
660
661 phy->fw_written += r;
662 phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
663
664 return 0;
665}
666
667static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
668 const u8 *data, u16 datalen)
669{
670 u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
671 struct pn544_i2c_fw_secure_frame *chunk;
672 int chunklen;
673 int r;
674
675 if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
676 datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
677
678 chunk = (struct pn544_i2c_fw_secure_frame *) buf;
679
680 chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
681
682 put_unaligned_be16(datalen, &chunk->be_datalen);
683
684 memcpy(chunk->data, data, datalen);
685
686 chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
687
688 r = i2c_master_send(phy->i2c_dev, buf, chunklen);
689
690 if (r == chunklen)
691 return datalen;
692 else if (r < 0)
693 return r;
694 else
695 return -EIO;
696
697}
698
699static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
700{
701 struct pn544_i2c_fw_secure_frame *framep;
702 int r;
703
704 framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
705 if (phy->fw_written == 0)
706 phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
707 + PN544_FW_SECURE_FRAME_HEADER_LEN;
708
709 /* Only secure write command can be chunked*/
710 if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
711 framep->cmd != PN544_FW_CMD_SECURE_WRITE)
712 return -EINVAL;
713
714 /* The firmware also have other commands, we just send them directly */
715 if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
716 r = i2c_master_send(phy->i2c_dev,
717 (const char *) phy->fw_blob_data, phy->fw_blob_size);
718
719 if (r == phy->fw_blob_size)
720 goto exit;
721 else if (r < 0)
722 return r;
723 else
724 return -EIO;
725 }
726
727 r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
728 phy->fw_blob_data + phy->fw_written,
729 phy->fw_blob_size - phy->fw_written);
730 if (r < 0)
731 return r;
732
733exit:
734 phy->fw_written += r;
735 phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
736
737 /* SW reset command will not trig any response from PN544 */
738 if (framep->cmd == PN544_FW_CMD_RESET) {
739 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
740 phy->fw_cmd_result = 0;
741 schedule_work(&phy->fw_work);
742 }
743
744 return 0;
745}
746
747static void pn544_hci_i2c_fw_work(struct work_struct *work)
748{
749 struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
750 fw_work);
751 int r;
752 struct pn544_i2c_fw_blob *blob;
753 struct pn544_i2c_fw_secure_blob *secure_blob;
754
755 switch (phy->fw_work_state) {
756 case FW_WORK_STATE_START:
757 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
758
759 r = request_firmware(&phy->fw, phy->firmware_name,
760 &phy->i2c_dev->dev);
761 if (r < 0)
762 goto exit_state_start;
763
764 phy->fw_written = 0;
765
766 switch (phy->hw_variant) {
767 case PN544_HW_VARIANT_C2:
768 blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
769 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
770 phy->fw_blob_dest_addr = get_unaligned_be32(
771 &blob->be_destaddr);
772 phy->fw_blob_data = blob->data;
773
774 r = pn544_hci_i2c_fw_write_chunk(phy);
775 break;
776 case PN544_HW_VARIANT_C3:
777 secure_blob = (struct pn544_i2c_fw_secure_blob *)
778 phy->fw->data;
779 phy->fw_blob_data = secure_blob->data;
780 phy->fw_size = phy->fw->size;
781 r = pn544_hci_i2c_fw_secure_write_frame(phy);
782 break;
783 default:
784 r = -ENOTSUPP;
785 break;
786 }
787
788exit_state_start:
789 if (r < 0)
790 pn544_hci_i2c_fw_work_complete(phy, r);
791 break;
792
793 case FW_WORK_STATE_WAIT_WRITE_ANSWER:
794 r = phy->fw_cmd_result;
795 if (r < 0)
796 goto exit_state_wait_write_answer;
797
798 if (phy->fw_written == phy->fw_blob_size) {
799 r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
800 phy->fw_blob_dest_addr,
801 phy->fw_blob_data,
802 phy->fw_blob_size);
803 if (r < 0)
804 goto exit_state_wait_write_answer;
805 phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
806 break;
807 }
808
809 r = pn544_hci_i2c_fw_write_chunk(phy);
810
811exit_state_wait_write_answer:
812 if (r < 0)
813 pn544_hci_i2c_fw_work_complete(phy, r);
814 break;
815
816 case FW_WORK_STATE_WAIT_CHECK_ANSWER:
817 r = phy->fw_cmd_result;
818 if (r < 0)
819 goto exit_state_wait_check_answer;
820
821 blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
822 phy->fw_blob_size);
823 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
824 if (phy->fw_blob_size != 0) {
825 phy->fw_blob_dest_addr =
826 get_unaligned_be32(&blob->be_destaddr);
827 phy->fw_blob_data = blob->data;
828
829 phy->fw_written = 0;
830 r = pn544_hci_i2c_fw_write_chunk(phy);
831 }
832
833exit_state_wait_check_answer:
834 if (r < 0 || phy->fw_blob_size == 0)
835 pn544_hci_i2c_fw_work_complete(phy, r);
836 break;
837
838 case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
839 r = phy->fw_cmd_result;
840 if (r < 0)
841 goto exit_state_wait_secure_write_answer;
842
843 if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
844 r = pn544_hci_i2c_fw_secure_write_frame(phy);
845 goto exit_state_wait_secure_write_answer;
846 }
847
848 if (phy->fw_written == phy->fw_blob_size) {
849 secure_blob = (struct pn544_i2c_fw_secure_blob *)
850 (phy->fw_blob_data + phy->fw_blob_size);
851 phy->fw_size -= phy->fw_blob_size +
852 PN544_FW_SECURE_BLOB_HEADER_LEN;
853 if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
854 + PN544_FW_SECURE_FRAME_HEADER_LEN) {
855 phy->fw_blob_data = secure_blob->data;
856
857 phy->fw_written = 0;
858 r = pn544_hci_i2c_fw_secure_write_frame(phy);
859 }
860 }
861
862exit_state_wait_secure_write_answer:
863 if (r < 0 || phy->fw_size == 0)
864 pn544_hci_i2c_fw_work_complete(phy, r);
865 break;
866
867 default:
868 break;
869 }
870}
871
872static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
873static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
874
875static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
876 { "enable-gpios", &enable_gpios, 1 },
877 { "firmware-gpios", &firmware_gpios, 1 },
878 { },
879};
880
881static int pn544_hci_i2c_probe(struct i2c_client *client,
882 const struct i2c_device_id *id)
883{
884 struct device *dev = &client->dev;
885 struct pn544_i2c_phy *phy;
886 int r = 0;
887
888 dev_dbg(&client->dev, "%s\n", __func__);
889 dev_dbg(&client->dev, "IRQ: %d\n", client->irq);
890
891 if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
892 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
893 return -ENODEV;
894 }
895
896 phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
897 GFP_KERNEL);
898 if (!phy)
899 return -ENOMEM;
900
901 INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
902 phy->fw_work_state = FW_WORK_STATE_IDLE;
903
904 phy->i2c_dev = client;
905 i2c_set_clientdata(client, phy);
906
907 r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
908 if (r)
909 dev_dbg(dev, "Unable to add GPIO mapping table\n");
910
911 /* Get EN GPIO */
912 phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
913 if (IS_ERR(phy->gpiod_en)) {
914 nfc_err(dev, "Unable to get EN GPIO\n");
915 return PTR_ERR(phy->gpiod_en);
916 }
917
918 /* Get FW GPIO */
919 phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
920 if (IS_ERR(phy->gpiod_fw)) {
921 nfc_err(dev, "Unable to get FW GPIO\n");
922 return PTR_ERR(phy->gpiod_fw);
923 }
924
925 pn544_hci_i2c_platform_init(phy);
926
927 r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
928 pn544_hci_i2c_irq_thread_fn,
929 IRQF_TRIGGER_RISING | IRQF_ONESHOT,
930 PN544_HCI_I2C_DRIVER_NAME, phy);
931 if (r < 0) {
932 nfc_err(&client->dev, "Unable to register IRQ handler\n");
933 return r;
934 }
935
936 r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
937 PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
938 PN544_HCI_I2C_LLC_MAX_PAYLOAD,
939 pn544_hci_i2c_fw_download, &phy->hdev);
940 if (r < 0)
941 return r;
942
943 return 0;
944}
945
946static int pn544_hci_i2c_remove(struct i2c_client *client)
947{
948 struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
949
950 dev_dbg(&client->dev, "%s\n", __func__);
951
952 cancel_work_sync(&phy->fw_work);
953 if (phy->fw_work_state != FW_WORK_STATE_IDLE)
954 pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
955
956 pn544_hci_remove(phy->hdev);
957
958 if (phy->powered)
959 pn544_hci_i2c_disable(phy);
960
961 return 0;
962}
963
964static const struct of_device_id of_pn544_i2c_match[] = {
965 { .compatible = "nxp,pn544-i2c", },
966 {},
967};
968MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
969
970static struct i2c_driver pn544_hci_i2c_driver = {
971 .driver = {
972 .name = PN544_HCI_I2C_DRIVER_NAME,
973 .of_match_table = of_match_ptr(of_pn544_i2c_match),
974 .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
975 },
976 .probe = pn544_hci_i2c_probe,
977 .id_table = pn544_hci_i2c_id_table,
978 .remove = pn544_hci_i2c_remove,
979};
980
981module_i2c_driver(pn544_hci_i2c_driver);
982
983MODULE_LICENSE("GPL");
984MODULE_DESCRIPTION(DRIVER_DESC);