1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * I2C Link Layer for ST21NFCA HCI based Driver
4 * Copyright (C) 2014 STMicroelectronics SAS. All rights reserved.
5 */
6
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8
9 #include <linux/crc-ccitt.h>
10 #include <linux/module.h>
11 #include <linux/i2c.h>
12 #include <linux/gpio/consumer.h>
13 #include <linux/of_irq.h>
14 #include <linux/acpi.h>
15 #include <linux/interrupt.h>
16 #include <linux/delay.h>
17 #include <linux/nfc.h>
18 #include <linux/firmware.h>
19
20 #include <net/nfc/hci.h>
21 #include <net/nfc/llc.h>
22 #include <net/nfc/nfc.h>
23
24 #include "st21nfca.h"
25
26 /*
27 * Every frame starts with ST21NFCA_SOF_EOF and ends with ST21NFCA_SOF_EOF.
28 * Because ST21NFCA_SOF_EOF is a possible data value, there is a mecanism
29 * called byte stuffing has been introduced.
30 *
31 * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
32 * - insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
33 * - xor byte with ST21NFCA_BYTE_STUFFING_MASK
34 */
35 #define ST21NFCA_SOF_EOF 0x7e
36 #define ST21NFCA_BYTE_STUFFING_MASK 0x20
37 #define ST21NFCA_ESCAPE_BYTE_STUFFING 0x7d
38
39 /* SOF + 00 */
40 #define ST21NFCA_FRAME_HEADROOM 2
41
42 /* 2 bytes crc + EOF */
43 #define ST21NFCA_FRAME_TAILROOM 3
44 #define IS_START_OF_FRAME(buf) (buf[0] == ST21NFCA_SOF_EOF && \
45 buf[1] == 0)
46
47 #define ST21NFCA_HCI_DRIVER_NAME "st21nfca_hci"
48 #define ST21NFCA_HCI_I2C_DRIVER_NAME "st21nfca_hci_i2c"
49
50 struct st21nfca_i2c_phy {
51 struct i2c_client *i2c_dev;
52 struct nfc_hci_dev *hdev;
53
54 struct gpio_desc *gpiod_ena;
55 struct st21nfca_se_status se_status;
56
57 struct sk_buff *pending_skb;
58 int current_read_len;
59 /*
60 * crc might have fail because i2c macro
61 * is disable due to other interface activity
62 */
63 int crc_trials;
64
65 int powered;
66 int run_mode;
67
68 /*
69 * < 0 if hardware error occured (e.g. i2c err)
70 * and prevents normal operation.
71 */
72 int hard_fault;
73 struct mutex phy_lock;
74 };
75
76 static const u8 len_seq[] = { 16, 24, 12, 29 };
77 static const u16 wait_tab[] = { 2, 3, 5, 15, 20, 40};
78
79 #define I2C_DUMP_SKB(info, skb) \
80 do { \
81 pr_debug("%s:\n", info); \
82 print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
83 16, 1, (skb)->data, (skb)->len, 0); \
84 } while (0)
85
86 /*
87 * In order to get the CLF in a known state we generate an internal reboot
88 * using a proprietary command.
89 * Once the reboot is completed, we expect to receive a ST21NFCA_SOF_EOF
90 * fill buffer.
91 */
st21nfca_hci_platform_init(struct st21nfca_i2c_phy * phy)92 static int st21nfca_hci_platform_init(struct st21nfca_i2c_phy *phy)
93 {
94 u16 wait_reboot[] = { 50, 300, 1000 };
95 char reboot_cmd[] = { 0x7E, 0x66, 0x48, 0xF6, 0x7E };
96 u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE];
97 int i, r = -1;
98
99 for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
100 r = i2c_master_send(phy->i2c_dev, reboot_cmd,
101 sizeof(reboot_cmd));
102 if (r < 0)
103 msleep(wait_reboot[i]);
104 }
105 if (r < 0)
106 return r;
107
108 /* CLF is spending about 20ms to do an internal reboot */
109 msleep(20);
110 r = -1;
111 for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
112 r = i2c_master_recv(phy->i2c_dev, tmp,
113 ST21NFCA_HCI_LLC_MAX_SIZE);
114 if (r < 0)
115 msleep(wait_reboot[i]);
116 }
117 if (r < 0)
118 return r;
119
120 for (i = 0; i < ST21NFCA_HCI_LLC_MAX_SIZE &&
121 tmp[i] == ST21NFCA_SOF_EOF; i++)
122 ;
123
124 if (r != ST21NFCA_HCI_LLC_MAX_SIZE)
125 return -ENODEV;
126
127 usleep_range(1000, 1500);
128 return 0;
129 }
130
st21nfca_hci_i2c_enable(void * phy_id)131 static int st21nfca_hci_i2c_enable(void *phy_id)
132 {
133 struct st21nfca_i2c_phy *phy = phy_id;
134
135 gpiod_set_value(phy->gpiod_ena, 1);
136 phy->powered = 1;
137 phy->run_mode = ST21NFCA_HCI_MODE;
138
139 usleep_range(10000, 15000);
140
141 return 0;
142 }
143
st21nfca_hci_i2c_disable(void * phy_id)144 static void st21nfca_hci_i2c_disable(void *phy_id)
145 {
146 struct st21nfca_i2c_phy *phy = phy_id;
147
148 gpiod_set_value(phy->gpiod_ena, 0);
149
150 phy->powered = 0;
151 }
152
st21nfca_hci_add_len_crc(struct sk_buff * skb)153 static void st21nfca_hci_add_len_crc(struct sk_buff *skb)
154 {
155 u16 crc;
156 u8 tmp;
157
158 *(u8 *)skb_push(skb, 1) = 0;
159
160 crc = crc_ccitt(0xffff, skb->data, skb->len);
161 crc = ~crc;
162
163 tmp = crc & 0x00ff;
164 skb_put_u8(skb, tmp);
165
166 tmp = (crc >> 8) & 0x00ff;
167 skb_put_u8(skb, tmp);
168 }
169
st21nfca_hci_remove_len_crc(struct sk_buff * skb)170 static void st21nfca_hci_remove_len_crc(struct sk_buff *skb)
171 {
172 skb_pull(skb, ST21NFCA_FRAME_HEADROOM);
173 skb_trim(skb, skb->len - ST21NFCA_FRAME_TAILROOM);
174 }
175
176 /*
177 * Writing a frame must not return the number of written bytes.
178 * It must return either zero for success, or <0 for error.
179 * In addition, it must not alter the skb
180 */
st21nfca_hci_i2c_write(void * phy_id,struct sk_buff * skb)181 static int st21nfca_hci_i2c_write(void *phy_id, struct sk_buff *skb)
182 {
183 int r = -1, i, j;
184 struct st21nfca_i2c_phy *phy = phy_id;
185 struct i2c_client *client = phy->i2c_dev;
186 u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE * 2];
187
188 I2C_DUMP_SKB("st21nfca_hci_i2c_write", skb);
189
190 if (phy->hard_fault != 0)
191 return phy->hard_fault;
192
193 /*
194 * Compute CRC before byte stuffing computation on frame
195 * Note st21nfca_hci_add_len_crc is doing a byte stuffing
196 * on its own value
197 */
198 st21nfca_hci_add_len_crc(skb);
199
200 /* add ST21NFCA_SOF_EOF on tail */
201 skb_put_u8(skb, ST21NFCA_SOF_EOF);
202 /* add ST21NFCA_SOF_EOF on head */
203 *(u8 *)skb_push(skb, 1) = ST21NFCA_SOF_EOF;
204
205 /*
206 * Compute byte stuffing
207 * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
208 * insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
209 * xor byte with ST21NFCA_BYTE_STUFFING_MASK
210 */
211 tmp[0] = skb->data[0];
212 for (i = 1, j = 1; i < skb->len - 1; i++, j++) {
213 if (skb->data[i] == ST21NFCA_SOF_EOF
214 || skb->data[i] == ST21NFCA_ESCAPE_BYTE_STUFFING) {
215 tmp[j] = ST21NFCA_ESCAPE_BYTE_STUFFING;
216 j++;
217 tmp[j] = skb->data[i] ^ ST21NFCA_BYTE_STUFFING_MASK;
218 } else {
219 tmp[j] = skb->data[i];
220 }
221 }
222 tmp[j] = skb->data[i];
223 j++;
224
225 /*
226 * Manage sleep mode
227 * Try 3 times to send data with delay between each
228 */
229 mutex_lock(&phy->phy_lock);
230 for (i = 0; i < ARRAY_SIZE(wait_tab) && r < 0; i++) {
231 r = i2c_master_send(client, tmp, j);
232 if (r < 0)
233 msleep(wait_tab[i]);
234 }
235 mutex_unlock(&phy->phy_lock);
236
237 if (r >= 0) {
238 if (r != j)
239 r = -EREMOTEIO;
240 else
241 r = 0;
242 }
243
244 st21nfca_hci_remove_len_crc(skb);
245
246 return r;
247 }
248
get_frame_size(u8 * buf,int buflen)249 static int get_frame_size(u8 *buf, int buflen)
250 {
251 int len = 0;
252
253 if (buf[len + 1] == ST21NFCA_SOF_EOF)
254 return 0;
255
256 for (len = 1; len < buflen && buf[len] != ST21NFCA_SOF_EOF; len++)
257 ;
258
259 return len;
260 }
261
check_crc(u8 * buf,int buflen)262 static int check_crc(u8 *buf, int buflen)
263 {
264 u16 crc;
265
266 crc = crc_ccitt(0xffff, buf, buflen - 2);
267 crc = ~crc;
268
269 if (buf[buflen - 2] != (crc & 0xff) || buf[buflen - 1] != (crc >> 8)) {
270 pr_err(ST21NFCA_HCI_DRIVER_NAME
271 ": CRC error 0x%x != 0x%x 0x%x\n", crc, buf[buflen - 1],
272 buf[buflen - 2]);
273
274 pr_info(DRIVER_DESC ": %s : BAD CRC\n", __func__);
275 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
276 16, 2, buf, buflen, false);
277 return -EPERM;
278 }
279 return 0;
280 }
281
282 /*
283 * Prepare received data for upper layer.
284 * Received data include byte stuffing, crc and sof/eof
285 * which is not usable by hci part.
286 * returns:
287 * frame size without sof/eof, header and byte stuffing
288 * -EBADMSG : frame was incorrect and discarded
289 */
st21nfca_hci_i2c_repack(struct sk_buff * skb)290 static int st21nfca_hci_i2c_repack(struct sk_buff *skb)
291 {
292 int read, write, r, size;
293
294 if (skb->len < ST21NFCA_FRAME_HEADROOM ||
295 !IS_START_OF_FRAME(skb->data))
296 return -EBADMSG;
297
298 size = get_frame_size(skb->data, skb->len);
299 if (size > 0) {
300 if (size < ST21NFCA_FRAME_HEADROOM + 2)
301 return -EBADMSG;
302
303 skb_trim(skb, size);
304 /* remove ST21NFCA byte stuffing for upper layer */
305 for (read = 1, write = 1; read < skb->len;) {
306 if (skb->data[read] ==
307 (u8) ST21NFCA_ESCAPE_BYTE_STUFFING) {
308 if (read + 1 == skb->len)
309 return -EBADMSG;
310
311 skb->data[write++] = skb->data[read + 1]
312 | ST21NFCA_BYTE_STUFFING_MASK;
313 read += 2;
314 } else {
315 skb->data[write++] = skb->data[read++];
316 }
317 }
318 /* remove byte stuffing useless byte */
319 skb_trim(skb, write);
320 if (skb->len < ST21NFCA_FRAME_HEADROOM + 2)
321 return -EBADMSG;
322 /* remove ST21NFCA_SOF_EOF from head */
323 skb_pull(skb, 1);
324
325 r = check_crc(skb->data, skb->len);
326 if (r != 0)
327 return -EBADMSG;
328
329 /* remove headbyte */
330 skb_pull(skb, 1);
331 /* remove crc. Byte Stuffing is already removed here */
332 skb_trim(skb, skb->len - 2);
333 return skb->len;
334 }
335 return 0;
336 }
337
338 /*
339 * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
340 * that i2c bus will be flushed and that next read will start on a new frame.
341 * returned skb contains only LLC header and payload.
342 * returns:
343 * frame size : if received frame is complete (find ST21NFCA_SOF_EOF at
344 * end of read)
345 * -EAGAIN : if received frame is incomplete (not find ST21NFCA_SOF_EOF
346 * at end of read)
347 * -EREMOTEIO : i2c read error (fatal)
348 * -EBADMSG : frame was incorrect and discarded
349 * (value returned from st21nfca_hci_i2c_repack)
350 * -EIO : if no ST21NFCA_SOF_EOF is found after reaching
351 * the read length end sequence
352 */
st21nfca_hci_i2c_read(struct st21nfca_i2c_phy * phy,struct sk_buff * skb)353 static int st21nfca_hci_i2c_read(struct st21nfca_i2c_phy *phy,
354 struct sk_buff *skb)
355 {
356 int r, i;
357 u8 len;
358 u8 buf[ST21NFCA_HCI_LLC_MAX_PAYLOAD];
359 struct i2c_client *client = phy->i2c_dev;
360
361 if (phy->current_read_len < ARRAY_SIZE(len_seq)) {
362 len = len_seq[phy->current_read_len];
363
364 /*
365 * Add retry mecanism
366 * Operation on I2C interface may fail in case of operation on
367 * RF or SWP interface
368 */
369 r = 0;
370 mutex_lock(&phy->phy_lock);
371 for (i = 0; i < ARRAY_SIZE(wait_tab) && r <= 0; i++) {
372 r = i2c_master_recv(client, buf, len);
373 if (r < 0)
374 msleep(wait_tab[i]);
375 }
376 mutex_unlock(&phy->phy_lock);
377
378 if (r != len) {
379 phy->current_read_len = 0;
380 return -EREMOTEIO;
381 }
382
383 /*
384 * The first read sequence does not start with SOF.
385 * Data is corrupeted so we drop it.
386 */
387 if (!phy->current_read_len && !IS_START_OF_FRAME(buf)) {
388 skb_trim(skb, 0);
389 phy->current_read_len = 0;
390 return -EIO;
391 } else if (phy->current_read_len && IS_START_OF_FRAME(buf)) {
392 /*
393 * Previous frame transmission was interrupted and
394 * the frame got repeated.
395 * Received frame start with ST21NFCA_SOF_EOF + 00.
396 */
397 skb_trim(skb, 0);
398 phy->current_read_len = 0;
399 }
400
401 skb_put_data(skb, buf, len);
402
403 if (skb->data[skb->len - 1] == ST21NFCA_SOF_EOF) {
404 phy->current_read_len = 0;
405 return st21nfca_hci_i2c_repack(skb);
406 }
407 phy->current_read_len++;
408 return -EAGAIN;
409 }
410 return -EIO;
411 }
412
413 /*
414 * Reads an shdlc frame from the chip. This is not as straightforward as it
415 * seems. The frame format is data-crc, and corruption can occur anywhere
416 * while transiting on i2c bus, such that we could read an invalid data.
417 * The tricky case is when we read a corrupted data or crc. We must detect
418 * this here in order to determine that data can be transmitted to the hci
419 * core. This is the reason why we check the crc here.
420 * The CLF will repeat a frame until we send a RR on that frame.
421 *
422 * On ST21NFCA, IRQ goes in idle when read starts. As no size information are
423 * available in the incoming data, other IRQ might come. Every IRQ will trigger
424 * a read sequence with different length and will fill the current frame.
425 * The reception is complete once we reach a ST21NFCA_SOF_EOF.
426 */
st21nfca_hci_irq_thread_fn(int irq,void * phy_id)427 static irqreturn_t st21nfca_hci_irq_thread_fn(int irq, void *phy_id)
428 {
429 struct st21nfca_i2c_phy *phy = phy_id;
430
431 int r;
432
433 if (!phy || irq != phy->i2c_dev->irq) {
434 WARN_ON_ONCE(1);
435 return IRQ_NONE;
436 }
437
438 if (phy->hard_fault != 0)
439 return IRQ_HANDLED;
440
441 r = st21nfca_hci_i2c_read(phy, phy->pending_skb);
442 if (r == -EREMOTEIO) {
443 phy->hard_fault = r;
444
445 nfc_hci_recv_frame(phy->hdev, NULL);
446
447 return IRQ_HANDLED;
448 } else if (r == -EAGAIN || r == -EIO) {
449 return IRQ_HANDLED;
450 } else if (r == -EBADMSG && phy->crc_trials < ARRAY_SIZE(wait_tab)) {
451 /*
452 * With ST21NFCA, only one interface (I2C, RF or SWP)
453 * may be active at a time.
454 * Having incorrect crc is usually due to i2c macrocell
455 * deactivation in the middle of a transmission.
456 * It may generate corrupted data on i2c.
457 * We give sometime to get i2c back.
458 * The complete frame will be repeated.
459 */
460 msleep(wait_tab[phy->crc_trials]);
461 phy->crc_trials++;
462 phy->current_read_len = 0;
463 kfree_skb(phy->pending_skb);
464 } else if (r > 0) {
465 /*
466 * We succeeded to read data from the CLF and
467 * data is valid.
468 * Reset counter.
469 */
470 nfc_hci_recv_frame(phy->hdev, phy->pending_skb);
471 phy->crc_trials = 0;
472 } else {
473 kfree_skb(phy->pending_skb);
474 }
475
476 phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
477 if (phy->pending_skb == NULL) {
478 phy->hard_fault = -ENOMEM;
479 nfc_hci_recv_frame(phy->hdev, NULL);
480 }
481
482 return IRQ_HANDLED;
483 }
484
485 static const struct nfc_phy_ops i2c_phy_ops = {
486 .write = st21nfca_hci_i2c_write,
487 .enable = st21nfca_hci_i2c_enable,
488 .disable = st21nfca_hci_i2c_disable,
489 };
490
491 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
492
493 static const struct acpi_gpio_mapping acpi_st21nfca_gpios[] = {
494 { "enable-gpios", &enable_gpios, 1 },
495 {},
496 };
497
st21nfca_hci_i2c_probe(struct i2c_client * client)498 static int st21nfca_hci_i2c_probe(struct i2c_client *client)
499 {
500 struct device *dev = &client->dev;
501 struct st21nfca_i2c_phy *phy;
502 int r;
503
504 if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
505 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
506 return -ENODEV;
507 }
508
509 phy = devm_kzalloc(&client->dev, sizeof(struct st21nfca_i2c_phy),
510 GFP_KERNEL);
511 if (!phy)
512 return -ENOMEM;
513
514 phy->i2c_dev = client;
515 phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
516 if (phy->pending_skb == NULL)
517 return -ENOMEM;
518
519 phy->current_read_len = 0;
520 phy->crc_trials = 0;
521 mutex_init(&phy->phy_lock);
522 i2c_set_clientdata(client, phy);
523
524 r = devm_acpi_dev_add_driver_gpios(dev, acpi_st21nfca_gpios);
525 if (r)
526 dev_dbg(dev, "Unable to add GPIO mapping table\n");
527
528 /* Get EN GPIO from resource provider */
529 phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
530 if (IS_ERR(phy->gpiod_ena)) {
531 nfc_err(dev, "Unable to get ENABLE GPIO\n");
532 r = PTR_ERR(phy->gpiod_ena);
533 goto out_free;
534 }
535
536 phy->se_status.is_ese_present =
537 device_property_read_bool(&client->dev, "ese-present");
538 phy->se_status.is_uicc_present =
539 device_property_read_bool(&client->dev, "uicc-present");
540
541 r = st21nfca_hci_platform_init(phy);
542 if (r < 0) {
543 nfc_err(&client->dev, "Unable to reboot st21nfca\n");
544 goto out_free;
545 }
546
547 r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
548 st21nfca_hci_irq_thread_fn,
549 IRQF_ONESHOT,
550 ST21NFCA_HCI_DRIVER_NAME, phy);
551 if (r < 0) {
552 nfc_err(&client->dev, "Unable to register IRQ handler\n");
553 goto out_free;
554 }
555
556 r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
557 ST21NFCA_FRAME_HEADROOM,
558 ST21NFCA_FRAME_TAILROOM,
559 ST21NFCA_HCI_LLC_MAX_PAYLOAD,
560 &phy->hdev,
561 &phy->se_status);
562 if (r)
563 goto out_free;
564
565 return 0;
566
567 out_free:
568 kfree_skb(phy->pending_skb);
569 return r;
570 }
571
st21nfca_hci_i2c_remove(struct i2c_client * client)572 static void st21nfca_hci_i2c_remove(struct i2c_client *client)
573 {
574 struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
575
576 st21nfca_hci_remove(phy->hdev);
577
578 if (phy->powered)
579 st21nfca_hci_i2c_disable(phy);
580 kfree_skb(phy->pending_skb);
581 }
582
583 static const struct i2c_device_id st21nfca_hci_i2c_id_table[] = {
584 { .name = ST21NFCA_HCI_DRIVER_NAME },
585 { }
586 };
587 MODULE_DEVICE_TABLE(i2c, st21nfca_hci_i2c_id_table);
588
589 static const struct acpi_device_id st21nfca_hci_i2c_acpi_match[] = {
590 { .id = "SMO2100" },
591 { }
592 };
593 MODULE_DEVICE_TABLE(acpi, st21nfca_hci_i2c_acpi_match);
594
595 static const struct of_device_id of_st21nfca_i2c_match[] = {
596 { .compatible = "st,st21nfca-i2c" },
597 { .compatible = "st,st21nfca_i2c" },
598 { }
599 };
600 MODULE_DEVICE_TABLE(of, of_st21nfca_i2c_match);
601
602 static struct i2c_driver st21nfca_hci_i2c_driver = {
603 .driver = {
604 .name = ST21NFCA_HCI_I2C_DRIVER_NAME,
605 .of_match_table = of_match_ptr(of_st21nfca_i2c_match),
606 .acpi_match_table = ACPI_PTR(st21nfca_hci_i2c_acpi_match),
607 },
608 .probe = st21nfca_hci_i2c_probe,
609 .id_table = st21nfca_hci_i2c_id_table,
610 .remove = st21nfca_hci_i2c_remove,
611 };
612 module_i2c_driver(st21nfca_hci_i2c_driver);
613
614 MODULE_LICENSE("GPL");
615 MODULE_DESCRIPTION(DRIVER_DESC);
616