xref: /linux/drivers/nfc/pn544/i2c.c (revision a1ff5a7d78a036d6c2178ee5acd6ba4946243800)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * I2C Link Layer for PN544 HCI based Driver
4  *
5  * Copyright (C) 2012  Intel Corporation. All rights reserved.
6  */
7 
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 
10 #include <linux/crc-ccitt.h>
11 #include <linux/module.h>
12 #include <linux/i2c.h>
13 #include <linux/acpi.h>
14 #include <linux/interrupt.h>
15 #include <linux/delay.h>
16 #include <linux/nfc.h>
17 #include <linux/firmware.h>
18 #include <linux/gpio/consumer.h>
19 
20 #include <asm/unaligned.h>
21 
22 #include <net/nfc/hci.h>
23 #include <net/nfc/llc.h>
24 #include <net/nfc/nfc.h>
25 
26 #include "pn544.h"
27 
28 #define PN544_I2C_FRAME_HEADROOM 1
29 #define PN544_I2C_FRAME_TAILROOM 2
30 
31 /* GPIO names */
32 #define PN544_GPIO_NAME_IRQ "pn544_irq"
33 #define PN544_GPIO_NAME_FW  "pn544_fw"
34 #define PN544_GPIO_NAME_EN  "pn544_en"
35 
36 /* framing in HCI mode */
37 #define PN544_HCI_I2C_LLC_LEN		1
38 #define PN544_HCI_I2C_LLC_CRC		2
39 #define PN544_HCI_I2C_LLC_LEN_CRC	(PN544_HCI_I2C_LLC_LEN + \
40 					 PN544_HCI_I2C_LLC_CRC)
41 #define PN544_HCI_I2C_LLC_MIN_SIZE	(1 + PN544_HCI_I2C_LLC_LEN_CRC)
42 #define PN544_HCI_I2C_LLC_MAX_PAYLOAD	29
43 #define PN544_HCI_I2C_LLC_MAX_SIZE	(PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
44 					 PN544_HCI_I2C_LLC_MAX_PAYLOAD)
45 
46 static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
47 	{ "pn544" },
48 	{}
49 };
50 
51 MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
52 
53 static const struct acpi_device_id pn544_hci_i2c_acpi_match[] __maybe_unused = {
54 	{"NXP5440", 0},
55 	{}
56 };
57 
58 MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
59 
60 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
61 
62 /*
63  * Exposed through the 4 most significant bytes
64  * from the HCI SW_VERSION first byte, a.k.a.
65  * SW RomLib.
66  */
67 #define PN544_HW_VARIANT_C2 0xa
68 #define PN544_HW_VARIANT_C3 0xb
69 
70 #define PN544_FW_CMD_RESET 0x01
71 #define PN544_FW_CMD_WRITE 0x08
72 #define PN544_FW_CMD_CHECK 0x06
73 #define PN544_FW_CMD_SECURE_WRITE 0x0C
74 #define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
75 
76 struct pn544_i2c_fw_frame_write {
77 	u8 cmd;
78 	u16 be_length;
79 	u8 be_dest_addr[3];
80 	u16 be_datalen;
81 	u8 data[];
82 } __packed;
83 
84 struct pn544_i2c_fw_frame_check {
85 	u8 cmd;
86 	u16 be_length;
87 	u8 be_start_addr[3];
88 	u16 be_datalen;
89 	u16 be_crc;
90 } __packed;
91 
92 struct pn544_i2c_fw_frame_response {
93 	u8 status;
94 	u16 be_length;
95 } __packed;
96 
97 struct pn544_i2c_fw_blob {
98 	u32 be_size;
99 	u32 be_destaddr;
100 	u8 data[];
101 };
102 
103 struct pn544_i2c_fw_secure_frame {
104 	u8 cmd;
105 	u16 be_datalen;
106 	u8 data[];
107 } __packed;
108 
109 struct pn544_i2c_fw_secure_blob {
110 	u64 header;
111 	u8 data[];
112 };
113 
114 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
115 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
116 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
117 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
118 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
119 #define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
120 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
121 #define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
122 #define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
123 #define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
124 #define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
125 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
126 #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
127 #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
128 
129 #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
130 #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
131 #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
132 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
133 					 PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
134 					 PN544_FW_WRITE_BUFFER_MAX_LEN)
135 #define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
136 #define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
137 			PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
138 #define PN544_FW_SECURE_FRAME_HEADER_LEN 3
139 #define PN544_FW_SECURE_BLOB_HEADER_LEN 8
140 
141 #define FW_WORK_STATE_IDLE 1
142 #define FW_WORK_STATE_START 2
143 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
144 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
145 #define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
146 
147 struct pn544_i2c_phy {
148 	struct i2c_client *i2c_dev;
149 	struct nfc_hci_dev *hdev;
150 
151 	struct gpio_desc *gpiod_en;
152 	struct gpio_desc *gpiod_fw;
153 
154 	unsigned int en_polarity;
155 
156 	u8 hw_variant;
157 
158 	struct work_struct fw_work;
159 	int fw_work_state;
160 	char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
161 	const struct firmware *fw;
162 	u32 fw_blob_dest_addr;
163 	size_t fw_blob_size;
164 	const u8 *fw_blob_data;
165 	size_t fw_written;
166 	size_t fw_size;
167 
168 	int fw_cmd_result;
169 
170 	int powered;
171 	int run_mode;
172 
173 	int hard_fault;		/*
174 				 * < 0 if hardware error occured (e.g. i2c err)
175 				 * and prevents normal operation.
176 				 */
177 };
178 
179 #define I2C_DUMP_SKB(info, skb)					\
180 do {								\
181 	pr_debug("%s:\n", info);				\
182 	print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET,	\
183 		       16, 1, (skb)->data, (skb)->len, 0);	\
184 } while (0)
185 
pn544_hci_i2c_platform_init(struct pn544_i2c_phy * phy)186 static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
187 {
188 	int polarity, retry, ret;
189 	static const char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
190 	int count = sizeof(rset_cmd);
191 
192 	nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
193 
194 	/* Disable fw download */
195 	gpiod_set_value_cansleep(phy->gpiod_fw, 0);
196 
197 	for (polarity = 0; polarity < 2; polarity++) {
198 		phy->en_polarity = polarity;
199 		retry = 3;
200 		while (retry--) {
201 			/* power off */
202 			gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
203 			usleep_range(10000, 15000);
204 
205 			/* power on */
206 			gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
207 			usleep_range(10000, 15000);
208 
209 			/* send reset */
210 			dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
211 			ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
212 			if (ret == count) {
213 				nfc_info(&phy->i2c_dev->dev,
214 					 "nfc_en polarity : active %s\n",
215 					 (polarity == 0 ? "low" : "high"));
216 				goto out;
217 			}
218 		}
219 	}
220 
221 	nfc_err(&phy->i2c_dev->dev,
222 		"Could not detect nfc_en polarity, fallback to active high\n");
223 
224 out:
225 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
226 	usleep_range(10000, 15000);
227 }
228 
pn544_hci_i2c_enable_mode(struct pn544_i2c_phy * phy,int run_mode)229 static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
230 {
231 	gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
232 	gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
233 	usleep_range(10000, 15000);
234 
235 	phy->run_mode = run_mode;
236 }
237 
pn544_hci_i2c_enable(void * phy_id)238 static int pn544_hci_i2c_enable(void *phy_id)
239 {
240 	struct pn544_i2c_phy *phy = phy_id;
241 
242 	pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
243 
244 	phy->powered = 1;
245 
246 	return 0;
247 }
248 
pn544_hci_i2c_disable(void * phy_id)249 static void pn544_hci_i2c_disable(void *phy_id)
250 {
251 	struct pn544_i2c_phy *phy = phy_id;
252 
253 	gpiod_set_value_cansleep(phy->gpiod_fw, 0);
254 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
255 	usleep_range(10000, 15000);
256 
257 	gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
258 	usleep_range(10000, 15000);
259 
260 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
261 	usleep_range(10000, 15000);
262 
263 	phy->powered = 0;
264 }
265 
pn544_hci_i2c_add_len_crc(struct sk_buff * skb)266 static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
267 {
268 	u16 crc;
269 	int len;
270 
271 	len = skb->len + 2;
272 	*(u8 *)skb_push(skb, 1) = len;
273 
274 	crc = crc_ccitt(0xffff, skb->data, skb->len);
275 	crc = ~crc;
276 	skb_put_u8(skb, crc & 0xff);
277 	skb_put_u8(skb, crc >> 8);
278 }
279 
pn544_hci_i2c_remove_len_crc(struct sk_buff * skb)280 static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
281 {
282 	skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
283 	skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
284 }
285 
286 /*
287  * Writing a frame must not return the number of written bytes.
288  * It must return either zero for success, or <0 for error.
289  * In addition, it must not alter the skb
290  */
pn544_hci_i2c_write(void * phy_id,struct sk_buff * skb)291 static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
292 {
293 	int r;
294 	struct pn544_i2c_phy *phy = phy_id;
295 	struct i2c_client *client = phy->i2c_dev;
296 
297 	if (phy->hard_fault != 0)
298 		return phy->hard_fault;
299 
300 	usleep_range(3000, 6000);
301 
302 	pn544_hci_i2c_add_len_crc(skb);
303 
304 	I2C_DUMP_SKB("i2c frame written", skb);
305 
306 	r = i2c_master_send(client, skb->data, skb->len);
307 
308 	if (r == -EREMOTEIO) {	/* Retry, chip was in standby */
309 		usleep_range(6000, 10000);
310 		r = i2c_master_send(client, skb->data, skb->len);
311 	}
312 
313 	if (r >= 0) {
314 		if (r != skb->len)
315 			r = -EREMOTEIO;
316 		else
317 			r = 0;
318 	}
319 
320 	pn544_hci_i2c_remove_len_crc(skb);
321 
322 	return r;
323 }
324 
check_crc(u8 * buf,int buflen)325 static int check_crc(u8 *buf, int buflen)
326 {
327 	int len;
328 	u16 crc;
329 
330 	len = buf[0] + 1;
331 	crc = crc_ccitt(0xffff, buf, len - 2);
332 	crc = ~crc;
333 
334 	if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
335 		pr_err("CRC error 0x%x != 0x%x 0x%x\n",
336 		       crc, buf[len - 1], buf[len - 2]);
337 		pr_info("%s: BAD CRC\n", __func__);
338 		print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
339 			       16, 2, buf, buflen, false);
340 		return -EPERM;
341 	}
342 	return 0;
343 }
344 
345 /*
346  * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
347  * that i2c bus will be flushed and that next read will start on a new frame.
348  * returned skb contains only LLC header and payload.
349  * returns:
350  * -EREMOTEIO : i2c read error (fatal)
351  * -EBADMSG : frame was incorrect and discarded
352  * -ENOMEM : cannot allocate skb, frame dropped
353  */
pn544_hci_i2c_read(struct pn544_i2c_phy * phy,struct sk_buff ** skb)354 static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
355 {
356 	int r;
357 	u8 len;
358 	u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
359 	struct i2c_client *client = phy->i2c_dev;
360 
361 	r = i2c_master_recv(client, &len, 1);
362 	if (r != 1) {
363 		nfc_err(&client->dev, "cannot read len byte\n");
364 		return -EREMOTEIO;
365 	}
366 
367 	if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
368 	    (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
369 		nfc_err(&client->dev, "invalid len byte\n");
370 		r = -EBADMSG;
371 		goto flush;
372 	}
373 
374 	*skb = alloc_skb(1 + len, GFP_KERNEL);
375 	if (*skb == NULL) {
376 		r = -ENOMEM;
377 		goto flush;
378 	}
379 
380 	skb_put_u8(*skb, len);
381 
382 	r = i2c_master_recv(client, skb_put(*skb, len), len);
383 	if (r != len) {
384 		kfree_skb(*skb);
385 		return -EREMOTEIO;
386 	}
387 
388 	I2C_DUMP_SKB("i2c frame read", *skb);
389 
390 	r = check_crc((*skb)->data, (*skb)->len);
391 	if (r != 0) {
392 		kfree_skb(*skb);
393 		r = -EBADMSG;
394 		goto flush;
395 	}
396 
397 	skb_pull(*skb, 1);
398 	skb_trim(*skb, (*skb)->len - 2);
399 
400 	usleep_range(3000, 6000);
401 
402 	return 0;
403 
404 flush:
405 	if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
406 		r = -EREMOTEIO;
407 
408 	usleep_range(3000, 6000);
409 
410 	return r;
411 }
412 
pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy * phy)413 static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
414 {
415 	int r;
416 	struct pn544_i2c_fw_frame_response response;
417 	struct i2c_client *client = phy->i2c_dev;
418 
419 	r = i2c_master_recv(client, (char *) &response, sizeof(response));
420 	if (r != sizeof(response)) {
421 		nfc_err(&client->dev, "cannot read fw status\n");
422 		return -EIO;
423 	}
424 
425 	usleep_range(3000, 6000);
426 
427 	switch (response.status) {
428 	case 0:
429 		return 0;
430 	case PN544_FW_CMD_RESULT_CHUNK_OK:
431 		return response.status;
432 	case PN544_FW_CMD_RESULT_TIMEOUT:
433 		return -ETIMEDOUT;
434 	case PN544_FW_CMD_RESULT_BAD_CRC:
435 		return -ENODATA;
436 	case PN544_FW_CMD_RESULT_ACCESS_DENIED:
437 		return -EACCES;
438 	case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
439 		return -EPROTO;
440 	case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
441 		return -EINVAL;
442 	case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
443 		return -ENOTSUPP;
444 	case PN544_FW_CMD_RESULT_INVALID_LENGTH:
445 		return -EBADMSG;
446 	case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
447 		return -ENOKEY;
448 	case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
449 		return -EINVAL;
450 	case PN544_FW_CMD_RESULT_MEMORY_ERROR:
451 		return -ENOMEM;
452 	case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
453 		return -EACCES;
454 	case PN544_FW_CMD_RESULT_WRITE_FAILED:
455 	case PN544_FW_CMD_RESULT_CHUNK_ERROR:
456 		return -EIO;
457 	default:
458 		return -EIO;
459 	}
460 }
461 
462 /*
463  * Reads an shdlc frame from the chip. This is not as straightforward as it
464  * seems. There are cases where we could loose the frame start synchronization.
465  * The frame format is len-data-crc, and corruption can occur anywhere while
466  * transiting on i2c bus, such that we could read an invalid len.
467  * In order to recover synchronization with the next frame, we must be sure
468  * to read the real amount of data without using the len byte. We do this by
469  * assuming the following:
470  * - the chip will always present only one single complete frame on the bus
471  *   before triggering the interrupt
472  * - the chip will not present a new frame until we have completely read
473  *   the previous one (or until we have handled the interrupt).
474  * The tricky case is when we read a corrupted len that is less than the real
475  * len. We must detect this here in order to determine that we need to flush
476  * the bus. This is the reason why we check the crc here.
477  */
pn544_hci_i2c_irq_thread_fn(int irq,void * phy_id)478 static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
479 {
480 	struct pn544_i2c_phy *phy = phy_id;
481 	struct i2c_client *client;
482 	struct sk_buff *skb = NULL;
483 	int r;
484 
485 	if (!phy || irq != phy->i2c_dev->irq) {
486 		WARN_ON_ONCE(1);
487 		return IRQ_NONE;
488 	}
489 
490 	client = phy->i2c_dev;
491 	dev_dbg(&client->dev, "IRQ\n");
492 
493 	if (phy->hard_fault != 0)
494 		return IRQ_HANDLED;
495 
496 	if (phy->run_mode == PN544_FW_MODE) {
497 		phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
498 		schedule_work(&phy->fw_work);
499 	} else {
500 		r = pn544_hci_i2c_read(phy, &skb);
501 		if (r == -EREMOTEIO) {
502 			phy->hard_fault = r;
503 
504 			nfc_hci_recv_frame(phy->hdev, NULL);
505 
506 			return IRQ_HANDLED;
507 		} else if ((r == -ENOMEM) || (r == -EBADMSG)) {
508 			return IRQ_HANDLED;
509 		}
510 
511 		nfc_hci_recv_frame(phy->hdev, skb);
512 	}
513 	return IRQ_HANDLED;
514 }
515 
516 static const struct nfc_phy_ops i2c_phy_ops = {
517 	.write = pn544_hci_i2c_write,
518 	.enable = pn544_hci_i2c_enable,
519 	.disable = pn544_hci_i2c_disable,
520 };
521 
pn544_hci_i2c_fw_download(void * phy_id,const char * firmware_name,u8 hw_variant)522 static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
523 					u8 hw_variant)
524 {
525 	struct pn544_i2c_phy *phy = phy_id;
526 
527 	pr_info("Starting Firmware Download (%s)\n", firmware_name);
528 
529 	strcpy(phy->firmware_name, firmware_name);
530 
531 	phy->hw_variant = hw_variant;
532 	phy->fw_work_state = FW_WORK_STATE_START;
533 
534 	schedule_work(&phy->fw_work);
535 
536 	return 0;
537 }
538 
pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy * phy,int result)539 static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
540 					   int result)
541 {
542 	pr_info("Firmware Download Complete, result=%d\n", result);
543 
544 	pn544_hci_i2c_disable(phy);
545 
546 	phy->fw_work_state = FW_WORK_STATE_IDLE;
547 
548 	if (phy->fw) {
549 		release_firmware(phy->fw);
550 		phy->fw = NULL;
551 	}
552 
553 	nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
554 }
555 
pn544_hci_i2c_fw_write_cmd(struct i2c_client * client,u32 dest_addr,const u8 * data,u16 datalen)556 static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
557 				      const u8 *data, u16 datalen)
558 {
559 	u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
560 	struct pn544_i2c_fw_frame_write *framep;
561 	u16 params_len;
562 	int framelen;
563 	int r;
564 
565 	if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
566 		datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
567 
568 	framep = (struct pn544_i2c_fw_frame_write *) frame;
569 
570 	params_len = sizeof(framep->be_dest_addr) +
571 		     sizeof(framep->be_datalen) + datalen;
572 	framelen = params_len + sizeof(framep->cmd) +
573 			     sizeof(framep->be_length);
574 
575 	framep->cmd = PN544_FW_CMD_WRITE;
576 
577 	put_unaligned_be16(params_len, &framep->be_length);
578 
579 	framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
580 	framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
581 	framep->be_dest_addr[2] = dest_addr & 0xff;
582 
583 	put_unaligned_be16(datalen, &framep->be_datalen);
584 
585 	memcpy(framep->data, data, datalen);
586 
587 	r = i2c_master_send(client, frame, framelen);
588 
589 	if (r == framelen)
590 		return datalen;
591 	else if (r < 0)
592 		return r;
593 	else
594 		return -EIO;
595 }
596 
pn544_hci_i2c_fw_check_cmd(struct i2c_client * client,u32 start_addr,const u8 * data,u16 datalen)597 static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
598 				      const u8 *data, u16 datalen)
599 {
600 	struct pn544_i2c_fw_frame_check frame;
601 	int r;
602 	u16 crc;
603 
604 	/* calculate local crc for the data we want to check */
605 	crc = crc_ccitt(0xffff, data, datalen);
606 
607 	frame.cmd = PN544_FW_CMD_CHECK;
608 
609 	put_unaligned_be16(sizeof(frame.be_start_addr) +
610 			   sizeof(frame.be_datalen) + sizeof(frame.be_crc),
611 			   &frame.be_length);
612 
613 	/* tell the chip the memory region to which our crc applies */
614 	frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
615 	frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
616 	frame.be_start_addr[2] = start_addr & 0xff;
617 
618 	put_unaligned_be16(datalen, &frame.be_datalen);
619 
620 	/*
621 	 * and give our local crc. Chip will calculate its own crc for the
622 	 * region and compare with ours.
623 	 */
624 	put_unaligned_be16(crc, &frame.be_crc);
625 
626 	r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
627 
628 	if (r == sizeof(frame))
629 		return 0;
630 	else if (r < 0)
631 		return r;
632 	else
633 		return -EIO;
634 }
635 
pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy * phy)636 static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
637 {
638 	int r;
639 
640 	r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
641 				       phy->fw_blob_dest_addr + phy->fw_written,
642 				       phy->fw_blob_data + phy->fw_written,
643 				       phy->fw_blob_size - phy->fw_written);
644 	if (r < 0)
645 		return r;
646 
647 	phy->fw_written += r;
648 	phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
649 
650 	return 0;
651 }
652 
pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy * phy,const u8 * data,u16 datalen)653 static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
654 					const u8 *data, u16 datalen)
655 {
656 	u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
657 	struct pn544_i2c_fw_secure_frame *chunk;
658 	int chunklen;
659 	int r;
660 
661 	if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
662 		datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
663 
664 	chunk = (struct pn544_i2c_fw_secure_frame *) buf;
665 
666 	chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
667 
668 	put_unaligned_be16(datalen, &chunk->be_datalen);
669 
670 	memcpy(chunk->data, data, datalen);
671 
672 	chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
673 
674 	r = i2c_master_send(phy->i2c_dev, buf, chunklen);
675 
676 	if (r == chunklen)
677 		return datalen;
678 	else if (r < 0)
679 		return r;
680 	else
681 		return -EIO;
682 
683 }
684 
pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy * phy)685 static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
686 {
687 	struct pn544_i2c_fw_secure_frame *framep;
688 	int r;
689 
690 	framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
691 	if (phy->fw_written == 0)
692 		phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
693 				+ PN544_FW_SECURE_FRAME_HEADER_LEN;
694 
695 	/* Only secure write command can be chunked*/
696 	if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
697 			framep->cmd != PN544_FW_CMD_SECURE_WRITE)
698 		return -EINVAL;
699 
700 	/* The firmware also have other commands, we just send them directly */
701 	if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
702 		r = i2c_master_send(phy->i2c_dev,
703 			(const char *) phy->fw_blob_data, phy->fw_blob_size);
704 
705 		if (r == phy->fw_blob_size)
706 			goto exit;
707 		else if (r < 0)
708 			return r;
709 		else
710 			return -EIO;
711 	}
712 
713 	r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
714 				       phy->fw_blob_data + phy->fw_written,
715 				       phy->fw_blob_size - phy->fw_written);
716 	if (r < 0)
717 		return r;
718 
719 exit:
720 	phy->fw_written += r;
721 	phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
722 
723 	/* SW reset command will not trig any response from PN544 */
724 	if (framep->cmd == PN544_FW_CMD_RESET) {
725 		pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
726 		phy->fw_cmd_result = 0;
727 		schedule_work(&phy->fw_work);
728 	}
729 
730 	return 0;
731 }
732 
pn544_hci_i2c_fw_work(struct work_struct * work)733 static void pn544_hci_i2c_fw_work(struct work_struct *work)
734 {
735 	struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
736 						fw_work);
737 	int r;
738 	struct pn544_i2c_fw_blob *blob;
739 	struct pn544_i2c_fw_secure_blob *secure_blob;
740 
741 	switch (phy->fw_work_state) {
742 	case FW_WORK_STATE_START:
743 		pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
744 
745 		r = request_firmware(&phy->fw, phy->firmware_name,
746 				     &phy->i2c_dev->dev);
747 		if (r < 0)
748 			goto exit_state_start;
749 
750 		phy->fw_written = 0;
751 
752 		switch (phy->hw_variant) {
753 		case PN544_HW_VARIANT_C2:
754 			blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
755 			phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
756 			phy->fw_blob_dest_addr = get_unaligned_be32(
757 							&blob->be_destaddr);
758 			phy->fw_blob_data = blob->data;
759 
760 			r = pn544_hci_i2c_fw_write_chunk(phy);
761 			break;
762 		case PN544_HW_VARIANT_C3:
763 			secure_blob = (struct pn544_i2c_fw_secure_blob *)
764 								phy->fw->data;
765 			phy->fw_blob_data = secure_blob->data;
766 			phy->fw_size = phy->fw->size;
767 			r = pn544_hci_i2c_fw_secure_write_frame(phy);
768 			break;
769 		default:
770 			r = -ENOTSUPP;
771 			break;
772 		}
773 
774 exit_state_start:
775 		if (r < 0)
776 			pn544_hci_i2c_fw_work_complete(phy, r);
777 		break;
778 
779 	case FW_WORK_STATE_WAIT_WRITE_ANSWER:
780 		r = phy->fw_cmd_result;
781 		if (r < 0)
782 			goto exit_state_wait_write_answer;
783 
784 		if (phy->fw_written == phy->fw_blob_size) {
785 			r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
786 						       phy->fw_blob_dest_addr,
787 						       phy->fw_blob_data,
788 						       phy->fw_blob_size);
789 			if (r < 0)
790 				goto exit_state_wait_write_answer;
791 			phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
792 			break;
793 		}
794 
795 		r = pn544_hci_i2c_fw_write_chunk(phy);
796 
797 exit_state_wait_write_answer:
798 		if (r < 0)
799 			pn544_hci_i2c_fw_work_complete(phy, r);
800 		break;
801 
802 	case FW_WORK_STATE_WAIT_CHECK_ANSWER:
803 		r = phy->fw_cmd_result;
804 		if (r < 0)
805 			goto exit_state_wait_check_answer;
806 
807 		blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
808 		       phy->fw_blob_size);
809 		phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
810 		if (phy->fw_blob_size != 0) {
811 			phy->fw_blob_dest_addr =
812 					get_unaligned_be32(&blob->be_destaddr);
813 			phy->fw_blob_data = blob->data;
814 
815 			phy->fw_written = 0;
816 			r = pn544_hci_i2c_fw_write_chunk(phy);
817 		}
818 
819 exit_state_wait_check_answer:
820 		if (r < 0 || phy->fw_blob_size == 0)
821 			pn544_hci_i2c_fw_work_complete(phy, r);
822 		break;
823 
824 	case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
825 		r = phy->fw_cmd_result;
826 		if (r < 0)
827 			goto exit_state_wait_secure_write_answer;
828 
829 		if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
830 			r = pn544_hci_i2c_fw_secure_write_frame(phy);
831 			goto exit_state_wait_secure_write_answer;
832 		}
833 
834 		if (phy->fw_written == phy->fw_blob_size) {
835 			secure_blob = (struct pn544_i2c_fw_secure_blob *)
836 				(phy->fw_blob_data + phy->fw_blob_size);
837 			phy->fw_size -= phy->fw_blob_size +
838 				PN544_FW_SECURE_BLOB_HEADER_LEN;
839 			if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
840 					+ PN544_FW_SECURE_FRAME_HEADER_LEN) {
841 				phy->fw_blob_data = secure_blob->data;
842 
843 				phy->fw_written = 0;
844 				r = pn544_hci_i2c_fw_secure_write_frame(phy);
845 			}
846 		}
847 
848 exit_state_wait_secure_write_answer:
849 		if (r < 0 || phy->fw_size == 0)
850 			pn544_hci_i2c_fw_work_complete(phy, r);
851 		break;
852 
853 	default:
854 		break;
855 	}
856 }
857 
858 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
859 static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
860 
861 static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
862 	{ "enable-gpios", &enable_gpios, 1 },
863 	{ "firmware-gpios", &firmware_gpios, 1 },
864 	{ },
865 };
866 
pn544_hci_i2c_probe(struct i2c_client * client)867 static int pn544_hci_i2c_probe(struct i2c_client *client)
868 {
869 	struct device *dev = &client->dev;
870 	struct pn544_i2c_phy *phy;
871 	int r = 0;
872 
873 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
874 		nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
875 		return -ENODEV;
876 	}
877 
878 	phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
879 			   GFP_KERNEL);
880 	if (!phy)
881 		return -ENOMEM;
882 
883 	INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
884 	phy->fw_work_state = FW_WORK_STATE_IDLE;
885 
886 	phy->i2c_dev = client;
887 	i2c_set_clientdata(client, phy);
888 
889 	r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
890 	if (r)
891 		dev_dbg(dev, "Unable to add GPIO mapping table\n");
892 
893 	/* Get EN GPIO */
894 	phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
895 	if (IS_ERR(phy->gpiod_en)) {
896 		nfc_err(dev, "Unable to get EN GPIO\n");
897 		return PTR_ERR(phy->gpiod_en);
898 	}
899 
900 	/* Get FW GPIO */
901 	phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
902 	if (IS_ERR(phy->gpiod_fw)) {
903 		nfc_err(dev, "Unable to get FW GPIO\n");
904 		return PTR_ERR(phy->gpiod_fw);
905 	}
906 
907 	pn544_hci_i2c_platform_init(phy);
908 
909 	r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
910 				      pn544_hci_i2c_irq_thread_fn,
911 				      IRQF_TRIGGER_RISING | IRQF_ONESHOT,
912 				      PN544_HCI_I2C_DRIVER_NAME, phy);
913 	if (r < 0) {
914 		nfc_err(&client->dev, "Unable to register IRQ handler\n");
915 		return r;
916 	}
917 
918 	r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
919 			    PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
920 			    PN544_HCI_I2C_LLC_MAX_PAYLOAD,
921 			    pn544_hci_i2c_fw_download, &phy->hdev);
922 	if (r < 0)
923 		return r;
924 
925 	return 0;
926 }
927 
pn544_hci_i2c_remove(struct i2c_client * client)928 static void pn544_hci_i2c_remove(struct i2c_client *client)
929 {
930 	struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
931 
932 	cancel_work_sync(&phy->fw_work);
933 	if (phy->fw_work_state != FW_WORK_STATE_IDLE)
934 		pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
935 
936 	pn544_hci_remove(phy->hdev);
937 
938 	if (phy->powered)
939 		pn544_hci_i2c_disable(phy);
940 }
941 
942 static const struct of_device_id of_pn544_i2c_match[] __maybe_unused = {
943 	{ .compatible = "nxp,pn544-i2c", },
944 	{},
945 };
946 MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
947 
948 static struct i2c_driver pn544_hci_i2c_driver = {
949 	.driver = {
950 		   .name = PN544_HCI_I2C_DRIVER_NAME,
951 		   .of_match_table = of_match_ptr(of_pn544_i2c_match),
952 		   .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
953 		  },
954 	.probe = pn544_hci_i2c_probe,
955 	.id_table = pn544_hci_i2c_id_table,
956 	.remove = pn544_hci_i2c_remove,
957 };
958 
959 module_i2c_driver(pn544_hci_i2c_driver);
960 
961 MODULE_LICENSE("GPL");
962 MODULE_DESCRIPTION(DRIVER_DESC);
963