drivers/nfc/pn544/i2c.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * I2C Link Layer for PN544 HCI based Driver
   4  *
   5  * Copyright (C) 2012  Intel Corporation. All rights reserved.
   6  */
   7
   8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10 #include <linux/crc-ccitt.h>
  11 #include <linux/module.h>
  12 #include <linux/i2c.h>
  13 #include <linux/acpi.h>
  14 #include <linux/interrupt.h>
  15 #include <linux/delay.h>
  16 #include <linux/nfc.h>
  17 #include <linux/firmware.h>
  18 #include <linux/gpio/consumer.h>
  19
  20 #include <asm/unaligned.h>
  21
  22 #include <net/nfc/hci.h>
  23 #include <net/nfc/llc.h>
  24 #include <net/nfc/nfc.h>
  25
  26 #include "pn544.h"
  27
  28 #define PN544_I2C_FRAME_HEADROOM 1
  29 #define PN544_I2C_FRAME_TAILROOM 2
  30
  31 /* GPIO names */
  32 #define PN544_GPIO_NAME_IRQ "pn544_irq"
  33 #define PN544_GPIO_NAME_FW  "pn544_fw"
  34 #define PN544_GPIO_NAME_EN  "pn544_en"
  35
  36 /* framing in HCI mode */
  37 #define PN544_HCI_I2C_LLC_LEN           1
  38 #define PN544_HCI_I2C_LLC_CRC           2
  39 #define PN544_HCI_I2C_LLC_LEN_CRC       (PN544_HCI_I2C_LLC_LEN + \
  40                                          PN544_HCI_I2C_LLC_CRC)
  41 #define PN544_HCI_I2C_LLC_MIN_SIZE      (1 + PN544_HCI_I2C_LLC_LEN_CRC)
  42 #define PN544_HCI_I2C_LLC_MAX_PAYLOAD   29
  43 #define PN544_HCI_I2C_LLC_MAX_SIZE      (PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
  44                                          PN544_HCI_I2C_LLC_MAX_PAYLOAD)
  45
  46 static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
  47         { "pn544" },
  48         {}
  49 };
  50
  51 MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
  52
  53 static const struct acpi_device_id pn544_hci_i2c_acpi_match[] __maybe_unused = {
  54         {"NXP5440", 0},
  55         {}
  56 };
  57
  58 MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
  59
  60 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
  61
  62 /*
  63  * Exposed through the 4 most significant bytes
  64  * from the HCI SW_VERSION first byte, a.k.a.
  65  * SW RomLib.
  66  */
  67 #define PN544_HW_VARIANT_C2 0xa
  68 #define PN544_HW_VARIANT_C3 0xb
  69
  70 #define PN544_FW_CMD_RESET 0x01
  71 #define PN544_FW_CMD_WRITE 0x08
  72 #define PN544_FW_CMD_CHECK 0x06
  73 #define PN544_FW_CMD_SECURE_WRITE 0x0C
  74 #define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
  75
  76 struct pn544_i2c_fw_frame_write {
  77         u8 cmd;
  78         u16 be_length;
  79         u8 be_dest_addr[3];
  80         u16 be_datalen;
  81         u8 data[];
  82 } __packed;
  83
  84 struct pn544_i2c_fw_frame_check {
  85         u8 cmd;
  86         u16 be_length;
  87         u8 be_start_addr[3];
  88         u16 be_datalen;
  89         u16 be_crc;
  90 } __packed;
  91
  92 struct pn544_i2c_fw_frame_response {
  93         u8 status;
  94         u16 be_length;
  95 } __packed;
  96
  97 struct pn544_i2c_fw_blob {
  98         u32 be_size;
  99         u32 be_destaddr;
 100         u8 data[];
 101 };
 102
 103 struct pn544_i2c_fw_secure_frame {
 104         u8 cmd;
 105         u16 be_datalen;
 106         u8 data[];
 107 } __packed;
 108
 109 struct pn544_i2c_fw_secure_blob {
 110         u64 header;
 111         u8 data[];
 112 };
 113
 114 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
 115 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
 116 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
 117 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
 118 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
 119 #define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
 120 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
 121 #define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
 122 #define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
 123 #define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
 124 #define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
 125 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
 126 #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
 127 #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
 128
 129 #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
 130 #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
 131 #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
 132 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
 133                                          PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
 134                                          PN544_FW_WRITE_BUFFER_MAX_LEN)
 135 #define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
 136 #define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
 137                         PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
 138 #define PN544_FW_SECURE_FRAME_HEADER_LEN 3
 139 #define PN544_FW_SECURE_BLOB_HEADER_LEN 8
 140
 141 #define FW_WORK_STATE_IDLE 1
 142 #define FW_WORK_STATE_START 2
 143 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
 144 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
 145 #define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
 146
 147 struct pn544_i2c_phy {
 148         struct i2c_client *i2c_dev;
 149         struct nfc_hci_dev *hdev;
 150
 151         struct gpio_desc *gpiod_en;
 152         struct gpio_desc *gpiod_fw;
 153
 154         unsigned int en_polarity;
 155
 156         u8 hw_variant;
 157
 158         struct work_struct fw_work;
 159         int fw_work_state;
 160         char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
 161         const struct firmware *fw;
 162         u32 fw_blob_dest_addr;
 163         size_t fw_blob_size;
 164         const u8 *fw_blob_data;
 165         size_t fw_written;
 166         size_t fw_size;
 167
 168         int fw_cmd_result;
 169
 170         int powered;
 171         int run_mode;
 172
 173         int hard_fault;         /*
 174                                  * < 0 if hardware error occured (e.g. i2c err)
 175                                  * and prevents normal operation.
 176                                  */
 177 };
 178
 179 #define I2C_DUMP_SKB(info, skb)                                 \
 180 do {                                                            \
 181         pr_debug("%s:\n", info);                                \
 182         print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
 183                        16, 1, (skb)->data, (skb)->len, 0);      \
 184 } while (0)
 185
 186 static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
 187 {
 188         int polarity, retry, ret;
 189         static const char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
 190         int count = sizeof(rset_cmd);
 191
 192         nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
 193
 194         /* Disable fw download */
 195         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 196
 197         for (polarity = 0; polarity < 2; polarity++) {
 198                 phy->en_polarity = polarity;
 199                 retry = 3;
 200                 while (retry--) {
 201                         /* power off */
 202                         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 203                         usleep_range(10000, 15000);
 204
 205                         /* power on */
 206                         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 207                         usleep_range(10000, 15000);
 208
 209                         /* send reset */
 210                         dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
 211                         ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
 212                         if (ret == count) {
 213                                 nfc_info(&phy->i2c_dev->dev,
 214                                          "nfc_en polarity : active %s\n",
 215                                          (polarity == 0 ? "low" : "high"));
 216                                 goto out;
 217                         }
 218                 }
 219         }
 220
 221         nfc_err(&phy->i2c_dev->dev,
 222                 "Could not detect nfc_en polarity, fallback to active high\n");
 223
 224 out:
 225         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 226         usleep_range(10000, 15000);
 227 }
 228
 229 static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
 230 {
 231         gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
 232         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 233         usleep_range(10000, 15000);
 234
 235         phy->run_mode = run_mode;
 236 }
 237
 238 static int pn544_hci_i2c_enable(void *phy_id)
 239 {
 240         struct pn544_i2c_phy *phy = phy_id;
 241
 242         pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
 243
 244         phy->powered = 1;
 245
 246         return 0;
 247 }
 248
 249 static void pn544_hci_i2c_disable(void *phy_id)
 250 {
 251         struct pn544_i2c_phy *phy = phy_id;
 252
 253         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 254         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 255         usleep_range(10000, 15000);
 256
 257         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 258         usleep_range(10000, 15000);
 259
 260         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 261         usleep_range(10000, 15000);
 262
 263         phy->powered = 0;
 264 }
 265
 266 static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
 267 {
 268         u16 crc;
 269         int len;
 270
 271         len = skb->len + 2;
 272         *(u8 *)skb_push(skb, 1) = len;
 273
 274         crc = crc_ccitt(0xffff, skb->data, skb->len);
 275         crc = ~crc;
 276         skb_put_u8(skb, crc & 0xff);
 277         skb_put_u8(skb, crc >> 8);
 278 }
 279
 280 static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
 281 {
 282         skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
 283         skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
 284 }
 285
 286 /*
 287  * Writing a frame must not return the number of written bytes.
 288  * It must return either zero for success, or <0 for error.
 289  * In addition, it must not alter the skb
 290  */
 291 static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
 292 {
 293         int r;
 294         struct pn544_i2c_phy *phy = phy_id;
 295         struct i2c_client *client = phy->i2c_dev;
 296
 297         if (phy->hard_fault != 0)
 298                 return phy->hard_fault;
 299
 300         usleep_range(3000, 6000);
 301
 302         pn544_hci_i2c_add_len_crc(skb);
 303
 304         I2C_DUMP_SKB("i2c frame written", skb);
 305
 306         r = i2c_master_send(client, skb->data, skb->len);
 307
 308         if (r == -EREMOTEIO) {  /* Retry, chip was in standby */
 309                 usleep_range(6000, 10000);
 310                 r = i2c_master_send(client, skb->data, skb->len);
 311         }
 312
 313         if (r >= 0) {
 314                 if (r != skb->len)
 315                         r = -EREMOTEIO;
 316                 else
 317                         r = 0;
 318         }
 319
 320         pn544_hci_i2c_remove_len_crc(skb);
 321
 322         return r;
 323 }
 324
 325 static int check_crc(u8 *buf, int buflen)
 326 {
 327         int len;
 328         u16 crc;
 329
 330         len = buf[0] + 1;
 331         crc = crc_ccitt(0xffff, buf, len - 2);
 332         crc = ~crc;
 333
 334         if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
 335                 pr_err("CRC error 0x%x != 0x%x 0x%x\n",
 336                        crc, buf[len - 1], buf[len - 2]);
 337                 pr_info("%s: BAD CRC\n", __func__);
 338                 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
 339                                16, 2, buf, buflen, false);
 340                 return -EPERM;
 341         }
 342         return 0;
 343 }
 344
 345 /*
 346  * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
 347  * that i2c bus will be flushed and that next read will start on a new frame.
 348  * returned skb contains only LLC header and payload.
 349  * returns:
 350  * -EREMOTEIO : i2c read error (fatal)
 351  * -EBADMSG : frame was incorrect and discarded
 352  * -ENOMEM : cannot allocate skb, frame dropped
 353  */
 354 static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
 355 {
 356         int r;
 357         u8 len;
 358         u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
 359         struct i2c_client *client = phy->i2c_dev;
 360
 361         r = i2c_master_recv(client, &len, 1);
 362         if (r != 1) {
 363                 nfc_err(&client->dev, "cannot read len byte\n");
 364                 return -EREMOTEIO;
 365         }
 366
 367         if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
 368             (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
 369                 nfc_err(&client->dev, "invalid len byte\n");
 370                 r = -EBADMSG;
 371                 goto flush;
 372         }
 373
 374         *skb = alloc_skb(1 + len, GFP_KERNEL);
 375         if (*skb == NULL) {
 376                 r = -ENOMEM;
 377                 goto flush;
 378         }
 379
 380         skb_put_u8(*skb, len);
 381
 382         r = i2c_master_recv(client, skb_put(*skb, len), len);
 383         if (r != len) {
 384                 kfree_skb(*skb);
 385                 return -EREMOTEIO;
 386         }
 387
 388         I2C_DUMP_SKB("i2c frame read", *skb);
 389
 390         r = check_crc((*skb)->data, (*skb)->len);
 391         if (r != 0) {
 392                 kfree_skb(*skb);
 393                 r = -EBADMSG;
 394                 goto flush;
 395         }
 396
 397         skb_pull(*skb, 1);
 398         skb_trim(*skb, (*skb)->len - 2);
 399
 400         usleep_range(3000, 6000);
 401
 402         return 0;
 403
 404 flush:
 405         if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
 406                 r = -EREMOTEIO;
 407
 408         usleep_range(3000, 6000);
 409
 410         return r;
 411 }
 412
 413 static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
 414 {
 415         int r;
 416         struct pn544_i2c_fw_frame_response response;
 417         struct i2c_client *client = phy->i2c_dev;
 418
 419         r = i2c_master_recv(client, (char *) &response, sizeof(response));
 420         if (r != sizeof(response)) {
 421                 nfc_err(&client->dev, "cannot read fw status\n");
 422                 return -EIO;
 423         }
 424
 425         usleep_range(3000, 6000);
 426
 427         switch (response.status) {
 428         case 0:
 429                 return 0;
 430         case PN544_FW_CMD_RESULT_CHUNK_OK:
 431                 return response.status;
 432         case PN544_FW_CMD_RESULT_TIMEOUT:
 433                 return -ETIMEDOUT;
 434         case PN544_FW_CMD_RESULT_BAD_CRC:
 435                 return -ENODATA;
 436         case PN544_FW_CMD_RESULT_ACCESS_DENIED:
 437                 return -EACCES;
 438         case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
 439                 return -EPROTO;
 440         case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
 441                 return -EINVAL;
 442         case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
 443                 return -ENOTSUPP;
 444         case PN544_FW_CMD_RESULT_INVALID_LENGTH:
 445                 return -EBADMSG;
 446         case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
 447                 return -ENOKEY;
 448         case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
 449                 return -EINVAL;
 450         case PN544_FW_CMD_RESULT_MEMORY_ERROR:
 451                 return -ENOMEM;
 452         case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
 453                 return -EACCES;
 454         case PN544_FW_CMD_RESULT_WRITE_FAILED:
 455         case PN544_FW_CMD_RESULT_CHUNK_ERROR:
 456                 return -EIO;
 457         default:
 458                 return -EIO;
 459         }
 460 }
 461
 462 /*
 463  * Reads an shdlc frame from the chip. This is not as straightforward as it
 464  * seems. There are cases where we could loose the frame start synchronization.
 465  * The frame format is len-data-crc, and corruption can occur anywhere while
 466  * transiting on i2c bus, such that we could read an invalid len.
 467  * In order to recover synchronization with the next frame, we must be sure
 468  * to read the real amount of data without using the len byte. We do this by
 469  * assuming the following:
 470  * - the chip will always present only one single complete frame on the bus
 471  *   before triggering the interrupt
 472  * - the chip will not present a new frame until we have completely read
 473  *   the previous one (or until we have handled the interrupt).
 474  * The tricky case is when we read a corrupted len that is less than the real
 475  * len. We must detect this here in order to determine that we need to flush
 476  * the bus. This is the reason why we check the crc here.
 477  */
 478 static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
 479 {
 480         struct pn544_i2c_phy *phy = phy_id;
 481         struct i2c_client *client;
 482         struct sk_buff *skb = NULL;
 483         int r;
 484
 485         if (!phy || irq != phy->i2c_dev->irq) {
 486                 WARN_ON_ONCE(1);
 487                 return IRQ_NONE;
 488         }
 489
 490         client = phy->i2c_dev;
 491         dev_dbg(&client->dev, "IRQ\n");
 492
 493         if (phy->hard_fault != 0)
 494                 return IRQ_HANDLED;
 495
 496         if (phy->run_mode == PN544_FW_MODE) {
 497                 phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
 498                 schedule_work(&phy->fw_work);
 499         } else {
 500                 r = pn544_hci_i2c_read(phy, &skb);
 501                 if (r == -EREMOTEIO) {
 502                         phy->hard_fault = r;
 503
 504                         nfc_hci_recv_frame(phy->hdev, NULL);
 505
 506                         return IRQ_HANDLED;
 507                 } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
 508                         return IRQ_HANDLED;
 509                 }
 510
 511                 nfc_hci_recv_frame(phy->hdev, skb);
 512         }
 513         return IRQ_HANDLED;
 514 }
 515
 516 static const struct nfc_phy_ops i2c_phy_ops = {
 517         .write = pn544_hci_i2c_write,
 518         .enable = pn544_hci_i2c_enable,
 519         .disable = pn544_hci_i2c_disable,
 520 };
 521
 522 static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
 523                                         u8 hw_variant)
 524 {
 525         struct pn544_i2c_phy *phy = phy_id;
 526
 527         pr_info("Starting Firmware Download (%s)\n", firmware_name);
 528
 529         strcpy(phy->firmware_name, firmware_name);
 530
 531         phy->hw_variant = hw_variant;
 532         phy->fw_work_state = FW_WORK_STATE_START;
 533
 534         schedule_work(&phy->fw_work);
 535
 536         return 0;
 537 }
 538
 539 static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
 540                                            int result)
 541 {
 542         pr_info("Firmware Download Complete, result=%d\n", result);
 543
 544         pn544_hci_i2c_disable(phy);
 545
 546         phy->fw_work_state = FW_WORK_STATE_IDLE;
 547
 548         if (phy->fw) {
 549                 release_firmware(phy->fw);
 550                 phy->fw = NULL;
 551         }
 552
 553         nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
 554 }
 555
 556 static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
 557                                       const u8 *data, u16 datalen)
 558 {
 559         u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
 560         struct pn544_i2c_fw_frame_write *framep;
 561         u16 params_len;
 562         int framelen;
 563         int r;
 564
 565         if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
 566                 datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
 567
 568         framep = (struct pn544_i2c_fw_frame_write *) frame;
 569
 570         params_len = sizeof(framep->be_dest_addr) +
 571                      sizeof(framep->be_datalen) + datalen;
 572         framelen = params_len + sizeof(framep->cmd) +
 573                              sizeof(framep->be_length);
 574
 575         framep->cmd = PN544_FW_CMD_WRITE;
 576
 577         put_unaligned_be16(params_len, &framep->be_length);
 578
 579         framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
 580         framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
 581         framep->be_dest_addr[2] = dest_addr & 0xff;
 582
 583         put_unaligned_be16(datalen, &framep->be_datalen);
 584
 585         memcpy(framep->data, data, datalen);
 586
 587         r = i2c_master_send(client, frame, framelen);
 588
 589         if (r == framelen)
 590                 return datalen;
 591         else if (r < 0)
 592                 return r;
 593         else
 594                 return -EIO;
 595 }
 596
 597 static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
 598                                       const u8 *data, u16 datalen)
 599 {
 600         struct pn544_i2c_fw_frame_check frame;
 601         int r;
 602         u16 crc;
 603
 604         /* calculate local crc for the data we want to check */
 605         crc = crc_ccitt(0xffff, data, datalen);
 606
 607         frame.cmd = PN544_FW_CMD_CHECK;
 608
 609         put_unaligned_be16(sizeof(frame.be_start_addr) +
 610                            sizeof(frame.be_datalen) + sizeof(frame.be_crc),
 611                            &frame.be_length);
 612
 613         /* tell the chip the memory region to which our crc applies */
 614         frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
 615         frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
 616         frame.be_start_addr[2] = start_addr & 0xff;
 617
 618         put_unaligned_be16(datalen, &frame.be_datalen);
 619
 620         /*
 621          * and give our local crc. Chip will calculate its own crc for the
 622          * region and compare with ours.
 623          */
 624         put_unaligned_be16(crc, &frame.be_crc);
 625
 626         r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
 627
 628         if (r == sizeof(frame))
 629                 return 0;
 630         else if (r < 0)
 631                 return r;
 632         else
 633                 return -EIO;
 634 }
 635
 636 static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
 637 {
 638         int r;
 639
 640         r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
 641                                        phy->fw_blob_dest_addr + phy->fw_written,
 642                                        phy->fw_blob_data + phy->fw_written,
 643                                        phy->fw_blob_size - phy->fw_written);
 644         if (r < 0)
 645                 return r;
 646
 647         phy->fw_written += r;
 648         phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
 649
 650         return 0;
 651 }
 652
 653 static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
 654                                         const u8 *data, u16 datalen)
 655 {
 656         u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
 657         struct pn544_i2c_fw_secure_frame *chunk;
 658         int chunklen;
 659         int r;
 660
 661         if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
 662                 datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
 663
 664         chunk = (struct pn544_i2c_fw_secure_frame *) buf;
 665
 666         chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
 667
 668         put_unaligned_be16(datalen, &chunk->be_datalen);
 669
 670         memcpy(chunk->data, data, datalen);
 671
 672         chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
 673
 674         r = i2c_master_send(phy->i2c_dev, buf, chunklen);
 675
 676         if (r == chunklen)
 677                 return datalen;
 678         else if (r < 0)
 679                 return r;
 680         else
 681                 return -EIO;
 682
 683 }
 684
 685 static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
 686 {
 687         struct pn544_i2c_fw_secure_frame *framep;
 688         int r;
 689
 690         framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
 691         if (phy->fw_written == 0)
 692                 phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
 693                                 + PN544_FW_SECURE_FRAME_HEADER_LEN;
 694
 695         /* Only secure write command can be chunked*/
 696         if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
 697                         framep->cmd != PN544_FW_CMD_SECURE_WRITE)
 698                 return -EINVAL;
 699
 700         /* The firmware also have other commands, we just send them directly */
 701         if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
 702                 r = i2c_master_send(phy->i2c_dev,
 703                         (const char *) phy->fw_blob_data, phy->fw_blob_size);
 704
 705                 if (r == phy->fw_blob_size)
 706                         goto exit;
 707                 else if (r < 0)
 708                         return r;
 709                 else
 710                         return -EIO;
 711         }
 712
 713         r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
 714                                        phy->fw_blob_data + phy->fw_written,
 715                                        phy->fw_blob_size - phy->fw_written);
 716         if (r < 0)
 717                 return r;
 718
 719 exit:
 720         phy->fw_written += r;
 721         phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
 722
 723         /* SW reset command will not trig any response from PN544 */
 724         if (framep->cmd == PN544_FW_CMD_RESET) {
 725                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 726                 phy->fw_cmd_result = 0;
 727                 schedule_work(&phy->fw_work);
 728         }
 729
 730         return 0;
 731 }
 732
 733 static void pn544_hci_i2c_fw_work(struct work_struct *work)
 734 {
 735         struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
 736                                                 fw_work);
 737         int r;
 738         struct pn544_i2c_fw_blob *blob;
 739         struct pn544_i2c_fw_secure_blob *secure_blob;
 740
 741         switch (phy->fw_work_state) {
 742         case FW_WORK_STATE_START:
 743                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 744
 745                 r = request_firmware(&phy->fw, phy->firmware_name,
 746                                      &phy->i2c_dev->dev);
 747                 if (r < 0)
 748                         goto exit_state_start;
 749
 750                 phy->fw_written = 0;
 751
 752                 switch (phy->hw_variant) {
 753                 case PN544_HW_VARIANT_C2:
 754                         blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
 755                         phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 756                         phy->fw_blob_dest_addr = get_unaligned_be32(
 757                                                         &blob->be_destaddr);
 758                         phy->fw_blob_data = blob->data;
 759
 760                         r = pn544_hci_i2c_fw_write_chunk(phy);
 761                         break;
 762                 case PN544_HW_VARIANT_C3:
 763                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 764                                                                 phy->fw->data;
 765                         phy->fw_blob_data = secure_blob->data;
 766                         phy->fw_size = phy->fw->size;
 767                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 768                         break;
 769                 default:
 770                         r = -ENOTSUPP;
 771                         break;
 772                 }
 773
 774 exit_state_start:
 775                 if (r < 0)
 776                         pn544_hci_i2c_fw_work_complete(phy, r);
 777                 break;
 778
 779         case FW_WORK_STATE_WAIT_WRITE_ANSWER:
 780                 r = phy->fw_cmd_result;
 781                 if (r < 0)
 782                         goto exit_state_wait_write_answer;
 783
 784                 if (phy->fw_written == phy->fw_blob_size) {
 785                         r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
 786                                                        phy->fw_blob_dest_addr,
 787                                                        phy->fw_blob_data,
 788                                                        phy->fw_blob_size);
 789                         if (r < 0)
 790                                 goto exit_state_wait_write_answer;
 791                         phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
 792                         break;
 793                 }
 794
 795                 r = pn544_hci_i2c_fw_write_chunk(phy);
 796
 797 exit_state_wait_write_answer:
 798                 if (r < 0)
 799                         pn544_hci_i2c_fw_work_complete(phy, r);
 800                 break;
 801
 802         case FW_WORK_STATE_WAIT_CHECK_ANSWER:
 803                 r = phy->fw_cmd_result;
 804                 if (r < 0)
 805                         goto exit_state_wait_check_answer;
 806
 807                 blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
 808                        phy->fw_blob_size);
 809                 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 810                 if (phy->fw_blob_size != 0) {
 811                         phy->fw_blob_dest_addr =
 812                                         get_unaligned_be32(&blob->be_destaddr);
 813                         phy->fw_blob_data = blob->data;
 814
 815                         phy->fw_written = 0;
 816                         r = pn544_hci_i2c_fw_write_chunk(phy);
 817                 }
 818
 819 exit_state_wait_check_answer:
 820                 if (r < 0 || phy->fw_blob_size == 0)
 821                         pn544_hci_i2c_fw_work_complete(phy, r);
 822                 break;
 823
 824         case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
 825                 r = phy->fw_cmd_result;
 826                 if (r < 0)
 827                         goto exit_state_wait_secure_write_answer;
 828
 829                 if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
 830                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 831                         goto exit_state_wait_secure_write_answer;
 832                 }
 833
 834                 if (phy->fw_written == phy->fw_blob_size) {
 835                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 836                                 (phy->fw_blob_data + phy->fw_blob_size);
 837                         phy->fw_size -= phy->fw_blob_size +
 838                                 PN544_FW_SECURE_BLOB_HEADER_LEN;
 839                         if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
 840                                         + PN544_FW_SECURE_FRAME_HEADER_LEN) {
 841                                 phy->fw_blob_data = secure_blob->data;
 842
 843                                 phy->fw_written = 0;
 844                                 r = pn544_hci_i2c_fw_secure_write_frame(phy);
 845                         }
 846                 }
 847
 848 exit_state_wait_secure_write_answer:
 849                 if (r < 0 || phy->fw_size == 0)
 850                         pn544_hci_i2c_fw_work_complete(phy, r);
 851                 break;
 852
 853         default:
 854                 break;
 855         }
 856 }
 857
 858 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
 859 static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
 860
 861 static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
 862         { "enable-gpios", &enable_gpios, 1 },
 863         { "firmware-gpios", &firmware_gpios, 1 },
 864         { },
 865 };
 866
 867 static int pn544_hci_i2c_probe(struct i2c_client *client)
 868 {
 869         struct device *dev = &client->dev;
 870         struct pn544_i2c_phy *phy;
 871         int r = 0;
 872
 873         if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 874                 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
 875                 return -ENODEV;
 876         }
 877
 878         phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
 879                            GFP_KERNEL);
 880         if (!phy)
 881                 return -ENOMEM;
 882
 883         INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
 884         phy->fw_work_state = FW_WORK_STATE_IDLE;
 885
 886         phy->i2c_dev = client;
 887         i2c_set_clientdata(client, phy);
 888
 889         r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
 890         if (r)
 891                 dev_dbg(dev, "Unable to add GPIO mapping table\n");
 892
 893         /* Get EN GPIO */
 894         phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
 895         if (IS_ERR(phy->gpiod_en)) {
 896                 nfc_err(dev, "Unable to get EN GPIO\n");
 897                 return PTR_ERR(phy->gpiod_en);
 898         }
 899
 900         /* Get FW GPIO */
 901         phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
 902         if (IS_ERR(phy->gpiod_fw)) {
 903                 nfc_err(dev, "Unable to get FW GPIO\n");
 904                 return PTR_ERR(phy->gpiod_fw);
 905         }
 906
 907         pn544_hci_i2c_platform_init(phy);
 908
 909         r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
 910                                       pn544_hci_i2c_irq_thread_fn,
 911                                       IRQF_TRIGGER_RISING | IRQF_ONESHOT,
 912                                       PN544_HCI_I2C_DRIVER_NAME, phy);
 913         if (r < 0) {
 914                 nfc_err(&client->dev, "Unable to register IRQ handler\n");
 915                 return r;
 916         }
 917
 918         r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
 919                             PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
 920                             PN544_HCI_I2C_LLC_MAX_PAYLOAD,
 921                             pn544_hci_i2c_fw_download, &phy->hdev);
 922         if (r < 0)
 923                 return r;
 924
 925         return 0;
 926 }
 927
 928 static void pn544_hci_i2c_remove(struct i2c_client *client)
 929 {
 930         struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
 931
 932         cancel_work_sync(&phy->fw_work);
 933         if (phy->fw_work_state != FW_WORK_STATE_IDLE)
 934                 pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
 935
 936         pn544_hci_remove(phy->hdev);
 937
 938         if (phy->powered)
 939                 pn544_hci_i2c_disable(phy);
 940 }
 941
 942 static const struct of_device_id of_pn544_i2c_match[] __maybe_unused = {
 943         { .compatible = "nxp,pn544-i2c", },
 944         {},
 945 };
 946 MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
 947
 948 static struct i2c_driver pn544_hci_i2c_driver = {
 949         .driver = {
 950                    .name = PN544_HCI_I2C_DRIVER_NAME,
 951                    .of_match_table = of_match_ptr(of_pn544_i2c_match),
 952                    .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
 953                   },
 954         .probe = pn544_hci_i2c_probe,
 955         .id_table = pn544_hci_i2c_id_table,
 956         .remove = pn544_hci_i2c_remove,
 957 };
 958
 959 module_i2c_driver(pn544_hci_i2c_driver);
 960
 961 MODULE_LICENSE("GPL");
 962 MODULE_DESCRIPTION(DRIVER_DESC);