drivers/nfc/pn544/i2c.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * I2C Link Layer for PN544 HCI based Driver
   4  *
   5  * Copyright (C) 2012  Intel Corporation. All rights reserved.
   6  */
   7
   8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10 #include <linux/crc-ccitt.h>
  11 #include <linux/module.h>
  12 #include <linux/i2c.h>
  13 #include <linux/acpi.h>
  14 #include <linux/interrupt.h>
  15 #include <linux/delay.h>
  16 #include <linux/nfc.h>
  17 #include <linux/firmware.h>
  18 #include <linux/gpio/consumer.h>
  19
  20 #include <asm/unaligned.h>
  21
  22 #include <net/nfc/hci.h>
  23 #include <net/nfc/llc.h>
  24 #include <net/nfc/nfc.h>
  25
  26 #include "pn544.h"
  27
  28 #define PN544_I2C_FRAME_HEADROOM 1
  29 #define PN544_I2C_FRAME_TAILROOM 2
  30
  31 /* GPIO names */
  32 #define PN544_GPIO_NAME_IRQ "pn544_irq"
  33 #define PN544_GPIO_NAME_FW  "pn544_fw"
  34 #define PN544_GPIO_NAME_EN  "pn544_en"
  35
  36 /* framing in HCI mode */
  37 #define PN544_HCI_I2C_LLC_LEN           1
  38 #define PN544_HCI_I2C_LLC_CRC           2
  39 #define PN544_HCI_I2C_LLC_LEN_CRC       (PN544_HCI_I2C_LLC_LEN + \
  40                                          PN544_HCI_I2C_LLC_CRC)
  41 #define PN544_HCI_I2C_LLC_MIN_SIZE      (1 + PN544_HCI_I2C_LLC_LEN_CRC)
  42 #define PN544_HCI_I2C_LLC_MAX_PAYLOAD   29
  43 #define PN544_HCI_I2C_LLC_MAX_SIZE      (PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
  44                                          PN544_HCI_I2C_LLC_MAX_PAYLOAD)
  45
  46 static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
  47         {"pn544", 0},
  48         {}
  49 };
  50
  51 MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
  52
  53 static const struct acpi_device_id pn544_hci_i2c_acpi_match[] = {
  54         {"NXP5440", 0},
  55         {}
  56 };
  57
  58 MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
  59
  60 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
  61
  62 /*
  63  * Exposed through the 4 most significant bytes
  64  * from the HCI SW_VERSION first byte, a.k.a.
  65  * SW RomLib.
  66  */
  67 #define PN544_HW_VARIANT_C2 0xa
  68 #define PN544_HW_VARIANT_C3 0xb
  69
  70 #define PN544_FW_CMD_RESET 0x01
  71 #define PN544_FW_CMD_WRITE 0x08
  72 #define PN544_FW_CMD_CHECK 0x06
  73 #define PN544_FW_CMD_SECURE_WRITE 0x0C
  74 #define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
  75
  76 struct pn544_i2c_fw_frame_write {
  77         u8 cmd;
  78         u16 be_length;
  79         u8 be_dest_addr[3];
  80         u16 be_datalen;
  81         u8 data[];
  82 } __packed;
  83
  84 struct pn544_i2c_fw_frame_check {
  85         u8 cmd;
  86         u16 be_length;
  87         u8 be_start_addr[3];
  88         u16 be_datalen;
  89         u16 be_crc;
  90 } __packed;
  91
  92 struct pn544_i2c_fw_frame_response {
  93         u8 status;
  94         u16 be_length;
  95 } __packed;
  96
  97 struct pn544_i2c_fw_blob {
  98         u32 be_size;
  99         u32 be_destaddr;
 100         u8 data[];
 101 };
 102
 103 struct pn544_i2c_fw_secure_frame {
 104         u8 cmd;
 105         u16 be_datalen;
 106         u8 data[];
 107 } __packed;
 108
 109 struct pn544_i2c_fw_secure_blob {
 110         u64 header;
 111         u8 data[];
 112 };
 113
 114 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
 115 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
 116 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
 117 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
 118 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
 119 #define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
 120 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
 121 #define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
 122 #define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
 123 #define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
 124 #define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
 125 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
 126 #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
 127 #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
 128
 129 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
 130
 131 #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
 132 #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
 133 #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
 134 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
 135                                          PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
 136                                          PN544_FW_WRITE_BUFFER_MAX_LEN)
 137 #define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
 138 #define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
 139                         PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
 140 #define PN544_FW_SECURE_FRAME_HEADER_LEN 3
 141 #define PN544_FW_SECURE_BLOB_HEADER_LEN 8
 142
 143 #define FW_WORK_STATE_IDLE 1
 144 #define FW_WORK_STATE_START 2
 145 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
 146 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
 147 #define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
 148
 149 struct pn544_i2c_phy {
 150         struct i2c_client *i2c_dev;
 151         struct nfc_hci_dev *hdev;
 152
 153         struct gpio_desc *gpiod_en;
 154         struct gpio_desc *gpiod_fw;
 155
 156         unsigned int en_polarity;
 157
 158         u8 hw_variant;
 159
 160         struct work_struct fw_work;
 161         int fw_work_state;
 162         char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
 163         const struct firmware *fw;
 164         u32 fw_blob_dest_addr;
 165         size_t fw_blob_size;
 166         const u8 *fw_blob_data;
 167         size_t fw_written;
 168         size_t fw_size;
 169
 170         int fw_cmd_result;
 171
 172         int powered;
 173         int run_mode;
 174
 175         int hard_fault;         /*
 176                                  * < 0 if hardware error occured (e.g. i2c err)
 177                                  * and prevents normal operation.
 178                                  */
 179 };
 180
 181 #define I2C_DUMP_SKB(info, skb)                                 \
 182 do {                                                            \
 183         pr_debug("%s:\n", info);                                \
 184         print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
 185                        16, 1, (skb)->data, (skb)->len, 0);      \
 186 } while (0)
 187
 188 static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
 189 {
 190         int polarity, retry, ret;
 191         char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
 192         int count = sizeof(rset_cmd);
 193
 194         nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
 195
 196         /* Disable fw download */
 197         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 198
 199         for (polarity = 0; polarity < 2; polarity++) {
 200                 phy->en_polarity = polarity;
 201                 retry = 3;
 202                 while (retry--) {
 203                         /* power off */
 204                         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 205                         usleep_range(10000, 15000);
 206
 207                         /* power on */
 208                         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 209                         usleep_range(10000, 15000);
 210
 211                         /* send reset */
 212                         dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
 213                         ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
 214                         if (ret == count) {
 215                                 nfc_info(&phy->i2c_dev->dev,
 216                                          "nfc_en polarity : active %s\n",
 217                                          (polarity == 0 ? "low" : "high"));
 218                                 goto out;
 219                         }
 220                 }
 221         }
 222
 223         nfc_err(&phy->i2c_dev->dev,
 224                 "Could not detect nfc_en polarity, fallback to active high\n");
 225
 226 out:
 227         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 228         usleep_range(10000, 15000);
 229 }
 230
 231 static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
 232 {
 233         gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
 234         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 235         usleep_range(10000, 15000);
 236
 237         phy->run_mode = run_mode;
 238 }
 239
 240 static int pn544_hci_i2c_enable(void *phy_id)
 241 {
 242         struct pn544_i2c_phy *phy = phy_id;
 243
 244         pr_info("%s\n", __func__);
 245
 246         pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
 247
 248         phy->powered = 1;
 249
 250         return 0;
 251 }
 252
 253 static void pn544_hci_i2c_disable(void *phy_id)
 254 {
 255         struct pn544_i2c_phy *phy = phy_id;
 256
 257         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 258         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 259         usleep_range(10000, 15000);
 260
 261         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 262         usleep_range(10000, 15000);
 263
 264         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 265         usleep_range(10000, 15000);
 266
 267         phy->powered = 0;
 268 }
 269
 270 static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
 271 {
 272         u16 crc;
 273         int len;
 274
 275         len = skb->len + 2;
 276         *(u8 *)skb_push(skb, 1) = len;
 277
 278         crc = crc_ccitt(0xffff, skb->data, skb->len);
 279         crc = ~crc;
 280         skb_put_u8(skb, crc & 0xff);
 281         skb_put_u8(skb, crc >> 8);
 282 }
 283
 284 static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
 285 {
 286         skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
 287         skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
 288 }
 289
 290 /*
 291  * Writing a frame must not return the number of written bytes.
 292  * It must return either zero for success, or <0 for error.
 293  * In addition, it must not alter the skb
 294  */
 295 static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
 296 {
 297         int r;
 298         struct pn544_i2c_phy *phy = phy_id;
 299         struct i2c_client *client = phy->i2c_dev;
 300
 301         if (phy->hard_fault != 0)
 302                 return phy->hard_fault;
 303
 304         usleep_range(3000, 6000);
 305
 306         pn544_hci_i2c_add_len_crc(skb);
 307
 308         I2C_DUMP_SKB("i2c frame written", skb);
 309
 310         r = i2c_master_send(client, skb->data, skb->len);
 311
 312         if (r == -EREMOTEIO) {  /* Retry, chip was in standby */
 313                 usleep_range(6000, 10000);
 314                 r = i2c_master_send(client, skb->data, skb->len);
 315         }
 316
 317         if (r >= 0) {
 318                 if (r != skb->len)
 319                         r = -EREMOTEIO;
 320                 else
 321                         r = 0;
 322         }
 323
 324         pn544_hci_i2c_remove_len_crc(skb);
 325
 326         return r;
 327 }
 328
 329 static int check_crc(u8 *buf, int buflen)
 330 {
 331         int len;
 332         u16 crc;
 333
 334         len = buf[0] + 1;
 335         crc = crc_ccitt(0xffff, buf, len - 2);
 336         crc = ~crc;
 337
 338         if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
 339                 pr_err("CRC error 0x%x != 0x%x 0x%x\n",
 340                        crc, buf[len - 1], buf[len - 2]);
 341                 pr_info("%s: BAD CRC\n", __func__);
 342                 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
 343                                16, 2, buf, buflen, false);
 344                 return -EPERM;
 345         }
 346         return 0;
 347 }
 348
 349 /*
 350  * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
 351  * that i2c bus will be flushed and that next read will start on a new frame.
 352  * returned skb contains only LLC header and payload.
 353  * returns:
 354  * -EREMOTEIO : i2c read error (fatal)
 355  * -EBADMSG : frame was incorrect and discarded
 356  * -ENOMEM : cannot allocate skb, frame dropped
 357  */
 358 static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
 359 {
 360         int r;
 361         u8 len;
 362         u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
 363         struct i2c_client *client = phy->i2c_dev;
 364
 365         r = i2c_master_recv(client, &len, 1);
 366         if (r != 1) {
 367                 nfc_err(&client->dev, "cannot read len byte\n");
 368                 return -EREMOTEIO;
 369         }
 370
 371         if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
 372             (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
 373                 nfc_err(&client->dev, "invalid len byte\n");
 374                 r = -EBADMSG;
 375                 goto flush;
 376         }
 377
 378         *skb = alloc_skb(1 + len, GFP_KERNEL);
 379         if (*skb == NULL) {
 380                 r = -ENOMEM;
 381                 goto flush;
 382         }
 383
 384         skb_put_u8(*skb, len);
 385
 386         r = i2c_master_recv(client, skb_put(*skb, len), len);
 387         if (r != len) {
 388                 kfree_skb(*skb);
 389                 return -EREMOTEIO;
 390         }
 391
 392         I2C_DUMP_SKB("i2c frame read", *skb);
 393
 394         r = check_crc((*skb)->data, (*skb)->len);
 395         if (r != 0) {
 396                 kfree_skb(*skb);
 397                 r = -EBADMSG;
 398                 goto flush;
 399         }
 400
 401         skb_pull(*skb, 1);
 402         skb_trim(*skb, (*skb)->len - 2);
 403
 404         usleep_range(3000, 6000);
 405
 406         return 0;
 407
 408 flush:
 409         if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
 410                 r = -EREMOTEIO;
 411
 412         usleep_range(3000, 6000);
 413
 414         return r;
 415 }
 416
 417 static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
 418 {
 419         int r;
 420         struct pn544_i2c_fw_frame_response response;
 421         struct i2c_client *client = phy->i2c_dev;
 422
 423         r = i2c_master_recv(client, (char *) &response, sizeof(response));
 424         if (r != sizeof(response)) {
 425                 nfc_err(&client->dev, "cannot read fw status\n");
 426                 return -EIO;
 427         }
 428
 429         usleep_range(3000, 6000);
 430
 431         switch (response.status) {
 432         case 0:
 433                 return 0;
 434         case PN544_FW_CMD_RESULT_CHUNK_OK:
 435                 return response.status;
 436         case PN544_FW_CMD_RESULT_TIMEOUT:
 437                 return -ETIMEDOUT;
 438         case PN544_FW_CMD_RESULT_BAD_CRC:
 439                 return -ENODATA;
 440         case PN544_FW_CMD_RESULT_ACCESS_DENIED:
 441                 return -EACCES;
 442         case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
 443                 return -EPROTO;
 444         case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
 445                 return -EINVAL;
 446         case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
 447                 return -ENOTSUPP;
 448         case PN544_FW_CMD_RESULT_INVALID_LENGTH:
 449                 return -EBADMSG;
 450         case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
 451                 return -ENOKEY;
 452         case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
 453                 return -EINVAL;
 454         case PN544_FW_CMD_RESULT_MEMORY_ERROR:
 455                 return -ENOMEM;
 456         case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
 457                 return -EACCES;
 458         case PN544_FW_CMD_RESULT_WRITE_FAILED:
 459         case PN544_FW_CMD_RESULT_CHUNK_ERROR:
 460                 return -EIO;
 461         default:
 462                 return -EIO;
 463         }
 464 }
 465
 466 /*
 467  * Reads an shdlc frame from the chip. This is not as straightforward as it
 468  * seems. There are cases where we could loose the frame start synchronization.
 469  * The frame format is len-data-crc, and corruption can occur anywhere while
 470  * transiting on i2c bus, such that we could read an invalid len.
 471  * In order to recover synchronization with the next frame, we must be sure
 472  * to read the real amount of data without using the len byte. We do this by
 473  * assuming the following:
 474  * - the chip will always present only one single complete frame on the bus
 475  *   before triggering the interrupt
 476  * - the chip will not present a new frame until we have completely read
 477  *   the previous one (or until we have handled the interrupt).
 478  * The tricky case is when we read a corrupted len that is less than the real
 479  * len. We must detect this here in order to determine that we need to flush
 480  * the bus. This is the reason why we check the crc here.
 481  */
 482 static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
 483 {
 484         struct pn544_i2c_phy *phy = phy_id;
 485         struct i2c_client *client;
 486         struct sk_buff *skb = NULL;
 487         int r;
 488
 489         if (!phy || irq != phy->i2c_dev->irq) {
 490                 WARN_ON_ONCE(1);
 491                 return IRQ_NONE;
 492         }
 493
 494         client = phy->i2c_dev;
 495         dev_dbg(&client->dev, "IRQ\n");
 496
 497         if (phy->hard_fault != 0)
 498                 return IRQ_HANDLED;
 499
 500         if (phy->run_mode == PN544_FW_MODE) {
 501                 phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
 502                 schedule_work(&phy->fw_work);
 503         } else {
 504                 r = pn544_hci_i2c_read(phy, &skb);
 505                 if (r == -EREMOTEIO) {
 506                         phy->hard_fault = r;
 507
 508                         nfc_hci_recv_frame(phy->hdev, NULL);
 509
 510                         return IRQ_HANDLED;
 511                 } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
 512                         return IRQ_HANDLED;
 513                 }
 514
 515                 nfc_hci_recv_frame(phy->hdev, skb);
 516         }
 517         return IRQ_HANDLED;
 518 }
 519
 520 static struct nfc_phy_ops i2c_phy_ops = {
 521         .write = pn544_hci_i2c_write,
 522         .enable = pn544_hci_i2c_enable,
 523         .disable = pn544_hci_i2c_disable,
 524 };
 525
 526 static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
 527                                         u8 hw_variant)
 528 {
 529         struct pn544_i2c_phy *phy = phy_id;
 530
 531         pr_info("Starting Firmware Download (%s)\n", firmware_name);
 532
 533         strcpy(phy->firmware_name, firmware_name);
 534
 535         phy->hw_variant = hw_variant;
 536         phy->fw_work_state = FW_WORK_STATE_START;
 537
 538         schedule_work(&phy->fw_work);
 539
 540         return 0;
 541 }
 542
 543 static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
 544                                            int result)
 545 {
 546         pr_info("Firmware Download Complete, result=%d\n", result);
 547
 548         pn544_hci_i2c_disable(phy);
 549
 550         phy->fw_work_state = FW_WORK_STATE_IDLE;
 551
 552         if (phy->fw) {
 553                 release_firmware(phy->fw);
 554                 phy->fw = NULL;
 555         }
 556
 557         nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
 558 }
 559
 560 static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
 561                                       const u8 *data, u16 datalen)
 562 {
 563         u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
 564         struct pn544_i2c_fw_frame_write *framep;
 565         u16 params_len;
 566         int framelen;
 567         int r;
 568
 569         if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
 570                 datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
 571
 572         framep = (struct pn544_i2c_fw_frame_write *) frame;
 573
 574         params_len = sizeof(framep->be_dest_addr) +
 575                      sizeof(framep->be_datalen) + datalen;
 576         framelen = params_len + sizeof(framep->cmd) +
 577                              sizeof(framep->be_length);
 578
 579         framep->cmd = PN544_FW_CMD_WRITE;
 580
 581         put_unaligned_be16(params_len, &framep->be_length);
 582
 583         framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
 584         framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
 585         framep->be_dest_addr[2] = dest_addr & 0xff;
 586
 587         put_unaligned_be16(datalen, &framep->be_datalen);
 588
 589         memcpy(framep->data, data, datalen);
 590
 591         r = i2c_master_send(client, frame, framelen);
 592
 593         if (r == framelen)
 594                 return datalen;
 595         else if (r < 0)
 596                 return r;
 597         else
 598                 return -EIO;
 599 }
 600
 601 static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
 602                                       const u8 *data, u16 datalen)
 603 {
 604         struct pn544_i2c_fw_frame_check frame;
 605         int r;
 606         u16 crc;
 607
 608         /* calculate local crc for the data we want to check */
 609         crc = crc_ccitt(0xffff, data, datalen);
 610
 611         frame.cmd = PN544_FW_CMD_CHECK;
 612
 613         put_unaligned_be16(sizeof(frame.be_start_addr) +
 614                            sizeof(frame.be_datalen) + sizeof(frame.be_crc),
 615                            &frame.be_length);
 616
 617         /* tell the chip the memory region to which our crc applies */
 618         frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
 619         frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
 620         frame.be_start_addr[2] = start_addr & 0xff;
 621
 622         put_unaligned_be16(datalen, &frame.be_datalen);
 623
 624         /*
 625          * and give our local crc. Chip will calculate its own crc for the
 626          * region and compare with ours.
 627          */
 628         put_unaligned_be16(crc, &frame.be_crc);
 629
 630         r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
 631
 632         if (r == sizeof(frame))
 633                 return 0;
 634         else if (r < 0)
 635                 return r;
 636         else
 637                 return -EIO;
 638 }
 639
 640 static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
 641 {
 642         int r;
 643
 644         r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
 645                                        phy->fw_blob_dest_addr + phy->fw_written,
 646                                        phy->fw_blob_data + phy->fw_written,
 647                                        phy->fw_blob_size - phy->fw_written);
 648         if (r < 0)
 649                 return r;
 650
 651         phy->fw_written += r;
 652         phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
 653
 654         return 0;
 655 }
 656
 657 static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
 658                                         const u8 *data, u16 datalen)
 659 {
 660         u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
 661         struct pn544_i2c_fw_secure_frame *chunk;
 662         int chunklen;
 663         int r;
 664
 665         if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
 666                 datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
 667
 668         chunk = (struct pn544_i2c_fw_secure_frame *) buf;
 669
 670         chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
 671
 672         put_unaligned_be16(datalen, &chunk->be_datalen);
 673
 674         memcpy(chunk->data, data, datalen);
 675
 676         chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
 677
 678         r = i2c_master_send(phy->i2c_dev, buf, chunklen);
 679
 680         if (r == chunklen)
 681                 return datalen;
 682         else if (r < 0)
 683                 return r;
 684         else
 685                 return -EIO;
 686
 687 }
 688
 689 static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
 690 {
 691         struct pn544_i2c_fw_secure_frame *framep;
 692         int r;
 693
 694         framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
 695         if (phy->fw_written == 0)
 696                 phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
 697                                 + PN544_FW_SECURE_FRAME_HEADER_LEN;
 698
 699         /* Only secure write command can be chunked*/
 700         if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
 701                         framep->cmd != PN544_FW_CMD_SECURE_WRITE)
 702                 return -EINVAL;
 703
 704         /* The firmware also have other commands, we just send them directly */
 705         if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
 706                 r = i2c_master_send(phy->i2c_dev,
 707                         (const char *) phy->fw_blob_data, phy->fw_blob_size);
 708
 709                 if (r == phy->fw_blob_size)
 710                         goto exit;
 711                 else if (r < 0)
 712                         return r;
 713                 else
 714                         return -EIO;
 715         }
 716
 717         r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
 718                                        phy->fw_blob_data + phy->fw_written,
 719                                        phy->fw_blob_size - phy->fw_written);
 720         if (r < 0)
 721                 return r;
 722
 723 exit:
 724         phy->fw_written += r;
 725         phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
 726
 727         /* SW reset command will not trig any response from PN544 */
 728         if (framep->cmd == PN544_FW_CMD_RESET) {
 729                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 730                 phy->fw_cmd_result = 0;
 731                 schedule_work(&phy->fw_work);
 732         }
 733
 734         return 0;
 735 }
 736
 737 static void pn544_hci_i2c_fw_work(struct work_struct *work)
 738 {
 739         struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
 740                                                 fw_work);
 741         int r;
 742         struct pn544_i2c_fw_blob *blob;
 743         struct pn544_i2c_fw_secure_blob *secure_blob;
 744
 745         switch (phy->fw_work_state) {
 746         case FW_WORK_STATE_START:
 747                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 748
 749                 r = request_firmware(&phy->fw, phy->firmware_name,
 750                                      &phy->i2c_dev->dev);
 751                 if (r < 0)
 752                         goto exit_state_start;
 753
 754                 phy->fw_written = 0;
 755
 756                 switch (phy->hw_variant) {
 757                 case PN544_HW_VARIANT_C2:
 758                         blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
 759                         phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 760                         phy->fw_blob_dest_addr = get_unaligned_be32(
 761                                                         &blob->be_destaddr);
 762                         phy->fw_blob_data = blob->data;
 763
 764                         r = pn544_hci_i2c_fw_write_chunk(phy);
 765                         break;
 766                 case PN544_HW_VARIANT_C3:
 767                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 768                                                                 phy->fw->data;
 769                         phy->fw_blob_data = secure_blob->data;
 770                         phy->fw_size = phy->fw->size;
 771                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 772                         break;
 773                 default:
 774                         r = -ENOTSUPP;
 775                         break;
 776                 }
 777
 778 exit_state_start:
 779                 if (r < 0)
 780                         pn544_hci_i2c_fw_work_complete(phy, r);
 781                 break;
 782
 783         case FW_WORK_STATE_WAIT_WRITE_ANSWER:
 784                 r = phy->fw_cmd_result;
 785                 if (r < 0)
 786                         goto exit_state_wait_write_answer;
 787
 788                 if (phy->fw_written == phy->fw_blob_size) {
 789                         r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
 790                                                        phy->fw_blob_dest_addr,
 791                                                        phy->fw_blob_data,
 792                                                        phy->fw_blob_size);
 793                         if (r < 0)
 794                                 goto exit_state_wait_write_answer;
 795                         phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
 796                         break;
 797                 }
 798
 799                 r = pn544_hci_i2c_fw_write_chunk(phy);
 800
 801 exit_state_wait_write_answer:
 802                 if (r < 0)
 803                         pn544_hci_i2c_fw_work_complete(phy, r);
 804                 break;
 805
 806         case FW_WORK_STATE_WAIT_CHECK_ANSWER:
 807                 r = phy->fw_cmd_result;
 808                 if (r < 0)
 809                         goto exit_state_wait_check_answer;
 810
 811                 blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
 812                        phy->fw_blob_size);
 813                 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 814                 if (phy->fw_blob_size != 0) {
 815                         phy->fw_blob_dest_addr =
 816                                         get_unaligned_be32(&blob->be_destaddr);
 817                         phy->fw_blob_data = blob->data;
 818
 819                         phy->fw_written = 0;
 820                         r = pn544_hci_i2c_fw_write_chunk(phy);
 821                 }
 822
 823 exit_state_wait_check_answer:
 824                 if (r < 0 || phy->fw_blob_size == 0)
 825                         pn544_hci_i2c_fw_work_complete(phy, r);
 826                 break;
 827
 828         case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
 829                 r = phy->fw_cmd_result;
 830                 if (r < 0)
 831                         goto exit_state_wait_secure_write_answer;
 832
 833                 if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
 834                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 835                         goto exit_state_wait_secure_write_answer;
 836                 }
 837
 838                 if (phy->fw_written == phy->fw_blob_size) {
 839                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 840                                 (phy->fw_blob_data + phy->fw_blob_size);
 841                         phy->fw_size -= phy->fw_blob_size +
 842                                 PN544_FW_SECURE_BLOB_HEADER_LEN;
 843                         if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
 844                                         + PN544_FW_SECURE_FRAME_HEADER_LEN) {
 845                                 phy->fw_blob_data = secure_blob->data;
 846
 847                                 phy->fw_written = 0;
 848                                 r = pn544_hci_i2c_fw_secure_write_frame(phy);
 849                         }
 850                 }
 851
 852 exit_state_wait_secure_write_answer:
 853                 if (r < 0 || phy->fw_size == 0)
 854                         pn544_hci_i2c_fw_work_complete(phy, r);
 855                 break;
 856
 857         default:
 858                 break;
 859         }
 860 }
 861
 862 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
 863 static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
 864
 865 static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
 866         { "enable-gpios", &enable_gpios, 1 },
 867         { "firmware-gpios", &firmware_gpios, 1 },
 868         { },
 869 };
 870
 871 static int pn544_hci_i2c_probe(struct i2c_client *client,
 872                                const struct i2c_device_id *id)
 873 {
 874         struct device *dev = &client->dev;
 875         struct pn544_i2c_phy *phy;
 876         int r = 0;
 877
 878         dev_dbg(&client->dev, "%s\n", __func__);
 879         dev_dbg(&client->dev, "IRQ: %d\n", client->irq);
 880
 881         if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 882                 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
 883                 return -ENODEV;
 884         }
 885
 886         phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
 887                            GFP_KERNEL);
 888         if (!phy)
 889                 return -ENOMEM;
 890
 891         INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
 892         phy->fw_work_state = FW_WORK_STATE_IDLE;
 893
 894         phy->i2c_dev = client;
 895         i2c_set_clientdata(client, phy);
 896
 897         r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
 898         if (r)
 899                 dev_dbg(dev, "Unable to add GPIO mapping table\n");
 900
 901         /* Get EN GPIO */
 902         phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
 903         if (IS_ERR(phy->gpiod_en)) {
 904                 nfc_err(dev, "Unable to get EN GPIO\n");
 905                 return PTR_ERR(phy->gpiod_en);
 906         }
 907
 908         /* Get FW GPIO */
 909         phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
 910         if (IS_ERR(phy->gpiod_fw)) {
 911                 nfc_err(dev, "Unable to get FW GPIO\n");
 912                 return PTR_ERR(phy->gpiod_fw);
 913         }
 914
 915         pn544_hci_i2c_platform_init(phy);
 916
 917         r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
 918                                       pn544_hci_i2c_irq_thread_fn,
 919                                       IRQF_TRIGGER_RISING | IRQF_ONESHOT,
 920                                       PN544_HCI_I2C_DRIVER_NAME, phy);
 921         if (r < 0) {
 922                 nfc_err(&client->dev, "Unable to register IRQ handler\n");
 923                 return r;
 924         }
 925
 926         r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
 927                             PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
 928                             PN544_HCI_I2C_LLC_MAX_PAYLOAD,
 929                             pn544_hci_i2c_fw_download, &phy->hdev);
 930         if (r < 0)
 931                 return r;
 932
 933         return 0;
 934 }
 935
 936 static int pn544_hci_i2c_remove(struct i2c_client *client)
 937 {
 938         struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
 939
 940         dev_dbg(&client->dev, "%s\n", __func__);
 941
 942         cancel_work_sync(&phy->fw_work);
 943         if (phy->fw_work_state != FW_WORK_STATE_IDLE)
 944                 pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
 945
 946         pn544_hci_remove(phy->hdev);
 947
 948         if (phy->powered)
 949                 pn544_hci_i2c_disable(phy);
 950
 951         return 0;
 952 }
 953
 954 static const struct of_device_id of_pn544_i2c_match[] = {
 955         { .compatible = "nxp,pn544-i2c", },
 956         {},
 957 };
 958 MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
 959
 960 static struct i2c_driver pn544_hci_i2c_driver = {
 961         .driver = {
 962                    .name = PN544_HCI_I2C_DRIVER_NAME,
 963                    .of_match_table = of_match_ptr(of_pn544_i2c_match),
 964                    .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
 965                   },
 966         .probe = pn544_hci_i2c_probe,
 967         .id_table = pn544_hci_i2c_id_table,
 968         .remove = pn544_hci_i2c_remove,
 969 };
 970
 971 module_i2c_driver(pn544_hci_i2c_driver);
 972
 973 MODULE_LICENSE("GPL");
 974 MODULE_DESCRIPTION(DRIVER_DESC);