1 // SPDX-License-Identifier: GPL-2.0+
4 * Multifunction core driver for Zodiac Inflight Innovations RAVE
5 * Supervisory Processor(SP) MCU that is connected via dedicated UART
8 * Copyright (C) 2017 Zodiac Inflight Innovations
11 #include <linux/atomic.h>
12 #include <linux/crc-ccitt.h>
13 #include <linux/delay.h>
14 #include <linux/export.h>
15 #include <linux/init.h>
16 #include <linux/slab.h>
17 #include <linux/kernel.h>
18 #include <linux/mfd/rave-sp.h>
19 #include <linux/module.h>
21 #include <linux/of_device.h>
22 #include <linux/sched.h>
23 #include <linux/serdev.h>
24 #include <asm/unaligned.h>
27 * UART protocol using following entities:
28 * - message to MCU => ACK response
29 * - event from MCU => event ACK
32 * <STX> <DATA> <CHECKSUM> <ETX>
34 * - STX - is start of transmission character
35 * - ETX - end of transmission
37 * - CHECKSUM - checksum calculated on <DATA>
39 * If <DATA> or <CHECKSUM> contain one of control characters, then it is
40 * escaped using <DLE> control code. Added <DLE> does not participate in
41 * checksum calculation.
43 #define RAVE_SP_STX 0x02
44 #define RAVE_SP_ETX 0x03
45 #define RAVE_SP_DLE 0x10
47 #define RAVE_SP_MAX_DATA_SIZE 64
48 #define RAVE_SP_CHECKSUM_SIZE 2 /* Worst case scenario on RDU2 */
50 * We don't store STX, ETX and unescaped bytes, so Rx is only
53 #define RAVE_SP_RX_BUFFER_SIZE \
54 (RAVE_SP_MAX_DATA_SIZE + RAVE_SP_CHECKSUM_SIZE)
56 #define RAVE_SP_STX_ETX_SIZE 2
58 * For Tx we have to have space for everything, STX, EXT and
59 * potentially stuffed DATA + CSUM data + csum
61 #define RAVE_SP_TX_BUFFER_SIZE \
62 (RAVE_SP_STX_ETX_SIZE + 2 * RAVE_SP_RX_BUFFER_SIZE)
64 #define RAVE_SP_BOOT_SOURCE_GET 0
65 #define RAVE_SP_BOOT_SOURCE_SET 1
67 #define RAVE_SP_RDU2_BOARD_TYPE_RMB 0
68 #define RAVE_SP_RDU2_BOARD_TYPE_DEB 1
70 #define RAVE_SP_BOOT_SOURCE_SD 0
71 #define RAVE_SP_BOOT_SOURCE_EMMC 1
72 #define RAVE_SP_BOOT_SOURCE_NOR 2
75 * enum rave_sp_deframer_state - Possible state for de-framer
77 * @RAVE_SP_EXPECT_SOF: Scanning input for start-of-frame marker
78 * @RAVE_SP_EXPECT_DATA: Got start of frame marker, collecting frame
79 * @RAVE_SP_EXPECT_ESCAPED_DATA: Got escape character, collecting escaped byte
81 enum rave_sp_deframer_state
{
84 RAVE_SP_EXPECT_ESCAPED_DATA
,
88 * struct rave_sp_deframer - Device protocol deframer
90 * @state: Current state of the deframer
91 * @data: Buffer used to collect deframed data
92 * @length: Number of bytes de-framed so far
94 struct rave_sp_deframer
{
95 enum rave_sp_deframer_state state
;
96 unsigned char data
[RAVE_SP_RX_BUFFER_SIZE
];
101 * struct rave_sp_reply - Reply as per RAVE device protocol
103 * @length: Expected reply length
104 * @data: Buffer to store reply payload in
105 * @code: Expected reply code
106 * @ackid: Expected reply ACK ID
107 * @completion: Successful reply reception completion
109 struct rave_sp_reply
{
114 struct completion received
;
118 * struct rave_sp_checksum - Variant specific checksum implementation details
120 * @length: Caculated checksum length
121 * @subroutine: Utilized checksum algorithm implementation
123 struct rave_sp_checksum
{
125 void (*subroutine
)(const u8
*, size_t, u8
*);
129 * struct rave_sp_variant_cmds - Variant specific command routines
131 * @translate: Generic to variant specific command mapping routine
134 struct rave_sp_variant_cmds
{
135 int (*translate
)(enum rave_sp_command
);
139 * struct rave_sp_variant - RAVE supervisory processor core variant
141 * @checksum: Variant specific checksum implementation
142 * @cmd: Variant specific command pointer table
145 struct rave_sp_variant
{
146 const struct rave_sp_checksum
*checksum
;
147 struct rave_sp_variant_cmds cmd
;
151 * struct rave_sp - RAVE supervisory processor core
153 * @serdev: Pointer to underlying serdev
154 * @deframer: Stored state of the protocol deframer
155 * @ackid: ACK ID used in last reply sent to the device
156 * @bus_lock: Lock to serialize access to the device
157 * @reply_lock: Lock protecting @reply
158 * @reply: Pointer to memory to store reply payload
160 * @variant: Device variant specific information
161 * @event_notifier_list: Input event notification chain
165 struct serdev_device
*serdev
;
166 struct rave_sp_deframer deframer
;
168 struct mutex bus_lock
;
169 struct mutex reply_lock
;
170 struct rave_sp_reply
*reply
;
172 const struct rave_sp_variant
*variant
;
173 struct blocking_notifier_head event_notifier_list
;
176 static bool rave_sp_id_is_event(u8 code
)
178 return (code
& 0xF0) == RAVE_SP_EVNT_BASE
;
181 static void rave_sp_unregister_event_notifier(struct device
*dev
, void *res
)
183 struct rave_sp
*sp
= dev_get_drvdata(dev
->parent
);
184 struct notifier_block
*nb
= *(struct notifier_block
**)res
;
185 struct blocking_notifier_head
*bnh
= &sp
->event_notifier_list
;
187 WARN_ON(blocking_notifier_chain_unregister(bnh
, nb
));
190 int devm_rave_sp_register_event_notifier(struct device
*dev
,
191 struct notifier_block
*nb
)
193 struct rave_sp
*sp
= dev_get_drvdata(dev
->parent
);
194 struct notifier_block
**rcnb
;
197 rcnb
= devres_alloc(rave_sp_unregister_event_notifier
,
198 sizeof(*rcnb
), GFP_KERNEL
);
202 ret
= blocking_notifier_chain_register(&sp
->event_notifier_list
, nb
);
205 devres_add(dev
, rcnb
);
212 EXPORT_SYMBOL_GPL(devm_rave_sp_register_event_notifier
);
214 static void csum_8b2c(const u8
*buf
, size_t size
, u8
*crc
)
225 static void csum_ccitt(const u8
*buf
, size_t size
, u8
*crc
)
227 const u16 calculated
= crc_ccitt_false(0xffff, buf
, size
);
230 * While the rest of the wire protocol is little-endian,
231 * CCITT-16 CRC in RDU2 device is sent out in big-endian order.
233 put_unaligned_be16(calculated
, crc
);
236 static void *stuff(unsigned char *dest
, const unsigned char *src
, size_t n
)
239 const unsigned char byte
= *src
++;
245 *dest
++ = RAVE_SP_DLE
;
255 static int rave_sp_write(struct rave_sp
*sp
, const u8
*data
, u8 data_size
)
257 const size_t checksum_length
= sp
->variant
->checksum
->length
;
258 unsigned char frame
[RAVE_SP_TX_BUFFER_SIZE
];
259 unsigned char crc
[RAVE_SP_CHECKSUM_SIZE
];
260 unsigned char *dest
= frame
;
263 if (WARN_ON(checksum_length
> sizeof(crc
)))
266 if (WARN_ON(data_size
> sizeof(frame
)))
269 sp
->variant
->checksum
->subroutine(data
, data_size
, crc
);
271 *dest
++ = RAVE_SP_STX
;
272 dest
= stuff(dest
, data
, data_size
);
273 dest
= stuff(dest
, crc
, checksum_length
);
274 *dest
++ = RAVE_SP_ETX
;
276 length
= dest
- frame
;
278 print_hex_dump(KERN_DEBUG
, "rave-sp tx: ", DUMP_PREFIX_NONE
,
279 16, 1, frame
, length
, false);
281 return serdev_device_write(sp
->serdev
, frame
, length
, HZ
);
284 static u8
rave_sp_reply_code(u8 command
)
287 * There isn't a single rule that describes command code ->
288 * ACK code transformation, but, going through various
289 * versions of ICDs, there appear to be three distinct groups
290 * that can be described by simple transformation.
295 * Commands implemented by firmware found in RDU1 and
296 * older devices all seem to obey the following rule
298 return command
+ 0x20;
301 * Events emitted by all versions of the firmare use
302 * least significant bit to get an ACK code
304 return command
| 0x01;
307 * Commands implemented by firmware found in RDU2 are
308 * similar to "old" commands, but they use slightly
311 return command
+ 0x40;
315 int rave_sp_exec(struct rave_sp
*sp
,
316 void *__data
, size_t data_size
,
317 void *reply_data
, size_t reply_data_size
)
319 struct rave_sp_reply reply
= {
321 .length
= reply_data_size
,
322 .received
= COMPLETION_INITIALIZER_ONSTACK(reply
.received
),
324 unsigned char *data
= __data
;
325 int command
, ret
= 0;
328 command
= sp
->variant
->cmd
.translate(data
[0]);
332 ackid
= atomic_inc_return(&sp
->ackid
);
334 reply
.code
= rave_sp_reply_code((u8
)command
),
336 mutex_lock(&sp
->bus_lock
);
338 mutex_lock(&sp
->reply_lock
);
340 mutex_unlock(&sp
->reply_lock
);
345 rave_sp_write(sp
, data
, data_size
);
347 if (!wait_for_completion_timeout(&reply
.received
, HZ
)) {
348 dev_err(&sp
->serdev
->dev
, "Command timeout\n");
351 mutex_lock(&sp
->reply_lock
);
353 mutex_unlock(&sp
->reply_lock
);
356 mutex_unlock(&sp
->bus_lock
);
359 EXPORT_SYMBOL_GPL(rave_sp_exec
);
361 static void rave_sp_receive_event(struct rave_sp
*sp
,
362 const unsigned char *data
, size_t length
)
365 [0] = rave_sp_reply_code(data
[0]),
369 rave_sp_write(sp
, cmd
, sizeof(cmd
));
371 blocking_notifier_call_chain(&sp
->event_notifier_list
,
372 rave_sp_action_pack(data
[0], data
[2]),
376 static void rave_sp_receive_reply(struct rave_sp
*sp
,
377 const unsigned char *data
, size_t length
)
379 struct device
*dev
= &sp
->serdev
->dev
;
380 struct rave_sp_reply
*reply
;
381 const size_t payload_length
= length
- 2;
383 mutex_lock(&sp
->reply_lock
);
387 if (reply
->code
== data
[0] && reply
->ackid
== data
[1] &&
388 payload_length
>= reply
->length
) {
390 * We are relying on memcpy(dst, src, 0) to be a no-op
391 * when handling commands that have a no-payload reply
393 memcpy(reply
->data
, &data
[2], reply
->length
);
394 complete(&reply
->received
);
397 dev_err(dev
, "Ignoring incorrect reply\n");
398 dev_dbg(dev
, "Code: expected = 0x%08x received = 0x%08x\n",
399 reply
->code
, data
[0]);
400 dev_dbg(dev
, "ACK ID: expected = 0x%08x received = 0x%08x\n",
401 reply
->ackid
, data
[1]);
402 dev_dbg(dev
, "Length: expected = %zu received = %zu\n",
403 reply
->length
, payload_length
);
407 mutex_unlock(&sp
->reply_lock
);
410 static void rave_sp_receive_frame(struct rave_sp
*sp
,
411 const unsigned char *data
,
414 const size_t checksum_length
= sp
->variant
->checksum
->length
;
415 const size_t payload_length
= length
- checksum_length
;
416 const u8
*crc_reported
= &data
[payload_length
];
417 struct device
*dev
= &sp
->serdev
->dev
;
418 u8 crc_calculated
[checksum_length
];
420 print_hex_dump(KERN_DEBUG
, "rave-sp rx: ", DUMP_PREFIX_NONE
,
421 16, 1, data
, length
, false);
423 if (unlikely(length
<= checksum_length
)) {
424 dev_warn(dev
, "Dropping short frame\n");
428 sp
->variant
->checksum
->subroutine(data
, payload_length
,
431 if (memcmp(crc_calculated
, crc_reported
, checksum_length
)) {
432 dev_warn(dev
, "Dropping bad frame\n");
436 if (rave_sp_id_is_event(data
[0]))
437 rave_sp_receive_event(sp
, data
, length
);
439 rave_sp_receive_reply(sp
, data
, length
);
442 static int rave_sp_receive_buf(struct serdev_device
*serdev
,
443 const unsigned char *buf
, size_t size
)
445 struct device
*dev
= &serdev
->dev
;
446 struct rave_sp
*sp
= dev_get_drvdata(dev
);
447 struct rave_sp_deframer
*deframer
= &sp
->deframer
;
448 const unsigned char *src
= buf
;
449 const unsigned char *end
= buf
+ size
;
452 const unsigned char byte
= *src
++;
454 switch (deframer
->state
) {
455 case RAVE_SP_EXPECT_SOF
:
456 if (byte
== RAVE_SP_STX
)
457 deframer
->state
= RAVE_SP_EXPECT_DATA
;
460 case RAVE_SP_EXPECT_DATA
:
462 * Treat special byte values first
466 rave_sp_receive_frame(sp
,
470 * Once we extracted a complete frame
471 * out of a stream, we call it done
472 * and proceed to bailing out while
473 * resetting the framer to initial
474 * state, regardless if we've consumed
475 * all of the stream or not.
479 dev_warn(dev
, "Bad frame: STX before ETX\n");
481 * If we encounter second "start of
482 * the frame" marker before seeing
483 * corresponding "end of frame", we
484 * reset the framer and ignore both:
485 * frame started by first SOF and
486 * frame started by current SOF.
488 * NOTE: The above means that only the
489 * frame started by third SOF, sent
490 * after this one will have a chance
495 deframer
->state
= RAVE_SP_EXPECT_ESCAPED_DATA
;
497 * If we encounter escape sequence we
498 * need to skip it and collect the
499 * byte that follows. We do it by
500 * forcing the next iteration of the
501 * encompassing while loop.
506 * For the rest of the bytes, that are not
507 * speical snoflakes, we do the same thing
508 * that we do to escaped data - collect it in
514 case RAVE_SP_EXPECT_ESCAPED_DATA
:
515 deframer
->data
[deframer
->length
++] = byte
;
517 if (deframer
->length
== sizeof(deframer
->data
)) {
518 dev_warn(dev
, "Bad frame: Too long\n");
520 * If the amount of data we've
521 * accumulated for current frame so
522 * far starts to exceed the capacity
523 * of deframer's buffer, there's
524 * nothing else we can do but to
525 * discard that data and start
526 * assemblying a new frame again
532 * We've extracted out special byte, now we
533 * can go back to regular data collecting
535 deframer
->state
= RAVE_SP_EXPECT_DATA
;
541 * The only way to get out of the above loop and end up here
542 * is throught consuming all of the supplied data, so here we
543 * report that we processed it all.
549 * NOTE: A number of codepaths that will drop us here will do
550 * so before consuming all 'size' bytes of the data passed by
551 * serdev layer. We rely on the fact that serdev layer will
552 * re-execute this handler with the remainder of the Rx bytes
553 * once we report actual number of bytes that we processed.
555 deframer
->state
= RAVE_SP_EXPECT_SOF
;
556 deframer
->length
= 0;
561 static int rave_sp_rdu1_cmd_translate(enum rave_sp_command command
)
563 if (command
>= RAVE_SP_CMD_STATUS
&&
564 command
<= RAVE_SP_CMD_CONTROL_EVENTS
)
570 static int rave_sp_rdu2_cmd_translate(enum rave_sp_command command
)
572 if (command
>= RAVE_SP_CMD_GET_FIRMWARE_VERSION
&&
573 command
<= RAVE_SP_CMD_GET_GPIO_STATE
)
576 if (command
== RAVE_SP_CMD_REQ_COPPER_REV
) {
578 * As per RDU2 ICD 3.4.47 CMD_GET_COPPER_REV code is
579 * different from that for RDU1 and it is set to 0x28.
584 return rave_sp_rdu1_cmd_translate(command
);
587 static int rave_sp_default_cmd_translate(enum rave_sp_command command
)
590 * All of the following command codes were taken from "Table :
591 * Communications Protocol Message Types" in section 3.3
592 * "MESSAGE TYPES" of Rave PIC24 ICD.
595 case RAVE_SP_CMD_GET_FIRMWARE_VERSION
:
597 case RAVE_SP_CMD_GET_BOOTLOADER_VERSION
:
599 case RAVE_SP_CMD_BOOT_SOURCE
:
601 case RAVE_SP_CMD_SW_WDT
:
603 case RAVE_SP_CMD_RESET
:
605 case RAVE_SP_CMD_RESET_REASON
:
612 static const struct rave_sp_checksum rave_sp_checksum_8b2c
= {
614 .subroutine
= csum_8b2c
,
617 static const struct rave_sp_checksum rave_sp_checksum_ccitt
= {
619 .subroutine
= csum_ccitt
,
622 static const struct rave_sp_variant rave_sp_legacy
= {
623 .checksum
= &rave_sp_checksum_8b2c
,
625 .translate
= rave_sp_default_cmd_translate
,
629 static const struct rave_sp_variant rave_sp_rdu1
= {
630 .checksum
= &rave_sp_checksum_8b2c
,
632 .translate
= rave_sp_rdu1_cmd_translate
,
636 static const struct rave_sp_variant rave_sp_rdu2
= {
637 .checksum
= &rave_sp_checksum_ccitt
,
639 .translate
= rave_sp_rdu2_cmd_translate
,
643 static const struct of_device_id rave_sp_dt_ids
[] = {
644 { .compatible
= "zii,rave-sp-niu", .data
= &rave_sp_legacy
},
645 { .compatible
= "zii,rave-sp-mezz", .data
= &rave_sp_legacy
},
646 { .compatible
= "zii,rave-sp-esb", .data
= &rave_sp_legacy
},
647 { .compatible
= "zii,rave-sp-rdu1", .data
= &rave_sp_rdu1
},
648 { .compatible
= "zii,rave-sp-rdu2", .data
= &rave_sp_rdu2
},
652 static const struct serdev_device_ops rave_sp_serdev_device_ops
= {
653 .receive_buf
= rave_sp_receive_buf
,
654 .write_wakeup
= serdev_device_write_wakeup
,
657 static int rave_sp_probe(struct serdev_device
*serdev
)
659 struct device
*dev
= &serdev
->dev
;
664 if (of_property_read_u32(dev
->of_node
, "current-speed", &baud
)) {
666 "'current-speed' is not specified in device node\n");
670 sp
= devm_kzalloc(dev
, sizeof(*sp
), GFP_KERNEL
);
675 dev_set_drvdata(dev
, sp
);
677 sp
->variant
= of_device_get_match_data(dev
);
681 mutex_init(&sp
->bus_lock
);
682 mutex_init(&sp
->reply_lock
);
683 BLOCKING_INIT_NOTIFIER_HEAD(&sp
->event_notifier_list
);
685 serdev_device_set_client_ops(serdev
, &rave_sp_serdev_device_ops
);
686 ret
= devm_serdev_device_open(dev
, serdev
);
690 serdev_device_set_baudrate(serdev
, baud
);
692 return devm_of_platform_populate(dev
);
695 MODULE_DEVICE_TABLE(of
, rave_sp_dt_ids
);
697 static struct serdev_device_driver rave_sp_drv
= {
698 .probe
= rave_sp_probe
,
701 .of_match_table
= rave_sp_dt_ids
,
704 module_serdev_device_driver(rave_sp_drv
);
706 MODULE_LICENSE("GPL");
707 MODULE_AUTHOR("Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>");
708 MODULE_AUTHOR("Nikita Yushchenko <nikita.yoush@cogentembedded.com>");
709 MODULE_AUTHOR("Andrey Smirnov <andrew.smirnov@gmail.com>");
710 MODULE_DESCRIPTION("RAVE SP core driver");