drivers/nfc/pn544/i2c.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * I2C Link Layer for PN544 HCI based Driver
   4  *
   5  * Copyright (C) 2012  Intel Corporation. All rights reserved.
   6  */
   7
   8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10 #include <linux/crc-ccitt.h>
  11 #include <linux/module.h>
  12 #include <linux/i2c.h>
  13 #include <linux/acpi.h>
  14 #include <linux/interrupt.h>
  15 #include <linux/delay.h>
  16 #include <linux/nfc.h>
  17 #include <linux/firmware.h>
  18 #include <linux/gpio/consumer.h>
  19
  20 #include <asm/unaligned.h>
  21
  22 #include <net/nfc/hci.h>
  23 #include <net/nfc/llc.h>
  24 #include <net/nfc/nfc.h>
  25
  26 #include "pn544.h"
  27
  28 #define PN544_I2C_FRAME_HEADROOM 1
  29 #define PN544_I2C_FRAME_TAILROOM 2
  30
  31 /* GPIO names */
  32 #define PN544_GPIO_NAME_IRQ "pn544_irq"
  33 #define PN544_GPIO_NAME_FW  "pn544_fw"
  34 #define PN544_GPIO_NAME_EN  "pn544_en"
  35
  36 /* framing in HCI mode */
  37 #define PN544_HCI_I2C_LLC_LEN           1
  38 #define PN544_HCI_I2C_LLC_CRC           2
  39 #define PN544_HCI_I2C_LLC_LEN_CRC       (PN544_HCI_I2C_LLC_LEN + \
  40                                          PN544_HCI_I2C_LLC_CRC)
  41 #define PN544_HCI_I2C_LLC_MIN_SIZE      (1 + PN544_HCI_I2C_LLC_LEN_CRC)
  42 #define PN544_HCI_I2C_LLC_MAX_PAYLOAD   29
  43 #define PN544_HCI_I2C_LLC_MAX_SIZE      (PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
  44                                          PN544_HCI_I2C_LLC_MAX_PAYLOAD)
  45
  46 static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
  47         {"pn544", 0},
  48         {}
  49 };
  50
  51 MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
  52
  53 static const struct acpi_device_id pn544_hci_i2c_acpi_match[] __maybe_unused = {
  54         {"NXP5440", 0},
  55         {}
  56 };
  57
  58 MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
  59
  60 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
  61
  62 /*
  63  * Exposed through the 4 most significant bytes
  64  * from the HCI SW_VERSION first byte, a.k.a.
  65  * SW RomLib.
  66  */
  67 #define PN544_HW_VARIANT_C2 0xa
  68 #define PN544_HW_VARIANT_C3 0xb
  69
  70 #define PN544_FW_CMD_RESET 0x01
  71 #define PN544_FW_CMD_WRITE 0x08
  72 #define PN544_FW_CMD_CHECK 0x06
  73 #define PN544_FW_CMD_SECURE_WRITE 0x0C
  74 #define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
  75
  76 struct pn544_i2c_fw_frame_write {
  77         u8 cmd;
  78         u16 be_length;
  79         u8 be_dest_addr[3];
  80         u16 be_datalen;
  81         u8 data[];
  82 } __packed;
  83
  84 struct pn544_i2c_fw_frame_check {
  85         u8 cmd;
  86         u16 be_length;
  87         u8 be_start_addr[3];
  88         u16 be_datalen;
  89         u16 be_crc;
  90 } __packed;
  91
  92 struct pn544_i2c_fw_frame_response {
  93         u8 status;
  94         u16 be_length;
  95 } __packed;
  96
  97 struct pn544_i2c_fw_blob {
  98         u32 be_size;
  99         u32 be_destaddr;
 100         u8 data[];
 101 };
 102
 103 struct pn544_i2c_fw_secure_frame {
 104         u8 cmd;
 105         u16 be_datalen;
 106         u8 data[];
 107 } __packed;
 108
 109 struct pn544_i2c_fw_secure_blob {
 110         u64 header;
 111         u8 data[];
 112 };
 113
 114 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
 115 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
 116 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
 117 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
 118 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
 119 #define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
 120 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
 121 #define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
 122 #define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
 123 #define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
 124 #define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
 125 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
 126 #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
 127 #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
 128
 129 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
 130
 131 #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
 132 #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
 133 #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
 134 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
 135                                          PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
 136                                          PN544_FW_WRITE_BUFFER_MAX_LEN)
 137 #define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
 138 #define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
 139                         PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
 140 #define PN544_FW_SECURE_FRAME_HEADER_LEN 3
 141 #define PN544_FW_SECURE_BLOB_HEADER_LEN 8
 142
 143 #define FW_WORK_STATE_IDLE 1
 144 #define FW_WORK_STATE_START 2
 145 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
 146 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
 147 #define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
 148
 149 struct pn544_i2c_phy {
 150         struct i2c_client *i2c_dev;
 151         struct nfc_hci_dev *hdev;
 152
 153         struct gpio_desc *gpiod_en;
 154         struct gpio_desc *gpiod_fw;
 155
 156         unsigned int en_polarity;
 157
 158         u8 hw_variant;
 159
 160         struct work_struct fw_work;
 161         int fw_work_state;
 162         char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
 163         const struct firmware *fw;
 164         u32 fw_blob_dest_addr;
 165         size_t fw_blob_size;
 166         const u8 *fw_blob_data;
 167         size_t fw_written;
 168         size_t fw_size;
 169
 170         int fw_cmd_result;
 171
 172         int powered;
 173         int run_mode;
 174
 175         int hard_fault;         /*
 176                                  * < 0 if hardware error occured (e.g. i2c err)
 177                                  * and prevents normal operation.
 178                                  */
 179 };
 180
 181 #define I2C_DUMP_SKB(info, skb)                                 \
 182 do {                                                            \
 183         pr_debug("%s:\n", info);                                \
 184         print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
 185                        16, 1, (skb)->data, (skb)->len, 0);      \
 186 } while (0)
 187
 188 static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
 189 {
 190         int polarity, retry, ret;
 191         static const char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
 192         int count = sizeof(rset_cmd);
 193
 194         nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
 195
 196         /* Disable fw download */
 197         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 198
 199         for (polarity = 0; polarity < 2; polarity++) {
 200                 phy->en_polarity = polarity;
 201                 retry = 3;
 202                 while (retry--) {
 203                         /* power off */
 204                         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 205                         usleep_range(10000, 15000);
 206
 207                         /* power on */
 208                         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 209                         usleep_range(10000, 15000);
 210
 211                         /* send reset */
 212                         dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
 213                         ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
 214                         if (ret == count) {
 215                                 nfc_info(&phy->i2c_dev->dev,
 216                                          "nfc_en polarity : active %s\n",
 217                                          (polarity == 0 ? "low" : "high"));
 218                                 goto out;
 219                         }
 220                 }
 221         }
 222
 223         nfc_err(&phy->i2c_dev->dev,
 224                 "Could not detect nfc_en polarity, fallback to active high\n");
 225
 226 out:
 227         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 228         usleep_range(10000, 15000);
 229 }
 230
 231 static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
 232 {
 233         gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
 234         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 235         usleep_range(10000, 15000);
 236
 237         phy->run_mode = run_mode;
 238 }
 239
 240 static int pn544_hci_i2c_enable(void *phy_id)
 241 {
 242         struct pn544_i2c_phy *phy = phy_id;
 243
 244         pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
 245
 246         phy->powered = 1;
 247
 248         return 0;
 249 }
 250
 251 static void pn544_hci_i2c_disable(void *phy_id)
 252 {
 253         struct pn544_i2c_phy *phy = phy_id;
 254
 255         gpiod_set_value_cansleep(phy->gpiod_fw, 0);
 256         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 257         usleep_range(10000, 15000);
 258
 259         gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
 260         usleep_range(10000, 15000);
 261
 262         gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
 263         usleep_range(10000, 15000);
 264
 265         phy->powered = 0;
 266 }
 267
 268 static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
 269 {
 270         u16 crc;
 271         int len;
 272
 273         len = skb->len + 2;
 274         *(u8 *)skb_push(skb, 1) = len;
 275
 276         crc = crc_ccitt(0xffff, skb->data, skb->len);
 277         crc = ~crc;
 278         skb_put_u8(skb, crc & 0xff);
 279         skb_put_u8(skb, crc >> 8);
 280 }
 281
 282 static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
 283 {
 284         skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
 285         skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
 286 }
 287
 288 /*
 289  * Writing a frame must not return the number of written bytes.
 290  * It must return either zero for success, or <0 for error.
 291  * In addition, it must not alter the skb
 292  */
 293 static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
 294 {
 295         int r;
 296         struct pn544_i2c_phy *phy = phy_id;
 297         struct i2c_client *client = phy->i2c_dev;
 298
 299         if (phy->hard_fault != 0)
 300                 return phy->hard_fault;
 301
 302         usleep_range(3000, 6000);
 303
 304         pn544_hci_i2c_add_len_crc(skb);
 305
 306         I2C_DUMP_SKB("i2c frame written", skb);
 307
 308         r = i2c_master_send(client, skb->data, skb->len);
 309
 310         if (r == -EREMOTEIO) {  /* Retry, chip was in standby */
 311                 usleep_range(6000, 10000);
 312                 r = i2c_master_send(client, skb->data, skb->len);
 313         }
 314
 315         if (r >= 0) {
 316                 if (r != skb->len)
 317                         r = -EREMOTEIO;
 318                 else
 319                         r = 0;
 320         }
 321
 322         pn544_hci_i2c_remove_len_crc(skb);
 323
 324         return r;
 325 }
 326
 327 static int check_crc(u8 *buf, int buflen)
 328 {
 329         int len;
 330         u16 crc;
 331
 332         len = buf[0] + 1;
 333         crc = crc_ccitt(0xffff, buf, len - 2);
 334         crc = ~crc;
 335
 336         if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
 337                 pr_err("CRC error 0x%x != 0x%x 0x%x\n",
 338                        crc, buf[len - 1], buf[len - 2]);
 339                 pr_info("%s: BAD CRC\n", __func__);
 340                 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
 341                                16, 2, buf, buflen, false);
 342                 return -EPERM;
 343         }
 344         return 0;
 345 }
 346
 347 /*
 348  * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
 349  * that i2c bus will be flushed and that next read will start on a new frame.
 350  * returned skb contains only LLC header and payload.
 351  * returns:
 352  * -EREMOTEIO : i2c read error (fatal)
 353  * -EBADMSG : frame was incorrect and discarded
 354  * -ENOMEM : cannot allocate skb, frame dropped
 355  */
 356 static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
 357 {
 358         int r;
 359         u8 len;
 360         u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
 361         struct i2c_client *client = phy->i2c_dev;
 362
 363         r = i2c_master_recv(client, &len, 1);
 364         if (r != 1) {
 365                 nfc_err(&client->dev, "cannot read len byte\n");
 366                 return -EREMOTEIO;
 367         }
 368
 369         if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
 370             (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
 371                 nfc_err(&client->dev, "invalid len byte\n");
 372                 r = -EBADMSG;
 373                 goto flush;
 374         }
 375
 376         *skb = alloc_skb(1 + len, GFP_KERNEL);
 377         if (*skb == NULL) {
 378                 r = -ENOMEM;
 379                 goto flush;
 380         }
 381
 382         skb_put_u8(*skb, len);
 383
 384         r = i2c_master_recv(client, skb_put(*skb, len), len);
 385         if (r != len) {
 386                 kfree_skb(*skb);
 387                 return -EREMOTEIO;
 388         }
 389
 390         I2C_DUMP_SKB("i2c frame read", *skb);
 391
 392         r = check_crc((*skb)->data, (*skb)->len);
 393         if (r != 0) {
 394                 kfree_skb(*skb);
 395                 r = -EBADMSG;
 396                 goto flush;
 397         }
 398
 399         skb_pull(*skb, 1);
 400         skb_trim(*skb, (*skb)->len - 2);
 401
 402         usleep_range(3000, 6000);
 403
 404         return 0;
 405
 406 flush:
 407         if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
 408                 r = -EREMOTEIO;
 409
 410         usleep_range(3000, 6000);
 411
 412         return r;
 413 }
 414
 415 static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
 416 {
 417         int r;
 418         struct pn544_i2c_fw_frame_response response;
 419         struct i2c_client *client = phy->i2c_dev;
 420
 421         r = i2c_master_recv(client, (char *) &response, sizeof(response));
 422         if (r != sizeof(response)) {
 423                 nfc_err(&client->dev, "cannot read fw status\n");
 424                 return -EIO;
 425         }
 426
 427         usleep_range(3000, 6000);
 428
 429         switch (response.status) {
 430         case 0:
 431                 return 0;
 432         case PN544_FW_CMD_RESULT_CHUNK_OK:
 433                 return response.status;
 434         case PN544_FW_CMD_RESULT_TIMEOUT:
 435                 return -ETIMEDOUT;
 436         case PN544_FW_CMD_RESULT_BAD_CRC:
 437                 return -ENODATA;
 438         case PN544_FW_CMD_RESULT_ACCESS_DENIED:
 439                 return -EACCES;
 440         case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
 441                 return -EPROTO;
 442         case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
 443                 return -EINVAL;
 444         case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
 445                 return -ENOTSUPP;
 446         case PN544_FW_CMD_RESULT_INVALID_LENGTH:
 447                 return -EBADMSG;
 448         case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
 449                 return -ENOKEY;
 450         case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
 451                 return -EINVAL;
 452         case PN544_FW_CMD_RESULT_MEMORY_ERROR:
 453                 return -ENOMEM;
 454         case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
 455                 return -EACCES;
 456         case PN544_FW_CMD_RESULT_WRITE_FAILED:
 457         case PN544_FW_CMD_RESULT_CHUNK_ERROR:
 458                 return -EIO;
 459         default:
 460                 return -EIO;
 461         }
 462 }
 463
 464 /*
 465  * Reads an shdlc frame from the chip. This is not as straightforward as it
 466  * seems. There are cases where we could loose the frame start synchronization.
 467  * The frame format is len-data-crc, and corruption can occur anywhere while
 468  * transiting on i2c bus, such that we could read an invalid len.
 469  * In order to recover synchronization with the next frame, we must be sure
 470  * to read the real amount of data without using the len byte. We do this by
 471  * assuming the following:
 472  * - the chip will always present only one single complete frame on the bus
 473  *   before triggering the interrupt
 474  * - the chip will not present a new frame until we have completely read
 475  *   the previous one (or until we have handled the interrupt).
 476  * The tricky case is when we read a corrupted len that is less than the real
 477  * len. We must detect this here in order to determine that we need to flush
 478  * the bus. This is the reason why we check the crc here.
 479  */
 480 static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
 481 {
 482         struct pn544_i2c_phy *phy = phy_id;
 483         struct i2c_client *client;
 484         struct sk_buff *skb = NULL;
 485         int r;
 486
 487         if (!phy || irq != phy->i2c_dev->irq) {
 488                 WARN_ON_ONCE(1);
 489                 return IRQ_NONE;
 490         }
 491
 492         client = phy->i2c_dev;
 493         dev_dbg(&client->dev, "IRQ\n");
 494
 495         if (phy->hard_fault != 0)
 496                 return IRQ_HANDLED;
 497
 498         if (phy->run_mode == PN544_FW_MODE) {
 499                 phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
 500                 schedule_work(&phy->fw_work);
 501         } else {
 502                 r = pn544_hci_i2c_read(phy, &skb);
 503                 if (r == -EREMOTEIO) {
 504                         phy->hard_fault = r;
 505
 506                         nfc_hci_recv_frame(phy->hdev, NULL);
 507
 508                         return IRQ_HANDLED;
 509                 } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
 510                         return IRQ_HANDLED;
 511                 }
 512
 513                 nfc_hci_recv_frame(phy->hdev, skb);
 514         }
 515         return IRQ_HANDLED;
 516 }
 517
 518 static const struct nfc_phy_ops i2c_phy_ops = {
 519         .write = pn544_hci_i2c_write,
 520         .enable = pn544_hci_i2c_enable,
 521         .disable = pn544_hci_i2c_disable,
 522 };
 523
 524 static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
 525                                         u8 hw_variant)
 526 {
 527         struct pn544_i2c_phy *phy = phy_id;
 528
 529         pr_info("Starting Firmware Download (%s)\n", firmware_name);
 530
 531         strcpy(phy->firmware_name, firmware_name);
 532
 533         phy->hw_variant = hw_variant;
 534         phy->fw_work_state = FW_WORK_STATE_START;
 535
 536         schedule_work(&phy->fw_work);
 537
 538         return 0;
 539 }
 540
 541 static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
 542                                            int result)
 543 {
 544         pr_info("Firmware Download Complete, result=%d\n", result);
 545
 546         pn544_hci_i2c_disable(phy);
 547
 548         phy->fw_work_state = FW_WORK_STATE_IDLE;
 549
 550         if (phy->fw) {
 551                 release_firmware(phy->fw);
 552                 phy->fw = NULL;
 553         }
 554
 555         nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
 556 }
 557
 558 static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
 559                                       const u8 *data, u16 datalen)
 560 {
 561         u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
 562         struct pn544_i2c_fw_frame_write *framep;
 563         u16 params_len;
 564         int framelen;
 565         int r;
 566
 567         if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
 568                 datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
 569
 570         framep = (struct pn544_i2c_fw_frame_write *) frame;
 571
 572         params_len = sizeof(framep->be_dest_addr) +
 573                      sizeof(framep->be_datalen) + datalen;
 574         framelen = params_len + sizeof(framep->cmd) +
 575                              sizeof(framep->be_length);
 576
 577         framep->cmd = PN544_FW_CMD_WRITE;
 578
 579         put_unaligned_be16(params_len, &framep->be_length);
 580
 581         framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
 582         framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
 583         framep->be_dest_addr[2] = dest_addr & 0xff;
 584
 585         put_unaligned_be16(datalen, &framep->be_datalen);
 586
 587         memcpy(framep->data, data, datalen);
 588
 589         r = i2c_master_send(client, frame, framelen);
 590
 591         if (r == framelen)
 592                 return datalen;
 593         else if (r < 0)
 594                 return r;
 595         else
 596                 return -EIO;
 597 }
 598
 599 static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
 600                                       const u8 *data, u16 datalen)
 601 {
 602         struct pn544_i2c_fw_frame_check frame;
 603         int r;
 604         u16 crc;
 605
 606         /* calculate local crc for the data we want to check */
 607         crc = crc_ccitt(0xffff, data, datalen);
 608
 609         frame.cmd = PN544_FW_CMD_CHECK;
 610
 611         put_unaligned_be16(sizeof(frame.be_start_addr) +
 612                            sizeof(frame.be_datalen) + sizeof(frame.be_crc),
 613                            &frame.be_length);
 614
 615         /* tell the chip the memory region to which our crc applies */
 616         frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
 617         frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
 618         frame.be_start_addr[2] = start_addr & 0xff;
 619
 620         put_unaligned_be16(datalen, &frame.be_datalen);
 621
 622         /*
 623          * and give our local crc. Chip will calculate its own crc for the
 624          * region and compare with ours.
 625          */
 626         put_unaligned_be16(crc, &frame.be_crc);
 627
 628         r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
 629
 630         if (r == sizeof(frame))
 631                 return 0;
 632         else if (r < 0)
 633                 return r;
 634         else
 635                 return -EIO;
 636 }
 637
 638 static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
 639 {
 640         int r;
 641
 642         r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
 643                                        phy->fw_blob_dest_addr + phy->fw_written,
 644                                        phy->fw_blob_data + phy->fw_written,
 645                                        phy->fw_blob_size - phy->fw_written);
 646         if (r < 0)
 647                 return r;
 648
 649         phy->fw_written += r;
 650         phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
 651
 652         return 0;
 653 }
 654
 655 static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
 656                                         const u8 *data, u16 datalen)
 657 {
 658         u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
 659         struct pn544_i2c_fw_secure_frame *chunk;
 660         int chunklen;
 661         int r;
 662
 663         if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
 664                 datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
 665
 666         chunk = (struct pn544_i2c_fw_secure_frame *) buf;
 667
 668         chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
 669
 670         put_unaligned_be16(datalen, &chunk->be_datalen);
 671
 672         memcpy(chunk->data, data, datalen);
 673
 674         chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
 675
 676         r = i2c_master_send(phy->i2c_dev, buf, chunklen);
 677
 678         if (r == chunklen)
 679                 return datalen;
 680         else if (r < 0)
 681                 return r;
 682         else
 683                 return -EIO;
 684
 685 }
 686
 687 static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
 688 {
 689         struct pn544_i2c_fw_secure_frame *framep;
 690         int r;
 691
 692         framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
 693         if (phy->fw_written == 0)
 694                 phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
 695                                 + PN544_FW_SECURE_FRAME_HEADER_LEN;
 696
 697         /* Only secure write command can be chunked*/
 698         if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
 699                         framep->cmd != PN544_FW_CMD_SECURE_WRITE)
 700                 return -EINVAL;
 701
 702         /* The firmware also have other commands, we just send them directly */
 703         if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
 704                 r = i2c_master_send(phy->i2c_dev,
 705                         (const char *) phy->fw_blob_data, phy->fw_blob_size);
 706
 707                 if (r == phy->fw_blob_size)
 708                         goto exit;
 709                 else if (r < 0)
 710                         return r;
 711                 else
 712                         return -EIO;
 713         }
 714
 715         r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
 716                                        phy->fw_blob_data + phy->fw_written,
 717                                        phy->fw_blob_size - phy->fw_written);
 718         if (r < 0)
 719                 return r;
 720
 721 exit:
 722         phy->fw_written += r;
 723         phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
 724
 725         /* SW reset command will not trig any response from PN544 */
 726         if (framep->cmd == PN544_FW_CMD_RESET) {
 727                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 728                 phy->fw_cmd_result = 0;
 729                 schedule_work(&phy->fw_work);
 730         }
 731
 732         return 0;
 733 }
 734
 735 static void pn544_hci_i2c_fw_work(struct work_struct *work)
 736 {
 737         struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
 738                                                 fw_work);
 739         int r;
 740         struct pn544_i2c_fw_blob *blob;
 741         struct pn544_i2c_fw_secure_blob *secure_blob;
 742
 743         switch (phy->fw_work_state) {
 744         case FW_WORK_STATE_START:
 745                 pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
 746
 747                 r = request_firmware(&phy->fw, phy->firmware_name,
 748                                      &phy->i2c_dev->dev);
 749                 if (r < 0)
 750                         goto exit_state_start;
 751
 752                 phy->fw_written = 0;
 753
 754                 switch (phy->hw_variant) {
 755                 case PN544_HW_VARIANT_C2:
 756                         blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
 757                         phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 758                         phy->fw_blob_dest_addr = get_unaligned_be32(
 759                                                         &blob->be_destaddr);
 760                         phy->fw_blob_data = blob->data;
 761
 762                         r = pn544_hci_i2c_fw_write_chunk(phy);
 763                         break;
 764                 case PN544_HW_VARIANT_C3:
 765                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 766                                                                 phy->fw->data;
 767                         phy->fw_blob_data = secure_blob->data;
 768                         phy->fw_size = phy->fw->size;
 769                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 770                         break;
 771                 default:
 772                         r = -ENOTSUPP;
 773                         break;
 774                 }
 775
 776 exit_state_start:
 777                 if (r < 0)
 778                         pn544_hci_i2c_fw_work_complete(phy, r);
 779                 break;
 780
 781         case FW_WORK_STATE_WAIT_WRITE_ANSWER:
 782                 r = phy->fw_cmd_result;
 783                 if (r < 0)
 784                         goto exit_state_wait_write_answer;
 785
 786                 if (phy->fw_written == phy->fw_blob_size) {
 787                         r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
 788                                                        phy->fw_blob_dest_addr,
 789                                                        phy->fw_blob_data,
 790                                                        phy->fw_blob_size);
 791                         if (r < 0)
 792                                 goto exit_state_wait_write_answer;
 793                         phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
 794                         break;
 795                 }
 796
 797                 r = pn544_hci_i2c_fw_write_chunk(phy);
 798
 799 exit_state_wait_write_answer:
 800                 if (r < 0)
 801                         pn544_hci_i2c_fw_work_complete(phy, r);
 802                 break;
 803
 804         case FW_WORK_STATE_WAIT_CHECK_ANSWER:
 805                 r = phy->fw_cmd_result;
 806                 if (r < 0)
 807                         goto exit_state_wait_check_answer;
 808
 809                 blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
 810                        phy->fw_blob_size);
 811                 phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
 812                 if (phy->fw_blob_size != 0) {
 813                         phy->fw_blob_dest_addr =
 814                                         get_unaligned_be32(&blob->be_destaddr);
 815                         phy->fw_blob_data = blob->data;
 816
 817                         phy->fw_written = 0;
 818                         r = pn544_hci_i2c_fw_write_chunk(phy);
 819                 }
 820
 821 exit_state_wait_check_answer:
 822                 if (r < 0 || phy->fw_blob_size == 0)
 823                         pn544_hci_i2c_fw_work_complete(phy, r);
 824                 break;
 825
 826         case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
 827                 r = phy->fw_cmd_result;
 828                 if (r < 0)
 829                         goto exit_state_wait_secure_write_answer;
 830
 831                 if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
 832                         r = pn544_hci_i2c_fw_secure_write_frame(phy);
 833                         goto exit_state_wait_secure_write_answer;
 834                 }
 835
 836                 if (phy->fw_written == phy->fw_blob_size) {
 837                         secure_blob = (struct pn544_i2c_fw_secure_blob *)
 838                                 (phy->fw_blob_data + phy->fw_blob_size);
 839                         phy->fw_size -= phy->fw_blob_size +
 840                                 PN544_FW_SECURE_BLOB_HEADER_LEN;
 841                         if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
 842                                         + PN544_FW_SECURE_FRAME_HEADER_LEN) {
 843                                 phy->fw_blob_data = secure_blob->data;
 844
 845                                 phy->fw_written = 0;
 846                                 r = pn544_hci_i2c_fw_secure_write_frame(phy);
 847                         }
 848                 }
 849
 850 exit_state_wait_secure_write_answer:
 851                 if (r < 0 || phy->fw_size == 0)
 852                         pn544_hci_i2c_fw_work_complete(phy, r);
 853                 break;
 854
 855         default:
 856                 break;
 857         }
 858 }
 859
 860 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
 861 static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
 862
 863 static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
 864         { "enable-gpios", &enable_gpios, 1 },
 865         { "firmware-gpios", &firmware_gpios, 1 },
 866         { },
 867 };
 868
 869 static int pn544_hci_i2c_probe(struct i2c_client *client,
 870                                const struct i2c_device_id *id)
 871 {
 872         struct device *dev = &client->dev;
 873         struct pn544_i2c_phy *phy;
 874         int r = 0;
 875
 876         if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 877                 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
 878                 return -ENODEV;
 879         }
 880
 881         phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
 882                            GFP_KERNEL);
 883         if (!phy)
 884                 return -ENOMEM;
 885
 886         INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
 887         phy->fw_work_state = FW_WORK_STATE_IDLE;
 888
 889         phy->i2c_dev = client;
 890         i2c_set_clientdata(client, phy);
 891
 892         r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
 893         if (r)
 894                 dev_dbg(dev, "Unable to add GPIO mapping table\n");
 895
 896         /* Get EN GPIO */
 897         phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
 898         if (IS_ERR(phy->gpiod_en)) {
 899                 nfc_err(dev, "Unable to get EN GPIO\n");
 900                 return PTR_ERR(phy->gpiod_en);
 901         }
 902
 903         /* Get FW GPIO */
 904         phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
 905         if (IS_ERR(phy->gpiod_fw)) {
 906                 nfc_err(dev, "Unable to get FW GPIO\n");
 907                 return PTR_ERR(phy->gpiod_fw);
 908         }
 909
 910         pn544_hci_i2c_platform_init(phy);
 911
 912         r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
 913                                       pn544_hci_i2c_irq_thread_fn,
 914                                       IRQF_TRIGGER_RISING | IRQF_ONESHOT,
 915                                       PN544_HCI_I2C_DRIVER_NAME, phy);
 916         if (r < 0) {
 917                 nfc_err(&client->dev, "Unable to register IRQ handler\n");
 918                 return r;
 919         }
 920
 921         r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
 922                             PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
 923                             PN544_HCI_I2C_LLC_MAX_PAYLOAD,
 924                             pn544_hci_i2c_fw_download, &phy->hdev);
 925         if (r < 0)
 926                 return r;
 927
 928         return 0;
 929 }
 930
 931 static void pn544_hci_i2c_remove(struct i2c_client *client)
 932 {
 933         struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
 934
 935         cancel_work_sync(&phy->fw_work);
 936         if (phy->fw_work_state != FW_WORK_STATE_IDLE)
 937                 pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
 938
 939         pn544_hci_remove(phy->hdev);
 940
 941         if (phy->powered)
 942                 pn544_hci_i2c_disable(phy);
 943 }
 944
 945 static const struct of_device_id of_pn544_i2c_match[] __maybe_unused = {
 946         { .compatible = "nxp,pn544-i2c", },
 947         {},
 948 };
 949 MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
 950
 951 static struct i2c_driver pn544_hci_i2c_driver = {
 952         .driver = {
 953                    .name = PN544_HCI_I2C_DRIVER_NAME,
 954                    .of_match_table = of_match_ptr(of_pn544_i2c_match),
 955                    .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
 956                   },
 957         .probe = pn544_hci_i2c_probe,
 958         .id_table = pn544_hci_i2c_id_table,
 959         .remove = pn544_hci_i2c_remove,
 960 };
 961
 962 module_i2c_driver(pn544_hci_i2c_driver);
 963
 964 MODULE_LICENSE("GPL");
 965 MODULE_DESCRIPTION(DRIVER_DESC);