1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * I2C Link Layer for ST21NFCA HCI based Driver
4 * Copyright (C) 2014 STMicroelectronics SAS. All rights reserved.
5 */
6
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8
9 #include <linux/crc-ccitt.h>
10 #include <linux/module.h>
11 #include <linux/i2c.h>
12 #include <linux/gpio/consumer.h>
13 #include <linux/of_irq.h>
14 #include <linux/of_gpio.h>
15 #include <linux/acpi.h>
16 #include <linux/interrupt.h>
17 #include <linux/delay.h>
18 #include <linux/nfc.h>
19 #include <linux/firmware.h>
20
21 #include <net/nfc/hci.h>
22 #include <net/nfc/llc.h>
23 #include <net/nfc/nfc.h>
24
25 #include "st21nfca.h"
26
27 /*
28 * Every frame starts with ST21NFCA_SOF_EOF and ends with ST21NFCA_SOF_EOF.
29 * Because ST21NFCA_SOF_EOF is a possible data value, there is a mecanism
30 * called byte stuffing has been introduced.
31 *
32 * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
33 * - insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
34 * - xor byte with ST21NFCA_BYTE_STUFFING_MASK
35 */
36 #define ST21NFCA_SOF_EOF 0x7e
37 #define ST21NFCA_BYTE_STUFFING_MASK 0x20
38 #define ST21NFCA_ESCAPE_BYTE_STUFFING 0x7d
39
40 /* SOF + 00 */
41 #define ST21NFCA_FRAME_HEADROOM 2
42
43 /* 2 bytes crc + EOF */
44 #define ST21NFCA_FRAME_TAILROOM 3
45 #define IS_START_OF_FRAME(buf) (buf[0] == ST21NFCA_SOF_EOF && \
46 buf[1] == 0)
47
48 #define ST21NFCA_HCI_DRIVER_NAME "st21nfca_hci"
49 #define ST21NFCA_HCI_I2C_DRIVER_NAME "st21nfca_hci_i2c"
50
51 struct st21nfca_i2c_phy {
52 struct i2c_client *i2c_dev;
53 struct nfc_hci_dev *hdev;
54
55 struct gpio_desc *gpiod_ena;
56 struct st21nfca_se_status se_status;
57
58 struct sk_buff *pending_skb;
59 int current_read_len;
60 /*
61 * crc might have fail because i2c macro
62 * is disable due to other interface activity
63 */
64 int crc_trials;
65
66 int powered;
67 int run_mode;
68
69 /*
70 * < 0 if hardware error occured (e.g. i2c err)
71 * and prevents normal operation.
72 */
73 int hard_fault;
74 struct mutex phy_lock;
75 };
76
77 static const u8 len_seq[] = { 16, 24, 12, 29 };
78 static const u16 wait_tab[] = { 2, 3, 5, 15, 20, 40};
79
80 #define I2C_DUMP_SKB(info, skb) \
81 do { \
82 pr_debug("%s:\n", info); \
83 print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
84 16, 1, (skb)->data, (skb)->len, 0); \
85 } while (0)
86
87 /*
88 * In order to get the CLF in a known state we generate an internal reboot
89 * using a proprietary command.
90 * Once the reboot is completed, we expect to receive a ST21NFCA_SOF_EOF
91 * fill buffer.
92 */
st21nfca_hci_platform_init(struct st21nfca_i2c_phy * phy)93 static int st21nfca_hci_platform_init(struct st21nfca_i2c_phy *phy)
94 {
95 u16 wait_reboot[] = { 50, 300, 1000 };
96 char reboot_cmd[] = { 0x7E, 0x66, 0x48, 0xF6, 0x7E };
97 u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE];
98 int i, r = -1;
99
100 for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
101 r = i2c_master_send(phy->i2c_dev, reboot_cmd,
102 sizeof(reboot_cmd));
103 if (r < 0)
104 msleep(wait_reboot[i]);
105 }
106 if (r < 0)
107 return r;
108
109 /* CLF is spending about 20ms to do an internal reboot */
110 msleep(20);
111 r = -1;
112 for (i = 0; i < ARRAY_SIZE(wait_reboot) && r < 0; i++) {
113 r = i2c_master_recv(phy->i2c_dev, tmp,
114 ST21NFCA_HCI_LLC_MAX_SIZE);
115 if (r < 0)
116 msleep(wait_reboot[i]);
117 }
118 if (r < 0)
119 return r;
120
121 for (i = 0; i < ST21NFCA_HCI_LLC_MAX_SIZE &&
122 tmp[i] == ST21NFCA_SOF_EOF; i++)
123 ;
124
125 if (r != ST21NFCA_HCI_LLC_MAX_SIZE)
126 return -ENODEV;
127
128 usleep_range(1000, 1500);
129 return 0;
130 }
131
st21nfca_hci_i2c_enable(void * phy_id)132 static int st21nfca_hci_i2c_enable(void *phy_id)
133 {
134 struct st21nfca_i2c_phy *phy = phy_id;
135
136 gpiod_set_value(phy->gpiod_ena, 1);
137 phy->powered = 1;
138 phy->run_mode = ST21NFCA_HCI_MODE;
139
140 usleep_range(10000, 15000);
141
142 return 0;
143 }
144
st21nfca_hci_i2c_disable(void * phy_id)145 static void st21nfca_hci_i2c_disable(void *phy_id)
146 {
147 struct st21nfca_i2c_phy *phy = phy_id;
148
149 gpiod_set_value(phy->gpiod_ena, 0);
150
151 phy->powered = 0;
152 }
153
st21nfca_hci_add_len_crc(struct sk_buff * skb)154 static void st21nfca_hci_add_len_crc(struct sk_buff *skb)
155 {
156 u16 crc;
157 u8 tmp;
158
159 *(u8 *)skb_push(skb, 1) = 0;
160
161 crc = crc_ccitt(0xffff, skb->data, skb->len);
162 crc = ~crc;
163
164 tmp = crc & 0x00ff;
165 skb_put_u8(skb, tmp);
166
167 tmp = (crc >> 8) & 0x00ff;
168 skb_put_u8(skb, tmp);
169 }
170
st21nfca_hci_remove_len_crc(struct sk_buff * skb)171 static void st21nfca_hci_remove_len_crc(struct sk_buff *skb)
172 {
173 skb_pull(skb, ST21NFCA_FRAME_HEADROOM);
174 skb_trim(skb, skb->len - ST21NFCA_FRAME_TAILROOM);
175 }
176
177 /*
178 * Writing a frame must not return the number of written bytes.
179 * It must return either zero for success, or <0 for error.
180 * In addition, it must not alter the skb
181 */
st21nfca_hci_i2c_write(void * phy_id,struct sk_buff * skb)182 static int st21nfca_hci_i2c_write(void *phy_id, struct sk_buff *skb)
183 {
184 int r = -1, i, j;
185 struct st21nfca_i2c_phy *phy = phy_id;
186 struct i2c_client *client = phy->i2c_dev;
187 u8 tmp[ST21NFCA_HCI_LLC_MAX_SIZE * 2];
188
189 I2C_DUMP_SKB("st21nfca_hci_i2c_write", skb);
190
191 if (phy->hard_fault != 0)
192 return phy->hard_fault;
193
194 /*
195 * Compute CRC before byte stuffing computation on frame
196 * Note st21nfca_hci_add_len_crc is doing a byte stuffing
197 * on its own value
198 */
199 st21nfca_hci_add_len_crc(skb);
200
201 /* add ST21NFCA_SOF_EOF on tail */
202 skb_put_u8(skb, ST21NFCA_SOF_EOF);
203 /* add ST21NFCA_SOF_EOF on head */
204 *(u8 *)skb_push(skb, 1) = ST21NFCA_SOF_EOF;
205
206 /*
207 * Compute byte stuffing
208 * if byte == ST21NFCA_SOF_EOF or ST21NFCA_ESCAPE_BYTE_STUFFING
209 * insert ST21NFCA_ESCAPE_BYTE_STUFFING (escape byte)
210 * xor byte with ST21NFCA_BYTE_STUFFING_MASK
211 */
212 tmp[0] = skb->data[0];
213 for (i = 1, j = 1; i < skb->len - 1; i++, j++) {
214 if (skb->data[i] == ST21NFCA_SOF_EOF
215 || skb->data[i] == ST21NFCA_ESCAPE_BYTE_STUFFING) {
216 tmp[j] = ST21NFCA_ESCAPE_BYTE_STUFFING;
217 j++;
218 tmp[j] = skb->data[i] ^ ST21NFCA_BYTE_STUFFING_MASK;
219 } else {
220 tmp[j] = skb->data[i];
221 }
222 }
223 tmp[j] = skb->data[i];
224 j++;
225
226 /*
227 * Manage sleep mode
228 * Try 3 times to send data with delay between each
229 */
230 mutex_lock(&phy->phy_lock);
231 for (i = 0; i < ARRAY_SIZE(wait_tab) && r < 0; i++) {
232 r = i2c_master_send(client, tmp, j);
233 if (r < 0)
234 msleep(wait_tab[i]);
235 }
236 mutex_unlock(&phy->phy_lock);
237
238 if (r >= 0) {
239 if (r != j)
240 r = -EREMOTEIO;
241 else
242 r = 0;
243 }
244
245 st21nfca_hci_remove_len_crc(skb);
246
247 return r;
248 }
249
get_frame_size(u8 * buf,int buflen)250 static int get_frame_size(u8 *buf, int buflen)
251 {
252 int len = 0;
253
254 if (buf[len + 1] == ST21NFCA_SOF_EOF)
255 return 0;
256
257 for (len = 1; len < buflen && buf[len] != ST21NFCA_SOF_EOF; len++)
258 ;
259
260 return len;
261 }
262
check_crc(u8 * buf,int buflen)263 static int check_crc(u8 *buf, int buflen)
264 {
265 u16 crc;
266
267 crc = crc_ccitt(0xffff, buf, buflen - 2);
268 crc = ~crc;
269
270 if (buf[buflen - 2] != (crc & 0xff) || buf[buflen - 1] != (crc >> 8)) {
271 pr_err(ST21NFCA_HCI_DRIVER_NAME
272 ": CRC error 0x%x != 0x%x 0x%x\n", crc, buf[buflen - 1],
273 buf[buflen - 2]);
274
275 pr_info(DRIVER_DESC ": %s : BAD CRC\n", __func__);
276 print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
277 16, 2, buf, buflen, false);
278 return -EPERM;
279 }
280 return 0;
281 }
282
283 /*
284 * Prepare received data for upper layer.
285 * Received data include byte stuffing, crc and sof/eof
286 * which is not usable by hci part.
287 * returns:
288 * frame size without sof/eof, header and byte stuffing
289 * -EBADMSG : frame was incorrect and discarded
290 */
st21nfca_hci_i2c_repack(struct sk_buff * skb)291 static int st21nfca_hci_i2c_repack(struct sk_buff *skb)
292 {
293 int i, j, r, size;
294
295 if (skb->len < 1 || (skb->len > 1 && skb->data[1] != 0))
296 return -EBADMSG;
297
298 size = get_frame_size(skb->data, skb->len);
299 if (size > 0) {
300 skb_trim(skb, size);
301 /* remove ST21NFCA byte stuffing for upper layer */
302 for (i = 1, j = 0; i < skb->len; i++) {
303 if (skb->data[i + j] ==
304 (u8) ST21NFCA_ESCAPE_BYTE_STUFFING) {
305 skb->data[i] = skb->data[i + j + 1]
306 | ST21NFCA_BYTE_STUFFING_MASK;
307 i++;
308 j++;
309 }
310 skb->data[i] = skb->data[i + j];
311 }
312 /* remove byte stuffing useless byte */
313 skb_trim(skb, i - j);
314 /* remove ST21NFCA_SOF_EOF from head */
315 skb_pull(skb, 1);
316
317 r = check_crc(skb->data, skb->len);
318 if (r != 0) {
319 i = 0;
320 return -EBADMSG;
321 }
322
323 /* remove headbyte */
324 skb_pull(skb, 1);
325 /* remove crc. Byte Stuffing is already removed here */
326 skb_trim(skb, skb->len - 2);
327 return skb->len;
328 }
329 return 0;
330 }
331
332 /*
333 * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
334 * that i2c bus will be flushed and that next read will start on a new frame.
335 * returned skb contains only LLC header and payload.
336 * returns:
337 * frame size : if received frame is complete (find ST21NFCA_SOF_EOF at
338 * end of read)
339 * -EAGAIN : if received frame is incomplete (not find ST21NFCA_SOF_EOF
340 * at end of read)
341 * -EREMOTEIO : i2c read error (fatal)
342 * -EBADMSG : frame was incorrect and discarded
343 * (value returned from st21nfca_hci_i2c_repack)
344 * -EIO : if no ST21NFCA_SOF_EOF is found after reaching
345 * the read length end sequence
346 */
st21nfca_hci_i2c_read(struct st21nfca_i2c_phy * phy,struct sk_buff * skb)347 static int st21nfca_hci_i2c_read(struct st21nfca_i2c_phy *phy,
348 struct sk_buff *skb)
349 {
350 int r, i;
351 u8 len;
352 u8 buf[ST21NFCA_HCI_LLC_MAX_PAYLOAD];
353 struct i2c_client *client = phy->i2c_dev;
354
355 if (phy->current_read_len < ARRAY_SIZE(len_seq)) {
356 len = len_seq[phy->current_read_len];
357
358 /*
359 * Add retry mecanism
360 * Operation on I2C interface may fail in case of operation on
361 * RF or SWP interface
362 */
363 r = 0;
364 mutex_lock(&phy->phy_lock);
365 for (i = 0; i < ARRAY_SIZE(wait_tab) && r <= 0; i++) {
366 r = i2c_master_recv(client, buf, len);
367 if (r < 0)
368 msleep(wait_tab[i]);
369 }
370 mutex_unlock(&phy->phy_lock);
371
372 if (r != len) {
373 phy->current_read_len = 0;
374 return -EREMOTEIO;
375 }
376
377 /*
378 * The first read sequence does not start with SOF.
379 * Data is corrupeted so we drop it.
380 */
381 if (!phy->current_read_len && !IS_START_OF_FRAME(buf)) {
382 skb_trim(skb, 0);
383 phy->current_read_len = 0;
384 return -EIO;
385 } else if (phy->current_read_len && IS_START_OF_FRAME(buf)) {
386 /*
387 * Previous frame transmission was interrupted and
388 * the frame got repeated.
389 * Received frame start with ST21NFCA_SOF_EOF + 00.
390 */
391 skb_trim(skb, 0);
392 phy->current_read_len = 0;
393 }
394
395 skb_put_data(skb, buf, len);
396
397 if (skb->data[skb->len - 1] == ST21NFCA_SOF_EOF) {
398 phy->current_read_len = 0;
399 return st21nfca_hci_i2c_repack(skb);
400 }
401 phy->current_read_len++;
402 return -EAGAIN;
403 }
404 return -EIO;
405 }
406
407 /*
408 * Reads an shdlc frame from the chip. This is not as straightforward as it
409 * seems. The frame format is data-crc, and corruption can occur anywhere
410 * while transiting on i2c bus, such that we could read an invalid data.
411 * The tricky case is when we read a corrupted data or crc. We must detect
412 * this here in order to determine that data can be transmitted to the hci
413 * core. This is the reason why we check the crc here.
414 * The CLF will repeat a frame until we send a RR on that frame.
415 *
416 * On ST21NFCA, IRQ goes in idle when read starts. As no size information are
417 * available in the incoming data, other IRQ might come. Every IRQ will trigger
418 * a read sequence with different length and will fill the current frame.
419 * The reception is complete once we reach a ST21NFCA_SOF_EOF.
420 */
st21nfca_hci_irq_thread_fn(int irq,void * phy_id)421 static irqreturn_t st21nfca_hci_irq_thread_fn(int irq, void *phy_id)
422 {
423 struct st21nfca_i2c_phy *phy = phy_id;
424 struct i2c_client *client;
425
426 int r;
427
428 if (!phy || irq != phy->i2c_dev->irq) {
429 WARN_ON_ONCE(1);
430 return IRQ_NONE;
431 }
432
433 client = phy->i2c_dev;
434 dev_dbg(&client->dev, "IRQ\n");
435
436 if (phy->hard_fault != 0)
437 return IRQ_HANDLED;
438
439 r = st21nfca_hci_i2c_read(phy, phy->pending_skb);
440 if (r == -EREMOTEIO) {
441 phy->hard_fault = r;
442
443 nfc_hci_recv_frame(phy->hdev, NULL);
444
445 return IRQ_HANDLED;
446 } else if (r == -EAGAIN || r == -EIO) {
447 return IRQ_HANDLED;
448 } else if (r == -EBADMSG && phy->crc_trials < ARRAY_SIZE(wait_tab)) {
449 /*
450 * With ST21NFCA, only one interface (I2C, RF or SWP)
451 * may be active at a time.
452 * Having incorrect crc is usually due to i2c macrocell
453 * deactivation in the middle of a transmission.
454 * It may generate corrupted data on i2c.
455 * We give sometime to get i2c back.
456 * The complete frame will be repeated.
457 */
458 msleep(wait_tab[phy->crc_trials]);
459 phy->crc_trials++;
460 phy->current_read_len = 0;
461 kfree_skb(phy->pending_skb);
462 } else if (r > 0) {
463 /*
464 * We succeeded to read data from the CLF and
465 * data is valid.
466 * Reset counter.
467 */
468 nfc_hci_recv_frame(phy->hdev, phy->pending_skb);
469 phy->crc_trials = 0;
470 } else {
471 kfree_skb(phy->pending_skb);
472 }
473
474 phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
475 if (phy->pending_skb == NULL) {
476 phy->hard_fault = -ENOMEM;
477 nfc_hci_recv_frame(phy->hdev, NULL);
478 }
479
480 return IRQ_HANDLED;
481 }
482
483 static const struct nfc_phy_ops i2c_phy_ops = {
484 .write = st21nfca_hci_i2c_write,
485 .enable = st21nfca_hci_i2c_enable,
486 .disable = st21nfca_hci_i2c_disable,
487 };
488
489 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
490
491 static const struct acpi_gpio_mapping acpi_st21nfca_gpios[] = {
492 { "enable-gpios", &enable_gpios, 1 },
493 {},
494 };
495
st21nfca_hci_i2c_probe(struct i2c_client * client,const struct i2c_device_id * id)496 static int st21nfca_hci_i2c_probe(struct i2c_client *client,
497 const struct i2c_device_id *id)
498 {
499 struct device *dev = &client->dev;
500 struct st21nfca_i2c_phy *phy;
501 int r;
502
503 if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
504 nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
505 return -ENODEV;
506 }
507
508 phy = devm_kzalloc(&client->dev, sizeof(struct st21nfca_i2c_phy),
509 GFP_KERNEL);
510 if (!phy)
511 return -ENOMEM;
512
513 phy->i2c_dev = client;
514 phy->pending_skb = alloc_skb(ST21NFCA_HCI_LLC_MAX_SIZE * 2, GFP_KERNEL);
515 if (phy->pending_skb == NULL)
516 return -ENOMEM;
517
518 phy->current_read_len = 0;
519 phy->crc_trials = 0;
520 mutex_init(&phy->phy_lock);
521 i2c_set_clientdata(client, phy);
522
523 r = devm_acpi_dev_add_driver_gpios(dev, acpi_st21nfca_gpios);
524 if (r)
525 dev_dbg(dev, "Unable to add GPIO mapping table\n");
526
527 /* Get EN GPIO from resource provider */
528 phy->gpiod_ena = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
529 if (IS_ERR(phy->gpiod_ena)) {
530 nfc_err(dev, "Unable to get ENABLE GPIO\n");
531 r = PTR_ERR(phy->gpiod_ena);
532 goto out_free;
533 }
534
535 phy->se_status.is_ese_present =
536 device_property_read_bool(&client->dev, "ese-present");
537 phy->se_status.is_uicc_present =
538 device_property_read_bool(&client->dev, "uicc-present");
539
540 r = st21nfca_hci_platform_init(phy);
541 if (r < 0) {
542 nfc_err(&client->dev, "Unable to reboot st21nfca\n");
543 goto out_free;
544 }
545
546 r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
547 st21nfca_hci_irq_thread_fn,
548 IRQF_ONESHOT,
549 ST21NFCA_HCI_DRIVER_NAME, phy);
550 if (r < 0) {
551 nfc_err(&client->dev, "Unable to register IRQ handler\n");
552 goto out_free;
553 }
554
555 r = st21nfca_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
556 ST21NFCA_FRAME_HEADROOM,
557 ST21NFCA_FRAME_TAILROOM,
558 ST21NFCA_HCI_LLC_MAX_PAYLOAD,
559 &phy->hdev,
560 &phy->se_status);
561 if (r)
562 goto out_free;
563
564 return 0;
565
566 out_free:
567 kfree_skb(phy->pending_skb);
568 return r;
569 }
570
st21nfca_hci_i2c_remove(struct i2c_client * client)571 static int st21nfca_hci_i2c_remove(struct i2c_client *client)
572 {
573 struct st21nfca_i2c_phy *phy = i2c_get_clientdata(client);
574
575 st21nfca_hci_remove(phy->hdev);
576
577 if (phy->powered)
578 st21nfca_hci_i2c_disable(phy);
579 if (phy->pending_skb)
580 kfree_skb(phy->pending_skb);
581
582 return 0;
583 }
584
585 static const struct i2c_device_id st21nfca_hci_i2c_id_table[] = {
586 {ST21NFCA_HCI_DRIVER_NAME, 0},
587 {}
588 };
589 MODULE_DEVICE_TABLE(i2c, st21nfca_hci_i2c_id_table);
590
591 static const struct acpi_device_id st21nfca_hci_i2c_acpi_match[] __maybe_unused = {
592 {"SMO2100", 0},
593 {}
594 };
595 MODULE_DEVICE_TABLE(acpi, st21nfca_hci_i2c_acpi_match);
596
597 static const struct of_device_id of_st21nfca_i2c_match[] __maybe_unused = {
598 { .compatible = "st,st21nfca-i2c", },
599 { .compatible = "st,st21nfca_i2c", },
600 {}
601 };
602 MODULE_DEVICE_TABLE(of, of_st21nfca_i2c_match);
603
604 static struct i2c_driver st21nfca_hci_i2c_driver = {
605 .driver = {
606 .name = ST21NFCA_HCI_I2C_DRIVER_NAME,
607 .of_match_table = of_match_ptr(of_st21nfca_i2c_match),
608 .acpi_match_table = ACPI_PTR(st21nfca_hci_i2c_acpi_match),
609 },
610 .probe = st21nfca_hci_i2c_probe,
611 .id_table = st21nfca_hci_i2c_id_table,
612 .remove = st21nfca_hci_i2c_remove,
613 };
614 module_i2c_driver(st21nfca_hci_i2c_driver);
615
616 MODULE_LICENSE("GPL");
617 MODULE_DESCRIPTION(DRIVER_DESC);
618