1 // SPDX-License-Identifier: GPL-2.0+ 2 3 /* 4 * Multifunction core driver for Zodiac Inflight Innovations RAVE 5 * Supervisory Processor(SP) MCU that is connected via dedicated UART 6 * port 7 * 8 * Copyright (C) 2017 Zodiac Inflight Innovations 9 */ 10 11 #include <linux/atomic.h> 12 #include <linux/crc-ccitt.h> 13 #include <linux/delay.h> 14 #include <linux/export.h> 15 #include <linux/init.h> 16 #include <linux/slab.h> 17 #include <linux/kernel.h> 18 #include <linux/mfd/rave-sp.h> 19 #include <linux/module.h> 20 #include <linux/of.h> 21 #include <linux/of_device.h> 22 #include <linux/sched.h> 23 #include <linux/serdev.h> 24 #include <asm/unaligned.h> 25 26 /* 27 * UART protocol using following entities: 28 * - message to MCU => ACK response 29 * - event from MCU => event ACK 30 * 31 * Frame structure: 32 * <STX> <DATA> <CHECKSUM> <ETX> 33 * Where: 34 * - STX - is start of transmission character 35 * - ETX - end of transmission 36 * - DATA - payload 37 * - CHECKSUM - checksum calculated on <DATA> 38 * 39 * If <DATA> or <CHECKSUM> contain one of control characters, then it is 40 * escaped using <DLE> control code. Added <DLE> does not participate in 41 * checksum calculation. 42 */ 43 #define RAVE_SP_STX 0x02 44 #define RAVE_SP_ETX 0x03 45 #define RAVE_SP_DLE 0x10 46 47 #define RAVE_SP_MAX_DATA_SIZE 64 48 #define RAVE_SP_CHECKSUM_SIZE 2 /* Worst case scenario on RDU2 */ 49 /* 50 * We don't store STX, ETX and unescaped bytes, so Rx is only 51 * DATA + CSUM 52 */ 53 #define RAVE_SP_RX_BUFFER_SIZE \ 54 (RAVE_SP_MAX_DATA_SIZE + RAVE_SP_CHECKSUM_SIZE) 55 56 #define RAVE_SP_STX_ETX_SIZE 2 57 /* 58 * For Tx we have to have space for everything, STX, EXT and 59 * potentially stuffed DATA + CSUM data + csum 60 */ 61 #define RAVE_SP_TX_BUFFER_SIZE \ 62 (RAVE_SP_STX_ETX_SIZE + 2 * RAVE_SP_RX_BUFFER_SIZE) 63 64 #define RAVE_SP_BOOT_SOURCE_GET 0 65 #define RAVE_SP_BOOT_SOURCE_SET 1 66 67 #define RAVE_SP_RDU2_BOARD_TYPE_RMB 0 68 #define RAVE_SP_RDU2_BOARD_TYPE_DEB 1 69 70 #define RAVE_SP_BOOT_SOURCE_SD 0 71 #define RAVE_SP_BOOT_SOURCE_EMMC 1 72 #define RAVE_SP_BOOT_SOURCE_NOR 2 73 74 /** 75 * enum rave_sp_deframer_state - Possible state for de-framer 76 * 77 * @RAVE_SP_EXPECT_SOF: Scanning input for start-of-frame marker 78 * @RAVE_SP_EXPECT_DATA: Got start of frame marker, collecting frame 79 * @RAVE_SP_EXPECT_ESCAPED_DATA: Got escape character, collecting escaped byte 80 */ 81 enum rave_sp_deframer_state { 82 RAVE_SP_EXPECT_SOF, 83 RAVE_SP_EXPECT_DATA, 84 RAVE_SP_EXPECT_ESCAPED_DATA, 85 }; 86 87 /** 88 * struct rave_sp_deframer - Device protocol deframer 89 * 90 * @state: Current state of the deframer 91 * @data: Buffer used to collect deframed data 92 * @length: Number of bytes de-framed so far 93 */ 94 struct rave_sp_deframer { 95 enum rave_sp_deframer_state state; 96 unsigned char data[RAVE_SP_RX_BUFFER_SIZE]; 97 size_t length; 98 }; 99 100 /** 101 * struct rave_sp_reply - Reply as per RAVE device protocol 102 * 103 * @length: Expected reply length 104 * @data: Buffer to store reply payload in 105 * @code: Expected reply code 106 * @ackid: Expected reply ACK ID 107 * @completion: Successful reply reception completion 108 */ 109 struct rave_sp_reply { 110 size_t length; 111 void *data; 112 u8 code; 113 u8 ackid; 114 struct completion received; 115 }; 116 117 /** 118 * struct rave_sp_checksum - Variant specific checksum implementation details 119 * 120 * @length: Caculated checksum length 121 * @subroutine: Utilized checksum algorithm implementation 122 */ 123 struct rave_sp_checksum { 124 size_t length; 125 void (*subroutine)(const u8 *, size_t, u8 *); 126 }; 127 128 /** 129 * struct rave_sp_variant_cmds - Variant specific command routines 130 * 131 * @translate: Generic to variant specific command mapping routine 132 * 133 */ 134 struct rave_sp_variant_cmds { 135 int (*translate)(enum rave_sp_command); 136 }; 137 138 /** 139 * struct rave_sp_variant - RAVE supervisory processor core variant 140 * 141 * @checksum: Variant specific checksum implementation 142 * @cmd: Variant specific command pointer table 143 * 144 */ 145 struct rave_sp_variant { 146 const struct rave_sp_checksum *checksum; 147 struct rave_sp_variant_cmds cmd; 148 }; 149 150 /** 151 * struct rave_sp - RAVE supervisory processor core 152 * 153 * @serdev: Pointer to underlying serdev 154 * @deframer: Stored state of the protocol deframer 155 * @ackid: ACK ID used in last reply sent to the device 156 * @bus_lock: Lock to serialize access to the device 157 * @reply_lock: Lock protecting @reply 158 * @reply: Pointer to memory to store reply payload 159 * 160 * @variant: Device variant specific information 161 * @event_notifier_list: Input event notification chain 162 * 163 */ 164 struct rave_sp { 165 struct serdev_device *serdev; 166 struct rave_sp_deframer deframer; 167 atomic_t ackid; 168 struct mutex bus_lock; 169 struct mutex reply_lock; 170 struct rave_sp_reply *reply; 171 172 const struct rave_sp_variant *variant; 173 struct blocking_notifier_head event_notifier_list; 174 }; 175 176 static bool rave_sp_id_is_event(u8 code) 177 { 178 return (code & 0xF0) == RAVE_SP_EVNT_BASE; 179 } 180 181 static void rave_sp_unregister_event_notifier(struct device *dev, void *res) 182 { 183 struct rave_sp *sp = dev_get_drvdata(dev->parent); 184 struct notifier_block *nb = *(struct notifier_block **)res; 185 struct blocking_notifier_head *bnh = &sp->event_notifier_list; 186 187 WARN_ON(blocking_notifier_chain_unregister(bnh, nb)); 188 } 189 190 int devm_rave_sp_register_event_notifier(struct device *dev, 191 struct notifier_block *nb) 192 { 193 struct rave_sp *sp = dev_get_drvdata(dev->parent); 194 struct notifier_block **rcnb; 195 int ret; 196 197 rcnb = devres_alloc(rave_sp_unregister_event_notifier, 198 sizeof(*rcnb), GFP_KERNEL); 199 if (!rcnb) 200 return -ENOMEM; 201 202 ret = blocking_notifier_chain_register(&sp->event_notifier_list, nb); 203 if (!ret) { 204 *rcnb = nb; 205 devres_add(dev, rcnb); 206 } else { 207 devres_free(rcnb); 208 } 209 210 return ret; 211 } 212 EXPORT_SYMBOL_GPL(devm_rave_sp_register_event_notifier); 213 214 static void csum_8b2c(const u8 *buf, size_t size, u8 *crc) 215 { 216 *crc = *buf++; 217 size--; 218 219 while (size--) 220 *crc += *buf++; 221 222 *crc = 1 + ~(*crc); 223 } 224 225 static void csum_ccitt(const u8 *buf, size_t size, u8 *crc) 226 { 227 const u16 calculated = crc_ccitt_false(0xffff, buf, size); 228 229 /* 230 * While the rest of the wire protocol is little-endian, 231 * CCITT-16 CRC in RDU2 device is sent out in big-endian order. 232 */ 233 put_unaligned_be16(calculated, crc); 234 } 235 236 static void *stuff(unsigned char *dest, const unsigned char *src, size_t n) 237 { 238 while (n--) { 239 const unsigned char byte = *src++; 240 241 switch (byte) { 242 case RAVE_SP_STX: 243 case RAVE_SP_ETX: 244 case RAVE_SP_DLE: 245 *dest++ = RAVE_SP_DLE; 246 /* FALLTHROUGH */ 247 default: 248 *dest++ = byte; 249 } 250 } 251 252 return dest; 253 } 254 255 static int rave_sp_write(struct rave_sp *sp, const u8 *data, u8 data_size) 256 { 257 const size_t checksum_length = sp->variant->checksum->length; 258 unsigned char frame[RAVE_SP_TX_BUFFER_SIZE]; 259 unsigned char crc[RAVE_SP_CHECKSUM_SIZE]; 260 unsigned char *dest = frame; 261 size_t length; 262 263 if (WARN_ON(checksum_length > sizeof(crc))) 264 return -ENOMEM; 265 266 if (WARN_ON(data_size > sizeof(frame))) 267 return -ENOMEM; 268 269 sp->variant->checksum->subroutine(data, data_size, crc); 270 271 *dest++ = RAVE_SP_STX; 272 dest = stuff(dest, data, data_size); 273 dest = stuff(dest, crc, checksum_length); 274 *dest++ = RAVE_SP_ETX; 275 276 length = dest - frame; 277 278 print_hex_dump(KERN_DEBUG, "rave-sp tx: ", DUMP_PREFIX_NONE, 279 16, 1, frame, length, false); 280 281 return serdev_device_write(sp->serdev, frame, length, HZ); 282 } 283 284 static u8 rave_sp_reply_code(u8 command) 285 { 286 /* 287 * There isn't a single rule that describes command code -> 288 * ACK code transformation, but, going through various 289 * versions of ICDs, there appear to be three distinct groups 290 * that can be described by simple transformation. 291 */ 292 switch (command) { 293 case 0xA0 ... 0xBE: 294 /* 295 * Commands implemented by firmware found in RDU1 and 296 * older devices all seem to obey the following rule 297 */ 298 return command + 0x20; 299 case 0xE0 ... 0xEF: 300 /* 301 * Events emitted by all versions of the firmare use 302 * least significant bit to get an ACK code 303 */ 304 return command | 0x01; 305 default: 306 /* 307 * Commands implemented by firmware found in RDU2 are 308 * similar to "old" commands, but they use slightly 309 * different offset 310 */ 311 return command + 0x40; 312 } 313 } 314 315 int rave_sp_exec(struct rave_sp *sp, 316 void *__data, size_t data_size, 317 void *reply_data, size_t reply_data_size) 318 { 319 struct rave_sp_reply reply = { 320 .data = reply_data, 321 .length = reply_data_size, 322 .received = COMPLETION_INITIALIZER_ONSTACK(reply.received), 323 }; 324 unsigned char *data = __data; 325 int command, ret = 0; 326 u8 ackid; 327 328 command = sp->variant->cmd.translate(data[0]); 329 if (command < 0) 330 return command; 331 332 ackid = atomic_inc_return(&sp->ackid); 333 reply.ackid = ackid; 334 reply.code = rave_sp_reply_code((u8)command), 335 336 mutex_lock(&sp->bus_lock); 337 338 mutex_lock(&sp->reply_lock); 339 sp->reply = &reply; 340 mutex_unlock(&sp->reply_lock); 341 342 data[0] = command; 343 data[1] = ackid; 344 345 rave_sp_write(sp, data, data_size); 346 347 if (!wait_for_completion_timeout(&reply.received, HZ)) { 348 dev_err(&sp->serdev->dev, "Command timeout\n"); 349 ret = -ETIMEDOUT; 350 351 mutex_lock(&sp->reply_lock); 352 sp->reply = NULL; 353 mutex_unlock(&sp->reply_lock); 354 } 355 356 mutex_unlock(&sp->bus_lock); 357 return ret; 358 } 359 EXPORT_SYMBOL_GPL(rave_sp_exec); 360 361 static void rave_sp_receive_event(struct rave_sp *sp, 362 const unsigned char *data, size_t length) 363 { 364 u8 cmd[] = { 365 [0] = rave_sp_reply_code(data[0]), 366 [1] = data[1], 367 }; 368 369 rave_sp_write(sp, cmd, sizeof(cmd)); 370 371 blocking_notifier_call_chain(&sp->event_notifier_list, 372 rave_sp_action_pack(data[0], data[2]), 373 NULL); 374 } 375 376 static void rave_sp_receive_reply(struct rave_sp *sp, 377 const unsigned char *data, size_t length) 378 { 379 struct device *dev = &sp->serdev->dev; 380 struct rave_sp_reply *reply; 381 const size_t payload_length = length - 2; 382 383 mutex_lock(&sp->reply_lock); 384 reply = sp->reply; 385 386 if (reply) { 387 if (reply->code == data[0] && reply->ackid == data[1] && 388 payload_length >= reply->length) { 389 /* 390 * We are relying on memcpy(dst, src, 0) to be a no-op 391 * when handling commands that have a no-payload reply 392 */ 393 memcpy(reply->data, &data[2], reply->length); 394 complete(&reply->received); 395 sp->reply = NULL; 396 } else { 397 dev_err(dev, "Ignoring incorrect reply\n"); 398 dev_dbg(dev, "Code: expected = 0x%08x received = 0x%08x\n", 399 reply->code, data[0]); 400 dev_dbg(dev, "ACK ID: expected = 0x%08x received = 0x%08x\n", 401 reply->ackid, data[1]); 402 dev_dbg(dev, "Length: expected = %zu received = %zu\n", 403 reply->length, payload_length); 404 } 405 } 406 407 mutex_unlock(&sp->reply_lock); 408 } 409 410 static void rave_sp_receive_frame(struct rave_sp *sp, 411 const unsigned char *data, 412 size_t length) 413 { 414 const size_t checksum_length = sp->variant->checksum->length; 415 const size_t payload_length = length - checksum_length; 416 const u8 *crc_reported = &data[payload_length]; 417 struct device *dev = &sp->serdev->dev; 418 u8 crc_calculated[checksum_length]; 419 420 print_hex_dump(KERN_DEBUG, "rave-sp rx: ", DUMP_PREFIX_NONE, 421 16, 1, data, length, false); 422 423 if (unlikely(length <= checksum_length)) { 424 dev_warn(dev, "Dropping short frame\n"); 425 return; 426 } 427 428 sp->variant->checksum->subroutine(data, payload_length, 429 crc_calculated); 430 431 if (memcmp(crc_calculated, crc_reported, checksum_length)) { 432 dev_warn(dev, "Dropping bad frame\n"); 433 return; 434 } 435 436 if (rave_sp_id_is_event(data[0])) 437 rave_sp_receive_event(sp, data, length); 438 else 439 rave_sp_receive_reply(sp, data, length); 440 } 441 442 static int rave_sp_receive_buf(struct serdev_device *serdev, 443 const unsigned char *buf, size_t size) 444 { 445 struct device *dev = &serdev->dev; 446 struct rave_sp *sp = dev_get_drvdata(dev); 447 struct rave_sp_deframer *deframer = &sp->deframer; 448 const unsigned char *src = buf; 449 const unsigned char *end = buf + size; 450 451 while (src < end) { 452 const unsigned char byte = *src++; 453 454 switch (deframer->state) { 455 case RAVE_SP_EXPECT_SOF: 456 if (byte == RAVE_SP_STX) 457 deframer->state = RAVE_SP_EXPECT_DATA; 458 break; 459 460 case RAVE_SP_EXPECT_DATA: 461 /* 462 * Treat special byte values first 463 */ 464 switch (byte) { 465 case RAVE_SP_ETX: 466 rave_sp_receive_frame(sp, 467 deframer->data, 468 deframer->length); 469 /* 470 * Once we extracted a complete frame 471 * out of a stream, we call it done 472 * and proceed to bailing out while 473 * resetting the framer to initial 474 * state, regardless if we've consumed 475 * all of the stream or not. 476 */ 477 goto reset_framer; 478 case RAVE_SP_STX: 479 dev_warn(dev, "Bad frame: STX before ETX\n"); 480 /* 481 * If we encounter second "start of 482 * the frame" marker before seeing 483 * corresponding "end of frame", we 484 * reset the framer and ignore both: 485 * frame started by first SOF and 486 * frame started by current SOF. 487 * 488 * NOTE: The above means that only the 489 * frame started by third SOF, sent 490 * after this one will have a chance 491 * to get throught. 492 */ 493 goto reset_framer; 494 case RAVE_SP_DLE: 495 deframer->state = RAVE_SP_EXPECT_ESCAPED_DATA; 496 /* 497 * If we encounter escape sequence we 498 * need to skip it and collect the 499 * byte that follows. We do it by 500 * forcing the next iteration of the 501 * encompassing while loop. 502 */ 503 continue; 504 } 505 /* 506 * For the rest of the bytes, that are not 507 * speical snoflakes, we do the same thing 508 * that we do to escaped data - collect it in 509 * deframer buffer 510 */ 511 512 /* FALLTHROUGH */ 513 514 case RAVE_SP_EXPECT_ESCAPED_DATA: 515 deframer->data[deframer->length++] = byte; 516 517 if (deframer->length == sizeof(deframer->data)) { 518 dev_warn(dev, "Bad frame: Too long\n"); 519 /* 520 * If the amount of data we've 521 * accumulated for current frame so 522 * far starts to exceed the capacity 523 * of deframer's buffer, there's 524 * nothing else we can do but to 525 * discard that data and start 526 * assemblying a new frame again 527 */ 528 goto reset_framer; 529 } 530 531 /* 532 * We've extracted out special byte, now we 533 * can go back to regular data collecting 534 */ 535 deframer->state = RAVE_SP_EXPECT_DATA; 536 break; 537 } 538 } 539 540 /* 541 * The only way to get out of the above loop and end up here 542 * is throught consuming all of the supplied data, so here we 543 * report that we processed it all. 544 */ 545 return size; 546 547 reset_framer: 548 /* 549 * NOTE: A number of codepaths that will drop us here will do 550 * so before consuming all 'size' bytes of the data passed by 551 * serdev layer. We rely on the fact that serdev layer will 552 * re-execute this handler with the remainder of the Rx bytes 553 * once we report actual number of bytes that we processed. 554 */ 555 deframer->state = RAVE_SP_EXPECT_SOF; 556 deframer->length = 0; 557 558 return src - buf; 559 } 560 561 static int rave_sp_rdu1_cmd_translate(enum rave_sp_command command) 562 { 563 if (command >= RAVE_SP_CMD_STATUS && 564 command <= RAVE_SP_CMD_CONTROL_EVENTS) 565 return command; 566 567 return -EINVAL; 568 } 569 570 static int rave_sp_rdu2_cmd_translate(enum rave_sp_command command) 571 { 572 if (command >= RAVE_SP_CMD_GET_FIRMWARE_VERSION && 573 command <= RAVE_SP_CMD_GET_GPIO_STATE) 574 return command; 575 576 if (command == RAVE_SP_CMD_REQ_COPPER_REV) { 577 /* 578 * As per RDU2 ICD 3.4.47 CMD_GET_COPPER_REV code is 579 * different from that for RDU1 and it is set to 0x28. 580 */ 581 return 0x28; 582 } 583 584 return rave_sp_rdu1_cmd_translate(command); 585 } 586 587 static int rave_sp_default_cmd_translate(enum rave_sp_command command) 588 { 589 /* 590 * All of the following command codes were taken from "Table : 591 * Communications Protocol Message Types" in section 3.3 592 * "MESSAGE TYPES" of Rave PIC24 ICD. 593 */ 594 switch (command) { 595 case RAVE_SP_CMD_GET_FIRMWARE_VERSION: 596 return 0x11; 597 case RAVE_SP_CMD_GET_BOOTLOADER_VERSION: 598 return 0x12; 599 case RAVE_SP_CMD_BOOT_SOURCE: 600 return 0x14; 601 case RAVE_SP_CMD_SW_WDT: 602 return 0x1C; 603 case RAVE_SP_CMD_RESET: 604 return 0x1E; 605 case RAVE_SP_CMD_RESET_REASON: 606 return 0x1F; 607 default: 608 return -EINVAL; 609 } 610 } 611 612 static const struct rave_sp_checksum rave_sp_checksum_8b2c = { 613 .length = 1, 614 .subroutine = csum_8b2c, 615 }; 616 617 static const struct rave_sp_checksum rave_sp_checksum_ccitt = { 618 .length = 2, 619 .subroutine = csum_ccitt, 620 }; 621 622 static const struct rave_sp_variant rave_sp_legacy = { 623 .checksum = &rave_sp_checksum_8b2c, 624 .cmd = { 625 .translate = rave_sp_default_cmd_translate, 626 }, 627 }; 628 629 static const struct rave_sp_variant rave_sp_rdu1 = { 630 .checksum = &rave_sp_checksum_8b2c, 631 .cmd = { 632 .translate = rave_sp_rdu1_cmd_translate, 633 }, 634 }; 635 636 static const struct rave_sp_variant rave_sp_rdu2 = { 637 .checksum = &rave_sp_checksum_ccitt, 638 .cmd = { 639 .translate = rave_sp_rdu2_cmd_translate, 640 }, 641 }; 642 643 static const struct of_device_id rave_sp_dt_ids[] = { 644 { .compatible = "zii,rave-sp-niu", .data = &rave_sp_legacy }, 645 { .compatible = "zii,rave-sp-mezz", .data = &rave_sp_legacy }, 646 { .compatible = "zii,rave-sp-esb", .data = &rave_sp_legacy }, 647 { .compatible = "zii,rave-sp-rdu1", .data = &rave_sp_rdu1 }, 648 { .compatible = "zii,rave-sp-rdu2", .data = &rave_sp_rdu2 }, 649 { /* sentinel */ } 650 }; 651 652 static const struct serdev_device_ops rave_sp_serdev_device_ops = { 653 .receive_buf = rave_sp_receive_buf, 654 .write_wakeup = serdev_device_write_wakeup, 655 }; 656 657 static int rave_sp_probe(struct serdev_device *serdev) 658 { 659 struct device *dev = &serdev->dev; 660 struct rave_sp *sp; 661 u32 baud; 662 int ret; 663 664 if (of_property_read_u32(dev->of_node, "current-speed", &baud)) { 665 dev_err(dev, 666 "'current-speed' is not specified in device node\n"); 667 return -EINVAL; 668 } 669 670 sp = devm_kzalloc(dev, sizeof(*sp), GFP_KERNEL); 671 if (!sp) 672 return -ENOMEM; 673 674 sp->serdev = serdev; 675 dev_set_drvdata(dev, sp); 676 677 sp->variant = of_device_get_match_data(dev); 678 if (!sp->variant) 679 return -ENODEV; 680 681 mutex_init(&sp->bus_lock); 682 mutex_init(&sp->reply_lock); 683 BLOCKING_INIT_NOTIFIER_HEAD(&sp->event_notifier_list); 684 685 serdev_device_set_client_ops(serdev, &rave_sp_serdev_device_ops); 686 ret = devm_serdev_device_open(dev, serdev); 687 if (ret) 688 return ret; 689 690 serdev_device_set_baudrate(serdev, baud); 691 692 return devm_of_platform_populate(dev); 693 } 694 695 MODULE_DEVICE_TABLE(of, rave_sp_dt_ids); 696 697 static struct serdev_device_driver rave_sp_drv = { 698 .probe = rave_sp_probe, 699 .driver = { 700 .name = "rave-sp", 701 .of_match_table = rave_sp_dt_ids, 702 }, 703 }; 704 module_serdev_device_driver(rave_sp_drv); 705 706 MODULE_LICENSE("GPL"); 707 MODULE_AUTHOR("Andrey Vostrikov <andrey.vostrikov@cogentembedded.com>"); 708 MODULE_AUTHOR("Nikita Yushchenko <nikita.yoush@cogentembedded.com>"); 709 MODULE_AUTHOR("Andrey Smirnov <andrew.smirnov@gmail.com>"); 710 MODULE_DESCRIPTION("RAVE SP core driver"); 711