xref: /openbmc/linux/drivers/nfc/pn544/i2c.c (revision b830f94f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * I2C Link Layer for PN544 HCI based Driver
4  *
5  * Copyright (C) 2012  Intel Corporation. All rights reserved.
6  */
7 
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9 
10 #include <linux/crc-ccitt.h>
11 #include <linux/module.h>
12 #include <linux/i2c.h>
13 #include <linux/acpi.h>
14 #include <linux/interrupt.h>
15 #include <linux/delay.h>
16 #include <linux/nfc.h>
17 #include <linux/firmware.h>
18 #include <linux/gpio/consumer.h>
19 
20 #include <asm/unaligned.h>
21 
22 #include <net/nfc/hci.h>
23 #include <net/nfc/llc.h>
24 #include <net/nfc/nfc.h>
25 
26 #include "pn544.h"
27 
28 #define PN544_I2C_FRAME_HEADROOM 1
29 #define PN544_I2C_FRAME_TAILROOM 2
30 
31 /* GPIO names */
32 #define PN544_GPIO_NAME_IRQ "pn544_irq"
33 #define PN544_GPIO_NAME_FW  "pn544_fw"
34 #define PN544_GPIO_NAME_EN  "pn544_en"
35 
36 /* framing in HCI mode */
37 #define PN544_HCI_I2C_LLC_LEN		1
38 #define PN544_HCI_I2C_LLC_CRC		2
39 #define PN544_HCI_I2C_LLC_LEN_CRC	(PN544_HCI_I2C_LLC_LEN + \
40 					 PN544_HCI_I2C_LLC_CRC)
41 #define PN544_HCI_I2C_LLC_MIN_SIZE	(1 + PN544_HCI_I2C_LLC_LEN_CRC)
42 #define PN544_HCI_I2C_LLC_MAX_PAYLOAD	29
43 #define PN544_HCI_I2C_LLC_MAX_SIZE	(PN544_HCI_I2C_LLC_LEN_CRC + 1 + \
44 					 PN544_HCI_I2C_LLC_MAX_PAYLOAD)
45 
46 static const struct i2c_device_id pn544_hci_i2c_id_table[] = {
47 	{"pn544", 0},
48 	{}
49 };
50 
51 MODULE_DEVICE_TABLE(i2c, pn544_hci_i2c_id_table);
52 
53 static const struct acpi_device_id pn544_hci_i2c_acpi_match[] = {
54 	{"NXP5440", 0},
55 	{}
56 };
57 
58 MODULE_DEVICE_TABLE(acpi, pn544_hci_i2c_acpi_match);
59 
60 #define PN544_HCI_I2C_DRIVER_NAME "pn544_hci_i2c"
61 
62 /*
63  * Exposed through the 4 most significant bytes
64  * from the HCI SW_VERSION first byte, a.k.a.
65  * SW RomLib.
66  */
67 #define PN544_HW_VARIANT_C2 0xa
68 #define PN544_HW_VARIANT_C3 0xb
69 
70 #define PN544_FW_CMD_RESET 0x01
71 #define PN544_FW_CMD_WRITE 0x08
72 #define PN544_FW_CMD_CHECK 0x06
73 #define PN544_FW_CMD_SECURE_WRITE 0x0C
74 #define PN544_FW_CMD_SECURE_CHUNK_WRITE 0x0D
75 
76 struct pn544_i2c_fw_frame_write {
77 	u8 cmd;
78 	u16 be_length;
79 	u8 be_dest_addr[3];
80 	u16 be_datalen;
81 	u8 data[];
82 } __packed;
83 
84 struct pn544_i2c_fw_frame_check {
85 	u8 cmd;
86 	u16 be_length;
87 	u8 be_start_addr[3];
88 	u16 be_datalen;
89 	u16 be_crc;
90 } __packed;
91 
92 struct pn544_i2c_fw_frame_response {
93 	u8 status;
94 	u16 be_length;
95 } __packed;
96 
97 struct pn544_i2c_fw_blob {
98 	u32 be_size;
99 	u32 be_destaddr;
100 	u8 data[];
101 };
102 
103 struct pn544_i2c_fw_secure_frame {
104 	u8 cmd;
105 	u16 be_datalen;
106 	u8 data[];
107 } __packed;
108 
109 struct pn544_i2c_fw_secure_blob {
110 	u64 header;
111 	u8 data[];
112 };
113 
114 #define PN544_FW_CMD_RESULT_TIMEOUT 0x01
115 #define PN544_FW_CMD_RESULT_BAD_CRC 0x02
116 #define PN544_FW_CMD_RESULT_ACCESS_DENIED 0x08
117 #define PN544_FW_CMD_RESULT_PROTOCOL_ERROR 0x0B
118 #define PN544_FW_CMD_RESULT_INVALID_PARAMETER 0x11
119 #define PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND 0x13
120 #define PN544_FW_CMD_RESULT_INVALID_LENGTH 0x18
121 #define PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR 0x19
122 #define PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR 0x1D
123 #define PN544_FW_CMD_RESULT_MEMORY_ERROR 0x20
124 #define PN544_FW_CMD_RESULT_CHUNK_OK 0x21
125 #define PN544_FW_CMD_RESULT_WRITE_FAILED 0x74
126 #define PN544_FW_CMD_RESULT_COMMAND_REJECTED 0xE0
127 #define PN544_FW_CMD_RESULT_CHUNK_ERROR 0xE6
128 
129 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
130 
131 #define PN544_FW_WRITE_BUFFER_MAX_LEN 0x9f7
132 #define PN544_FW_I2C_MAX_PAYLOAD PN544_HCI_I2C_LLC_MAX_SIZE
133 #define PN544_FW_I2C_WRITE_FRAME_HEADER_LEN 8
134 #define PN544_FW_I2C_WRITE_DATA_MAX_LEN MIN((PN544_FW_I2C_MAX_PAYLOAD -\
135 					 PN544_FW_I2C_WRITE_FRAME_HEADER_LEN),\
136 					 PN544_FW_WRITE_BUFFER_MAX_LEN)
137 #define PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN 3
138 #define PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN (PN544_FW_I2C_MAX_PAYLOAD -\
139 			PN544_FW_SECURE_CHUNK_WRITE_HEADER_LEN)
140 #define PN544_FW_SECURE_FRAME_HEADER_LEN 3
141 #define PN544_FW_SECURE_BLOB_HEADER_LEN 8
142 
143 #define FW_WORK_STATE_IDLE 1
144 #define FW_WORK_STATE_START 2
145 #define FW_WORK_STATE_WAIT_WRITE_ANSWER 3
146 #define FW_WORK_STATE_WAIT_CHECK_ANSWER 4
147 #define FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER 5
148 
149 struct pn544_i2c_phy {
150 	struct i2c_client *i2c_dev;
151 	struct nfc_hci_dev *hdev;
152 
153 	struct gpio_desc *gpiod_en;
154 	struct gpio_desc *gpiod_fw;
155 
156 	unsigned int en_polarity;
157 
158 	u8 hw_variant;
159 
160 	struct work_struct fw_work;
161 	int fw_work_state;
162 	char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
163 	const struct firmware *fw;
164 	u32 fw_blob_dest_addr;
165 	size_t fw_blob_size;
166 	const u8 *fw_blob_data;
167 	size_t fw_written;
168 	size_t fw_size;
169 
170 	int fw_cmd_result;
171 
172 	int powered;
173 	int run_mode;
174 
175 	int hard_fault;		/*
176 				 * < 0 if hardware error occured (e.g. i2c err)
177 				 * and prevents normal operation.
178 				 */
179 };
180 
181 #define I2C_DUMP_SKB(info, skb)					\
182 do {								\
183 	pr_debug("%s:\n", info);				\
184 	print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET,	\
185 		       16, 1, (skb)->data, (skb)->len, 0);	\
186 } while (0)
187 
188 static void pn544_hci_i2c_platform_init(struct pn544_i2c_phy *phy)
189 {
190 	int polarity, retry, ret;
191 	char rset_cmd[] = { 0x05, 0xF9, 0x04, 0x00, 0xC3, 0xE5 };
192 	int count = sizeof(rset_cmd);
193 
194 	nfc_info(&phy->i2c_dev->dev, "Detecting nfc_en polarity\n");
195 
196 	/* Disable fw download */
197 	gpiod_set_value_cansleep(phy->gpiod_fw, 0);
198 
199 	for (polarity = 0; polarity < 2; polarity++) {
200 		phy->en_polarity = polarity;
201 		retry = 3;
202 		while (retry--) {
203 			/* power off */
204 			gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
205 			usleep_range(10000, 15000);
206 
207 			/* power on */
208 			gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
209 			usleep_range(10000, 15000);
210 
211 			/* send reset */
212 			dev_dbg(&phy->i2c_dev->dev, "Sending reset cmd\n");
213 			ret = i2c_master_send(phy->i2c_dev, rset_cmd, count);
214 			if (ret == count) {
215 				nfc_info(&phy->i2c_dev->dev,
216 					 "nfc_en polarity : active %s\n",
217 					 (polarity == 0 ? "low" : "high"));
218 				goto out;
219 			}
220 		}
221 	}
222 
223 	nfc_err(&phy->i2c_dev->dev,
224 		"Could not detect nfc_en polarity, fallback to active high\n");
225 
226 out:
227 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
228 }
229 
230 static void pn544_hci_i2c_enable_mode(struct pn544_i2c_phy *phy, int run_mode)
231 {
232 	gpiod_set_value_cansleep(phy->gpiod_fw, run_mode == PN544_FW_MODE ? 1 : 0);
233 	gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
234 	usleep_range(10000, 15000);
235 
236 	phy->run_mode = run_mode;
237 }
238 
239 static int pn544_hci_i2c_enable(void *phy_id)
240 {
241 	struct pn544_i2c_phy *phy = phy_id;
242 
243 	pr_info("%s\n", __func__);
244 
245 	pn544_hci_i2c_enable_mode(phy, PN544_HCI_MODE);
246 
247 	phy->powered = 1;
248 
249 	return 0;
250 }
251 
252 static void pn544_hci_i2c_disable(void *phy_id)
253 {
254 	struct pn544_i2c_phy *phy = phy_id;
255 
256 	gpiod_set_value_cansleep(phy->gpiod_fw, 0);
257 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
258 	usleep_range(10000, 15000);
259 
260 	gpiod_set_value_cansleep(phy->gpiod_en, phy->en_polarity);
261 	usleep_range(10000, 15000);
262 
263 	gpiod_set_value_cansleep(phy->gpiod_en, !phy->en_polarity);
264 	usleep_range(10000, 15000);
265 
266 	phy->powered = 0;
267 }
268 
269 static void pn544_hci_i2c_add_len_crc(struct sk_buff *skb)
270 {
271 	u16 crc;
272 	int len;
273 
274 	len = skb->len + 2;
275 	*(u8 *)skb_push(skb, 1) = len;
276 
277 	crc = crc_ccitt(0xffff, skb->data, skb->len);
278 	crc = ~crc;
279 	skb_put_u8(skb, crc & 0xff);
280 	skb_put_u8(skb, crc >> 8);
281 }
282 
283 static void pn544_hci_i2c_remove_len_crc(struct sk_buff *skb)
284 {
285 	skb_pull(skb, PN544_I2C_FRAME_HEADROOM);
286 	skb_trim(skb, PN544_I2C_FRAME_TAILROOM);
287 }
288 
289 /*
290  * Writing a frame must not return the number of written bytes.
291  * It must return either zero for success, or <0 for error.
292  * In addition, it must not alter the skb
293  */
294 static int pn544_hci_i2c_write(void *phy_id, struct sk_buff *skb)
295 {
296 	int r;
297 	struct pn544_i2c_phy *phy = phy_id;
298 	struct i2c_client *client = phy->i2c_dev;
299 
300 	if (phy->hard_fault != 0)
301 		return phy->hard_fault;
302 
303 	usleep_range(3000, 6000);
304 
305 	pn544_hci_i2c_add_len_crc(skb);
306 
307 	I2C_DUMP_SKB("i2c frame written", skb);
308 
309 	r = i2c_master_send(client, skb->data, skb->len);
310 
311 	if (r == -EREMOTEIO) {	/* Retry, chip was in standby */
312 		usleep_range(6000, 10000);
313 		r = i2c_master_send(client, skb->data, skb->len);
314 	}
315 
316 	if (r >= 0) {
317 		if (r != skb->len)
318 			r = -EREMOTEIO;
319 		else
320 			r = 0;
321 	}
322 
323 	pn544_hci_i2c_remove_len_crc(skb);
324 
325 	return r;
326 }
327 
328 static int check_crc(u8 *buf, int buflen)
329 {
330 	int len;
331 	u16 crc;
332 
333 	len = buf[0] + 1;
334 	crc = crc_ccitt(0xffff, buf, len - 2);
335 	crc = ~crc;
336 
337 	if (buf[len - 2] != (crc & 0xff) || buf[len - 1] != (crc >> 8)) {
338 		pr_err("CRC error 0x%x != 0x%x 0x%x\n",
339 		       crc, buf[len - 1], buf[len - 2]);
340 		pr_info("%s: BAD CRC\n", __func__);
341 		print_hex_dump(KERN_DEBUG, "crc: ", DUMP_PREFIX_NONE,
342 			       16, 2, buf, buflen, false);
343 		return -EPERM;
344 	}
345 	return 0;
346 }
347 
348 /*
349  * Reads an shdlc frame and returns it in a newly allocated sk_buff. Guarantees
350  * that i2c bus will be flushed and that next read will start on a new frame.
351  * returned skb contains only LLC header and payload.
352  * returns:
353  * -EREMOTEIO : i2c read error (fatal)
354  * -EBADMSG : frame was incorrect and discarded
355  * -ENOMEM : cannot allocate skb, frame dropped
356  */
357 static int pn544_hci_i2c_read(struct pn544_i2c_phy *phy, struct sk_buff **skb)
358 {
359 	int r;
360 	u8 len;
361 	u8 tmp[PN544_HCI_I2C_LLC_MAX_SIZE - 1];
362 	struct i2c_client *client = phy->i2c_dev;
363 
364 	r = i2c_master_recv(client, &len, 1);
365 	if (r != 1) {
366 		nfc_err(&client->dev, "cannot read len byte\n");
367 		return -EREMOTEIO;
368 	}
369 
370 	if ((len < (PN544_HCI_I2C_LLC_MIN_SIZE - 1)) ||
371 	    (len > (PN544_HCI_I2C_LLC_MAX_SIZE - 1))) {
372 		nfc_err(&client->dev, "invalid len byte\n");
373 		r = -EBADMSG;
374 		goto flush;
375 	}
376 
377 	*skb = alloc_skb(1 + len, GFP_KERNEL);
378 	if (*skb == NULL) {
379 		r = -ENOMEM;
380 		goto flush;
381 	}
382 
383 	skb_put_u8(*skb, len);
384 
385 	r = i2c_master_recv(client, skb_put(*skb, len), len);
386 	if (r != len) {
387 		kfree_skb(*skb);
388 		return -EREMOTEIO;
389 	}
390 
391 	I2C_DUMP_SKB("i2c frame read", *skb);
392 
393 	r = check_crc((*skb)->data, (*skb)->len);
394 	if (r != 0) {
395 		kfree_skb(*skb);
396 		r = -EBADMSG;
397 		goto flush;
398 	}
399 
400 	skb_pull(*skb, 1);
401 	skb_trim(*skb, (*skb)->len - 2);
402 
403 	usleep_range(3000, 6000);
404 
405 	return 0;
406 
407 flush:
408 	if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
409 		r = -EREMOTEIO;
410 
411 	usleep_range(3000, 6000);
412 
413 	return r;
414 }
415 
416 static int pn544_hci_i2c_fw_read_status(struct pn544_i2c_phy *phy)
417 {
418 	int r;
419 	struct pn544_i2c_fw_frame_response response;
420 	struct i2c_client *client = phy->i2c_dev;
421 
422 	r = i2c_master_recv(client, (char *) &response, sizeof(response));
423 	if (r != sizeof(response)) {
424 		nfc_err(&client->dev, "cannot read fw status\n");
425 		return -EIO;
426 	}
427 
428 	usleep_range(3000, 6000);
429 
430 	switch (response.status) {
431 	case 0:
432 		return 0;
433 	case PN544_FW_CMD_RESULT_CHUNK_OK:
434 		return response.status;
435 	case PN544_FW_CMD_RESULT_TIMEOUT:
436 		return -ETIMEDOUT;
437 	case PN544_FW_CMD_RESULT_BAD_CRC:
438 		return -ENODATA;
439 	case PN544_FW_CMD_RESULT_ACCESS_DENIED:
440 		return -EACCES;
441 	case PN544_FW_CMD_RESULT_PROTOCOL_ERROR:
442 		return -EPROTO;
443 	case PN544_FW_CMD_RESULT_INVALID_PARAMETER:
444 		return -EINVAL;
445 	case PN544_FW_CMD_RESULT_UNSUPPORTED_COMMAND:
446 		return -ENOTSUPP;
447 	case PN544_FW_CMD_RESULT_INVALID_LENGTH:
448 		return -EBADMSG;
449 	case PN544_FW_CMD_RESULT_CRYPTOGRAPHIC_ERROR:
450 		return -ENOKEY;
451 	case PN544_FW_CMD_RESULT_VERSION_CONDITIONS_ERROR:
452 		return -EINVAL;
453 	case PN544_FW_CMD_RESULT_MEMORY_ERROR:
454 		return -ENOMEM;
455 	case PN544_FW_CMD_RESULT_COMMAND_REJECTED:
456 		return -EACCES;
457 	case PN544_FW_CMD_RESULT_WRITE_FAILED:
458 	case PN544_FW_CMD_RESULT_CHUNK_ERROR:
459 		return -EIO;
460 	default:
461 		return -EIO;
462 	}
463 }
464 
465 /*
466  * Reads an shdlc frame from the chip. This is not as straightforward as it
467  * seems. There are cases where we could loose the frame start synchronization.
468  * The frame format is len-data-crc, and corruption can occur anywhere while
469  * transiting on i2c bus, such that we could read an invalid len.
470  * In order to recover synchronization with the next frame, we must be sure
471  * to read the real amount of data without using the len byte. We do this by
472  * assuming the following:
473  * - the chip will always present only one single complete frame on the bus
474  *   before triggering the interrupt
475  * - the chip will not present a new frame until we have completely read
476  *   the previous one (or until we have handled the interrupt).
477  * The tricky case is when we read a corrupted len that is less than the real
478  * len. We must detect this here in order to determine that we need to flush
479  * the bus. This is the reason why we check the crc here.
480  */
481 static irqreturn_t pn544_hci_i2c_irq_thread_fn(int irq, void *phy_id)
482 {
483 	struct pn544_i2c_phy *phy = phy_id;
484 	struct i2c_client *client;
485 	struct sk_buff *skb = NULL;
486 	int r;
487 
488 	if (!phy || irq != phy->i2c_dev->irq) {
489 		WARN_ON_ONCE(1);
490 		return IRQ_NONE;
491 	}
492 
493 	client = phy->i2c_dev;
494 	dev_dbg(&client->dev, "IRQ\n");
495 
496 	if (phy->hard_fault != 0)
497 		return IRQ_HANDLED;
498 
499 	if (phy->run_mode == PN544_FW_MODE) {
500 		phy->fw_cmd_result = pn544_hci_i2c_fw_read_status(phy);
501 		schedule_work(&phy->fw_work);
502 	} else {
503 		r = pn544_hci_i2c_read(phy, &skb);
504 		if (r == -EREMOTEIO) {
505 			phy->hard_fault = r;
506 
507 			nfc_hci_recv_frame(phy->hdev, NULL);
508 
509 			return IRQ_HANDLED;
510 		} else if ((r == -ENOMEM) || (r == -EBADMSG)) {
511 			return IRQ_HANDLED;
512 		}
513 
514 		nfc_hci_recv_frame(phy->hdev, skb);
515 	}
516 	return IRQ_HANDLED;
517 }
518 
519 static struct nfc_phy_ops i2c_phy_ops = {
520 	.write = pn544_hci_i2c_write,
521 	.enable = pn544_hci_i2c_enable,
522 	.disable = pn544_hci_i2c_disable,
523 };
524 
525 static int pn544_hci_i2c_fw_download(void *phy_id, const char *firmware_name,
526 					u8 hw_variant)
527 {
528 	struct pn544_i2c_phy *phy = phy_id;
529 
530 	pr_info("Starting Firmware Download (%s)\n", firmware_name);
531 
532 	strcpy(phy->firmware_name, firmware_name);
533 
534 	phy->hw_variant = hw_variant;
535 	phy->fw_work_state = FW_WORK_STATE_START;
536 
537 	schedule_work(&phy->fw_work);
538 
539 	return 0;
540 }
541 
542 static void pn544_hci_i2c_fw_work_complete(struct pn544_i2c_phy *phy,
543 					   int result)
544 {
545 	pr_info("Firmware Download Complete, result=%d\n", result);
546 
547 	pn544_hci_i2c_disable(phy);
548 
549 	phy->fw_work_state = FW_WORK_STATE_IDLE;
550 
551 	if (phy->fw) {
552 		release_firmware(phy->fw);
553 		phy->fw = NULL;
554 	}
555 
556 	nfc_fw_download_done(phy->hdev->ndev, phy->firmware_name, (u32) -result);
557 }
558 
559 static int pn544_hci_i2c_fw_write_cmd(struct i2c_client *client, u32 dest_addr,
560 				      const u8 *data, u16 datalen)
561 {
562 	u8 frame[PN544_FW_I2C_MAX_PAYLOAD];
563 	struct pn544_i2c_fw_frame_write *framep;
564 	u16 params_len;
565 	int framelen;
566 	int r;
567 
568 	if (datalen > PN544_FW_I2C_WRITE_DATA_MAX_LEN)
569 		datalen = PN544_FW_I2C_WRITE_DATA_MAX_LEN;
570 
571 	framep = (struct pn544_i2c_fw_frame_write *) frame;
572 
573 	params_len = sizeof(framep->be_dest_addr) +
574 		     sizeof(framep->be_datalen) + datalen;
575 	framelen = params_len + sizeof(framep->cmd) +
576 			     sizeof(framep->be_length);
577 
578 	framep->cmd = PN544_FW_CMD_WRITE;
579 
580 	put_unaligned_be16(params_len, &framep->be_length);
581 
582 	framep->be_dest_addr[0] = (dest_addr & 0xff0000) >> 16;
583 	framep->be_dest_addr[1] = (dest_addr & 0xff00) >> 8;
584 	framep->be_dest_addr[2] = dest_addr & 0xff;
585 
586 	put_unaligned_be16(datalen, &framep->be_datalen);
587 
588 	memcpy(framep->data, data, datalen);
589 
590 	r = i2c_master_send(client, frame, framelen);
591 
592 	if (r == framelen)
593 		return datalen;
594 	else if (r < 0)
595 		return r;
596 	else
597 		return -EIO;
598 }
599 
600 static int pn544_hci_i2c_fw_check_cmd(struct i2c_client *client, u32 start_addr,
601 				      const u8 *data, u16 datalen)
602 {
603 	struct pn544_i2c_fw_frame_check frame;
604 	int r;
605 	u16 crc;
606 
607 	/* calculate local crc for the data we want to check */
608 	crc = crc_ccitt(0xffff, data, datalen);
609 
610 	frame.cmd = PN544_FW_CMD_CHECK;
611 
612 	put_unaligned_be16(sizeof(frame.be_start_addr) +
613 			   sizeof(frame.be_datalen) + sizeof(frame.be_crc),
614 			   &frame.be_length);
615 
616 	/* tell the chip the memory region to which our crc applies */
617 	frame.be_start_addr[0] = (start_addr & 0xff0000) >> 16;
618 	frame.be_start_addr[1] = (start_addr & 0xff00) >> 8;
619 	frame.be_start_addr[2] = start_addr & 0xff;
620 
621 	put_unaligned_be16(datalen, &frame.be_datalen);
622 
623 	/*
624 	 * and give our local crc. Chip will calculate its own crc for the
625 	 * region and compare with ours.
626 	 */
627 	put_unaligned_be16(crc, &frame.be_crc);
628 
629 	r = i2c_master_send(client, (const char *) &frame, sizeof(frame));
630 
631 	if (r == sizeof(frame))
632 		return 0;
633 	else if (r < 0)
634 		return r;
635 	else
636 		return -EIO;
637 }
638 
639 static int pn544_hci_i2c_fw_write_chunk(struct pn544_i2c_phy *phy)
640 {
641 	int r;
642 
643 	r = pn544_hci_i2c_fw_write_cmd(phy->i2c_dev,
644 				       phy->fw_blob_dest_addr + phy->fw_written,
645 				       phy->fw_blob_data + phy->fw_written,
646 				       phy->fw_blob_size - phy->fw_written);
647 	if (r < 0)
648 		return r;
649 
650 	phy->fw_written += r;
651 	phy->fw_work_state = FW_WORK_STATE_WAIT_WRITE_ANSWER;
652 
653 	return 0;
654 }
655 
656 static int pn544_hci_i2c_fw_secure_write_frame_cmd(struct pn544_i2c_phy *phy,
657 					const u8 *data, u16 datalen)
658 {
659 	u8 buf[PN544_FW_I2C_MAX_PAYLOAD];
660 	struct pn544_i2c_fw_secure_frame *chunk;
661 	int chunklen;
662 	int r;
663 
664 	if (datalen > PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN)
665 		datalen = PN544_FW_SECURE_CHUNK_WRITE_DATA_MAX_LEN;
666 
667 	chunk = (struct pn544_i2c_fw_secure_frame *) buf;
668 
669 	chunk->cmd = PN544_FW_CMD_SECURE_CHUNK_WRITE;
670 
671 	put_unaligned_be16(datalen, &chunk->be_datalen);
672 
673 	memcpy(chunk->data, data, datalen);
674 
675 	chunklen = sizeof(chunk->cmd) + sizeof(chunk->be_datalen) + datalen;
676 
677 	r = i2c_master_send(phy->i2c_dev, buf, chunklen);
678 
679 	if (r == chunklen)
680 		return datalen;
681 	else if (r < 0)
682 		return r;
683 	else
684 		return -EIO;
685 
686 }
687 
688 static int pn544_hci_i2c_fw_secure_write_frame(struct pn544_i2c_phy *phy)
689 {
690 	struct pn544_i2c_fw_secure_frame *framep;
691 	int r;
692 
693 	framep = (struct pn544_i2c_fw_secure_frame *) phy->fw_blob_data;
694 	if (phy->fw_written == 0)
695 		phy->fw_blob_size = get_unaligned_be16(&framep->be_datalen)
696 				+ PN544_FW_SECURE_FRAME_HEADER_LEN;
697 
698 	/* Only secure write command can be chunked*/
699 	if (phy->fw_blob_size > PN544_FW_I2C_MAX_PAYLOAD &&
700 			framep->cmd != PN544_FW_CMD_SECURE_WRITE)
701 		return -EINVAL;
702 
703 	/* The firmware also have other commands, we just send them directly */
704 	if (phy->fw_blob_size < PN544_FW_I2C_MAX_PAYLOAD) {
705 		r = i2c_master_send(phy->i2c_dev,
706 			(const char *) phy->fw_blob_data, phy->fw_blob_size);
707 
708 		if (r == phy->fw_blob_size)
709 			goto exit;
710 		else if (r < 0)
711 			return r;
712 		else
713 			return -EIO;
714 	}
715 
716 	r = pn544_hci_i2c_fw_secure_write_frame_cmd(phy,
717 				       phy->fw_blob_data + phy->fw_written,
718 				       phy->fw_blob_size - phy->fw_written);
719 	if (r < 0)
720 		return r;
721 
722 exit:
723 	phy->fw_written += r;
724 	phy->fw_work_state = FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER;
725 
726 	/* SW reset command will not trig any response from PN544 */
727 	if (framep->cmd == PN544_FW_CMD_RESET) {
728 		pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
729 		phy->fw_cmd_result = 0;
730 		schedule_work(&phy->fw_work);
731 	}
732 
733 	return 0;
734 }
735 
736 static void pn544_hci_i2c_fw_work(struct work_struct *work)
737 {
738 	struct pn544_i2c_phy *phy = container_of(work, struct pn544_i2c_phy,
739 						fw_work);
740 	int r;
741 	struct pn544_i2c_fw_blob *blob;
742 	struct pn544_i2c_fw_secure_blob *secure_blob;
743 
744 	switch (phy->fw_work_state) {
745 	case FW_WORK_STATE_START:
746 		pn544_hci_i2c_enable_mode(phy, PN544_FW_MODE);
747 
748 		r = request_firmware(&phy->fw, phy->firmware_name,
749 				     &phy->i2c_dev->dev);
750 		if (r < 0)
751 			goto exit_state_start;
752 
753 		phy->fw_written = 0;
754 
755 		switch (phy->hw_variant) {
756 		case PN544_HW_VARIANT_C2:
757 			blob = (struct pn544_i2c_fw_blob *) phy->fw->data;
758 			phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
759 			phy->fw_blob_dest_addr = get_unaligned_be32(
760 							&blob->be_destaddr);
761 			phy->fw_blob_data = blob->data;
762 
763 			r = pn544_hci_i2c_fw_write_chunk(phy);
764 			break;
765 		case PN544_HW_VARIANT_C3:
766 			secure_blob = (struct pn544_i2c_fw_secure_blob *)
767 								phy->fw->data;
768 			phy->fw_blob_data = secure_blob->data;
769 			phy->fw_size = phy->fw->size;
770 			r = pn544_hci_i2c_fw_secure_write_frame(phy);
771 			break;
772 		default:
773 			r = -ENOTSUPP;
774 			break;
775 		}
776 
777 exit_state_start:
778 		if (r < 0)
779 			pn544_hci_i2c_fw_work_complete(phy, r);
780 		break;
781 
782 	case FW_WORK_STATE_WAIT_WRITE_ANSWER:
783 		r = phy->fw_cmd_result;
784 		if (r < 0)
785 			goto exit_state_wait_write_answer;
786 
787 		if (phy->fw_written == phy->fw_blob_size) {
788 			r = pn544_hci_i2c_fw_check_cmd(phy->i2c_dev,
789 						       phy->fw_blob_dest_addr,
790 						       phy->fw_blob_data,
791 						       phy->fw_blob_size);
792 			if (r < 0)
793 				goto exit_state_wait_write_answer;
794 			phy->fw_work_state = FW_WORK_STATE_WAIT_CHECK_ANSWER;
795 			break;
796 		}
797 
798 		r = pn544_hci_i2c_fw_write_chunk(phy);
799 
800 exit_state_wait_write_answer:
801 		if (r < 0)
802 			pn544_hci_i2c_fw_work_complete(phy, r);
803 		break;
804 
805 	case FW_WORK_STATE_WAIT_CHECK_ANSWER:
806 		r = phy->fw_cmd_result;
807 		if (r < 0)
808 			goto exit_state_wait_check_answer;
809 
810 		blob = (struct pn544_i2c_fw_blob *) (phy->fw_blob_data +
811 		       phy->fw_blob_size);
812 		phy->fw_blob_size = get_unaligned_be32(&blob->be_size);
813 		if (phy->fw_blob_size != 0) {
814 			phy->fw_blob_dest_addr =
815 					get_unaligned_be32(&blob->be_destaddr);
816 			phy->fw_blob_data = blob->data;
817 
818 			phy->fw_written = 0;
819 			r = pn544_hci_i2c_fw_write_chunk(phy);
820 		}
821 
822 exit_state_wait_check_answer:
823 		if (r < 0 || phy->fw_blob_size == 0)
824 			pn544_hci_i2c_fw_work_complete(phy, r);
825 		break;
826 
827 	case FW_WORK_STATE_WAIT_SECURE_WRITE_ANSWER:
828 		r = phy->fw_cmd_result;
829 		if (r < 0)
830 			goto exit_state_wait_secure_write_answer;
831 
832 		if (r == PN544_FW_CMD_RESULT_CHUNK_OK) {
833 			r = pn544_hci_i2c_fw_secure_write_frame(phy);
834 			goto exit_state_wait_secure_write_answer;
835 		}
836 
837 		if (phy->fw_written == phy->fw_blob_size) {
838 			secure_blob = (struct pn544_i2c_fw_secure_blob *)
839 				(phy->fw_blob_data + phy->fw_blob_size);
840 			phy->fw_size -= phy->fw_blob_size +
841 				PN544_FW_SECURE_BLOB_HEADER_LEN;
842 			if (phy->fw_size >= PN544_FW_SECURE_BLOB_HEADER_LEN
843 					+ PN544_FW_SECURE_FRAME_HEADER_LEN) {
844 				phy->fw_blob_data = secure_blob->data;
845 
846 				phy->fw_written = 0;
847 				r = pn544_hci_i2c_fw_secure_write_frame(phy);
848 			}
849 		}
850 
851 exit_state_wait_secure_write_answer:
852 		if (r < 0 || phy->fw_size == 0)
853 			pn544_hci_i2c_fw_work_complete(phy, r);
854 		break;
855 
856 	default:
857 		break;
858 	}
859 }
860 
861 static const struct acpi_gpio_params enable_gpios = { 1, 0, false };
862 static const struct acpi_gpio_params firmware_gpios = { 2, 0, false };
863 
864 static const struct acpi_gpio_mapping acpi_pn544_gpios[] = {
865 	{ "enable-gpios", &enable_gpios, 1 },
866 	{ "firmware-gpios", &firmware_gpios, 1 },
867 	{ },
868 };
869 
870 static int pn544_hci_i2c_probe(struct i2c_client *client,
871 			       const struct i2c_device_id *id)
872 {
873 	struct device *dev = &client->dev;
874 	struct pn544_i2c_phy *phy;
875 	int r = 0;
876 
877 	dev_dbg(&client->dev, "%s\n", __func__);
878 	dev_dbg(&client->dev, "IRQ: %d\n", client->irq);
879 
880 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
881 		nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
882 		return -ENODEV;
883 	}
884 
885 	phy = devm_kzalloc(&client->dev, sizeof(struct pn544_i2c_phy),
886 			   GFP_KERNEL);
887 	if (!phy)
888 		return -ENOMEM;
889 
890 	INIT_WORK(&phy->fw_work, pn544_hci_i2c_fw_work);
891 	phy->fw_work_state = FW_WORK_STATE_IDLE;
892 
893 	phy->i2c_dev = client;
894 	i2c_set_clientdata(client, phy);
895 
896 	r = devm_acpi_dev_add_driver_gpios(dev, acpi_pn544_gpios);
897 	if (r)
898 		dev_dbg(dev, "Unable to add GPIO mapping table\n");
899 
900 	/* Get EN GPIO */
901 	phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
902 	if (IS_ERR(phy->gpiod_en)) {
903 		nfc_err(dev, "Unable to get EN GPIO\n");
904 		return PTR_ERR(phy->gpiod_en);
905 	}
906 
907 	/* Get FW GPIO */
908 	phy->gpiod_fw = devm_gpiod_get(dev, "firmware", GPIOD_OUT_LOW);
909 	if (IS_ERR(phy->gpiod_fw)) {
910 		nfc_err(dev, "Unable to get FW GPIO\n");
911 		return PTR_ERR(phy->gpiod_fw);
912 	}
913 
914 	pn544_hci_i2c_platform_init(phy);
915 
916 	r = devm_request_threaded_irq(&client->dev, client->irq, NULL,
917 				      pn544_hci_i2c_irq_thread_fn,
918 				      IRQF_TRIGGER_RISING | IRQF_ONESHOT,
919 				      PN544_HCI_I2C_DRIVER_NAME, phy);
920 	if (r < 0) {
921 		nfc_err(&client->dev, "Unable to register IRQ handler\n");
922 		return r;
923 	}
924 
925 	r = pn544_hci_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
926 			    PN544_I2C_FRAME_HEADROOM, PN544_I2C_FRAME_TAILROOM,
927 			    PN544_HCI_I2C_LLC_MAX_PAYLOAD,
928 			    pn544_hci_i2c_fw_download, &phy->hdev);
929 	if (r < 0)
930 		return r;
931 
932 	return 0;
933 }
934 
935 static int pn544_hci_i2c_remove(struct i2c_client *client)
936 {
937 	struct pn544_i2c_phy *phy = i2c_get_clientdata(client);
938 
939 	dev_dbg(&client->dev, "%s\n", __func__);
940 
941 	cancel_work_sync(&phy->fw_work);
942 	if (phy->fw_work_state != FW_WORK_STATE_IDLE)
943 		pn544_hci_i2c_fw_work_complete(phy, -ENODEV);
944 
945 	pn544_hci_remove(phy->hdev);
946 
947 	if (phy->powered)
948 		pn544_hci_i2c_disable(phy);
949 
950 	return 0;
951 }
952 
953 static const struct of_device_id of_pn544_i2c_match[] = {
954 	{ .compatible = "nxp,pn544-i2c", },
955 	{},
956 };
957 MODULE_DEVICE_TABLE(of, of_pn544_i2c_match);
958 
959 static struct i2c_driver pn544_hci_i2c_driver = {
960 	.driver = {
961 		   .name = PN544_HCI_I2C_DRIVER_NAME,
962 		   .of_match_table = of_match_ptr(of_pn544_i2c_match),
963 		   .acpi_match_table = ACPI_PTR(pn544_hci_i2c_acpi_match),
964 		  },
965 	.probe = pn544_hci_i2c_probe,
966 	.id_table = pn544_hci_i2c_id_table,
967 	.remove = pn544_hci_i2c_remove,
968 };
969 
970 module_i2c_driver(pn544_hci_i2c_driver);
971 
972 MODULE_LICENSE("GPL");
973 MODULE_DESCRIPTION(DRIVER_DESC);
974