linux/drivers/nfc/nxp-nci/i2c.c

363 lines
8.2 KiB
C
Raw Permalink Normal View History

// SPDX-License-Identifier: GPL-2.0-only
/*
* I2C link layer for the NXP NCI driver
*
* Copyright (C) 2014 NXP Semiconductors All rights reserved.
* Copyright (C) 2012-2015 Intel Corporation. All rights reserved.
*
* Authors: Clément Perrochaud <clement.perrochaud@nxp.com>
* Authors: Oleg Zhurakivskyy <oleg.zhurakivskyy@intel.com>
*
* Derived from PN544 device driver:
* Copyright (C) 2012 Intel Corporation. All rights reserved.
*/
#include <linux/acpi.h>
#include <linux/delay.h>
#include <linux/i2c.h>
#include <linux/interrupt.h>
#include <linux/module.h>
#include <linux/nfc.h>
#include <linux/gpio/consumer.h>
#include <linux/unaligned.h>
#include <net/nfc/nfc.h>
#include "nxp-nci.h"
#define NXP_NCI_I2C_DRIVER_NAME "nxp-nci_i2c"
#define NXP_NCI_I2C_MAX_PAYLOAD 32
struct nxp_nci_i2c_phy {
struct i2c_client *i2c_dev;
struct nci_dev *ndev;
struct gpio_desc *gpiod_en;
struct gpio_desc *gpiod_fw;
int hard_fault; /*
* < 0 if hardware error occurred (e.g. i2c err)
* and prevents normal operation.
*/
};
static int nxp_nci_i2c_set_mode(void *phy_id,
enum nxp_nci_mode mode)
{
struct nxp_nci_i2c_phy *phy = (struct nxp_nci_i2c_phy *) phy_id;
gpiod_set_value(phy->gpiod_fw, (mode == NXP_NCI_MODE_FW) ? 1 : 0);
gpiod_set_value(phy->gpiod_en, (mode != NXP_NCI_MODE_COLD) ? 1 : 0);
usleep_range(10000, 15000);
if (mode == NXP_NCI_MODE_COLD)
phy->hard_fault = 0;
return 0;
}
static int nxp_nci_i2c_write(void *phy_id, struct sk_buff *skb)
{
int r;
struct nxp_nci_i2c_phy *phy = phy_id;
struct i2c_client *client = phy->i2c_dev;
if (phy->hard_fault != 0)
return phy->hard_fault;
r = i2c_master_send(client, skb->data, skb->len);
if (r < 0) {
/* Retry, chip was in standby */
msleep(110);
r = i2c_master_send(client, skb->data, skb->len);
}
if (r < 0) {
nfc_err(&client->dev, "Error %d on I2C send\n", r);
} else if (r != skb->len) {
nfc_err(&client->dev,
"Invalid length sent: %u (expected %u)\n",
r, skb->len);
r = -EREMOTEIO;
} else {
/* Success but return 0 and not number of bytes */
r = 0;
}
return r;
}
static const struct nxp_nci_phy_ops i2c_phy_ops = {
.set_mode = nxp_nci_i2c_set_mode,
.write = nxp_nci_i2c_write,
};
static int nxp_nci_i2c_fw_read(struct nxp_nci_i2c_phy *phy,
struct sk_buff **skb)
{
struct i2c_client *client = phy->i2c_dev;
size_t frame_len;
__be16 header;
int r;
r = i2c_master_recv(client, (u8 *) &header, NXP_NCI_FW_HDR_LEN);
if (r < 0) {
goto fw_read_exit;
} else if (r != NXP_NCI_FW_HDR_LEN) {
nfc_err(&client->dev, "Incorrect header length: %u\n", r);
r = -EBADMSG;
goto fw_read_exit;
}
frame_len = (be16_to_cpu(header) & NXP_NCI_FW_FRAME_LEN_MASK) +
NXP_NCI_FW_CRC_LEN;
*skb = alloc_skb(NXP_NCI_FW_HDR_LEN + frame_len, GFP_KERNEL);
if (*skb == NULL) {
r = -ENOMEM;
goto fw_read_exit;
}
skb_put_data(*skb, &header, NXP_NCI_FW_HDR_LEN);
r = i2c_master_recv(client, skb_put(*skb, frame_len), frame_len);
if (r < 0) {
goto fw_read_exit_free_skb;
} else if (r != frame_len) {
nfc_err(&client->dev,
"Invalid frame length: %u (expected %zu)\n",
r, frame_len);
r = -EBADMSG;
goto fw_read_exit_free_skb;
}
return 0;
fw_read_exit_free_skb:
kfree_skb(*skb);
fw_read_exit:
return r;
}
static int nxp_nci_i2c_nci_read(struct nxp_nci_i2c_phy *phy,
struct sk_buff **skb)
{
struct nci_ctrl_hdr header; /* May actually be a data header */
struct i2c_client *client = phy->i2c_dev;
int r;
r = i2c_master_recv(client, (u8 *) &header, NCI_CTRL_HDR_SIZE);
if (r < 0) {
goto nci_read_exit;
} else if (r != NCI_CTRL_HDR_SIZE) {
nfc_err(&client->dev, "Incorrect header length: %u\n", r);
r = -EBADMSG;
goto nci_read_exit;
}
*skb = alloc_skb(NCI_CTRL_HDR_SIZE + header.plen, GFP_KERNEL);
if (*skb == NULL) {
r = -ENOMEM;
goto nci_read_exit;
}
skb_put_data(*skb, (void *)&header, NCI_CTRL_HDR_SIZE);
if (!header.plen)
return 0;
r = i2c_master_recv(client, skb_put(*skb, header.plen), header.plen);
if (r < 0) {
goto nci_read_exit_free_skb;
} else if (r != header.plen) {
nfc_err(&client->dev,
"Invalid frame payload length: %u (expected %u)\n",
r, header.plen);
r = -EBADMSG;
goto nci_read_exit_free_skb;
}
return 0;
nci_read_exit_free_skb:
kfree_skb(*skb);
nci_read_exit:
return r;
}
static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
{
struct nxp_nci_i2c_phy *phy = phy_id;
struct i2c_client *client;
struct nxp_nci_info *info;
struct sk_buff *skb = NULL;
int r = 0;
if (!phy || !phy->ndev)
goto exit_irq_none;
client = phy->i2c_dev;
if (!client || irq != client->irq)
goto exit_irq_none;
info = nci_get_drvdata(phy->ndev);
if (!info)
goto exit_irq_none;
mutex_lock(&info->info_lock);
if (phy->hard_fault != 0)
goto exit_irq_handled;
switch (info->mode) {
case NXP_NCI_MODE_NCI:
r = nxp_nci_i2c_nci_read(phy, &skb);
break;
case NXP_NCI_MODE_FW:
r = nxp_nci_i2c_fw_read(phy, &skb);
break;
case NXP_NCI_MODE_COLD:
r = -EREMOTEIO;
break;
}
if (r == -EREMOTEIO) {
phy->hard_fault = r;
NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci result in a NULL pointer dereference at the moment: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1 RIP: 0010:skb_queue_tail+0x25/0x50 Call Trace: nci_recv_frame+0x36/0x90 [nci] nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c] ? preempt_count_add+0x68/0xa0 ? irq_forced_thread_fn+0x80/0x80 irq_thread_fn+0x20/0x60 irq_thread+0xee/0x180 ? wake_threads_waitq+0x30/0x30 kthread+0xfb/0x130 ? irq_thread_check_affinity+0xd0/0xd0 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x40 Afterward the kernel must be rebooted to work properly again. This happens because it attempts to call nci_recv_frame() with skb == NULL. However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any NULL checks for skb, causing the NULL pointer dereference. Change the code to call only nxp_nci_fw_recv_frame() in case of an error. Make sure to log it so it is obvious that a communication error occurred. The error above then becomes: nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") Signed-off-by: Stephan Gerhold <stephan@gerhold.net> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-11 00:19:15 +08:00
if (info->mode == NXP_NCI_MODE_FW)
nxp_nci_fw_recv_frame(phy->ndev, NULL);
}
if (r < 0) {
nfc_err(&client->dev, "Read failed with error %d\n", r);
goto exit_irq_handled;
}
switch (info->mode) {
case NXP_NCI_MODE_NCI:
nci_recv_frame(phy->ndev, skb);
break;
case NXP_NCI_MODE_FW:
nxp_nci_fw_recv_frame(phy->ndev, skb);
break;
case NXP_NCI_MODE_COLD:
break;
}
exit_irq_handled:
mutex_unlock(&info->info_lock);
return IRQ_HANDLED;
exit_irq_none:
WARN_ON_ONCE(1);
return IRQ_NONE;
}
static const struct acpi_gpio_params firmware_gpios = { 1, 0, false };
static const struct acpi_gpio_params enable_gpios = { 2, 0, false };
static const struct acpi_gpio_mapping acpi_nxp_nci_gpios[] = {
{ "enable-gpios", &enable_gpios, 1 },
{ "firmware-gpios", &firmware_gpios, 1 },
{ }
};
static int nxp_nci_i2c_probe(struct i2c_client *client)
{
struct device *dev = &client->dev;
struct nxp_nci_i2c_phy *phy;
int r;
if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
nfc_err(&client->dev, "Need I2C_FUNC_I2C\n");
return -ENODEV;
}
phy = devm_kzalloc(&client->dev, sizeof(struct nxp_nci_i2c_phy),
GFP_KERNEL);
if (!phy)
return -ENOMEM;
phy->i2c_dev = client;
i2c_set_clientdata(client, phy);
r = devm_acpi_dev_add_driver_gpios(dev, acpi_nxp_nci_gpios);
if (r)
dev_dbg(dev, "Unable to add GPIO mapping table\n");
phy->gpiod_en = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
if (IS_ERR(phy->gpiod_en)) {
nfc_err(dev, "Failed to get EN gpio\n");
return PTR_ERR(phy->gpiod_en);
}
phy->gpiod_fw = devm_gpiod_get_optional(dev, "firmware", GPIOD_OUT_LOW);
if (IS_ERR(phy->gpiod_fw)) {
nfc_err(dev, "Failed to get FW gpio\n");
return PTR_ERR(phy->gpiod_fw);
}
r = nxp_nci_probe(phy, &client->dev, &i2c_phy_ops,
NXP_NCI_I2C_MAX_PAYLOAD, &phy->ndev);
if (r < 0)
return r;
r = request_threaded_irq(client->irq, NULL,
nxp_nci_i2c_irq_thread_fn,
IRQF_TRIGGER_RISING | IRQF_ONESHOT,
NXP_NCI_I2C_DRIVER_NAME, phy);
if (r < 0)
nfc_err(&client->dev, "Unable to register IRQ handler\n");
return r;
}
i2c: Make remove callback return void The value returned by an i2c driver's remove function is mostly ignored. (Only an error message is printed if the value is non-zero that the error is ignored.) So change the prototype of the remove function to return no value. This way driver authors are not tempted to assume that passing an error to the upper layer is a good idea. All drivers are adapted accordingly. There is no intended change of behaviour, all callbacks were prepared to return 0 before. Reviewed-by: Peter Senna Tschudin <peter.senna@gmail.com> Reviewed-by: Jeremy Kerr <jk@codeconstruct.com.au> Reviewed-by: Benjamin Mugnier <benjamin.mugnier@foss.st.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Crt Mori <cmo@melexis.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Behún <kabel@kernel.org> # for leds-turris-omnia Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Petr Machata <petrm@nvidia.com> # for mlxsw Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com> # for surface3_power Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> # for bmc150-accel-i2c + kxcjk-1013 Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> # for media/* + staging/media/* Acked-by: Miguel Ojeda <ojeda@kernel.org> # for auxdisplay/ht16k33 + auxdisplay/lcd2s Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> # for versaclock5 Reviewed-by: Ajay Gupta <ajayg@nvidia.com> # for ucsi_ccg Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> # for iio Acked-by: Peter Rosin <peda@axentia.se> # for i2c-mux-*, max9860 Acked-by: Adrien Grassein <adrien.grassein@gmail.com> # for lontium-lt8912b Reviewed-by: Jean Delvare <jdelvare@suse.de> # for hwmon, i2c-core and i2c/muxes Acked-by: Corey Minyard <cminyard@mvista.com> # for IPMI Reviewed-by: Vladimir Oltean <olteanv@gmail.com> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Sebastian Reichel <sebastian.reichel@collabora.com> # for drivers/power Acked-by: Krzysztof Hałasa <khalasa@piap.pl> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Wolfram Sang <wsa@kernel.org>
2022-08-15 16:02:30 +08:00
static void nxp_nci_i2c_remove(struct i2c_client *client)
{
struct nxp_nci_i2c_phy *phy = i2c_get_clientdata(client);
nxp_nci_remove(phy->ndev);
free_irq(client->irq, phy);
}
static const struct i2c_device_id nxp_nci_i2c_id_table[] = {
{ "nxp-nci_i2c" },
{}
};
MODULE_DEVICE_TABLE(i2c, nxp_nci_i2c_id_table);
static const struct of_device_id of_nxp_nci_i2c_match[] = {
{ .compatible = "nxp,nxp-nci-i2c", },
{}
};
MODULE_DEVICE_TABLE(of, of_nxp_nci_i2c_match);
#ifdef CONFIG_ACPI
static const struct acpi_device_id acpi_id[] = {
{ "NXP1001" },
{ "NXP1002" },
{ "NXP7471" },
{ }
};
MODULE_DEVICE_TABLE(acpi, acpi_id);
#endif
static struct i2c_driver nxp_nci_i2c_driver = {
.driver = {
.name = NXP_NCI_I2C_DRIVER_NAME,
.acpi_match_table = ACPI_PTR(acpi_id),
.of_match_table = of_nxp_nci_i2c_match,
},
.probe = nxp_nci_i2c_probe,
.id_table = nxp_nci_i2c_id_table,
.remove = nxp_nci_i2c_remove,
};
module_i2c_driver(nxp_nci_i2c_driver);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("I2C driver for NXP NCI NFC controllers");
MODULE_AUTHOR("Clément Perrochaud <clement.perrochaud@nxp.com>");
MODULE_AUTHOR("Oleg Zhurakivskyy <oleg.zhurakivskyy@intel.com>");