1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * |
4 | * Bluetooth HCI UART driver for marvell devices |
5 | * |
6 | * Copyright (C) 2016 Marvell International Ltd. |
7 | * Copyright (C) 2016 Intel Corporation |
8 | */ |
9 | |
10 | #include <linux/kernel.h> |
11 | #include <linux/errno.h> |
12 | #include <linux/skbuff.h> |
13 | #include <linux/firmware.h> |
14 | #include <linux/module.h> |
15 | #include <linux/tty.h> |
16 | #include <linux/of.h> |
17 | #include <linux/serdev.h> |
18 | |
19 | #include <net/bluetooth/bluetooth.h> |
20 | #include <net/bluetooth/hci_core.h> |
21 | |
22 | #include "hci_uart.h" |
23 | |
24 | #define HCI_FW_REQ_PKT 0xA5 |
25 | #define HCI_CHIP_VER_PKT 0xAA |
26 | |
27 | #define MRVL_ACK 0x5A |
28 | #define MRVL_NAK 0xBF |
29 | #define MRVL_RAW_DATA 0x1F |
30 | #define MRVL_SET_BAUDRATE 0xFC09 |
31 | |
32 | enum { |
33 | STATE_CHIP_VER_PENDING, |
34 | STATE_FW_REQ_PENDING, |
35 | STATE_FW_LOADED, |
36 | }; |
37 | |
38 | struct mrvl_data { |
39 | struct sk_buff *rx_skb; |
40 | struct sk_buff_head txq; |
41 | struct sk_buff_head rawq; |
42 | unsigned long flags; |
43 | unsigned int tx_len; |
44 | u8 id, rev; |
45 | }; |
46 | |
47 | struct mrvl_serdev { |
48 | struct hci_uart hu; |
49 | }; |
50 | |
51 | struct hci_mrvl_pkt { |
52 | __le16 lhs; |
53 | __le16 rhs; |
54 | } __packed; |
55 | #define HCI_MRVL_PKT_SIZE 4 |
56 | |
57 | static int mrvl_open(struct hci_uart *hu) |
58 | { |
59 | struct mrvl_data *mrvl; |
60 | int ret; |
61 | |
62 | BT_DBG("hu %p" , hu); |
63 | |
64 | if (!hci_uart_has_flow_control(hu)) |
65 | return -EOPNOTSUPP; |
66 | |
67 | mrvl = kzalloc(size: sizeof(*mrvl), GFP_KERNEL); |
68 | if (!mrvl) |
69 | return -ENOMEM; |
70 | |
71 | skb_queue_head_init(list: &mrvl->txq); |
72 | skb_queue_head_init(list: &mrvl->rawq); |
73 | |
74 | set_bit(nr: STATE_CHIP_VER_PENDING, addr: &mrvl->flags); |
75 | |
76 | hu->priv = mrvl; |
77 | |
78 | if (hu->serdev) { |
79 | ret = serdev_device_open(hu->serdev); |
80 | if (ret) |
81 | goto err; |
82 | } |
83 | |
84 | return 0; |
85 | err: |
86 | kfree(objp: mrvl); |
87 | |
88 | return ret; |
89 | } |
90 | |
91 | static int mrvl_close(struct hci_uart *hu) |
92 | { |
93 | struct mrvl_data *mrvl = hu->priv; |
94 | |
95 | BT_DBG("hu %p" , hu); |
96 | |
97 | if (hu->serdev) |
98 | serdev_device_close(hu->serdev); |
99 | |
100 | skb_queue_purge(list: &mrvl->txq); |
101 | skb_queue_purge(list: &mrvl->rawq); |
102 | kfree_skb(skb: mrvl->rx_skb); |
103 | kfree(objp: mrvl); |
104 | |
105 | hu->priv = NULL; |
106 | return 0; |
107 | } |
108 | |
109 | static int mrvl_flush(struct hci_uart *hu) |
110 | { |
111 | struct mrvl_data *mrvl = hu->priv; |
112 | |
113 | BT_DBG("hu %p" , hu); |
114 | |
115 | skb_queue_purge(list: &mrvl->txq); |
116 | skb_queue_purge(list: &mrvl->rawq); |
117 | |
118 | return 0; |
119 | } |
120 | |
121 | static struct sk_buff *mrvl_dequeue(struct hci_uart *hu) |
122 | { |
123 | struct mrvl_data *mrvl = hu->priv; |
124 | struct sk_buff *skb; |
125 | |
126 | skb = skb_dequeue(list: &mrvl->txq); |
127 | if (!skb) { |
128 | /* Any raw data ? */ |
129 | skb = skb_dequeue(list: &mrvl->rawq); |
130 | } else { |
131 | /* Prepend skb with frame type */ |
132 | memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); |
133 | } |
134 | |
135 | return skb; |
136 | } |
137 | |
138 | static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb) |
139 | { |
140 | struct mrvl_data *mrvl = hu->priv; |
141 | |
142 | skb_queue_tail(list: &mrvl->txq, newsk: skb); |
143 | return 0; |
144 | } |
145 | |
146 | static void mrvl_send_ack(struct hci_uart *hu, unsigned char type) |
147 | { |
148 | struct mrvl_data *mrvl = hu->priv; |
149 | struct sk_buff *skb; |
150 | |
151 | /* No H4 payload, only 1 byte header */ |
152 | skb = bt_skb_alloc(len: 0, GFP_ATOMIC); |
153 | if (!skb) { |
154 | bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet" ); |
155 | return; |
156 | } |
157 | hci_skb_pkt_type(skb) = type; |
158 | |
159 | skb_queue_tail(list: &mrvl->txq, newsk: skb); |
160 | hci_uart_tx_wakeup(hu); |
161 | } |
162 | |
163 | static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb) |
164 | { |
165 | struct hci_mrvl_pkt *pkt = (void *)skb->data; |
166 | struct hci_uart *hu = hci_get_drvdata(hdev); |
167 | struct mrvl_data *mrvl = hu->priv; |
168 | int ret = 0; |
169 | |
170 | if ((pkt->lhs ^ pkt->rhs) != 0xffff) { |
171 | bt_dev_err(hdev, "Corrupted mrvl header" ); |
172 | mrvl_send_ack(hu, MRVL_NAK); |
173 | ret = -EINVAL; |
174 | goto done; |
175 | } |
176 | mrvl_send_ack(hu, MRVL_ACK); |
177 | |
178 | if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) { |
179 | bt_dev_err(hdev, "Received unexpected firmware request" ); |
180 | ret = -EINVAL; |
181 | goto done; |
182 | } |
183 | |
184 | mrvl->tx_len = le16_to_cpu(pkt->lhs); |
185 | |
186 | clear_bit(nr: STATE_FW_REQ_PENDING, addr: &mrvl->flags); |
187 | smp_mb__after_atomic(); |
188 | wake_up_bit(word: &mrvl->flags, bit: STATE_FW_REQ_PENDING); |
189 | |
190 | done: |
191 | kfree_skb(skb); |
192 | return ret; |
193 | } |
194 | |
195 | static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb) |
196 | { |
197 | struct hci_mrvl_pkt *pkt = (void *)skb->data; |
198 | struct hci_uart *hu = hci_get_drvdata(hdev); |
199 | struct mrvl_data *mrvl = hu->priv; |
200 | u16 version = le16_to_cpu(pkt->lhs); |
201 | int ret = 0; |
202 | |
203 | if ((pkt->lhs ^ pkt->rhs) != 0xffff) { |
204 | bt_dev_err(hdev, "Corrupted mrvl header" ); |
205 | mrvl_send_ack(hu, MRVL_NAK); |
206 | ret = -EINVAL; |
207 | goto done; |
208 | } |
209 | mrvl_send_ack(hu, MRVL_ACK); |
210 | |
211 | if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) { |
212 | bt_dev_err(hdev, "Received unexpected chip version" ); |
213 | goto done; |
214 | } |
215 | |
216 | mrvl->id = version; |
217 | mrvl->rev = version >> 8; |
218 | |
219 | bt_dev_info(hdev, "Controller id = %x, rev = %x" , mrvl->id, mrvl->rev); |
220 | |
221 | clear_bit(nr: STATE_CHIP_VER_PENDING, addr: &mrvl->flags); |
222 | smp_mb__after_atomic(); |
223 | wake_up_bit(word: &mrvl->flags, bit: STATE_CHIP_VER_PENDING); |
224 | |
225 | done: |
226 | kfree_skb(skb); |
227 | return ret; |
228 | } |
229 | |
230 | #define HCI_RECV_CHIP_VER \ |
231 | .type = HCI_CHIP_VER_PKT, \ |
232 | .hlen = HCI_MRVL_PKT_SIZE, \ |
233 | .loff = 0, \ |
234 | .lsize = 0, \ |
235 | .maxlen = HCI_MRVL_PKT_SIZE |
236 | |
237 | #define HCI_RECV_FW_REQ \ |
238 | .type = HCI_FW_REQ_PKT, \ |
239 | .hlen = HCI_MRVL_PKT_SIZE, \ |
240 | .loff = 0, \ |
241 | .lsize = 0, \ |
242 | .maxlen = HCI_MRVL_PKT_SIZE |
243 | |
244 | static const struct h4_recv_pkt mrvl_recv_pkts[] = { |
245 | { H4_RECV_ACL, .recv = hci_recv_frame }, |
246 | { H4_RECV_SCO, .recv = hci_recv_frame }, |
247 | { H4_RECV_EVENT, .recv = hci_recv_frame }, |
248 | { HCI_RECV_FW_REQ, .recv = mrvl_recv_fw_req }, |
249 | { HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver }, |
250 | }; |
251 | |
252 | static int mrvl_recv(struct hci_uart *hu, const void *data, int count) |
253 | { |
254 | struct mrvl_data *mrvl = hu->priv; |
255 | |
256 | if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) |
257 | return -EUNATCH; |
258 | |
259 | /* We might receive some noise when there is no firmware loaded. Therefore, |
260 | * we drop data if the firmware is not loaded yet and if there is no fw load |
261 | * request pending. |
262 | */ |
263 | if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags) && |
264 | !test_bit(STATE_FW_LOADED, &mrvl->flags)) |
265 | return count; |
266 | |
267 | mrvl->rx_skb = h4_recv_buf(hdev: hu->hdev, skb: mrvl->rx_skb, buffer: data, count, |
268 | pkts: mrvl_recv_pkts, |
269 | ARRAY_SIZE(mrvl_recv_pkts)); |
270 | if (IS_ERR(ptr: mrvl->rx_skb)) { |
271 | int err = PTR_ERR(ptr: mrvl->rx_skb); |
272 | bt_dev_err(hu->hdev, "Frame reassembly failed (%d)" , err); |
273 | mrvl->rx_skb = NULL; |
274 | return err; |
275 | } |
276 | |
277 | return count; |
278 | } |
279 | |
280 | static int mrvl_load_firmware(struct hci_dev *hdev, const char *name) |
281 | { |
282 | struct hci_uart *hu = hci_get_drvdata(hdev); |
283 | struct mrvl_data *mrvl = hu->priv; |
284 | const struct firmware *fw = NULL; |
285 | const u8 *fw_ptr, *fw_max; |
286 | int err; |
287 | |
288 | err = request_firmware(fw: &fw, name, device: &hdev->dev); |
289 | if (err < 0) { |
290 | bt_dev_err(hdev, "Failed to load firmware file %s" , name); |
291 | return err; |
292 | } |
293 | |
294 | fw_ptr = fw->data; |
295 | fw_max = fw->data + fw->size; |
296 | |
297 | bt_dev_info(hdev, "Loading %s" , name); |
298 | |
299 | set_bit(nr: STATE_FW_REQ_PENDING, addr: &mrvl->flags); |
300 | |
301 | while (fw_ptr <= fw_max) { |
302 | struct sk_buff *skb; |
303 | |
304 | /* Controller drives the firmware load by sending firmware |
305 | * request packets containing the expected fragment size. |
306 | */ |
307 | err = wait_on_bit_timeout(word: &mrvl->flags, bit: STATE_FW_REQ_PENDING, |
308 | TASK_INTERRUPTIBLE, |
309 | timeout: msecs_to_jiffies(m: 2000)); |
310 | if (err == 1) { |
311 | bt_dev_err(hdev, "Firmware load interrupted" ); |
312 | err = -EINTR; |
313 | break; |
314 | } else if (err) { |
315 | bt_dev_err(hdev, "Firmware request timeout" ); |
316 | err = -ETIMEDOUT; |
317 | break; |
318 | } |
319 | |
320 | bt_dev_dbg(hdev, "Firmware request, expecting %d bytes" , |
321 | mrvl->tx_len); |
322 | |
323 | if (fw_ptr == fw_max) { |
324 | /* Controller requests a null size once firmware is |
325 | * fully loaded. If controller expects more data, there |
326 | * is an issue. |
327 | */ |
328 | if (!mrvl->tx_len) { |
329 | bt_dev_info(hdev, "Firmware loading complete" ); |
330 | } else { |
331 | bt_dev_err(hdev, "Firmware loading failure" ); |
332 | err = -EINVAL; |
333 | } |
334 | break; |
335 | } |
336 | |
337 | if (fw_ptr + mrvl->tx_len > fw_max) { |
338 | mrvl->tx_len = fw_max - fw_ptr; |
339 | bt_dev_dbg(hdev, "Adjusting tx_len to %d" , |
340 | mrvl->tx_len); |
341 | } |
342 | |
343 | skb = bt_skb_alloc(len: mrvl->tx_len, GFP_KERNEL); |
344 | if (!skb) { |
345 | bt_dev_err(hdev, "Failed to alloc mem for FW packet" ); |
346 | err = -ENOMEM; |
347 | break; |
348 | } |
349 | bt_cb(skb)->pkt_type = MRVL_RAW_DATA; |
350 | |
351 | skb_put_data(skb, data: fw_ptr, len: mrvl->tx_len); |
352 | fw_ptr += mrvl->tx_len; |
353 | |
354 | set_bit(nr: STATE_FW_REQ_PENDING, addr: &mrvl->flags); |
355 | |
356 | skb_queue_tail(list: &mrvl->rawq, newsk: skb); |
357 | hci_uart_tx_wakeup(hu); |
358 | } |
359 | |
360 | release_firmware(fw); |
361 | return err; |
362 | } |
363 | |
364 | static int mrvl_setup(struct hci_uart *hu) |
365 | { |
366 | int err; |
367 | struct mrvl_data *mrvl = hu->priv; |
368 | |
369 | hci_uart_set_flow_control(hu, enable: true); |
370 | |
371 | err = mrvl_load_firmware(hdev: hu->hdev, name: "mrvl/helper_uart_3000000.bin" ); |
372 | if (err) { |
373 | bt_dev_err(hu->hdev, "Unable to download firmware helper" ); |
374 | return -EINVAL; |
375 | } |
376 | |
377 | /* Let the final ack go out before switching the baudrate */ |
378 | hci_uart_wait_until_sent(hu); |
379 | |
380 | if (hu->serdev) |
381 | serdev_device_set_baudrate(hu->serdev, hu->oper_speed); |
382 | else |
383 | hci_uart_set_baudrate(hu, speed: hu->oper_speed); |
384 | |
385 | hci_uart_set_flow_control(hu, enable: false); |
386 | |
387 | err = mrvl_load_firmware(hdev: hu->hdev, name: "mrvl/uart8897_bt.bin" ); |
388 | if (err) |
389 | return err; |
390 | |
391 | set_bit(nr: STATE_FW_LOADED, addr: &mrvl->flags); |
392 | |
393 | return 0; |
394 | } |
395 | |
396 | static int mrvl_set_baudrate(struct hci_uart *hu, unsigned int speed) |
397 | { |
398 | int err; |
399 | struct mrvl_data *mrvl = hu->priv; |
400 | __le32 speed_le = cpu_to_le32(speed); |
401 | |
402 | /* The firmware might be loaded by the Wifi driver over SDIO. We wait |
403 | * up to 10s for the CTS to go up. Afterward, we know that the firmware |
404 | * is ready. |
405 | */ |
406 | err = serdev_device_wait_for_cts(serdev: hu->serdev, state: true, timeout_ms: 10000); |
407 | if (err) { |
408 | bt_dev_err(hu->hdev, "Wait for CTS failed with %d\n" , err); |
409 | return err; |
410 | } |
411 | |
412 | set_bit(nr: STATE_FW_LOADED, addr: &mrvl->flags); |
413 | |
414 | err = __hci_cmd_sync_status(hdev: hu->hdev, MRVL_SET_BAUDRATE, |
415 | plen: sizeof(speed_le), param: &speed_le, |
416 | HCI_INIT_TIMEOUT); |
417 | if (err) { |
418 | bt_dev_err(hu->hdev, "send command failed: %d" , err); |
419 | return err; |
420 | } |
421 | |
422 | serdev_device_set_baudrate(hu->serdev, speed); |
423 | |
424 | /* We forcefully have to send a command to the bluetooth module so that |
425 | * the driver detects it after a baudrate change. This is foreseen by |
426 | * hci_serdev by setting HCI_UART_VND_DETECT which then causes a dummy |
427 | * local version read. |
428 | */ |
429 | set_bit(HCI_UART_VND_DETECT, addr: &hu->hdev_flags); |
430 | |
431 | return 0; |
432 | } |
433 | |
434 | static const struct hci_uart_proto mrvl_proto_8897 = { |
435 | .id = HCI_UART_MRVL, |
436 | .name = "Marvell" , |
437 | .init_speed = 115200, |
438 | .oper_speed = 3000000, |
439 | .open = mrvl_open, |
440 | .close = mrvl_close, |
441 | .flush = mrvl_flush, |
442 | .setup = mrvl_setup, |
443 | .recv = mrvl_recv, |
444 | .enqueue = mrvl_enqueue, |
445 | .dequeue = mrvl_dequeue, |
446 | }; |
447 | |
448 | static const struct hci_uart_proto mrvl_proto_8997 = { |
449 | .id = HCI_UART_MRVL, |
450 | .name = "Marvell 8997" , |
451 | .init_speed = 115200, |
452 | .oper_speed = 3000000, |
453 | .open = mrvl_open, |
454 | .close = mrvl_close, |
455 | .flush = mrvl_flush, |
456 | .set_baudrate = mrvl_set_baudrate, |
457 | .recv = mrvl_recv, |
458 | .enqueue = mrvl_enqueue, |
459 | .dequeue = mrvl_dequeue, |
460 | }; |
461 | |
462 | static int mrvl_serdev_probe(struct serdev_device *serdev) |
463 | { |
464 | struct mrvl_serdev *mrvldev; |
465 | const struct hci_uart_proto *mrvl_proto = device_get_match_data(dev: &serdev->dev); |
466 | |
467 | mrvldev = devm_kzalloc(dev: &serdev->dev, size: sizeof(*mrvldev), GFP_KERNEL); |
468 | if (!mrvldev) |
469 | return -ENOMEM; |
470 | |
471 | mrvldev->hu.oper_speed = mrvl_proto->oper_speed; |
472 | if (mrvl_proto->set_baudrate) |
473 | of_property_read_u32(np: serdev->dev.of_node, propname: "max-speed" , out_value: &mrvldev->hu.oper_speed); |
474 | |
475 | mrvldev->hu.serdev = serdev; |
476 | serdev_device_set_drvdata(serdev, data: mrvldev); |
477 | |
478 | return hci_uart_register_device(hu: &mrvldev->hu, p: mrvl_proto); |
479 | } |
480 | |
481 | static void mrvl_serdev_remove(struct serdev_device *serdev) |
482 | { |
483 | struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev); |
484 | |
485 | hci_uart_unregister_device(hu: &mrvldev->hu); |
486 | } |
487 | |
488 | static const struct of_device_id __maybe_unused mrvl_bluetooth_of_match[] = { |
489 | { .compatible = "mrvl,88w8897" , .data = &mrvl_proto_8897}, |
490 | { .compatible = "mrvl,88w8997" , .data = &mrvl_proto_8997}, |
491 | { }, |
492 | }; |
493 | MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match); |
494 | |
495 | static struct serdev_device_driver mrvl_serdev_driver = { |
496 | .probe = mrvl_serdev_probe, |
497 | .remove = mrvl_serdev_remove, |
498 | .driver = { |
499 | .name = "hci_uart_mrvl" , |
500 | .of_match_table = of_match_ptr(mrvl_bluetooth_of_match), |
501 | }, |
502 | }; |
503 | |
504 | int __init mrvl_init(void) |
505 | { |
506 | serdev_device_driver_register(&mrvl_serdev_driver); |
507 | |
508 | return hci_uart_register_proto(p: &mrvl_proto_8897); |
509 | } |
510 | |
511 | int __exit mrvl_deinit(void) |
512 | { |
513 | serdev_device_driver_unregister(sdrv: &mrvl_serdev_driver); |
514 | |
515 | return hci_uart_unregister_proto(p: &mrvl_proto_8897); |
516 | } |
517 | |