1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * NXP Bluetooth driver
4 * Copyright 2023 NXP
5 */
6
7 #include <linux/module.h>
8 #include <linux/kernel.h>
9
10 #include <linux/serdev.h>
11 #include <linux/of.h>
12 #include <linux/skbuff.h>
13 #include <asm/unaligned.h>
14 #include <linux/firmware.h>
15 #include <linux/string.h>
16 #include <linux/crc8.h>
17 #include <linux/crc32.h>
18 #include <linux/string_helpers.h>
19
20 #include <net/bluetooth/bluetooth.h>
21 #include <net/bluetooth/hci_core.h>
22
23 #include "h4_recv.h"
24
25 #define MANUFACTURER_NXP 37
26
27 #define BTNXPUART_TX_STATE_ACTIVE 1
28 #define BTNXPUART_FW_DOWNLOADING 2
29 #define BTNXPUART_CHECK_BOOT_SIGNATURE 3
30 #define BTNXPUART_SERDEV_OPEN 4
31 #define BTNXPUART_IR_IN_PROGRESS 5
32 #define BTNXPUART_FW_DOWNLOAD_ABORT 6
33
34 /* NXP HW err codes */
35 #define BTNXPUART_IR_HW_ERR 0xb0
36
37 #define FIRMWARE_W8987 "nxp/uartuart8987_bt.bin"
38 #define FIRMWARE_W8997 "nxp/uartuart8997_bt_v4.bin"
39 #define FIRMWARE_W9098 "nxp/uartuart9098_bt_v1.bin"
40 #define FIRMWARE_IW416 "nxp/uartiw416_bt_v0.bin"
41 #define FIRMWARE_IW612 "nxp/uartspi_n61x_v1.bin.se"
42 #define FIRMWARE_IW624 "nxp/uartiw624_bt.bin"
43 #define FIRMWARE_SECURE_IW624 "nxp/uartiw624_bt.bin.se"
44 #define FIRMWARE_AW693 "nxp/uartaw693_bt.bin"
45 #define FIRMWARE_SECURE_AW693 "nxp/uartaw693_bt.bin.se"
46 #define FIRMWARE_HELPER "nxp/helper_uart_3000000.bin"
47
48 #define CHIP_ID_W9098 0x5c03
49 #define CHIP_ID_IW416 0x7201
50 #define CHIP_ID_IW612 0x7601
51 #define CHIP_ID_IW624a 0x8000
52 #define CHIP_ID_IW624c 0x8001
53 #define CHIP_ID_AW693 0x8200
54
55 #define FW_SECURE_MASK 0xc0
56 #define FW_OPEN 0x00
57 #define FW_AUTH_ILLEGAL 0x40
58 #define FW_AUTH_PLAIN 0x80
59 #define FW_AUTH_ENC 0xc0
60
61 #define HCI_NXP_PRI_BAUDRATE 115200
62 #define HCI_NXP_SEC_BAUDRATE 3000000
63
64 #define MAX_FW_FILE_NAME_LEN 50
65
66 /* Default ps timeout period in milliseconds */
67 #define PS_DEFAULT_TIMEOUT_PERIOD_MS 2000
68
69 /* wakeup methods */
70 #define WAKEUP_METHOD_DTR 0
71 #define WAKEUP_METHOD_BREAK 1
72 #define WAKEUP_METHOD_EXT_BREAK 2
73 #define WAKEUP_METHOD_RTS 3
74 #define WAKEUP_METHOD_INVALID 0xff
75
76 /* power save mode status */
77 #define PS_MODE_DISABLE 0
78 #define PS_MODE_ENABLE 1
79
80 /* Power Save Commands to ps_work_func */
81 #define PS_CMD_EXIT_PS 1
82 #define PS_CMD_ENTER_PS 2
83
84 /* power save state */
85 #define PS_STATE_AWAKE 0
86 #define PS_STATE_SLEEP 1
87
88 /* Bluetooth vendor command : Sleep mode */
89 #define HCI_NXP_AUTO_SLEEP_MODE 0xfc23
90 /* Bluetooth vendor command : Wakeup method */
91 #define HCI_NXP_WAKEUP_METHOD 0xfc53
92 /* Bluetooth vendor command : Set operational baudrate */
93 #define HCI_NXP_SET_OPER_SPEED 0xfc09
94 /* Bluetooth vendor command: Independent Reset */
95 #define HCI_NXP_IND_RESET 0xfcfc
96
97 /* Bluetooth Power State : Vendor cmd params */
98 #define BT_PS_ENABLE 0x02
99 #define BT_PS_DISABLE 0x03
100
101 /* Bluetooth Host Wakeup Methods */
102 #define BT_HOST_WAKEUP_METHOD_NONE 0x00
103 #define BT_HOST_WAKEUP_METHOD_DTR 0x01
104 #define BT_HOST_WAKEUP_METHOD_BREAK 0x02
105 #define BT_HOST_WAKEUP_METHOD_GPIO 0x03
106
107 /* Bluetooth Chip Wakeup Methods */
108 #define BT_CTRL_WAKEUP_METHOD_DSR 0x00
109 #define BT_CTRL_WAKEUP_METHOD_BREAK 0x01
110 #define BT_CTRL_WAKEUP_METHOD_GPIO 0x02
111 #define BT_CTRL_WAKEUP_METHOD_EXT_BREAK 0x04
112 #define BT_CTRL_WAKEUP_METHOD_RTS 0x05
113
114 struct ps_data {
115 u8 target_ps_mode; /* ps mode to be set */
116 u8 cur_psmode; /* current ps_mode */
117 u8 ps_state; /* controller's power save state */
118 u8 ps_cmd;
119 u8 h2c_wakeupmode;
120 u8 cur_h2c_wakeupmode;
121 u8 c2h_wakeupmode;
122 u8 c2h_wakeup_gpio;
123 u8 h2c_wakeup_gpio;
124 bool driver_sent_cmd;
125 u16 h2c_ps_interval;
126 u16 c2h_ps_interval;
127 struct hci_dev *hdev;
128 struct work_struct work;
129 struct timer_list ps_timer;
130 struct mutex ps_lock;
131 };
132
133 struct wakeup_cmd_payload {
134 u8 c2h_wakeupmode;
135 u8 c2h_wakeup_gpio;
136 u8 h2c_wakeupmode;
137 u8 h2c_wakeup_gpio;
138 } __packed;
139
140 struct psmode_cmd_payload {
141 u8 ps_cmd;
142 __le16 c2h_ps_interval;
143 } __packed;
144
145 struct btnxpuart_data {
146 const char *helper_fw_name;
147 const char *fw_name;
148 };
149
150 struct btnxpuart_dev {
151 struct hci_dev *hdev;
152 struct serdev_device *serdev;
153
154 struct work_struct tx_work;
155 unsigned long tx_state;
156 struct sk_buff_head txq;
157 struct sk_buff *rx_skb;
158
159 const struct firmware *fw;
160 u8 fw_name[MAX_FW_FILE_NAME_LEN];
161 u32 fw_dnld_v1_offset;
162 u32 fw_v1_sent_bytes;
163 u32 fw_dnld_v3_offset;
164 u32 fw_v3_offset_correction;
165 u32 fw_v1_expected_len;
166 u32 boot_reg_offset;
167 wait_queue_head_t fw_dnld_done_wait_q;
168 wait_queue_head_t check_boot_sign_wait_q;
169
170 u32 new_baudrate;
171 u32 current_baudrate;
172 u32 fw_init_baudrate;
173 bool timeout_changed;
174 bool baudrate_changed;
175 bool helper_downloaded;
176
177 struct ps_data psdata;
178 struct btnxpuart_data *nxp_data;
179 };
180
181 #define NXP_V1_FW_REQ_PKT 0xa5
182 #define NXP_V1_CHIP_VER_PKT 0xaa
183 #define NXP_V3_FW_REQ_PKT 0xa7
184 #define NXP_V3_CHIP_VER_PKT 0xab
185
186 #define NXP_ACK_V1 0x5a
187 #define NXP_NAK_V1 0xbf
188 #define NXP_ACK_V3 0x7a
189 #define NXP_NAK_V3 0x7b
190 #define NXP_CRC_ERROR_V3 0x7c
191
192 /* Bootloader signature error codes */
193 #define NXP_ACK_RX_TIMEOUT 0x0002 /* ACK not received from host */
194 #define NXP_HDR_RX_TIMEOUT 0x0003 /* FW Header chunk not received */
195 #define NXP_DATA_RX_TIMEOUT 0x0004 /* FW Data chunk not received */
196
197 #define HDR_LEN 16
198
199 #define NXP_RECV_CHIP_VER_V1 \
200 .type = NXP_V1_CHIP_VER_PKT, \
201 .hlen = 4, \
202 .loff = 0, \
203 .lsize = 0, \
204 .maxlen = 4
205
206 #define NXP_RECV_FW_REQ_V1 \
207 .type = NXP_V1_FW_REQ_PKT, \
208 .hlen = 4, \
209 .loff = 0, \
210 .lsize = 0, \
211 .maxlen = 4
212
213 #define NXP_RECV_CHIP_VER_V3 \
214 .type = NXP_V3_CHIP_VER_PKT, \
215 .hlen = 4, \
216 .loff = 0, \
217 .lsize = 0, \
218 .maxlen = 4
219
220 #define NXP_RECV_FW_REQ_V3 \
221 .type = NXP_V3_FW_REQ_PKT, \
222 .hlen = 9, \
223 .loff = 0, \
224 .lsize = 0, \
225 .maxlen = 9
226
227 struct v1_data_req {
228 __le16 len;
229 __le16 len_comp;
230 } __packed;
231
232 struct v1_start_ind {
233 __le16 chip_id;
234 __le16 chip_id_comp;
235 } __packed;
236
237 struct v3_data_req {
238 __le16 len;
239 __le32 offset;
240 __le16 error;
241 u8 crc;
242 } __packed;
243
244 struct v3_start_ind {
245 __le16 chip_id;
246 u8 loader_ver;
247 u8 crc;
248 } __packed;
249
250 /* UART register addresses of BT chip */
251 #define CLKDIVADDR 0x7f00008f
252 #define UARTDIVADDR 0x7f000090
253 #define UARTMCRADDR 0x7f000091
254 #define UARTREINITADDR 0x7f000092
255 #define UARTICRADDR 0x7f000093
256 #define UARTFCRADDR 0x7f000094
257
258 #define MCR 0x00000022
259 #define INIT 0x00000001
260 #define ICR 0x000000c7
261 #define FCR 0x000000c7
262
263 #define POLYNOMIAL8 0x07
264
265 struct uart_reg {
266 __le32 address;
267 __le32 value;
268 } __packed;
269
270 struct uart_config {
271 struct uart_reg clkdiv;
272 struct uart_reg uartdiv;
273 struct uart_reg mcr;
274 struct uart_reg re_init;
275 struct uart_reg icr;
276 struct uart_reg fcr;
277 __be32 crc;
278 } __packed;
279
280 struct nxp_bootloader_cmd {
281 __le32 header;
282 __le32 arg;
283 __le32 payload_len;
284 __be32 crc;
285 } __packed;
286
287 struct nxp_v3_rx_timeout_nak {
288 u8 nak;
289 __le32 offset;
290 u8 crc;
291 } __packed;
292
293 union nxp_v3_rx_timeout_nak_u {
294 struct nxp_v3_rx_timeout_nak pkt;
295 u8 buf[6];
296 };
297
298 static u8 crc8_table[CRC8_TABLE_SIZE];
299
300 /* Default configurations */
301 #define DEFAULT_H2C_WAKEUP_MODE WAKEUP_METHOD_BREAK
302 #define DEFAULT_PS_MODE PS_MODE_ENABLE
303 #define FW_INIT_BAUDRATE HCI_NXP_PRI_BAUDRATE
304
nxp_drv_send_cmd(struct hci_dev * hdev,u16 opcode,u32 plen,void * param)305 static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode,
306 u32 plen,
307 void *param)
308 {
309 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
310 struct ps_data *psdata = &nxpdev->psdata;
311 struct sk_buff *skb;
312
313 /* set flag to prevent nxp_enqueue from parsing values from this command and
314 * calling hci_cmd_sync_queue() again.
315 */
316 psdata->driver_sent_cmd = true;
317 skb = __hci_cmd_sync(hdev, opcode, plen, param, HCI_CMD_TIMEOUT);
318 psdata->driver_sent_cmd = false;
319
320 return skb;
321 }
322
btnxpuart_tx_wakeup(struct btnxpuart_dev * nxpdev)323 static void btnxpuart_tx_wakeup(struct btnxpuart_dev *nxpdev)
324 {
325 if (schedule_work(&nxpdev->tx_work))
326 set_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
327 }
328
329 /* NXP Power Save Feature */
ps_start_timer(struct btnxpuart_dev * nxpdev)330 static void ps_start_timer(struct btnxpuart_dev *nxpdev)
331 {
332 struct ps_data *psdata = &nxpdev->psdata;
333
334 if (!psdata)
335 return;
336
337 if (psdata->cur_psmode == PS_MODE_ENABLE)
338 mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval));
339
340 if (psdata->ps_state == PS_STATE_AWAKE && psdata->ps_cmd == PS_CMD_ENTER_PS)
341 cancel_work_sync(&psdata->work);
342 }
343
ps_cancel_timer(struct btnxpuart_dev * nxpdev)344 static void ps_cancel_timer(struct btnxpuart_dev *nxpdev)
345 {
346 struct ps_data *psdata = &nxpdev->psdata;
347
348 flush_work(&psdata->work);
349 timer_shutdown_sync(&psdata->ps_timer);
350 }
351
ps_control(struct hci_dev * hdev,u8 ps_state)352 static void ps_control(struct hci_dev *hdev, u8 ps_state)
353 {
354 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
355 struct ps_data *psdata = &nxpdev->psdata;
356 int status;
357
358 if (psdata->ps_state == ps_state ||
359 !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state))
360 return;
361
362 mutex_lock(&psdata->ps_lock);
363 switch (psdata->cur_h2c_wakeupmode) {
364 case WAKEUP_METHOD_DTR:
365 if (ps_state == PS_STATE_AWAKE)
366 status = serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
367 else
368 status = serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
369 break;
370 case WAKEUP_METHOD_BREAK:
371 default:
372 if (ps_state == PS_STATE_AWAKE)
373 status = serdev_device_break_ctl(nxpdev->serdev, 0);
374 else
375 status = serdev_device_break_ctl(nxpdev->serdev, -1);
376 msleep(20); /* Allow chip to detect UART-break and enter sleep */
377 bt_dev_dbg(hdev, "Set UART break: %s, status=%d",
378 str_on_off(ps_state == PS_STATE_SLEEP), status);
379 break;
380 }
381 if (!status)
382 psdata->ps_state = ps_state;
383 mutex_unlock(&psdata->ps_lock);
384
385 if (ps_state == PS_STATE_AWAKE)
386 btnxpuart_tx_wakeup(nxpdev);
387 }
388
ps_work_func(struct work_struct * work)389 static void ps_work_func(struct work_struct *work)
390 {
391 struct ps_data *data = container_of(work, struct ps_data, work);
392
393 if (data->ps_cmd == PS_CMD_ENTER_PS && data->cur_psmode == PS_MODE_ENABLE)
394 ps_control(data->hdev, PS_STATE_SLEEP);
395 else if (data->ps_cmd == PS_CMD_EXIT_PS)
396 ps_control(data->hdev, PS_STATE_AWAKE);
397 }
398
ps_timeout_func(struct timer_list * t)399 static void ps_timeout_func(struct timer_list *t)
400 {
401 struct ps_data *data = from_timer(data, t, ps_timer);
402 struct hci_dev *hdev = data->hdev;
403 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
404
405 if (test_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state)) {
406 ps_start_timer(nxpdev);
407 } else {
408 data->ps_cmd = PS_CMD_ENTER_PS;
409 schedule_work(&data->work);
410 }
411 }
412
ps_setup(struct hci_dev * hdev)413 static void ps_setup(struct hci_dev *hdev)
414 {
415 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
416 struct ps_data *psdata = &nxpdev->psdata;
417
418 psdata->hdev = hdev;
419 INIT_WORK(&psdata->work, ps_work_func);
420 mutex_init(&psdata->ps_lock);
421 timer_setup(&psdata->ps_timer, ps_timeout_func, 0);
422 }
423
ps_wakeup(struct btnxpuart_dev * nxpdev)424 static bool ps_wakeup(struct btnxpuart_dev *nxpdev)
425 {
426 struct ps_data *psdata = &nxpdev->psdata;
427 u8 ps_state;
428
429 mutex_lock(&psdata->ps_lock);
430 ps_state = psdata->ps_state;
431 mutex_unlock(&psdata->ps_lock);
432
433 if (ps_state != PS_STATE_AWAKE) {
434 psdata->ps_cmd = PS_CMD_EXIT_PS;
435 schedule_work(&psdata->work);
436 return true;
437 }
438 return false;
439 }
440
ps_cleanup(struct btnxpuart_dev * nxpdev)441 static void ps_cleanup(struct btnxpuart_dev *nxpdev)
442 {
443 struct ps_data *psdata = &nxpdev->psdata;
444 u8 ps_state;
445
446 mutex_lock(&psdata->ps_lock);
447 ps_state = psdata->ps_state;
448 mutex_unlock(&psdata->ps_lock);
449
450 if (ps_state != PS_STATE_AWAKE)
451 ps_control(psdata->hdev, PS_STATE_AWAKE);
452
453 ps_cancel_timer(nxpdev);
454 cancel_work_sync(&psdata->work);
455 mutex_destroy(&psdata->ps_lock);
456 }
457
send_ps_cmd(struct hci_dev * hdev,void * data)458 static int send_ps_cmd(struct hci_dev *hdev, void *data)
459 {
460 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
461 struct ps_data *psdata = &nxpdev->psdata;
462 struct psmode_cmd_payload pcmd;
463 struct sk_buff *skb;
464 u8 *status;
465
466 if (psdata->target_ps_mode == PS_MODE_ENABLE)
467 pcmd.ps_cmd = BT_PS_ENABLE;
468 else
469 pcmd.ps_cmd = BT_PS_DISABLE;
470 pcmd.c2h_ps_interval = __cpu_to_le16(psdata->c2h_ps_interval);
471
472 skb = nxp_drv_send_cmd(hdev, HCI_NXP_AUTO_SLEEP_MODE, sizeof(pcmd), &pcmd);
473 if (IS_ERR(skb)) {
474 bt_dev_err(hdev, "Setting Power Save mode failed (%ld)", PTR_ERR(skb));
475 return PTR_ERR(skb);
476 }
477
478 status = skb_pull_data(skb, 1);
479 if (status) {
480 if (!*status)
481 psdata->cur_psmode = psdata->target_ps_mode;
482 else
483 psdata->target_ps_mode = psdata->cur_psmode;
484 if (psdata->cur_psmode == PS_MODE_ENABLE)
485 ps_start_timer(nxpdev);
486 else
487 ps_wakeup(nxpdev);
488 bt_dev_dbg(hdev, "Power Save mode response: status=%d, ps_mode=%d",
489 *status, psdata->cur_psmode);
490 }
491 kfree_skb(skb);
492
493 return 0;
494 }
495
send_wakeup_method_cmd(struct hci_dev * hdev,void * data)496 static int send_wakeup_method_cmd(struct hci_dev *hdev, void *data)
497 {
498 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
499 struct ps_data *psdata = &nxpdev->psdata;
500 struct wakeup_cmd_payload pcmd;
501 struct sk_buff *skb;
502 u8 *status;
503
504 pcmd.c2h_wakeupmode = psdata->c2h_wakeupmode;
505 pcmd.c2h_wakeup_gpio = psdata->c2h_wakeup_gpio;
506 switch (psdata->h2c_wakeupmode) {
507 case WAKEUP_METHOD_DTR:
508 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_DSR;
509 break;
510 case WAKEUP_METHOD_BREAK:
511 default:
512 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_BREAK;
513 break;
514 }
515 pcmd.h2c_wakeup_gpio = 0xff;
516
517 skb = nxp_drv_send_cmd(hdev, HCI_NXP_WAKEUP_METHOD, sizeof(pcmd), &pcmd);
518 if (IS_ERR(skb)) {
519 bt_dev_err(hdev, "Setting wake-up method failed (%ld)", PTR_ERR(skb));
520 return PTR_ERR(skb);
521 }
522
523 status = skb_pull_data(skb, 1);
524 if (status) {
525 if (*status == 0)
526 psdata->cur_h2c_wakeupmode = psdata->h2c_wakeupmode;
527 else
528 psdata->h2c_wakeupmode = psdata->cur_h2c_wakeupmode;
529 bt_dev_dbg(hdev, "Set Wakeup Method response: status=%d, h2c_wakeupmode=%d",
530 *status, psdata->cur_h2c_wakeupmode);
531 }
532 kfree_skb(skb);
533
534 return 0;
535 }
536
ps_init(struct hci_dev * hdev)537 static void ps_init(struct hci_dev *hdev)
538 {
539 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
540 struct ps_data *psdata = &nxpdev->psdata;
541
542 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_RTS);
543 usleep_range(5000, 10000);
544 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_RTS, 0);
545 usleep_range(5000, 10000);
546
547 psdata->ps_state = PS_STATE_AWAKE;
548 psdata->c2h_wakeupmode = BT_HOST_WAKEUP_METHOD_NONE;
549 psdata->c2h_wakeup_gpio = 0xff;
550
551 psdata->cur_h2c_wakeupmode = WAKEUP_METHOD_INVALID;
552 psdata->h2c_ps_interval = PS_DEFAULT_TIMEOUT_PERIOD_MS;
553 switch (DEFAULT_H2C_WAKEUP_MODE) {
554 case WAKEUP_METHOD_DTR:
555 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
556 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
557 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
558 break;
559 case WAKEUP_METHOD_BREAK:
560 default:
561 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
562 serdev_device_break_ctl(nxpdev->serdev, -1);
563 usleep_range(5000, 10000);
564 serdev_device_break_ctl(nxpdev->serdev, 0);
565 usleep_range(5000, 10000);
566 break;
567 }
568
569 psdata->cur_psmode = PS_MODE_DISABLE;
570 psdata->target_ps_mode = DEFAULT_PS_MODE;
571
572 if (psdata->cur_h2c_wakeupmode != psdata->h2c_wakeupmode)
573 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
574 if (psdata->cur_psmode != psdata->target_ps_mode)
575 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
576 }
577
578 /* NXP Firmware Download Feature */
nxp_download_firmware(struct hci_dev * hdev)579 static int nxp_download_firmware(struct hci_dev *hdev)
580 {
581 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
582 int err = 0;
583
584 nxpdev->fw_dnld_v1_offset = 0;
585 nxpdev->fw_v1_sent_bytes = 0;
586 nxpdev->fw_v1_expected_len = HDR_LEN;
587 nxpdev->boot_reg_offset = 0;
588 nxpdev->fw_dnld_v3_offset = 0;
589 nxpdev->fw_v3_offset_correction = 0;
590 nxpdev->baudrate_changed = false;
591 nxpdev->timeout_changed = false;
592 nxpdev->helper_downloaded = false;
593
594 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
595 serdev_device_set_flow_control(nxpdev->serdev, false);
596 nxpdev->current_baudrate = HCI_NXP_PRI_BAUDRATE;
597
598 /* Wait till FW is downloaded */
599 err = wait_event_interruptible_timeout(nxpdev->fw_dnld_done_wait_q,
600 !test_bit(BTNXPUART_FW_DOWNLOADING,
601 &nxpdev->tx_state),
602 msecs_to_jiffies(60000));
603
604 if (nxpdev->fw && strlen(nxpdev->fw_name)) {
605 release_firmware(nxpdev->fw);
606 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
607 }
608
609 if (err == 0) {
610 bt_dev_err(hdev, "FW Download Timeout. offset: %d",
611 nxpdev->fw_dnld_v1_offset ?
612 nxpdev->fw_dnld_v1_offset :
613 nxpdev->fw_dnld_v3_offset);
614 return -ETIMEDOUT;
615 }
616 if (test_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state)) {
617 bt_dev_err(hdev, "FW Download Aborted");
618 return -EINTR;
619 }
620
621 serdev_device_set_flow_control(nxpdev->serdev, true);
622
623 /* Allow the downloaded FW to initialize */
624 msleep(1200);
625
626 return 0;
627 }
628
nxp_send_ack(u8 ack,struct hci_dev * hdev)629 static void nxp_send_ack(u8 ack, struct hci_dev *hdev)
630 {
631 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
632 u8 ack_nak[2];
633 int len = 1;
634
635 ack_nak[0] = ack;
636 if (ack == NXP_ACK_V3) {
637 ack_nak[1] = crc8(crc8_table, ack_nak, 1, 0xff);
638 len = 2;
639 }
640 serdev_device_write_buf(nxpdev->serdev, ack_nak, len);
641 }
642
nxp_fw_change_baudrate(struct hci_dev * hdev,u16 req_len)643 static bool nxp_fw_change_baudrate(struct hci_dev *hdev, u16 req_len)
644 {
645 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
646 struct nxp_bootloader_cmd nxp_cmd5;
647 struct uart_config uart_config;
648 u32 clkdivaddr = CLKDIVADDR - nxpdev->boot_reg_offset;
649 u32 uartdivaddr = UARTDIVADDR - nxpdev->boot_reg_offset;
650 u32 uartmcraddr = UARTMCRADDR - nxpdev->boot_reg_offset;
651 u32 uartreinitaddr = UARTREINITADDR - nxpdev->boot_reg_offset;
652 u32 uarticraddr = UARTICRADDR - nxpdev->boot_reg_offset;
653 u32 uartfcraddr = UARTFCRADDR - nxpdev->boot_reg_offset;
654
655 if (req_len == sizeof(nxp_cmd5)) {
656 nxp_cmd5.header = __cpu_to_le32(5);
657 nxp_cmd5.arg = 0;
658 nxp_cmd5.payload_len = __cpu_to_le32(sizeof(uart_config));
659 /* FW expects swapped CRC bytes */
660 nxp_cmd5.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd5,
661 sizeof(nxp_cmd5) - 4));
662
663 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd5, sizeof(nxp_cmd5));
664 nxpdev->fw_v3_offset_correction += req_len;
665 } else if (req_len == sizeof(uart_config)) {
666 uart_config.clkdiv.address = __cpu_to_le32(clkdivaddr);
667 uart_config.clkdiv.value = __cpu_to_le32(0x00c00000);
668 uart_config.uartdiv.address = __cpu_to_le32(uartdivaddr);
669 uart_config.uartdiv.value = __cpu_to_le32(1);
670 uart_config.mcr.address = __cpu_to_le32(uartmcraddr);
671 uart_config.mcr.value = __cpu_to_le32(MCR);
672 uart_config.re_init.address = __cpu_to_le32(uartreinitaddr);
673 uart_config.re_init.value = __cpu_to_le32(INIT);
674 uart_config.icr.address = __cpu_to_le32(uarticraddr);
675 uart_config.icr.value = __cpu_to_le32(ICR);
676 uart_config.fcr.address = __cpu_to_le32(uartfcraddr);
677 uart_config.fcr.value = __cpu_to_le32(FCR);
678 /* FW expects swapped CRC bytes */
679 uart_config.crc = __cpu_to_be32(crc32_be(0UL, (char *)&uart_config,
680 sizeof(uart_config) - 4));
681
682 serdev_device_write_buf(nxpdev->serdev, (u8 *)&uart_config, sizeof(uart_config));
683 serdev_device_wait_until_sent(nxpdev->serdev, 0);
684 nxpdev->fw_v3_offset_correction += req_len;
685 return true;
686 }
687 return false;
688 }
689
nxp_fw_change_timeout(struct hci_dev * hdev,u16 req_len)690 static bool nxp_fw_change_timeout(struct hci_dev *hdev, u16 req_len)
691 {
692 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
693 struct nxp_bootloader_cmd nxp_cmd7;
694
695 if (req_len != sizeof(nxp_cmd7))
696 return false;
697
698 nxp_cmd7.header = __cpu_to_le32(7);
699 nxp_cmd7.arg = __cpu_to_le32(0x70);
700 nxp_cmd7.payload_len = 0;
701 /* FW expects swapped CRC bytes */
702 nxp_cmd7.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd7,
703 sizeof(nxp_cmd7) - 4));
704 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd7, sizeof(nxp_cmd7));
705 serdev_device_wait_until_sent(nxpdev->serdev, 0);
706 nxpdev->fw_v3_offset_correction += req_len;
707 return true;
708 }
709
nxp_get_data_len(const u8 * buf)710 static u32 nxp_get_data_len(const u8 *buf)
711 {
712 struct nxp_bootloader_cmd *hdr = (struct nxp_bootloader_cmd *)buf;
713
714 return __le32_to_cpu(hdr->payload_len);
715 }
716
is_fw_downloading(struct btnxpuart_dev * nxpdev)717 static bool is_fw_downloading(struct btnxpuart_dev *nxpdev)
718 {
719 return test_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
720 }
721
process_boot_signature(struct btnxpuart_dev * nxpdev)722 static bool process_boot_signature(struct btnxpuart_dev *nxpdev)
723 {
724 if (test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state)) {
725 clear_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
726 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
727 return false;
728 }
729 return is_fw_downloading(nxpdev);
730 }
731
nxp_request_firmware(struct hci_dev * hdev,const char * fw_name)732 static int nxp_request_firmware(struct hci_dev *hdev, const char *fw_name)
733 {
734 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
735 int err = 0;
736
737 if (!fw_name)
738 return -ENOENT;
739
740 if (!strlen(nxpdev->fw_name)) {
741 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "%s", fw_name);
742
743 bt_dev_dbg(hdev, "Request Firmware: %s", nxpdev->fw_name);
744 err = request_firmware(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
745 if (err < 0) {
746 bt_dev_err(hdev, "Firmware file %s not found", nxpdev->fw_name);
747 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
748 }
749 }
750 return err;
751 }
752
753 /* for legacy chipsets with V1 bootloader */
nxp_recv_chip_ver_v1(struct hci_dev * hdev,struct sk_buff * skb)754 static int nxp_recv_chip_ver_v1(struct hci_dev *hdev, struct sk_buff *skb)
755 {
756 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
757 struct v1_start_ind *req;
758 __u16 chip_id;
759
760 req = skb_pull_data(skb, sizeof(*req));
761 if (!req)
762 goto free_skb;
763
764 chip_id = le16_to_cpu(req->chip_id ^ req->chip_id_comp);
765 if (chip_id == 0xffff && nxpdev->fw_dnld_v1_offset) {
766 nxpdev->fw_dnld_v1_offset = 0;
767 nxpdev->fw_v1_sent_bytes = 0;
768 nxpdev->fw_v1_expected_len = HDR_LEN;
769 release_firmware(nxpdev->fw);
770 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
771 nxp_send_ack(NXP_ACK_V1, hdev);
772 }
773
774 free_skb:
775 kfree_skb(skb);
776 return 0;
777 }
778
nxp_recv_fw_req_v1(struct hci_dev * hdev,struct sk_buff * skb)779 static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
780 {
781 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
782 struct btnxpuart_data *nxp_data = nxpdev->nxp_data;
783 struct v1_data_req *req;
784 __u16 len;
785
786 if (!process_boot_signature(nxpdev))
787 goto free_skb;
788
789 req = skb_pull_data(skb, sizeof(*req));
790 if (!req)
791 goto free_skb;
792
793 len = __le16_to_cpu(req->len ^ req->len_comp);
794 if (len != 0xffff) {
795 bt_dev_dbg(hdev, "ERR: Send NAK");
796 nxp_send_ack(NXP_NAK_V1, hdev);
797 goto free_skb;
798 }
799 nxp_send_ack(NXP_ACK_V1, hdev);
800
801 len = __le16_to_cpu(req->len);
802
803 if (!nxp_data->helper_fw_name) {
804 if (!nxpdev->timeout_changed) {
805 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev,
806 len);
807 goto free_skb;
808 }
809 if (!nxpdev->baudrate_changed) {
810 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev,
811 len);
812 if (nxpdev->baudrate_changed) {
813 serdev_device_set_baudrate(nxpdev->serdev,
814 HCI_NXP_SEC_BAUDRATE);
815 serdev_device_set_flow_control(nxpdev->serdev, true);
816 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
817 }
818 goto free_skb;
819 }
820 }
821
822 if (!nxp_data->helper_fw_name || nxpdev->helper_downloaded) {
823 if (nxp_request_firmware(hdev, nxp_data->fw_name))
824 goto free_skb;
825 } else if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
826 if (nxp_request_firmware(hdev, nxp_data->helper_fw_name))
827 goto free_skb;
828 }
829
830 if (!len) {
831 bt_dev_dbg(hdev, "FW Downloaded Successfully: %zu bytes",
832 nxpdev->fw->size);
833 if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
834 nxpdev->helper_downloaded = true;
835 serdev_device_wait_until_sent(nxpdev->serdev, 0);
836 serdev_device_set_baudrate(nxpdev->serdev,
837 HCI_NXP_SEC_BAUDRATE);
838 serdev_device_set_flow_control(nxpdev->serdev, true);
839 } else {
840 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
841 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
842 }
843 goto free_skb;
844 }
845 if (len & 0x01) {
846 /* The CRC did not match at the other end.
847 * Simply send the same bytes again.
848 */
849 len = nxpdev->fw_v1_sent_bytes;
850 bt_dev_dbg(hdev, "CRC error. Resend %d bytes of FW.", len);
851 } else {
852 nxpdev->fw_dnld_v1_offset += nxpdev->fw_v1_sent_bytes;
853
854 /* The FW bin file is made up of many blocks of
855 * 16 byte header and payload data chunks. If the
856 * FW has requested a header, read the payload length
857 * info from the header, before sending the header.
858 * In the next iteration, the FW should request the
859 * payload data chunk, which should be equal to the
860 * payload length read from header. If there is a
861 * mismatch, clearly the driver and FW are out of sync,
862 * and we need to re-send the previous header again.
863 */
864 if (len == nxpdev->fw_v1_expected_len) {
865 if (len == HDR_LEN)
866 nxpdev->fw_v1_expected_len = nxp_get_data_len(nxpdev->fw->data +
867 nxpdev->fw_dnld_v1_offset);
868 else
869 nxpdev->fw_v1_expected_len = HDR_LEN;
870 } else if (len == HDR_LEN) {
871 /* FW download out of sync. Send previous chunk again */
872 nxpdev->fw_dnld_v1_offset -= nxpdev->fw_v1_sent_bytes;
873 nxpdev->fw_v1_expected_len = HDR_LEN;
874 }
875 }
876
877 if (nxpdev->fw_dnld_v1_offset + len <= nxpdev->fw->size)
878 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
879 nxpdev->fw_dnld_v1_offset, len);
880 nxpdev->fw_v1_sent_bytes = len;
881
882 free_skb:
883 kfree_skb(skb);
884 return 0;
885 }
886
nxp_get_fw_name_from_chipid(struct hci_dev * hdev,u16 chipid,u8 loader_ver)887 static char *nxp_get_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid,
888 u8 loader_ver)
889 {
890 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
891 char *fw_name = NULL;
892
893 switch (chipid) {
894 case CHIP_ID_W9098:
895 fw_name = FIRMWARE_W9098;
896 break;
897 case CHIP_ID_IW416:
898 fw_name = FIRMWARE_IW416;
899 break;
900 case CHIP_ID_IW612:
901 fw_name = FIRMWARE_IW612;
902 break;
903 case CHIP_ID_IW624a:
904 case CHIP_ID_IW624c:
905 nxpdev->boot_reg_offset = 1;
906 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
907 fw_name = FIRMWARE_IW624;
908 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
909 fw_name = FIRMWARE_SECURE_IW624;
910 else
911 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
912 break;
913 case CHIP_ID_AW693:
914 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
915 fw_name = FIRMWARE_AW693;
916 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
917 fw_name = FIRMWARE_SECURE_AW693;
918 else
919 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
920 break;
921 default:
922 bt_dev_err(hdev, "Unknown chip signature %04x", chipid);
923 break;
924 }
925 return fw_name;
926 }
927
nxp_recv_chip_ver_v3(struct hci_dev * hdev,struct sk_buff * skb)928 static int nxp_recv_chip_ver_v3(struct hci_dev *hdev, struct sk_buff *skb)
929 {
930 struct v3_start_ind *req = skb_pull_data(skb, sizeof(*req));
931 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
932 u16 chip_id;
933 u8 loader_ver;
934
935 if (!process_boot_signature(nxpdev))
936 goto free_skb;
937
938 chip_id = le16_to_cpu(req->chip_id);
939 loader_ver = req->loader_ver;
940 if (!nxp_request_firmware(hdev, nxp_get_fw_name_from_chipid(hdev,
941 chip_id, loader_ver)))
942 nxp_send_ack(NXP_ACK_V3, hdev);
943
944 free_skb:
945 kfree_skb(skb);
946 return 0;
947 }
948
nxp_handle_fw_download_error(struct hci_dev * hdev,struct v3_data_req * req)949 static void nxp_handle_fw_download_error(struct hci_dev *hdev, struct v3_data_req *req)
950 {
951 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
952 __u32 offset = __le32_to_cpu(req->offset);
953 __u16 err = __le16_to_cpu(req->error);
954 union nxp_v3_rx_timeout_nak_u nak_tx_buf;
955
956 switch (err) {
957 case NXP_ACK_RX_TIMEOUT:
958 case NXP_HDR_RX_TIMEOUT:
959 case NXP_DATA_RX_TIMEOUT:
960 nak_tx_buf.pkt.nak = NXP_NAK_V3;
961 nak_tx_buf.pkt.offset = __cpu_to_le32(offset);
962 nak_tx_buf.pkt.crc = crc8(crc8_table, nak_tx_buf.buf,
963 sizeof(nak_tx_buf) - 1, 0xff);
964 serdev_device_write_buf(nxpdev->serdev, nak_tx_buf.buf,
965 sizeof(nak_tx_buf));
966 break;
967 default:
968 bt_dev_dbg(hdev, "Unknown bootloader error code: %d", err);
969 break;
970
971 }
972
973 }
974
nxp_recv_fw_req_v3(struct hci_dev * hdev,struct sk_buff * skb)975 static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
976 {
977 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
978 struct v3_data_req *req;
979 __u16 len;
980 __u32 offset;
981
982 if (!process_boot_signature(nxpdev))
983 goto free_skb;
984
985 req = skb_pull_data(skb, sizeof(*req));
986 if (!req || !nxpdev->fw)
987 goto free_skb;
988
989 if (!req->error) {
990 nxp_send_ack(NXP_ACK_V3, hdev);
991 } else {
992 nxp_handle_fw_download_error(hdev, req);
993 goto free_skb;
994 }
995
996 len = __le16_to_cpu(req->len);
997
998 if (!nxpdev->timeout_changed) {
999 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev, len);
1000 goto free_skb;
1001 }
1002
1003 if (!nxpdev->baudrate_changed) {
1004 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev, len);
1005 if (nxpdev->baudrate_changed) {
1006 serdev_device_set_baudrate(nxpdev->serdev,
1007 HCI_NXP_SEC_BAUDRATE);
1008 serdev_device_set_flow_control(nxpdev->serdev, true);
1009 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
1010 }
1011 goto free_skb;
1012 }
1013
1014 if (req->len == 0) {
1015 bt_dev_dbg(hdev, "FW Downloaded Successfully: %zu bytes",
1016 nxpdev->fw->size);
1017 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1018 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1019 goto free_skb;
1020 }
1021
1022 offset = __le32_to_cpu(req->offset);
1023 if (offset < nxpdev->fw_v3_offset_correction) {
1024 /* This scenario should ideally never occur. But if it ever does,
1025 * FW is out of sync and needs a power cycle.
1026 */
1027 bt_dev_err(hdev, "Something went wrong during FW download");
1028 bt_dev_err(hdev, "Please power cycle and try again");
1029 goto free_skb;
1030 }
1031
1032 nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
1033 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
1034 nxpdev->fw_dnld_v3_offset, len);
1035
1036 free_skb:
1037 kfree_skb(skb);
1038 return 0;
1039 }
1040
nxp_set_baudrate_cmd(struct hci_dev * hdev,void * data)1041 static int nxp_set_baudrate_cmd(struct hci_dev *hdev, void *data)
1042 {
1043 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1044 __le32 new_baudrate = __cpu_to_le32(nxpdev->new_baudrate);
1045 struct ps_data *psdata = &nxpdev->psdata;
1046 struct sk_buff *skb;
1047 u8 *status;
1048
1049 if (!psdata)
1050 return 0;
1051
1052 skb = nxp_drv_send_cmd(hdev, HCI_NXP_SET_OPER_SPEED, 4, (u8 *)&new_baudrate);
1053 if (IS_ERR(skb)) {
1054 bt_dev_err(hdev, "Setting baudrate failed (%ld)", PTR_ERR(skb));
1055 return PTR_ERR(skb);
1056 }
1057
1058 status = (u8 *)skb_pull_data(skb, 1);
1059 if (status) {
1060 if (*status == 0) {
1061 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->new_baudrate);
1062 nxpdev->current_baudrate = nxpdev->new_baudrate;
1063 }
1064 bt_dev_dbg(hdev, "Set baudrate response: status=%d, baudrate=%d",
1065 *status, nxpdev->new_baudrate);
1066 }
1067 kfree_skb(skb);
1068
1069 return 0;
1070 }
1071
nxp_check_boot_sign(struct btnxpuart_dev * nxpdev)1072 static int nxp_check_boot_sign(struct btnxpuart_dev *nxpdev)
1073 {
1074 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
1075 if (test_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state))
1076 serdev_device_set_flow_control(nxpdev->serdev, false);
1077 else
1078 serdev_device_set_flow_control(nxpdev->serdev, true);
1079 set_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
1080
1081 return wait_event_interruptible_timeout(nxpdev->check_boot_sign_wait_q,
1082 !test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE,
1083 &nxpdev->tx_state),
1084 msecs_to_jiffies(1000));
1085 }
1086
nxp_set_ind_reset(struct hci_dev * hdev,void * data)1087 static int nxp_set_ind_reset(struct hci_dev *hdev, void *data)
1088 {
1089 static const u8 ir_hw_err[] = { HCI_EV_HARDWARE_ERROR,
1090 0x01, BTNXPUART_IR_HW_ERR };
1091 struct sk_buff *skb;
1092
1093 skb = bt_skb_alloc(3, GFP_ATOMIC);
1094 if (!skb)
1095 return -ENOMEM;
1096
1097 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1098 skb_put_data(skb, ir_hw_err, 3);
1099
1100 /* Inject Hardware Error to upper stack */
1101 return hci_recv_frame(hdev, skb);
1102 }
1103
1104 /* NXP protocol */
nxp_setup(struct hci_dev * hdev)1105 static int nxp_setup(struct hci_dev *hdev)
1106 {
1107 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1108 int err = 0;
1109
1110 if (nxp_check_boot_sign(nxpdev)) {
1111 bt_dev_dbg(hdev, "Need FW Download.");
1112 err = nxp_download_firmware(hdev);
1113 if (err < 0)
1114 return err;
1115 } else {
1116 bt_dev_dbg(hdev, "FW already running.");
1117 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1118 }
1119
1120 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->fw_init_baudrate);
1121 nxpdev->current_baudrate = nxpdev->fw_init_baudrate;
1122
1123 if (nxpdev->current_baudrate != HCI_NXP_SEC_BAUDRATE) {
1124 nxpdev->new_baudrate = HCI_NXP_SEC_BAUDRATE;
1125 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1126 }
1127
1128 ps_init(hdev);
1129
1130 if (test_and_clear_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state))
1131 hci_dev_clear_flag(hdev, HCI_SETUP);
1132
1133 return 0;
1134 }
1135
nxp_hw_err(struct hci_dev * hdev,u8 code)1136 static void nxp_hw_err(struct hci_dev *hdev, u8 code)
1137 {
1138 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1139
1140 switch (code) {
1141 case BTNXPUART_IR_HW_ERR:
1142 set_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state);
1143 hci_dev_set_flag(hdev, HCI_SETUP);
1144 break;
1145 default:
1146 break;
1147 }
1148 }
1149
nxp_shutdown(struct hci_dev * hdev)1150 static int nxp_shutdown(struct hci_dev *hdev)
1151 {
1152 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1153 struct sk_buff *skb;
1154 u8 *status;
1155 u8 pcmd = 0;
1156
1157 if (test_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state)) {
1158 skb = nxp_drv_send_cmd(hdev, HCI_NXP_IND_RESET, 1, &pcmd);
1159 if (IS_ERR(skb))
1160 return PTR_ERR(skb);
1161
1162 status = skb_pull_data(skb, 1);
1163 if (status) {
1164 serdev_device_set_flow_control(nxpdev->serdev, false);
1165 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1166 }
1167 kfree_skb(skb);
1168 }
1169
1170 return 0;
1171 }
1172
btnxpuart_queue_skb(struct hci_dev * hdev,struct sk_buff * skb)1173 static int btnxpuart_queue_skb(struct hci_dev *hdev, struct sk_buff *skb)
1174 {
1175 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1176
1177 /* Prepend skb with frame type */
1178 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
1179 skb_queue_tail(&nxpdev->txq, skb);
1180 btnxpuart_tx_wakeup(nxpdev);
1181 return 0;
1182 }
1183
nxp_enqueue(struct hci_dev * hdev,struct sk_buff * skb)1184 static int nxp_enqueue(struct hci_dev *hdev, struct sk_buff *skb)
1185 {
1186 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1187 struct ps_data *psdata = &nxpdev->psdata;
1188 struct hci_command_hdr *hdr;
1189 struct psmode_cmd_payload ps_parm;
1190 struct wakeup_cmd_payload wakeup_parm;
1191 __le32 baudrate_parm;
1192
1193 /* if vendor commands are received from user space (e.g. hcitool), update
1194 * driver flags accordingly and ask driver to re-send the command to FW.
1195 * In case the payload for any command does not match expected payload
1196 * length, let the firmware and user space program handle it, or throw
1197 * an error.
1198 */
1199 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT && !psdata->driver_sent_cmd) {
1200 hdr = (struct hci_command_hdr *)skb->data;
1201 if (hdr->plen != (skb->len - HCI_COMMAND_HDR_SIZE))
1202 return btnxpuart_queue_skb(hdev, skb);
1203
1204 switch (__le16_to_cpu(hdr->opcode)) {
1205 case HCI_NXP_AUTO_SLEEP_MODE:
1206 if (hdr->plen == sizeof(ps_parm)) {
1207 memcpy(&ps_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1208 if (ps_parm.ps_cmd == BT_PS_ENABLE)
1209 psdata->target_ps_mode = PS_MODE_ENABLE;
1210 else if (ps_parm.ps_cmd == BT_PS_DISABLE)
1211 psdata->target_ps_mode = PS_MODE_DISABLE;
1212 psdata->c2h_ps_interval = __le16_to_cpu(ps_parm.c2h_ps_interval);
1213 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
1214 goto free_skb;
1215 }
1216 break;
1217 case HCI_NXP_WAKEUP_METHOD:
1218 if (hdr->plen == sizeof(wakeup_parm)) {
1219 memcpy(&wakeup_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1220 psdata->c2h_wakeupmode = wakeup_parm.c2h_wakeupmode;
1221 psdata->c2h_wakeup_gpio = wakeup_parm.c2h_wakeup_gpio;
1222 psdata->h2c_wakeup_gpio = wakeup_parm.h2c_wakeup_gpio;
1223 switch (wakeup_parm.h2c_wakeupmode) {
1224 case BT_CTRL_WAKEUP_METHOD_DSR:
1225 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
1226 break;
1227 case BT_CTRL_WAKEUP_METHOD_BREAK:
1228 default:
1229 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
1230 break;
1231 }
1232 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
1233 goto free_skb;
1234 }
1235 break;
1236 case HCI_NXP_SET_OPER_SPEED:
1237 if (hdr->plen == sizeof(baudrate_parm)) {
1238 memcpy(&baudrate_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1239 nxpdev->new_baudrate = __le32_to_cpu(baudrate_parm);
1240 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1241 goto free_skb;
1242 }
1243 break;
1244 case HCI_NXP_IND_RESET:
1245 if (hdr->plen == 1) {
1246 hci_cmd_sync_queue(hdev, nxp_set_ind_reset, NULL, NULL);
1247 goto free_skb;
1248 }
1249 break;
1250 default:
1251 break;
1252 }
1253 }
1254
1255 return btnxpuart_queue_skb(hdev, skb);
1256
1257 free_skb:
1258 kfree_skb(skb);
1259 return 0;
1260 }
1261
nxp_dequeue(void * data)1262 static struct sk_buff *nxp_dequeue(void *data)
1263 {
1264 struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data;
1265
1266 ps_start_timer(nxpdev);
1267 return skb_dequeue(&nxpdev->txq);
1268 }
1269
1270 /* btnxpuart based on serdev */
btnxpuart_tx_work(struct work_struct * work)1271 static void btnxpuart_tx_work(struct work_struct *work)
1272 {
1273 struct btnxpuart_dev *nxpdev = container_of(work, struct btnxpuart_dev,
1274 tx_work);
1275 struct serdev_device *serdev = nxpdev->serdev;
1276 struct hci_dev *hdev = nxpdev->hdev;
1277 struct sk_buff *skb;
1278 int len;
1279
1280 if (ps_wakeup(nxpdev))
1281 return;
1282
1283 while ((skb = nxp_dequeue(nxpdev))) {
1284 len = serdev_device_write_buf(serdev, skb->data, skb->len);
1285 hdev->stat.byte_tx += len;
1286
1287 skb_pull(skb, len);
1288 if (skb->len > 0) {
1289 skb_queue_head(&nxpdev->txq, skb);
1290 continue;
1291 }
1292
1293 switch (hci_skb_pkt_type(skb)) {
1294 case HCI_COMMAND_PKT:
1295 hdev->stat.cmd_tx++;
1296 break;
1297 case HCI_ACLDATA_PKT:
1298 hdev->stat.acl_tx++;
1299 break;
1300 case HCI_SCODATA_PKT:
1301 hdev->stat.sco_tx++;
1302 break;
1303 }
1304
1305 kfree_skb(skb);
1306 }
1307 clear_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
1308 }
1309
btnxpuart_open(struct hci_dev * hdev)1310 static int btnxpuart_open(struct hci_dev *hdev)
1311 {
1312 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1313 int err = 0;
1314
1315 err = serdev_device_open(nxpdev->serdev);
1316 if (err) {
1317 bt_dev_err(hdev, "Unable to open UART device %s",
1318 dev_name(&nxpdev->serdev->dev));
1319 } else {
1320 set_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1321 }
1322 return err;
1323 }
1324
btnxpuart_close(struct hci_dev * hdev)1325 static int btnxpuart_close(struct hci_dev *hdev)
1326 {
1327 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1328
1329 serdev_device_close(nxpdev->serdev);
1330 skb_queue_purge(&nxpdev->txq);
1331 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1332 kfree_skb(nxpdev->rx_skb);
1333 nxpdev->rx_skb = NULL;
1334 }
1335 clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1336 return 0;
1337 }
1338
btnxpuart_flush(struct hci_dev * hdev)1339 static int btnxpuart_flush(struct hci_dev *hdev)
1340 {
1341 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1342
1343 /* Flush any pending characters */
1344 serdev_device_write_flush(nxpdev->serdev);
1345 skb_queue_purge(&nxpdev->txq);
1346
1347 cancel_work_sync(&nxpdev->tx_work);
1348
1349 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1350 kfree_skb(nxpdev->rx_skb);
1351 nxpdev->rx_skb = NULL;
1352 }
1353
1354 return 0;
1355 }
1356
1357 static const struct h4_recv_pkt nxp_recv_pkts[] = {
1358 { H4_RECV_ACL, .recv = hci_recv_frame },
1359 { H4_RECV_SCO, .recv = hci_recv_frame },
1360 { H4_RECV_EVENT, .recv = hci_recv_frame },
1361 { NXP_RECV_CHIP_VER_V1, .recv = nxp_recv_chip_ver_v1 },
1362 { NXP_RECV_FW_REQ_V1, .recv = nxp_recv_fw_req_v1 },
1363 { NXP_RECV_CHIP_VER_V3, .recv = nxp_recv_chip_ver_v3 },
1364 { NXP_RECV_FW_REQ_V3, .recv = nxp_recv_fw_req_v3 },
1365 };
1366
btnxpuart_receive_buf(struct serdev_device * serdev,const u8 * data,size_t count)1367 static int btnxpuart_receive_buf(struct serdev_device *serdev, const u8 *data,
1368 size_t count)
1369 {
1370 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1371
1372 ps_start_timer(nxpdev);
1373
1374 nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
1375 nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
1376 if (IS_ERR(nxpdev->rx_skb)) {
1377 int err = PTR_ERR(nxpdev->rx_skb);
1378 /* Safe to ignore out-of-sync bootloader signatures */
1379 if (!is_fw_downloading(nxpdev))
1380 bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
1381 nxpdev->rx_skb = NULL;
1382 return count;
1383 }
1384 if (!is_fw_downloading(nxpdev))
1385 nxpdev->hdev->stat.byte_rx += count;
1386 return count;
1387 }
1388
btnxpuart_write_wakeup(struct serdev_device * serdev)1389 static void btnxpuart_write_wakeup(struct serdev_device *serdev)
1390 {
1391 serdev_device_write_wakeup(serdev);
1392 }
1393
1394 static const struct serdev_device_ops btnxpuart_client_ops = {
1395 .receive_buf = btnxpuart_receive_buf,
1396 .write_wakeup = btnxpuart_write_wakeup,
1397 };
1398
nxp_serdev_probe(struct serdev_device * serdev)1399 static int nxp_serdev_probe(struct serdev_device *serdev)
1400 {
1401 struct hci_dev *hdev;
1402 struct btnxpuart_dev *nxpdev;
1403
1404 nxpdev = devm_kzalloc(&serdev->dev, sizeof(*nxpdev), GFP_KERNEL);
1405 if (!nxpdev)
1406 return -ENOMEM;
1407
1408 nxpdev->nxp_data = (struct btnxpuart_data *)device_get_match_data(&serdev->dev);
1409
1410 nxpdev->serdev = serdev;
1411 serdev_device_set_drvdata(serdev, nxpdev);
1412
1413 serdev_device_set_client_ops(serdev, &btnxpuart_client_ops);
1414
1415 INIT_WORK(&nxpdev->tx_work, btnxpuart_tx_work);
1416 skb_queue_head_init(&nxpdev->txq);
1417
1418 init_waitqueue_head(&nxpdev->fw_dnld_done_wait_q);
1419 init_waitqueue_head(&nxpdev->check_boot_sign_wait_q);
1420
1421 device_property_read_u32(&nxpdev->serdev->dev, "fw-init-baudrate",
1422 &nxpdev->fw_init_baudrate);
1423 if (!nxpdev->fw_init_baudrate)
1424 nxpdev->fw_init_baudrate = FW_INIT_BAUDRATE;
1425
1426 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1427
1428 crc8_populate_msb(crc8_table, POLYNOMIAL8);
1429
1430 /* Initialize and register HCI device */
1431 hdev = hci_alloc_dev();
1432 if (!hdev) {
1433 dev_err(&serdev->dev, "Can't allocate HCI device\n");
1434 return -ENOMEM;
1435 }
1436
1437 nxpdev->hdev = hdev;
1438
1439 hdev->bus = HCI_UART;
1440 hci_set_drvdata(hdev, nxpdev);
1441
1442 hdev->manufacturer = MANUFACTURER_NXP;
1443 hdev->open = btnxpuart_open;
1444 hdev->close = btnxpuart_close;
1445 hdev->flush = btnxpuart_flush;
1446 hdev->setup = nxp_setup;
1447 hdev->send = nxp_enqueue;
1448 hdev->hw_error = nxp_hw_err;
1449 hdev->shutdown = nxp_shutdown;
1450 SET_HCIDEV_DEV(hdev, &serdev->dev);
1451
1452 if (hci_register_dev(hdev) < 0) {
1453 dev_err(&serdev->dev, "Can't register HCI device\n");
1454 hci_free_dev(hdev);
1455 return -ENODEV;
1456 }
1457
1458 ps_setup(hdev);
1459
1460 return 0;
1461 }
1462
nxp_serdev_remove(struct serdev_device * serdev)1463 static void nxp_serdev_remove(struct serdev_device *serdev)
1464 {
1465 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1466 struct hci_dev *hdev = nxpdev->hdev;
1467
1468 if (is_fw_downloading(nxpdev)) {
1469 set_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state);
1470 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1471 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
1472 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1473 } else {
1474 /* Restore FW baudrate to fw_init_baudrate if changed.
1475 * This will ensure FW baudrate is in sync with
1476 * driver baudrate in case this driver is re-inserted.
1477 */
1478 if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
1479 nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
1480 nxp_set_baudrate_cmd(hdev, NULL);
1481 }
1482 }
1483 ps_cleanup(nxpdev);
1484 hci_unregister_dev(hdev);
1485 hci_free_dev(hdev);
1486 }
1487
1488 static struct btnxpuart_data w8987_data __maybe_unused = {
1489 .helper_fw_name = NULL,
1490 .fw_name = FIRMWARE_W8987,
1491 };
1492
1493 static struct btnxpuart_data w8997_data __maybe_unused = {
1494 .helper_fw_name = FIRMWARE_HELPER,
1495 .fw_name = FIRMWARE_W8997,
1496 };
1497
1498 static const struct of_device_id nxpuart_of_match_table[] __maybe_unused = {
1499 { .compatible = "nxp,88w8987-bt", .data = &w8987_data },
1500 { .compatible = "nxp,88w8997-bt", .data = &w8997_data },
1501 { }
1502 };
1503 MODULE_DEVICE_TABLE(of, nxpuart_of_match_table);
1504
1505 static struct serdev_device_driver nxp_serdev_driver = {
1506 .probe = nxp_serdev_probe,
1507 .remove = nxp_serdev_remove,
1508 .driver = {
1509 .name = "btnxpuart",
1510 .of_match_table = of_match_ptr(nxpuart_of_match_table),
1511 },
1512 };
1513
1514 module_serdev_device_driver(nxp_serdev_driver);
1515
1516 MODULE_AUTHOR("Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>");
1517 MODULE_DESCRIPTION("NXP Bluetooth Serial driver");
1518 MODULE_LICENSE("GPL");
1519