1 // SPDX-License-Identifier: GPL-2.0 2 // Copyright (c) 2018 MediaTek Inc. 3 4 /* 5 * Bluetooth support for MediaTek serial devices 6 * 7 * Author: Sean Wang <sean.wang@mediatek.com> 8 * 9 */ 10 11 #include <asm/unaligned.h> 12 #include <linux/atomic.h> 13 #include <linux/clk.h> 14 #include <linux/firmware.h> 15 #include <linux/kernel.h> 16 #include <linux/module.h> 17 #include <linux/of.h> 18 #include <linux/pm_runtime.h> 19 #include <linux/serdev.h> 20 #include <linux/skbuff.h> 21 22 #include <net/bluetooth/bluetooth.h> 23 #include <net/bluetooth/hci_core.h> 24 25 #include "h4_recv.h" 26 27 #define VERSION "0.1" 28 29 #define FIRMWARE_MT7622 "mediatek/mt7622pr2h.bin" 30 31 #define MTK_STP_TLR_SIZE 2 32 33 #define BTMTKUART_TX_STATE_ACTIVE 1 34 #define BTMTKUART_TX_STATE_WAKEUP 2 35 #define BTMTKUART_TX_WAIT_VND_EVT 3 36 37 enum { 38 MTK_WMT_PATCH_DWNLD = 0x1, 39 MTK_WMT_FUNC_CTRL = 0x6, 40 MTK_WMT_RST = 0x7 41 }; 42 43 struct mtk_stp_hdr { 44 u8 prefix; 45 __be16 dlen; 46 u8 cs; 47 } __packed; 48 49 struct mtk_wmt_hdr { 50 u8 dir; 51 u8 op; 52 __le16 dlen; 53 u8 flag; 54 } __packed; 55 56 struct mtk_hci_wmt_cmd { 57 struct mtk_wmt_hdr hdr; 58 u8 data[256]; 59 } __packed; 60 61 struct btmtkuart_dev { 62 struct hci_dev *hdev; 63 struct serdev_device *serdev; 64 struct clk *clk; 65 66 struct work_struct tx_work; 67 unsigned long tx_state; 68 struct sk_buff_head txq; 69 70 struct sk_buff *rx_skb; 71 72 u8 stp_pad[6]; 73 u8 stp_cursor; 74 u16 stp_dlen; 75 }; 76 77 static int mtk_hci_wmt_sync(struct hci_dev *hdev, u8 op, u8 flag, u16 plen, 78 const void *param) 79 { 80 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 81 struct mtk_hci_wmt_cmd wc; 82 struct mtk_wmt_hdr *hdr; 83 u32 hlen; 84 int err; 85 86 hlen = sizeof(*hdr) + plen; 87 if (hlen > 255) 88 return -EINVAL; 89 90 hdr = (struct mtk_wmt_hdr *)&wc; 91 hdr->dir = 1; 92 hdr->op = op; 93 hdr->dlen = cpu_to_le16(plen + 1); 94 hdr->flag = flag; 95 memcpy(wc.data, param, plen); 96 97 set_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); 98 99 err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc); 100 if (err < 0) { 101 clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); 102 return err; 103 } 104 105 /* The vendor specific WMT commands are all answered by a vendor 106 * specific event and will not have the Command Status or Command 107 * Complete as with usual HCI command flow control. 108 * 109 * After sending the command, wait for BTMTKUART_TX_WAIT_VND_EVT 110 * state to be cleared. The driver speicfic event receive routine 111 * will clear that state and with that indicate completion of the 112 * WMT command. 113 */ 114 err = wait_on_bit_timeout(&bdev->tx_state, BTMTKUART_TX_WAIT_VND_EVT, 115 TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT); 116 if (err == -EINTR) { 117 bt_dev_err(hdev, "Execution of wmt command interrupted"); 118 return err; 119 } 120 121 if (err) { 122 bt_dev_err(hdev, "Execution of wmt command timed out"); 123 return -ETIMEDOUT; 124 } 125 126 return 0; 127 } 128 129 static int mtk_setup_fw(struct hci_dev *hdev) 130 { 131 const struct firmware *fw; 132 const u8 *fw_ptr; 133 size_t fw_size; 134 int err, dlen; 135 u8 flag; 136 137 err = request_firmware(&fw, FIRMWARE_MT7622, &hdev->dev); 138 if (err < 0) { 139 bt_dev_err(hdev, "Failed to load firmware file (%d)", err); 140 return err; 141 } 142 143 fw_ptr = fw->data; 144 fw_size = fw->size; 145 146 /* The size of patch header is 30 bytes, should be skip */ 147 if (fw_size < 30) 148 return -EINVAL; 149 150 fw_size -= 30; 151 fw_ptr += 30; 152 flag = 1; 153 154 while (fw_size > 0) { 155 dlen = min_t(int, 250, fw_size); 156 157 /* Tell device the position in sequence */ 158 if (fw_size - dlen <= 0) 159 flag = 3; 160 else if (fw_size < fw->size - 30) 161 flag = 2; 162 163 err = mtk_hci_wmt_sync(hdev, MTK_WMT_PATCH_DWNLD, flag, dlen, 164 fw_ptr); 165 if (err < 0) { 166 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 167 err); 168 break; 169 } 170 171 fw_size -= dlen; 172 fw_ptr += dlen; 173 } 174 175 release_firmware(fw); 176 177 return err; 178 } 179 180 static int btmtkuart_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 181 { 182 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 183 struct hci_event_hdr *hdr = (void *)skb->data; 184 int err; 185 186 /* Fix up the vendor event id with 0xff for vendor specific instead 187 * of 0xe4 so that event send via monitoring socket can be parsed 188 * properly. 189 */ 190 if (hdr->evt == 0xe4) 191 hdr->evt = HCI_EV_VENDOR; 192 193 err = hci_recv_frame(hdev, skb); 194 195 if (hdr->evt == HCI_EV_VENDOR) { 196 if (test_and_clear_bit(BTMTKUART_TX_WAIT_VND_EVT, 197 &bdev->tx_state)) { 198 /* Barrier to sync with other CPUs */ 199 smp_mb__after_atomic(); 200 wake_up_bit(&bdev->tx_state, BTMTKUART_TX_WAIT_VND_EVT); 201 } 202 } 203 204 return err; 205 } 206 207 static const struct h4_recv_pkt mtk_recv_pkts[] = { 208 { H4_RECV_ACL, .recv = hci_recv_frame }, 209 { H4_RECV_SCO, .recv = hci_recv_frame }, 210 { H4_RECV_EVENT, .recv = btmtkuart_recv_event }, 211 }; 212 213 static void btmtkuart_tx_work(struct work_struct *work) 214 { 215 struct btmtkuart_dev *bdev = container_of(work, struct btmtkuart_dev, 216 tx_work); 217 struct serdev_device *serdev = bdev->serdev; 218 struct hci_dev *hdev = bdev->hdev; 219 220 while (1) { 221 clear_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state); 222 223 while (1) { 224 struct sk_buff *skb = skb_dequeue(&bdev->txq); 225 int len; 226 227 if (!skb) 228 break; 229 230 len = serdev_device_write_buf(serdev, skb->data, 231 skb->len); 232 hdev->stat.byte_tx += len; 233 234 skb_pull(skb, len); 235 if (skb->len > 0) { 236 skb_queue_head(&bdev->txq, skb); 237 break; 238 } 239 240 switch (hci_skb_pkt_type(skb)) { 241 case HCI_COMMAND_PKT: 242 hdev->stat.cmd_tx++; 243 break; 244 case HCI_ACLDATA_PKT: 245 hdev->stat.acl_tx++; 246 break; 247 case HCI_SCODATA_PKT: 248 hdev->stat.sco_tx++; 249 break; 250 } 251 252 kfree_skb(skb); 253 } 254 255 if (!test_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state)) 256 break; 257 } 258 259 clear_bit(BTMTKUART_TX_STATE_ACTIVE, &bdev->tx_state); 260 } 261 262 static void btmtkuart_tx_wakeup(struct btmtkuart_dev *bdev) 263 { 264 if (test_and_set_bit(BTMTKUART_TX_STATE_ACTIVE, &bdev->tx_state)) 265 set_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state); 266 267 schedule_work(&bdev->tx_work); 268 } 269 270 static const unsigned char * 271 mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count, 272 int *sz_h4) 273 { 274 struct mtk_stp_hdr *shdr; 275 276 /* The cursor is reset when all the data of STP is consumed out */ 277 if (!bdev->stp_dlen && bdev->stp_cursor >= 6) 278 bdev->stp_cursor = 0; 279 280 /* Filling pad until all STP info is obtained */ 281 while (bdev->stp_cursor < 6 && count > 0) { 282 bdev->stp_pad[bdev->stp_cursor] = *data; 283 bdev->stp_cursor++; 284 data++; 285 count--; 286 } 287 288 /* Retrieve STP info and have a sanity check */ 289 if (!bdev->stp_dlen && bdev->stp_cursor >= 6) { 290 shdr = (struct mtk_stp_hdr *)&bdev->stp_pad[2]; 291 bdev->stp_dlen = be16_to_cpu(shdr->dlen) & 0x0fff; 292 293 /* Resync STP when unexpected data is being read */ 294 if (shdr->prefix != 0x80 || bdev->stp_dlen > 2048) { 295 bt_dev_err(bdev->hdev, "stp format unexpect (%d, %d)", 296 shdr->prefix, bdev->stp_dlen); 297 bdev->stp_cursor = 2; 298 bdev->stp_dlen = 0; 299 } 300 } 301 302 /* Directly quit when there's no data found for H4 can process */ 303 if (count <= 0) 304 return NULL; 305 306 /* Tranlate to how much the size of data H4 can handle so far */ 307 *sz_h4 = min_t(int, count, bdev->stp_dlen); 308 309 /* Update the remaining size of STP packet */ 310 bdev->stp_dlen -= *sz_h4; 311 312 /* Data points to STP payload which can be handled by H4 */ 313 return data; 314 } 315 316 static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) 317 { 318 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 319 const unsigned char *p_left = data, *p_h4; 320 int sz_left = count, sz_h4, adv; 321 int err; 322 323 while (sz_left > 0) { 324 /* The serial data received from MT7622 BT controller is 325 * at all time padded around with the STP header and tailer. 326 * 327 * A full STP packet is looking like 328 * ----------------------------------- 329 * | STP header | H:4 | STP tailer | 330 * ----------------------------------- 331 * but it doesn't guarantee to contain a full H:4 packet which 332 * means that it's possible for multiple STP packets forms a 333 * full H:4 packet that means extra STP header + length doesn't 334 * indicate a full H:4 frame, things can fragment. Whose length 335 * recorded in STP header just shows up the most length the 336 * H:4 engine can handle currently. 337 */ 338 339 p_h4 = mtk_stp_split(bdev, p_left, sz_left, &sz_h4); 340 if (!p_h4) 341 break; 342 343 adv = p_h4 - p_left; 344 sz_left -= adv; 345 p_left += adv; 346 347 bdev->rx_skb = h4_recv_buf(bdev->hdev, bdev->rx_skb, p_h4, 348 sz_h4, mtk_recv_pkts, 349 ARRAY_SIZE(mtk_recv_pkts)); 350 if (IS_ERR(bdev->rx_skb)) { 351 err = PTR_ERR(bdev->rx_skb); 352 bt_dev_err(bdev->hdev, 353 "Frame reassembly failed (%d)", err); 354 bdev->rx_skb = NULL; 355 return err; 356 } 357 358 sz_left -= sz_h4; 359 p_left += sz_h4; 360 } 361 362 return 0; 363 } 364 365 static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data, 366 size_t count) 367 { 368 struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); 369 int err; 370 371 err = btmtkuart_recv(bdev->hdev, data, count); 372 if (err < 0) 373 return err; 374 375 bdev->hdev->stat.byte_rx += count; 376 377 return count; 378 } 379 380 static void btmtkuart_write_wakeup(struct serdev_device *serdev) 381 { 382 struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); 383 384 btmtkuart_tx_wakeup(bdev); 385 } 386 387 static const struct serdev_device_ops btmtkuart_client_ops = { 388 .receive_buf = btmtkuart_receive_buf, 389 .write_wakeup = btmtkuart_write_wakeup, 390 }; 391 392 static int btmtkuart_open(struct hci_dev *hdev) 393 { 394 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 395 struct device *dev; 396 int err; 397 398 err = serdev_device_open(bdev->serdev); 399 if (err) { 400 bt_dev_err(hdev, "Unable to open UART device %s", 401 dev_name(&bdev->serdev->dev)); 402 goto err_open; 403 } 404 405 bdev->stp_cursor = 2; 406 bdev->stp_dlen = 0; 407 408 dev = &bdev->serdev->dev; 409 410 /* Enable the power domain and clock the device requires */ 411 pm_runtime_enable(dev); 412 err = pm_runtime_get_sync(dev); 413 if (err < 0) { 414 pm_runtime_put_noidle(dev); 415 goto err_disable_rpm; 416 } 417 418 err = clk_prepare_enable(bdev->clk); 419 if (err < 0) 420 goto err_put_rpm; 421 422 return 0; 423 424 err_put_rpm: 425 pm_runtime_put_sync(dev); 426 err_disable_rpm: 427 pm_runtime_disable(dev); 428 err_open: 429 return err; 430 } 431 432 static int btmtkuart_close(struct hci_dev *hdev) 433 { 434 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 435 struct device *dev = &bdev->serdev->dev; 436 437 /* Shutdown the clock and power domain the device requires */ 438 clk_disable_unprepare(bdev->clk); 439 pm_runtime_put_sync(dev); 440 pm_runtime_disable(dev); 441 442 serdev_device_close(bdev->serdev); 443 444 return 0; 445 } 446 447 static int btmtkuart_flush(struct hci_dev *hdev) 448 { 449 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 450 451 /* Flush any pending characters */ 452 serdev_device_write_flush(bdev->serdev); 453 skb_queue_purge(&bdev->txq); 454 455 cancel_work_sync(&bdev->tx_work); 456 457 kfree_skb(bdev->rx_skb); 458 bdev->rx_skb = NULL; 459 460 bdev->stp_cursor = 2; 461 bdev->stp_dlen = 0; 462 463 return 0; 464 } 465 466 static int btmtkuart_setup(struct hci_dev *hdev) 467 { 468 u8 param = 0x1; 469 int err = 0; 470 471 /* Setup a firmware which the device definitely requires */ 472 err = mtk_setup_fw(hdev); 473 if (err < 0) 474 return err; 475 476 /* Activate function the firmware providing to */ 477 err = mtk_hci_wmt_sync(hdev, MTK_WMT_RST, 0x4, 0, 0); 478 if (err < 0) { 479 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err); 480 return err; 481 } 482 483 /* Enable Bluetooth protocol */ 484 err = mtk_hci_wmt_sync(hdev, MTK_WMT_FUNC_CTRL, 0x0, sizeof(param), 485 ¶m); 486 if (err < 0) { 487 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 488 return err; 489 } 490 491 return 0; 492 } 493 494 static int btmtkuart_shutdown(struct hci_dev *hdev) 495 { 496 u8 param = 0x0; 497 int err; 498 499 /* Disable the device */ 500 err = mtk_hci_wmt_sync(hdev, MTK_WMT_FUNC_CTRL, 0x0, sizeof(param), 501 ¶m); 502 if (err < 0) { 503 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 504 return err; 505 } 506 507 return 0; 508 } 509 510 static int btmtkuart_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 511 { 512 struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); 513 struct mtk_stp_hdr *shdr; 514 int err, dlen, type = 0; 515 516 /* Prepend skb with frame type */ 517 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 518 519 /* Make sure that there is enough rooms for STP header and trailer */ 520 if (unlikely(skb_headroom(skb) < sizeof(*shdr)) || 521 (skb_tailroom(skb) < MTK_STP_TLR_SIZE)) { 522 err = pskb_expand_head(skb, sizeof(*shdr), MTK_STP_TLR_SIZE, 523 GFP_ATOMIC); 524 if (err < 0) 525 return err; 526 } 527 528 /* Add the STP header */ 529 dlen = skb->len; 530 shdr = skb_push(skb, sizeof(*shdr)); 531 shdr->prefix = 0x80; 532 shdr->dlen = cpu_to_be16((dlen & 0x0fff) | (type << 12)); 533 shdr->cs = 0; /* MT7622 doesn't care about checksum value */ 534 535 /* Add the STP trailer */ 536 skb_put_zero(skb, MTK_STP_TLR_SIZE); 537 538 skb_queue_tail(&bdev->txq, skb); 539 540 btmtkuart_tx_wakeup(bdev); 541 return 0; 542 } 543 544 static int btmtkuart_probe(struct serdev_device *serdev) 545 { 546 struct btmtkuart_dev *bdev; 547 struct hci_dev *hdev; 548 549 bdev = devm_kzalloc(&serdev->dev, sizeof(*bdev), GFP_KERNEL); 550 if (!bdev) 551 return -ENOMEM; 552 553 bdev->clk = devm_clk_get(&serdev->dev, "ref"); 554 if (IS_ERR(bdev->clk)) 555 return PTR_ERR(bdev->clk); 556 557 bdev->serdev = serdev; 558 serdev_device_set_drvdata(serdev, bdev); 559 560 serdev_device_set_client_ops(serdev, &btmtkuart_client_ops); 561 562 INIT_WORK(&bdev->tx_work, btmtkuart_tx_work); 563 skb_queue_head_init(&bdev->txq); 564 565 /* Initialize and register HCI device */ 566 hdev = hci_alloc_dev(); 567 if (!hdev) { 568 dev_err(&serdev->dev, "Can't allocate HCI device\n"); 569 return -ENOMEM; 570 } 571 572 bdev->hdev = hdev; 573 574 hdev->bus = HCI_UART; 575 hci_set_drvdata(hdev, bdev); 576 577 hdev->open = btmtkuart_open; 578 hdev->close = btmtkuart_close; 579 hdev->flush = btmtkuart_flush; 580 hdev->setup = btmtkuart_setup; 581 hdev->shutdown = btmtkuart_shutdown; 582 hdev->send = btmtkuart_send_frame; 583 SET_HCIDEV_DEV(hdev, &serdev->dev); 584 585 hdev->manufacturer = 70; 586 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 587 588 if (hci_register_dev(hdev) < 0) { 589 dev_err(&serdev->dev, "Can't register HCI device\n"); 590 hci_free_dev(hdev); 591 return -ENODEV; 592 } 593 594 return 0; 595 } 596 597 static void btmtkuart_remove(struct serdev_device *serdev) 598 { 599 struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); 600 struct hci_dev *hdev = bdev->hdev; 601 602 hci_unregister_dev(hdev); 603 hci_free_dev(hdev); 604 } 605 606 #ifdef CONFIG_OF 607 static const struct of_device_id mtk_of_match_table[] = { 608 { .compatible = "mediatek,mt7622-bluetooth"}, 609 { } 610 }; 611 MODULE_DEVICE_TABLE(of, mtk_of_match_table); 612 #endif 613 614 static struct serdev_device_driver btmtkuart_driver = { 615 .probe = btmtkuart_probe, 616 .remove = btmtkuart_remove, 617 .driver = { 618 .name = "btmtkuart", 619 .of_match_table = of_match_ptr(mtk_of_match_table), 620 }, 621 }; 622 623 module_serdev_device_driver(btmtkuart_driver); 624 625 MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>"); 626 MODULE_DESCRIPTION("MediaTek Bluetooth Serial driver ver " VERSION); 627 MODULE_VERSION(VERSION); 628 MODULE_LICENSE("GPL"); 629 MODULE_FIRMWARE(FIRMWARE_MT7622); 630