xref: /openbmc/linux/drivers/bluetooth/hci_ll.c (revision d0e22329)
1 /*
2  *  Texas Instruments' Bluetooth HCILL UART protocol
3  *
4  *  HCILL (HCI Low Level) is a Texas Instruments' power management
5  *  protocol extension to H4.
6  *
7  *  Copyright (C) 2007 Texas Instruments, Inc.
8  *
9  *  Written by Ohad Ben-Cohen <ohad@bencohen.org>
10  *
11  *  Acknowledgements:
12  *  This file is based on hci_h4.c, which was written
13  *  by Maxim Krasnyansky and Marcel Holtmann.
14  *
15  *  This program is free software; you can redistribute it and/or modify
16  *  it under the terms of the GNU General Public License version 2
17  *  as published by the Free Software Foundation
18  *
19  *  This program is distributed in the hope that it will be useful,
20  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
21  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
22  *  GNU General Public License for more details.
23  *
24  *  You should have received a copy of the GNU General Public License
25  *  along with this program; if not, write to the Free Software
26  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
27  *
28  */
29 
30 #include <linux/module.h>
31 #include <linux/kernel.h>
32 
33 #include <linux/init.h>
34 #include <linux/sched.h>
35 #include <linux/types.h>
36 #include <linux/fcntl.h>
37 #include <linux/firmware.h>
38 #include <linux/interrupt.h>
39 #include <linux/ptrace.h>
40 #include <linux/poll.h>
41 
42 #include <linux/slab.h>
43 #include <linux/errno.h>
44 #include <linux/string.h>
45 #include <linux/signal.h>
46 #include <linux/ioctl.h>
47 #include <linux/of.h>
48 #include <linux/serdev.h>
49 #include <linux/skbuff.h>
50 #include <linux/ti_wilink_st.h>
51 #include <linux/clk.h>
52 
53 #include <net/bluetooth/bluetooth.h>
54 #include <net/bluetooth/hci_core.h>
55 #include <linux/gpio/consumer.h>
56 #include <linux/nvmem-consumer.h>
57 
58 #include "hci_uart.h"
59 
60 /* Vendor-specific HCI commands */
61 #define HCI_VS_WRITE_BD_ADDR			0xfc06
62 #define HCI_VS_UPDATE_UART_HCI_BAUDRATE		0xff36
63 
64 /* HCILL commands */
65 #define HCILL_GO_TO_SLEEP_IND	0x30
66 #define HCILL_GO_TO_SLEEP_ACK	0x31
67 #define HCILL_WAKE_UP_IND	0x32
68 #define HCILL_WAKE_UP_ACK	0x33
69 
70 /* HCILL states */
71 enum hcill_states_e {
72 	HCILL_ASLEEP,
73 	HCILL_ASLEEP_TO_AWAKE,
74 	HCILL_AWAKE,
75 	HCILL_AWAKE_TO_ASLEEP
76 };
77 
78 struct ll_device {
79 	struct hci_uart hu;
80 	struct serdev_device *serdev;
81 	struct gpio_desc *enable_gpio;
82 	struct clk *ext_clk;
83 	bdaddr_t bdaddr;
84 };
85 
86 struct ll_struct {
87 	struct sk_buff *rx_skb;
88 	struct sk_buff_head txq;
89 	spinlock_t hcill_lock;		/* HCILL state lock	*/
90 	unsigned long hcill_state;	/* HCILL power state	*/
91 	struct sk_buff_head tx_wait_q;	/* HCILL wait queue	*/
92 };
93 
94 /*
95  * Builds and sends an HCILL command packet.
96  * These are very simple packets with only 1 cmd byte
97  */
98 static int send_hcill_cmd(u8 cmd, struct hci_uart *hu)
99 {
100 	int err = 0;
101 	struct sk_buff *skb = NULL;
102 	struct ll_struct *ll = hu->priv;
103 
104 	BT_DBG("hu %p cmd 0x%x", hu, cmd);
105 
106 	/* allocate packet */
107 	skb = bt_skb_alloc(1, GFP_ATOMIC);
108 	if (!skb) {
109 		BT_ERR("cannot allocate memory for HCILL packet");
110 		err = -ENOMEM;
111 		goto out;
112 	}
113 
114 	/* prepare packet */
115 	skb_put_u8(skb, cmd);
116 
117 	/* send packet */
118 	skb_queue_tail(&ll->txq, skb);
119 out:
120 	return err;
121 }
122 
123 /* Initialize protocol */
124 static int ll_open(struct hci_uart *hu)
125 {
126 	struct ll_struct *ll;
127 
128 	BT_DBG("hu %p", hu);
129 
130 	ll = kzalloc(sizeof(*ll), GFP_KERNEL);
131 	if (!ll)
132 		return -ENOMEM;
133 
134 	skb_queue_head_init(&ll->txq);
135 	skb_queue_head_init(&ll->tx_wait_q);
136 	spin_lock_init(&ll->hcill_lock);
137 
138 	ll->hcill_state = HCILL_AWAKE;
139 
140 	hu->priv = ll;
141 
142 	if (hu->serdev) {
143 		struct ll_device *lldev = serdev_device_get_drvdata(hu->serdev);
144 		if (!IS_ERR(lldev->ext_clk))
145 			clk_prepare_enable(lldev->ext_clk);
146 	}
147 
148 	return 0;
149 }
150 
151 /* Flush protocol data */
152 static int ll_flush(struct hci_uart *hu)
153 {
154 	struct ll_struct *ll = hu->priv;
155 
156 	BT_DBG("hu %p", hu);
157 
158 	skb_queue_purge(&ll->tx_wait_q);
159 	skb_queue_purge(&ll->txq);
160 
161 	return 0;
162 }
163 
164 /* Close protocol */
165 static int ll_close(struct hci_uart *hu)
166 {
167 	struct ll_struct *ll = hu->priv;
168 
169 	BT_DBG("hu %p", hu);
170 
171 	skb_queue_purge(&ll->tx_wait_q);
172 	skb_queue_purge(&ll->txq);
173 
174 	kfree_skb(ll->rx_skb);
175 
176 	if (hu->serdev) {
177 		struct ll_device *lldev = serdev_device_get_drvdata(hu->serdev);
178 		gpiod_set_value_cansleep(lldev->enable_gpio, 0);
179 
180 		clk_disable_unprepare(lldev->ext_clk);
181 	}
182 
183 	hu->priv = NULL;
184 
185 	kfree(ll);
186 
187 	return 0;
188 }
189 
190 /*
191  * internal function, which does common work of the device wake up process:
192  * 1. places all pending packets (waiting in tx_wait_q list) in txq list.
193  * 2. changes internal state to HCILL_AWAKE.
194  * Note: assumes that hcill_lock spinlock is taken,
195  * shouldn't be called otherwise!
196  */
197 static void __ll_do_awake(struct ll_struct *ll)
198 {
199 	struct sk_buff *skb = NULL;
200 
201 	while ((skb = skb_dequeue(&ll->tx_wait_q)))
202 		skb_queue_tail(&ll->txq, skb);
203 
204 	ll->hcill_state = HCILL_AWAKE;
205 }
206 
207 /*
208  * Called upon a wake-up-indication from the device
209  */
210 static void ll_device_want_to_wakeup(struct hci_uart *hu)
211 {
212 	unsigned long flags;
213 	struct ll_struct *ll = hu->priv;
214 
215 	BT_DBG("hu %p", hu);
216 
217 	/* lock hcill state */
218 	spin_lock_irqsave(&ll->hcill_lock, flags);
219 
220 	switch (ll->hcill_state) {
221 	case HCILL_ASLEEP_TO_AWAKE:
222 		/*
223 		 * This state means that both the host and the BRF chip
224 		 * have simultaneously sent a wake-up-indication packet.
225 		 * Traditionally, in this case, receiving a wake-up-indication
226 		 * was enough and an additional wake-up-ack wasn't needed.
227 		 * This has changed with the BRF6350, which does require an
228 		 * explicit wake-up-ack. Other BRF versions, which do not
229 		 * require an explicit ack here, do accept it, thus it is
230 		 * perfectly safe to always send one.
231 		 */
232 		BT_DBG("dual wake-up-indication");
233 		/* fall through */
234 	case HCILL_ASLEEP:
235 		/* acknowledge device wake up */
236 		if (send_hcill_cmd(HCILL_WAKE_UP_ACK, hu) < 0) {
237 			BT_ERR("cannot acknowledge device wake up");
238 			goto out;
239 		}
240 		break;
241 	default:
242 		/* any other state is illegal */
243 		BT_ERR("received HCILL_WAKE_UP_IND in state %ld", ll->hcill_state);
244 		break;
245 	}
246 
247 	/* send pending packets and change state to HCILL_AWAKE */
248 	__ll_do_awake(ll);
249 
250 out:
251 	spin_unlock_irqrestore(&ll->hcill_lock, flags);
252 
253 	/* actually send the packets */
254 	hci_uart_tx_wakeup(hu);
255 }
256 
257 /*
258  * Called upon a sleep-indication from the device
259  */
260 static void ll_device_want_to_sleep(struct hci_uart *hu)
261 {
262 	unsigned long flags;
263 	struct ll_struct *ll = hu->priv;
264 
265 	BT_DBG("hu %p", hu);
266 
267 	/* lock hcill state */
268 	spin_lock_irqsave(&ll->hcill_lock, flags);
269 
270 	/* sanity check */
271 	if (ll->hcill_state != HCILL_AWAKE)
272 		BT_ERR("ERR: HCILL_GO_TO_SLEEP_IND in state %ld", ll->hcill_state);
273 
274 	/* acknowledge device sleep */
275 	if (send_hcill_cmd(HCILL_GO_TO_SLEEP_ACK, hu) < 0) {
276 		BT_ERR("cannot acknowledge device sleep");
277 		goto out;
278 	}
279 
280 	/* update state */
281 	ll->hcill_state = HCILL_ASLEEP;
282 
283 out:
284 	spin_unlock_irqrestore(&ll->hcill_lock, flags);
285 
286 	/* actually send the sleep ack packet */
287 	hci_uart_tx_wakeup(hu);
288 }
289 
290 /*
291  * Called upon wake-up-acknowledgement from the device
292  */
293 static void ll_device_woke_up(struct hci_uart *hu)
294 {
295 	unsigned long flags;
296 	struct ll_struct *ll = hu->priv;
297 
298 	BT_DBG("hu %p", hu);
299 
300 	/* lock hcill state */
301 	spin_lock_irqsave(&ll->hcill_lock, flags);
302 
303 	/* sanity check */
304 	if (ll->hcill_state != HCILL_ASLEEP_TO_AWAKE)
305 		BT_ERR("received HCILL_WAKE_UP_ACK in state %ld", ll->hcill_state);
306 
307 	/* send pending packets and change state to HCILL_AWAKE */
308 	__ll_do_awake(ll);
309 
310 	spin_unlock_irqrestore(&ll->hcill_lock, flags);
311 
312 	/* actually send the packets */
313 	hci_uart_tx_wakeup(hu);
314 }
315 
316 /* Enqueue frame for transmittion (padding, crc, etc) */
317 /* may be called from two simultaneous tasklets */
318 static int ll_enqueue(struct hci_uart *hu, struct sk_buff *skb)
319 {
320 	unsigned long flags = 0;
321 	struct ll_struct *ll = hu->priv;
322 
323 	BT_DBG("hu %p skb %p", hu, skb);
324 
325 	/* Prepend skb with frame type */
326 	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
327 
328 	/* lock hcill state */
329 	spin_lock_irqsave(&ll->hcill_lock, flags);
330 
331 	/* act according to current state */
332 	switch (ll->hcill_state) {
333 	case HCILL_AWAKE:
334 		BT_DBG("device awake, sending normally");
335 		skb_queue_tail(&ll->txq, skb);
336 		break;
337 	case HCILL_ASLEEP:
338 		BT_DBG("device asleep, waking up and queueing packet");
339 		/* save packet for later */
340 		skb_queue_tail(&ll->tx_wait_q, skb);
341 		/* awake device */
342 		if (send_hcill_cmd(HCILL_WAKE_UP_IND, hu) < 0) {
343 			BT_ERR("cannot wake up device");
344 			break;
345 		}
346 		ll->hcill_state = HCILL_ASLEEP_TO_AWAKE;
347 		break;
348 	case HCILL_ASLEEP_TO_AWAKE:
349 		BT_DBG("device waking up, queueing packet");
350 		/* transient state; just keep packet for later */
351 		skb_queue_tail(&ll->tx_wait_q, skb);
352 		break;
353 	default:
354 		BT_ERR("illegal hcill state: %ld (losing packet)", ll->hcill_state);
355 		kfree_skb(skb);
356 		break;
357 	}
358 
359 	spin_unlock_irqrestore(&ll->hcill_lock, flags);
360 
361 	return 0;
362 }
363 
364 static int ll_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
365 {
366 	struct hci_uart *hu = hci_get_drvdata(hdev);
367 	struct ll_struct *ll = hu->priv;
368 
369 	switch (hci_skb_pkt_type(skb)) {
370 	case HCILL_GO_TO_SLEEP_IND:
371 		BT_DBG("HCILL_GO_TO_SLEEP_IND packet");
372 		ll_device_want_to_sleep(hu);
373 		break;
374 	case HCILL_GO_TO_SLEEP_ACK:
375 		/* shouldn't happen */
376 		bt_dev_err(hdev, "received HCILL_GO_TO_SLEEP_ACK in state %ld",
377 			   ll->hcill_state);
378 		break;
379 	case HCILL_WAKE_UP_IND:
380 		BT_DBG("HCILL_WAKE_UP_IND packet");
381 		ll_device_want_to_wakeup(hu);
382 		break;
383 	case HCILL_WAKE_UP_ACK:
384 		BT_DBG("HCILL_WAKE_UP_ACK packet");
385 		ll_device_woke_up(hu);
386 		break;
387 	}
388 
389 	kfree_skb(skb);
390 	return 0;
391 }
392 
393 #define LL_RECV_SLEEP_IND \
394 	.type = HCILL_GO_TO_SLEEP_IND, \
395 	.hlen = 0, \
396 	.loff = 0, \
397 	.lsize = 0, \
398 	.maxlen = 0
399 
400 #define LL_RECV_SLEEP_ACK \
401 	.type = HCILL_GO_TO_SLEEP_ACK, \
402 	.hlen = 0, \
403 	.loff = 0, \
404 	.lsize = 0, \
405 	.maxlen = 0
406 
407 #define LL_RECV_WAKE_IND \
408 	.type = HCILL_WAKE_UP_IND, \
409 	.hlen = 0, \
410 	.loff = 0, \
411 	.lsize = 0, \
412 	.maxlen = 0
413 
414 #define LL_RECV_WAKE_ACK \
415 	.type = HCILL_WAKE_UP_ACK, \
416 	.hlen = 0, \
417 	.loff = 0, \
418 	.lsize = 0, \
419 	.maxlen = 0
420 
421 static const struct h4_recv_pkt ll_recv_pkts[] = {
422 	{ H4_RECV_ACL,       .recv = hci_recv_frame },
423 	{ H4_RECV_SCO,       .recv = hci_recv_frame },
424 	{ H4_RECV_EVENT,     .recv = hci_recv_frame },
425 	{ LL_RECV_SLEEP_IND, .recv = ll_recv_frame  },
426 	{ LL_RECV_SLEEP_ACK, .recv = ll_recv_frame  },
427 	{ LL_RECV_WAKE_IND,  .recv = ll_recv_frame  },
428 	{ LL_RECV_WAKE_ACK,  .recv = ll_recv_frame  },
429 };
430 
431 /* Recv data */
432 static int ll_recv(struct hci_uart *hu, const void *data, int count)
433 {
434 	struct ll_struct *ll = hu->priv;
435 
436 	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
437 		return -EUNATCH;
438 
439 	ll->rx_skb = h4_recv_buf(hu->hdev, ll->rx_skb, data, count,
440 				 ll_recv_pkts, ARRAY_SIZE(ll_recv_pkts));
441 	if (IS_ERR(ll->rx_skb)) {
442 		int err = PTR_ERR(ll->rx_skb);
443 		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
444 		ll->rx_skb = NULL;
445 		return err;
446 	}
447 
448 	return count;
449 }
450 
451 static struct sk_buff *ll_dequeue(struct hci_uart *hu)
452 {
453 	struct ll_struct *ll = hu->priv;
454 	return skb_dequeue(&ll->txq);
455 }
456 
457 #if IS_ENABLED(CONFIG_SERIAL_DEV_BUS)
458 static int read_local_version(struct hci_dev *hdev)
459 {
460 	int err = 0;
461 	unsigned short version = 0;
462 	struct sk_buff *skb;
463 	struct hci_rp_read_local_version *ver;
464 
465 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, HCI_INIT_TIMEOUT);
466 	if (IS_ERR(skb)) {
467 		bt_dev_err(hdev, "Reading TI version information failed (%ld)",
468 			   PTR_ERR(skb));
469 		return PTR_ERR(skb);
470 	}
471 	if (skb->len != sizeof(*ver)) {
472 		err = -EILSEQ;
473 		goto out;
474 	}
475 
476 	ver = (struct hci_rp_read_local_version *)skb->data;
477 	if (le16_to_cpu(ver->manufacturer) != 13) {
478 		err = -ENODEV;
479 		goto out;
480 	}
481 
482 	version = le16_to_cpu(ver->lmp_subver);
483 
484 out:
485 	if (err) bt_dev_err(hdev, "Failed to read TI version info: %d", err);
486 	kfree_skb(skb);
487 	return err ? err : version;
488 }
489 
490 /**
491  * download_firmware -
492  *	internal function which parses through the .bts firmware
493  *	script file intreprets SEND, DELAY actions only as of now
494  */
495 static int download_firmware(struct ll_device *lldev)
496 {
497 	unsigned short chip, min_ver, maj_ver;
498 	int version, err, len;
499 	unsigned char *ptr, *action_ptr;
500 	unsigned char bts_scr_name[40];	/* 40 char long bts scr name? */
501 	const struct firmware *fw;
502 	struct sk_buff *skb;
503 	struct hci_command *cmd;
504 
505 	version = read_local_version(lldev->hu.hdev);
506 	if (version < 0)
507 		return version;
508 
509 	chip = (version & 0x7C00) >> 10;
510 	min_ver = (version & 0x007F);
511 	maj_ver = (version & 0x0380) >> 7;
512 	if (version & 0x8000)
513 		maj_ver |= 0x0008;
514 
515 	snprintf(bts_scr_name, sizeof(bts_scr_name),
516 		 "ti-connectivity/TIInit_%d.%d.%d.bts",
517 		 chip, maj_ver, min_ver);
518 
519 	err = request_firmware(&fw, bts_scr_name, &lldev->serdev->dev);
520 	if (err || !fw->data || !fw->size) {
521 		bt_dev_err(lldev->hu.hdev, "request_firmware failed(errno %d) for %s",
522 			   err, bts_scr_name);
523 		return -EINVAL;
524 	}
525 	ptr = (void *)fw->data;
526 	len = fw->size;
527 	/* bts_header to remove out magic number and
528 	 * version
529 	 */
530 	ptr += sizeof(struct bts_header);
531 	len -= sizeof(struct bts_header);
532 
533 	while (len > 0 && ptr) {
534 		bt_dev_dbg(lldev->hu.hdev, " action size %d, type %d ",
535 			   ((struct bts_action *)ptr)->size,
536 			   ((struct bts_action *)ptr)->type);
537 
538 		action_ptr = &(((struct bts_action *)ptr)->data[0]);
539 
540 		switch (((struct bts_action *)ptr)->type) {
541 		case ACTION_SEND_COMMAND:	/* action send */
542 			bt_dev_dbg(lldev->hu.hdev, "S");
543 			cmd = (struct hci_command *)action_ptr;
544 			if (cmd->opcode == HCI_VS_UPDATE_UART_HCI_BAUDRATE) {
545 				/* ignore remote change
546 				 * baud rate HCI VS command
547 				 */
548 				bt_dev_warn(lldev->hu.hdev, "change remote baud rate command in firmware");
549 				break;
550 			}
551 			if (cmd->prefix != 1)
552 				bt_dev_dbg(lldev->hu.hdev, "command type %d", cmd->prefix);
553 
554 			skb = __hci_cmd_sync(lldev->hu.hdev, cmd->opcode, cmd->plen, &cmd->speed, HCI_INIT_TIMEOUT);
555 			if (IS_ERR(skb)) {
556 				bt_dev_err(lldev->hu.hdev, "send command failed");
557 				err = PTR_ERR(skb);
558 				goto out_rel_fw;
559 			}
560 			kfree_skb(skb);
561 			break;
562 		case ACTION_WAIT_EVENT:  /* wait */
563 			/* no need to wait as command was synchronous */
564 			bt_dev_dbg(lldev->hu.hdev, "W");
565 			break;
566 		case ACTION_DELAY:	/* sleep */
567 			bt_dev_info(lldev->hu.hdev, "sleep command in scr");
568 			msleep(((struct bts_action_delay *)action_ptr)->msec);
569 			break;
570 		}
571 		len -= (sizeof(struct bts_action) +
572 			((struct bts_action *)ptr)->size);
573 		ptr += sizeof(struct bts_action) +
574 			((struct bts_action *)ptr)->size;
575 	}
576 
577 out_rel_fw:
578 	/* fw download complete */
579 	release_firmware(fw);
580 	return err;
581 }
582 
583 static int ll_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
584 {
585 	bdaddr_t bdaddr_swapped;
586 	struct sk_buff *skb;
587 
588 	/* HCI_VS_WRITE_BD_ADDR (at least on a CC2560A chip) expects the BD
589 	 * address to be MSB first, but bdaddr_t has the convention of being
590 	 * LSB first.
591 	 */
592 	baswap(&bdaddr_swapped, bdaddr);
593 	skb = __hci_cmd_sync(hdev, HCI_VS_WRITE_BD_ADDR, sizeof(bdaddr_t),
594 			     &bdaddr_swapped, HCI_INIT_TIMEOUT);
595 	if (!IS_ERR(skb))
596 		kfree_skb(skb);
597 
598 	return PTR_ERR_OR_ZERO(skb);
599 }
600 
601 static int ll_setup(struct hci_uart *hu)
602 {
603 	int err, retry = 3;
604 	struct ll_device *lldev;
605 	struct serdev_device *serdev = hu->serdev;
606 	u32 speed;
607 
608 	if (!serdev)
609 		return 0;
610 
611 	lldev = serdev_device_get_drvdata(serdev);
612 
613 	hu->hdev->set_bdaddr = ll_set_bdaddr;
614 
615 	serdev_device_set_flow_control(serdev, true);
616 
617 	do {
618 		/* Reset the Bluetooth device */
619 		gpiod_set_value_cansleep(lldev->enable_gpio, 0);
620 		msleep(5);
621 		gpiod_set_value_cansleep(lldev->enable_gpio, 1);
622 		err = serdev_device_wait_for_cts(serdev, true, 200);
623 		if (err) {
624 			bt_dev_err(hu->hdev, "Failed to get CTS");
625 			return err;
626 		}
627 
628 		err = download_firmware(lldev);
629 		if (!err)
630 			break;
631 
632 		/* Toggle BT_EN and retry */
633 		bt_dev_err(hu->hdev, "download firmware failed, retrying...");
634 	} while (retry--);
635 
636 	if (err)
637 		return err;
638 
639 	/* Set BD address if one was specified at probe */
640 	if (!bacmp(&lldev->bdaddr, BDADDR_NONE)) {
641 		/* This means that there was an error getting the BD address
642 		 * during probe, so mark the device as having a bad address.
643 		 */
644 		set_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks);
645 	} else if (bacmp(&lldev->bdaddr, BDADDR_ANY)) {
646 		err = ll_set_bdaddr(hu->hdev, &lldev->bdaddr);
647 		if (err)
648 			set_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks);
649 	}
650 
651 	/* Operational speed if any */
652 	if (hu->oper_speed)
653 		speed = hu->oper_speed;
654 	else if (hu->proto->oper_speed)
655 		speed = hu->proto->oper_speed;
656 	else
657 		speed = 0;
658 
659 	if (speed) {
660 		__le32 speed_le = cpu_to_le32(speed);
661 		struct sk_buff *skb;
662 
663 		skb = __hci_cmd_sync(hu->hdev, HCI_VS_UPDATE_UART_HCI_BAUDRATE,
664 				     sizeof(speed_le), &speed_le,
665 				     HCI_INIT_TIMEOUT);
666 		if (!IS_ERR(skb)) {
667 			kfree_skb(skb);
668 			serdev_device_set_baudrate(serdev, speed);
669 		}
670 	}
671 
672 	return 0;
673 }
674 
675 static const struct hci_uart_proto llp;
676 
677 static int hci_ti_probe(struct serdev_device *serdev)
678 {
679 	struct hci_uart *hu;
680 	struct ll_device *lldev;
681 	struct nvmem_cell *bdaddr_cell;
682 	u32 max_speed = 3000000;
683 
684 	lldev = devm_kzalloc(&serdev->dev, sizeof(struct ll_device), GFP_KERNEL);
685 	if (!lldev)
686 		return -ENOMEM;
687 	hu = &lldev->hu;
688 
689 	serdev_device_set_drvdata(serdev, lldev);
690 	lldev->serdev = hu->serdev = serdev;
691 
692 	lldev->enable_gpio = devm_gpiod_get_optional(&serdev->dev, "enable", GPIOD_OUT_LOW);
693 	if (IS_ERR(lldev->enable_gpio))
694 		return PTR_ERR(lldev->enable_gpio);
695 
696 	lldev->ext_clk = devm_clk_get(&serdev->dev, "ext_clock");
697 	if (IS_ERR(lldev->ext_clk) && PTR_ERR(lldev->ext_clk) != -ENOENT)
698 		return PTR_ERR(lldev->ext_clk);
699 
700 	of_property_read_u32(serdev->dev.of_node, "max-speed", &max_speed);
701 	hci_uart_set_speeds(hu, 115200, max_speed);
702 
703 	/* optional BD address from nvram */
704 	bdaddr_cell = nvmem_cell_get(&serdev->dev, "bd-address");
705 	if (IS_ERR(bdaddr_cell)) {
706 		int err = PTR_ERR(bdaddr_cell);
707 
708 		if (err == -EPROBE_DEFER)
709 			return err;
710 
711 		/* ENOENT means there is no matching nvmem cell and ENOSYS
712 		 * means that nvmem is not enabled in the kernel configuration.
713 		 */
714 		if (err != -ENOENT && err != -ENOSYS) {
715 			/* If there was some other error, give userspace a
716 			 * chance to fix the problem instead of failing to load
717 			 * the driver. Using BDADDR_NONE as a flag that is
718 			 * tested later in the setup function.
719 			 */
720 			dev_warn(&serdev->dev,
721 				 "Failed to get \"bd-address\" nvmem cell (%d)\n",
722 				 err);
723 			bacpy(&lldev->bdaddr, BDADDR_NONE);
724 		}
725 	} else {
726 		bdaddr_t *bdaddr;
727 		size_t len;
728 
729 		bdaddr = nvmem_cell_read(bdaddr_cell, &len);
730 		nvmem_cell_put(bdaddr_cell);
731 		if (IS_ERR(bdaddr)) {
732 			dev_err(&serdev->dev, "Failed to read nvmem bd-address\n");
733 			return PTR_ERR(bdaddr);
734 		}
735 		if (len != sizeof(bdaddr_t)) {
736 			dev_err(&serdev->dev, "Invalid nvmem bd-address length\n");
737 			kfree(bdaddr);
738 			return -EINVAL;
739 		}
740 
741 		/* As per the device tree bindings, the value from nvmem is
742 		 * expected to be MSB first, but in the kernel it is expected
743 		 * that bdaddr_t is LSB first.
744 		 */
745 		baswap(&lldev->bdaddr, bdaddr);
746 		kfree(bdaddr);
747 	}
748 
749 	return hci_uart_register_device(hu, &llp);
750 }
751 
752 static void hci_ti_remove(struct serdev_device *serdev)
753 {
754 	struct ll_device *lldev = serdev_device_get_drvdata(serdev);
755 
756 	hci_uart_unregister_device(&lldev->hu);
757 }
758 
759 static const struct of_device_id hci_ti_of_match[] = {
760 	{ .compatible = "ti,cc2560" },
761 	{ .compatible = "ti,wl1271-st" },
762 	{ .compatible = "ti,wl1273-st" },
763 	{ .compatible = "ti,wl1281-st" },
764 	{ .compatible = "ti,wl1283-st" },
765 	{ .compatible = "ti,wl1285-st" },
766 	{ .compatible = "ti,wl1801-st" },
767 	{ .compatible = "ti,wl1805-st" },
768 	{ .compatible = "ti,wl1807-st" },
769 	{ .compatible = "ti,wl1831-st" },
770 	{ .compatible = "ti,wl1835-st" },
771 	{ .compatible = "ti,wl1837-st" },
772 	{},
773 };
774 MODULE_DEVICE_TABLE(of, hci_ti_of_match);
775 
776 static struct serdev_device_driver hci_ti_drv = {
777 	.driver		= {
778 		.name	= "hci-ti",
779 		.of_match_table = of_match_ptr(hci_ti_of_match),
780 	},
781 	.probe	= hci_ti_probe,
782 	.remove	= hci_ti_remove,
783 };
784 #else
785 #define ll_setup NULL
786 #endif
787 
788 static const struct hci_uart_proto llp = {
789 	.id		= HCI_UART_LL,
790 	.name		= "LL",
791 	.setup		= ll_setup,
792 	.open		= ll_open,
793 	.close		= ll_close,
794 	.recv		= ll_recv,
795 	.enqueue	= ll_enqueue,
796 	.dequeue	= ll_dequeue,
797 	.flush		= ll_flush,
798 };
799 
800 int __init ll_init(void)
801 {
802 	serdev_device_driver_register(&hci_ti_drv);
803 
804 	return hci_uart_register_proto(&llp);
805 }
806 
807 int __exit ll_deinit(void)
808 {
809 	serdev_device_driver_unregister(&hci_ti_drv);
810 
811 	return hci_uart_unregister_proto(&llp);
812 }
813