1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth HCI UART driver for marvell devices 5 * 6 * Copyright (C) 2016 Marvell International Ltd. 7 * Copyright (C) 2016 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/errno.h> 12 #include <linux/skbuff.h> 13 #include <linux/firmware.h> 14 #include <linux/module.h> 15 #include <linux/tty.h> 16 #include <linux/of.h> 17 #include <linux/serdev.h> 18 19 #include <net/bluetooth/bluetooth.h> 20 #include <net/bluetooth/hci_core.h> 21 22 #include "hci_uart.h" 23 24 #define HCI_FW_REQ_PKT 0xA5 25 #define HCI_CHIP_VER_PKT 0xAA 26 27 #define MRVL_ACK 0x5A 28 #define MRVL_NAK 0xBF 29 #define MRVL_RAW_DATA 0x1F 30 #define MRVL_SET_BAUDRATE 0xFC09 31 32 enum { 33 STATE_CHIP_VER_PENDING, 34 STATE_FW_REQ_PENDING, 35 STATE_FW_LOADED, 36 }; 37 38 struct mrvl_data { 39 struct sk_buff *rx_skb; 40 struct sk_buff_head txq; 41 struct sk_buff_head rawq; 42 unsigned long flags; 43 unsigned int tx_len; 44 u8 id, rev; 45 }; 46 47 struct mrvl_serdev { 48 struct hci_uart hu; 49 }; 50 51 struct hci_mrvl_pkt { 52 __le16 lhs; 53 __le16 rhs; 54 } __packed; 55 #define HCI_MRVL_PKT_SIZE 4 56 57 static int mrvl_open(struct hci_uart *hu) 58 { 59 struct mrvl_data *mrvl; 60 int ret; 61 62 BT_DBG("hu %p", hu); 63 64 if (!hci_uart_has_flow_control(hu)) 65 return -EOPNOTSUPP; 66 67 mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL); 68 if (!mrvl) 69 return -ENOMEM; 70 71 skb_queue_head_init(&mrvl->txq); 72 skb_queue_head_init(&mrvl->rawq); 73 74 set_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 75 76 hu->priv = mrvl; 77 78 if (hu->serdev) { 79 ret = serdev_device_open(hu->serdev); 80 if (ret) 81 goto err; 82 } 83 84 return 0; 85 err: 86 kfree(mrvl); 87 88 return ret; 89 } 90 91 static int mrvl_close(struct hci_uart *hu) 92 { 93 struct mrvl_data *mrvl = hu->priv; 94 95 BT_DBG("hu %p", hu); 96 97 if (hu->serdev) 98 serdev_device_close(hu->serdev); 99 100 skb_queue_purge(&mrvl->txq); 101 skb_queue_purge(&mrvl->rawq); 102 kfree_skb(mrvl->rx_skb); 103 kfree(mrvl); 104 105 hu->priv = NULL; 106 return 0; 107 } 108 109 static int mrvl_flush(struct hci_uart *hu) 110 { 111 struct mrvl_data *mrvl = hu->priv; 112 113 BT_DBG("hu %p", hu); 114 115 skb_queue_purge(&mrvl->txq); 116 skb_queue_purge(&mrvl->rawq); 117 118 return 0; 119 } 120 121 static struct sk_buff *mrvl_dequeue(struct hci_uart *hu) 122 { 123 struct mrvl_data *mrvl = hu->priv; 124 struct sk_buff *skb; 125 126 skb = skb_dequeue(&mrvl->txq); 127 if (!skb) { 128 /* Any raw data ? */ 129 skb = skb_dequeue(&mrvl->rawq); 130 } else { 131 /* Prepend skb with frame type */ 132 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 133 } 134 135 return skb; 136 } 137 138 static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb) 139 { 140 struct mrvl_data *mrvl = hu->priv; 141 142 skb_queue_tail(&mrvl->txq, skb); 143 return 0; 144 } 145 146 static void mrvl_send_ack(struct hci_uart *hu, unsigned char type) 147 { 148 struct mrvl_data *mrvl = hu->priv; 149 struct sk_buff *skb; 150 151 /* No H4 payload, only 1 byte header */ 152 skb = bt_skb_alloc(0, GFP_ATOMIC); 153 if (!skb) { 154 bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet"); 155 return; 156 } 157 hci_skb_pkt_type(skb) = type; 158 159 skb_queue_tail(&mrvl->txq, skb); 160 hci_uart_tx_wakeup(hu); 161 } 162 163 static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb) 164 { 165 struct hci_mrvl_pkt *pkt = (void *)skb->data; 166 struct hci_uart *hu = hci_get_drvdata(hdev); 167 struct mrvl_data *mrvl = hu->priv; 168 int ret = 0; 169 170 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 171 bt_dev_err(hdev, "Corrupted mrvl header"); 172 mrvl_send_ack(hu, MRVL_NAK); 173 ret = -EINVAL; 174 goto done; 175 } 176 mrvl_send_ack(hu, MRVL_ACK); 177 178 if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) { 179 bt_dev_err(hdev, "Received unexpected firmware request"); 180 ret = -EINVAL; 181 goto done; 182 } 183 184 mrvl->tx_len = le16_to_cpu(pkt->lhs); 185 186 clear_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 187 smp_mb__after_atomic(); 188 wake_up_bit(&mrvl->flags, STATE_FW_REQ_PENDING); 189 190 done: 191 kfree_skb(skb); 192 return ret; 193 } 194 195 static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb) 196 { 197 struct hci_mrvl_pkt *pkt = (void *)skb->data; 198 struct hci_uart *hu = hci_get_drvdata(hdev); 199 struct mrvl_data *mrvl = hu->priv; 200 u16 version = le16_to_cpu(pkt->lhs); 201 int ret = 0; 202 203 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 204 bt_dev_err(hdev, "Corrupted mrvl header"); 205 mrvl_send_ack(hu, MRVL_NAK); 206 ret = -EINVAL; 207 goto done; 208 } 209 mrvl_send_ack(hu, MRVL_ACK); 210 211 if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) { 212 bt_dev_err(hdev, "Received unexpected chip version"); 213 goto done; 214 } 215 216 mrvl->id = version; 217 mrvl->rev = version >> 8; 218 219 bt_dev_info(hdev, "Controller id = %x, rev = %x", mrvl->id, mrvl->rev); 220 221 clear_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 222 smp_mb__after_atomic(); 223 wake_up_bit(&mrvl->flags, STATE_CHIP_VER_PENDING); 224 225 done: 226 kfree_skb(skb); 227 return ret; 228 } 229 230 #define HCI_RECV_CHIP_VER \ 231 .type = HCI_CHIP_VER_PKT, \ 232 .hlen = HCI_MRVL_PKT_SIZE, \ 233 .loff = 0, \ 234 .lsize = 0, \ 235 .maxlen = HCI_MRVL_PKT_SIZE 236 237 #define HCI_RECV_FW_REQ \ 238 .type = HCI_FW_REQ_PKT, \ 239 .hlen = HCI_MRVL_PKT_SIZE, \ 240 .loff = 0, \ 241 .lsize = 0, \ 242 .maxlen = HCI_MRVL_PKT_SIZE 243 244 static const struct h4_recv_pkt mrvl_recv_pkts[] = { 245 { H4_RECV_ACL, .recv = hci_recv_frame }, 246 { H4_RECV_SCO, .recv = hci_recv_frame }, 247 { H4_RECV_EVENT, .recv = hci_recv_frame }, 248 { HCI_RECV_FW_REQ, .recv = mrvl_recv_fw_req }, 249 { HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver }, 250 }; 251 252 static int mrvl_recv(struct hci_uart *hu, const void *data, int count) 253 { 254 struct mrvl_data *mrvl = hu->priv; 255 256 if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) 257 return -EUNATCH; 258 259 /* We might receive some noise when there is no firmware loaded. Therefore, 260 * we drop data if the firmware is not loaded yet and if there is no fw load 261 * request pending. 262 */ 263 if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags) && 264 !test_bit(STATE_FW_LOADED, &mrvl->flags)) 265 return count; 266 267 mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count, 268 mrvl_recv_pkts, 269 ARRAY_SIZE(mrvl_recv_pkts)); 270 if (IS_ERR(mrvl->rx_skb)) { 271 int err = PTR_ERR(mrvl->rx_skb); 272 bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err); 273 mrvl->rx_skb = NULL; 274 return err; 275 } 276 277 return count; 278 } 279 280 static int mrvl_load_firmware(struct hci_dev *hdev, const char *name) 281 { 282 struct hci_uart *hu = hci_get_drvdata(hdev); 283 struct mrvl_data *mrvl = hu->priv; 284 const struct firmware *fw = NULL; 285 const u8 *fw_ptr, *fw_max; 286 int err; 287 288 err = request_firmware(&fw, name, &hdev->dev); 289 if (err < 0) { 290 bt_dev_err(hdev, "Failed to load firmware file %s", name); 291 return err; 292 } 293 294 fw_ptr = fw->data; 295 fw_max = fw->data + fw->size; 296 297 bt_dev_info(hdev, "Loading %s", name); 298 299 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 300 301 while (fw_ptr <= fw_max) { 302 struct sk_buff *skb; 303 304 /* Controller drives the firmware load by sending firmware 305 * request packets containing the expected fragment size. 306 */ 307 err = wait_on_bit_timeout(&mrvl->flags, STATE_FW_REQ_PENDING, 308 TASK_INTERRUPTIBLE, 309 msecs_to_jiffies(2000)); 310 if (err == 1) { 311 bt_dev_err(hdev, "Firmware load interrupted"); 312 err = -EINTR; 313 break; 314 } else if (err) { 315 bt_dev_err(hdev, "Firmware request timeout"); 316 err = -ETIMEDOUT; 317 break; 318 } 319 320 bt_dev_dbg(hdev, "Firmware request, expecting %d bytes", 321 mrvl->tx_len); 322 323 if (fw_ptr == fw_max) { 324 /* Controller requests a null size once firmware is 325 * fully loaded. If controller expects more data, there 326 * is an issue. 327 */ 328 if (!mrvl->tx_len) { 329 bt_dev_info(hdev, "Firmware loading complete"); 330 } else { 331 bt_dev_err(hdev, "Firmware loading failure"); 332 err = -EINVAL; 333 } 334 break; 335 } 336 337 if (fw_ptr + mrvl->tx_len > fw_max) { 338 mrvl->tx_len = fw_max - fw_ptr; 339 bt_dev_dbg(hdev, "Adjusting tx_len to %d", 340 mrvl->tx_len); 341 } 342 343 skb = bt_skb_alloc(mrvl->tx_len, GFP_KERNEL); 344 if (!skb) { 345 bt_dev_err(hdev, "Failed to alloc mem for FW packet"); 346 err = -ENOMEM; 347 break; 348 } 349 bt_cb(skb)->pkt_type = MRVL_RAW_DATA; 350 351 skb_put_data(skb, fw_ptr, mrvl->tx_len); 352 fw_ptr += mrvl->tx_len; 353 354 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 355 356 skb_queue_tail(&mrvl->rawq, skb); 357 hci_uart_tx_wakeup(hu); 358 } 359 360 release_firmware(fw); 361 return err; 362 } 363 364 static int mrvl_setup(struct hci_uart *hu) 365 { 366 int err; 367 struct mrvl_data *mrvl = hu->priv; 368 369 hci_uart_set_flow_control(hu, true); 370 371 err = mrvl_load_firmware(hu->hdev, "mrvl/helper_uart_3000000.bin"); 372 if (err) { 373 bt_dev_err(hu->hdev, "Unable to download firmware helper"); 374 return -EINVAL; 375 } 376 377 /* Let the final ack go out before switching the baudrate */ 378 hci_uart_wait_until_sent(hu); 379 380 if (hu->serdev) 381 serdev_device_set_baudrate(hu->serdev, hu->oper_speed); 382 else 383 hci_uart_set_baudrate(hu, hu->oper_speed); 384 385 hci_uart_set_flow_control(hu, false); 386 387 err = mrvl_load_firmware(hu->hdev, "mrvl/uart8897_bt.bin"); 388 if (err) 389 return err; 390 391 set_bit(STATE_FW_LOADED, &mrvl->flags); 392 393 return 0; 394 } 395 396 static int mrvl_set_baudrate(struct hci_uart *hu, unsigned int speed) 397 { 398 int err; 399 struct mrvl_data *mrvl = hu->priv; 400 __le32 speed_le = cpu_to_le32(speed); 401 402 /* The firmware might be loaded by the Wifi driver over SDIO. We wait 403 * up to 10s for the CTS to go up. Afterward, we know that the firmware 404 * is ready. 405 */ 406 err = serdev_device_wait_for_cts(hu->serdev, true, 10000); 407 if (err) { 408 bt_dev_err(hu->hdev, "Wait for CTS failed with %d\n", err); 409 return err; 410 } 411 412 set_bit(STATE_FW_LOADED, &mrvl->flags); 413 414 err = __hci_cmd_sync_status(hu->hdev, MRVL_SET_BAUDRATE, 415 sizeof(speed_le), &speed_le, 416 HCI_INIT_TIMEOUT); 417 if (err) { 418 bt_dev_err(hu->hdev, "send command failed: %d", err); 419 return err; 420 } 421 422 serdev_device_set_baudrate(hu->serdev, speed); 423 424 /* We forcefully have to send a command to the bluetooth module so that 425 * the driver detects it after a baudrate change. This is foreseen by 426 * hci_serdev by setting HCI_UART_VND_DETECT which then causes a dummy 427 * local version read. 428 */ 429 set_bit(HCI_UART_VND_DETECT, &hu->hdev_flags); 430 431 return 0; 432 } 433 434 static const struct hci_uart_proto mrvl_proto_8897 = { 435 .id = HCI_UART_MRVL, 436 .name = "Marvell", 437 .init_speed = 115200, 438 .oper_speed = 3000000, 439 .open = mrvl_open, 440 .close = mrvl_close, 441 .flush = mrvl_flush, 442 .setup = mrvl_setup, 443 .recv = mrvl_recv, 444 .enqueue = mrvl_enqueue, 445 .dequeue = mrvl_dequeue, 446 }; 447 448 static const struct hci_uart_proto mrvl_proto_8997 = { 449 .id = HCI_UART_MRVL, 450 .name = "Marvell 8997", 451 .init_speed = 115200, 452 .oper_speed = 3000000, 453 .open = mrvl_open, 454 .close = mrvl_close, 455 .flush = mrvl_flush, 456 .set_baudrate = mrvl_set_baudrate, 457 .recv = mrvl_recv, 458 .enqueue = mrvl_enqueue, 459 .dequeue = mrvl_dequeue, 460 }; 461 462 static int mrvl_serdev_probe(struct serdev_device *serdev) 463 { 464 struct mrvl_serdev *mrvldev; 465 const struct hci_uart_proto *mrvl_proto = device_get_match_data(&serdev->dev); 466 467 mrvldev = devm_kzalloc(&serdev->dev, sizeof(*mrvldev), GFP_KERNEL); 468 if (!mrvldev) 469 return -ENOMEM; 470 471 mrvldev->hu.oper_speed = mrvl_proto->oper_speed; 472 if (mrvl_proto->set_baudrate) 473 of_property_read_u32(serdev->dev.of_node, "max-speed", &mrvldev->hu.oper_speed); 474 475 mrvldev->hu.serdev = serdev; 476 serdev_device_set_drvdata(serdev, mrvldev); 477 478 return hci_uart_register_device(&mrvldev->hu, mrvl_proto); 479 } 480 481 static void mrvl_serdev_remove(struct serdev_device *serdev) 482 { 483 struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev); 484 485 hci_uart_unregister_device(&mrvldev->hu); 486 } 487 488 static const struct of_device_id __maybe_unused mrvl_bluetooth_of_match[] = { 489 { .compatible = "mrvl,88w8897", .data = &mrvl_proto_8897}, 490 { .compatible = "mrvl,88w8997", .data = &mrvl_proto_8997}, 491 { }, 492 }; 493 MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match); 494 495 static struct serdev_device_driver mrvl_serdev_driver = { 496 .probe = mrvl_serdev_probe, 497 .remove = mrvl_serdev_remove, 498 .driver = { 499 .name = "hci_uart_mrvl", 500 .of_match_table = of_match_ptr(mrvl_bluetooth_of_match), 501 }, 502 }; 503 504 int __init mrvl_init(void) 505 { 506 serdev_device_driver_register(&mrvl_serdev_driver); 507 508 return hci_uart_register_proto(&mrvl_proto_8897); 509 } 510 511 int __exit mrvl_deinit(void) 512 { 513 serdev_device_driver_unregister(&mrvl_serdev_driver); 514 515 return hci_uart_unregister_proto(&mrvl_proto_8897); 516 } 517