1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth HCI UART driver for marvell devices 5 * 6 * Copyright (C) 2016 Marvell International Ltd. 7 * Copyright (C) 2016 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/errno.h> 12 #include <linux/skbuff.h> 13 #include <linux/firmware.h> 14 #include <linux/module.h> 15 #include <linux/tty.h> 16 #include <linux/of.h> 17 #include <linux/serdev.h> 18 19 #include <net/bluetooth/bluetooth.h> 20 #include <net/bluetooth/hci_core.h> 21 22 #include "hci_uart.h" 23 24 #define HCI_FW_REQ_PKT 0xA5 25 #define HCI_CHIP_VER_PKT 0xAA 26 27 #define MRVL_ACK 0x5A 28 #define MRVL_NAK 0xBF 29 #define MRVL_RAW_DATA 0x1F 30 31 enum { 32 STATE_CHIP_VER_PENDING, 33 STATE_FW_REQ_PENDING, 34 }; 35 36 struct mrvl_data { 37 struct sk_buff *rx_skb; 38 struct sk_buff_head txq; 39 struct sk_buff_head rawq; 40 unsigned long flags; 41 unsigned int tx_len; 42 u8 id, rev; 43 }; 44 45 struct mrvl_serdev { 46 struct hci_uart hu; 47 }; 48 49 struct hci_mrvl_pkt { 50 __le16 lhs; 51 __le16 rhs; 52 } __packed; 53 #define HCI_MRVL_PKT_SIZE 4 54 55 static int mrvl_open(struct hci_uart *hu) 56 { 57 struct mrvl_data *mrvl; 58 int ret; 59 60 BT_DBG("hu %p", hu); 61 62 mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL); 63 if (!mrvl) 64 return -ENOMEM; 65 66 skb_queue_head_init(&mrvl->txq); 67 skb_queue_head_init(&mrvl->rawq); 68 69 set_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 70 71 hu->priv = mrvl; 72 73 if (hu->serdev) { 74 ret = serdev_device_open(hu->serdev); 75 if (ret) 76 goto err; 77 } 78 79 return 0; 80 err: 81 kfree(mrvl); 82 83 return ret; 84 } 85 86 static int mrvl_close(struct hci_uart *hu) 87 { 88 struct mrvl_data *mrvl = hu->priv; 89 90 BT_DBG("hu %p", hu); 91 92 if (hu->serdev) 93 serdev_device_close(hu->serdev); 94 95 skb_queue_purge(&mrvl->txq); 96 skb_queue_purge(&mrvl->rawq); 97 kfree_skb(mrvl->rx_skb); 98 kfree(mrvl); 99 100 hu->priv = NULL; 101 return 0; 102 } 103 104 static int mrvl_flush(struct hci_uart *hu) 105 { 106 struct mrvl_data *mrvl = hu->priv; 107 108 BT_DBG("hu %p", hu); 109 110 skb_queue_purge(&mrvl->txq); 111 skb_queue_purge(&mrvl->rawq); 112 113 return 0; 114 } 115 116 static struct sk_buff *mrvl_dequeue(struct hci_uart *hu) 117 { 118 struct mrvl_data *mrvl = hu->priv; 119 struct sk_buff *skb; 120 121 skb = skb_dequeue(&mrvl->txq); 122 if (!skb) { 123 /* Any raw data ? */ 124 skb = skb_dequeue(&mrvl->rawq); 125 } else { 126 /* Prepend skb with frame type */ 127 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 128 } 129 130 return skb; 131 } 132 133 static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb) 134 { 135 struct mrvl_data *mrvl = hu->priv; 136 137 skb_queue_tail(&mrvl->txq, skb); 138 return 0; 139 } 140 141 static void mrvl_send_ack(struct hci_uart *hu, unsigned char type) 142 { 143 struct mrvl_data *mrvl = hu->priv; 144 struct sk_buff *skb; 145 146 /* No H4 payload, only 1 byte header */ 147 skb = bt_skb_alloc(0, GFP_ATOMIC); 148 if (!skb) { 149 bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet"); 150 return; 151 } 152 hci_skb_pkt_type(skb) = type; 153 154 skb_queue_tail(&mrvl->txq, skb); 155 hci_uart_tx_wakeup(hu); 156 } 157 158 static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb) 159 { 160 struct hci_mrvl_pkt *pkt = (void *)skb->data; 161 struct hci_uart *hu = hci_get_drvdata(hdev); 162 struct mrvl_data *mrvl = hu->priv; 163 int ret = 0; 164 165 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 166 bt_dev_err(hdev, "Corrupted mrvl header"); 167 mrvl_send_ack(hu, MRVL_NAK); 168 ret = -EINVAL; 169 goto done; 170 } 171 mrvl_send_ack(hu, MRVL_ACK); 172 173 if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) { 174 bt_dev_err(hdev, "Received unexpected firmware request"); 175 ret = -EINVAL; 176 goto done; 177 } 178 179 mrvl->tx_len = le16_to_cpu(pkt->lhs); 180 181 clear_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 182 smp_mb__after_atomic(); 183 wake_up_bit(&mrvl->flags, STATE_FW_REQ_PENDING); 184 185 done: 186 kfree_skb(skb); 187 return ret; 188 } 189 190 static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb) 191 { 192 struct hci_mrvl_pkt *pkt = (void *)skb->data; 193 struct hci_uart *hu = hci_get_drvdata(hdev); 194 struct mrvl_data *mrvl = hu->priv; 195 u16 version = le16_to_cpu(pkt->lhs); 196 int ret = 0; 197 198 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 199 bt_dev_err(hdev, "Corrupted mrvl header"); 200 mrvl_send_ack(hu, MRVL_NAK); 201 ret = -EINVAL; 202 goto done; 203 } 204 mrvl_send_ack(hu, MRVL_ACK); 205 206 if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) { 207 bt_dev_err(hdev, "Received unexpected chip version"); 208 goto done; 209 } 210 211 mrvl->id = version; 212 mrvl->rev = version >> 8; 213 214 bt_dev_info(hdev, "Controller id = %x, rev = %x", mrvl->id, mrvl->rev); 215 216 clear_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 217 smp_mb__after_atomic(); 218 wake_up_bit(&mrvl->flags, STATE_CHIP_VER_PENDING); 219 220 done: 221 kfree_skb(skb); 222 return ret; 223 } 224 225 #define HCI_RECV_CHIP_VER \ 226 .type = HCI_CHIP_VER_PKT, \ 227 .hlen = HCI_MRVL_PKT_SIZE, \ 228 .loff = 0, \ 229 .lsize = 0, \ 230 .maxlen = HCI_MRVL_PKT_SIZE 231 232 #define HCI_RECV_FW_REQ \ 233 .type = HCI_FW_REQ_PKT, \ 234 .hlen = HCI_MRVL_PKT_SIZE, \ 235 .loff = 0, \ 236 .lsize = 0, \ 237 .maxlen = HCI_MRVL_PKT_SIZE 238 239 static const struct h4_recv_pkt mrvl_recv_pkts[] = { 240 { H4_RECV_ACL, .recv = hci_recv_frame }, 241 { H4_RECV_SCO, .recv = hci_recv_frame }, 242 { H4_RECV_EVENT, .recv = hci_recv_frame }, 243 { HCI_RECV_FW_REQ, .recv = mrvl_recv_fw_req }, 244 { HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver }, 245 }; 246 247 static int mrvl_recv(struct hci_uart *hu, const void *data, int count) 248 { 249 struct mrvl_data *mrvl = hu->priv; 250 251 if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) 252 return -EUNATCH; 253 254 mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count, 255 mrvl_recv_pkts, 256 ARRAY_SIZE(mrvl_recv_pkts)); 257 if (IS_ERR(mrvl->rx_skb)) { 258 int err = PTR_ERR(mrvl->rx_skb); 259 bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err); 260 mrvl->rx_skb = NULL; 261 return err; 262 } 263 264 return count; 265 } 266 267 static int mrvl_load_firmware(struct hci_dev *hdev, const char *name) 268 { 269 struct hci_uart *hu = hci_get_drvdata(hdev); 270 struct mrvl_data *mrvl = hu->priv; 271 const struct firmware *fw = NULL; 272 const u8 *fw_ptr, *fw_max; 273 int err; 274 275 err = request_firmware(&fw, name, &hdev->dev); 276 if (err < 0) { 277 bt_dev_err(hdev, "Failed to load firmware file %s", name); 278 return err; 279 } 280 281 fw_ptr = fw->data; 282 fw_max = fw->data + fw->size; 283 284 bt_dev_info(hdev, "Loading %s", name); 285 286 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 287 288 while (fw_ptr <= fw_max) { 289 struct sk_buff *skb; 290 291 /* Controller drives the firmware load by sending firmware 292 * request packets containing the expected fragment size. 293 */ 294 err = wait_on_bit_timeout(&mrvl->flags, STATE_FW_REQ_PENDING, 295 TASK_INTERRUPTIBLE, 296 msecs_to_jiffies(2000)); 297 if (err == 1) { 298 bt_dev_err(hdev, "Firmware load interrupted"); 299 err = -EINTR; 300 break; 301 } else if (err) { 302 bt_dev_err(hdev, "Firmware request timeout"); 303 err = -ETIMEDOUT; 304 break; 305 } 306 307 bt_dev_dbg(hdev, "Firmware request, expecting %d bytes", 308 mrvl->tx_len); 309 310 if (fw_ptr == fw_max) { 311 /* Controller requests a null size once firmware is 312 * fully loaded. If controller expects more data, there 313 * is an issue. 314 */ 315 if (!mrvl->tx_len) { 316 bt_dev_info(hdev, "Firmware loading complete"); 317 } else { 318 bt_dev_err(hdev, "Firmware loading failure"); 319 err = -EINVAL; 320 } 321 break; 322 } 323 324 if (fw_ptr + mrvl->tx_len > fw_max) { 325 mrvl->tx_len = fw_max - fw_ptr; 326 bt_dev_dbg(hdev, "Adjusting tx_len to %d", 327 mrvl->tx_len); 328 } 329 330 skb = bt_skb_alloc(mrvl->tx_len, GFP_KERNEL); 331 if (!skb) { 332 bt_dev_err(hdev, "Failed to alloc mem for FW packet"); 333 err = -ENOMEM; 334 break; 335 } 336 bt_cb(skb)->pkt_type = MRVL_RAW_DATA; 337 338 skb_put_data(skb, fw_ptr, mrvl->tx_len); 339 fw_ptr += mrvl->tx_len; 340 341 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 342 343 skb_queue_tail(&mrvl->rawq, skb); 344 hci_uart_tx_wakeup(hu); 345 } 346 347 release_firmware(fw); 348 return err; 349 } 350 351 static int mrvl_setup(struct hci_uart *hu) 352 { 353 int err; 354 355 hci_uart_set_flow_control(hu, true); 356 357 err = mrvl_load_firmware(hu->hdev, "mrvl/helper_uart_3000000.bin"); 358 if (err) { 359 bt_dev_err(hu->hdev, "Unable to download firmware helper"); 360 return -EINVAL; 361 } 362 363 /* Let the final ack go out before switching the baudrate */ 364 hci_uart_wait_until_sent(hu); 365 366 if (hu->serdev) 367 serdev_device_set_baudrate(hu->serdev, 3000000); 368 else 369 hci_uart_set_baudrate(hu, 3000000); 370 371 hci_uart_set_flow_control(hu, false); 372 373 err = mrvl_load_firmware(hu->hdev, "mrvl/uart8897_bt.bin"); 374 if (err) 375 return err; 376 377 return 0; 378 } 379 380 static const struct hci_uart_proto mrvl_proto = { 381 .id = HCI_UART_MRVL, 382 .name = "Marvell", 383 .init_speed = 115200, 384 .open = mrvl_open, 385 .close = mrvl_close, 386 .flush = mrvl_flush, 387 .setup = mrvl_setup, 388 .recv = mrvl_recv, 389 .enqueue = mrvl_enqueue, 390 .dequeue = mrvl_dequeue, 391 }; 392 393 static int mrvl_serdev_probe(struct serdev_device *serdev) 394 { 395 struct mrvl_serdev *mrvldev; 396 397 mrvldev = devm_kzalloc(&serdev->dev, sizeof(*mrvldev), GFP_KERNEL); 398 if (!mrvldev) 399 return -ENOMEM; 400 401 mrvldev->hu.serdev = serdev; 402 serdev_device_set_drvdata(serdev, mrvldev); 403 404 return hci_uart_register_device(&mrvldev->hu, &mrvl_proto); 405 } 406 407 static void mrvl_serdev_remove(struct serdev_device *serdev) 408 { 409 struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev); 410 411 hci_uart_unregister_device(&mrvldev->hu); 412 } 413 414 #ifdef CONFIG_OF 415 static const struct of_device_id mrvl_bluetooth_of_match[] = { 416 { .compatible = "mrvl,88w8897" }, 417 { }, 418 }; 419 MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match); 420 #endif 421 422 static struct serdev_device_driver mrvl_serdev_driver = { 423 .probe = mrvl_serdev_probe, 424 .remove = mrvl_serdev_remove, 425 .driver = { 426 .name = "hci_uart_mrvl", 427 .of_match_table = of_match_ptr(mrvl_bluetooth_of_match), 428 }, 429 }; 430 431 int __init mrvl_init(void) 432 { 433 serdev_device_driver_register(&mrvl_serdev_driver); 434 435 return hci_uart_register_proto(&mrvl_proto); 436 } 437 438 int __exit mrvl_deinit(void) 439 { 440 serdev_device_driver_unregister(&mrvl_serdev_driver); 441 442 return hci_uart_unregister_proto(&mrvl_proto); 443 } 444