26 	BCM4377 = 0,
32 #define BCM4377_DEVICE_ID 0x5fa0
33 #define BCM4378_DEVICE_ID 0x5f69
34 #define BCM4387_DEVICE_ID 0x5f71
35 #define BCM4388_DEVICE_ID 0x5f72
43  * 0xffffffff but is always aligned down to the previous 0x200 byte boundary
44  * which effectively limits the window to [start, start+0xfffffe00].
45  * We just limit the DMA window to [0, 0xfffffe00] to make sure we don't
48 #define BCM4377_DMA_MASK 0xfffffe00
50 #define BCM4377_PCIECFG_BAR0_WINDOW1	   0x80
51 #define BCM4377_PCIECFG_BAR0_WINDOW2	   0x70
52 #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW1 0x74
53 #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW2 0x78
54 #define BCM4377_PCIECFG_BAR2_WINDOW	   0x84
56 #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW1_DEFAULT 0x18011000
57 #define BCM4377_PCIECFG_BAR2_WINDOW_DEFAULT	   0x19000000
59 #define BCM4377_PCIECFG_SUBSYSTEM_CTRL 0x88
61 #define BCM4377_BAR0_FW_DOORBELL 0x140
62 #define BCM4377_BAR0_RTI_CONTROL 0x144
64 #define BCM4377_BAR0_SLEEP_CONTROL	      0x150
65 #define BCM4377_BAR0_SLEEP_CONTROL_UNQUIESCE  0
69 #define BCM4377_BAR0_DOORBELL	    0x174
74 #define BCM4377_BAR0_HOST_WINDOW_LO   0x590
75 #define BCM4377_BAR0_HOST_WINDOW_HI   0x594
76 #define BCM4377_BAR0_HOST_WINDOW_SIZE 0x598
78 #define BCM4377_BAR2_BOOTSTAGE 0x200454
80 #define BCM4377_BAR2_FW_LO   0x200478
81 #define BCM4377_BAR2_FW_HI   0x20047c
82 #define BCM4377_BAR2_FW_SIZE 0x200480
84 #define BCM4377_BAR2_CONTEXT_ADDR_LO 0x20048c
85 #define BCM4377_BAR2_CONTEXT_ADDR_HI 0x200450
87 #define BCM4377_BAR2_RTI_STATUS	     0x20045c
88 #define BCM4377_BAR2_RTI_WINDOW_LO   0x200494
89 #define BCM4377_BAR2_RTI_WINDOW_HI   0x200498
90 #define BCM4377_BAR2_RTI_WINDOW_SIZE 0x20049c
92 #define BCM4377_OTP_SIZE	  0xe0
93 #define BCM4377_OTP_SYS_VENDOR	  0x15
94 #define BCM4377_OTP_CIS		  0x80
95 #define BCM4377_OTP_VENDOR_HDR	  0x00000008
104 #define BCM4377_MSGID_ID	 GENMASK(7, 0)
108 #define BCM4377_CONTROL_MSG_SIZE		   0x34
109 #define BCM4377_XFER_RING_MAX_INPLACE_PAYLOAD_SIZE (4 * 0xff)
121 	BCM4377_XFER_RING_CONTROL = 0,
131 	BCM4377_ACK_RING_CONTROL = 0,
139 	BCM4377_DOORBELL_CONTROL = 0,
156 #define BCM4377_XFER_RING_FLAG_PAYLOAD_MAPPED	 BIT(0)
165 static_assert(sizeof(struct bcm4377_xfer_ring_entry) == 0x10);
185 static_assert(sizeof(struct bcm4377_completion_ring_entry) == 0x10);
301  * size: Size of this structure, must be 0x68.
303  * peripheral_info_addr: DMA address for a 0x20 buffer to which the device will
316  *                                   must be set to 0xffff
317  * control_xfer_ring_msi: Control completion ring MSI index, must be 0
318  * control_completion_ring_msi: Control completion ring MSI index, must be 0.
367 static_assert(sizeof(struct bcm4377_context) == 0x68);
369 #define BCM4378_CALIBRATION_CHUNK_SIZE 0xe6
376 #define BCM4378_PTB_CHUNK_SIZE 0xcf
485  * id: Chip id (e.g. 0x4377 for BCM4377)
616 	u32 db = 0;  in bcm4377_ring_doorbell()
622 	dev_dbg(&bcm4377->pdev->dev, "write %d to doorbell #%d (0x%x)\n", val,  in bcm4377_ring_doorbell()
649 	return 0;  in bcm4377_extract_msgid()
729 	bitmap_release_region(ring->msgids, msgid, 0);  in bcm4377_handle_ack()
758 	if ((ring->transfer_rings & BIT(transfer_ring)) == 0) {  in bcm4377_handle_completion()
910 	msgid = bitmap_find_free_region(ring->msgids, ring->n_entries, 0);  in bcm4377_enqueue()
911 	if (msgid < 0) {  in bcm4377_enqueue()
924 	memset(entry, 0, sizeof(*entry));  in bcm4377_enqueue()
959 	ret = 0;  in bcm4377_enqueue()
964 	if (ret == 0 && wait) {  in bcm4377_enqueue()
967 		if (ret == 0)  in bcm4377_enqueue()
969 		else if (ret > 0)  in bcm4377_enqueue()
970 			ret = 0;  in bcm4377_enqueue()
989 		return 0;  in bcm4377_create_completion_ring()
992 	memset(ring->ring, 0,  in bcm4377_create_completion_ring()
995 	memset(&msg, 0, sizeof(msg));  in bcm4377_create_completion_ring()
1001 	msg.intmod_bytes = cpu_to_le32(0xffffffff);  in bcm4377_create_completion_ring()
1002 	msg.unk = cpu_to_le32(0xffffffff);  in bcm4377_create_completion_ring()
1020 	memset(&msg, 0, sizeof(msg));  in bcm4377_destroy_completion_ring()
1039 	u16 flags = 0;  in bcm4377_create_transfer_ring()
1049 	memset(&msg, 0, sizeof(msg));  in bcm4377_create_transfer_ring()
1060 	bcm4377->ring_state->xfer_ring_head[ring->ring_id] = 0;  in bcm4377_create_transfer_ring()
1061 	bcm4377->ring_state->xfer_ring_tail[ring->ring_id] = 0;  in bcm4377_create_transfer_ring()
1071 		for (i = 0; i < ring->n_entries; ++i) {  in bcm4377_create_transfer_ring()
1078 			memset(entry, 0, sizeof(*entry));  in bcm4377_create_transfer_ring()
1094 			cpu_to_le16(0xf);  in bcm4377_create_transfer_ring()
1095 		bcm4377_ring_doorbell(bcm4377, ring->doorbell, 0xf);  in bcm4377_create_transfer_ring()
1110 	memset(&msg, 0, sizeof(msg));  in bcm4377_destroy_transfer_ring()
1134 	memset(&cmd, 0, sizeof(cmd));  in __bcm4378_send_calibration_chunk()
1135 	cmd.unk = 0x03;  in __bcm4378_send_calibration_chunk()
1139 	skb = __hci_cmd_sync(bcm4377->hdev, 0xfd97, sizeof(cmd), &cmd,  in __bcm4378_send_calibration_chunk()
1145 	return 0;  in __bcm4378_send_calibration_chunk()
1162 	for (i = 0, left = data_size; i < blocks; ++i, left -= transfer_len) {  in __bcm4378_send_calibration()
1176 	return 0;  in __bcm4378_send_calibration()
1181 	if ((strcmp(bcm4377->stepping, "b1") == 0) ||  in bcm4378_send_calibration()
1182 	    strcmp(bcm4377->stepping, "b3") == 0)  in bcm4378_send_calibration()
1194 	if (strcmp(bcm4377->stepping, "c2") == 0)  in bcm4387_send_calibration()
1245 	skb = __hci_cmd_sync(bcm4377->hdev, 0xfd98, fw->size, fw->data,  in bcm4377_send_ptb()
1256 	return 0;  in bcm4377_send_ptb()
1269 	memset(&cmd, 0, sizeof(cmd));  in bcm4378_send_ptb_chunk()
1273 	skb = __hci_cmd_sync(bcm4377->hdev, 0xfe0d, sizeof(cmd), &cmd,  in bcm4378_send_ptb_chunk()
1279 	return 0;  in bcm4378_send_ptb_chunk()
1289 	for (i = 0, left = fw->size; i < chunks; ++i, left -= transfer_len) {  in bcm4378_send_ptb()
1304 	return 0;  in bcm4378_send_ptb()
1352 	return 0;  in bcm4377_hci_open()
1395 	return 0;  in bcm4377_hci_close()
1401 	if (addr->b[0] != 0x93)  in bcm4377_is_valid_bdaddr()
1403 	if (addr->b[1] != 0x76)  in bcm4377_is_valid_bdaddr()
1405 	if (addr->b[2] != 0x00)  in bcm4377_is_valid_bdaddr()
1407 	if (addr->b[4] != (bcm4377->hw->id & 0xff))  in bcm4377_is_valid_bdaddr()
1419 	skb = __hci_cmd_sync(bcm4377->hdev, HCI_OP_READ_BD_ADDR, 0, NULL,  in bcm4377_check_bdaddr()
1441 	return 0;  in bcm4377_check_bdaddr()
1497 	if (ret < 0) {  in bcm4377_hci_send_frame()
1513 	skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);  in bcm4377_hci_set_bdaddr()
1522 	return 0;  in bcm4377_hci_set_bdaddr()
1550 		return 0;  in bcm4377_alloc_transfer_ring()
1577 	return 0;  in bcm4377_alloc_transfer_ring()
1599 	return 0;  in bcm4377_alloc_completion_ring()
1611 	memset(bcm4377->ctx, 0, sizeof(*bcm4377->ctx));  in bcm4377_init_context()
1618 	memset(bcm4377->ring_state, 0, sizeof(*bcm4377->ring_state));  in bcm4377_init_context()
1625 	 * The BT device will write 0x20 bytes of data to this buffer but  in bcm4377_init_context()
1629 	if (!dmam_alloc_coherent(&bcm4377->pdev->dev, 0x20,  in bcm4377_init_context()
1655 	bcm4377->ctx->control_completion_ring_doorbell = cpu_to_le16(0xffff);  in bcm4377_init_context()
1656 	bcm4377->ctx->control_completion_ring_msi = 0;  in bcm4377_init_context()
1657 	bcm4377->ctx->control_completion_ring_header_size = 0;  in bcm4377_init_context()
1658 	bcm4377->ctx->control_completion_ring_footer_size = 0;  in bcm4377_init_context()
1666 	bcm4377->ctx->control_xfer_ring_msi = 0;  in bcm4377_init_context()
1667 	bcm4377->ctx->control_xfer_ring_header_size = 0;  in bcm4377_init_context()
1674 	return 0;  in bcm4377_init_context()
1824 	return 0;  in bcm4377_prepare_rings()
1832 	int ret = 0;  in bcm4377_boot()
1838 	if (bootstage != 0) {  in bcm4377_boot()
1839 		dev_err(&bcm4377->pdev->dev, "bootstage is %d and not 0\n",  in bcm4377_boot()
1844 	if (rti_status != 0) {  in bcm4377_boot()
1845 		dev_err(&bcm4377->pdev->dev, "RTI status is %d and not 0\n",  in bcm4377_boot()
1865 	iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_HOST_WINDOW_LO);  in bcm4377_boot()
1866 	iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_HOST_WINDOW_HI);  in bcm4377_boot()
1876 	iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_FW_DOORBELL);  in bcm4377_boot()
1882 	if (ret == 0) {  in bcm4377_boot()
1885 	} else if (ret < 0) {  in bcm4377_boot()
1898 	ret = 0;  in bcm4377_boot()
1916 	if (ret == 0) {  in bcm4377_setup_rti()
1920 	} else if (ret < 0) {  in bcm4377_setup_rti()
1932 	iowrite32(0, bcm4377->bar2 + bcm4377->hw->bar2_offset + BCM4377_BAR2_RTI_WINDOW_LO);  in bcm4377_setup_rti()
1933 	iowrite32(0, bcm4377->bar2 + bcm4377->hw->bar2_offset + BCM4377_BAR2_RTI_WINDOW_HI);  in bcm4377_setup_rti()
1946 	if (ret == 0) {  in bcm4377_setup_rti()
1950 	} else if (ret < 0) {  in bcm4377_setup_rti()
1964 	return 0;  in bcm4377_setup_rti()
1971 		return 0;  in bcm4377_parse_otp_board_params()
1976 	return 0;  in bcm4377_parse_otp_board_params()
1982 	size_t idx = 0;  in bcm4377_parse_otp_chip_params()
1985 		return 0;  in bcm4377_parse_otp_chip_params()
1989 	while (len != 0) {  in bcm4377_parse_otp_chip_params()
1991 		if (val[idx] == '\0')  in bcm4377_parse_otp_chip_params()
1992 			return 0;  in bcm4377_parse_otp_chip_params()
1998 	bcm4377->stepping[idx] = '\0';  in bcm4377_parse_otp_chip_params()
1999 	return 0;  in bcm4377_parse_otp_chip_params()
2017 		/* *p might be NUL here, if so end == p and len == 0 */  in bcm4377_parse_otp_str()
2046 	return 0;  in bcm4377_parse_otp_str()
2093 	if (!bcm4377->stepping[0] || !bcm4377->vendor[0])  in bcm4377_parse_otp_sys_vendor()
2098 	return 0;  in bcm4377_parse_otp_sys_vendor()
2111 	for (i = 0; i < BCM4377_OTP_SIZE; ++i)  in bcm4377_parse_otp()
2114 	i = 0;  in bcm4377_parse_otp()
2119 		if (type == 0)  in bcm4377_parse_otp()
2128 				"OTP @ 0x%x (%d): SYS_VENDOR", i, length);  in bcm4377_parse_otp()
2133 			dev_dbg(&bcm4377->pdev->dev, "OTP @ 0x%x (%d): CIS", i,  in bcm4377_parse_otp()
2137 			dev_dbg(&bcm4377->pdev->dev, "OTP @ 0x%x (%d): unknown",  in bcm4377_parse_otp()
2210 	return 0;  in bcm4377_probe_dmi()
2219 		return 0;  in bcm4377_probe_of()
2244 	return 0;  in bcm4377_probe_of()
2340 	bcm4377->bar0 = pcim_iomap(pdev, 0, 0);  in bcm4377_probe()
2343 	bcm4377->bar2 = pcim_iomap(pdev, 2, 0);  in bcm4377_probe()
2359 	if (ret < 0)  in bcm4377_probe()
2366 	irq = pci_irq_vector(pdev, 0);  in bcm4377_probe()
2367 	if (irq <= 0)  in bcm4377_probe()
2370 	ret = devm_request_irq(&pdev->dev, irq, bcm4377_irq, 0, "bcm4377",  in bcm4377_probe()
2431 	return 0;  in bcm4377_suspend()
2471 		.id = 0x4377,
2472 		.otp_offset = 0x4120,
2473 		.bar0_window1 = 0x1800b000,
2474 		.bar0_window2 = 0x1810c000,
2481 		.id = 0x4378,
2482 		.otp_offset = 0x4120,
2483 		.bar0_window1 = 0x18002000,
2484 		.bar0_window2 = 0x1810a000,
2485 		.bar0_core2_window2 = 0x18107000,
2494 		.id = 0x4387,
2495 		.otp_offset = 0x413c,
2496 		.bar0_window1 = 0x18002000,
2497 		.bar0_window2 = 0x18109000,
2498 		.bar0_core2_window2 = 0x18106000,
2509 		.id = 0x4388,
2510 		.otp_offset = 0x415c,
2511 		.bar2_offset = 0x200000,
2512 		.bar0_window1 = 0x18002000,
2513 		.bar0_window2 = 0x18109000,
2514 		.bar0_core2_window2 = 0x18106000,
2527 			PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, \