1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth HCI UART driver for marvell devices 5 * 6 * Copyright (C) 2016 Marvell International Ltd. 7 * Copyright (C) 2016 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/errno.h> 12 #include <linux/skbuff.h> 13 #include <linux/firmware.h> 14 #include <linux/module.h> 15 #include <linux/tty.h> 16 #include <linux/of.h> 17 #include <linux/serdev.h> 18 19 #include <net/bluetooth/bluetooth.h> 20 #include <net/bluetooth/hci_core.h> 21 22 #include "hci_uart.h" 23 24 #define HCI_FW_REQ_PKT 0xA5 25 #define HCI_CHIP_VER_PKT 0xAA 26 27 #define MRVL_ACK 0x5A 28 #define MRVL_NAK 0xBF 29 #define MRVL_RAW_DATA 0x1F 30 #define MRVL_SET_BAUDRATE 0xFC09 31 32 enum { 33 STATE_CHIP_VER_PENDING, 34 STATE_FW_REQ_PENDING, 35 STATE_FW_LOADED, 36 }; 37 38 struct mrvl_data { 39 struct sk_buff *rx_skb; 40 struct sk_buff_head txq; 41 struct sk_buff_head rawq; 42 unsigned long flags; 43 unsigned int tx_len; 44 u8 id, rev; 45 }; 46 47 struct mrvl_serdev { 48 struct hci_uart hu; 49 }; 50 51 struct hci_mrvl_pkt { 52 __le16 lhs; 53 __le16 rhs; 54 } __packed; 55 #define HCI_MRVL_PKT_SIZE 4 56 57 static int mrvl_open(struct hci_uart *hu) 58 { 59 struct mrvl_data *mrvl; 60 int ret; 61 62 BT_DBG("hu %p", hu); 63 64 if (!hci_uart_has_flow_control(hu)) 65 return -EOPNOTSUPP; 66 67 mrvl = kzalloc_obj(*mrvl); 68 if (!mrvl) 69 return -ENOMEM; 70 71 skb_queue_head_init(&mrvl->txq); 72 skb_queue_head_init(&mrvl->rawq); 73 74 set_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 75 76 hu->priv = mrvl; 77 78 if (hu->serdev) { 79 ret = serdev_device_open(hu->serdev); 80 if (ret) 81 goto err; 82 } 83 84 return 0; 85 err: 86 kfree(mrvl); 87 88 return ret; 89 } 90 91 static int mrvl_close(struct hci_uart *hu) 92 { 93 struct mrvl_data *mrvl = hu->priv; 94 95 BT_DBG("hu %p", hu); 96 97 if (hu->serdev) 98 serdev_device_close(hu->serdev); 99 100 skb_queue_purge(&mrvl->txq); 101 skb_queue_purge(&mrvl->rawq); 102 kfree_skb(mrvl->rx_skb); 103 kfree(mrvl); 104 105 hu->priv = NULL; 106 return 0; 107 } 108 109 static int mrvl_flush(struct hci_uart *hu) 110 { 111 struct mrvl_data *mrvl = hu->priv; 112 113 BT_DBG("hu %p", hu); 114 115 skb_queue_purge(&mrvl->txq); 116 skb_queue_purge(&mrvl->rawq); 117 118 return 0; 119 } 120 121 static struct sk_buff *mrvl_dequeue(struct hci_uart *hu) 122 { 123 struct mrvl_data *mrvl = hu->priv; 124 struct sk_buff *skb; 125 126 skb = skb_dequeue(&mrvl->txq); 127 if (!skb) { 128 /* Any raw data ? */ 129 skb = skb_dequeue(&mrvl->rawq); 130 } else { 131 /* Prepend skb with frame type */ 132 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 133 } 134 135 return skb; 136 } 137 138 static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb) 139 { 140 struct mrvl_data *mrvl = hu->priv; 141 142 skb_queue_tail(&mrvl->txq, skb); 143 return 0; 144 } 145 146 static void mrvl_send_ack(struct hci_uart *hu, unsigned char type) 147 { 148 struct mrvl_data *mrvl = hu->priv; 149 struct sk_buff *skb; 150 151 /* No H4 payload, only 1 byte header */ 152 skb = bt_skb_alloc(0, GFP_ATOMIC); 153 if (!skb) { 154 bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet"); 155 return; 156 } 157 hci_skb_pkt_type(skb) = type; 158 159 skb_queue_tail(&mrvl->txq, skb); 160 hci_uart_tx_wakeup(hu); 161 } 162 163 static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb) 164 { 165 struct hci_mrvl_pkt *pkt = (void *)skb->data; 166 struct hci_uart *hu = hci_get_drvdata(hdev); 167 struct mrvl_data *mrvl = hu->priv; 168 int ret = 0; 169 170 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 171 bt_dev_err(hdev, "Corrupted mrvl header"); 172 mrvl_send_ack(hu, MRVL_NAK); 173 ret = -EINVAL; 174 goto done; 175 } 176 mrvl_send_ack(hu, MRVL_ACK); 177 178 if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) { 179 bt_dev_err(hdev, "Received unexpected firmware request"); 180 ret = -EINVAL; 181 goto done; 182 } 183 184 mrvl->tx_len = le16_to_cpu(pkt->lhs); 185 186 clear_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 187 smp_mb__after_atomic(); 188 wake_up_bit(&mrvl->flags, STATE_FW_REQ_PENDING); 189 190 done: 191 kfree_skb(skb); 192 return ret; 193 } 194 195 static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb) 196 { 197 struct hci_mrvl_pkt *pkt = (void *)skb->data; 198 struct hci_uart *hu = hci_get_drvdata(hdev); 199 struct mrvl_data *mrvl = hu->priv; 200 u16 version = le16_to_cpu(pkt->lhs); 201 int ret = 0; 202 203 if ((pkt->lhs ^ pkt->rhs) != 0xffff) { 204 bt_dev_err(hdev, "Corrupted mrvl header"); 205 mrvl_send_ack(hu, MRVL_NAK); 206 ret = -EINVAL; 207 goto done; 208 } 209 mrvl_send_ack(hu, MRVL_ACK); 210 211 if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) { 212 bt_dev_err(hdev, "Received unexpected chip version"); 213 goto done; 214 } 215 216 mrvl->id = version; 217 mrvl->rev = version >> 8; 218 219 bt_dev_info(hdev, "Controller id = %x, rev = %x", mrvl->id, mrvl->rev); 220 221 clear_bit(STATE_CHIP_VER_PENDING, &mrvl->flags); 222 smp_mb__after_atomic(); 223 wake_up_bit(&mrvl->flags, STATE_CHIP_VER_PENDING); 224 225 done: 226 kfree_skb(skb); 227 return ret; 228 } 229 230 #define HCI_RECV_CHIP_VER \ 231 .type = HCI_CHIP_VER_PKT, \ 232 .hlen = HCI_MRVL_PKT_SIZE, \ 233 .loff = 0, \ 234 .lsize = 0, \ 235 .maxlen = HCI_MRVL_PKT_SIZE 236 237 #define HCI_RECV_FW_REQ \ 238 .type = HCI_FW_REQ_PKT, \ 239 .hlen = HCI_MRVL_PKT_SIZE, \ 240 .loff = 0, \ 241 .lsize = 0, \ 242 .maxlen = HCI_MRVL_PKT_SIZE 243 244 static const struct h4_recv_pkt mrvl_recv_pkts[] = { 245 { H4_RECV_ACL, .recv = hci_recv_frame }, 246 { H4_RECV_SCO, .recv = hci_recv_frame }, 247 { H4_RECV_EVENT, .recv = hci_recv_frame }, 248 { HCI_RECV_FW_REQ, .recv = mrvl_recv_fw_req }, 249 { HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver }, 250 }; 251 252 static int mrvl_recv(struct hci_uart *hu, const void *data, int count) 253 { 254 struct mrvl_data *mrvl = hu->priv; 255 256 if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) 257 return -EUNATCH; 258 259 /* We might receive some noise when there is no firmware loaded. Therefore, 260 * we drop data if the firmware is not loaded yet and if there is no fw load 261 * request pending. 262 */ 263 if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags) && 264 !test_bit(STATE_FW_LOADED, &mrvl->flags)) 265 return count; 266 267 mrvl->rx_skb = h4_recv_buf(hu, mrvl->rx_skb, data, count, 268 mrvl_recv_pkts, 269 ARRAY_SIZE(mrvl_recv_pkts)); 270 if (IS_ERR(mrvl->rx_skb)) { 271 int err = PTR_ERR(mrvl->rx_skb); 272 bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err); 273 mrvl->rx_skb = NULL; 274 return err; 275 } 276 277 return count; 278 } 279 280 static int mrvl_load_firmware(struct hci_dev *hdev, const char *name) 281 { 282 struct hci_uart *hu = hci_get_drvdata(hdev); 283 struct mrvl_data *mrvl = hu->priv; 284 const struct firmware *fw = NULL; 285 const u8 *fw_ptr, *fw_max; 286 int err; 287 288 err = request_firmware(&fw, name, &hdev->dev); 289 if (err < 0) { 290 bt_dev_err(hdev, "Failed to load firmware file %s", name); 291 return err; 292 } 293 294 fw_ptr = fw->data; 295 fw_max = fw->data + fw->size; 296 297 bt_dev_info(hdev, "Loading %s", name); 298 299 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 300 301 while (fw_ptr <= fw_max) { 302 struct sk_buff *skb; 303 304 /* Controller drives the firmware load by sending firmware 305 * request packets containing the expected fragment size. 306 */ 307 err = wait_on_bit_timeout(&mrvl->flags, STATE_FW_REQ_PENDING, 308 TASK_INTERRUPTIBLE, 309 msecs_to_jiffies(2000)); 310 if (err == -EINTR) { 311 bt_dev_err(hdev, "Firmware load interrupted"); 312 break; 313 } else if (err) { 314 bt_dev_err(hdev, "Firmware request timeout"); 315 err = -ETIMEDOUT; 316 break; 317 } 318 319 bt_dev_dbg(hdev, "Firmware request, expecting %d bytes", 320 mrvl->tx_len); 321 322 if (fw_ptr == fw_max) { 323 /* Controller requests a null size once firmware is 324 * fully loaded. If controller expects more data, there 325 * is an issue. 326 */ 327 if (!mrvl->tx_len) { 328 bt_dev_info(hdev, "Firmware loading complete"); 329 } else { 330 bt_dev_err(hdev, "Firmware loading failure"); 331 err = -EINVAL; 332 } 333 break; 334 } 335 336 if (fw_ptr + mrvl->tx_len > fw_max) { 337 mrvl->tx_len = fw_max - fw_ptr; 338 bt_dev_dbg(hdev, "Adjusting tx_len to %d", 339 mrvl->tx_len); 340 } 341 342 skb = bt_skb_alloc(mrvl->tx_len, GFP_KERNEL); 343 if (!skb) { 344 bt_dev_err(hdev, "Failed to alloc mem for FW packet"); 345 err = -ENOMEM; 346 break; 347 } 348 bt_cb(skb)->pkt_type = MRVL_RAW_DATA; 349 350 skb_put_data(skb, fw_ptr, mrvl->tx_len); 351 fw_ptr += mrvl->tx_len; 352 353 set_bit(STATE_FW_REQ_PENDING, &mrvl->flags); 354 355 skb_queue_tail(&mrvl->rawq, skb); 356 hci_uart_tx_wakeup(hu); 357 } 358 359 release_firmware(fw); 360 return err; 361 } 362 363 static int mrvl_setup(struct hci_uart *hu) 364 { 365 int err; 366 struct mrvl_data *mrvl = hu->priv; 367 368 hci_uart_set_flow_control(hu, true); 369 370 err = mrvl_load_firmware(hu->hdev, "mrvl/helper_uart_3000000.bin"); 371 if (err) { 372 bt_dev_err(hu->hdev, "Unable to download firmware helper"); 373 return -EINVAL; 374 } 375 376 /* Let the final ack go out before switching the baudrate */ 377 hci_uart_wait_until_sent(hu); 378 379 if (hu->serdev) 380 serdev_device_set_baudrate(hu->serdev, hu->oper_speed); 381 else 382 hci_uart_set_baudrate(hu, hu->oper_speed); 383 384 hci_uart_set_flow_control(hu, false); 385 386 err = mrvl_load_firmware(hu->hdev, "mrvl/uart8897_bt.bin"); 387 if (err) 388 return err; 389 390 set_bit(STATE_FW_LOADED, &mrvl->flags); 391 392 return 0; 393 } 394 395 static int mrvl_set_baudrate(struct hci_uart *hu, unsigned int speed) 396 { 397 int err; 398 struct mrvl_data *mrvl = hu->priv; 399 __le32 speed_le = cpu_to_le32(speed); 400 401 /* The firmware might be loaded by the Wifi driver over SDIO. We wait 402 * up to 10s for the CTS to go up. Afterward, we know that the firmware 403 * is ready. 404 */ 405 err = serdev_device_wait_for_cts(hu->serdev, true, 10000); 406 if (err) { 407 bt_dev_err(hu->hdev, "Wait for CTS failed with %d\n", err); 408 return err; 409 } 410 411 set_bit(STATE_FW_LOADED, &mrvl->flags); 412 413 err = __hci_cmd_sync_status(hu->hdev, MRVL_SET_BAUDRATE, 414 sizeof(speed_le), &speed_le, 415 HCI_INIT_TIMEOUT); 416 if (err) { 417 bt_dev_err(hu->hdev, "send command failed: %d", err); 418 return err; 419 } 420 421 serdev_device_set_baudrate(hu->serdev, speed); 422 423 /* We forcefully have to send a command to the bluetooth module so that 424 * the driver detects it after a baudrate change. This is foreseen by 425 * hci_serdev by setting HCI_UART_VND_DETECT which then causes a dummy 426 * local version read. 427 */ 428 set_bit(HCI_UART_VND_DETECT, &hu->hdev_flags); 429 430 return 0; 431 } 432 433 static const struct hci_uart_proto mrvl_proto_8897 = { 434 .id = HCI_UART_MRVL, 435 .name = "Marvell", 436 .init_speed = 115200, 437 .oper_speed = 3000000, 438 .open = mrvl_open, 439 .close = mrvl_close, 440 .flush = mrvl_flush, 441 .setup = mrvl_setup, 442 .recv = mrvl_recv, 443 .enqueue = mrvl_enqueue, 444 .dequeue = mrvl_dequeue, 445 }; 446 447 static const struct hci_uart_proto mrvl_proto_8997 = { 448 .id = HCI_UART_MRVL, 449 .name = "Marvell 8997", 450 .init_speed = 115200, 451 .oper_speed = 3000000, 452 .open = mrvl_open, 453 .close = mrvl_close, 454 .flush = mrvl_flush, 455 .set_baudrate = mrvl_set_baudrate, 456 .recv = mrvl_recv, 457 .enqueue = mrvl_enqueue, 458 .dequeue = mrvl_dequeue, 459 }; 460 461 static int mrvl_serdev_probe(struct serdev_device *serdev) 462 { 463 struct mrvl_serdev *mrvldev; 464 const struct hci_uart_proto *mrvl_proto = device_get_match_data(&serdev->dev); 465 466 mrvldev = devm_kzalloc(&serdev->dev, sizeof(*mrvldev), GFP_KERNEL); 467 if (!mrvldev) 468 return -ENOMEM; 469 470 mrvldev->hu.oper_speed = mrvl_proto->oper_speed; 471 if (mrvl_proto->set_baudrate) 472 of_property_read_u32(serdev->dev.of_node, "max-speed", &mrvldev->hu.oper_speed); 473 474 mrvldev->hu.serdev = serdev; 475 serdev_device_set_drvdata(serdev, mrvldev); 476 477 return hci_uart_register_device(&mrvldev->hu, mrvl_proto); 478 } 479 480 static void mrvl_serdev_remove(struct serdev_device *serdev) 481 { 482 struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev); 483 484 hci_uart_unregister_device(&mrvldev->hu); 485 } 486 487 static const struct of_device_id __maybe_unused mrvl_bluetooth_of_match[] = { 488 { .compatible = "mrvl,88w8897", .data = &mrvl_proto_8897}, 489 { .compatible = "mrvl,88w8997", .data = &mrvl_proto_8997}, 490 { }, 491 }; 492 MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match); 493 494 static struct serdev_device_driver mrvl_serdev_driver = { 495 .probe = mrvl_serdev_probe, 496 .remove = mrvl_serdev_remove, 497 .driver = { 498 .name = "hci_uart_mrvl", 499 .of_match_table = of_match_ptr(mrvl_bluetooth_of_match), 500 }, 501 }; 502 503 int __init mrvl_init(void) 504 { 505 serdev_device_driver_register(&mrvl_serdev_driver); 506 507 return hci_uart_register_proto(&mrvl_proto_8897); 508 } 509 510 int __exit mrvl_deinit(void) 511 { 512 serdev_device_driver_unregister(&mrvl_serdev_driver); 513 514 return hci_uart_unregister_proto(&mrvl_proto_8897); 515 } 516