1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * NXP Bluetooth driver
4 * Copyright 2023-2025 NXP
5 */
6
7 #include <linux/module.h>
8 #include <linux/kernel.h>
9
10 #include <linux/serdev.h>
11 #include <linux/of.h>
12 #include <linux/of_graph.h>
13 #include <linux/pwrseq/consumer.h>
14 #include <linux/skbuff.h>
15 #include <linux/unaligned.h>
16 #include <linux/firmware.h>
17 #include <linux/string.h>
18 #include <linux/crc8.h>
19 #include <linux/crc32.h>
20 #include <linux/string_helpers.h>
21 #include <linux/gpio/consumer.h>
22 #include <linux/of_irq.h>
23 #include <linux/regulator/consumer.h>
24 #include <linux/reset.h>
25
26 #include <net/bluetooth/bluetooth.h>
27 #include <net/bluetooth/hci_core.h>
28
29 #include "hci_uart.h"
30
31 #define MANUFACTURER_NXP 37
32
33 #define BTNXPUART_TX_STATE_ACTIVE 1
34 #define BTNXPUART_FW_DOWNLOADING 2
35 #define BTNXPUART_CHECK_BOOT_SIGNATURE 3
36 #define BTNXPUART_SERDEV_OPEN 4
37 #define BTNXPUART_IR_IN_PROGRESS 5
38 #define BTNXPUART_FW_DOWNLOAD_ABORT 6
39 #define BTNXPUART_FW_DUMP_IN_PROGRESS 7
40
41 /* NXP HW err codes */
42 #define BTNXPUART_IR_HW_ERR 0xb0
43
44 #define FIRMWARE_W8987 "uart8987_bt.bin"
45 #define FIRMWARE_W8987_OLD "uartuart8987_bt.bin"
46 #define FIRMWARE_W8997 "uart8997_bt_v4.bin"
47 #define FIRMWARE_W8997_OLD "uartuart8997_bt_v4.bin"
48 #define FIRMWARE_W9098 "uart9098_bt_v1.bin"
49 #define FIRMWARE_W9098_OLD "uartuart9098_bt_v1.bin"
50 #define FIRMWARE_IW416 "uartiw416_bt.bin"
51 #define FIRMWARE_IW416_OLD "uartiw416_bt_v0.bin"
52 #define FIRMWARE_IW612 "uartspi_n61x_v1.bin.se"
53 #define FIRMWARE_IW610 "uartspi_iw610.bin"
54 #define FIRMWARE_SECURE_IW610 "uartspi_iw610.bin.se"
55 #define FIRMWARE_IW624 "uartiw624_bt.bin"
56 #define FIRMWARE_SECURE_IW624 "uartiw624_bt.bin.se"
57 #define FIRMWARE_AW693 "uartaw693_bt.bin"
58 #define FIRMWARE_SECURE_AW693 "uartaw693_bt.bin.se"
59 #define FIRMWARE_AW693_A1 "uartaw693_bt_v1.bin"
60 #define FIRMWARE_SECURE_AW693_A1 "uartaw693_bt_v1.bin.se"
61 #define FIRMWARE_HELPER "helper_uart_3000000.bin"
62
63 #define CHIP_ID_W9098 0x5c03
64 #define CHIP_ID_IW416 0x7201
65 #define CHIP_ID_IW612 0x7601
66 #define CHIP_ID_IW624a 0x8000
67 #define CHIP_ID_IW624c 0x8001
68 #define CHIP_ID_AW693a0 0x8200
69 #define CHIP_ID_AW693a1 0x8201
70 #define CHIP_ID_IW610a0 0x8800
71 #define CHIP_ID_IW610a1 0x8801
72
73 #define FW_SECURE_MASK 0xc0
74 #define FW_OPEN 0x00
75 #define FW_AUTH_ILLEGAL 0x40
76 #define FW_AUTH_PLAIN 0x80
77 #define FW_AUTH_ENC 0xc0
78
79 #define HCI_NXP_PRI_BAUDRATE 115200
80 #define HCI_NXP_SEC_BAUDRATE_3M 3000000
81 #define HCI_NXP_SEC_BAUDRATE_4M 4000000
82
83 #define MAX_FW_FILE_NAME_LEN 50
84
85 /* Default ps timeout period in milliseconds */
86 #define PS_DEFAULT_TIMEOUT_PERIOD_MS 2000
87
88 /* wakeup methods */
89 #define WAKEUP_METHOD_DTR 0
90 #define WAKEUP_METHOD_BREAK 1
91 #define WAKEUP_METHOD_EXT_BREAK 2
92 #define WAKEUP_METHOD_RTS 3
93 #define WAKEUP_METHOD_GPIO 4
94 #define WAKEUP_METHOD_INVALID 0xff
95
96 /* power save mode status */
97 #define PS_MODE_DISABLE 0
98 #define PS_MODE_ENABLE 1
99
100 /* Power Save Commands to ps_work_func */
101 #define PS_CMD_EXIT_PS 1
102 #define PS_CMD_ENTER_PS 2
103
104 /* power save state */
105 #define PS_STATE_AWAKE 0
106 #define PS_STATE_SLEEP 1
107
108 /* NXP Vendor Commands. Refer user manual UM11628 on nxp.com */
109 /* Set custom BD Address */
110 #define HCI_NXP_SET_BD_ADDR 0xfc22
111 /* Set Auto-Sleep mode */
112 #define HCI_NXP_AUTO_SLEEP_MODE 0xfc23
113 /* Set Wakeup method */
114 #define HCI_NXP_WAKEUP_METHOD 0xfc53
115 /* Set operational baudrate */
116 #define HCI_NXP_SET_OPER_SPEED 0xfc09
117 /* Independent Reset (Soft Reset) */
118 #define HCI_NXP_IND_RESET 0xfcfc
119 /* Bluetooth vendor command: Trigger FW dump */
120 #define HCI_NXP_TRIGGER_DUMP 0xfe91
121
122 /* Bluetooth Power State : Vendor cmd params */
123 #define BT_PS_ENABLE 0x02
124 #define BT_PS_DISABLE 0x03
125
126 /* Bluetooth Host Wakeup Methods */
127 #define BT_HOST_WAKEUP_METHOD_NONE 0x00
128 #define BT_HOST_WAKEUP_METHOD_DTR 0x01
129 #define BT_HOST_WAKEUP_METHOD_BREAK 0x02
130 #define BT_HOST_WAKEUP_METHOD_GPIO 0x03
131
132 /* Bluetooth Chip Wakeup Methods */
133 #define BT_CTRL_WAKEUP_METHOD_DSR 0x00
134 #define BT_CTRL_WAKEUP_METHOD_BREAK 0x01
135 #define BT_CTRL_WAKEUP_METHOD_GPIO 0x02
136 #define BT_CTRL_WAKEUP_METHOD_EXT_BREAK 0x04
137 #define BT_CTRL_WAKEUP_METHOD_RTS 0x05
138
139 struct ps_data {
140 u8 target_ps_mode; /* ps mode to be set */
141 u8 cur_psmode; /* current ps_mode */
142 u8 ps_state; /* controller's power save state */
143 u8 ps_cmd;
144 u8 h2c_wakeupmode;
145 u8 cur_h2c_wakeupmode;
146 u8 c2h_wakeupmode;
147 u8 c2h_wakeup_gpio;
148 u8 h2c_wakeup_gpio;
149 bool driver_sent_cmd;
150 u16 h2c_ps_interval;
151 u16 c2h_ps_interval;
152 bool wakeup_source;
153 struct gpio_desc *h2c_ps_gpio;
154 s32 irq_handler;
155 struct hci_dev *hdev;
156 struct work_struct work;
157 struct timer_list ps_timer;
158 struct mutex ps_lock;
159 };
160
161 struct wakeup_cmd_payload {
162 u8 c2h_wakeupmode;
163 u8 c2h_wakeup_gpio;
164 u8 h2c_wakeupmode;
165 u8 h2c_wakeup_gpio;
166 } __packed;
167
168 struct psmode_cmd_payload {
169 u8 ps_cmd;
170 __le16 c2h_ps_interval;
171 } __packed;
172
173 struct btnxpuart_data {
174 const char *helper_fw_name;
175 const char *fw_name;
176 const char *fw_name_old;
177 };
178
179 enum bootloader_param_change {
180 not_changed,
181 cmd_sent,
182 changed
183 };
184
185 struct btnxpuart_dev {
186 struct hci_dev *hdev;
187 struct serdev_device *serdev;
188
189 struct work_struct tx_work;
190 unsigned long tx_state;
191 struct sk_buff_head txq;
192 struct sk_buff *rx_skb;
193
194 const struct firmware *fw;
195 u8 fw_name[MAX_FW_FILE_NAME_LEN];
196 u32 fw_dnld_v1_offset;
197 u32 fw_v1_sent_bytes;
198 u32 fw_dnld_v3_offset;
199 u32 fw_v3_offset_correction;
200 u32 fw_v3_prev_sent;
201 u32 fw_v1_expected_len;
202 u32 boot_reg_offset;
203 wait_queue_head_t fw_dnld_done_wait_q;
204 wait_queue_head_t check_boot_sign_wait_q;
205
206 u32 new_baudrate;
207 u32 current_baudrate;
208 u32 fw_init_baudrate;
209 u32 secondary_baudrate;
210 enum bootloader_param_change timeout_changed;
211 enum bootloader_param_change baudrate_changed;
212 bool helper_downloaded;
213
214 struct ps_data psdata;
215 struct btnxpuart_data *nxp_data;
216 struct pwrseq_desc *pwrseq;
217 struct reset_control *pdn;
218 struct hci_uart hu;
219 };
220
221 #define NXP_V1_FW_REQ_PKT 0xa5
222 #define NXP_V1_CHIP_VER_PKT 0xaa
223 #define NXP_V3_FW_REQ_PKT 0xa7
224 #define NXP_V3_CHIP_VER_PKT 0xab
225
226 #define NXP_ACK_V1 0x5a
227 #define NXP_NAK_V1 0xbf
228 #define NXP_ACK_V3 0x7a
229 #define NXP_NAK_V3 0x7b
230 #define NXP_CRC_ERROR_V3 0x7c
231
232 /* Bootloader signature error codes: Refer AN12820 from nxp.com */
233 #define NXP_CRC_RX_ERROR BIT(0) /* CRC error in previous packet */
234 #define NXP_ACK_RX_TIMEOUT BIT(2) /* ACK not received from host */
235 #define NXP_HDR_RX_TIMEOUT BIT(3) /* FW Header chunk not received */
236 #define NXP_DATA_RX_TIMEOUT BIT(4) /* FW Data chunk not received */
237
238 #define HDR_LEN 16
239
240 #define NXP_RECV_CHIP_VER_V1 \
241 .type = NXP_V1_CHIP_VER_PKT, \
242 .hlen = 4, \
243 .loff = 0, \
244 .lsize = 0, \
245 .maxlen = 4
246
247 #define NXP_RECV_FW_REQ_V1 \
248 .type = NXP_V1_FW_REQ_PKT, \
249 .hlen = 4, \
250 .loff = 0, \
251 .lsize = 0, \
252 .maxlen = 4
253
254 #define NXP_RECV_CHIP_VER_V3 \
255 .type = NXP_V3_CHIP_VER_PKT, \
256 .hlen = 4, \
257 .loff = 0, \
258 .lsize = 0, \
259 .maxlen = 4
260
261 #define NXP_RECV_FW_REQ_V3 \
262 .type = NXP_V3_FW_REQ_PKT, \
263 .hlen = 9, \
264 .loff = 0, \
265 .lsize = 0, \
266 .maxlen = 9
267
268 struct v1_data_req {
269 __le16 len;
270 __le16 len_comp;
271 } __packed;
272
273 struct v1_start_ind {
274 __le16 chip_id;
275 __le16 chip_id_comp;
276 } __packed;
277
278 struct v3_data_req {
279 __le16 len;
280 __le32 offset;
281 __le16 error;
282 u8 crc;
283 } __packed;
284
285 struct v3_start_ind {
286 __le16 chip_id;
287 u8 loader_ver;
288 u8 crc;
289 } __packed;
290
291 /* UART register addresses of BT chip */
292 #define CLKDIVADDR 0x7f00008f
293 #define UARTDIVADDR 0x7f000090
294 #define UARTMCRADDR 0x7f000091
295 #define UARTREINITADDR 0x7f000092
296 #define UARTICRADDR 0x7f000093
297 #define UARTFCRADDR 0x7f000094
298
299 #define MCR 0x00000022
300 #define INIT 0x00000001
301 #define ICR 0x000000c7
302 #define FCR 0x000000c7
303
304 #define POLYNOMIAL8 0x07
305
306 struct uart_reg {
307 __le32 address;
308 __le32 value;
309 } __packed;
310
311 struct uart_config {
312 struct uart_reg clkdiv;
313 struct uart_reg uartdiv;
314 struct uart_reg mcr;
315 struct uart_reg re_init;
316 struct uart_reg icr;
317 struct uart_reg fcr;
318 __be32 crc;
319 } __packed;
320
321 struct nxp_bootloader_cmd {
322 __le32 header;
323 __le32 arg;
324 __le32 payload_len;
325 __be32 crc;
326 } __packed;
327
328 struct nxp_v3_rx_timeout_nak {
329 u8 nak;
330 __le32 offset;
331 u8 crc;
332 } __packed;
333
334 union nxp_v3_rx_timeout_nak_u {
335 struct nxp_v3_rx_timeout_nak pkt;
336 u8 buf[6];
337 };
338
339 struct nxp_v3_crc_nak {
340 u8 nak;
341 u8 crc;
342 } __packed;
343
344 union nxp_v3_crc_nak_u {
345 struct nxp_v3_crc_nak pkt;
346 u8 buf[2];
347 };
348
349 /* FW dump */
350 #define NXP_FW_DUMP_SIZE (1024 * 1000)
351
352 struct nxp_fw_dump_hdr {
353 __le16 seq_num;
354 __le16 reserved;
355 __le16 buf_type;
356 __le16 buf_len;
357 };
358
359 union nxp_set_bd_addr_payload {
360 struct {
361 u8 param_id;
362 u8 param_len;
363 u8 param[6];
364 } __packed data;
365 u8 buf[8];
366 };
367
368 static u8 crc8_table[CRC8_TABLE_SIZE];
369
370 /* Default configurations */
371 #define DEFAULT_H2C_WAKEUP_MODE WAKEUP_METHOD_BREAK
372 #define DEFAULT_PS_MODE PS_MODE_ENABLE
373 #define FW_INIT_BAUDRATE HCI_NXP_PRI_BAUDRATE
374
nxp_drv_send_cmd(struct hci_dev * hdev,u16 opcode,u32 plen,void * param,bool resp)375 static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode,
376 u32 plen,
377 void *param,
378 bool resp)
379 {
380 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
381 struct ps_data *psdata = &nxpdev->psdata;
382 struct sk_buff *skb = NULL;
383
384 /* set flag to prevent nxp_enqueue from parsing values from this command and
385 * calling hci_cmd_sync_queue() again.
386 */
387 psdata->driver_sent_cmd = true;
388 if (resp) {
389 skb = __hci_cmd_sync(hdev, opcode, plen, param, HCI_CMD_TIMEOUT);
390 } else {
391 __hci_cmd_send(hdev, opcode, plen, param);
392 /* Allow command to be sent before tx_work is cancelled
393 * by btnxpuart_flush()
394 */
395 msleep(20);
396 }
397 psdata->driver_sent_cmd = false;
398
399 return skb;
400 }
401
btnxpuart_tx_wakeup(struct btnxpuart_dev * nxpdev)402 static void btnxpuart_tx_wakeup(struct btnxpuart_dev *nxpdev)
403 {
404 if (schedule_work(&nxpdev->tx_work))
405 set_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
406 }
407
408 /* NXP Power Save Feature */
ps_start_timer(struct btnxpuart_dev * nxpdev)409 static void ps_start_timer(struct btnxpuart_dev *nxpdev)
410 {
411 struct ps_data *psdata = &nxpdev->psdata;
412
413 if (!psdata)
414 return;
415
416 if (psdata->cur_psmode == PS_MODE_ENABLE)
417 mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval));
418
419 if (psdata->ps_state == PS_STATE_AWAKE && psdata->ps_cmd == PS_CMD_ENTER_PS)
420 cancel_work_sync(&psdata->work);
421 }
422
ps_cancel_timer(struct btnxpuart_dev * nxpdev)423 static void ps_cancel_timer(struct btnxpuart_dev *nxpdev)
424 {
425 struct ps_data *psdata = &nxpdev->psdata;
426
427 flush_work(&psdata->work);
428 timer_shutdown_sync(&psdata->ps_timer);
429 }
430
ps_control(struct hci_dev * hdev,u8 ps_state)431 static void ps_control(struct hci_dev *hdev, u8 ps_state)
432 {
433 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
434 struct ps_data *psdata = &nxpdev->psdata;
435 int status = 0;
436
437 if (psdata->ps_state == ps_state ||
438 !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state))
439 return;
440
441 mutex_lock(&psdata->ps_lock);
442 switch (psdata->cur_h2c_wakeupmode) {
443 case WAKEUP_METHOD_GPIO:
444 if (ps_state == PS_STATE_AWAKE)
445 gpiod_set_value_cansleep(psdata->h2c_ps_gpio, 0);
446 else
447 gpiod_set_value_cansleep(psdata->h2c_ps_gpio, 1);
448 bt_dev_dbg(hdev, "Set h2c_ps_gpio: %s",
449 str_high_low(ps_state == PS_STATE_SLEEP));
450 break;
451 case WAKEUP_METHOD_DTR:
452 if (ps_state == PS_STATE_AWAKE)
453 status = serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
454 else
455 status = serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
456 break;
457 case WAKEUP_METHOD_BREAK:
458 default:
459 if (ps_state == PS_STATE_AWAKE)
460 status = serdev_device_break_ctl(nxpdev->serdev, 0);
461 else
462 status = serdev_device_break_ctl(nxpdev->serdev, -1);
463 msleep(20); /* Allow chip to detect UART-break and enter sleep */
464 bt_dev_dbg(hdev, "Set UART break: %s, status=%d",
465 str_on_off(ps_state == PS_STATE_SLEEP), status);
466 break;
467 }
468 if (!status)
469 psdata->ps_state = ps_state;
470 mutex_unlock(&psdata->ps_lock);
471
472 if (ps_state == PS_STATE_AWAKE)
473 btnxpuart_tx_wakeup(nxpdev);
474 }
475
ps_work_func(struct work_struct * work)476 static void ps_work_func(struct work_struct *work)
477 {
478 struct ps_data *data = container_of(work, struct ps_data, work);
479
480 if (data->ps_cmd == PS_CMD_ENTER_PS && data->cur_psmode == PS_MODE_ENABLE)
481 ps_control(data->hdev, PS_STATE_SLEEP);
482 else if (data->ps_cmd == PS_CMD_EXIT_PS)
483 ps_control(data->hdev, PS_STATE_AWAKE);
484 }
485
ps_timeout_func(struct timer_list * t)486 static void ps_timeout_func(struct timer_list *t)
487 {
488 struct ps_data *data = timer_container_of(data, t, ps_timer);
489 struct hci_dev *hdev = data->hdev;
490 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
491
492 if (test_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state)) {
493 ps_start_timer(nxpdev);
494 } else {
495 data->ps_cmd = PS_CMD_ENTER_PS;
496 schedule_work(&data->work);
497 }
498 }
499
ps_host_wakeup_irq_handler(int irq,void * priv)500 static irqreturn_t ps_host_wakeup_irq_handler(int irq, void *priv)
501 {
502 struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)priv;
503
504 bt_dev_dbg(nxpdev->hdev, "Host wakeup interrupt");
505 return IRQ_HANDLED;
506 }
ps_setup(struct hci_dev * hdev)507 static int ps_setup(struct hci_dev *hdev)
508 {
509 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
510 struct serdev_device *serdev = nxpdev->serdev;
511 struct ps_data *psdata = &nxpdev->psdata;
512 int ret;
513
514 /* Out-Of-Band Device Wakeup */
515 psdata->h2c_ps_gpio = devm_gpiod_get_optional(&serdev->dev, "device-wakeup",
516 GPIOD_OUT_LOW);
517 if (IS_ERR(psdata->h2c_ps_gpio)) {
518 bt_dev_err(hdev, "Error fetching device-wakeup-gpios: %ld",
519 PTR_ERR(psdata->h2c_ps_gpio));
520 return PTR_ERR(psdata->h2c_ps_gpio);
521 }
522
523 if (device_property_read_u8(&serdev->dev, "nxp,wakein-pin", &psdata->h2c_wakeup_gpio)) {
524 psdata->h2c_wakeup_gpio = 0xff; /* 0xff: use default pin/gpio */
525 } else if (!psdata->h2c_ps_gpio) {
526 bt_dev_warn(hdev, "nxp,wakein-pin property without device-wakeup-gpios");
527 psdata->h2c_wakeup_gpio = 0xff;
528 }
529
530 /* Out-Of-Band Host Wakeup */
531 if (of_property_read_bool(serdev->dev.of_node, "wakeup-source")) {
532 psdata->irq_handler = of_irq_get_byname(serdev->dev.of_node, "wakeup");
533 bt_dev_info(nxpdev->hdev, "irq_handler: %d", psdata->irq_handler);
534 if (psdata->irq_handler > 0)
535 psdata->wakeup_source = true;
536 }
537
538 if (device_property_read_u8(&serdev->dev, "nxp,wakeout-pin", &psdata->c2h_wakeup_gpio)) {
539 psdata->c2h_wakeup_gpio = 0xff;
540 if (psdata->wakeup_source) {
541 bt_dev_warn(hdev, "host wakeup interrupt without nxp,wakeout-pin");
542 psdata->wakeup_source = false;
543 }
544 } else if (!psdata->wakeup_source) {
545 bt_dev_warn(hdev, "nxp,wakeout-pin property without host wakeup interrupt");
546 psdata->c2h_wakeup_gpio = 0xff;
547 }
548
549 if (psdata->wakeup_source) {
550 ret = devm_request_threaded_irq(&serdev->dev, psdata->irq_handler,
551 NULL, ps_host_wakeup_irq_handler,
552 IRQF_ONESHOT,
553 dev_name(&serdev->dev), nxpdev);
554 if (ret)
555 bt_dev_info(hdev, "error setting wakeup IRQ handler, ignoring\n");
556 disable_irq(psdata->irq_handler);
557 device_init_wakeup(&serdev->dev, true);
558 }
559
560 psdata->hdev = hdev;
561 INIT_WORK(&psdata->work, ps_work_func);
562 mutex_init(&psdata->ps_lock);
563 timer_setup(&psdata->ps_timer, ps_timeout_func, 0);
564
565 return 0;
566 }
567
ps_wakeup(struct btnxpuart_dev * nxpdev)568 static bool ps_wakeup(struct btnxpuart_dev *nxpdev)
569 {
570 struct ps_data *psdata = &nxpdev->psdata;
571 u8 ps_state;
572
573 mutex_lock(&psdata->ps_lock);
574 ps_state = psdata->ps_state;
575 mutex_unlock(&psdata->ps_lock);
576
577 if (ps_state != PS_STATE_AWAKE) {
578 psdata->ps_cmd = PS_CMD_EXIT_PS;
579 schedule_work(&psdata->work);
580 return true;
581 }
582 return false;
583 }
584
ps_cleanup(struct btnxpuart_dev * nxpdev)585 static void ps_cleanup(struct btnxpuart_dev *nxpdev)
586 {
587 struct ps_data *psdata = &nxpdev->psdata;
588 u8 ps_state;
589
590 mutex_lock(&psdata->ps_lock);
591 ps_state = psdata->ps_state;
592 mutex_unlock(&psdata->ps_lock);
593
594 if (ps_state != PS_STATE_AWAKE)
595 ps_control(psdata->hdev, PS_STATE_AWAKE);
596
597 ps_cancel_timer(nxpdev);
598 cancel_work_sync(&psdata->work);
599 mutex_destroy(&psdata->ps_lock);
600 }
601
send_ps_cmd(struct hci_dev * hdev,void * data)602 static int send_ps_cmd(struct hci_dev *hdev, void *data)
603 {
604 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
605 struct ps_data *psdata = &nxpdev->psdata;
606 struct psmode_cmd_payload pcmd;
607 struct sk_buff *skb;
608 u8 *status;
609
610 if (psdata->target_ps_mode == PS_MODE_ENABLE)
611 pcmd.ps_cmd = BT_PS_ENABLE;
612 else
613 pcmd.ps_cmd = BT_PS_DISABLE;
614 pcmd.c2h_ps_interval = __cpu_to_le16(psdata->c2h_ps_interval);
615
616 skb = nxp_drv_send_cmd(hdev, HCI_NXP_AUTO_SLEEP_MODE, sizeof(pcmd),
617 &pcmd, true);
618 if (IS_ERR(skb)) {
619 bt_dev_err(hdev, "Setting Power Save mode failed (%ld)", PTR_ERR(skb));
620 return PTR_ERR(skb);
621 }
622
623 status = skb_pull_data(skb, 1);
624 if (status) {
625 if (!*status)
626 psdata->cur_psmode = psdata->target_ps_mode;
627 else
628 psdata->target_ps_mode = psdata->cur_psmode;
629 if (psdata->cur_psmode == PS_MODE_ENABLE)
630 ps_start_timer(nxpdev);
631 else
632 ps_wakeup(nxpdev);
633 bt_dev_dbg(hdev, "Power Save mode response: status=%d, ps_mode=%d",
634 *status, psdata->cur_psmode);
635 }
636 kfree_skb(skb);
637
638 return 0;
639 }
640
send_wakeup_method_cmd(struct hci_dev * hdev,void * data)641 static int send_wakeup_method_cmd(struct hci_dev *hdev, void *data)
642 {
643 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
644 struct ps_data *psdata = &nxpdev->psdata;
645 struct wakeup_cmd_payload pcmd;
646 struct sk_buff *skb;
647 u8 *status;
648
649 pcmd.c2h_wakeupmode = psdata->c2h_wakeupmode;
650 pcmd.c2h_wakeup_gpio = psdata->c2h_wakeup_gpio;
651 pcmd.h2c_wakeup_gpio = 0xff;
652 switch (psdata->h2c_wakeupmode) {
653 case WAKEUP_METHOD_GPIO:
654 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_GPIO;
655 pcmd.h2c_wakeup_gpio = psdata->h2c_wakeup_gpio;
656 break;
657 case WAKEUP_METHOD_DTR:
658 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_DSR;
659 break;
660 case WAKEUP_METHOD_BREAK:
661 default:
662 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_BREAK;
663 break;
664 }
665
666 skb = nxp_drv_send_cmd(hdev, HCI_NXP_WAKEUP_METHOD, sizeof(pcmd),
667 &pcmd, true);
668 if (IS_ERR(skb)) {
669 bt_dev_err(hdev, "Setting wake-up method failed (%ld)", PTR_ERR(skb));
670 return PTR_ERR(skb);
671 }
672
673 status = skb_pull_data(skb, 1);
674 if (status) {
675 if (*status == 0)
676 psdata->cur_h2c_wakeupmode = psdata->h2c_wakeupmode;
677 else
678 psdata->h2c_wakeupmode = psdata->cur_h2c_wakeupmode;
679 bt_dev_dbg(hdev, "Set Wakeup Method response: status=%d, h2c_wakeupmode=%d",
680 *status, psdata->cur_h2c_wakeupmode);
681 }
682 kfree_skb(skb);
683
684 return 0;
685 }
686
ps_init(struct hci_dev * hdev)687 static void ps_init(struct hci_dev *hdev)
688 {
689 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
690 struct ps_data *psdata = &nxpdev->psdata;
691 u8 default_h2c_wakeup_mode = DEFAULT_H2C_WAKEUP_MODE;
692
693 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_RTS);
694 usleep_range(5000, 10000);
695 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_RTS, 0);
696 usleep_range(5000, 10000);
697
698 psdata->ps_state = PS_STATE_AWAKE;
699
700 if (psdata->c2h_wakeup_gpio != 0xff)
701 psdata->c2h_wakeupmode = BT_HOST_WAKEUP_METHOD_GPIO;
702 else
703 psdata->c2h_wakeupmode = BT_HOST_WAKEUP_METHOD_NONE;
704
705 psdata->cur_h2c_wakeupmode = WAKEUP_METHOD_INVALID;
706 if (psdata->h2c_ps_gpio)
707 default_h2c_wakeup_mode = WAKEUP_METHOD_GPIO;
708
709 psdata->h2c_ps_interval = PS_DEFAULT_TIMEOUT_PERIOD_MS;
710
711 switch (default_h2c_wakeup_mode) {
712 case WAKEUP_METHOD_GPIO:
713 psdata->h2c_wakeupmode = WAKEUP_METHOD_GPIO;
714 gpiod_set_value_cansleep(psdata->h2c_ps_gpio, 0);
715 usleep_range(5000, 10000);
716 break;
717 case WAKEUP_METHOD_DTR:
718 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
719 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
720 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
721 break;
722 case WAKEUP_METHOD_BREAK:
723 default:
724 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
725 serdev_device_break_ctl(nxpdev->serdev, -1);
726 usleep_range(5000, 10000);
727 serdev_device_break_ctl(nxpdev->serdev, 0);
728 usleep_range(5000, 10000);
729 break;
730 }
731
732 psdata->cur_psmode = PS_MODE_DISABLE;
733 psdata->target_ps_mode = DEFAULT_PS_MODE;
734 }
735
736 /* NXP Firmware Download Feature */
nxp_download_firmware(struct hci_dev * hdev)737 static int nxp_download_firmware(struct hci_dev *hdev)
738 {
739 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
740 int err = 0;
741
742 nxpdev->fw_dnld_v1_offset = 0;
743 nxpdev->fw_v1_sent_bytes = 0;
744 nxpdev->fw_v1_expected_len = HDR_LEN;
745 nxpdev->boot_reg_offset = 0;
746 nxpdev->fw_dnld_v3_offset = 0;
747 nxpdev->fw_v3_offset_correction = 0;
748 nxpdev->baudrate_changed = not_changed;
749 nxpdev->timeout_changed = not_changed;
750 nxpdev->helper_downloaded = false;
751
752 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
753 serdev_device_set_flow_control(nxpdev->serdev, false);
754 nxpdev->current_baudrate = HCI_NXP_PRI_BAUDRATE;
755
756 /* Wait till FW is downloaded */
757 err = wait_event_interruptible_timeout(nxpdev->fw_dnld_done_wait_q,
758 !test_bit(BTNXPUART_FW_DOWNLOADING,
759 &nxpdev->tx_state),
760 msecs_to_jiffies(60000));
761
762 if (nxpdev->fw && strlen(nxpdev->fw_name)) {
763 release_firmware(nxpdev->fw);
764 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
765 }
766
767 if (err == 0) {
768 bt_dev_err(hdev, "FW Download Timeout. offset: %d",
769 nxpdev->fw_dnld_v1_offset ?
770 nxpdev->fw_dnld_v1_offset :
771 nxpdev->fw_dnld_v3_offset);
772 return -ETIMEDOUT;
773 }
774 if (test_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state)) {
775 bt_dev_err(hdev, "FW Download Aborted");
776 return -EINTR;
777 }
778
779 serdev_device_set_flow_control(nxpdev->serdev, true);
780
781 /* Allow the downloaded FW to initialize */
782 msleep(1200);
783
784 return 0;
785 }
786
nxp_send_ack(u8 ack,struct hci_dev * hdev)787 static void nxp_send_ack(u8 ack, struct hci_dev *hdev)
788 {
789 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
790 u8 ack_nak[2];
791 int len = 1;
792
793 ack_nak[0] = ack;
794 if (ack == NXP_ACK_V3) {
795 ack_nak[1] = crc8(crc8_table, ack_nak, 1, 0xff);
796 len = 2;
797 }
798 serdev_device_write_buf(nxpdev->serdev, ack_nak, len);
799 }
800
nxp_fw_change_baudrate(struct hci_dev * hdev,u16 req_len)801 static bool nxp_fw_change_baudrate(struct hci_dev *hdev, u16 req_len)
802 {
803 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
804 struct nxp_bootloader_cmd nxp_cmd5;
805 struct uart_config uart_config;
806 u32 clkdivaddr = CLKDIVADDR - nxpdev->boot_reg_offset;
807 u32 uartdivaddr = UARTDIVADDR - nxpdev->boot_reg_offset;
808 u32 uartmcraddr = UARTMCRADDR - nxpdev->boot_reg_offset;
809 u32 uartreinitaddr = UARTREINITADDR - nxpdev->boot_reg_offset;
810 u32 uarticraddr = UARTICRADDR - nxpdev->boot_reg_offset;
811 u32 uartfcraddr = UARTFCRADDR - nxpdev->boot_reg_offset;
812
813 if (req_len == sizeof(nxp_cmd5)) {
814 nxp_cmd5.header = __cpu_to_le32(5);
815 nxp_cmd5.arg = 0;
816 nxp_cmd5.payload_len = __cpu_to_le32(sizeof(uart_config));
817 /* FW expects swapped CRC bytes */
818 nxp_cmd5.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd5,
819 sizeof(nxp_cmd5) - 4));
820
821 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd5, sizeof(nxp_cmd5));
822 nxpdev->fw_v3_offset_correction += req_len;
823 } else if (req_len == sizeof(uart_config)) {
824 uart_config.clkdiv.address = __cpu_to_le32(clkdivaddr);
825 if (nxpdev->new_baudrate == HCI_NXP_SEC_BAUDRATE_4M)
826 uart_config.clkdiv.value = __cpu_to_le32(0x01000000);
827 else
828 uart_config.clkdiv.value = __cpu_to_le32(0x00c00000);
829 uart_config.uartdiv.address = __cpu_to_le32(uartdivaddr);
830 uart_config.uartdiv.value = __cpu_to_le32(1);
831 uart_config.mcr.address = __cpu_to_le32(uartmcraddr);
832 uart_config.mcr.value = __cpu_to_le32(MCR);
833 uart_config.re_init.address = __cpu_to_le32(uartreinitaddr);
834 uart_config.re_init.value = __cpu_to_le32(INIT);
835 uart_config.icr.address = __cpu_to_le32(uarticraddr);
836 uart_config.icr.value = __cpu_to_le32(ICR);
837 uart_config.fcr.address = __cpu_to_le32(uartfcraddr);
838 uart_config.fcr.value = __cpu_to_le32(FCR);
839 /* FW expects swapped CRC bytes */
840 uart_config.crc = __cpu_to_be32(crc32_be(0UL, (char *)&uart_config,
841 sizeof(uart_config) - 4));
842
843 serdev_device_write_buf(nxpdev->serdev, (u8 *)&uart_config, sizeof(uart_config));
844 serdev_device_wait_until_sent(nxpdev->serdev, 0);
845 nxpdev->fw_v3_offset_correction += req_len;
846 return true;
847 }
848 return false;
849 }
850
nxp_fw_change_timeout(struct hci_dev * hdev,u16 req_len)851 static bool nxp_fw_change_timeout(struct hci_dev *hdev, u16 req_len)
852 {
853 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
854 struct nxp_bootloader_cmd nxp_cmd7;
855
856 if (req_len != sizeof(nxp_cmd7))
857 return false;
858
859 nxp_cmd7.header = __cpu_to_le32(7);
860 nxp_cmd7.arg = __cpu_to_le32(0x70);
861 nxp_cmd7.payload_len = 0;
862 /* FW expects swapped CRC bytes */
863 nxp_cmd7.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd7,
864 sizeof(nxp_cmd7) - 4));
865 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd7, sizeof(nxp_cmd7));
866 serdev_device_wait_until_sent(nxpdev->serdev, 0);
867 nxpdev->fw_v3_offset_correction += req_len;
868 return true;
869 }
870
nxp_get_data_len(const u8 * buf)871 static u32 nxp_get_data_len(const u8 *buf)
872 {
873 struct nxp_bootloader_cmd *hdr = (struct nxp_bootloader_cmd *)buf;
874
875 return __le32_to_cpu(hdr->payload_len);
876 }
877
is_fw_downloading(struct btnxpuart_dev * nxpdev)878 static bool is_fw_downloading(struct btnxpuart_dev *nxpdev)
879 {
880 return test_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
881 }
882
ind_reset_in_progress(struct btnxpuart_dev * nxpdev)883 static bool ind_reset_in_progress(struct btnxpuart_dev *nxpdev)
884 {
885 return test_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state);
886 }
887
fw_dump_in_progress(struct btnxpuart_dev * nxpdev)888 static bool fw_dump_in_progress(struct btnxpuart_dev *nxpdev)
889 {
890 return test_bit(BTNXPUART_FW_DUMP_IN_PROGRESS, &nxpdev->tx_state);
891 }
892
process_boot_signature(struct btnxpuart_dev * nxpdev)893 static bool process_boot_signature(struct btnxpuart_dev *nxpdev)
894 {
895 if (test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state)) {
896 clear_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
897 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
898 return false;
899 }
900 return is_fw_downloading(nxpdev);
901 }
902
nxp_request_firmware(struct hci_dev * hdev,const char * fw_name,const char * fw_name_old)903 static int nxp_request_firmware(struct hci_dev *hdev, const char *fw_name,
904 const char *fw_name_old)
905 {
906 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
907 const char *fw_name_dt;
908 int err = 0;
909
910 if (!fw_name)
911 return -ENOENT;
912
913 if (!strlen(nxpdev->fw_name)) {
914 if (strcmp(fw_name, FIRMWARE_HELPER) &&
915 !device_property_read_string(&nxpdev->serdev->dev,
916 "firmware-name",
917 &fw_name_dt))
918 fw_name = fw_name_dt;
919 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "nxp/%s", fw_name);
920 err = request_firmware_direct(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
921 if (err < 0 && fw_name_old) {
922 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "nxp/%s", fw_name_old);
923 err = request_firmware_direct(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
924 }
925
926 bt_dev_info(hdev, "Request Firmware: %s", nxpdev->fw_name);
927 if (err < 0) {
928 bt_dev_err(hdev, "Firmware file %s not found", nxpdev->fw_name);
929 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
930 }
931 }
932 return err;
933 }
934
935 /* for legacy chipsets with V1 bootloader */
nxp_recv_chip_ver_v1(struct hci_dev * hdev,struct sk_buff * skb)936 static int nxp_recv_chip_ver_v1(struct hci_dev *hdev, struct sk_buff *skb)
937 {
938 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
939 struct v1_start_ind *req;
940 __u16 chip_id;
941
942 req = skb_pull_data(skb, sizeof(*req));
943 if (!req)
944 goto free_skb;
945
946 chip_id = le16_to_cpu(req->chip_id ^ req->chip_id_comp);
947 if (chip_id == 0xffff && nxpdev->fw_dnld_v1_offset) {
948 nxpdev->fw_dnld_v1_offset = 0;
949 nxpdev->fw_v1_sent_bytes = 0;
950 nxpdev->fw_v1_expected_len = HDR_LEN;
951 release_firmware(nxpdev->fw);
952 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
953 nxp_send_ack(NXP_ACK_V1, hdev);
954 }
955
956 free_skb:
957 kfree_skb(skb);
958 return 0;
959 }
960
nxp_recv_fw_req_v1(struct hci_dev * hdev,struct sk_buff * skb)961 static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
962 {
963 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
964 struct btnxpuart_data *nxp_data = nxpdev->nxp_data;
965 struct v1_data_req *req;
966 __u16 len;
967
968 if (!process_boot_signature(nxpdev))
969 goto free_skb;
970
971 req = skb_pull_data(skb, sizeof(*req));
972 if (!req)
973 goto free_skb;
974
975 len = __le16_to_cpu(req->len ^ req->len_comp);
976 if (len != 0xffff) {
977 bt_dev_dbg(hdev, "ERR: Send NAK");
978 nxp_send_ack(NXP_NAK_V1, hdev);
979 goto free_skb;
980 }
981 nxp_send_ack(NXP_ACK_V1, hdev);
982
983 len = __le16_to_cpu(req->len);
984
985 if (!nxp_data->helper_fw_name) {
986 if (nxpdev->timeout_changed != changed) {
987 nxp_fw_change_timeout(hdev, len);
988 nxpdev->timeout_changed = changed;
989 goto free_skb;
990 }
991 if (nxpdev->baudrate_changed != changed) {
992 nxpdev->new_baudrate = nxpdev->secondary_baudrate;
993 if (nxp_fw_change_baudrate(hdev, len)) {
994 nxpdev->baudrate_changed = changed;
995 serdev_device_set_baudrate(nxpdev->serdev,
996 nxpdev->secondary_baudrate);
997 serdev_device_set_flow_control(nxpdev->serdev, true);
998 nxpdev->current_baudrate = nxpdev->secondary_baudrate;
999 }
1000 goto free_skb;
1001 }
1002 }
1003
1004 if (!nxp_data->helper_fw_name || nxpdev->helper_downloaded) {
1005 if (nxp_request_firmware(hdev, nxp_data->fw_name, nxp_data->fw_name_old))
1006 goto free_skb;
1007 } else if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
1008 if (nxp_request_firmware(hdev, nxp_data->helper_fw_name, NULL))
1009 goto free_skb;
1010 }
1011
1012 if (!len) {
1013 bt_dev_info(hdev, "FW Download Complete: %zu bytes",
1014 nxpdev->fw->size);
1015 if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
1016 nxpdev->helper_downloaded = true;
1017 serdev_device_wait_until_sent(nxpdev->serdev, 0);
1018 serdev_device_set_baudrate(nxpdev->serdev,
1019 HCI_NXP_SEC_BAUDRATE_3M);
1020 serdev_device_set_flow_control(nxpdev->serdev, true);
1021 } else {
1022 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1023 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1024 }
1025 goto free_skb;
1026 }
1027 if (len & 0x01) {
1028 /* The CRC did not match at the other end.
1029 * Simply send the same bytes again.
1030 */
1031 len = nxpdev->fw_v1_sent_bytes;
1032 bt_dev_dbg(hdev, "CRC error. Resend %d bytes of FW.", len);
1033 } else {
1034 nxpdev->fw_dnld_v1_offset += nxpdev->fw_v1_sent_bytes;
1035
1036 /* The FW bin file is made up of many blocks of
1037 * 16 byte header and payload data chunks. If the
1038 * FW has requested a header, read the payload length
1039 * info from the header, before sending the header.
1040 * In the next iteration, the FW should request the
1041 * payload data chunk, which should be equal to the
1042 * payload length read from header. If there is a
1043 * mismatch, clearly the driver and FW are out of sync,
1044 * and we need to re-send the previous header again.
1045 */
1046 if (len == nxpdev->fw_v1_expected_len) {
1047 if (len == HDR_LEN)
1048 nxpdev->fw_v1_expected_len = nxp_get_data_len(nxpdev->fw->data +
1049 nxpdev->fw_dnld_v1_offset);
1050 else
1051 nxpdev->fw_v1_expected_len = HDR_LEN;
1052 } else if (len == HDR_LEN) {
1053 /* FW download out of sync. Send previous chunk again */
1054 nxpdev->fw_dnld_v1_offset -= nxpdev->fw_v1_sent_bytes;
1055 nxpdev->fw_v1_expected_len = HDR_LEN;
1056 }
1057 }
1058
1059 if (nxpdev->fw_dnld_v1_offset + len <= nxpdev->fw->size)
1060 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
1061 nxpdev->fw_dnld_v1_offset, len);
1062 nxpdev->fw_v1_sent_bytes = len;
1063
1064 free_skb:
1065 kfree_skb(skb);
1066 return 0;
1067 }
1068
nxp_get_fw_name_from_chipid(struct hci_dev * hdev,u16 chipid,u8 loader_ver)1069 static char *nxp_get_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid,
1070 u8 loader_ver)
1071 {
1072 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1073 char *fw_name = NULL;
1074
1075 switch (chipid) {
1076 case CHIP_ID_W9098:
1077 fw_name = FIRMWARE_W9098;
1078 break;
1079 case CHIP_ID_IW416:
1080 fw_name = FIRMWARE_IW416;
1081 break;
1082 case CHIP_ID_IW612:
1083 fw_name = FIRMWARE_IW612;
1084 break;
1085 case CHIP_ID_IW624a:
1086 case CHIP_ID_IW624c:
1087 nxpdev->boot_reg_offset = 1;
1088 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
1089 fw_name = FIRMWARE_IW624;
1090 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
1091 fw_name = FIRMWARE_SECURE_IW624;
1092 else
1093 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
1094 break;
1095 case CHIP_ID_AW693a0:
1096 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
1097 fw_name = FIRMWARE_AW693;
1098 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
1099 fw_name = FIRMWARE_SECURE_AW693;
1100 else
1101 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
1102 break;
1103 case CHIP_ID_AW693a1:
1104 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
1105 fw_name = FIRMWARE_AW693_A1;
1106 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
1107 fw_name = FIRMWARE_SECURE_AW693_A1;
1108 else
1109 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
1110 break;
1111 case CHIP_ID_IW610a0:
1112 case CHIP_ID_IW610a1:
1113 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
1114 fw_name = FIRMWARE_IW610;
1115 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
1116 fw_name = FIRMWARE_SECURE_IW610;
1117 else
1118 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
1119 break;
1120 default:
1121 bt_dev_err(hdev, "Unknown chip signature %04x", chipid);
1122 break;
1123 }
1124 return fw_name;
1125 }
1126
nxp_get_old_fw_name_from_chipid(struct hci_dev * hdev,u16 chipid,u8 loader_ver)1127 static char *nxp_get_old_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid,
1128 u8 loader_ver)
1129 {
1130 char *fw_name_old = NULL;
1131
1132 switch (chipid) {
1133 case CHIP_ID_W9098:
1134 fw_name_old = FIRMWARE_W9098_OLD;
1135 break;
1136 case CHIP_ID_IW416:
1137 fw_name_old = FIRMWARE_IW416_OLD;
1138 break;
1139 }
1140 return fw_name_old;
1141 }
1142
nxp_recv_chip_ver_v3(struct hci_dev * hdev,struct sk_buff * skb)1143 static int nxp_recv_chip_ver_v3(struct hci_dev *hdev, struct sk_buff *skb)
1144 {
1145 struct v3_start_ind *req = skb_pull_data(skb, sizeof(*req));
1146 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1147 const char *fw_name;
1148 const char *fw_name_old;
1149 u16 chip_id;
1150 u8 loader_ver;
1151
1152 if (!process_boot_signature(nxpdev))
1153 goto free_skb;
1154
1155 chip_id = le16_to_cpu(req->chip_id);
1156 loader_ver = req->loader_ver;
1157 bt_dev_info(hdev, "ChipID: %04x, Version: %d", chip_id, loader_ver);
1158 fw_name = nxp_get_fw_name_from_chipid(hdev, chip_id, loader_ver);
1159 fw_name_old = nxp_get_old_fw_name_from_chipid(hdev, chip_id, loader_ver);
1160 if (!nxp_request_firmware(hdev, fw_name, fw_name_old))
1161 nxp_send_ack(NXP_ACK_V3, hdev);
1162
1163 free_skb:
1164 kfree_skb(skb);
1165 return 0;
1166 }
1167
nxp_handle_fw_download_error(struct hci_dev * hdev,struct v3_data_req * req)1168 static void nxp_handle_fw_download_error(struct hci_dev *hdev, struct v3_data_req *req)
1169 {
1170 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1171 __u32 offset = __le32_to_cpu(req->offset);
1172 __u16 err = __le16_to_cpu(req->error);
1173 union nxp_v3_rx_timeout_nak_u timeout_nak_buf;
1174 union nxp_v3_crc_nak_u crc_nak_buf;
1175
1176 if (err & NXP_CRC_RX_ERROR) {
1177 crc_nak_buf.pkt.nak = NXP_CRC_ERROR_V3;
1178 crc_nak_buf.pkt.crc = crc8(crc8_table, crc_nak_buf.buf,
1179 sizeof(crc_nak_buf) - 1, 0xff);
1180 serdev_device_write_buf(nxpdev->serdev, crc_nak_buf.buf,
1181 sizeof(crc_nak_buf));
1182 } else if (err & NXP_ACK_RX_TIMEOUT ||
1183 err & NXP_HDR_RX_TIMEOUT ||
1184 err & NXP_DATA_RX_TIMEOUT) {
1185 timeout_nak_buf.pkt.nak = NXP_NAK_V3;
1186 timeout_nak_buf.pkt.offset = __cpu_to_le32(offset);
1187 timeout_nak_buf.pkt.crc = crc8(crc8_table, timeout_nak_buf.buf,
1188 sizeof(timeout_nak_buf) - 1, 0xff);
1189 serdev_device_write_buf(nxpdev->serdev, timeout_nak_buf.buf,
1190 sizeof(timeout_nak_buf));
1191 } else {
1192 bt_dev_err(hdev, "Unknown bootloader error code: %d", err);
1193 }
1194 }
1195
nxp_recv_fw_req_v3(struct hci_dev * hdev,struct sk_buff * skb)1196 static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
1197 {
1198 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1199 struct v3_data_req *req;
1200 __u16 len = 0;
1201 __u16 err = 0;
1202 __u32 offset;
1203
1204 if (!process_boot_signature(nxpdev))
1205 goto free_skb;
1206
1207 req = skb_pull_data(skb, sizeof(*req));
1208 if (!req || !nxpdev->fw)
1209 goto free_skb;
1210
1211 err = __le16_to_cpu(req->error);
1212
1213 if (!err) {
1214 nxp_send_ack(NXP_ACK_V3, hdev);
1215 if (nxpdev->timeout_changed == cmd_sent)
1216 nxpdev->timeout_changed = changed;
1217 if (nxpdev->baudrate_changed == cmd_sent)
1218 nxpdev->baudrate_changed = changed;
1219 } else {
1220 nxp_handle_fw_download_error(hdev, req);
1221 if (nxpdev->timeout_changed == cmd_sent &&
1222 err == NXP_CRC_RX_ERROR) {
1223 nxpdev->fw_v3_offset_correction -= nxpdev->fw_v3_prev_sent;
1224 nxpdev->timeout_changed = not_changed;
1225 }
1226 if (nxpdev->baudrate_changed == cmd_sent &&
1227 err == NXP_CRC_RX_ERROR) {
1228 nxpdev->fw_v3_offset_correction -= nxpdev->fw_v3_prev_sent;
1229 nxpdev->baudrate_changed = not_changed;
1230 }
1231 goto free_skb;
1232 }
1233
1234 len = __le16_to_cpu(req->len);
1235
1236 if (nxpdev->timeout_changed != changed) {
1237 nxp_fw_change_timeout(hdev, len);
1238 nxpdev->timeout_changed = cmd_sent;
1239 goto free_skb;
1240 }
1241
1242 if (nxpdev->baudrate_changed != changed) {
1243 nxpdev->new_baudrate = nxpdev->secondary_baudrate;
1244 if (nxp_fw_change_baudrate(hdev, len)) {
1245 nxpdev->baudrate_changed = cmd_sent;
1246 serdev_device_set_baudrate(nxpdev->serdev,
1247 nxpdev->secondary_baudrate);
1248 serdev_device_set_flow_control(nxpdev->serdev, true);
1249 nxpdev->current_baudrate = nxpdev->secondary_baudrate;
1250 }
1251 goto free_skb;
1252 }
1253
1254 if (req->len == 0) {
1255 bt_dev_info(hdev, "FW Download Complete: %zu bytes",
1256 nxpdev->fw->size);
1257 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1258 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1259 goto free_skb;
1260 }
1261
1262 offset = __le32_to_cpu(req->offset);
1263 if (offset < nxpdev->fw_v3_offset_correction) {
1264 /* This scenario should ideally never occur. But if it ever does,
1265 * FW is out of sync and needs a power cycle.
1266 */
1267 bt_dev_err(hdev, "Something went wrong during FW download");
1268 bt_dev_err(hdev, "Please power cycle and try again");
1269 goto free_skb;
1270 }
1271
1272 nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
1273 if (nxpdev->fw_dnld_v3_offset >= nxpdev->fw->size ||
1274 len > nxpdev->fw->size - nxpdev->fw_dnld_v3_offset) {
1275 bt_dev_err(hdev, "FW download out of bounds, ignoring request");
1276 len = 0;
1277 goto free_skb;
1278 }
1279 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
1280 nxpdev->fw_dnld_v3_offset, len);
1281
1282 free_skb:
1283 nxpdev->fw_v3_prev_sent = len;
1284 kfree_skb(skb);
1285 return 0;
1286 }
1287
nxp_set_baudrate_cmd(struct hci_dev * hdev,void * data)1288 static int nxp_set_baudrate_cmd(struct hci_dev *hdev, void *data)
1289 {
1290 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1291 __le32 new_baudrate = __cpu_to_le32(nxpdev->new_baudrate);
1292 struct ps_data *psdata = &nxpdev->psdata;
1293 struct sk_buff *skb;
1294 u8 *status;
1295
1296 if (!psdata)
1297 return 0;
1298
1299 skb = nxp_drv_send_cmd(hdev, HCI_NXP_SET_OPER_SPEED, 4,
1300 (u8 *)&new_baudrate, true);
1301 if (IS_ERR(skb)) {
1302 bt_dev_err(hdev, "Setting baudrate failed (%ld)", PTR_ERR(skb));
1303 return PTR_ERR(skb);
1304 }
1305
1306 status = (u8 *)skb_pull_data(skb, 1);
1307 if (status) {
1308 if (*status == 0) {
1309 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->new_baudrate);
1310 nxpdev->current_baudrate = nxpdev->new_baudrate;
1311 }
1312 bt_dev_dbg(hdev, "Set baudrate response: status=%d, baudrate=%d",
1313 *status, nxpdev->new_baudrate);
1314 }
1315 kfree_skb(skb);
1316
1317 return 0;
1318 }
1319
nxp_check_boot_sign(struct btnxpuart_dev * nxpdev)1320 static int nxp_check_boot_sign(struct btnxpuart_dev *nxpdev)
1321 {
1322 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
1323 if (ind_reset_in_progress(nxpdev))
1324 serdev_device_set_flow_control(nxpdev->serdev, false);
1325 else
1326 serdev_device_set_flow_control(nxpdev->serdev, true);
1327 set_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
1328
1329 return wait_event_interruptible_timeout(nxpdev->check_boot_sign_wait_q,
1330 !test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE,
1331 &nxpdev->tx_state),
1332 msecs_to_jiffies(1000));
1333 }
1334
nxp_set_ind_reset(struct hci_dev * hdev,void * data)1335 static int nxp_set_ind_reset(struct hci_dev *hdev, void *data)
1336 {
1337 return __hci_reset_dev(hdev, BTNXPUART_IR_HW_ERR);
1338 }
1339
1340 /* Firmware dump */
nxp_coredump(struct hci_dev * hdev)1341 static void nxp_coredump(struct hci_dev *hdev)
1342 {
1343 struct sk_buff *skb;
1344 u8 pcmd = 2;
1345
1346 skb = nxp_drv_send_cmd(hdev, HCI_NXP_TRIGGER_DUMP, 1, &pcmd, true);
1347 if (IS_ERR(skb))
1348 bt_dev_err(hdev, "Failed to trigger FW Dump. (%ld)", PTR_ERR(skb));
1349 else
1350 kfree_skb(skb);
1351 }
1352
nxp_coredump_hdr(struct hci_dev * hdev,struct sk_buff * skb)1353 static void nxp_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
1354 {
1355 /* Nothing to be added in FW dump header */
1356 }
1357
nxp_process_fw_dump(struct hci_dev * hdev,struct sk_buff * skb)1358 static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
1359 {
1360 struct hci_acl_hdr *acl_hdr = (struct hci_acl_hdr *)skb_pull_data(skb,
1361 sizeof(*acl_hdr));
1362 struct nxp_fw_dump_hdr *fw_dump_hdr;
1363 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1364 __u16 seq_num;
1365 __u16 buf_len;
1366 int err;
1367
1368 fw_dump_hdr = skb_pull_data(skb, sizeof(*fw_dump_hdr));
1369 if (!fw_dump_hdr) {
1370 bt_dev_warn(hdev, "FW dump: invalid or corrupt fw dump chunk");
1371 goto free_skb;
1372 }
1373
1374 seq_num = __le16_to_cpu(fw_dump_hdr->seq_num);
1375 buf_len = __le16_to_cpu(fw_dump_hdr->buf_len);
1376
1377 if (seq_num == 0x0001) {
1378 if (test_and_set_bit(BTNXPUART_FW_DUMP_IN_PROGRESS, &nxpdev->tx_state)) {
1379 bt_dev_err(hdev, "FW dump already in progress");
1380 goto free_skb;
1381 }
1382 bt_dev_warn(hdev, "==== Start FW dump ===");
1383 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
1384 if (err < 0)
1385 goto free_skb;
1386
1387 schedule_delayed_work(&hdev->dump.dump_timeout,
1388 msecs_to_jiffies(20000));
1389 }
1390
1391 if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
1392 err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
1393 if (err < 0)
1394 goto free_skb;
1395 }
1396
1397 if (buf_len == 0) {
1398 bt_dev_warn(hdev, "==== FW dump complete ===");
1399 hci_devcd_complete(hdev);
1400 nxp_set_ind_reset(hdev, NULL);
1401 }
1402
1403 free_skb:
1404 kfree_skb(skb);
1405 return 0;
1406 }
1407
nxp_recv_acl_pkt(struct hci_dev * hdev,struct sk_buff * skb)1408 static int nxp_recv_acl_pkt(struct hci_dev *hdev, struct sk_buff *skb)
1409 {
1410 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
1411
1412 /* FW dump chunks are ACL packets with conn handle 0xfff */
1413 if ((handle & 0x0FFF) == 0xFFF)
1414 return nxp_process_fw_dump(hdev, skb);
1415 else
1416 return hci_recv_frame(hdev, skb);
1417 }
1418
nxp_set_bdaddr(struct hci_dev * hdev,const bdaddr_t * bdaddr)1419 static int nxp_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1420 {
1421 union nxp_set_bd_addr_payload pcmd;
1422 int err;
1423
1424 pcmd.data.param_id = 0xfe;
1425 pcmd.data.param_len = 6;
1426 memcpy(pcmd.data.param, bdaddr, 6);
1427
1428 /* BD address can be assigned only after first reset command. */
1429 err = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL,
1430 HCI_INIT_TIMEOUT);
1431 if (err) {
1432 bt_dev_err(hdev,
1433 "Reset before setting local-bd-addr failed (%d)",
1434 err);
1435 return err;
1436 }
1437
1438 err = __hci_cmd_sync_status(hdev, HCI_NXP_SET_BD_ADDR, sizeof(pcmd),
1439 pcmd.buf, HCI_CMD_TIMEOUT);
1440 if (err) {
1441 bt_dev_err(hdev, "Changing device address failed (%d)", err);
1442 return err;
1443 }
1444
1445 return 0;
1446 }
1447
1448 /* NXP protocol */
nxp_setup(struct hci_dev * hdev)1449 static int nxp_setup(struct hci_dev *hdev)
1450 {
1451 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1452 struct serdev_device *serdev = nxpdev->serdev;
1453 char device_string[30];
1454 char event_string[50];
1455 char *envp[] = {device_string, event_string, NULL};
1456 int err = 0;
1457
1458 if (nxp_check_boot_sign(nxpdev)) {
1459 bt_dev_dbg(hdev, "Need FW Download.");
1460 err = nxp_download_firmware(hdev);
1461 if (err < 0)
1462 return err;
1463 } else {
1464 bt_dev_info(hdev, "FW already running.");
1465 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1466 }
1467
1468 snprintf(device_string, 30, "BTNXPUART_DEV=%s", dev_name(&serdev->dev));
1469 snprintf(event_string, 50, "BTNXPUART_STATE=FW_READY");
1470 bt_dev_dbg(hdev, "==== Send uevent: %s:%s ===", device_string,
1471 event_string);
1472 kobject_uevent_env(&serdev->dev.kobj, KOBJ_CHANGE, envp);
1473
1474 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->fw_init_baudrate);
1475 nxpdev->current_baudrate = nxpdev->fw_init_baudrate;
1476
1477 ps_init(hdev);
1478
1479 if (test_and_clear_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state))
1480 hci_dev_clear_flag(hdev, HCI_SETUP);
1481
1482 return 0;
1483 }
1484
nxp_post_init(struct hci_dev * hdev)1485 static int nxp_post_init(struct hci_dev *hdev)
1486 {
1487 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1488 struct ps_data *psdata = &nxpdev->psdata;
1489
1490 if (nxpdev->current_baudrate != nxpdev->secondary_baudrate) {
1491 nxpdev->new_baudrate = nxpdev->secondary_baudrate;
1492 nxp_set_baudrate_cmd(hdev, NULL);
1493 }
1494 if (psdata->cur_h2c_wakeupmode != psdata->h2c_wakeupmode)
1495 send_wakeup_method_cmd(hdev, NULL);
1496 if (psdata->cur_psmode != psdata->target_ps_mode)
1497 send_ps_cmd(hdev, NULL);
1498 return 0;
1499 }
1500
nxp_hw_err(struct hci_dev * hdev,u8 code)1501 static void nxp_hw_err(struct hci_dev *hdev, u8 code)
1502 {
1503 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1504
1505 switch (code) {
1506 case BTNXPUART_IR_HW_ERR:
1507 set_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state);
1508 hci_dev_set_flag(hdev, HCI_SETUP);
1509 break;
1510 default:
1511 break;
1512 }
1513 }
1514
nxp_shutdown(struct hci_dev * hdev)1515 static int nxp_shutdown(struct hci_dev *hdev)
1516 {
1517 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1518 struct sk_buff *skb;
1519 u8 pcmd = 0;
1520
1521 if (ind_reset_in_progress(nxpdev)) {
1522 if (test_and_clear_bit(BTNXPUART_FW_DUMP_IN_PROGRESS,
1523 &nxpdev->tx_state))
1524 skb = nxp_drv_send_cmd(hdev, HCI_NXP_IND_RESET, 1,
1525 &pcmd, false);
1526 else
1527 skb = nxp_drv_send_cmd(hdev, HCI_NXP_IND_RESET, 1,
1528 &pcmd, true);
1529 serdev_device_set_flow_control(nxpdev->serdev, false);
1530 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1531 /* HCI_NXP_IND_RESET command may not returns any response */
1532 if (!IS_ERR(skb))
1533 kfree_skb(skb);
1534 }
1535
1536 return 0;
1537 }
1538
nxp_wakeup(struct hci_dev * hdev)1539 static bool nxp_wakeup(struct hci_dev *hdev)
1540 {
1541 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1542 struct ps_data *psdata = &nxpdev->psdata;
1543
1544 if (psdata->c2h_wakeupmode != BT_HOST_WAKEUP_METHOD_NONE)
1545 return true;
1546
1547 return false;
1548 }
1549
nxp_reset(struct hci_dev * hdev)1550 static void nxp_reset(struct hci_dev *hdev)
1551 {
1552 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1553
1554 if (!ind_reset_in_progress(nxpdev) && !fw_dump_in_progress(nxpdev)) {
1555 bt_dev_dbg(hdev, "CMD Timeout detected. Resetting.");
1556 nxp_set_ind_reset(hdev, NULL);
1557 }
1558 }
1559
btnxpuart_queue_skb(struct hci_dev * hdev,struct sk_buff * skb)1560 static int btnxpuart_queue_skb(struct hci_dev *hdev, struct sk_buff *skb)
1561 {
1562 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1563
1564 /* Prepend skb with frame type */
1565 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
1566 skb_queue_tail(&nxpdev->txq, skb);
1567 btnxpuart_tx_wakeup(nxpdev);
1568 return 0;
1569 }
1570
nxp_enqueue(struct hci_dev * hdev,struct sk_buff * skb)1571 static int nxp_enqueue(struct hci_dev *hdev, struct sk_buff *skb)
1572 {
1573 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1574 struct ps_data *psdata = &nxpdev->psdata;
1575 struct hci_command_hdr *hdr;
1576 struct psmode_cmd_payload ps_parm;
1577 struct wakeup_cmd_payload wakeup_parm;
1578 __le32 baudrate_parm;
1579
1580 if (fw_dump_in_progress(nxpdev))
1581 return -EBUSY;
1582
1583 /* if vendor commands are received from user space (e.g. hcitool), update
1584 * driver flags accordingly and ask driver to re-send the command to FW.
1585 * In case the payload for any command does not match expected payload
1586 * length, let the firmware and user space program handle it, or throw
1587 * an error.
1588 */
1589 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT && !psdata->driver_sent_cmd) {
1590 hdr = (struct hci_command_hdr *)skb->data;
1591 if (hdr->plen != (skb->len - HCI_COMMAND_HDR_SIZE))
1592 return btnxpuart_queue_skb(hdev, skb);
1593
1594 switch (__le16_to_cpu(hdr->opcode)) {
1595 case HCI_NXP_AUTO_SLEEP_MODE:
1596 if (hdr->plen == sizeof(ps_parm)) {
1597 memcpy(&ps_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1598 if (ps_parm.ps_cmd == BT_PS_ENABLE)
1599 psdata->target_ps_mode = PS_MODE_ENABLE;
1600 else if (ps_parm.ps_cmd == BT_PS_DISABLE)
1601 psdata->target_ps_mode = PS_MODE_DISABLE;
1602 psdata->c2h_ps_interval = __le16_to_cpu(ps_parm.c2h_ps_interval);
1603 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
1604 goto free_skb;
1605 }
1606 break;
1607 case HCI_NXP_WAKEUP_METHOD:
1608 if (hdr->plen == sizeof(wakeup_parm)) {
1609 memcpy(&wakeup_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1610 psdata->c2h_wakeupmode = wakeup_parm.c2h_wakeupmode;
1611 psdata->c2h_wakeup_gpio = wakeup_parm.c2h_wakeup_gpio;
1612 psdata->h2c_wakeup_gpio = wakeup_parm.h2c_wakeup_gpio;
1613 switch (wakeup_parm.h2c_wakeupmode) {
1614 case BT_CTRL_WAKEUP_METHOD_GPIO:
1615 psdata->h2c_wakeupmode = WAKEUP_METHOD_GPIO;
1616 break;
1617 case BT_CTRL_WAKEUP_METHOD_DSR:
1618 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
1619 break;
1620 case BT_CTRL_WAKEUP_METHOD_BREAK:
1621 default:
1622 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
1623 break;
1624 }
1625 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
1626 goto free_skb;
1627 }
1628 break;
1629 case HCI_NXP_SET_OPER_SPEED:
1630 if (hdr->plen == sizeof(baudrate_parm)) {
1631 memcpy(&baudrate_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1632 nxpdev->new_baudrate = __le32_to_cpu(baudrate_parm);
1633 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1634 goto free_skb;
1635 }
1636 break;
1637 case HCI_NXP_IND_RESET:
1638 if (hdr->plen == 1) {
1639 hci_cmd_sync_queue(hdev, nxp_set_ind_reset, NULL, NULL);
1640 goto free_skb;
1641 }
1642 break;
1643 default:
1644 break;
1645 }
1646 }
1647
1648 return btnxpuart_queue_skb(hdev, skb);
1649
1650 free_skb:
1651 kfree_skb(skb);
1652 return 0;
1653 }
1654
nxp_dequeue(void * data)1655 static struct sk_buff *nxp_dequeue(void *data)
1656 {
1657 struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data;
1658
1659 ps_start_timer(nxpdev);
1660 return skb_dequeue(&nxpdev->txq);
1661 }
1662
1663 /* btnxpuart based on serdev */
btnxpuart_tx_work(struct work_struct * work)1664 static void btnxpuart_tx_work(struct work_struct *work)
1665 {
1666 struct btnxpuart_dev *nxpdev = container_of(work, struct btnxpuart_dev,
1667 tx_work);
1668 struct serdev_device *serdev = nxpdev->serdev;
1669 struct hci_dev *hdev = nxpdev->hdev;
1670 struct sk_buff *skb;
1671 int len;
1672
1673 if (ps_wakeup(nxpdev))
1674 return;
1675
1676 while ((skb = nxp_dequeue(nxpdev))) {
1677 len = serdev_device_write_buf(serdev, skb->data, skb->len);
1678 hdev->stat.byte_tx += len;
1679
1680 skb_pull(skb, len);
1681 if (skb->len > 0) {
1682 skb_queue_head(&nxpdev->txq, skb);
1683 continue;
1684 }
1685
1686 switch (hci_skb_pkt_type(skb)) {
1687 case HCI_COMMAND_PKT:
1688 hdev->stat.cmd_tx++;
1689 break;
1690 case HCI_ACLDATA_PKT:
1691 hdev->stat.acl_tx++;
1692 break;
1693 case HCI_SCODATA_PKT:
1694 hdev->stat.sco_tx++;
1695 break;
1696 }
1697
1698 kfree_skb(skb);
1699 }
1700 clear_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
1701 }
1702
btnxpuart_open(struct hci_dev * hdev)1703 static int btnxpuart_open(struct hci_dev *hdev)
1704 {
1705 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1706 int err = 0;
1707
1708 err = serdev_device_open(nxpdev->serdev);
1709 if (err) {
1710 bt_dev_err(hdev, "Unable to open UART device %s",
1711 dev_name(&nxpdev->serdev->dev));
1712 } else {
1713 set_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1714 }
1715 return err;
1716 }
1717
btnxpuart_close(struct hci_dev * hdev)1718 static int btnxpuart_close(struct hci_dev *hdev)
1719 {
1720 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1721
1722 serdev_device_close(nxpdev->serdev);
1723 skb_queue_purge(&nxpdev->txq);
1724 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1725 kfree_skb(nxpdev->rx_skb);
1726 nxpdev->rx_skb = NULL;
1727 }
1728 clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1729 return 0;
1730 }
1731
btnxpuart_flush(struct hci_dev * hdev)1732 static int btnxpuart_flush(struct hci_dev *hdev)
1733 {
1734 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1735
1736 /* Flush any pending characters */
1737 serdev_device_write_flush(nxpdev->serdev);
1738 skb_queue_purge(&nxpdev->txq);
1739
1740 cancel_work_sync(&nxpdev->tx_work);
1741
1742 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1743 kfree_skb(nxpdev->rx_skb);
1744 nxpdev->rx_skb = NULL;
1745 }
1746
1747 return 0;
1748 }
1749
1750 static const struct h4_recv_pkt nxp_recv_pkts[] = {
1751 { H4_RECV_ACL, .recv = nxp_recv_acl_pkt },
1752 { H4_RECV_SCO, .recv = hci_recv_frame },
1753 { H4_RECV_EVENT, .recv = hci_recv_frame },
1754 { H4_RECV_ISO, .recv = hci_recv_frame },
1755 { NXP_RECV_CHIP_VER_V1, .recv = nxp_recv_chip_ver_v1 },
1756 { NXP_RECV_FW_REQ_V1, .recv = nxp_recv_fw_req_v1 },
1757 { NXP_RECV_CHIP_VER_V3, .recv = nxp_recv_chip_ver_v3 },
1758 { NXP_RECV_FW_REQ_V3, .recv = nxp_recv_fw_req_v3 },
1759 };
1760
btnxpuart_receive_buf(struct serdev_device * serdev,const u8 * data,size_t count)1761 static size_t btnxpuart_receive_buf(struct serdev_device *serdev,
1762 const u8 *data, size_t count)
1763 {
1764 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1765
1766 ps_start_timer(nxpdev);
1767
1768 nxpdev->rx_skb = h4_recv_buf(&nxpdev->hu, nxpdev->rx_skb, data, count,
1769 nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
1770 if (IS_ERR(nxpdev->rx_skb)) {
1771 int err = PTR_ERR(nxpdev->rx_skb);
1772 /* Safe to ignore out-of-sync bootloader signatures */
1773 if (!is_fw_downloading(nxpdev) &&
1774 !ind_reset_in_progress(nxpdev))
1775 bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
1776 return count;
1777 }
1778 if (!is_fw_downloading(nxpdev) &&
1779 !ind_reset_in_progress(nxpdev))
1780 nxpdev->hdev->stat.byte_rx += count;
1781 return count;
1782 }
1783
btnxpuart_write_wakeup(struct serdev_device * serdev)1784 static void btnxpuart_write_wakeup(struct serdev_device *serdev)
1785 {
1786 serdev_device_write_wakeup(serdev);
1787 }
1788
1789 static const struct serdev_device_ops btnxpuart_client_ops = {
1790 .receive_buf = btnxpuart_receive_buf,
1791 .write_wakeup = btnxpuart_write_wakeup,
1792 };
1793
nxp_coredump_notify(struct hci_dev * hdev,int state)1794 static void nxp_coredump_notify(struct hci_dev *hdev, int state)
1795 {
1796 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1797 struct serdev_device *serdev = nxpdev->serdev;
1798 char device_string[30];
1799 char event_string[50];
1800 char *envp[] = {device_string, event_string, NULL};
1801
1802 snprintf(device_string, 30, "BTNXPUART_DEV=%s", dev_name(&serdev->dev));
1803 switch (state) {
1804 case HCI_DEVCOREDUMP_ACTIVE:
1805 snprintf(event_string, 50, "BTNXPUART_STATE=FW_DUMP_ACTIVE");
1806 break;
1807 case HCI_DEVCOREDUMP_DONE:
1808 snprintf(event_string, 50, "BTNXPUART_STATE=FW_DUMP_DONE");
1809 break;
1810 case HCI_DEVCOREDUMP_TIMEOUT:
1811 snprintf(event_string, 50, "BTNXPUART_STATE=FW_DUMP_TIMEOUT");
1812 break;
1813 default:
1814 snprintf(event_string, 50, "BTNXPUART_STATE=FW_DUMP_STATE_%d",
1815 state);
1816 break;
1817 }
1818 bt_dev_dbg(hdev, "==== Send uevent: %s:%s ===", device_string,
1819 event_string);
1820 kobject_uevent_env(&serdev->dev.kobj, KOBJ_CHANGE, envp);
1821 }
1822
1823 /*
1824 * Check if the remote M.2 connector device linked via OF graph is present
1825 * and available. This is used to determine whether the pwrseq path should
1826 * be taken. When the remote connector node is disabled (e.g., by a DT
1827 * overlay switching from PCIe WiFi to SDIO WiFi), the pwrseq path is
1828 * skipped, allowing the BT driver to use a direct bluetooth child node
1829 * instead.
1830 */
nxp_m2_connector_is_available(struct device * dev)1831 static bool nxp_m2_connector_is_available(struct device *dev)
1832 {
1833 struct device_node *ep __free(device_node) =
1834 of_graph_get_next_endpoint(dev_of_node(dev), NULL);
1835
1836 if (!ep)
1837 return false;
1838
1839 struct device_node *remote __free(device_node) =
1840 of_graph_get_remote_port_parent(ep);
1841
1842 return remote && of_device_is_available(remote);
1843 }
1844
nxp_serdev_probe(struct serdev_device * serdev)1845 static int nxp_serdev_probe(struct serdev_device *serdev)
1846 {
1847 struct hci_dev *hdev;
1848 struct btnxpuart_dev *nxpdev;
1849 bdaddr_t ba = {0};
1850 int err;
1851
1852 nxpdev = devm_kzalloc(&serdev->dev, sizeof(*nxpdev), GFP_KERNEL);
1853 if (!nxpdev)
1854 return -ENOMEM;
1855
1856 nxpdev->nxp_data = (struct btnxpuart_data *)device_get_match_data(&serdev->dev);
1857
1858 nxpdev->serdev = serdev;
1859 serdev_device_set_drvdata(serdev, nxpdev);
1860
1861 serdev_device_set_client_ops(serdev, &btnxpuart_client_ops);
1862
1863 INIT_WORK(&nxpdev->tx_work, btnxpuart_tx_work);
1864 skb_queue_head_init(&nxpdev->txq);
1865
1866 init_waitqueue_head(&nxpdev->fw_dnld_done_wait_q);
1867 init_waitqueue_head(&nxpdev->check_boot_sign_wait_q);
1868
1869 device_property_read_u32(&nxpdev->serdev->dev, "fw-init-baudrate",
1870 &nxpdev->fw_init_baudrate);
1871 if (!nxpdev->fw_init_baudrate)
1872 nxpdev->fw_init_baudrate = FW_INIT_BAUDRATE;
1873
1874 device_property_read_u32(&nxpdev->serdev->dev, "max-speed",
1875 &nxpdev->secondary_baudrate);
1876 if (!nxpdev->secondary_baudrate ||
1877 (nxpdev->secondary_baudrate != HCI_NXP_SEC_BAUDRATE_3M &&
1878 nxpdev->secondary_baudrate != HCI_NXP_SEC_BAUDRATE_4M)) {
1879 if (nxpdev->secondary_baudrate)
1880 dev_err(&serdev->dev,
1881 "Invalid max-speed. Using default 3000000.");
1882 nxpdev->secondary_baudrate = HCI_NXP_SEC_BAUDRATE_3M;
1883 }
1884
1885 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1886
1887 crc8_populate_msb(crc8_table, POLYNOMIAL8);
1888
1889 nxpdev->pdn = devm_reset_control_get_optional_shared(&serdev->dev, NULL);
1890 if (IS_ERR(nxpdev->pdn))
1891 return PTR_ERR(nxpdev->pdn);
1892
1893 err = devm_regulator_get_enable(&serdev->dev, "vcc");
1894 if (err) {
1895 dev_err(&serdev->dev, "Failed to enable vcc regulator\n");
1896 return err;
1897 }
1898
1899 if (nxp_m2_connector_is_available(&serdev->ctrl->dev)) {
1900 struct pwrseq_desc *pwrseq;
1901
1902 pwrseq = pwrseq_get(&serdev->ctrl->dev, "uart");
1903 if (IS_ERR(pwrseq))
1904 return dev_err_probe(&serdev->dev, PTR_ERR(pwrseq),
1905 "failed to get pwrseq\n");
1906
1907 nxpdev->pwrseq = pwrseq;
1908 err = pwrseq_enable(pwrseq);
1909 if (err)
1910 goto err_pwrseq_put;
1911 }
1912
1913 /* Initialize and register HCI device */
1914 hdev = hci_alloc_dev();
1915 if (!hdev) {
1916 dev_err(&serdev->dev, "Can't allocate HCI device\n");
1917 err = -ENOMEM;
1918 goto err_pwrseq_put;
1919 }
1920
1921 reset_control_deassert(nxpdev->pdn);
1922
1923 nxpdev->hdev = hdev;
1924 nxpdev->hu.hdev = hdev;
1925
1926 hdev->bus = HCI_UART;
1927 hci_set_drvdata(hdev, nxpdev);
1928
1929 hdev->manufacturer = MANUFACTURER_NXP;
1930 hdev->open = btnxpuart_open;
1931 hdev->close = btnxpuart_close;
1932 hdev->flush = btnxpuart_flush;
1933 hdev->setup = nxp_setup;
1934 hdev->post_init = nxp_post_init;
1935 hdev->send = nxp_enqueue;
1936 hdev->hw_error = nxp_hw_err;
1937 hdev->shutdown = nxp_shutdown;
1938 hdev->wakeup = nxp_wakeup;
1939 hdev->reset = nxp_reset;
1940 hdev->set_bdaddr = nxp_set_bdaddr;
1941 SET_HCIDEV_DEV(hdev, &serdev->dev);
1942
1943 device_property_read_u8_array(&nxpdev->serdev->dev,
1944 "local-bd-address",
1945 (u8 *)&ba, sizeof(ba));
1946 if (bacmp(&ba, BDADDR_ANY))
1947 hci_set_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY);
1948
1949 err = hci_register_dev(hdev);
1950 if (err < 0) {
1951 dev_err(&serdev->dev, "Can't register HCI device\n");
1952 goto probe_fail;
1953 }
1954
1955 if (ps_setup(hdev)) {
1956 err = -ENODEV;
1957 goto probe_fail_unregister;
1958 }
1959
1960 hci_devcd_register(hdev, nxp_coredump, nxp_coredump_hdr,
1961 nxp_coredump_notify);
1962
1963 return 0;
1964
1965 probe_fail_unregister:
1966 hci_unregister_dev(hdev);
1967 probe_fail:
1968 reset_control_assert(nxpdev->pdn);
1969 hci_free_dev(hdev);
1970 err_pwrseq_put:
1971 if (nxpdev->pwrseq)
1972 pwrseq_put(nxpdev->pwrseq);
1973 return err;
1974 }
1975
nxp_serdev_remove(struct serdev_device * serdev)1976 static void nxp_serdev_remove(struct serdev_device *serdev)
1977 {
1978 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1979 struct hci_dev *hdev = nxpdev->hdev;
1980
1981 if (is_fw_downloading(nxpdev)) {
1982 set_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state);
1983 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1984 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
1985 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1986 } else {
1987 /* Restore FW baudrate to fw_init_baudrate if changed.
1988 * This will ensure FW baudrate is in sync with
1989 * driver baudrate in case this driver is re-inserted.
1990 */
1991 if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
1992 nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
1993 nxp_set_baudrate_cmd(hdev, NULL);
1994 }
1995 }
1996
1997 ps_cleanup(nxpdev);
1998 hci_unregister_dev(hdev);
1999 reset_control_assert(nxpdev->pdn);
2000 if (nxpdev->pwrseq)
2001 pwrseq_put(nxpdev->pwrseq);
2002 hci_free_dev(hdev);
2003 }
2004
nxp_serdev_suspend(struct device * dev)2005 static int __maybe_unused nxp_serdev_suspend(struct device *dev)
2006 {
2007 struct btnxpuart_dev *nxpdev = dev_get_drvdata(dev);
2008 struct ps_data *psdata = &nxpdev->psdata;
2009
2010 ps_control(psdata->hdev, PS_STATE_SLEEP);
2011
2012 if (psdata->wakeup_source) {
2013 enable_irq_wake(psdata->irq_handler);
2014 enable_irq(psdata->irq_handler);
2015 }
2016 return 0;
2017 }
2018
nxp_serdev_resume(struct device * dev)2019 static int __maybe_unused nxp_serdev_resume(struct device *dev)
2020 {
2021 struct btnxpuart_dev *nxpdev = dev_get_drvdata(dev);
2022 struct ps_data *psdata = &nxpdev->psdata;
2023
2024 if (psdata->wakeup_source) {
2025 disable_irq(psdata->irq_handler);
2026 disable_irq_wake(psdata->irq_handler);
2027 }
2028
2029 ps_control(psdata->hdev, PS_STATE_AWAKE);
2030 return 0;
2031 }
2032
2033 #ifdef CONFIG_DEV_COREDUMP
nxp_serdev_coredump(struct device * dev)2034 static void nxp_serdev_coredump(struct device *dev)
2035 {
2036 struct btnxpuart_dev *nxpdev = dev_get_drvdata(dev);
2037 struct hci_dev *hdev = nxpdev->hdev;
2038
2039 if (hdev->dump.coredump)
2040 hdev->dump.coredump(hdev);
2041 }
2042 #endif
2043
2044 static struct btnxpuart_data w8987_data __maybe_unused = {
2045 .helper_fw_name = NULL,
2046 .fw_name = FIRMWARE_W8987,
2047 .fw_name_old = FIRMWARE_W8987_OLD,
2048 };
2049
2050 static struct btnxpuart_data w8997_data __maybe_unused = {
2051 .helper_fw_name = FIRMWARE_HELPER,
2052 .fw_name = FIRMWARE_W8997,
2053 .fw_name_old = FIRMWARE_W8997_OLD,
2054 };
2055
2056 static const struct of_device_id nxpuart_of_match_table[] __maybe_unused = {
2057 { .compatible = "nxp,88w8987-bt", .data = &w8987_data },
2058 { .compatible = "nxp,88w8997-bt", .data = &w8997_data },
2059 { }
2060 };
2061 MODULE_DEVICE_TABLE(of, nxpuart_of_match_table);
2062
2063 static const struct dev_pm_ops nxp_pm_ops = {
2064 SET_SYSTEM_SLEEP_PM_OPS(nxp_serdev_suspend, nxp_serdev_resume)
2065 };
2066
2067 static struct serdev_device_driver nxp_serdev_driver = {
2068 .probe = nxp_serdev_probe,
2069 .remove = nxp_serdev_remove,
2070 .driver = {
2071 .name = "btnxpuart",
2072 .of_match_table = of_match_ptr(nxpuart_of_match_table),
2073 .pm = &nxp_pm_ops,
2074 #ifdef CONFIG_DEV_COREDUMP
2075 .coredump = nxp_serdev_coredump,
2076 #endif
2077 },
2078 };
2079
2080 module_serdev_device_driver(nxp_serdev_driver);
2081
2082 MODULE_AUTHOR("Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>");
2083 MODULE_DESCRIPTION("NXP Bluetooth Serial driver");
2084 MODULE_LICENSE("GPL");
2085