1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel PCIe devices 5 * 6 * Copyright (C) 2024 Intel Corporation 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/module.h> 11 #include <linux/firmware.h> 12 #include <linux/overflow.h> 13 #include <linux/pci.h> 14 #include <linux/string.h> 15 #include <linux/wait.h> 16 #include <linux/delay.h> 17 #include <linux/interrupt.h> 18 #include <linux/acpi.h> 19 20 #include <linux/unaligned.h> 21 #include <linux/devcoredump.h> 22 23 #include <net/bluetooth/bluetooth.h> 24 #include <net/bluetooth/hci_core.h> 25 #include <net/bluetooth/hci_drv.h> 26 27 #include "btintel.h" 28 #include "btintel_pcie.h" 29 30 #define VERSION "0.1" 31 32 #define BTINTEL_PCI_DEVICE(dev, subdev) \ 33 .vendor = PCI_VENDOR_ID_INTEL, \ 34 .device = (dev), \ 35 .subvendor = PCI_ANY_ID, \ 36 .subdevice = (subdev), \ 37 .driver_data = 0 38 39 #define POLL_INTERVAL_US 10 40 41 #define BTINTEL_PCIE_DMA_ALIGN_128B 128 /* 128 byte aligned */ 42 43 /* Intel Bluetooth PCIe device id table */ 44 static const struct pci_device_id btintel_pcie_table[] = { 45 /* BlazarI, Wildcat Lake */ 46 { BTINTEL_PCI_DEVICE(0x4D76, PCI_ANY_ID) }, 47 /* BlazarI, Lunar Lake */ 48 { BTINTEL_PCI_DEVICE(0xA876, PCI_ANY_ID) }, 49 /* Scorpious, Panther Lake-H484 */ 50 { BTINTEL_PCI_DEVICE(0xE376, PCI_ANY_ID) }, 51 /* Scorpious, Panther Lake-H404 */ 52 { BTINTEL_PCI_DEVICE(0xE476, PCI_ANY_ID) }, 53 /* Scorpious2, Nova Lake-PCD-H */ 54 { BTINTEL_PCI_DEVICE(0xD346, PCI_ANY_ID) }, 55 /* Scorpious2, Nova Lake-PCD-S */ 56 { BTINTEL_PCI_DEVICE(0x6E74, PCI_ANY_ID) }, 57 { 0 } 58 }; 59 MODULE_DEVICE_TABLE(pci, btintel_pcie_table); 60 61 struct btintel_pcie_dev_recovery { 62 struct list_head list; 63 u8 count; 64 time64_t last_error; 65 char name[]; 66 }; 67 68 /* Intel PCIe uses 4 bytes of HCI type instead of 1 byte BT SIG HCI type */ 69 #define BTINTEL_PCIE_HCI_TYPE_LEN 4 70 #define BTINTEL_PCIE_HCI_CMD_PKT 0x00000001 71 #define BTINTEL_PCIE_HCI_ACL_PKT 0x00000002 72 #define BTINTEL_PCIE_HCI_SCO_PKT 0x00000003 73 #define BTINTEL_PCIE_HCI_EVT_PKT 0x00000004 74 #define BTINTEL_PCIE_HCI_ISO_PKT 0x00000005 75 76 #define BTINTEL_PCIE_MAGIC_NUM 0xA5A5A5A5 77 78 #define BTINTEL_PCIE_BLZR_HWEXP_SIZE 1024 79 #define BTINTEL_PCIE_BLZR_HWEXP_DMP_ADDR 0xB00A7C00 80 81 #define BTINTEL_PCIE_SCP_HWEXP_SIZE 4096 82 #define BTINTEL_PCIE_SCP_HWEXP_DMP_ADDR 0xB030F800 83 84 #define BTINTEL_PCIE_SCP2_HWEXP_SIZE 4096 85 #define BTINTEL_PCIE_SCP2_HWEXP_DMP_ADDR 0xB031D000 86 87 #define BTINTEL_PCIE_MAGIC_NUM 0xA5A5A5A5 88 89 #define BTINTEL_PCIE_TRIGGER_REASON_USER_TRIGGER 0x17A2 90 #define BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT 0x1E61 91 92 #define BTINTEL_PCIE_RESET_WINDOW_SECS 5 93 #define BTINTEL_PCIE_FLR_MAX_RETRY 1 94 95 /* Alive interrupt context */ 96 enum { 97 BTINTEL_PCIE_ROM, 98 BTINTEL_PCIE_FW_DL, 99 BTINTEL_PCIE_HCI_RESET, 100 BTINTEL_PCIE_INTEL_HCI_RESET1, 101 BTINTEL_PCIE_INTEL_HCI_RESET2, 102 BTINTEL_PCIE_D0, 103 BTINTEL_PCIE_D3 104 }; 105 106 enum { 107 BTINTEL_PCIE_DSM_SET_RESET_TIMING = 1, 108 BTINTEL_PCIE_DSM_GET_RESET_TIMING = 2, 109 BTINTEL_PCIE_DSM_BT_PLDR_CONFIG = 3, 110 BTINTEL_PCIE_DSM_GET_RESET_TYPE = 4, 111 BTINTEL_PCIE_DSM_DYNAMIC_PLDR = 5, 112 BTINTEL_PCIE_DSM_GET_RESET_METHOD = 6, 113 BTINTEL_PCIE_DSM_SET_PLDR_DELAY = 7, 114 }; 115 116 enum btintel_dsm_internal_product_reset_mode { 117 BTINTEL_PCIE_DSM_PLDR_MODE_EN_PROD_RESET = BIT(0), 118 BTINTEL_PCIE_DSM_PLDR_MODE_EN_WIFI_FLR = BIT(1), 119 BTINTEL_PCIE_DSM_PLDR_MODE_EN_BT_OFF_ON = BIT(2), 120 }; 121 122 /* Structure for dbgc fragment buffer 123 * @buf_addr_lsb: LSB of the buffer's physical address 124 * @buf_addr_msb: MSB of the buffer's physical address 125 * @buf_size: Total size of the buffer 126 */ 127 struct btintel_pcie_dbgc_ctxt_buf { 128 u32 buf_addr_lsb; 129 u32 buf_addr_msb; 130 u32 buf_size; 131 }; 132 133 /* Structure for dbgc fragment 134 * @magic_num: 0XA5A5A5A5 135 * @ver: For Driver-FW compatibility 136 * @total_size: Total size of the payload debug info 137 * @num_buf: Num of allocated debug bufs 138 * @bufs: All buffer's addresses and sizes 139 */ 140 struct btintel_pcie_dbgc_ctxt { 141 u32 magic_num; 142 u32 ver; 143 u32 total_size; 144 u32 num_buf; 145 struct btintel_pcie_dbgc_ctxt_buf bufs[BTINTEL_PCIE_DBGC_BUFFER_COUNT]; 146 }; 147 148 struct btintel_pcie_trigger_evt { 149 u8 type; 150 u8 len; 151 __le32 addr; 152 __le32 size; 153 } __packed; 154 155 struct btintel_pcie_fwtrigger_evt { 156 __le32 reserved; 157 u8 type; /* Debug Trigger event */ 158 __le16 len; 159 u8 event_type; 160 __le16 event_id; 161 __le16 reserved2; 162 } __packed; 163 164 static LIST_HEAD(btintel_pcie_recovery_list); 165 static DEFINE_SPINLOCK(btintel_pcie_recovery_lock); 166 167 static inline char *btintel_pcie_alivectxt_state2str(u32 alive_intr_ctxt) 168 { 169 switch (alive_intr_ctxt) { 170 case BTINTEL_PCIE_ROM: 171 return "rom"; 172 case BTINTEL_PCIE_FW_DL: 173 return "fw_dl"; 174 case BTINTEL_PCIE_D0: 175 return "d0"; 176 case BTINTEL_PCIE_D3: 177 return "d3"; 178 case BTINTEL_PCIE_HCI_RESET: 179 return "hci_reset"; 180 case BTINTEL_PCIE_INTEL_HCI_RESET1: 181 return "intel_reset1"; 182 case BTINTEL_PCIE_INTEL_HCI_RESET2: 183 return "intel_reset2"; 184 default: 185 return "unknown"; 186 } 187 } 188 189 /* This function initializes the memory for DBGC buffers and formats the 190 * DBGC fragment which consists header info and DBGC buffer's LSB, MSB and 191 * size as the payload 192 */ 193 static int btintel_pcie_setup_dbgc(struct btintel_pcie_data *data) 194 { 195 struct btintel_pcie_dbgc_ctxt db_frag; 196 struct data_buf *buf; 197 int i; 198 199 data->dbgc.count = BTINTEL_PCIE_DBGC_BUFFER_COUNT; 200 data->dbgc.bufs = devm_kcalloc(&data->pdev->dev, data->dbgc.count, 201 sizeof(*buf), GFP_KERNEL); 202 if (!data->dbgc.bufs) 203 return -ENOMEM; 204 205 data->dbgc.buf_v_addr = dmam_alloc_coherent(&data->pdev->dev, 206 data->dbgc.count * 207 BTINTEL_PCIE_DBGC_BUFFER_SIZE, 208 &data->dbgc.buf_p_addr, 209 GFP_KERNEL | __GFP_NOWARN); 210 if (!data->dbgc.buf_v_addr) 211 return -ENOMEM; 212 213 data->dbgc.frag_v_addr = dmam_alloc_coherent(&data->pdev->dev, 214 sizeof(struct btintel_pcie_dbgc_ctxt), 215 &data->dbgc.frag_p_addr, 216 GFP_KERNEL | __GFP_NOWARN); 217 if (!data->dbgc.frag_v_addr) 218 return -ENOMEM; 219 220 data->dbgc.frag_size = sizeof(struct btintel_pcie_dbgc_ctxt); 221 222 db_frag.magic_num = BTINTEL_PCIE_MAGIC_NUM; 223 db_frag.ver = BTINTEL_PCIE_DBGC_FRAG_VERSION; 224 db_frag.total_size = BTINTEL_PCIE_DBGC_FRAG_PAYLOAD_SIZE; 225 db_frag.num_buf = BTINTEL_PCIE_DBGC_FRAG_BUFFER_COUNT; 226 227 for (i = 0; i < data->dbgc.count; i++) { 228 buf = &data->dbgc.bufs[i]; 229 buf->data_p_addr = data->dbgc.buf_p_addr + i * BTINTEL_PCIE_DBGC_BUFFER_SIZE; 230 buf->data = data->dbgc.buf_v_addr + i * BTINTEL_PCIE_DBGC_BUFFER_SIZE; 231 db_frag.bufs[i].buf_addr_lsb = lower_32_bits(buf->data_p_addr); 232 db_frag.bufs[i].buf_addr_msb = upper_32_bits(buf->data_p_addr); 233 db_frag.bufs[i].buf_size = BTINTEL_PCIE_DBGC_BUFFER_SIZE; 234 } 235 236 memcpy(data->dbgc.frag_v_addr, &db_frag, sizeof(db_frag)); 237 return 0; 238 } 239 240 static inline void ipc_print_ia_ring(struct hci_dev *hdev, struct ia *ia, 241 u16 queue_num) 242 { 243 bt_dev_dbg(hdev, "IA: %s: tr-h:%02u tr-t:%02u cr-h:%02u cr-t:%02u", 244 queue_num == BTINTEL_PCIE_TXQ_NUM ? "TXQ" : "RXQ", 245 ia->tr_hia[queue_num], ia->tr_tia[queue_num], 246 ia->cr_hia[queue_num], ia->cr_tia[queue_num]); 247 } 248 249 static inline void ipc_print_urbd1(struct hci_dev *hdev, struct urbd1 *urbd1, 250 u16 index) 251 { 252 bt_dev_dbg(hdev, "RXQ:urbd1(%u) frbd_tag:%u status: 0x%x fixed:0x%x", 253 index, urbd1->frbd_tag, urbd1->status, urbd1->fixed); 254 } 255 256 static struct btintel_pcie_data *btintel_pcie_get_data(struct msix_entry *entry) 257 { 258 u8 queue = entry->entry; 259 struct msix_entry *entries = entry - queue; 260 261 return container_of(entries, struct btintel_pcie_data, msix_entries[0]); 262 } 263 264 /* Set the doorbell for TXQ to notify the device that @index (actually index-1) 265 * of the TFD is updated and ready to transmit. 266 */ 267 static void btintel_pcie_set_tx_db(struct btintel_pcie_data *data, u16 index) 268 { 269 u32 val; 270 271 val = index; 272 val |= (BTINTEL_PCIE_TX_DB_VEC << 16); 273 274 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_HBUS_TARG_WRPTR, val); 275 } 276 277 /* Copy the data to next(@tfd_index) data buffer and update the TFD(transfer 278 * descriptor) with the data length and the DMA address of the data buffer. 279 */ 280 static void btintel_pcie_prepare_tx(struct txq *txq, u16 tfd_index, 281 struct sk_buff *skb) 282 { 283 struct data_buf *buf; 284 struct tfd *tfd; 285 286 tfd = &txq->tfds[tfd_index]; 287 memset(tfd, 0, sizeof(*tfd)); 288 289 buf = &txq->bufs[tfd_index]; 290 291 tfd->size = skb->len; 292 tfd->addr = buf->data_p_addr; 293 294 /* Copy the outgoing data to DMA buffer */ 295 memcpy(buf->data, skb->data, tfd->size); 296 } 297 298 static inline void btintel_pcie_dump_debug_registers(struct hci_dev *hdev) 299 { 300 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 301 u16 cr_hia, cr_tia; 302 u32 reg, mbox_reg; 303 struct sk_buff *skb; 304 u8 buf[80]; 305 306 skb = alloc_skb(1024, GFP_ATOMIC); 307 if (!skb) 308 return; 309 310 strscpy(buf, "---- Dump of debug registers ---"); 311 bt_dev_dbg(hdev, "%s", buf); 312 skb_put_data(skb, buf, strlen(buf)); 313 314 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_BOOT_STAGE_REG); 315 snprintf(buf, sizeof(buf), "boot stage: 0x%8.8x", reg); 316 bt_dev_dbg(hdev, "%s", buf); 317 skb_put_data(skb, buf, strlen(buf)); 318 data->boot_stage_cache = reg; 319 320 if (reg & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING) 321 bt_dev_warn(hdev, "Controller device warning (boot_stage: 0x%8.8x)", reg); 322 323 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_STATUS_REG); 324 snprintf(buf, sizeof(buf), "ipc status: 0x%8.8x", reg); 325 skb_put_data(skb, buf, strlen(buf)); 326 bt_dev_dbg(hdev, "%s", buf); 327 328 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_CONTROL_REG); 329 snprintf(buf, sizeof(buf), "ipc control: 0x%8.8x", reg); 330 skb_put_data(skb, buf, strlen(buf)); 331 bt_dev_dbg(hdev, "%s", buf); 332 333 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IPC_SLEEP_CTL_REG); 334 snprintf(buf, sizeof(buf), "ipc sleep control: 0x%8.8x", reg); 335 skb_put_data(skb, buf, strlen(buf)); 336 bt_dev_dbg(hdev, "%s", buf); 337 338 /*Read the Mail box status and registers*/ 339 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MBOX_STATUS_REG); 340 snprintf(buf, sizeof(buf), "mbox status: 0x%8.8x", reg); 341 skb_put_data(skb, buf, strlen(buf)); 342 if (reg & BTINTEL_PCIE_CSR_MBOX_STATUS_MBOX1) { 343 mbox_reg = btintel_pcie_rd_reg32(data, 344 BTINTEL_PCIE_CSR_MBOX_1_REG); 345 snprintf(buf, sizeof(buf), "mbox_1: 0x%8.8x", mbox_reg); 346 skb_put_data(skb, buf, strlen(buf)); 347 bt_dev_dbg(hdev, "%s", buf); 348 } 349 350 if (reg & BTINTEL_PCIE_CSR_MBOX_STATUS_MBOX2) { 351 mbox_reg = btintel_pcie_rd_reg32(data, 352 BTINTEL_PCIE_CSR_MBOX_2_REG); 353 snprintf(buf, sizeof(buf), "mbox_2: 0x%8.8x", mbox_reg); 354 skb_put_data(skb, buf, strlen(buf)); 355 bt_dev_dbg(hdev, "%s", buf); 356 } 357 358 if (reg & BTINTEL_PCIE_CSR_MBOX_STATUS_MBOX3) { 359 mbox_reg = btintel_pcie_rd_reg32(data, 360 BTINTEL_PCIE_CSR_MBOX_3_REG); 361 snprintf(buf, sizeof(buf), "mbox_3: 0x%8.8x", mbox_reg); 362 skb_put_data(skb, buf, strlen(buf)); 363 bt_dev_dbg(hdev, "%s", buf); 364 } 365 366 if (reg & BTINTEL_PCIE_CSR_MBOX_STATUS_MBOX4) { 367 mbox_reg = btintel_pcie_rd_reg32(data, 368 BTINTEL_PCIE_CSR_MBOX_4_REG); 369 snprintf(buf, sizeof(buf), "mbox_4: 0x%8.8x", mbox_reg); 370 skb_put_data(skb, buf, strlen(buf)); 371 bt_dev_dbg(hdev, "%s", buf); 372 } 373 374 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM]; 375 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM]; 376 snprintf(buf, sizeof(buf), "rxq: cr_tia: %u cr_hia: %u", cr_tia, cr_hia); 377 skb_put_data(skb, buf, strlen(buf)); 378 bt_dev_dbg(hdev, "%s", buf); 379 380 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM]; 381 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM]; 382 snprintf(buf, sizeof(buf), "txq: cr_tia: %u cr_hia: %u", cr_tia, cr_hia); 383 skb_put_data(skb, buf, strlen(buf)); 384 bt_dev_dbg(hdev, "%s", buf); 385 strscpy(buf, "--------------------------------"); 386 bt_dev_dbg(hdev, "%s", buf); 387 388 hci_recv_diag(hdev, skb); 389 } 390 391 static int btintel_pcie_send_sync(struct btintel_pcie_data *data, 392 struct sk_buff *skb, u32 pkt_type, u16 opcode) 393 { 394 int ret; 395 u16 tfd_index; 396 u32 old_ctxt; 397 bool wait_on_alive = false; 398 struct hci_dev *hdev = data->hdev; 399 400 struct txq *txq = &data->txq; 401 402 tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM]; 403 404 if (tfd_index > txq->count) 405 return -ERANGE; 406 407 /* Firmware raises alive interrupt on HCI_OP_RESET or 408 * BTINTEL_HCI_OP_RESET 409 */ 410 wait_on_alive = (pkt_type == BTINTEL_PCIE_HCI_CMD_PKT && 411 (opcode == BTINTEL_HCI_OP_RESET || opcode == HCI_OP_RESET)); 412 413 if (wait_on_alive) { 414 data->gp0_received = false; 415 old_ctxt = data->alive_intr_ctxt; 416 data->alive_intr_ctxt = 417 (opcode == BTINTEL_HCI_OP_RESET ? BTINTEL_PCIE_INTEL_HCI_RESET1 : 418 BTINTEL_PCIE_HCI_RESET); 419 bt_dev_dbg(data->hdev, "sending cmd: 0x%4.4x alive context changed: %s -> %s", 420 opcode, btintel_pcie_alivectxt_state2str(old_ctxt), 421 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt)); 422 } 423 424 memcpy(skb_push(skb, BTINTEL_PCIE_HCI_TYPE_LEN), &pkt_type, 425 BTINTEL_PCIE_HCI_TYPE_LEN); 426 427 /* Prepare for TX. It updates the TFD with the length of data and 428 * address of the DMA buffer, and copy the data to the DMA buffer 429 */ 430 btintel_pcie_prepare_tx(txq, tfd_index, skb); 431 432 tfd_index = (tfd_index + 1) % txq->count; 433 data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM] = tfd_index; 434 435 /* Arm wait event condition */ 436 data->tx_wait_done = false; 437 438 /* Set the doorbell to notify the device */ 439 btintel_pcie_set_tx_db(data, tfd_index); 440 441 /* Wait for the complete interrupt - URBD0 */ 442 ret = wait_event_timeout(data->tx_wait_q, data->tx_wait_done, 443 msecs_to_jiffies(BTINTEL_PCIE_TX_WAIT_TIMEOUT_MS)); 444 if (!ret) { 445 bt_dev_err(data->hdev, "Timeout (%u ms) on tx completion", 446 BTINTEL_PCIE_TX_WAIT_TIMEOUT_MS); 447 btintel_pcie_dump_debug_registers(data->hdev); 448 return -ETIME; 449 } 450 451 if (wait_on_alive) { 452 ret = wait_event_timeout(data->gp0_wait_q, 453 data->gp0_received, 454 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS)); 455 if (!ret) { 456 hdev->stat.err_tx++; 457 bt_dev_err(hdev, "Timeout (%u ms) on alive interrupt, alive context: %s", 458 BTINTEL_DEFAULT_INTR_TIMEOUT_MS, 459 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt)); 460 return -ETIME; 461 } 462 } 463 return 0; 464 } 465 466 /* Set the doorbell for RXQ to notify the device that @index (actually index-1) 467 * is available to receive the data 468 */ 469 static void btintel_pcie_set_rx_db(struct btintel_pcie_data *data, u16 index) 470 { 471 u32 val; 472 473 val = index; 474 val |= (BTINTEL_PCIE_RX_DB_VEC << 16); 475 476 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_HBUS_TARG_WRPTR, val); 477 } 478 479 /* Update the FRBD (free buffer descriptor) with the @frbd_index and the 480 * DMA address of the free buffer. 481 */ 482 static void btintel_pcie_prepare_rx(struct rxq *rxq, u16 frbd_index) 483 { 484 struct data_buf *buf; 485 struct frbd *frbd; 486 487 /* Get the buffer of the FRBD for DMA */ 488 buf = &rxq->bufs[frbd_index]; 489 490 frbd = &rxq->frbds[frbd_index]; 491 memset(frbd, 0, sizeof(*frbd)); 492 493 /* Update FRBD */ 494 frbd->tag = frbd_index; 495 frbd->addr = buf->data_p_addr; 496 } 497 498 static int btintel_pcie_submit_rx(struct btintel_pcie_data *data) 499 { 500 u16 frbd_index; 501 struct rxq *rxq = &data->rxq; 502 503 frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM]; 504 505 if (frbd_index > rxq->count) 506 return -ERANGE; 507 508 /* Prepare for RX submit. It updates the FRBD with the address of DMA 509 * buffer 510 */ 511 btintel_pcie_prepare_rx(rxq, frbd_index); 512 513 frbd_index = (frbd_index + 1) % rxq->count; 514 data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM] = frbd_index; 515 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_RXQ_NUM); 516 517 /* Set the doorbell to notify the device */ 518 btintel_pcie_set_rx_db(data, frbd_index); 519 520 return 0; 521 } 522 523 static int btintel_pcie_start_rx(struct btintel_pcie_data *data) 524 { 525 int i, ret; 526 struct rxq *rxq = &data->rxq; 527 528 /* Post (BTINTEL_PCIE_RX_DESCS_COUNT - 3) buffers to overcome the 529 * hardware issues leading to race condition at the firmware. 530 */ 531 532 for (i = 0; i < rxq->count - 3; i++) { 533 ret = btintel_pcie_submit_rx(data); 534 if (ret) 535 return ret; 536 } 537 538 return 0; 539 } 540 541 static void btintel_pcie_reset_ia(struct btintel_pcie_data *data) 542 { 543 memset(data->ia.tr_hia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES); 544 memset(data->ia.tr_tia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES); 545 memset(data->ia.cr_hia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES); 546 memset(data->ia.cr_tia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES); 547 } 548 549 static int btintel_pcie_reset_bt(struct btintel_pcie_data *data) 550 { 551 u32 reg; 552 int retry = 3; 553 554 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 555 556 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA | 557 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT | 558 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT); 559 reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON; 560 561 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 562 563 do { 564 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 565 if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_STS) 566 break; 567 usleep_range(10000, 12000); 568 569 } while (--retry > 0); 570 usleep_range(10000, 12000); 571 572 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 573 574 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA | 575 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT | 576 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT); 577 reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET; 578 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 579 usleep_range(10000, 12000); 580 581 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 582 bt_dev_dbg(data->hdev, "csr register after reset: 0x%8.8x", reg); 583 584 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_BOOT_STAGE_REG); 585 586 /* If shared hardware reset is success then boot stage register shall be 587 * set to 0 588 */ 589 return reg == 0 ? 0 : -ENODEV; 590 } 591 592 static void btintel_pcie_mac_init(struct btintel_pcie_data *data) 593 { 594 u32 reg; 595 596 /* Set MAC_INIT bit to start primary bootloader */ 597 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 598 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT | 599 BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON | 600 BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET); 601 reg |= (BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA | 602 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT); 603 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 604 } 605 606 static int btintel_pcie_get_mac_access(struct btintel_pcie_data *data) 607 { 608 u32 reg; 609 int retry = 15; 610 611 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 612 613 if (!(reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ)) { 614 reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ; 615 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 616 } 617 618 do { 619 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 620 if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_STS) 621 return 0; 622 /* Need delay here for Target Access harwdware to settle down*/ 623 usleep_range(1000, 1200); 624 625 } while (--retry > 0); 626 627 return -ETIME; 628 } 629 630 static void btintel_pcie_release_mac_access(struct btintel_pcie_data *data) 631 { 632 u32 reg; 633 634 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 635 636 if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ) { 637 reg &= ~BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_ACCESS_REQ; 638 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 639 } 640 } 641 642 static void *btintel_pcie_copy_tlv(void *dest, enum btintel_pcie_tlv_type type, 643 void *data, size_t size) 644 { 645 struct intel_tlv *tlv; 646 647 tlv = dest; 648 tlv->type = type; 649 tlv->len = size; 650 memcpy(tlv->val, data, tlv->len); 651 return dest + sizeof(*tlv) + size; 652 } 653 654 static int btintel_pcie_read_dram_buffers(struct btintel_pcie_data *data) 655 { 656 u32 offset, prev_size, wr_ptr_status, dump_size, data_len; 657 u32 status_reg, wrap_reg; 658 struct btintel_pcie_dbgc *dbgc = &data->dbgc; 659 struct hci_dev *hdev = data->hdev; 660 u8 *pdata, *p, buf_idx, hw_variant; 661 struct intel_tlv *tlv; 662 struct timespec64 now; 663 struct tm tm_now; 664 char fw_build[128]; 665 char ts[128]; 666 char vendor[64]; 667 char driver[64]; 668 669 if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) 670 return -EOPNOTSUPP; 671 672 673 hw_variant = INTEL_HW_VARIANT(data->cnvi); 674 switch (hw_variant) { 675 case BTINTEL_HWID_BZRI: 676 case BTINTEL_HWID_BZRIW: 677 status_reg = BTINTEL_PCIE_DBGC_CUR_DBGBUFF_STATUS; 678 wrap_reg = BTINTEL_PCIE_DBGC_DBGBUFF_WRAP_ARND; 679 break; 680 case BTINTEL_HWID_SCP: 681 case BTINTEL_HWID_SCP2: 682 case BTINTEL_HWID_SCP2F: 683 status_reg = BTINTEL_PCIE_DBGC_CUR_DBGBUFF_STATUS_SCP; 684 wrap_reg = BTINTEL_PCIE_DBGC_DBGBUFF_WRAP_ARND_SCP; 685 break; 686 default: 687 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%2.2x)", 688 hw_variant); 689 return -EINVAL; 690 } 691 692 wr_ptr_status = btintel_pcie_rd_dev_mem(data, status_reg); 693 data->dmp_hdr.wrap_ctr = btintel_pcie_rd_dev_mem(data, wrap_reg); 694 695 offset = wr_ptr_status & BTINTEL_PCIE_DBG_OFFSET_BIT_MASK; 696 697 buf_idx = BTINTEL_PCIE_DBGC_DBG_BUF_IDX(wr_ptr_status); 698 if (buf_idx > dbgc->count) { 699 bt_dev_warn(hdev, "Buffer index is invalid"); 700 return -EINVAL; 701 } 702 703 prev_size = buf_idx * BTINTEL_PCIE_DBGC_BUFFER_SIZE; 704 if (prev_size + offset >= prev_size) 705 data->dmp_hdr.write_ptr = prev_size + offset; 706 else 707 return -EINVAL; 708 709 strscpy(vendor, "Vendor: Intel\n"); 710 snprintf(driver, sizeof(driver), "Driver: %s\n", 711 data->dmp_hdr.driver_name); 712 713 ktime_get_real_ts64(&now); 714 time64_to_tm(now.tv_sec, 0, &tm_now); 715 snprintf(ts, sizeof(ts), "Dump Time: %02d-%02d-%04ld %02d:%02d:%02d", 716 tm_now.tm_mday, tm_now.tm_mon + 1, tm_now.tm_year + 1900, 717 tm_now.tm_hour, tm_now.tm_min, tm_now.tm_sec); 718 719 snprintf(fw_build, sizeof(fw_build), 720 "Firmware Timestamp: Year %u WW %02u buildtype %u build %u", 721 2000 + (data->dmp_hdr.fw_timestamp >> 8), 722 data->dmp_hdr.fw_timestamp & 0xff, data->dmp_hdr.fw_build_type, 723 data->dmp_hdr.fw_build_num); 724 725 data_len = sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_bt) + 726 sizeof(*tlv) + sizeof(data->dmp_hdr.write_ptr) + 727 sizeof(*tlv) + sizeof(data->dmp_hdr.wrap_ctr) + 728 sizeof(*tlv) + sizeof(data->dmp_hdr.trigger_reason) + 729 sizeof(*tlv) + sizeof(data->dmp_hdr.fw_git_sha1) + 730 sizeof(*tlv) + sizeof(data->dmp_hdr.cnvr_top) + 731 sizeof(*tlv) + sizeof(data->dmp_hdr.cnvi_top) + 732 sizeof(*tlv) + strlen(ts) + 733 sizeof(*tlv) + strlen(fw_build) + 734 sizeof(*tlv) + strlen(vendor) + 735 sizeof(*tlv) + strlen(driver); 736 737 if (data->dmp_hdr.event_type && data->dmp_hdr.event_id) { 738 data_len += sizeof(*tlv) + sizeof(data->dmp_hdr.event_type); 739 data_len += sizeof(*tlv) + sizeof(data->dmp_hdr.event_id); 740 } 741 742 /* 743 * sizeof(u32) - signature 744 * sizeof(data_len) - to store tlv data size 745 * data_len - TLV data 746 */ 747 dump_size = sizeof(u32) + sizeof(data_len) + data_len; 748 749 750 /* Add debug buffers data length to dump size */ 751 dump_size += BTINTEL_PCIE_DBGC_BUFFER_SIZE * dbgc->count; 752 753 pdata = vmalloc(dump_size); 754 if (!pdata) 755 return -ENOMEM; 756 p = pdata; 757 758 *(u32 *)p = BTINTEL_PCIE_MAGIC_NUM; 759 p += sizeof(u32); 760 761 *(u32 *)p = data_len; 762 p += sizeof(u32); 763 764 765 p = btintel_pcie_copy_tlv(p, BTINTEL_VENDOR, vendor, strlen(vendor)); 766 p = btintel_pcie_copy_tlv(p, BTINTEL_DRIVER, driver, strlen(driver)); 767 p = btintel_pcie_copy_tlv(p, BTINTEL_DUMP_TIME, ts, strlen(ts)); 768 p = btintel_pcie_copy_tlv(p, BTINTEL_FW_BUILD, fw_build, 769 strlen(fw_build)); 770 p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_BT, &data->dmp_hdr.cnvi_bt, 771 sizeof(data->dmp_hdr.cnvi_bt)); 772 p = btintel_pcie_copy_tlv(p, BTINTEL_WRITE_PTR, &data->dmp_hdr.write_ptr, 773 sizeof(data->dmp_hdr.write_ptr)); 774 p = btintel_pcie_copy_tlv(p, BTINTEL_WRAP_CTR, &data->dmp_hdr.wrap_ctr, 775 sizeof(data->dmp_hdr.wrap_ctr)); 776 p = btintel_pcie_copy_tlv(p, BTINTEL_TRIGGER_REASON, &data->dmp_hdr.trigger_reason, 777 sizeof(data->dmp_hdr.trigger_reason)); 778 p = btintel_pcie_copy_tlv(p, BTINTEL_FW_SHA, &data->dmp_hdr.fw_git_sha1, 779 sizeof(data->dmp_hdr.fw_git_sha1)); 780 p = btintel_pcie_copy_tlv(p, BTINTEL_CNVR_TOP, &data->dmp_hdr.cnvr_top, 781 sizeof(data->dmp_hdr.cnvr_top)); 782 p = btintel_pcie_copy_tlv(p, BTINTEL_CNVI_TOP, &data->dmp_hdr.cnvi_top, 783 sizeof(data->dmp_hdr.cnvi_top)); 784 785 if (data->dmp_hdr.event_type && data->dmp_hdr.event_id) { 786 p = btintel_pcie_copy_tlv(p, BTINTEL_EVENT_TYPE, 787 &data->dmp_hdr.event_type, 788 sizeof(data->dmp_hdr.event_type)); 789 p = btintel_pcie_copy_tlv(p, BTINTEL_EVENT_ID, 790 &data->dmp_hdr.event_id, 791 sizeof(data->dmp_hdr.event_id)); 792 data->dmp_hdr.event_type = 0; 793 data->dmp_hdr.event_id = 0; 794 } 795 796 memcpy(p, dbgc->bufs[0].data, dbgc->count * BTINTEL_PCIE_DBGC_BUFFER_SIZE); 797 dev_coredumpv(&hdev->dev, pdata, dump_size, GFP_KERNEL); 798 return 0; 799 } 800 801 static void btintel_pcie_dump_traces(struct hci_dev *hdev) 802 { 803 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 804 int ret = 0; 805 806 ret = btintel_pcie_get_mac_access(data); 807 if (ret) { 808 bt_dev_err(hdev, "Failed to get mac access: (%d)", ret); 809 return; 810 } 811 812 ret = btintel_pcie_read_dram_buffers(data); 813 814 btintel_pcie_release_mac_access(data); 815 816 if (ret) 817 bt_dev_err(hdev, "Failed to dump traces: (%d)", ret); 818 } 819 820 static bool btintel_pcie_is_blazariw(struct pci_dev *pdev) 821 { 822 return pdev->device == 0x4D76; 823 } 824 825 /* This function enables BT function by setting BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT bit in 826 * BTINTEL_PCIE_CSR_FUNC_CTRL_REG register and wait for MSI-X with 827 * BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0. 828 * Then the host reads firmware version from BTINTEL_CSR_F2D_MBX and the boot stage 829 * from BTINTEL_PCIE_CSR_BOOT_STAGE_REG. 830 */ 831 static int btintel_pcie_enable_bt(struct btintel_pcie_data *data) 832 { 833 int err; 834 u32 reg; 835 836 data->gp0_received = false; 837 838 /* Update the DMA address of CI struct to CSR */ 839 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_CI_ADDR_LSB_REG, 840 data->ci_p_addr & 0xffffffff); 841 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_CI_ADDR_MSB_REG, 842 (u64)data->ci_p_addr >> 32); 843 844 /* On BlazarIW, the D0 entry to MAC init does not complete in 845 * time. Wait 50 ms (worst case as per HW analysis) for the 846 * shared hardware reset flow to complete before proceeding with 847 * MAC init. 848 */ 849 if (btintel_pcie_is_blazariw(data->pdev)) 850 msleep(50); 851 852 /* Reset the cached value of boot stage. it is updated by the MSI-X 853 * gp0 interrupt handler. 854 */ 855 data->boot_stage_cache = 0x0; 856 857 /* Set MAC_INIT bit to start primary bootloader */ 858 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 859 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT | 860 BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON | 861 BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET); 862 reg |= (BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA | 863 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT); 864 865 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg); 866 867 /* MAC is ready. Enable BT FUNC */ 868 btintel_pcie_set_reg_bits(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, 869 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT); 870 871 btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG); 872 873 /* wait for interrupt from the device after booting up to primary 874 * bootloader. 875 */ 876 data->alive_intr_ctxt = BTINTEL_PCIE_ROM; 877 err = wait_event_timeout(data->gp0_wait_q, data->gp0_received, 878 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS)); 879 if (!err) 880 return -ETIME; 881 882 /* Check cached boot stage is BTINTEL_PCIE_CSR_BOOT_STAGE_ROM(BIT(0)) */ 883 if (~data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ROM) 884 return -ENODEV; 885 886 return 0; 887 } 888 889 static inline bool btintel_pcie_in_op(struct btintel_pcie_data *data) 890 { 891 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW; 892 } 893 894 static inline bool btintel_pcie_in_iml(struct btintel_pcie_data *data) 895 { 896 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_IML && 897 !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW); 898 } 899 900 static inline bool btintel_pcie_in_d3(struct btintel_pcie_data *data) 901 { 902 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY; 903 } 904 905 static inline bool btintel_pcie_in_d0(struct btintel_pcie_data *data) 906 { 907 return !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY); 908 } 909 910 static inline bool btintel_pcie_in_device_halt(struct btintel_pcie_data *data) 911 { 912 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_HALTED; 913 } 914 915 static void btintel_pcie_wr_sleep_cntrl(struct btintel_pcie_data *data, 916 u32 dxstate) 917 { 918 bt_dev_dbg(data->hdev, "writing sleep_ctl_reg: 0x%8.8x", dxstate); 919 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_IPC_SLEEP_CTL_REG, dxstate); 920 } 921 922 static int btintel_pcie_read_device_mem(struct btintel_pcie_data *data, 923 void *buf, u32 dev_addr, int len) 924 { 925 int err; 926 u32 *val = buf; 927 928 /* Get device mac access */ 929 err = btintel_pcie_get_mac_access(data); 930 if (err) { 931 bt_dev_err(data->hdev, "Failed to get mac access %d", err); 932 return err; 933 } 934 935 for (; len > 0; len -= 4, dev_addr += 4, val++) 936 *val = btintel_pcie_rd_dev_mem(data, dev_addr); 937 938 btintel_pcie_release_mac_access(data); 939 940 return 0; 941 } 942 943 static inline bool btintel_pcie_in_lockdown(struct btintel_pcie_data *data) 944 { 945 return (data->boot_stage_cache & 946 BTINTEL_PCIE_CSR_BOOT_STAGE_ROM_LOCKDOWN) || 947 (data->boot_stage_cache & 948 BTINTEL_PCIE_CSR_BOOT_STAGE_IML_LOCKDOWN); 949 } 950 951 static inline bool btintel_pcie_in_error(struct btintel_pcie_data *data) 952 { 953 if (data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_DEVICE_WARNING) 954 bt_dev_warn(data->hdev, "Controller device warning (boot_stage: 0x%8.8x)", 955 data->boot_stage_cache); 956 957 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ABORT_HANDLER; 958 } 959 960 static void btintel_pcie_msix_gp1_handler(struct btintel_pcie_data *data) 961 { 962 bt_dev_err(data->hdev, "Received gp1 mailbox interrupt"); 963 btintel_pcie_dump_debug_registers(data->hdev); 964 } 965 966 /* This function handles the MSI-X interrupt for gp0 cause (bit 0 in 967 * BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES) which is sent for boot stage and image response. 968 */ 969 static void btintel_pcie_msix_gp0_handler(struct btintel_pcie_data *data) 970 { 971 bool submit_rx, signal_waitq; 972 u32 reg, old_ctxt; 973 974 /* This interrupt is for three different causes and it is not easy to 975 * know what causes the interrupt. So, it compares each register value 976 * with cached value and update it before it wake up the queue. 977 */ 978 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_BOOT_STAGE_REG); 979 if (reg != data->boot_stage_cache) 980 data->boot_stage_cache = reg; 981 982 bt_dev_dbg(data->hdev, "Alive context: %s old_boot_stage: 0x%8.8x new_boot_stage: 0x%8.8x", 983 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt), 984 data->boot_stage_cache, reg); 985 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IMG_RESPONSE_REG); 986 if (reg != data->img_resp_cache) 987 data->img_resp_cache = reg; 988 989 if (btintel_pcie_in_error(data)) { 990 bt_dev_err(data->hdev, "Controller in error state (boot_stage: 0x%8.8x)", 991 data->boot_stage_cache); 992 btintel_pcie_dump_debug_registers(data->hdev); 993 return; 994 } 995 996 if (btintel_pcie_in_lockdown(data)) { 997 bt_dev_err(data->hdev, "Controller in lockdown state"); 998 btintel_pcie_dump_debug_registers(data->hdev); 999 return; 1000 } 1001 1002 data->gp0_received = true; 1003 1004 old_ctxt = data->alive_intr_ctxt; 1005 submit_rx = false; 1006 signal_waitq = false; 1007 1008 switch (data->alive_intr_ctxt) { 1009 case BTINTEL_PCIE_ROM: 1010 data->alive_intr_ctxt = BTINTEL_PCIE_FW_DL; 1011 signal_waitq = true; 1012 break; 1013 case BTINTEL_PCIE_FW_DL: 1014 /* Error case is already handled. Ideally control shall not 1015 * reach here 1016 */ 1017 break; 1018 case BTINTEL_PCIE_INTEL_HCI_RESET1: 1019 if (btintel_pcie_in_op(data)) { 1020 submit_rx = true; 1021 signal_waitq = true; 1022 break; 1023 } 1024 1025 if (btintel_pcie_in_iml(data)) { 1026 submit_rx = true; 1027 signal_waitq = true; 1028 data->alive_intr_ctxt = BTINTEL_PCIE_FW_DL; 1029 break; 1030 } 1031 break; 1032 case BTINTEL_PCIE_INTEL_HCI_RESET2: 1033 if (btintel_test_and_clear_flag(data->hdev, INTEL_WAIT_FOR_D0)) { 1034 btintel_wake_up_flag(data->hdev, INTEL_WAIT_FOR_D0); 1035 data->alive_intr_ctxt = BTINTEL_PCIE_D0; 1036 } 1037 break; 1038 case BTINTEL_PCIE_D0: 1039 if (btintel_pcie_in_d3(data)) { 1040 data->alive_intr_ctxt = BTINTEL_PCIE_D3; 1041 signal_waitq = true; 1042 break; 1043 } 1044 break; 1045 case BTINTEL_PCIE_D3: 1046 if (btintel_pcie_in_d0(data)) { 1047 data->alive_intr_ctxt = BTINTEL_PCIE_D0; 1048 submit_rx = true; 1049 signal_waitq = true; 1050 break; 1051 } 1052 break; 1053 case BTINTEL_PCIE_HCI_RESET: 1054 data->alive_intr_ctxt = BTINTEL_PCIE_D0; 1055 submit_rx = true; 1056 signal_waitq = true; 1057 break; 1058 default: 1059 bt_dev_err(data->hdev, "Unknown state: 0x%2.2x", 1060 data->alive_intr_ctxt); 1061 break; 1062 } 1063 1064 if (submit_rx) { 1065 btintel_pcie_reset_ia(data); 1066 btintel_pcie_start_rx(data); 1067 } 1068 1069 if (signal_waitq) { 1070 bt_dev_dbg(data->hdev, "wake up gp0 wait_q"); 1071 wake_up(&data->gp0_wait_q); 1072 } 1073 1074 if (old_ctxt != data->alive_intr_ctxt) 1075 bt_dev_dbg(data->hdev, "alive context changed: %s -> %s", 1076 btintel_pcie_alivectxt_state2str(old_ctxt), 1077 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt)); 1078 } 1079 1080 /* This function handles the MSX-X interrupt for rx queue 0 which is for TX 1081 */ 1082 static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data) 1083 { 1084 u16 cr_tia, cr_hia; 1085 struct txq *txq; 1086 struct urbd0 *urbd0; 1087 1088 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM]; 1089 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM]; 1090 1091 if (cr_tia == cr_hia) 1092 return; 1093 1094 txq = &data->txq; 1095 1096 while (cr_tia != cr_hia) { 1097 data->tx_wait_done = true; 1098 wake_up(&data->tx_wait_q); 1099 1100 urbd0 = &txq->urbd0s[cr_tia]; 1101 1102 if (urbd0->tfd_index >= txq->count) 1103 return; 1104 1105 cr_tia = (cr_tia + 1) % txq->count; 1106 data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] = cr_tia; 1107 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_TXQ_NUM); 1108 } 1109 } 1110 1111 static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 1112 { 1113 struct hci_event_hdr *hdr = (void *)skb->data; 1114 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 1115 1116 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 1117 hdr->plen > 0) { 1118 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 1119 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 1120 1121 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 1122 switch (skb->data[2]) { 1123 case 0x02: 1124 /* When switching to the operational firmware 1125 * the device sends a vendor specific event 1126 * indicating that the bootup completed. 1127 */ 1128 btintel_bootup(hdev, ptr, len); 1129 1130 /* If bootup event is from operational image, 1131 * driver needs to write sleep control register to 1132 * move into D0 state 1133 */ 1134 if (btintel_pcie_in_op(data)) { 1135 btintel_pcie_wr_sleep_cntrl(data, BTINTEL_PCIE_STATE_D0); 1136 data->alive_intr_ctxt = BTINTEL_PCIE_INTEL_HCI_RESET2; 1137 kfree_skb(skb); 1138 return 0; 1139 } 1140 1141 if (btintel_pcie_in_iml(data)) { 1142 /* In case of IML, there is no concept 1143 * of D0 transition. Just mimic as if 1144 * IML moved to D0 by clearing INTEL_WAIT_FOR_D0 1145 * bit and waking up the task waiting on 1146 * INTEL_WAIT_FOR_D0. This is required 1147 * as intel_boot() is common function for 1148 * both IML and OP image loading. 1149 */ 1150 if (btintel_test_and_clear_flag(data->hdev, 1151 INTEL_WAIT_FOR_D0)) 1152 btintel_wake_up_flag(data->hdev, 1153 INTEL_WAIT_FOR_D0); 1154 } 1155 kfree_skb(skb); 1156 return 0; 1157 case 0x06: 1158 /* When the firmware loading completes the 1159 * device sends out a vendor specific event 1160 * indicating the result of the firmware 1161 * loading. 1162 */ 1163 btintel_secure_send_result(hdev, ptr, len); 1164 kfree_skb(skb); 1165 return 0; 1166 } 1167 } 1168 1169 /* This is a debug event that comes from IML and OP image when it 1170 * starts execution. There is no need pass this event to stack. 1171 */ 1172 if (skb->data[2] == 0x97) { 1173 hci_recv_diag(hdev, skb); 1174 return 0; 1175 } 1176 } 1177 1178 return hci_recv_frame(hdev, skb); 1179 } 1180 /* Process the received rx data 1181 * It check the frame header to identify the data type and create skb 1182 * and calling HCI API 1183 */ 1184 static int btintel_pcie_recv_frame(struct btintel_pcie_data *data, 1185 struct sk_buff *skb) 1186 { 1187 int ret; 1188 u8 pkt_type; 1189 u16 plen; 1190 u32 pcie_pkt_type; 1191 void *pdata; 1192 struct hci_dev *hdev = data->hdev; 1193 1194 spin_lock(&data->hci_rx_lock); 1195 1196 /* The first 4 bytes indicates the Intel PCIe specific packet type */ 1197 pdata = skb_pull_data(skb, BTINTEL_PCIE_HCI_TYPE_LEN); 1198 if (!pdata) { 1199 bt_dev_err(hdev, "Corrupted packet received"); 1200 ret = -EILSEQ; 1201 goto exit_error; 1202 } 1203 1204 pcie_pkt_type = get_unaligned_le32(pdata); 1205 1206 switch (pcie_pkt_type) { 1207 case BTINTEL_PCIE_HCI_ACL_PKT: 1208 if (skb->len >= HCI_ACL_HDR_SIZE) { 1209 plen = HCI_ACL_HDR_SIZE + __le16_to_cpu(hci_acl_hdr(skb)->dlen); 1210 pkt_type = HCI_ACLDATA_PKT; 1211 } else { 1212 bt_dev_err(hdev, "ACL packet is too short"); 1213 ret = -EILSEQ; 1214 goto exit_error; 1215 } 1216 break; 1217 1218 case BTINTEL_PCIE_HCI_SCO_PKT: 1219 if (skb->len >= HCI_SCO_HDR_SIZE) { 1220 plen = HCI_SCO_HDR_SIZE + hci_sco_hdr(skb)->dlen; 1221 pkt_type = HCI_SCODATA_PKT; 1222 } else { 1223 bt_dev_err(hdev, "SCO packet is too short"); 1224 ret = -EILSEQ; 1225 goto exit_error; 1226 } 1227 break; 1228 1229 case BTINTEL_PCIE_HCI_EVT_PKT: 1230 if (skb->len >= HCI_EVENT_HDR_SIZE) { 1231 plen = HCI_EVENT_HDR_SIZE + hci_event_hdr(skb)->plen; 1232 pkt_type = HCI_EVENT_PKT; 1233 } else { 1234 bt_dev_err(hdev, "Event packet is too short"); 1235 ret = -EILSEQ; 1236 goto exit_error; 1237 } 1238 break; 1239 1240 case BTINTEL_PCIE_HCI_ISO_PKT: 1241 if (skb->len >= HCI_ISO_HDR_SIZE) { 1242 plen = HCI_ISO_HDR_SIZE + __le16_to_cpu(hci_iso_hdr(skb)->dlen); 1243 pkt_type = HCI_ISODATA_PKT; 1244 } else { 1245 bt_dev_err(hdev, "ISO packet is too short"); 1246 ret = -EILSEQ; 1247 goto exit_error; 1248 } 1249 break; 1250 1251 default: 1252 bt_dev_err(hdev, "Invalid packet type received: 0x%4.4x", 1253 pcie_pkt_type); 1254 ret = -EINVAL; 1255 goto exit_error; 1256 } 1257 1258 if (skb->len < plen) { 1259 bt_dev_err(hdev, "Received corrupted packet. type: 0x%2.2x", 1260 pkt_type); 1261 ret = -EILSEQ; 1262 goto exit_error; 1263 } 1264 1265 bt_dev_dbg(hdev, "pkt_type: 0x%2.2x len: %u", pkt_type, plen); 1266 1267 hci_skb_pkt_type(skb) = pkt_type; 1268 hdev->stat.byte_rx += plen; 1269 skb_trim(skb, plen); 1270 1271 if (pcie_pkt_type == BTINTEL_PCIE_HCI_EVT_PKT) 1272 ret = btintel_pcie_recv_event(hdev, skb); 1273 else 1274 ret = hci_recv_frame(hdev, skb); 1275 skb = NULL; /* skb is freed in the callee */ 1276 1277 exit_error: 1278 kfree_skb(skb); 1279 1280 if (ret) 1281 hdev->stat.err_rx++; 1282 1283 spin_unlock(&data->hci_rx_lock); 1284 1285 return ret; 1286 } 1287 1288 static void btintel_pcie_read_hwexp(struct btintel_pcie_data *data) 1289 { 1290 int len, err, offset, pending; 1291 struct sk_buff *skb; 1292 u8 *buf, prefix[64]; 1293 u32 addr, val; 1294 u16 pkt_len; 1295 1296 struct tlv { 1297 u8 type; 1298 __le16 len; 1299 u8 val[]; 1300 } __packed; 1301 1302 struct tlv *tlv; 1303 1304 switch (data->dmp_hdr.cnvi_top & 0xfff) { 1305 case BTINTEL_CNVI_BLAZARI: 1306 case BTINTEL_CNVI_BLAZARIW: 1307 /* only from step B0 onwards */ 1308 if (INTEL_CNVX_TOP_STEP(data->dmp_hdr.cnvi_top) != 0x01) 1309 return; 1310 len = BTINTEL_PCIE_BLZR_HWEXP_SIZE; /* exception data length */ 1311 addr = BTINTEL_PCIE_BLZR_HWEXP_DMP_ADDR; 1312 break; 1313 case BTINTEL_CNVI_SCP: 1314 len = BTINTEL_PCIE_SCP_HWEXP_SIZE; 1315 addr = BTINTEL_PCIE_SCP_HWEXP_DMP_ADDR; 1316 break; 1317 case BTINTEL_CNVI_SCP2: 1318 case BTINTEL_CNVI_SCP2F: 1319 len = BTINTEL_PCIE_SCP2_HWEXP_SIZE; 1320 addr = BTINTEL_PCIE_SCP2_HWEXP_DMP_ADDR; 1321 break; 1322 default: 1323 bt_dev_err(data->hdev, "Unsupported cnvi 0x%8.8x", data->dmp_hdr.cnvi_top); 1324 return; 1325 } 1326 1327 buf = kzalloc(len, GFP_KERNEL); 1328 if (!buf) 1329 goto exit_on_error; 1330 1331 btintel_pcie_mac_init(data); 1332 1333 err = btintel_pcie_read_device_mem(data, buf, addr, len); 1334 if (err) 1335 goto exit_on_error; 1336 1337 val = get_unaligned_le32(buf); 1338 if (val != BTINTEL_PCIE_MAGIC_NUM) { 1339 bt_dev_err(data->hdev, "Invalid exception dump signature: 0x%8.8x", 1340 val); 1341 goto exit_on_error; 1342 } 1343 1344 snprintf(prefix, sizeof(prefix), "Bluetooth: %s: ", bt_dev_name(data->hdev)); 1345 1346 offset = 4; 1347 do { 1348 pending = len - offset; 1349 if (pending < sizeof(*tlv)) 1350 break; 1351 tlv = (struct tlv *)(buf + offset); 1352 1353 /* If type == 0, then there are no more TLVs to be parsed */ 1354 if (!tlv->type) { 1355 bt_dev_dbg(data->hdev, "Invalid TLV type 0"); 1356 break; 1357 } 1358 pkt_len = le16_to_cpu(tlv->len); 1359 offset += sizeof(*tlv); 1360 pending = len - offset; 1361 if (pkt_len > pending) 1362 break; 1363 1364 offset += pkt_len; 1365 1366 /* Only TLVs of type == 1 are HCI events, no need to process other 1367 * TLVs 1368 */ 1369 if (tlv->type != 1) 1370 continue; 1371 1372 bt_dev_dbg(data->hdev, "TLV packet length: %u", pkt_len); 1373 if (pkt_len > HCI_MAX_EVENT_SIZE) 1374 break; 1375 skb = bt_skb_alloc(pkt_len, GFP_KERNEL); 1376 if (!skb) 1377 goto exit_on_error; 1378 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 1379 skb_put_data(skb, tlv->val, pkt_len); 1380 1381 /* copy Intel specific pcie packet type */ 1382 val = BTINTEL_PCIE_HCI_EVT_PKT; 1383 memcpy(skb_push(skb, BTINTEL_PCIE_HCI_TYPE_LEN), &val, 1384 BTINTEL_PCIE_HCI_TYPE_LEN); 1385 1386 print_hex_dump(KERN_DEBUG, prefix, DUMP_PREFIX_OFFSET, 16, 1, 1387 tlv->val, pkt_len, false); 1388 1389 btintel_pcie_recv_frame(data, skb); 1390 } while (offset < len); 1391 1392 exit_on_error: 1393 kfree(buf); 1394 } 1395 1396 static int btintel_pcie_dump_fwtrigger_event(struct btintel_pcie_data *data) 1397 { 1398 struct btintel_pcie_fwtrigger_evt *evt; 1399 struct sk_buff *skb; 1400 unsigned int len; 1401 int err; 1402 u8 *buf; 1403 1404 if (!data->debug_evt_size || !data->debug_evt_addr) 1405 return -EINVAL; 1406 1407 len = data->debug_evt_size; 1408 1409 len = ALIGN_DOWN(len, 4); 1410 1411 if (len < sizeof(*evt) || len > HCI_MAX_EVENT_SIZE) { 1412 bt_dev_err(data->hdev, "Invalid FW trigger data size (%u bytes)", len); 1413 return -EINVAL; 1414 } 1415 1416 buf = kzalloc(len, GFP_KERNEL); 1417 if (!buf) 1418 return -ENOMEM; 1419 1420 btintel_pcie_mac_init(data); 1421 1422 err = btintel_pcie_read_device_mem(data, buf, data->debug_evt_addr, 1423 len); 1424 if (err) 1425 goto exit_on_error; 1426 1427 evt = (void *)buf; 1428 data->dmp_hdr.event_type = evt->event_type; 1429 data->dmp_hdr.event_id = le16_to_cpu(evt->event_id); 1430 1431 bt_dev_dbg(data->hdev, "event type: 0x%2.2x event id: 0x%4.4x len: %u", 1432 data->dmp_hdr.event_type, data->dmp_hdr.event_id, len); 1433 1434 skb = bt_skb_alloc(len, GFP_KERNEL); 1435 if (!skb) { 1436 err = -ENOMEM; 1437 goto exit_on_error; 1438 } 1439 skb_put_data(skb, buf, len); 1440 1441 hci_recv_diag(data->hdev, skb); 1442 err = 0; 1443 1444 exit_on_error: 1445 kfree(buf); 1446 return err; 1447 } 1448 1449 /* Queue a coredump dump_traces() pass. 1450 * 1451 * Returns true if a new coredump was queued, false if one was already 1452 * in-flight (the BTINTEL_PCIE_COREDUMP_INPROGRESS bit serves as the 1453 * single-writer guard for the @coredump_work item) or the workqueue is 1454 * disabled (reset / remove in progress). 1455 * 1456 * Always queue this AFTER any companion event-reader work (hwexp / 1457 * fwtrigger) so that, on the ordered @dump_workqueue, the event reader 1458 * runs first and populates dmp_hdr.event_type / event_id before 1459 * dump_traces consumes them. 1460 */ 1461 static bool btintel_pcie_queue_coredump(struct btintel_pcie_data *data, 1462 u16 trigger_reason) 1463 { 1464 if (test_and_set_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags)) 1465 return false; 1466 1467 data->dmp_hdr.trigger_reason = trigger_reason; 1468 1469 if (queue_work(data->dump_workqueue, &data->coredump_work)) 1470 return true; 1471 1472 /* Workqueue is disabled (reset/remove drained it). Release the 1473 * guard so a later trigger, after re-probe, can succeed. 1474 */ 1475 clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags); 1476 return false; 1477 } 1478 1479 static void btintel_pcie_msix_fw_trigger_handler(struct btintel_pcie_data *data) 1480 { 1481 bt_dev_dbg(data->hdev, "Received firmware smart trigger cause"); 1482 1483 /* Per-work guard: deduplicate concurrent FW-trigger interrupts. 1484 * Cleared at the tail of btintel_pcie_fwtrigger_worker(). 1485 */ 1486 if (test_and_set_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, 1487 &data->flags)) 1488 return; 1489 1490 if (!queue_work(data->dump_workqueue, &data->fwtrigger_work)) { 1491 clear_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags); 1492 return; 1493 } 1494 1495 /* Queue coredump after the fwtrigger event reader so dmp_hdr.event_* 1496 * is populated before dump_traces consumes it. 1497 */ 1498 btintel_pcie_queue_coredump(data, BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT); 1499 } 1500 1501 static void btintel_pcie_msix_hw_exp_handler(struct btintel_pcie_data *data) 1502 { 1503 bt_dev_err(data->hdev, "Received hw exception interrupt"); 1504 1505 /* CORE_HALTED is the single-writer guard for this handler. It is 1506 * set once on first HW exception and cleared only by re-probe 1507 * (data is reallocated), so it also serializes hwexp_work 1508 * scheduling without needing a separate bit. 1509 */ 1510 if (test_and_set_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags)) 1511 return; 1512 1513 /* Queue companion coredump first so it is appended after hwexp_work 1514 * on the ordered @dump_workqueue (preserves the original 1515 * coredump-then-hwexp ordering). 1516 */ 1517 btintel_pcie_queue_coredump(data, BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT); 1518 1519 queue_work(data->dump_workqueue, &data->hwexp_work); 1520 } 1521 1522 static void btintel_pcie_coredump_worker(struct work_struct *work) 1523 { 1524 struct btintel_pcie_data *data = container_of(work, 1525 struct btintel_pcie_data, coredump_work); 1526 1527 /* hdev is NULL until setup_hdev() succeeds, and is cleared on 1528 * teardown after disable_work_sync() drains us; bail in that case. 1529 */ 1530 if (!data->hdev) 1531 goto out; 1532 1533 btintel_pcie_dump_traces(data->hdev); 1534 out: 1535 /* Release guard last so a new trigger can run only after this 1536 * pass has fully completed (including dev_coredumpv()). 1537 */ 1538 clear_bit(BTINTEL_PCIE_COREDUMP_INPROGRESS, &data->flags); 1539 } 1540 1541 static void btintel_pcie_hwexp_worker(struct work_struct *work) 1542 { 1543 struct btintel_pcie_data *data = container_of(work, 1544 struct btintel_pcie_data, hwexp_work); 1545 1546 if (!data->hdev) 1547 return; 1548 1549 /* Unlike usb products, controller will not send hardware exception 1550 * event on exception. Instead controller writes the hardware event 1551 * to device memory along with optional debug events, raises MSIX 1552 * and halts. Driver shall read the exception event from device 1553 * memory and passes it to the stack for further processing. 1554 * 1555 * Re-entry is gated by BTINTEL_PCIE_CORE_HALTED in the IRQ 1556 * handler, which is only cleared by re-probe; no per-work bit 1557 * is needed here. 1558 */ 1559 btintel_pcie_read_hwexp(data); 1560 } 1561 1562 static void btintel_pcie_fwtrigger_worker(struct work_struct *work) 1563 { 1564 struct btintel_pcie_data *data = container_of(work, 1565 struct btintel_pcie_data, fwtrigger_work); 1566 int err; 1567 1568 if (!data->hdev) 1569 goto out; 1570 1571 err = btintel_pcie_dump_fwtrigger_event(data); 1572 if (err) 1573 bt_dev_warn(data->hdev, "failed to log fwtrigger event"); 1574 out: 1575 /* Release guard last; matches set in fw_trigger handler. */ 1576 clear_bit(BTINTEL_PCIE_FWTRIGGER_DUMP_INPROGRESS, &data->flags); 1577 } 1578 1579 static void btintel_pcie_rx_work(struct work_struct *work) 1580 { 1581 struct btintel_pcie_data *data = container_of(work, 1582 struct btintel_pcie_data, rx_work); 1583 struct sk_buff *skb; 1584 1585 /* Process the sk_buf in queue and send to the HCI layer */ 1586 while ((skb = skb_dequeue(&data->rx_skb_q))) { 1587 btintel_pcie_recv_frame(data, skb); 1588 } 1589 } 1590 1591 /* create sk_buff with data and save it to queue and start RX work */ 1592 static int btintel_pcie_submit_rx_work(struct btintel_pcie_data *data, u8 status, 1593 void *buf) 1594 { 1595 int ret, len; 1596 struct rfh_hdr *rfh_hdr; 1597 struct sk_buff *skb; 1598 1599 rfh_hdr = buf; 1600 1601 len = rfh_hdr->packet_len; 1602 if (len == 0 || len > BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr)) { 1603 bt_dev_err(data->hdev, "Invalid packet_len %d (max %zu)", len, 1604 BTINTEL_PCIE_BUFFER_SIZE - sizeof(*rfh_hdr)); 1605 ret = -EINVAL; 1606 goto resubmit; 1607 } 1608 1609 /* Remove RFH header */ 1610 buf += sizeof(*rfh_hdr); 1611 1612 skb = alloc_skb(len, GFP_ATOMIC); 1613 if (!skb) 1614 goto resubmit; 1615 1616 skb_put_data(skb, buf, len); 1617 skb_queue_tail(&data->rx_skb_q, skb); 1618 queue_work(data->workqueue, &data->rx_work); 1619 1620 resubmit: 1621 ret = btintel_pcie_submit_rx(data); 1622 1623 return ret; 1624 } 1625 1626 /* Handles the MSI-X interrupt for rx queue 1 which is for RX */ 1627 static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data *data) 1628 { 1629 u16 cr_hia, cr_tia; 1630 struct rxq *rxq; 1631 struct urbd1 *urbd1; 1632 struct data_buf *buf; 1633 int ret; 1634 struct hci_dev *hdev = data->hdev; 1635 1636 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM]; 1637 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM]; 1638 1639 bt_dev_dbg(hdev, "RXQ: cr_hia: %u cr_tia: %u", cr_hia, cr_tia); 1640 1641 /* Check CR_TIA and CR_HIA for change */ 1642 if (cr_tia == cr_hia) 1643 return; 1644 1645 rxq = &data->rxq; 1646 1647 /* The firmware sends multiple CD in a single MSI-X and it needs to 1648 * process all received CDs in this interrupt. 1649 */ 1650 while (cr_tia != cr_hia) { 1651 urbd1 = &rxq->urbd1s[cr_tia]; 1652 ipc_print_urbd1(data->hdev, urbd1, cr_tia); 1653 1654 buf = &rxq->bufs[urbd1->frbd_tag]; 1655 if (!buf) { 1656 bt_dev_err(hdev, "RXQ: failed to get the DMA buffer for %d", 1657 urbd1->frbd_tag); 1658 return; 1659 } 1660 1661 ret = btintel_pcie_submit_rx_work(data, urbd1->status, 1662 buf->data); 1663 if (ret) { 1664 bt_dev_err(hdev, "RXQ: failed to submit rx request"); 1665 return; 1666 } 1667 1668 cr_tia = (cr_tia + 1) % rxq->count; 1669 data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM] = cr_tia; 1670 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_RXQ_NUM); 1671 } 1672 } 1673 1674 static inline bool btintel_pcie_is_rxq_empty(struct btintel_pcie_data *data) 1675 { 1676 return data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM] == data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM]; 1677 } 1678 1679 static inline bool btintel_pcie_is_txackq_empty(struct btintel_pcie_data *data) 1680 { 1681 return data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] == data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM]; 1682 } 1683 1684 static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id) 1685 { 1686 struct msix_entry *entry = dev_id; 1687 struct btintel_pcie_data *data = btintel_pcie_get_data(entry); 1688 u32 intr_fh, intr_hw; 1689 1690 spin_lock(&data->irq_lock); 1691 intr_fh = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_CAUSES); 1692 intr_hw = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES); 1693 1694 /* Clear causes registers to avoid being handling the same cause */ 1695 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_CAUSES, intr_fh); 1696 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES, intr_hw); 1697 spin_unlock(&data->irq_lock); 1698 1699 if (unlikely(!(intr_fh | intr_hw))) { 1700 /* Ignore interrupt, inta == 0 */ 1701 bt_warn_ratelimited("Bluetooth: btintel_pcie: Received spurious interrupt\n"); 1702 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_AUTOMASK_ST, 1703 BIT(entry->entry)); 1704 return IRQ_NONE; 1705 } 1706 1707 /* This interrupt is raised when there is an hardware exception */ 1708 if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HWEXP) 1709 btintel_pcie_msix_hw_exp_handler(data); 1710 1711 if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP1) 1712 btintel_pcie_msix_gp1_handler(data); 1713 1714 1715 /* For TX */ 1716 if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0) { 1717 btintel_pcie_msix_tx_handle(data); 1718 if (!btintel_pcie_is_rxq_empty(data)) 1719 btintel_pcie_msix_rx_handle(data); 1720 } 1721 1722 /* For RX */ 1723 if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1) { 1724 btintel_pcie_msix_rx_handle(data); 1725 if (!btintel_pcie_is_txackq_empty(data)) 1726 btintel_pcie_msix_tx_handle(data); 1727 } 1728 1729 if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_FWTRIG) 1730 btintel_pcie_msix_fw_trigger_handler(data); 1731 1732 /* This interrupt is triggered by the firmware after updating 1733 * boot_stage register and image_response register 1734 */ 1735 if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0) 1736 btintel_pcie_msix_gp0_handler(data); 1737 1738 /* 1739 * Before sending the interrupt the HW disables it to prevent a nested 1740 * interrupt. This is done by writing 1 to the corresponding bit in 1741 * the mask register. After handling the interrupt, it should be 1742 * re-enabled by clearing this bit. This register is defined as write 1 1743 * clear (W1C) register, meaning that it's cleared by writing 1 1744 * to the bit. 1745 */ 1746 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_AUTOMASK_ST, 1747 BIT(entry->entry)); 1748 1749 return IRQ_HANDLED; 1750 } 1751 1752 /* This function requests the irq for MSI-X and registers the handlers per irq. 1753 * Currently, it requests only 1 irq for all interrupt causes. 1754 */ 1755 static int btintel_pcie_setup_irq(struct btintel_pcie_data *data) 1756 { 1757 int err; 1758 int num_irqs, i; 1759 1760 for (i = 0; i < BTINTEL_PCIE_MSIX_VEC_MAX; i++) 1761 data->msix_entries[i].entry = i; 1762 1763 num_irqs = pci_alloc_irq_vectors(data->pdev, BTINTEL_PCIE_MSIX_VEC_MIN, 1764 BTINTEL_PCIE_MSIX_VEC_MAX, PCI_IRQ_MSIX); 1765 if (num_irqs < 0) 1766 return num_irqs; 1767 1768 data->alloc_vecs = num_irqs; 1769 data->msix_enabled = 1; 1770 data->def_irq = 0; 1771 1772 /* setup irq handler */ 1773 for (i = 0; i < data->alloc_vecs; i++) { 1774 struct msix_entry *msix_entry; 1775 1776 msix_entry = &data->msix_entries[i]; 1777 msix_entry->vector = pci_irq_vector(data->pdev, i); 1778 1779 err = devm_request_threaded_irq(&data->pdev->dev, 1780 msix_entry->vector, 1781 NULL, 1782 btintel_pcie_irq_msix_handler, 1783 IRQF_ONESHOT | IRQF_SHARED, 1784 KBUILD_MODNAME, 1785 msix_entry); 1786 if (err) { 1787 pci_free_irq_vectors(data->pdev); 1788 data->alloc_vecs = 0; 1789 return err; 1790 } 1791 } 1792 return 0; 1793 } 1794 1795 struct btintel_pcie_causes_list { 1796 u32 cause; 1797 u32 mask_reg; 1798 u8 cause_num; 1799 }; 1800 1801 static struct btintel_pcie_causes_list causes_list[] = { 1802 { BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, 0x00 }, 1803 { BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, 0x01 }, 1804 { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, 0x20 }, 1805 { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_HWEXP, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, 0x23 }, 1806 { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_FWTRIG, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, 0x25 }, 1807 }; 1808 1809 /* This function configures the interrupt masks for both HW_INT_CAUSES and 1810 * FH_INT_CAUSES which are meaningful to us. 1811 * 1812 * After resetting BT function via PCIE FLR or FUNC_CTRL reset, the driver 1813 * need to call this function again to configure since the masks 1814 * are reset to 0xFFFFFFFF after reset. 1815 */ 1816 static void btintel_pcie_config_msix(struct btintel_pcie_data *data) 1817 { 1818 int i; 1819 int val = data->def_irq | BTINTEL_PCIE_MSIX_NON_AUTO_CLEAR_CAUSE; 1820 1821 /* Set Non Auto Clear Cause */ 1822 for (i = 0; i < ARRAY_SIZE(causes_list); i++) { 1823 btintel_pcie_wr_reg8(data, 1824 BTINTEL_PCIE_CSR_MSIX_IVAR(causes_list[i].cause_num), 1825 val); 1826 btintel_pcie_clr_reg_bits(data, 1827 causes_list[i].mask_reg, 1828 causes_list[i].cause); 1829 } 1830 1831 /* Save the initial interrupt mask */ 1832 data->fh_init_mask = ~btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK); 1833 data->hw_init_mask = ~btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK); 1834 } 1835 1836 static int btintel_pcie_config_pcie(struct pci_dev *pdev, 1837 struct btintel_pcie_data *data) 1838 { 1839 int err; 1840 1841 err = pcim_enable_device(pdev); 1842 if (err) 1843 return err; 1844 1845 pci_set_master(pdev); 1846 1847 err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); 1848 if (err) { 1849 err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); 1850 if (err) 1851 return err; 1852 } 1853 1854 data->base_addr = pcim_iomap_region(pdev, 0, KBUILD_MODNAME); 1855 if (IS_ERR(data->base_addr)) 1856 return PTR_ERR(data->base_addr); 1857 1858 err = btintel_pcie_setup_irq(data); 1859 if (err) 1860 return err; 1861 1862 /* Configure MSI-X with causes list */ 1863 btintel_pcie_config_msix(data); 1864 1865 return 0; 1866 } 1867 1868 static void btintel_pcie_init_ci(struct btintel_pcie_data *data, 1869 struct ctx_info *ci) 1870 { 1871 ci->version = 0x1; 1872 ci->size = sizeof(*ci); 1873 ci->config = 0x0000; 1874 ci->addr_cr_hia = data->ia.cr_hia_p_addr; 1875 ci->addr_tr_tia = data->ia.tr_tia_p_addr; 1876 ci->addr_cr_tia = data->ia.cr_tia_p_addr; 1877 ci->addr_tr_hia = data->ia.tr_hia_p_addr; 1878 ci->num_cr_ia = BTINTEL_PCIE_NUM_QUEUES; 1879 ci->num_tr_ia = BTINTEL_PCIE_NUM_QUEUES; 1880 ci->addr_urbdq0 = data->txq.urbd0s_p_addr; 1881 ci->addr_tfdq = data->txq.tfds_p_addr; 1882 ci->num_tfdq = data->txq.count; 1883 ci->num_urbdq0 = data->txq.count; 1884 ci->tfdq_db_vec = BTINTEL_PCIE_TXQ_NUM; 1885 ci->urbdq0_db_vec = BTINTEL_PCIE_TXQ_NUM; 1886 ci->rbd_size = BTINTEL_PCIE_RBD_SIZE_4K; 1887 ci->addr_frbdq = data->rxq.frbds_p_addr; 1888 ci->num_frbdq = data->rxq.count; 1889 ci->frbdq_db_vec = BTINTEL_PCIE_RXQ_NUM; 1890 ci->addr_urbdq1 = data->rxq.urbd1s_p_addr; 1891 ci->num_urbdq1 = data->rxq.count; 1892 ci->urbdq_db_vec = BTINTEL_PCIE_RXQ_NUM; 1893 1894 ci->dbg_output_mode = 0x01; 1895 ci->dbgc_addr = data->dbgc.frag_p_addr; 1896 ci->dbgc_size = data->dbgc.frag_size; 1897 ci->dbg_preset = 0x00; 1898 } 1899 1900 static void btintel_pcie_free_txq_bufs(struct btintel_pcie_data *data, 1901 struct txq *txq) 1902 { 1903 /* Free data buffers first */ 1904 dma_free_coherent(&data->pdev->dev, txq->count * BTINTEL_PCIE_BUFFER_SIZE, 1905 txq->buf_v_addr, txq->buf_p_addr); 1906 kfree(txq->bufs); 1907 } 1908 1909 static int btintel_pcie_setup_txq_bufs(struct btintel_pcie_data *data, 1910 struct txq *txq) 1911 { 1912 int i; 1913 struct data_buf *buf; 1914 1915 /* Allocate the same number of buffers as the descriptor */ 1916 txq->bufs = kmalloc_objs(*buf, txq->count); 1917 if (!txq->bufs) 1918 return -ENOMEM; 1919 1920 /* Allocate full chunk of data buffer for DMA first and do indexing and 1921 * initialization next, so it can be freed easily 1922 */ 1923 txq->buf_v_addr = dma_alloc_coherent(&data->pdev->dev, 1924 txq->count * BTINTEL_PCIE_BUFFER_SIZE, 1925 &txq->buf_p_addr, 1926 GFP_KERNEL | __GFP_NOWARN); 1927 if (!txq->buf_v_addr) { 1928 kfree(txq->bufs); 1929 return -ENOMEM; 1930 } 1931 1932 /* Setup the allocated DMA buffer to bufs. Each data_buf should 1933 * have virtual address and physical address 1934 */ 1935 for (i = 0; i < txq->count; i++) { 1936 buf = &txq->bufs[i]; 1937 buf->data_p_addr = txq->buf_p_addr + (i * BTINTEL_PCIE_BUFFER_SIZE); 1938 buf->data = txq->buf_v_addr + (i * BTINTEL_PCIE_BUFFER_SIZE); 1939 } 1940 1941 return 0; 1942 } 1943 1944 static void btintel_pcie_free_rxq_bufs(struct btintel_pcie_data *data, 1945 struct rxq *rxq) 1946 { 1947 /* Free data buffers first */ 1948 dma_free_coherent(&data->pdev->dev, rxq->count * BTINTEL_PCIE_BUFFER_SIZE, 1949 rxq->buf_v_addr, rxq->buf_p_addr); 1950 kfree(rxq->bufs); 1951 } 1952 1953 static int btintel_pcie_setup_rxq_bufs(struct btintel_pcie_data *data, 1954 struct rxq *rxq) 1955 { 1956 int i; 1957 struct data_buf *buf; 1958 1959 /* Allocate the same number of buffers as the descriptor */ 1960 rxq->bufs = kmalloc_objs(*buf, rxq->count); 1961 if (!rxq->bufs) 1962 return -ENOMEM; 1963 1964 /* Allocate full chunk of data buffer for DMA first and do indexing and 1965 * initialization next, so it can be freed easily 1966 */ 1967 rxq->buf_v_addr = dma_alloc_coherent(&data->pdev->dev, 1968 rxq->count * BTINTEL_PCIE_BUFFER_SIZE, 1969 &rxq->buf_p_addr, 1970 GFP_KERNEL | __GFP_NOWARN); 1971 if (!rxq->buf_v_addr) { 1972 kfree(rxq->bufs); 1973 return -ENOMEM; 1974 } 1975 1976 /* Setup the allocated DMA buffer to bufs. Each data_buf should 1977 * have virtual address and physical address 1978 */ 1979 for (i = 0; i < rxq->count; i++) { 1980 buf = &rxq->bufs[i]; 1981 buf->data_p_addr = rxq->buf_p_addr + (i * BTINTEL_PCIE_BUFFER_SIZE); 1982 buf->data = rxq->buf_v_addr + (i * BTINTEL_PCIE_BUFFER_SIZE); 1983 } 1984 1985 return 0; 1986 } 1987 1988 static void btintel_pcie_free(struct btintel_pcie_data *data) 1989 { 1990 btintel_pcie_free_rxq_bufs(data, &data->rxq); 1991 btintel_pcie_free_txq_bufs(data, &data->txq); 1992 1993 dma_pool_free(data->dma_pool, data->dma_v_addr, data->dma_p_addr); 1994 dma_pool_destroy(data->dma_pool); 1995 } 1996 1997 /* Allocate tx and rx queues, any related data structures and buffers. 1998 */ 1999 static int btintel_pcie_alloc(struct btintel_pcie_data *data) 2000 { 2001 int err = 0; 2002 size_t total; 2003 dma_addr_t p_addr; 2004 void *v_addr; 2005 size_t tfd_size, frbd_size, ctx_size, ci_size, urbd0_size, urbd1_size; 2006 2007 /* Allocate the chunk of DMA memory for descriptors, index array, and 2008 * context information, instead of allocating individually. 2009 * The DMA memory for data buffer is allocated while setting up the 2010 * each queue. 2011 * 2012 * Total size is sum of the following and each of the individual sizes 2013 * are aligned to 128 bytes before adding up. 2014 * 2015 * + size of TFD * Number of descriptors in queue 2016 * + size of URBD0 * Number of descriptors in queue 2017 * + size of FRBD * Number of descriptors in queue 2018 * + size of URBD1 * Number of descriptors in queue 2019 * + size of index * Number of queues(2) * type of index array(4) 2020 * + size of context information 2021 */ 2022 tfd_size = ALIGN(sizeof(struct tfd) * BTINTEL_PCIE_TX_DESCS_COUNT, 2023 BTINTEL_PCIE_DMA_ALIGN_128B); 2024 urbd0_size = ALIGN(sizeof(struct urbd0) * BTINTEL_PCIE_TX_DESCS_COUNT, 2025 BTINTEL_PCIE_DMA_ALIGN_128B); 2026 2027 frbd_size = ALIGN(sizeof(struct frbd) * BTINTEL_PCIE_RX_DESCS_COUNT, 2028 BTINTEL_PCIE_DMA_ALIGN_128B); 2029 urbd1_size = ALIGN(sizeof(struct urbd1) * BTINTEL_PCIE_RX_DESCS_COUNT, 2030 BTINTEL_PCIE_DMA_ALIGN_128B); 2031 2032 ci_size = ALIGN(sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES, 2033 BTINTEL_PCIE_DMA_ALIGN_128B); 2034 2035 ctx_size = ALIGN(sizeof(struct ctx_info), BTINTEL_PCIE_DMA_ALIGN_128B); 2036 2037 total = tfd_size + urbd0_size + frbd_size + urbd1_size + ctx_size + ci_size * 4; 2038 2039 data->dma_pool = dma_pool_create(KBUILD_MODNAME, &data->pdev->dev, 2040 total, BTINTEL_PCIE_DMA_ALIGN_128B, 0); 2041 if (!data->dma_pool) { 2042 err = -ENOMEM; 2043 goto exit_error; 2044 } 2045 2046 v_addr = dma_pool_zalloc(data->dma_pool, GFP_KERNEL | __GFP_NOWARN, 2047 &p_addr); 2048 if (!v_addr) { 2049 dma_pool_destroy(data->dma_pool); 2050 err = -ENOMEM; 2051 goto exit_error; 2052 } 2053 2054 data->dma_p_addr = p_addr; 2055 data->dma_v_addr = v_addr; 2056 2057 /* Setup descriptor count */ 2058 data->txq.count = BTINTEL_PCIE_TX_DESCS_COUNT; 2059 data->rxq.count = BTINTEL_PCIE_RX_DESCS_COUNT; 2060 2061 /* Setup tfds */ 2062 data->txq.tfds_p_addr = p_addr; 2063 data->txq.tfds = v_addr; 2064 2065 p_addr += tfd_size; 2066 v_addr += tfd_size; 2067 2068 /* Setup urbd0 */ 2069 data->txq.urbd0s_p_addr = p_addr; 2070 data->txq.urbd0s = v_addr; 2071 2072 p_addr += urbd0_size; 2073 v_addr += urbd0_size; 2074 2075 /* Setup FRBD*/ 2076 data->rxq.frbds_p_addr = p_addr; 2077 data->rxq.frbds = v_addr; 2078 2079 p_addr += frbd_size; 2080 v_addr += frbd_size; 2081 2082 /* Setup urbd1 */ 2083 data->rxq.urbd1s_p_addr = p_addr; 2084 data->rxq.urbd1s = v_addr; 2085 2086 p_addr += urbd1_size; 2087 v_addr += urbd1_size; 2088 2089 /* Setup data buffers for txq */ 2090 err = btintel_pcie_setup_txq_bufs(data, &data->txq); 2091 if (err) 2092 goto exit_error_pool; 2093 2094 /* Setup data buffers for rxq */ 2095 err = btintel_pcie_setup_rxq_bufs(data, &data->rxq); 2096 if (err) 2097 goto exit_error_txq; 2098 2099 /* TR Head Index Array */ 2100 data->ia.tr_hia_p_addr = p_addr; 2101 data->ia.tr_hia = v_addr; 2102 p_addr += ci_size; 2103 v_addr += ci_size; 2104 2105 /* TR Tail Index Array */ 2106 data->ia.tr_tia_p_addr = p_addr; 2107 data->ia.tr_tia = v_addr; 2108 p_addr += ci_size; 2109 v_addr += ci_size; 2110 2111 /* CR Head index Array */ 2112 data->ia.cr_hia_p_addr = p_addr; 2113 data->ia.cr_hia = v_addr; 2114 p_addr += ci_size; 2115 v_addr += ci_size; 2116 2117 /* CR Tail Index Array */ 2118 data->ia.cr_tia_p_addr = p_addr; 2119 data->ia.cr_tia = v_addr; 2120 p_addr += ci_size; 2121 v_addr += ci_size; 2122 2123 /* Setup data buffers for dbgc */ 2124 err = btintel_pcie_setup_dbgc(data); 2125 if (err) 2126 goto exit_error_txq; 2127 2128 /* Setup Context Information */ 2129 data->ci = v_addr; 2130 data->ci_p_addr = p_addr; 2131 2132 /* Initialize the CI */ 2133 btintel_pcie_init_ci(data, data->ci); 2134 2135 return 0; 2136 2137 exit_error_txq: 2138 btintel_pcie_free_txq_bufs(data, &data->txq); 2139 exit_error_pool: 2140 dma_pool_free(data->dma_pool, data->dma_v_addr, data->dma_p_addr); 2141 dma_pool_destroy(data->dma_pool); 2142 exit_error: 2143 return err; 2144 } 2145 2146 static int btintel_pcie_open(struct hci_dev *hdev) 2147 { 2148 bt_dev_dbg(hdev, ""); 2149 2150 return 0; 2151 } 2152 2153 static int btintel_pcie_close(struct hci_dev *hdev) 2154 { 2155 bt_dev_dbg(hdev, ""); 2156 2157 return 0; 2158 } 2159 2160 static int btintel_pcie_inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 2161 { 2162 struct sk_buff *skb; 2163 struct hci_event_hdr *hdr; 2164 struct hci_ev_cmd_complete *evt; 2165 2166 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL); 2167 if (!skb) 2168 return -ENOMEM; 2169 2170 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr)); 2171 hdr->evt = HCI_EV_CMD_COMPLETE; 2172 hdr->plen = sizeof(*evt) + 1; 2173 2174 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt)); 2175 evt->ncmd = 0x01; 2176 evt->opcode = cpu_to_le16(opcode); 2177 2178 *(u8 *)skb_put(skb, 1) = 0x00; 2179 2180 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 2181 2182 return hci_recv_frame(hdev, skb); 2183 } 2184 2185 static int btintel_pcie_send_frame(struct hci_dev *hdev, 2186 struct sk_buff *skb) 2187 { 2188 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2189 struct hci_command_hdr *cmd; 2190 __u16 opcode = ~0; 2191 int ret; 2192 u32 type; 2193 2194 if (test_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags)) 2195 return -ENODEV; 2196 2197 if (test_bit(BTINTEL_PCIE_RECOVERY_IN_PROGRESS, &data->flags)) 2198 return -ENODEV; 2199 2200 /* Due to the fw limitation, the type header of the packet should be 2201 * 4 bytes unlike 1 byte for UART. In UART, the firmware can read 2202 * the first byte to get the packet type and redirect the rest of data 2203 * packet to the right handler. 2204 * 2205 * But for PCIe, THF(Transfer Flow Handler) fetches the 4 bytes of data 2206 * from DMA memory and by the time it reads the first 4 bytes, it has 2207 * already consumed some part of packet. Thus the packet type indicator 2208 * for iBT PCIe is 4 bytes. 2209 * 2210 * Luckily, when HCI core creates the skb, it allocates 8 bytes of 2211 * head room for profile and driver use, and before sending the data 2212 * to the device, append the iBT PCIe packet type in the front. 2213 */ 2214 switch (hci_skb_pkt_type(skb)) { 2215 case HCI_COMMAND_PKT: 2216 type = BTINTEL_PCIE_HCI_CMD_PKT; 2217 cmd = (void *)skb->data; 2218 opcode = le16_to_cpu(cmd->opcode); 2219 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2220 struct hci_command_hdr *cmd = (void *)skb->data; 2221 __u16 opcode = le16_to_cpu(cmd->opcode); 2222 2223 /* When the BTINTEL_HCI_OP_RESET command is issued to 2224 * boot into the operational firmware, it will actually 2225 * not send a command complete event. To keep the flow 2226 * control working inject that event here. 2227 */ 2228 if (opcode == BTINTEL_HCI_OP_RESET) 2229 btintel_pcie_inject_cmd_complete(hdev, opcode); 2230 } 2231 2232 hdev->stat.cmd_tx++; 2233 break; 2234 case HCI_ACLDATA_PKT: 2235 type = BTINTEL_PCIE_HCI_ACL_PKT; 2236 hdev->stat.acl_tx++; 2237 break; 2238 case HCI_SCODATA_PKT: 2239 type = BTINTEL_PCIE_HCI_SCO_PKT; 2240 hdev->stat.sco_tx++; 2241 break; 2242 case HCI_ISODATA_PKT: 2243 type = BTINTEL_PCIE_HCI_ISO_PKT; 2244 break; 2245 default: 2246 bt_dev_err(hdev, "Unknown HCI packet type"); 2247 return -EILSEQ; 2248 } 2249 2250 ret = btintel_pcie_send_sync(data, skb, type, opcode); 2251 if (ret) { 2252 hdev->stat.err_tx++; 2253 bt_dev_err(hdev, "Failed to send frame (%d)", ret); 2254 goto exit_error; 2255 } 2256 2257 hdev->stat.byte_tx += skb->len; 2258 kfree_skb(skb); 2259 2260 exit_error: 2261 return ret; 2262 } 2263 2264 static void btintel_pcie_release_hdev(struct btintel_pcie_data *data) 2265 { 2266 struct hci_dev *hdev = data->hdev; 2267 2268 if (!hdev) 2269 return; 2270 2271 hci_unregister_dev(hdev); 2272 hci_free_dev(hdev); 2273 data->hdev = NULL; 2274 } 2275 2276 static void btintel_pcie_disable_interrupts(struct btintel_pcie_data *data) 2277 { 2278 spin_lock(&data->irq_lock); 2279 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, data->fh_init_mask); 2280 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, data->hw_init_mask); 2281 spin_unlock(&data->irq_lock); 2282 } 2283 2284 static void btintel_pcie_enable_interrupts(struct btintel_pcie_data *data) 2285 { 2286 spin_lock(&data->irq_lock); 2287 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, ~data->fh_init_mask); 2288 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, ~data->hw_init_mask); 2289 spin_unlock(&data->irq_lock); 2290 } 2291 2292 static void btintel_pcie_synchronize_irqs(struct btintel_pcie_data *data) 2293 { 2294 for (int i = 0; i < data->alloc_vecs; i++) 2295 synchronize_irq(data->msix_entries[i].vector); 2296 } 2297 2298 static int btintel_pcie_get_debug_info_addr(struct hci_dev *hdev) 2299 { 2300 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2301 struct btintel_pcie_trigger_evt *evt; 2302 u8 param[1] = {0x10}; 2303 struct sk_buff *skb; 2304 int err = 0; 2305 2306 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_DEBUG, 1, param, 2307 HCI_CMD_TIMEOUT); 2308 if (IS_ERR(skb)) { 2309 bt_dev_err(hdev, "Reading Intel read debug info address command failed (%ld)", 2310 PTR_ERR(skb)); 2311 /* Not all Intel products supports this command */ 2312 if (PTR_ERR(skb) == -EOPNOTSUPP) 2313 return 0; 2314 return PTR_ERR(skb); 2315 } 2316 2317 if (skb->len < (1 + sizeof(*evt))) { 2318 bt_dev_err(hdev, "Debug info response too short (%u bytes)", skb->len); 2319 err = -EIO; 2320 goto exit_error; 2321 } 2322 2323 /* Check the status */ 2324 if (skb->data[0]) { 2325 bt_dev_err(hdev, "Reading Intel read debug info command failed (0x%2.2x)", 2326 skb->data[0]); 2327 err = -EIO; 2328 goto exit_error; 2329 } 2330 2331 /* Consume Command Complete Status field */ 2332 skb_pull(skb, 1); 2333 2334 evt = (void *)skb->data; 2335 2336 data->debug_evt_addr = le32_to_cpu(evt->addr); 2337 data->debug_evt_size = le32_to_cpu(evt->size); 2338 2339 bt_dev_dbg(hdev, "config type: %u config len: %u debug event addr: 0x%8.8x size: 0x%8.8x", 2340 evt->type, evt->len, data->debug_evt_addr, 2341 data->debug_evt_size); 2342 exit_error: 2343 kfree_skb(skb); 2344 return err; 2345 } 2346 2347 static int btintel_pcie_setup_internal(struct hci_dev *hdev) 2348 { 2349 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2350 const u8 param[1] = { 0xFF }; 2351 struct intel_version_tlv ver_tlv; 2352 struct sk_buff *skb; 2353 int err; 2354 2355 BT_DBG("%s", hdev->name); 2356 2357 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 2358 if (IS_ERR(skb)) { 2359 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 2360 PTR_ERR(skb)); 2361 return PTR_ERR(skb); 2362 } 2363 2364 /* Check the status */ 2365 if (skb->data[0]) { 2366 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 2367 skb->data[0]); 2368 err = -EIO; 2369 goto exit_error; 2370 } 2371 2372 /* Apply the common HCI quirks for Intel device */ 2373 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 2374 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 2375 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 2376 2377 /* Set up the quality report callback for Intel devices */ 2378 hdev->set_quality_report = btintel_set_quality_report; 2379 2380 memset(&ver_tlv, 0, sizeof(ver_tlv)); 2381 /* For TLV type device, parse the tlv data */ 2382 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 2383 if (err) { 2384 bt_dev_err(hdev, "Failed to parse TLV version information"); 2385 goto exit_error; 2386 } 2387 2388 switch (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)) { 2389 case 0x37: 2390 break; 2391 default: 2392 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 2393 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 2394 err = -EINVAL; 2395 goto exit_error; 2396 } 2397 2398 /* Check for supported iBT hardware variants of this firmware 2399 * loading method. 2400 * 2401 * This check has been put in place to ensure correct forward 2402 * compatibility options when newer hardware variants come 2403 * along. 2404 */ 2405 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 2406 case 0x1e: /* BzrI */ 2407 case 0x1f: /* ScP */ 2408 case 0x20: /* ScP2 */ 2409 case 0x21: /* ScP2 F */ 2410 case 0x22: /* BzrIW */ 2411 /* Display version information of TLV type */ 2412 btintel_version_info_tlv(hdev, &ver_tlv); 2413 2414 /* Apply the device specific HCI quirks for TLV based devices 2415 * 2416 * All TLV based devices support WBS 2417 */ 2418 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 2419 2420 /* Setup MSFT Extension support */ 2421 btintel_set_msft_opcode(hdev, 2422 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 2423 2424 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 2425 if (err) 2426 goto exit_error; 2427 break; 2428 default: 2429 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 2430 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 2431 err = -EINVAL; 2432 goto exit_error; 2433 } 2434 2435 data->dmp_hdr.cnvi_top = ver_tlv.cnvi_top; 2436 data->dmp_hdr.cnvr_top = ver_tlv.cnvr_top; 2437 data->dmp_hdr.fw_timestamp = ver_tlv.timestamp; 2438 data->dmp_hdr.fw_build_type = ver_tlv.build_type; 2439 data->dmp_hdr.fw_build_num = ver_tlv.build_num; 2440 data->dmp_hdr.cnvi_bt = ver_tlv.cnvi_bt; 2441 2442 if (ver_tlv.img_type == 0x02 || ver_tlv.img_type == 0x03) 2443 data->dmp_hdr.fw_git_sha1 = ver_tlv.git_sha1; 2444 2445 err = btintel_pcie_get_debug_info_addr(hdev); 2446 if (err) 2447 goto exit_error; 2448 2449 btintel_print_fseq_info(hdev); 2450 exit_error: 2451 kfree_skb(skb); 2452 2453 return err; 2454 } 2455 2456 static int btintel_pcie_setup(struct hci_dev *hdev) 2457 { 2458 int err, fw_dl_retry = 0; 2459 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2460 2461 while ((err = btintel_pcie_setup_internal(hdev)) && fw_dl_retry++ < 1) { 2462 bt_dev_err(hdev, "Firmware download retry count: %d", 2463 fw_dl_retry); 2464 btintel_pcie_dump_debug_registers(hdev); 2465 btintel_pcie_disable_interrupts(data); 2466 btintel_pcie_synchronize_irqs(data); 2467 err = btintel_pcie_reset_bt(data); 2468 if (err) { 2469 bt_dev_err(hdev, "Failed to do shr reset: %d", err); 2470 break; 2471 } 2472 usleep_range(10000, 12000); 2473 btintel_pcie_reset_ia(data); 2474 btintel_pcie_enable_interrupts(data); 2475 btintel_pcie_config_msix(data); 2476 err = btintel_pcie_enable_bt(data); 2477 if (err) { 2478 bt_dev_err(hdev, "Failed to enable hardware: %d", err); 2479 break; 2480 } 2481 btintel_pcie_start_rx(data); 2482 } 2483 2484 if (!err) 2485 set_bit(BTINTEL_PCIE_SETUP_DONE, &data->flags); 2486 return err; 2487 } 2488 2489 static struct btintel_pcie_dev_recovery * 2490 btintel_pcie_get_recovery(struct pci_dev *pdev, struct device *dev) 2491 { 2492 struct btintel_pcie_dev_recovery *tmp, *data = NULL; 2493 const char *name = pci_name(pdev); 2494 const size_t name_len = strlen(name) + 1; 2495 struct hci_dev *hdev = to_hci_dev(dev); 2496 2497 spin_lock(&btintel_pcie_recovery_lock); 2498 list_for_each_entry(tmp, &btintel_pcie_recovery_list, list) { 2499 if (strcmp(tmp->name, name)) 2500 continue; 2501 data = tmp; 2502 break; 2503 } 2504 spin_unlock(&btintel_pcie_recovery_lock); 2505 2506 if (data) { 2507 bt_dev_dbg(hdev, "Found restart data for BDF: %s", data->name); 2508 return data; 2509 } 2510 2511 data = kzalloc_flex(*data, name, name_len, GFP_ATOMIC); 2512 if (!data) 2513 return NULL; 2514 2515 strscpy(data->name, name, name_len); 2516 spin_lock(&btintel_pcie_recovery_lock); 2517 list_add_tail(&data->list, &btintel_pcie_recovery_list); 2518 spin_unlock(&btintel_pcie_recovery_lock); 2519 2520 return data; 2521 } 2522 2523 static void btintel_pcie_free_restart_list(void) 2524 { 2525 struct btintel_pcie_dev_recovery *tmp; 2526 2527 while ((tmp = list_first_entry_or_null(&btintel_pcie_recovery_list, 2528 typeof(*tmp), list))) { 2529 list_del(&tmp->list); 2530 kfree(tmp); 2531 } 2532 } 2533 2534 static void btintel_pcie_inc_recovery_count(struct pci_dev *pdev, 2535 struct device *dev) 2536 { 2537 struct btintel_pcie_dev_recovery *data; 2538 time64_t retry_window; 2539 2540 data = btintel_pcie_get_recovery(pdev, dev); 2541 if (!data) 2542 return; 2543 2544 retry_window = ktime_get_boottime_seconds() - data->last_error; 2545 if (data->count == 0) { 2546 data->last_error = ktime_get_boottime_seconds(); 2547 data->count++; 2548 } else if (retry_window < BTINTEL_PCIE_RESET_WINDOW_SECS && 2549 data->count <= BTINTEL_PCIE_FLR_MAX_RETRY) { 2550 data->count++; 2551 } else if (retry_window > BTINTEL_PCIE_RESET_WINDOW_SECS) { 2552 data->last_error = 0; 2553 data->count = 0; 2554 } 2555 } 2556 2557 static int btintel_pcie_acpi_reset_method(struct btintel_pcie_data *data) 2558 { 2559 union acpi_object *obj, argv4; 2560 acpi_handle handle; 2561 int ret; 2562 struct pldr_mode { 2563 __le16 cmd_type; 2564 __le16 cmd_payload; 2565 } __packed; 2566 2567 /* set 1 for _PRR mode 2568 * Product Reset (PLDR Abort flow) 2569 */ 2570 static const struct pldr_mode mode = { 2571 .cmd_type = cpu_to_le16(1), 2572 .cmd_payload = cpu_to_le16(BTINTEL_PCIE_DSM_PLDR_MODE_EN_PROD_RESET | 2573 BTINTEL_PCIE_DSM_PLDR_MODE_EN_WIFI_FLR), 2574 }; 2575 struct hci_dev *hdev = data->hdev; 2576 2577 handle = ACPI_HANDLE(GET_HCIDEV_DEV(data->hdev)); 2578 if (!handle) { 2579 bt_dev_err(data->hdev, "No support for bluetooth device in ACPI firmware"); 2580 return -EACCES; 2581 } 2582 2583 if (!acpi_has_method(handle, "_PRR")) { 2584 bt_dev_err(data->hdev, "No support for _PRR ACPI method, cold boot"); 2585 return -ENODEV; 2586 } 2587 2588 argv4.buffer.type = ACPI_TYPE_BUFFER; 2589 argv4.buffer.length = sizeof(mode); 2590 argv4.buffer.pointer = (void *)&mode; 2591 2592 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2593 BTINTEL_PCIE_DSM_DYNAMIC_PLDR, &argv4); 2594 if (!obj) { 2595 bt_dev_err(data->hdev, "Failed to call dsm to set reset method"); 2596 return -EIO; 2597 } 2598 ACPI_FREE(obj); 2599 2600 pci_dev_lock(data->pdev); 2601 pci_save_state(data->pdev); 2602 ret = btintel_acpi_reset_method(hdev); 2603 if (ret) 2604 bt_dev_err(data->hdev, "ACPI _PRR reset failed (%d), PLDR incomplete", 2605 ret); 2606 pci_restore_state(data->pdev); 2607 pci_dev_unlock(data->pdev); 2608 return ret; 2609 } 2610 2611 static void btintel_pcie_perform_pldr(struct btintel_pcie_data *data) 2612 { 2613 struct pci_dev *pdev = data->pdev; 2614 struct pci_dev *wifi = NULL; 2615 struct pci_bus *bus; 2616 int ret; 2617 /* on integrated we have to look up by ID (same bus) */ 2618 static const struct pci_device_id wifi_device_ids[] = { 2619 #define WIFI_DEV(_id) { PCI_DEVICE(PCI_VENDOR_ID_INTEL, _id) } 2620 WIFI_DEV(0xA840), /* LNL */ 2621 WIFI_DEV(0xE440), /* PTL-P */ 2622 WIFI_DEV(0xE340), /* PTL-H */ 2623 WIFI_DEV(0xD340), /* NVL-H */ 2624 WIFI_DEV(0x6E70), /* NVL-S */ 2625 WIFI_DEV(0x4D40), /* WCL */ 2626 {} 2627 }; 2628 struct pci_dev *tmp = NULL; 2629 2630 bus = pdev->bus; 2631 if (!bus) 2632 return; 2633 2634 list_for_each_entry(tmp, &bus->devices, bus_list) { 2635 if (pci_match_id(wifi_device_ids, tmp)) { 2636 wifi = pci_dev_get(tmp); 2637 break; 2638 } 2639 } 2640 2641 if (wifi) 2642 device_release_driver(&wifi->dev); 2643 2644 /* Wi-Fi is fully unbound before the reset and fully reprobed after 2645 * the normal PCI probe path handles all state setup from scratch. 2646 * BT needs pci_save_state()/pci_restore_state() because the BT driver 2647 * is still partially attached when the _PRR runs (it hasn't been unbound yet). 2648 * The PCI device needs to remain minimally functional so that 2649 * device_reprobe(&pdev->dev) can work afterward 2650 */ 2651 ret = btintel_pcie_acpi_reset_method(data); 2652 2653 if (wifi) { 2654 if (device_reprobe(&wifi->dev)) 2655 BT_ERR("WiFi reprobe failed for BDF:%s", pci_name(wifi)); 2656 pci_dev_put(wifi); 2657 } 2658 2659 if (!ret) { 2660 if (device_reprobe(&pdev->dev)) 2661 BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev)); 2662 } 2663 } 2664 2665 /* 2666 * Issue a Function Level Reset and hand teardown/re-init off to the PCI 2667 * core via device_reprobe(), mirroring the PLDR path's contract. 2668 * 2669 * Caller must hold pci_lock_rescan_remove() and must have already 2670 * disabled interrupts and drained both rx_work and coredump_work. 2671 */ 2672 static int btintel_pcie_perform_flr(struct btintel_pcie_data *data) 2673 { 2674 struct pci_dev *pdev = data->pdev; 2675 int err; 2676 2677 /* pci_try_reset_function() avoids the device_lock ABBA against 2678 * btintel_pcie_remove(): .remove() runs with device_lock held and 2679 * then waits for this work via disable_work_sync(); the blocking 2680 * pci_reset_function() would deadlock by trying to re-acquire 2681 * device_lock here. 2682 */ 2683 err = pci_try_reset_function(pdev); 2684 if (err) { 2685 BT_ERR("Failed resetting the pcie device (%d)", err); 2686 return err; 2687 } 2688 2689 /* device_reprobe() always detaches the driver first (running 2690 * .remove(), which frees 'data'); any re-probe failure leaves the 2691 * device unbound but 'data' is already gone, so just log it. 2692 */ 2693 if (device_reprobe(&pdev->dev)) 2694 BT_ERR("BT reprobe failed for BDF:%s", pci_name(pdev)); 2695 2696 return 0; 2697 } 2698 2699 static void btintel_pcie_reset_work(struct work_struct *wk) 2700 { 2701 struct btintel_pcie_data *data = 2702 container_of(wk, struct btintel_pcie_data, reset_work); 2703 struct pci_dev *pdev = data->pdev; 2704 2705 pci_lock_rescan_remove(); 2706 2707 if (!pdev->bus) 2708 goto out; 2709 2710 if (!data) 2711 goto out; 2712 2713 btintel_pcie_disable_interrupts(data); 2714 btintel_pcie_synchronize_irqs(data); 2715 2716 flush_work(&data->rx_work); 2717 /* Drain any in-flight dump workers and block new ones across reset. 2718 * Safe from self-deadlock: they all run on a separate wq. 2719 */ 2720 disable_work_sync(&data->coredump_work); 2721 disable_work_sync(&data->hwexp_work); 2722 disable_work_sync(&data->fwtrigger_work); 2723 2724 bt_dev_dbg(data->hdev, "Release bluetooth interface"); 2725 2726 /* Both reset paths follow the same contract: on success they 2727 * destroy 'data' via device_reprobe() (a fresh probe re-INIT_WORKs 2728 * the dump workers with disable count 0), so enable_work() must 2729 * NOT be called on the success path. Only the FLR path can fail 2730 * with 'data' still alive, in which case we balance the 2731 * disable_work_sync() calls above so a later successful reset is 2732 * not permanently blocked. 2733 * 2734 * pci_lock_rescan_remove() (held above) serializes against PCI 2735 * device addition/removal (hotplug), so no device can be added to 2736 * or removed from the bus list while this code runs. 2737 */ 2738 if (data->reset_type == BTINTEL_PCIE_IOSF_PRR_PLDR) { 2739 btintel_pcie_perform_pldr(data); 2740 goto out; 2741 } 2742 2743 if (btintel_pcie_perform_flr(data)) { 2744 enable_work(&data->coredump_work); 2745 enable_work(&data->hwexp_work); 2746 enable_work(&data->fwtrigger_work); 2747 } 2748 2749 out: 2750 pci_dev_put(pdev); 2751 pci_unlock_rescan_remove(); 2752 } 2753 2754 /* Schedule a device reset of the requested type. 2755 * 2756 * BTINTEL_PCIE_RECOVERY_IN_PROGRESS serializes all reset requesters 2757 * (sysfs reset attribute, hci_cmd_timeout(), hw_error, resume error 2758 * path, etc.) so that: 2759 * 2760 * - dev_data->reset_type is written by exactly one caller (the 2761 * thread that wins test_and_set_bit), eliminating the race where 2762 * a second hw_error could clobber an already-scheduled reset's 2763 * type; 2764 * - the write happens AFTER the bit is set, so reset_work observes 2765 * it through schedule_work()'s memory ordering; 2766 * - losers return without touching reset_type or scheduling the 2767 * work, so concurrent triggers are silently coalesced into the 2768 * in-flight one (whose recovery will reinitialize the device 2769 * regardless of the dropped trigger's variant). 2770 * 2771 * The bit is cleared only by .remove() / re-probe via fresh devm 2772 * allocation, which is the intended one-shot semantics: a reset 2773 * tears down and re-probes 'data', so there is no "in-flight" 2774 * reset to follow up after device_reprobe() succeeds. 2775 */ 2776 static void btintel_pcie_request_reset(struct btintel_pcie_data *data, 2777 enum btintel_pcie_reset_type type) 2778 { 2779 if (!test_bit(BTINTEL_PCIE_SETUP_DONE, &data->flags)) 2780 return; 2781 2782 if (test_and_set_bit(BTINTEL_PCIE_RECOVERY_IN_PROGRESS, &data->flags)) 2783 return; 2784 2785 data->reset_type = type; 2786 2787 pci_dev_get(data->pdev); 2788 schedule_work(&data->reset_work); 2789 } 2790 2791 static void btintel_pcie_hci_reset(struct hci_dev *hdev) 2792 { 2793 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2794 2795 btintel_pcie_request_reset(data, BTINTEL_PCIE_IOSF_PRR_FLR); 2796 } 2797 2798 static ssize_t vendor_reset_store(struct device *dev, 2799 struct device_attribute *attr, 2800 const char *buf, size_t count) 2801 { 2802 unsigned int val; 2803 struct pci_dev *pdev = to_pci_dev(dev); 2804 struct btintel_pcie_data *data = pci_get_drvdata(pdev); 2805 2806 if (!data || !data->hdev) 2807 return -ENODEV; 2808 2809 if (kstrtouint(buf, 10, &val) || val != 0) { 2810 bt_dev_warn(data->hdev, "PLDR rejected: invalid input"); 2811 return -EINVAL; 2812 } 2813 2814 bt_dev_info(data->hdev, "PLDR triggered via sysfs"); 2815 btintel_pcie_request_reset(data, BTINTEL_PCIE_IOSF_PRR_PLDR); 2816 2817 return count; 2818 } 2819 2820 static ssize_t vendor_reset_show(struct device *dev, 2821 struct device_attribute *attr, char *buf) 2822 { 2823 return sysfs_emit(buf, "0 - PLDR\n"); 2824 } 2825 2826 static DEVICE_ATTR_RW(vendor_reset); 2827 2828 static struct attribute *btintel_pcie_attrs[] = { 2829 &dev_attr_vendor_reset.attr, 2830 NULL, 2831 }; 2832 2833 ATTRIBUTE_GROUPS(btintel_pcie); 2834 2835 static void btintel_pcie_hw_error(struct hci_dev *hdev, u8 code) 2836 { 2837 struct btintel_pcie_dev_recovery *rec; 2838 struct btintel_pcie_data *dev_data = hci_get_drvdata(hdev); 2839 struct pci_dev *pdev = dev_data->pdev; 2840 enum btintel_pcie_reset_type type; 2841 time64_t retry_window; 2842 2843 if (test_bit(BTINTEL_PCIE_RECOVERY_IN_PROGRESS, &dev_data->flags)) 2844 return; 2845 2846 btintel_pcie_dump_debug_registers(hdev); 2847 2848 rec = btintel_pcie_get_recovery(pdev, &hdev->dev); 2849 if (!rec) 2850 return; 2851 2852 type = (code == 0x13) ? BTINTEL_PCIE_IOSF_PRR_PLDR 2853 : BTINTEL_PCIE_IOSF_PRR_FLR; 2854 2855 bt_dev_err(hdev, "Encountered exception err:0x%x triggering: %s", code, 2856 type == BTINTEL_PCIE_IOSF_PRR_PLDR ? "PLDR" : "FLR"); 2857 retry_window = ktime_get_boottime_seconds() - rec->last_error; 2858 2859 if (retry_window < BTINTEL_PCIE_RESET_WINDOW_SECS && 2860 rec->count >= BTINTEL_PCIE_FLR_MAX_RETRY) { 2861 bt_dev_err(hdev, "Exhausted maximum: %d recovery attempts: %d", 2862 BTINTEL_PCIE_FLR_MAX_RETRY, rec->count); 2863 bt_dev_dbg(hdev, "Boot time: %lld seconds", 2864 ktime_get_boottime_seconds()); 2865 bt_dev_dbg(hdev, "last error at: %lld seconds", 2866 rec->last_error); 2867 return; 2868 } 2869 btintel_pcie_inc_recovery_count(pdev, &hdev->dev); 2870 btintel_pcie_request_reset(dev_data, type); 2871 } 2872 2873 static bool btintel_pcie_wakeup(struct hci_dev *hdev) 2874 { 2875 struct btintel_pcie_data *data = hci_get_drvdata(hdev); 2876 2877 return device_may_wakeup(&data->pdev->dev); 2878 } 2879 2880 static const struct { 2881 u16 opcode; 2882 const char *desc; 2883 } btintel_pcie_hci_drv_supported_commands[] = { 2884 /* Common commands */ 2885 { HCI_DRV_OP_READ_INFO, "Read Info" }, 2886 }; 2887 2888 static int btintel_pcie_hci_drv_read_info(struct hci_dev *hdev, void *data, 2889 u16 data_len) 2890 { 2891 struct hci_drv_rp_read_info *rp; 2892 size_t rp_size; 2893 int err, i; 2894 u16 opcode, num_supported_commands = 2895 ARRAY_SIZE(btintel_pcie_hci_drv_supported_commands); 2896 2897 rp_size = struct_size(rp, supported_commands, num_supported_commands); 2898 2899 rp = kmalloc(rp_size, GFP_KERNEL); 2900 if (!rp) 2901 return -ENOMEM; 2902 2903 strscpy_pad(rp->driver_name, KBUILD_MODNAME); 2904 2905 rp->num_supported_commands = cpu_to_le16(num_supported_commands); 2906 for (i = 0; i < num_supported_commands; i++) { 2907 opcode = btintel_pcie_hci_drv_supported_commands[i].opcode; 2908 bt_dev_dbg(hdev, 2909 "Supported HCI Drv command (0x%02x|0x%04x): %s", 2910 hci_opcode_ogf(opcode), 2911 hci_opcode_ocf(opcode), 2912 btintel_pcie_hci_drv_supported_commands[i].desc); 2913 rp->supported_commands[i] = cpu_to_le16(opcode); 2914 } 2915 2916 err = hci_drv_cmd_complete(hdev, HCI_DRV_OP_READ_INFO, 2917 HCI_DRV_STATUS_SUCCESS, 2918 rp, rp_size); 2919 2920 kfree(rp); 2921 return err; 2922 } 2923 2924 static const struct hci_drv_handler btintel_pcie_hci_drv_common_handlers[] = { 2925 { btintel_pcie_hci_drv_read_info, HCI_DRV_READ_INFO_SIZE }, 2926 }; 2927 2928 static const struct hci_drv_handler btintel_pcie_hci_drv_specific_handlers[] = {}; 2929 2930 static struct hci_drv btintel_pcie_hci_drv = { 2931 .common_handler_count = ARRAY_SIZE(btintel_pcie_hci_drv_common_handlers), 2932 .common_handlers = btintel_pcie_hci_drv_common_handlers, 2933 .specific_handler_count = ARRAY_SIZE(btintel_pcie_hci_drv_specific_handlers), 2934 .specific_handlers = btintel_pcie_hci_drv_specific_handlers, 2935 }; 2936 2937 static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data) 2938 { 2939 int err; 2940 struct hci_dev *hdev; 2941 2942 hdev = hci_alloc_dev_priv(sizeof(struct btintel_data)); 2943 if (!hdev) 2944 return -ENOMEM; 2945 2946 hdev->bus = HCI_PCI; 2947 hci_set_drvdata(hdev, data); 2948 2949 SET_HCIDEV_DEV(hdev, &data->pdev->dev); 2950 2951 hdev->manufacturer = 2; 2952 hdev->open = btintel_pcie_open; 2953 hdev->close = btintel_pcie_close; 2954 hdev->send = btintel_pcie_send_frame; 2955 hdev->setup = btintel_pcie_setup; 2956 hdev->shutdown = btintel_shutdown_combined; 2957 hdev->hw_error = btintel_pcie_hw_error; 2958 hdev->set_diag = btintel_set_diag; 2959 hdev->set_bdaddr = btintel_set_bdaddr; 2960 hdev->reset = btintel_pcie_hci_reset; 2961 hdev->wakeup = btintel_pcie_wakeup; 2962 hdev->hci_drv = &btintel_pcie_hci_drv; 2963 2964 err = hci_register_dev(hdev); 2965 if (err < 0) { 2966 BT_ERR("Failed to register to hdev (%d)", err); 2967 hci_free_dev(hdev); 2968 return err; 2969 } 2970 2971 /* Publish hdev only after successful registration; the coredump 2972 * worker bails on !data->hdev, so it never observes a half-set-up 2973 * device. 2974 */ 2975 data->hdev = hdev; 2976 data->dmp_hdr.driver_name = KBUILD_MODNAME; 2977 return 0; 2978 } 2979 2980 static int btintel_pcie_probe(struct pci_dev *pdev, 2981 const struct pci_device_id *ent) 2982 { 2983 int err; 2984 struct btintel_pcie_data *data; 2985 2986 if (!pdev) 2987 return -ENODEV; 2988 2989 data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); 2990 if (!data) 2991 return -ENOMEM; 2992 2993 data->pdev = pdev; 2994 2995 spin_lock_init(&data->irq_lock); 2996 spin_lock_init(&data->hci_rx_lock); 2997 2998 init_waitqueue_head(&data->gp0_wait_q); 2999 data->gp0_received = false; 3000 3001 init_waitqueue_head(&data->tx_wait_q); 3002 data->tx_wait_done = false; 3003 3004 data->workqueue = alloc_ordered_workqueue(KBUILD_MODNAME, WQ_HIGHPRI); 3005 if (!data->workqueue) 3006 return -ENOMEM; 3007 3008 data->dump_workqueue = alloc_ordered_workqueue(KBUILD_MODNAME "_cd", 0); 3009 if (!data->dump_workqueue) { 3010 destroy_workqueue(data->workqueue); 3011 return -ENOMEM; 3012 } 3013 3014 skb_queue_head_init(&data->rx_skb_q); 3015 INIT_WORK(&data->rx_work, btintel_pcie_rx_work); 3016 INIT_WORK(&data->reset_work, btintel_pcie_reset_work); 3017 INIT_WORK(&data->coredump_work, btintel_pcie_coredump_worker); 3018 INIT_WORK(&data->hwexp_work, btintel_pcie_hwexp_worker); 3019 INIT_WORK(&data->fwtrigger_work, btintel_pcie_fwtrigger_worker); 3020 3021 data->boot_stage_cache = 0x00; 3022 data->img_resp_cache = 0x00; 3023 /* FLR can be invoked by echoing to debugfs path, so explicitly 3024 * initialized 3025 */ 3026 data->reset_type = BTINTEL_PCIE_IOSF_PRR_FLR; 3027 err = btintel_pcie_config_pcie(pdev, data); 3028 if (err) 3029 goto exit_error; 3030 3031 pci_set_drvdata(pdev, data); 3032 3033 err = btintel_pcie_alloc(data); 3034 if (err) 3035 goto exit_error; 3036 3037 err = btintel_pcie_enable_bt(data); 3038 if (err) 3039 goto exit_error; 3040 3041 /* CNV information (CNVi and CNVr) is in CSR */ 3042 data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG); 3043 3044 data->cnvr = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_RF_ID_REG); 3045 3046 err = btintel_pcie_start_rx(data); 3047 if (err) 3048 goto exit_error; 3049 3050 err = btintel_pcie_setup_hdev(data); 3051 if (err) 3052 goto exit_error; 3053 3054 bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi, 3055 data->cnvr); 3056 return 0; 3057 3058 exit_error: 3059 /* reset device before exit */ 3060 btintel_pcie_reset_bt(data); 3061 3062 destroy_workqueue(data->dump_workqueue); 3063 3064 pci_clear_master(pdev); 3065 3066 pci_set_drvdata(pdev, NULL); 3067 3068 return err; 3069 } 3070 3071 static void btintel_pcie_remove(struct pci_dev *pdev) 3072 { 3073 struct btintel_pcie_data *data; 3074 3075 data = pci_get_drvdata(pdev); 3076 if (!data) { 3077 BT_WARN("PCI driver data is NULL, aborting remove"); 3078 return; 3079 } 3080 3081 /* Permanently block all dump triggers and drain the workers before 3082 * tearing down. Must run before disable_work_sync(&reset_work) so 3083 * the disable counters stay >= 1 even after reset_work()'s 3084 * balanced enable_work() (counter 2 -> 1, never reaching 0). 3085 */ 3086 disable_work_sync(&data->coredump_work); 3087 disable_work_sync(&data->hwexp_work); 3088 disable_work_sync(&data->fwtrigger_work); 3089 3090 /* Cancel pending reset work. Skip only when remove() is called from 3091 * within the reset work itself (PLDR device_reprobe path) to avoid 3092 * deadlock. current_work() returns the work_struct of the caller if 3093 * we are in a workqueue context. 3094 */ 3095 if (current_work() != &data->reset_work) 3096 disable_work_sync(&data->reset_work); 3097 3098 btintel_pcie_disable_interrupts(data); 3099 3100 btintel_pcie_synchronize_irqs(data); 3101 3102 flush_work(&data->rx_work); 3103 3104 btintel_pcie_reset_bt(data); 3105 for (int i = 0; i < data->alloc_vecs; i++) { 3106 struct msix_entry *msix_entry; 3107 3108 msix_entry = &data->msix_entries[i]; 3109 free_irq(msix_entry->vector, msix_entry); 3110 } 3111 3112 pci_free_irq_vectors(pdev); 3113 3114 btintel_pcie_release_hdev(data); 3115 3116 destroy_workqueue(data->dump_workqueue); 3117 destroy_workqueue(data->workqueue); 3118 3119 btintel_pcie_free(data); 3120 3121 pci_clear_master(pdev); 3122 3123 pci_set_drvdata(pdev, NULL); 3124 } 3125 3126 #ifdef CONFIG_DEV_COREDUMP 3127 static void btintel_pcie_coredump(struct device *dev) 3128 { 3129 struct pci_dev *pdev = to_pci_dev(dev); 3130 struct btintel_pcie_data *data = pci_get_drvdata(pdev); 3131 3132 if (!data) 3133 return; 3134 3135 btintel_pcie_queue_coredump(data, 3136 BTINTEL_PCIE_TRIGGER_REASON_USER_TRIGGER); 3137 } 3138 #endif 3139 3140 static int btintel_pcie_set_dxstate(struct btintel_pcie_data *data, u32 dxstate) 3141 { 3142 int retry = 0, status; 3143 u32 dx_intr_timeout_ms = 200; 3144 3145 do { 3146 data->gp0_received = false; 3147 3148 btintel_pcie_wr_sleep_cntrl(data, dxstate); 3149 3150 status = wait_event_timeout(data->gp0_wait_q, data->gp0_received, 3151 msecs_to_jiffies(dx_intr_timeout_ms)); 3152 3153 if (status) 3154 return 0; 3155 3156 bt_dev_warn(data->hdev, 3157 "Timeout (%u ms) on alive interrupt for D%d entry, retry count %d", 3158 dx_intr_timeout_ms, dxstate, retry); 3159 3160 /* clear gp0 cause */ 3161 btintel_pcie_clr_reg_bits(data, 3162 BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES, 3163 BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0); 3164 3165 /* A hardware bug may cause the alive interrupt to be missed. 3166 * Check if the controller reached the expected state and retry 3167 * the operation only if it hasn't. 3168 */ 3169 if (dxstate == BTINTEL_PCIE_STATE_D0) { 3170 if (btintel_pcie_in_d0(data)) 3171 return 0; 3172 } else { 3173 if (btintel_pcie_in_d3(data)) 3174 return 0; 3175 } 3176 3177 } while (++retry < BTINTEL_PCIE_DX_TRANSITION_MAX_RETRIES); 3178 3179 return -EBUSY; 3180 } 3181 3182 static int btintel_pcie_suspend_late(struct device *dev, pm_message_t mesg) 3183 { 3184 struct pci_dev *pdev = to_pci_dev(dev); 3185 struct btintel_pcie_data *data; 3186 ktime_t start; 3187 u32 dxstate; 3188 int err; 3189 3190 data = pci_get_drvdata(pdev); 3191 3192 dxstate = (mesg.event == PM_EVENT_SUSPEND ? 3193 BTINTEL_PCIE_STATE_D3_HOT : BTINTEL_PCIE_STATE_D3_COLD); 3194 3195 data->pm_sx_event = mesg.event; 3196 3197 start = ktime_get(); 3198 3199 /* Refer: 6.4.11.7 -> Platform power management */ 3200 err = btintel_pcie_set_dxstate(data, dxstate); 3201 3202 if (err) 3203 return err; 3204 3205 bt_dev_dbg(data->hdev, 3206 "device entered into d3 state from d0 in %lld us", 3207 ktime_to_us(ktime_get() - start)); 3208 return err; 3209 } 3210 3211 static int btintel_pcie_suspend(struct device *dev) 3212 { 3213 return btintel_pcie_suspend_late(dev, PMSG_SUSPEND); 3214 } 3215 3216 static int btintel_pcie_hibernate(struct device *dev) 3217 { 3218 return btintel_pcie_suspend_late(dev, PMSG_HIBERNATE); 3219 } 3220 3221 static int btintel_pcie_freeze(struct device *dev) 3222 { 3223 return btintel_pcie_suspend_late(dev, PMSG_FREEZE); 3224 } 3225 3226 static int btintel_pcie_resume(struct device *dev) 3227 { 3228 struct pci_dev *pdev = to_pci_dev(dev); 3229 struct btintel_pcie_data *data; 3230 ktime_t start; 3231 int err; 3232 3233 data = pci_get_drvdata(pdev); 3234 data->gp0_received = false; 3235 3236 start = ktime_get(); 3237 3238 /* When the system enters S4 (hibernate) mode, bluetooth device loses 3239 * power, which results in the erasure of its loaded firmware. 3240 * Consequently, function level reset (flr) is required on system 3241 * resume to bring the controller back into an operational state by 3242 * initiating a new firmware download. 3243 */ 3244 3245 if (data->pm_sx_event == PM_EVENT_FREEZE || 3246 data->pm_sx_event == PM_EVENT_HIBERNATE) { 3247 set_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags); 3248 btintel_pcie_request_reset(data, BTINTEL_PCIE_IOSF_PRR_FLR); 3249 return 0; 3250 } 3251 3252 /* Refer: 6.4.11.7 -> Platform power management */ 3253 err = btintel_pcie_set_dxstate(data, BTINTEL_PCIE_STATE_D0); 3254 3255 if (err == 0) { 3256 bt_dev_dbg(data->hdev, 3257 "device entered into d0 state from d3 in %lld us", 3258 ktime_to_us(ktime_get() - start)); 3259 return err; 3260 } 3261 3262 /* Trigger function level reset if the controller is in error 3263 * state during resume() to bring back the controller to 3264 * operational mode 3265 */ 3266 3267 data->boot_stage_cache = btintel_pcie_rd_reg32(data, 3268 BTINTEL_PCIE_CSR_BOOT_STAGE_REG); 3269 if (btintel_pcie_in_error(data) || 3270 btintel_pcie_in_device_halt(data)) { 3271 bt_dev_err(data->hdev, "Controller in error state for D0 entry"); 3272 btintel_pcie_queue_coredump(data, 3273 BTINTEL_PCIE_TRIGGER_REASON_FW_ASSERT); 3274 set_bit(BTINTEL_PCIE_CORE_HALTED, &data->flags); 3275 btintel_pcie_request_reset(data, BTINTEL_PCIE_IOSF_PRR_FLR); 3276 } 3277 return err; 3278 } 3279 3280 static const struct dev_pm_ops btintel_pcie_pm_ops = { 3281 .suspend = btintel_pcie_suspend, 3282 .resume = btintel_pcie_resume, 3283 .freeze = btintel_pcie_freeze, 3284 .thaw = btintel_pcie_resume, 3285 .poweroff = btintel_pcie_hibernate, 3286 .restore = btintel_pcie_resume, 3287 }; 3288 3289 static struct pci_driver btintel_pcie_driver = { 3290 .name = KBUILD_MODNAME, 3291 .id_table = btintel_pcie_table, 3292 .probe = btintel_pcie_probe, 3293 .remove = btintel_pcie_remove, 3294 .driver.pm = pm_sleep_ptr(&btintel_pcie_pm_ops), 3295 .dev_groups = btintel_pcie_groups, 3296 #ifdef CONFIG_DEV_COREDUMP 3297 .driver.coredump = btintel_pcie_coredump 3298 #endif 3299 }; 3300 3301 static int __init btintel_pcie_init(void) 3302 { 3303 return pci_register_driver(&btintel_pcie_driver); 3304 } 3305 3306 static void __exit btintel_pcie_exit(void) 3307 { 3308 pci_unregister_driver(&btintel_pcie_driver); 3309 btintel_pcie_free_restart_list(); 3310 } 3311 3312 module_init(btintel_pcie_init); 3313 module_exit(btintel_pcie_exit); 3314 3315 MODULE_AUTHOR("Tedd Ho-Jeong An <tedd.an@intel.com>"); 3316 MODULE_DESCRIPTION("Intel Bluetooth PCIe transport driver ver " VERSION); 3317 MODULE_VERSION(VERSION); 3318 MODULE_LICENSE("GPL"); 3319