1 // SPDX-License-Identifier: ISC 2 /* Copyright (C) 2021 MediaTek Inc. 3 * 4 */ 5 #include <linux/module.h> 6 #include <linux/firmware.h> 7 #include <linux/usb.h> 8 #include <linux/iopoll.h> 9 #include <linux/overflow.h> 10 #include <linux/unaligned.h> 11 12 #include <net/bluetooth/bluetooth.h> 13 #include <net/bluetooth/hci_core.h> 14 15 #include "btmtk.h" 16 17 #define VERSION "0.1" 18 19 /* It is for mt79xx download rom patch*/ 20 #define MTK_FW_ROM_PATCH_HEADER_SIZE 32 21 #define MTK_FW_ROM_PATCH_GD_SIZE 64 22 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64 23 #define MTK_SEC_MAP_COMMON_SIZE 12 24 #define MTK_SEC_MAP_NEED_SEND_SIZE 52 25 #define MTK_SEC_MAP_LENGTH_SIZE 4 26 #define MTK_SEC_CBMCU_DESC 0x5 27 28 /* CBMCU WMT command flags */ 29 #define BTMTK_CBMCU_FLAG_QUERY_STATUS 0xF0 30 #define BTMTK_CBMCU_FLAG_ENABLE_PATCH 0xF1 31 32 /* It is for mt79xx iso data transmission setting */ 33 #define MTK_ISO_THRESHOLD 264 34 35 struct btmtk_patch_header { 36 u8 datetime[16]; 37 u8 platform[4]; 38 __le16 hwver; 39 __le16 swver; 40 __le32 magicnum; 41 } __packed; 42 43 struct btmtk_global_desc { 44 __le32 patch_ver; 45 __le32 sub_sys; 46 __le32 feature_opt; 47 __le32 section_num; 48 } __packed; 49 50 struct btmtk_section_map { 51 __le32 sectype; 52 __le32 secoffset; 53 __le32 secsize; 54 union { 55 __le32 u4SecSpec[13]; 56 struct { 57 __le32 dlAddr; 58 __le32 dlsize; 59 __le32 seckeyidx; 60 __le32 alignlen; 61 __le32 sectype; 62 __le32 dlmodecrctype; 63 __le32 crc; 64 __le32 reserved[6]; 65 } bin_info_spec; 66 }; 67 } __packed; 68 69 /* Reject a firmware image whose header, global descriptor or section map 70 * array does not fit in the file, and hand back the validated section 71 * count, so that the section map walks stay inside the firmware buffer. 72 */ 73 static int btmtk_fw_validate_layout(struct hci_dev *hdev, 74 const struct firmware *fw, 75 u32 *section_num) 76 { 77 const struct btmtk_global_desc *globaldesc; 78 size_t need; 79 80 if (fw->size < MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE) { 81 bt_dev_err(hdev, "Firmware too small: %zu bytes, need at least %u", 82 fw->size, 83 MTK_FW_ROM_PATCH_HEADER_SIZE + MTK_FW_ROM_PATCH_GD_SIZE); 84 return -EINVAL; 85 } 86 87 globaldesc = (const struct btmtk_global_desc *)(fw->data + 88 MTK_FW_ROM_PATCH_HEADER_SIZE); 89 *section_num = le32_to_cpu(globaldesc->section_num); 90 91 if (!*section_num) { 92 bt_dev_err(hdev, "Firmware declares no sections"); 93 return -EINVAL; 94 } 95 96 if (check_mul_overflow((size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE, 97 (size_t)*section_num, &need) || 98 check_add_overflow(need, 99 (size_t)(MTK_FW_ROM_PATCH_HEADER_SIZE + 100 MTK_FW_ROM_PATCH_GD_SIZE), 101 &need)) { 102 bt_dev_err(hdev, "Firmware section count too large: %u", 103 *section_num); 104 return -EINVAL; 105 } 106 107 if (fw->size < need) { 108 bt_dev_err(hdev, "Firmware truncated: %zu bytes, need %zu for %u sections", 109 fw->size, need, *section_num); 110 return -EINVAL; 111 } 112 113 return 0; 114 } 115 116 /* Reject a section whose payload does not lie within the firmware file. */ 117 static int btmtk_fw_validate_section(struct hci_dev *hdev, 118 const struct firmware *fw, int index, 119 u32 offset, u32 size) 120 { 121 if (offset > fw->size || size > fw->size - offset) { 122 bt_dev_err(hdev, "Firmware section %d out of bounds: offset=%u, size=%u, fw_size=%zu", 123 index, offset, size, fw->size); 124 return -EINVAL; 125 } 126 127 return 0; 128 } 129 130 static void btmtk_coredump(struct hci_dev *hdev) 131 { 132 int err; 133 134 err = __hci_cmd_send(hdev, 0xfd5b, 0, NULL); 135 if (err < 0) 136 bt_dev_err(hdev, "Coredump failed (%d)", err); 137 } 138 139 static void btmtk_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb) 140 { 141 struct btmtk_data *data = hci_get_priv(hdev); 142 char buf[80]; 143 144 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 145 data->dev_id); 146 skb_put_data(skb, buf, strlen(buf)); 147 148 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 149 data->cd_info.fw_version); 150 skb_put_data(skb, buf, strlen(buf)); 151 152 snprintf(buf, sizeof(buf), "Driver: %s\n", 153 data->cd_info.driver_name); 154 skb_put_data(skb, buf, strlen(buf)); 155 156 snprintf(buf, sizeof(buf), "Vendor: MediaTek\n"); 157 skb_put_data(skb, buf, strlen(buf)); 158 } 159 160 static void btmtk_coredump_notify(struct hci_dev *hdev, int state) 161 { 162 struct btmtk_data *data = hci_get_priv(hdev); 163 164 switch (state) { 165 case HCI_DEVCOREDUMP_IDLE: 166 data->cd_info.state = HCI_DEVCOREDUMP_IDLE; 167 break; 168 case HCI_DEVCOREDUMP_ACTIVE: 169 data->cd_info.state = HCI_DEVCOREDUMP_ACTIVE; 170 break; 171 case HCI_DEVCOREDUMP_TIMEOUT: 172 case HCI_DEVCOREDUMP_ABORT: 173 case HCI_DEVCOREDUMP_DONE: 174 data->cd_info.state = HCI_DEVCOREDUMP_IDLE; 175 btmtk_reset_sync(hdev); 176 break; 177 } 178 } 179 180 void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver, 181 u32 fw_flavor) 182 { 183 if (dev_id == 0x6639) 184 snprintf(buf, size, 185 "mediatek/mt7927/BT_RAM_CODE_MT%04x_2_%x_hdr.bin", 186 dev_id & 0xffff, (fw_ver & 0xff) + 1); 187 else if (dev_id == 0x7925) 188 snprintf(buf, size, 189 "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", 190 dev_id & 0xffff, dev_id & 0xffff, (fw_ver & 0xff) + 1); 191 /* MT7928 */ 192 else if (dev_id == 0x7935) 193 snprintf(buf, size, 194 "mediatek/mt7928/BT_RAM_CODE_MT%04x_1_1_hdr.bin", 195 dev_id & 0xffff); 196 else if (dev_id == 0x7961 && fw_flavor) 197 snprintf(buf, size, 198 "mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin", 199 dev_id & 0xffff, (fw_ver & 0xff) + 1); 200 else 201 snprintf(buf, size, 202 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", 203 dev_id & 0xffff, (fw_ver & 0xff) + 1); 204 } 205 EXPORT_SYMBOL_GPL(btmtk_fw_get_filename); 206 207 int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname, 208 wmt_cmd_sync_func_t wmt_cmd_sync, 209 u32 dev_id) 210 { 211 struct btmtk_hci_wmt_params wmt_params; 212 struct btmtk_patch_header *hdr; 213 struct btmtk_section_map *sectionmap; 214 const struct firmware *fw; 215 const u8 *fw_ptr; 216 const u8 *fw_bin_ptr; 217 int err, dlen, i, status; 218 u8 flag, first_block, retry; 219 u32 section_num, dl_size, section_offset; 220 u8 cmd[64]; 221 222 err = request_firmware(&fw, fwname, &hdev->dev); 223 if (err < 0) { 224 bt_dev_err(hdev, "Failed to load firmware file (%d)", err); 225 return err; 226 } 227 228 bt_dev_info(hdev, "Loading BT firmware: %s", fwname); 229 230 err = btmtk_fw_validate_layout(hdev, fw, §ion_num); 231 if (err < 0) 232 goto err_release_fw; 233 234 fw_ptr = fw->data; 235 fw_bin_ptr = fw_ptr; 236 hdr = (struct btmtk_patch_header *)fw_ptr; 237 238 bt_dev_info(hdev, "BT HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16s", 239 dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime); 240 241 for (i = 0; i < section_num; i++) { 242 first_block = 1; 243 fw_ptr = fw_bin_ptr; 244 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 245 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); 246 247 section_offset = le32_to_cpu(sectionmap->secoffset); 248 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize); 249 250 /* MT6639: only download sections where dlmode byte0 == 0x01, 251 * matching the Windows driver behavior which skips WiFi/other 252 * sections that would cause the chip to hang. 253 */ 254 if (dev_id == 0x6639 && dl_size > 0 && 255 (le32_to_cpu(sectionmap->bin_info_spec.dlmodecrctype) & 0xff) != 0x01) 256 continue; 257 258 if (dl_size > 0) { 259 err = btmtk_fw_validate_section(hdev, fw, i, 260 section_offset, dl_size); 261 if (err < 0) 262 goto err_release_fw; 263 264 retry = 20; 265 while (retry > 0) { 266 cmd[0] = 0; /* 0 means legacy dl mode. */ 267 memcpy(cmd + 1, 268 fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 269 MTK_FW_ROM_PATCH_GD_SIZE + 270 MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i + 271 MTK_SEC_MAP_COMMON_SIZE, 272 MTK_SEC_MAP_NEED_SEND_SIZE); 273 274 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 275 wmt_params.status = &status; 276 wmt_params.flag = 0; 277 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1; 278 wmt_params.data = &cmd; 279 280 err = wmt_cmd_sync(hdev, &wmt_params); 281 if (err < 0) { 282 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 283 err); 284 goto err_release_fw; 285 } 286 287 if (status == BTMTK_WMT_PATCH_UNDONE) { 288 break; 289 } else if (status == BTMTK_WMT_PATCH_PROGRESS) { 290 msleep(100); 291 retry--; 292 } else if (status == BTMTK_WMT_PATCH_DONE) { 293 goto next_section; 294 } else { 295 bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)", 296 status); 297 err = -EIO; 298 goto err_release_fw; 299 } 300 } 301 302 /* If retry exhausted goto err_release_fw */ 303 if (retry == 0) { 304 err = -EIO; 305 goto err_release_fw; 306 } 307 308 fw_ptr += section_offset; 309 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 310 311 while (dl_size > 0) { 312 dlen = min_t(int, 250, dl_size); 313 if (first_block == 1) { 314 flag = BTMTK_WMT_PKT_START; 315 first_block = 0; 316 } else if (dl_size - dlen <= 0) { 317 flag = BTMTK_WMT_PKT_END; 318 } else { 319 flag = BTMTK_WMT_PKT_CONTINUE; 320 } 321 322 wmt_params.flag = flag; 323 wmt_params.dlen = dlen; 324 wmt_params.data = fw_ptr; 325 326 err = wmt_cmd_sync(hdev, &wmt_params); 327 /* Status BTMTK_WMT_PATCH_PROGRESS indicates firmware is 328 * in process of being downloaded, which is not expected to 329 * occur here. 330 */ 331 if (status == BTMTK_WMT_PATCH_PROGRESS) { 332 err = -EIO; 333 goto err_release_fw; 334 } else if (err < 0) { 335 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 336 err); 337 goto err_release_fw; 338 } 339 340 dl_size -= dlen; 341 fw_ptr += dlen; 342 } 343 } 344 next_section: 345 continue; 346 } 347 /* Wait a few moments for firmware activation done */ 348 usleep_range(100000, 120000); 349 350 err_release_fw: 351 release_firmware(fw); 352 353 return err; 354 } 355 EXPORT_SYMBOL_GPL(btmtk_setup_firmware_79xx); 356 357 int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname, 358 wmt_cmd_sync_func_t wmt_cmd_sync) 359 { 360 struct btmtk_hci_wmt_params wmt_params; 361 const struct firmware *fw; 362 const u8 *fw_ptr; 363 size_t fw_size; 364 int err, dlen; 365 u8 flag, param; 366 367 err = request_firmware(&fw, fwname, &hdev->dev); 368 if (err < 0) { 369 bt_dev_err(hdev, "Failed to load firmware file (%d)", err); 370 return err; 371 } 372 373 /* Power on data RAM the firmware relies on. */ 374 param = 1; 375 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 376 wmt_params.flag = 3; 377 wmt_params.dlen = sizeof(param); 378 wmt_params.data = ¶m; 379 wmt_params.status = NULL; 380 381 err = wmt_cmd_sync(hdev, &wmt_params); 382 if (err < 0) { 383 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); 384 goto err_release_fw; 385 } 386 387 fw_ptr = fw->data; 388 fw_size = fw->size; 389 390 /* The size of patch header is 30 bytes, should be skip */ 391 if (fw_size < 30) { 392 err = -EINVAL; 393 goto err_release_fw; 394 } 395 396 fw_size -= 30; 397 fw_ptr += 30; 398 flag = BTMTK_WMT_PKT_START; 399 400 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 401 wmt_params.status = NULL; 402 403 while (fw_size > 0) { 404 dlen = min_t(int, 250, fw_size); 405 406 /* Tell device the position in sequence */ 407 if (fw_size - dlen <= 0) 408 flag = BTMTK_WMT_PKT_END; 409 else if (fw_size < fw->size - 30) 410 flag = BTMTK_WMT_PKT_CONTINUE; 411 412 wmt_params.flag = flag; 413 wmt_params.dlen = dlen; 414 wmt_params.data = fw_ptr; 415 416 err = wmt_cmd_sync(hdev, &wmt_params); 417 if (err < 0) { 418 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 419 err); 420 goto err_release_fw; 421 } 422 423 fw_size -= dlen; 424 fw_ptr += dlen; 425 } 426 427 wmt_params.op = BTMTK_WMT_RST; 428 wmt_params.flag = 4; 429 wmt_params.dlen = 0; 430 wmt_params.data = NULL; 431 wmt_params.status = NULL; 432 433 /* Activate function the firmware providing to */ 434 err = wmt_cmd_sync(hdev, &wmt_params); 435 if (err < 0) { 436 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err); 437 goto err_release_fw; 438 } 439 440 /* Wait a few moments for firmware activation done */ 441 usleep_range(10000, 12000); 442 443 err_release_fw: 444 release_firmware(fw); 445 446 return err; 447 } 448 EXPORT_SYMBOL_GPL(btmtk_setup_firmware); 449 450 int btmtk_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 451 { 452 struct sk_buff *skb; 453 long ret; 454 455 skb = __hci_cmd_sync(hdev, 0xfc1a, 6, bdaddr, HCI_INIT_TIMEOUT); 456 if (IS_ERR(skb)) { 457 ret = PTR_ERR(skb); 458 bt_dev_err(hdev, "changing Mediatek device address failed (%ld)", 459 ret); 460 return ret; 461 } 462 kfree_skb(skb); 463 464 return 0; 465 } 466 EXPORT_SYMBOL_GPL(btmtk_set_bdaddr); 467 468 void btmtk_reset_sync(struct hci_dev *hdev) 469 { 470 struct btmtk_data *reset_work = hci_get_priv(hdev); 471 int err; 472 473 hci_dev_lock(hdev); 474 475 err = hci_cmd_sync_queue(hdev, reset_work->reset_sync, NULL, NULL); 476 if (err) 477 bt_dev_err(hdev, "failed to reset (%d)", err); 478 479 hci_dev_unlock(hdev); 480 } 481 EXPORT_SYMBOL_GPL(btmtk_reset_sync); 482 483 int btmtk_register_coredump(struct hci_dev *hdev, const char *name, 484 u32 fw_version) 485 { 486 struct btmtk_data *data = hci_get_priv(hdev); 487 488 if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) 489 return -EOPNOTSUPP; 490 491 data->cd_info.fw_version = fw_version; 492 data->cd_info.state = HCI_DEVCOREDUMP_IDLE; 493 data->cd_info.driver_name = name; 494 495 return hci_devcd_register(hdev, btmtk_coredump, btmtk_coredump_hdr, 496 btmtk_coredump_notify); 497 } 498 EXPORT_SYMBOL_GPL(btmtk_register_coredump); 499 500 int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) 501 { 502 struct btmtk_data *data = hci_get_priv(hdev); 503 int err; 504 bool complete = false; 505 506 if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) { 507 kfree_skb(skb); 508 return 0; 509 } 510 511 switch (data->cd_info.state) { 512 case HCI_DEVCOREDUMP_IDLE: 513 err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE); 514 if (err < 0) { 515 kfree_skb(skb); 516 break; 517 } 518 data->cd_info.cnt = 0; 519 520 /* It is supposed coredump can be done within 5 seconds */ 521 schedule_delayed_work(&hdev->dump.dump_timeout, 522 msecs_to_jiffies(5000)); 523 fallthrough; 524 case HCI_DEVCOREDUMP_ACTIVE: 525 default: 526 /* Mediatek coredump data would be more than MTK_COREDUMP_NUM */ 527 if (data->cd_info.cnt >= MTK_COREDUMP_NUM && 528 skb->len > MTK_COREDUMP_END_LEN) 529 if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN], 530 MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1)) 531 complete = true; 532 533 err = hci_devcd_append(hdev, skb); 534 if (err < 0) 535 break; 536 data->cd_info.cnt++; 537 538 if (complete) { 539 bt_dev_info(hdev, "Mediatek coredump end"); 540 hci_devcd_complete(hdev); 541 } 542 543 break; 544 } 545 546 return err; 547 } 548 EXPORT_SYMBOL_GPL(btmtk_process_coredump); 549 550 #if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) 551 /* Known MT6639 (MT7927) Bluetooth USB devices. 552 * Used to scope the zero-CHIPID workaround to real MT6639 hardware, 553 * since some boards return 0x0000 from the MMIO chip ID register. 554 */ 555 static const struct { 556 u16 vendor; 557 u16 product; 558 } btmtk_mt6639_devs[] = { 559 { 0x0489, 0xe13a }, /* ASUS ROG Crosshair X870E Hero */ 560 { 0x0489, 0xe0fa }, /* Lenovo Legion Pro 7 16ARX9 */ 561 { 0x0489, 0xe10f }, /* Gigabyte Z790 AORUS MASTER X */ 562 { 0x0489, 0xe110 }, /* MSI X870E Ace Max */ 563 { 0x0489, 0xe116 }, /* TP-Link Archer TBE550E */ 564 { 0x13d3, 0x3588 }, /* ASUS ROG STRIX X870E-E */ 565 }; 566 567 static void btmtk_usb_wmt_recv(struct urb *urb) 568 { 569 struct hci_dev *hdev = urb->context; 570 struct btmtk_data *data = hci_get_priv(hdev); 571 struct sk_buff *skb; 572 int err; 573 574 if (urb->status == 0 && urb->actual_length > 0) { 575 hdev->stat.byte_rx += urb->actual_length; 576 577 /* WMT event shouldn't be fragmented and the size should be 578 * less than HCI_WMT_MAX_EVENT_SIZE. 579 */ 580 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC); 581 if (!skb) { 582 hdev->stat.err_rx++; 583 kfree(urb->setup_packet); 584 return; 585 } 586 587 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 588 skb_put_data(skb, urb->transfer_buffer, urb->actual_length); 589 590 /* When someone waits for the WMT event, the skb is being cloned 591 * and being processed the events from there then. 592 */ 593 if (test_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags)) { 594 data->evt_skb = skb_clone(skb, GFP_ATOMIC); 595 if (!data->evt_skb) { 596 kfree_skb(skb); 597 kfree(urb->setup_packet); 598 return; 599 } 600 } 601 602 err = hci_recv_frame(hdev, skb); 603 if (err < 0) { 604 kfree_skb(data->evt_skb); 605 data->evt_skb = NULL; 606 kfree(urb->setup_packet); 607 return; 608 } 609 610 if (test_and_clear_bit(BTMTK_TX_WAIT_VND_EVT, 611 &data->flags)) { 612 /* Barrier to sync with other CPUs */ 613 smp_mb__after_atomic(); 614 wake_up_bit(&data->flags, 615 BTMTK_TX_WAIT_VND_EVT); 616 } 617 kfree(urb->setup_packet); 618 return; 619 } else if (urb->status == -ENOENT) { 620 /* Avoid suspend failed when usb_kill_urb */ 621 kfree(urb->setup_packet); 622 return; 623 } 624 625 usb_mark_last_busy(data->udev); 626 627 /* The URB complete handler is still called with urb->actual_length = 0 628 * when the event is not available, so we should keep re-submitting 629 * URB until WMT event returns, Also, It's necessary to wait some time 630 * between the two consecutive control URBs to relax the target device 631 * to generate the event. Otherwise, the WMT event cannot return from 632 * the device successfully. 633 */ 634 udelay(500); 635 636 usb_anchor_urb(urb, data->ctrl_anchor); 637 err = usb_submit_urb(urb, GFP_ATOMIC); 638 if (err < 0) { 639 kfree(urb->setup_packet); 640 /* -EPERM: urb is being killed; 641 * -ENODEV: device got disconnected 642 */ 643 if (err != -EPERM && err != -ENODEV) 644 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 645 urb, -err); 646 usb_unanchor_urb(urb); 647 } 648 } 649 650 static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev) 651 { 652 struct btmtk_data *data = hci_get_priv(hdev); 653 struct usb_ctrlrequest *dr; 654 unsigned char *buf; 655 int err, size = 64; 656 unsigned int pipe; 657 struct urb *urb; 658 659 urb = usb_alloc_urb(0, GFP_KERNEL); 660 if (!urb) 661 return -ENOMEM; 662 663 dr = kmalloc_obj(*dr); 664 if (!dr) { 665 usb_free_urb(urb); 666 return -ENOMEM; 667 } 668 669 dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN; 670 dr->bRequest = 1; 671 dr->wIndex = cpu_to_le16(0); 672 dr->wValue = cpu_to_le16(48); 673 dr->wLength = cpu_to_le16(size); 674 675 buf = kmalloc(size, GFP_KERNEL); 676 if (!buf) { 677 kfree(dr); 678 usb_free_urb(urb); 679 return -ENOMEM; 680 } 681 682 pipe = usb_rcvctrlpipe(data->udev, 0); 683 684 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 685 buf, size, btmtk_usb_wmt_recv, hdev); 686 687 urb->transfer_flags |= URB_FREE_BUFFER; 688 689 usb_anchor_urb(urb, data->ctrl_anchor); 690 err = usb_submit_urb(urb, GFP_KERNEL); 691 if (err < 0) { 692 if (err != -EPERM && err != -ENODEV) 693 bt_dev_err(hdev, "urb %p submission failed (%d)", 694 urb, -err); 695 kfree(dr); 696 usb_unanchor_urb(urb); 697 } 698 699 usb_free_urb(urb); 700 701 return err; 702 } 703 704 static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev, 705 struct btmtk_hci_wmt_params *wmt_params) 706 { 707 struct btmtk_data *data = hci_get_priv(hdev); 708 struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc; 709 u32 hlen, status = BTMTK_WMT_INVALID; 710 struct btmtk_hci_wmt_evt *wmt_evt; 711 struct btmtk_hci_wmt_cmd *wc; 712 struct btmtk_wmt_hdr *hdr; 713 int err; 714 715 /* Send the WMT command and wait until the WMT event returns */ 716 hlen = sizeof(*hdr) + wmt_params->dlen; 717 if (hlen > 255) 718 return -EINVAL; 719 720 wc = kzalloc(hlen, GFP_KERNEL); 721 if (!wc) 722 return -ENOMEM; 723 724 hdr = &wc->hdr; 725 hdr->dir = 1; 726 hdr->op = wmt_params->op; 727 hdr->dlen = cpu_to_le16(wmt_params->dlen + 1); 728 hdr->flag = wmt_params->flag; 729 memcpy(wc->data, wmt_params->data, wmt_params->dlen); 730 731 set_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags); 732 733 /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling, 734 * it needs constantly polling control pipe until the host received the 735 * WMT event, thus, we should require to specifically acquire PM counter 736 * on the USB to prevent the interface from entering auto suspended 737 * while WMT cmd/event in progress. 738 */ 739 err = usb_autopm_get_interface(data->intf); 740 if (err < 0) 741 goto err_free_wc; 742 743 err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc); 744 745 if (err < 0) { 746 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags); 747 usb_autopm_put_interface(data->intf); 748 goto err_free_wc; 749 } 750 751 /* Submit control IN URB on demand to process the WMT event */ 752 err = btmtk_usb_submit_wmt_recv_urb(hdev); 753 754 usb_autopm_put_interface(data->intf); 755 756 if (err < 0) 757 goto err_free_wc; 758 759 /* The vendor specific WMT commands are all answered by a vendor 760 * specific event and will have the Command Status or Command 761 * Complete as with usual HCI command flow control. 762 * 763 * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT 764 * state to be cleared. The driver specific event receive routine 765 * will clear that state and with that indicate completion of the 766 * WMT command. 767 */ 768 err = wait_on_bit_timeout(&data->flags, BTMTK_TX_WAIT_VND_EVT, 769 TASK_UNINTERRUPTIBLE, HCI_INIT_TIMEOUT); 770 771 if (err) { 772 bt_dev_err(hdev, "Execution of wmt command timed out"); 773 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags); 774 err = -ETIMEDOUT; 775 goto err_free_wc; 776 } 777 778 if (data->evt_skb == NULL) 779 goto err_free_wc; 780 781 wmt_evt = skb_pull_data(data->evt_skb, sizeof(*wmt_evt)); 782 if (!wmt_evt) { 783 bt_dev_err(hdev, "WMT event too short (%u bytes)", 784 data->evt_skb->len); 785 err = -EINVAL; 786 goto err_free_skb; 787 } 788 if (wmt_evt->whdr.op != hdr->op) { 789 bt_dev_err(hdev, "Wrong op received %d expected %d", 790 wmt_evt->whdr.op, hdr->op); 791 err = -EIO; 792 goto err_free_skb; 793 } 794 795 switch (wmt_evt->whdr.op) { 796 case BTMTK_WMT_SEMAPHORE: 797 if (wmt_evt->whdr.flag == 2) 798 status = BTMTK_WMT_PATCH_UNDONE; 799 else 800 status = BTMTK_WMT_PATCH_DONE; 801 break; 802 case BTMTK_WMT_FUNC_CTRL: 803 if (!skb_pull_data(data->evt_skb, 804 sizeof(wmt_evt_funcc->status))) { 805 /* A plain enable/disable request is acked with just 806 * the WMT header and no trailing status word; the 807 * result is carried in the header's own flag byte. 808 */ 809 status = wmt_evt->whdr.flag ? BTMTK_WMT_ON_UNDONE : 810 BTMTK_WMT_ON_DONE; 811 break; 812 } 813 814 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt; 815 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404) 816 status = BTMTK_WMT_ON_DONE; 817 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420) 818 status = BTMTK_WMT_ON_PROGRESS; 819 else 820 status = BTMTK_WMT_ON_UNDONE; 821 break; 822 case BTMTK_WMT_PATCH_DWNLD: 823 case BTMTK_WMT_CBMCU_DWNLD: 824 if (wmt_evt->whdr.flag == 2) 825 status = BTMTK_WMT_PATCH_DONE; 826 else if (wmt_evt->whdr.flag == 1) 827 status = BTMTK_WMT_PATCH_PROGRESS; 828 else 829 status = BTMTK_WMT_PATCH_UNDONE; 830 break; 831 } 832 833 if (wmt_params->status) 834 *wmt_params->status = status; 835 836 err_free_skb: 837 kfree_skb(data->evt_skb); 838 data->evt_skb = NULL; 839 err_free_wc: 840 kfree(wc); 841 return err; 842 } 843 844 static int btmtk_usb_func_query(struct hci_dev *hdev) 845 { 846 struct btmtk_hci_wmt_params wmt_params; 847 int status, err; 848 u8 param = 0; 849 850 /* Query whether the function is enabled */ 851 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 852 wmt_params.flag = 4; 853 wmt_params.dlen = sizeof(param); 854 wmt_params.data = ¶m; 855 wmt_params.status = &status; 856 857 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params); 858 if (err < 0) { 859 bt_dev_err(hdev, "Failed to query function status (%d)", err); 860 return err; 861 } 862 863 return status; 864 } 865 866 static int btmtk_usb_uhw_reg_write(struct hci_dev *hdev, u32 reg, u32 val) 867 { 868 struct btmtk_data *data = hci_get_priv(hdev); 869 int pipe, err; 870 void *buf; 871 872 buf = kzalloc(4, GFP_KERNEL); 873 if (!buf) 874 return -ENOMEM; 875 876 put_unaligned_le32(val, buf); 877 878 pipe = usb_sndctrlpipe(data->udev, 0); 879 err = usb_control_msg(data->udev, pipe, 0x02, 880 0x5E, 881 reg >> 16, reg & 0xffff, 882 buf, 4, USB_CTRL_SET_TIMEOUT); 883 if (err < 0) 884 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err); 885 886 kfree(buf); 887 888 return err; 889 } 890 891 static int btmtk_usb_uhw_reg_read(struct hci_dev *hdev, u32 reg, u32 *val) 892 { 893 struct btmtk_data *data = hci_get_priv(hdev); 894 u8 buf[sizeof(u32)]; 895 int err; 896 897 *val = 0; 898 err = usb_control_msg_recv(data->udev, 0, 0x01, 899 0xDE, 900 reg >> 16, reg & 0xffff, 901 buf, sizeof(buf), USB_CTRL_GET_TIMEOUT, 902 GFP_KERNEL); 903 if (err) { 904 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err); 905 return err; 906 } 907 908 *val = get_unaligned_le32(buf); 909 bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val); 910 911 return 0; 912 } 913 914 static int btmtk_usb_reg_read(struct hci_dev *hdev, u32 reg, u32 *val) 915 { 916 struct btmtk_data *data = hci_get_priv(hdev); 917 u8 buf[sizeof(u32)]; 918 int err; 919 920 *val = 0; 921 err = usb_control_msg_recv(data->udev, 0, 0x63, 922 USB_TYPE_VENDOR | USB_DIR_IN, 923 reg >> 16, reg & 0xffff, 924 buf, sizeof(buf), USB_CTRL_GET_TIMEOUT, 925 GFP_KERNEL); 926 if (err < 0) 927 return err; 928 929 *val = get_unaligned_le32(buf); 930 931 return 0; 932 } 933 934 static int btmtk_usb_id_get(struct hci_dev *hdev, u32 reg, u32 *id) 935 { 936 return btmtk_usb_reg_read(hdev, reg, id); 937 } 938 939 static u32 btmtk_usb_reset_done(struct hci_dev *hdev) 940 { 941 u32 val = 0; 942 943 btmtk_usb_uhw_reg_read(hdev, MTK_BT_MISC, &val); 944 945 return val & MTK_BT_RST_DONE; 946 } 947 948 static int btmtk_cbmcu_patch_status(struct hci_dev *hdev, 949 wmt_cmd_sync_func_t wmt_cmd_sync, 950 u8 *patch_status) 951 { 952 struct btmtk_hci_wmt_params wmt_params; 953 int status = BTMTK_WMT_INVALID, err, retry = 20; 954 955 do { 956 wmt_params.op = BTMTK_WMT_CBMCU_DWNLD; 957 wmt_params.flag = BTMTK_CBMCU_FLAG_QUERY_STATUS; 958 wmt_params.dlen = 0; 959 wmt_params.data = NULL; 960 wmt_params.status = &status; 961 962 err = wmt_cmd_sync(hdev, &wmt_params); 963 if (err < 0) { 964 bt_dev_err(hdev, "Failed to query CBMCU patch status (%d)", err); 965 return err; 966 } 967 968 *patch_status = (u8)status; 969 970 if (*patch_status == BTMTK_WMT_PATCH_PROGRESS) { 971 msleep(100); 972 retry--; 973 } else { 974 break; 975 } 976 } while (retry > 0); 977 978 if (*patch_status == BTMTK_WMT_PATCH_PROGRESS) { 979 bt_dev_err(hdev, "CBMCU patch status query timeout"); 980 return -ETIMEDOUT; 981 } 982 983 return 0; 984 } 985 986 /* Ask the firmware for the status of the given CBMCU section. A status of 987 * BTMTK_WMT_PATCH_UNDONE means the section has to be downloaded by the 988 * Bluetooth driver, and 0 is returned so the caller downloads it. A section 989 * the firmware already has is not expected here, because 990 * btmtk_setup_cbmcu_firmware() only reaches this point when the CBMCU patch 991 * as a whole is not downloaded, but it is not an error either: 1 is returned 992 * so the caller leaves that section alone. Any other status is an error. 993 */ 994 static int btmtk_query_cbmcu_section(struct hci_dev *hdev, 995 wmt_cmd_sync_func_t wmt_cmd_sync, 996 u8 cbmcu_type, 997 const u8 *section_map, 998 u32 cert_len) 999 { 1000 struct btmtk_hci_wmt_params wmt_params; 1001 u8 cmd[64]; 1002 int status = BTMTK_WMT_INVALID, err, retry = 20; 1003 1004 cmd[0] = 0; 1005 cmd[1] = cbmcu_type; 1006 1007 if (cbmcu_type == 0) 1008 put_unaligned_le32(cert_len, &cmd[2]); 1009 else 1010 memcpy(&cmd[2], section_map, MTK_SEC_MAP_NEED_SEND_SIZE); 1011 1012 wmt_params.op = BTMTK_WMT_CBMCU_DWNLD; 1013 wmt_params.flag = 0; 1014 wmt_params.dlen = cbmcu_type ? 1015 MTK_SEC_MAP_NEED_SEND_SIZE + 2 : 1016 MTK_SEC_MAP_LENGTH_SIZE + 2; 1017 wmt_params.data = cmd; 1018 wmt_params.status = &status; 1019 1020 /* The CBMCU is shared with the Wi-Fi driver, which may be downloading 1021 * the same firmware. Wait while the other driver holds this section, 1022 * the same way btmtk_setup_firmware_79xx() does for the ROM patch. 1023 */ 1024 while (retry--) { 1025 err = wmt_cmd_sync(hdev, &wmt_params); 1026 if (err < 0) { 1027 bt_dev_err(hdev, "Failed to query CBMCU section (%d)", err); 1028 return err; 1029 } 1030 1031 switch (status) { 1032 case BTMTK_WMT_PATCH_UNDONE: 1033 /* This section has to be downloaded by the BT driver */ 1034 return 0; 1035 case BTMTK_WMT_PATCH_DONE: 1036 /* Already downloaded, nothing to do for this section */ 1037 return 1; 1038 case BTMTK_WMT_PATCH_PROGRESS: 1039 msleep(100); 1040 break; 1041 default: 1042 bt_dev_err(hdev, "CBMCU section query status error (%d)", 1043 status); 1044 return -EIO; 1045 } 1046 } 1047 1048 bt_dev_err(hdev, "CBMCU section query timeout"); 1049 return -ETIMEDOUT; 1050 } 1051 1052 static int btmtk_download_cbmcu_section(struct hci_dev *hdev, 1053 wmt_cmd_sync_func_t wmt_cmd_sync, 1054 const u8 *fw_data, 1055 u32 dl_size) 1056 { 1057 struct btmtk_hci_wmt_params wmt_params; 1058 u32 sent_len, total_size = dl_size; 1059 int err; 1060 1061 wmt_params.op = BTMTK_WMT_CBMCU_DWNLD; 1062 wmt_params.status = NULL; 1063 1064 while (dl_size > 0) { 1065 sent_len = min_t(u32, 250, dl_size); 1066 1067 if (dl_size == total_size) 1068 wmt_params.flag = BTMTK_WMT_PKT_START; 1069 else if (dl_size == sent_len) 1070 wmt_params.flag = BTMTK_WMT_PKT_END; 1071 else 1072 wmt_params.flag = BTMTK_WMT_PKT_CONTINUE; 1073 1074 wmt_params.dlen = sent_len; 1075 wmt_params.data = fw_data; 1076 1077 err = wmt_cmd_sync(hdev, &wmt_params); 1078 if (err < 0) { 1079 bt_dev_err(hdev, "Failed to send CBMCU section data (%d)", err); 1080 return err; 1081 } 1082 1083 dl_size -= sent_len; 1084 fw_data += sent_len; 1085 } 1086 1087 return 0; 1088 } 1089 1090 static int btmtk_enable_cbmcu_patch(struct hci_dev *hdev, 1091 wmt_cmd_sync_func_t wmt_cmd_sync) 1092 { 1093 struct btmtk_hci_wmt_params wmt_params; 1094 int err; 1095 1096 wmt_params.op = BTMTK_WMT_CBMCU_DWNLD; 1097 wmt_params.flag = BTMTK_CBMCU_FLAG_ENABLE_PATCH; 1098 wmt_params.dlen = 0; 1099 wmt_params.data = NULL; 1100 wmt_params.status = NULL; 1101 1102 err = wmt_cmd_sync(hdev, &wmt_params); 1103 if (err < 0) { 1104 bt_dev_err(hdev, "Failed to enable CBMCU patch (%d)", err); 1105 return err; 1106 } 1107 1108 return 0; 1109 } 1110 1111 static int btmtk_load_cbmcu_firmware(struct hci_dev *hdev, 1112 const char *fwname, 1113 wmt_cmd_sync_func_t wmt_cmd_sync, 1114 u32 dev_id) 1115 { 1116 struct btmtk_patch_header *hdr; 1117 struct btmtk_section_map *sectionmap; 1118 const struct firmware *fw; 1119 const u8 *fw_ptr; 1120 u8 *cert_buf = NULL; 1121 u32 section_num, section_offset, dl_size, i; 1122 size_t map_len, cert_len; 1123 bool phase1_done = false; 1124 int err; 1125 1126 err = request_firmware(&fw, fwname, &hdev->dev); 1127 if (err < 0) { 1128 bt_dev_err(hdev, "Failed to load CBMCU firmware file %s (%d)", 1129 fwname, err); 1130 return err; 1131 } 1132 1133 err = btmtk_fw_validate_layout(hdev, fw, §ion_num); 1134 if (err < 0) 1135 goto err_release_fw; 1136 1137 fw_ptr = fw->data; 1138 hdr = (struct btmtk_patch_header *)fw_ptr; 1139 1140 bt_dev_info(hdev, "CBMCU HW ver: 0x%04x, SW ver: 0x%04x, Build Time: %.16s", 1141 dev_id & 0xffff, le16_to_cpu(hdr->swver), hdr->datetime); 1142 1143 /* Phase 1: Download section type MTK_SEC_CBMCU_DESC */ 1144 for (i = 0; i < section_num; i++) { 1145 sectionmap = (struct btmtk_section_map *) 1146 (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 1147 MTK_FW_ROM_PATCH_GD_SIZE + 1148 (size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); 1149 1150 /* Only process MTK_SEC_CBMCU_DESC section in Phase 1 */ 1151 if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) != MTK_SEC_CBMCU_DESC) 1152 continue; 1153 1154 section_offset = le32_to_cpu(sectionmap->secoffset); 1155 /* Unlike the sections downloaded in Phase 2, this one carries 1156 * the signature blob rather than a download target, so its 1157 * length is secsize and not bin_info_spec.dlsize. 1158 */ 1159 dl_size = le32_to_cpu(sectionmap->secsize); 1160 1161 if (dl_size == 0) 1162 continue; 1163 1164 err = btmtk_fw_validate_section(hdev, fw, i, 1165 section_offset, dl_size); 1166 if (err < 0) 1167 goto err_release_fw; 1168 1169 map_len = MTK_FW_ROM_PATCH_GD_SIZE + 1170 (size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE * section_num; 1171 if (check_add_overflow(map_len, (size_t)dl_size, &cert_len) || 1172 cert_len > U32_MAX) { 1173 err = -EINVAL; 1174 goto err_release_fw; 1175 } 1176 1177 /* Build the certificate before the query, because the firmware 1178 * hands this section over to whoever is told to download it. 1179 */ 1180 cert_buf = kmalloc(cert_len, GFP_KERNEL | __GFP_NOWARN); 1181 if (!cert_buf) { 1182 err = -ENOMEM; 1183 goto err_release_fw; 1184 } 1185 1186 /* Global Descriptor + All Section Maps, then the section data */ 1187 memcpy(cert_buf, fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE, map_len); 1188 memcpy(cert_buf + map_len, fw_ptr + section_offset, dl_size); 1189 1190 /* Query cbmcu section */ 1191 err = btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 0, NULL, 1192 cert_len); 1193 if (err < 0) 1194 goto err_release_fw; 1195 1196 /* Download the section unless the firmware already has it */ 1197 if (!err) { 1198 err = btmtk_download_cbmcu_section(hdev, wmt_cmd_sync, 1199 cert_buf, cert_len); 1200 if (err < 0) { 1201 bt_dev_err(hdev, "Failed to download CBMCU Phase 1 section (%d)", 1202 err); 1203 goto err_release_fw; 1204 } 1205 } 1206 1207 kfree(cert_buf); 1208 cert_buf = NULL; 1209 phase1_done = true; 1210 break; 1211 } 1212 1213 if (!phase1_done) { 1214 bt_dev_err(hdev, "CBMCU firmware has no Phase 1 section"); 1215 err = -EINVAL; 1216 goto err_release_fw; 1217 } 1218 1219 /* Phase 2: Download other sections (type != MTK_SEC_CBMCU_DESC) */ 1220 for (i = 0; i < section_num; i++) { 1221 sectionmap = (struct btmtk_section_map *) 1222 (fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 1223 MTK_FW_ROM_PATCH_GD_SIZE + 1224 (size_t)MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); 1225 1226 /* Skip MTK_SEC_CBMCU_DESC section in Phase 2 */ 1227 if ((le32_to_cpu(sectionmap->sectype) & 0xFFFF) == MTK_SEC_CBMCU_DESC) 1228 continue; 1229 1230 section_offset = le32_to_cpu(sectionmap->secoffset); 1231 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize); 1232 1233 if (dl_size == 0) 1234 continue; 1235 1236 err = btmtk_fw_validate_section(hdev, fw, i, 1237 section_offset, dl_size); 1238 if (err < 0) 1239 goto err_release_fw; 1240 1241 /* Query cbmcu section */ 1242 err = btmtk_query_cbmcu_section(hdev, wmt_cmd_sync, 1, 1243 (u8 *)§ionmap->bin_info_spec, 1244 0); 1245 if (err < 0) 1246 goto err_release_fw; 1247 1248 /* Nothing to do if the firmware already has this section */ 1249 if (err) 1250 continue; 1251 1252 /* Download section data */ 1253 err = btmtk_download_cbmcu_section(hdev, wmt_cmd_sync, 1254 fw_ptr + section_offset, 1255 dl_size); 1256 if (err < 0) { 1257 bt_dev_err(hdev, "Failed to download CBMCU section %u (%d)", i, err); 1258 goto err_release_fw; 1259 } 1260 } 1261 1262 /* A section the firmware already had leaves err > 0 */ 1263 err = 0; 1264 bt_dev_info(hdev, "CBMCU firmware download completed"); 1265 1266 err_release_fw: 1267 kfree(cert_buf); 1268 release_firmware(fw); 1269 return err; 1270 } 1271 1272 static int btmtk_setup_cbmcu_firmware(struct hci_dev *hdev, 1273 wmt_cmd_sync_func_t wmt_cmd_sync, 1274 u32 dev_id) 1275 { 1276 char cbmcu_fwname[64]; 1277 u8 patch_status; 1278 int err; 1279 1280 err = btmtk_cbmcu_patch_status(hdev, wmt_cmd_sync, &patch_status); 1281 if (err < 0) 1282 return err; 1283 1284 bt_dev_dbg(hdev, "CBMCU patch status: 0x%02x", patch_status); 1285 1286 /* Nothing to do if the firmware is already running */ 1287 if (patch_status == BTMTK_WMT_PATCH_DONE) 1288 return 0; 1289 1290 if (patch_status != BTMTK_WMT_PATCH_UNDONE) { 1291 bt_dev_err(hdev, "Unexpected CBMCU patch status (0x%02x)", 1292 patch_status); 1293 return -EIO; 1294 } 1295 1296 snprintf(cbmcu_fwname, sizeof(cbmcu_fwname), 1297 "mediatek/mt7928/CBMCU_CODE_MT%04x_1_1.bin", 1298 dev_id & 0xffff); 1299 1300 bt_dev_info(hdev, "Loading CBMCU firmware: %s", cbmcu_fwname); 1301 1302 err = btmtk_load_cbmcu_firmware(hdev, cbmcu_fwname, wmt_cmd_sync, dev_id); 1303 if (err < 0) { 1304 bt_dev_err(hdev, "Failed to download CBMCU firmware (%d)", err); 1305 return err; 1306 } 1307 1308 err = btmtk_enable_cbmcu_patch(hdev, wmt_cmd_sync); 1309 if (err < 0) 1310 return err; 1311 1312 return 0; 1313 } 1314 1315 int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id) 1316 { 1317 int reset_err = 0; 1318 u32 val; 1319 int err; 1320 1321 if (dev_id == 0x7922) { 1322 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val); 1323 if (err) 1324 return err; 1325 val |= 0x00002020; 1326 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val); 1327 if (err < 0) 1328 return err; 1329 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001); 1330 if (err < 0) 1331 return err; 1332 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val); 1333 if (err) 1334 return err; 1335 val |= BIT(0); 1336 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val); 1337 if (err < 0) 1338 return err; 1339 msleep(100); 1340 } else if (dev_id == 0x7925 || dev_id == 0x6639) { 1341 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val); 1342 if (err) 1343 return err; 1344 val |= (1 << 5); 1345 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val); 1346 if (err < 0) 1347 return err; 1348 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val); 1349 if (err) 1350 return err; 1351 val &= 0xFFFF00FF; 1352 val |= (1 << 13); 1353 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val); 1354 if (err < 0) 1355 return err; 1356 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001); 1357 if (err < 0) 1358 return err; 1359 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val); 1360 if (err) 1361 return err; 1362 val |= (1 << 0); 1363 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val); 1364 if (err < 0) 1365 return err; 1366 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF); 1367 if (err < 0) 1368 return err; 1369 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val); 1370 if (err) 1371 return err; 1372 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF); 1373 if (err < 0) 1374 return err; 1375 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val); 1376 if (err) 1377 return err; 1378 msleep(100); 1379 } else if (dev_id == 0x7935) { 1380 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val); 1381 if (err) 1382 return err; 1383 val |= BIT(31); 1384 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val); 1385 if (err < 0) 1386 return err; 1387 } else { 1388 /* It's Device EndPoint Reset Option Register */ 1389 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw"); 1390 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT); 1391 if (err < 0) 1392 return err; 1393 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_WDT_STATUS, &val); 1394 if (err) 1395 return err; 1396 /* Reset the bluetooth chip via USB interface. */ 1397 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 1); 1398 if (err < 0) 1399 return err; 1400 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF); 1401 if (err < 0) 1402 return err; 1403 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val); 1404 if (err) 1405 return err; 1406 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF); 1407 if (err < 0) 1408 return err; 1409 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val); 1410 if (err) 1411 return err; 1412 /* MT7921 need to delay 20ms between toggle reset bit */ 1413 msleep(20); 1414 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 0); 1415 if (err < 0) 1416 return err; 1417 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val); 1418 if (err) 1419 return err; 1420 } 1421 1422 err = readx_poll_timeout(btmtk_usb_reset_done, hdev, val, 1423 val & MTK_BT_RST_DONE, 20000, 1000000); 1424 if (err < 0) { 1425 bt_dev_err(hdev, "Reset timeout"); 1426 reset_err = err; 1427 } 1428 1429 if (dev_id == 0x7922) { 1430 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF); 1431 if (err < 0) 1432 return err; 1433 } 1434 1435 err = btmtk_usb_id_get(hdev, 0x70010200, &val); 1436 if (err || (!val && dev_id != 0x6639)) { 1437 bt_dev_err(hdev, "Can't get device id, subsys reset fail."); 1438 return err ? err : -ENODEV; 1439 } 1440 1441 return reset_err; 1442 } 1443 EXPORT_SYMBOL_GPL(btmtk_usb_subsys_reset); 1444 1445 int btmtk_usb_recv_acl(struct hci_dev *hdev, struct sk_buff *skb) 1446 { 1447 struct btmtk_data *data = hci_get_priv(hdev); 1448 u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle); 1449 1450 /* The handles below are vendor-reserved values MTK firmware uses to 1451 * tag out-of-band debug/dump data on the ACL channel rather than a 1452 * real connection. Each is always sent as a single, complete 1453 * ACL_START packet, so unlike genuine connection data they never 1454 * arrive fragmented (e.g. 0x2efd is never followed by an ACL_CONT 1455 * continuation, 0x1efd). 1456 */ 1457 switch (handle) { 1458 case 0xfc6f: /* Firmware dump from device */ 1459 /* When the firmware hangs, the device can no longer 1460 * suspend and thus disable auto-suspend. 1461 */ 1462 usb_disable_autosuspend(data->udev); 1463 1464 /* We need to forward the diagnostic packet to userspace daemon 1465 * for backward compatibility, so we have to clone the packet 1466 * extraly for the in-kernel coredump support. 1467 */ 1468 if (IS_ENABLED(CONFIG_DEV_COREDUMP)) { 1469 struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC); 1470 1471 if (skb_cd) 1472 btmtk_process_coredump(hdev, skb_cd); 1473 } 1474 1475 fallthrough; 1476 case 0x05ff: /* Firmware debug logging 1 */ 1477 case 0x05fe: /* Firmware debug logging 2 */ 1478 case 0x2efd: /* Firmware debug event */ 1479 return hci_recv_diag(hdev, skb); 1480 } 1481 1482 return hci_recv_frame(hdev, skb); 1483 } 1484 EXPORT_SYMBOL_GPL(btmtk_usb_recv_acl); 1485 1486 static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb) 1487 { 1488 if (skb->len > MTK_ISO_THRESHOLD) 1489 return -EINVAL; 1490 1491 /* On error, the skb is freed by hci_send_frame(). */ 1492 return __skb_put_padto(skb, MTK_ISO_THRESHOLD, false); 1493 } 1494 1495 static int __set_mtk_intr_interface(struct hci_dev *hdev) 1496 { 1497 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1498 struct usb_interface *intf = btmtk_data->isopkt_intf; 1499 int err; 1500 1501 if (!btmtk_data->isopkt_intf) 1502 return -ENODEV; 1503 1504 err = usb_set_interface(btmtk_data->udev, MTK_ISO_IFNUM, 1505 (intf->num_altsetting > 1) ? 1 : 0); 1506 if (err < 0) { 1507 bt_dev_err(hdev, "setting interface failed (%d)", -err); 1508 return err; 1509 } 1510 1511 err = usb_find_common_endpoints(intf->cur_altsetting, NULL, NULL, 1512 &btmtk_data->isopkt_rx_ep, 1513 &btmtk_data->isopkt_tx_ep); 1514 if (err) { 1515 bt_dev_err(hdev, "invalid interrupt descriptors"); 1516 return -ENODEV; 1517 } 1518 1519 return 0; 1520 } 1521 1522 struct urb *alloc_mtk_intr_urb(struct hci_dev *hdev, struct sk_buff *skb, 1523 usb_complete_t tx_complete) 1524 { 1525 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1526 struct urb *urb; 1527 unsigned int pipe; 1528 1529 if (!btmtk_data->isopkt_tx_ep) 1530 return ERR_PTR(-ENODEV); 1531 1532 urb = usb_alloc_urb(0, GFP_KERNEL); 1533 if (!urb) 1534 return ERR_PTR(-ENOMEM); 1535 1536 if (btmtk_isopkt_pad(hdev, skb)) { 1537 usb_free_urb(urb); 1538 return ERR_PTR(-EINVAL); 1539 } 1540 1541 pipe = usb_sndintpipe(btmtk_data->udev, 1542 btmtk_data->isopkt_tx_ep->bEndpointAddress); 1543 1544 usb_fill_int_urb(urb, btmtk_data->udev, pipe, 1545 skb->data, skb->len, tx_complete, 1546 skb, btmtk_data->isopkt_tx_ep->bInterval); 1547 1548 skb->dev = (void *)hdev; 1549 1550 return urb; 1551 } 1552 EXPORT_SYMBOL_GPL(alloc_mtk_intr_urb); 1553 1554 static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count) 1555 { 1556 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1557 struct sk_buff *skb; 1558 unsigned long flags; 1559 int err = 0; 1560 1561 spin_lock_irqsave(&btmtk_data->isorxlock, flags); 1562 skb = btmtk_data->isopkt_skb; 1563 1564 while (count) { 1565 int len; 1566 1567 if (!skb) { 1568 skb = bt_skb_alloc(HCI_MAX_ISO_SIZE, GFP_ATOMIC); 1569 if (!skb) { 1570 err = -ENOMEM; 1571 break; 1572 } 1573 1574 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; 1575 hci_skb_expect(skb) = HCI_ISO_HDR_SIZE; 1576 } 1577 1578 len = min_t(uint, hci_skb_expect(skb), count); 1579 skb_put_data(skb, buffer, len); 1580 1581 count -= len; 1582 buffer += len; 1583 hci_skb_expect(skb) -= len; 1584 1585 if (skb->len == HCI_ISO_HDR_SIZE) { 1586 __le16 dlen = ((struct hci_iso_hdr *)skb->data)->dlen; 1587 1588 /* Complete ISO header */ 1589 hci_skb_expect(skb) = __le16_to_cpu(dlen); 1590 1591 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 1592 kfree_skb(skb); 1593 skb = NULL; 1594 1595 err = -EILSEQ; 1596 break; 1597 } 1598 } 1599 1600 if (!hci_skb_expect(skb)) { 1601 /* Complete frame */ 1602 hci_recv_frame(hdev, skb); 1603 skb = NULL; 1604 } 1605 } 1606 1607 btmtk_data->isopkt_skb = skb; 1608 spin_unlock_irqrestore(&btmtk_data->isorxlock, flags); 1609 1610 return err; 1611 } 1612 1613 static void btmtk_intr_complete(struct urb *urb) 1614 { 1615 struct hci_dev *hdev = urb->context; 1616 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1617 int err; 1618 1619 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1620 urb->actual_length); 1621 1622 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1623 return; 1624 1625 if (hdev->suspended) 1626 return; 1627 1628 if (urb->status == 0) { 1629 hdev->stat.byte_rx += urb->actual_length; 1630 1631 if (btmtk_recv_isopkt(hdev, urb->transfer_buffer, 1632 urb->actual_length) < 0) { 1633 bt_dev_err(hdev, "corrupted iso packet"); 1634 hdev->stat.err_rx++; 1635 } 1636 } else if (urb->status == -ENOENT) { 1637 /* Avoid suspend failed when usb_kill_urb */ 1638 return; 1639 } 1640 1641 usb_mark_last_busy(btmtk_data->udev); 1642 usb_anchor_urb(urb, &btmtk_data->isopkt_anchor); 1643 1644 err = usb_submit_urb(urb, GFP_ATOMIC); 1645 if (err < 0) { 1646 /* -EPERM: urb is being killed; 1647 * -ENODEV: device got disconnected 1648 */ 1649 if (err != -EPERM && err != -ENODEV) 1650 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1651 urb, -err); 1652 if (err != -EPERM) 1653 hci_cmd_sync_cancel(hdev, -err); 1654 usb_unanchor_urb(urb); 1655 } 1656 } 1657 1658 static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 1659 { 1660 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1661 unsigned char *buf; 1662 unsigned int pipe; 1663 struct urb *urb; 1664 int err, size; 1665 1666 BT_DBG("%s", hdev->name); 1667 1668 if (!btmtk_data->isopkt_rx_ep) 1669 return -ENODEV; 1670 1671 urb = usb_alloc_urb(0, mem_flags); 1672 if (!urb) 1673 return -ENOMEM; 1674 size = le16_to_cpu(btmtk_data->isopkt_rx_ep->wMaxPacketSize); 1675 1676 buf = kmalloc(size, mem_flags); 1677 if (!buf) { 1678 usb_free_urb(urb); 1679 return -ENOMEM; 1680 } 1681 1682 pipe = usb_rcvintpipe(btmtk_data->udev, 1683 btmtk_data->isopkt_rx_ep->bEndpointAddress); 1684 1685 usb_fill_int_urb(urb, btmtk_data->udev, pipe, buf, size, 1686 btmtk_intr_complete, hdev, 1687 btmtk_data->isopkt_rx_ep->bInterval); 1688 1689 urb->transfer_flags |= URB_FREE_BUFFER; 1690 1691 usb_mark_last_busy(btmtk_data->udev); 1692 usb_anchor_urb(urb, &btmtk_data->isopkt_anchor); 1693 1694 err = usb_submit_urb(urb, mem_flags); 1695 if (err < 0) { 1696 if (err != -EPERM && err != -ENODEV) 1697 bt_dev_err(hdev, "urb %p submission failed (%d)", 1698 urb, -err); 1699 usb_unanchor_urb(urb); 1700 } 1701 1702 usb_free_urb(urb); 1703 1704 return err; 1705 } 1706 1707 static int btmtk_usb_isointf_init(struct hci_dev *hdev) 1708 { 1709 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1710 u8 iso_param[2] = { 0x08, 0x01 }; 1711 struct sk_buff *skb; 1712 int err; 1713 1714 spin_lock_init(&btmtk_data->isorxlock); 1715 1716 __set_mtk_intr_interface(hdev); 1717 1718 err = btmtk_submit_intr_urb(hdev, GFP_KERNEL); 1719 if (err < 0) { 1720 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor); 1721 bt_dev_err(hdev, "ISO intf not support (%d)", err); 1722 return err; 1723 } 1724 1725 skb = __hci_cmd_sync(hdev, 0xfd98, sizeof(iso_param), iso_param, 1726 HCI_INIT_TIMEOUT); 1727 if (IS_ERR(skb)) { 1728 bt_dev_err(hdev, "Failed to apply iso setting (%ld)", PTR_ERR(skb)); 1729 return PTR_ERR(skb); 1730 } 1731 kfree_skb(skb); 1732 1733 return 0; 1734 } 1735 1736 int btmtk_usb_resume(struct hci_dev *hdev) 1737 { 1738 /* This function describes the specific additional steps taken by MediaTek 1739 * when Bluetooth usb driver's resume function is called. 1740 */ 1741 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1742 1743 /* Resubmit urb for iso data transmission */ 1744 if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags)) { 1745 if (btmtk_submit_intr_urb(hdev, GFP_NOIO) < 0) 1746 clear_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags); 1747 } 1748 1749 return 0; 1750 } 1751 EXPORT_SYMBOL_GPL(btmtk_usb_resume); 1752 1753 int btmtk_usb_suspend(struct hci_dev *hdev) 1754 { 1755 /* This function describes the specific additional steps taken by MediaTek 1756 * when Bluetooth usb driver's suspend function is called. 1757 */ 1758 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1759 1760 /* Stop urb anchor for iso data transmission */ 1761 if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags)) 1762 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor); 1763 1764 return 0; 1765 } 1766 EXPORT_SYMBOL_GPL(btmtk_usb_suspend); 1767 1768 int btmtk_usb_setup(struct hci_dev *hdev) 1769 { 1770 struct btmtk_data *btmtk_data = hci_get_priv(hdev); 1771 struct btmtk_hci_wmt_params wmt_params; 1772 ktime_t calltime, delta, rettime; 1773 struct btmtk_tci_sleep tci_sleep; 1774 unsigned long long duration; 1775 struct sk_buff *skb; 1776 const char *fwname; 1777 int err, status; 1778 u32 dev_id = 0; 1779 char fw_bin_name[64]; 1780 u32 fw_version = 0, fw_flavor = 0; 1781 u8 param; 1782 1783 calltime = ktime_get(); 1784 1785 err = btmtk_usb_id_get(hdev, 0x80000008, &dev_id); 1786 if (err) { 1787 bt_dev_err(hdev, "Failed to get device id (%d)", err); 1788 return err; 1789 } 1790 1791 if (!dev_id || dev_id != 0x7663) { 1792 err = btmtk_usb_id_get(hdev, 0x70010200, &dev_id); 1793 if (err) { 1794 bt_dev_err(hdev, "Failed to get device id (%d)", err); 1795 return err; 1796 } 1797 err = btmtk_usb_id_get(hdev, 0x80021004, &fw_version); 1798 if (err) { 1799 bt_dev_err(hdev, "Failed to get fw version (%d)", err); 1800 return err; 1801 } 1802 err = btmtk_usb_id_get(hdev, 0x70010020, &fw_flavor); 1803 if (err) { 1804 bt_dev_err(hdev, "Failed to get fw flavor (%d)", err); 1805 return err; 1806 } 1807 fw_flavor = (fw_flavor & 0x00000080) >> 7; 1808 } 1809 1810 if (!dev_id) { 1811 u16 vid = le16_to_cpu(btmtk_data->udev->descriptor.idVendor); 1812 u16 pid = le16_to_cpu(btmtk_data->udev->descriptor.idProduct); 1813 int i; 1814 1815 for (i = 0; i < ARRAY_SIZE(btmtk_mt6639_devs); i++) { 1816 if (vid == btmtk_mt6639_devs[i].vendor && 1817 pid == btmtk_mt6639_devs[i].product) { 1818 dev_id = 0x6639; 1819 break; 1820 } 1821 } 1822 1823 if (dev_id) 1824 bt_dev_info(hdev, "MT6639: CHIPID=0x0000 with VID=%04x PID=%04x, using 0x6639", 1825 vid, pid); 1826 } 1827 1828 btmtk_data->dev_id = dev_id; 1829 1830 err = btmtk_register_coredump(hdev, btmtk_data->drv_name, fw_version); 1831 if (err < 0) 1832 bt_dev_err(hdev, "Failed to register coredump (%d)", err); 1833 1834 switch (dev_id) { 1835 case 0x7663: 1836 fwname = FIRMWARE_MT7663; 1837 break; 1838 case 0x7668: 1839 fwname = FIRMWARE_MT7668; 1840 break; 1841 case 0x7935: 1842 /* Requires CBMCU firmware before BT firmware */ 1843 err = btmtk_setup_cbmcu_firmware(hdev, btmtk_usb_hci_wmt_sync, 1844 dev_id); 1845 /* Carry on with the BT firmware even if this failed. The Wi-Fi 1846 * driver may be downloading the same CBMCU firmware and finish 1847 * it on its own, and if the CBMCU is left unusable the BT 1848 * firmware download below fails and triggers the one-shot 1849 * btmtk_reset_sync() recovery. 1850 */ 1851 if (err < 0) 1852 bt_dev_warn(hdev, "Failed to set up CBMCU firmware (%d)", 1853 err); 1854 fallthrough; 1855 case 0x7922: 1856 case 0x7925: 1857 case 0x7961: 1858 case 0x7902: 1859 case 0x6639: 1860 btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id, 1861 fw_version, fw_flavor); 1862 1863 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name, 1864 btmtk_usb_hci_wmt_sync, 1865 dev_id); 1866 if (err < 0) { 1867 /* retry once if setup firmware error */ 1868 if (!test_and_set_bit(BTMTK_FIRMWARE_DL_RETRY, &btmtk_data->flags)) 1869 btmtk_reset_sync(hdev); 1870 bt_dev_err(hdev, "Failed to set up firmware (%d)", err); 1871 return err; 1872 } 1873 1874 /* It's Device EndPoint Reset Option Register */ 1875 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 1876 MTK_EP_RST_IN_OUT_OPT); 1877 if (err < 0) 1878 return err; 1879 1880 /* Enable Bluetooth protocol */ 1881 param = 1; 1882 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 1883 wmt_params.flag = 0; 1884 wmt_params.dlen = sizeof(param); 1885 wmt_params.data = ¶m; 1886 wmt_params.status = NULL; 1887 1888 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params); 1889 if (err < 0) { 1890 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 1891 1892 if (dev_id == 0x7925 && err == -ETIMEDOUT) 1893 btmtk_reset_sync(hdev); 1894 1895 return err; 1896 } 1897 1898 hci_set_msft_opcode(hdev, 0xFD30); 1899 hci_set_aosp_capable(hdev); 1900 1901 /* Clear BTMTK_FIRMWARE_DL_RETRY if setup successfully */ 1902 test_and_clear_bit(BTMTK_FIRMWARE_DL_RETRY, &btmtk_data->flags); 1903 1904 /* Set up ISO interface after protocol enabled */ 1905 if (test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) { 1906 if (!btmtk_usb_isointf_init(hdev)) 1907 set_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags); 1908 } 1909 1910 goto done; 1911 default: 1912 bt_dev_err(hdev, "Unsupported hardware variant (%08x)", 1913 dev_id); 1914 return -ENODEV; 1915 } 1916 1917 /* Query whether the firmware is already download */ 1918 wmt_params.op = BTMTK_WMT_SEMAPHORE; 1919 wmt_params.flag = 1; 1920 wmt_params.dlen = 0; 1921 wmt_params.data = NULL; 1922 wmt_params.status = &status; 1923 1924 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params); 1925 if (err < 0) { 1926 bt_dev_err(hdev, "Failed to query firmware status (%d)", err); 1927 return err; 1928 } 1929 1930 if (status == BTMTK_WMT_PATCH_DONE) { 1931 bt_dev_info(hdev, "firmware already downloaded"); 1932 goto ignore_setup_fw; 1933 } 1934 1935 /* Setup a firmware which the device definitely requires */ 1936 err = btmtk_setup_firmware(hdev, fwname, 1937 btmtk_usb_hci_wmt_sync); 1938 if (err < 0) 1939 return err; 1940 1941 ignore_setup_fw: 1942 err = readx_poll_timeout(btmtk_usb_func_query, hdev, status, 1943 status < 0 || status != BTMTK_WMT_ON_PROGRESS, 1944 2000, 5000000); 1945 /* -ETIMEDOUT happens */ 1946 if (err < 0) 1947 return err; 1948 1949 /* The other errors happen in btmtk_usb_func_query */ 1950 if (status < 0) 1951 return status; 1952 1953 if (status == BTMTK_WMT_ON_DONE) { 1954 bt_dev_info(hdev, "function already on"); 1955 goto ignore_func_on; 1956 } 1957 1958 /* Enable Bluetooth protocol */ 1959 param = 1; 1960 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 1961 wmt_params.flag = 0; 1962 wmt_params.dlen = sizeof(param); 1963 wmt_params.data = ¶m; 1964 wmt_params.status = NULL; 1965 1966 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params); 1967 if (err < 0) { 1968 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 1969 return err; 1970 } 1971 1972 ignore_func_on: 1973 /* Apply the low power environment setup */ 1974 tci_sleep.mode = 0x5; 1975 tci_sleep.duration = cpu_to_le16(0x640); 1976 tci_sleep.host_duration = cpu_to_le16(0x640); 1977 tci_sleep.host_wakeup_pin = 0; 1978 tci_sleep.time_compensation = 0; 1979 1980 skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep, 1981 HCI_INIT_TIMEOUT); 1982 if (IS_ERR(skb)) { 1983 err = PTR_ERR(skb); 1984 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err); 1985 return err; 1986 } 1987 kfree_skb(skb); 1988 1989 done: 1990 rettime = ktime_get(); 1991 delta = ktime_sub(rettime, calltime); 1992 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1993 1994 bt_dev_info(hdev, "Device setup in %llu usecs", duration); 1995 1996 return 0; 1997 } 1998 EXPORT_SYMBOL_GPL(btmtk_usb_setup); 1999 2000 int btmtk_usb_shutdown(struct hci_dev *hdev) 2001 { 2002 struct btmtk_data *data = hci_get_priv(hdev); 2003 struct btmtk_hci_wmt_params wmt_params; 2004 u8 param = 0; 2005 int err; 2006 2007 err = usb_autopm_get_interface(data->intf); 2008 if (err < 0) 2009 return err; 2010 2011 /* Disable the device */ 2012 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 2013 wmt_params.flag = 0; 2014 wmt_params.dlen = sizeof(param); 2015 wmt_params.data = ¶m; 2016 wmt_params.status = NULL; 2017 2018 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params); 2019 if (err < 0) { 2020 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 2021 usb_autopm_put_interface(data->intf); 2022 return err; 2023 } 2024 2025 usb_autopm_put_interface(data->intf); 2026 return 0; 2027 } 2028 EXPORT_SYMBOL_GPL(btmtk_usb_shutdown); 2029 2030 int btmtk_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 2031 { 2032 struct hci_event_hdr *hdr = (void *)skb->data; 2033 struct hci_ev_cmd_complete *ec; 2034 2035 if (hdr->evt == HCI_EV_CMD_COMPLETE && 2036 skb->len >= HCI_EVENT_HDR_SIZE + sizeof(*ec)) { 2037 u16 opcode; 2038 2039 ec = (void *)(skb->data + HCI_EVENT_HDR_SIZE); 2040 opcode = __le16_to_cpu(ec->opcode); 2041 2042 /* Filter vendor opcode */ 2043 if (opcode == 0xfc5d) { 2044 kfree_skb(skb); 2045 return 0; 2046 } 2047 } 2048 2049 return hci_recv_frame(hdev, skb); 2050 } 2051 EXPORT_SYMBOL_GPL(btmtk_recv_event); 2052 #endif 2053 2054 MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>"); 2055 MODULE_AUTHOR("Mark Chen <mark-yw.chen@mediatek.com>"); 2056 MODULE_DESCRIPTION("Bluetooth support for MediaTek devices ver " VERSION); 2057 MODULE_VERSION(VERSION); 2058 MODULE_LICENSE("GPL"); 2059 MODULE_FIRMWARE(FIRMWARE_MT7622); 2060 MODULE_FIRMWARE(FIRMWARE_MT7663); 2061 MODULE_FIRMWARE(FIRMWARE_MT7668); 2062 MODULE_FIRMWARE(FIRMWARE_MT7922); 2063 MODULE_FIRMWARE(FIRMWARE_MT7961); 2064 MODULE_FIRMWARE(FIRMWARE_MT7920); 2065 MODULE_FIRMWARE(FIRMWARE_MT7925); 2066 MODULE_FIRMWARE(FIRMWARE_MT7927); 2067 MODULE_FIRMWARE(FIRMWARE_MT7928); 2068 MODULE_FIRMWARE(FIRMWARE_MT7928_CBMCU); 2069