xref: /linux/drivers/bluetooth/btmtksdio.c (revision 35c2c39832e569449b9192fa1afbbc4c66227af7)
1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2019 MediaTek Inc.
3 
4 /*
5  * Bluetooth support for MediaTek SDIO devices
6  *
7  * This file is written based on btsdio.c and btmtkuart.c.
8  *
9  * Author: Sean Wang <sean.wang@mediatek.com>
10  *
11  */
12 
13 #include <linux/unaligned.h>
14 #include <linux/atomic.h>
15 #include <linux/gpio/consumer.h>
16 #include <linux/init.h>
17 #include <linux/iopoll.h>
18 #include <linux/kernel.h>
19 #include <linux/module.h>
20 #include <linux/of.h>
21 #include <linux/pm_runtime.h>
22 #include <linux/skbuff.h>
23 #include <linux/usb.h>
24 
25 #include <linux/mmc/host.h>
26 #include <linux/mmc/sdio_ids.h>
27 #include <linux/mmc/sdio_func.h>
28 
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 
32 #include "hci_uart.h"
33 #include "btmtk.h"
34 
35 #define VERSION "0.1"
36 
37 #define MTKBTSDIO_AUTOSUSPEND_DELAY	1000
38 
39 static bool enable_autosuspend = true;
40 
41 struct btmtksdio_data {
42 	const char *fwname;
43 	u16 chipid;
44 	bool lp_mbox_supported;
45 	bool pm_runtime_supported;
46 };
47 
48 static const struct btmtksdio_data mt7663_data = {
49 	.fwname = FIRMWARE_MT7663,
50 	.chipid = 0x7663,
51 	.lp_mbox_supported = false,
52 	.pm_runtime_supported = true,
53 };
54 
55 static const struct btmtksdio_data mt7668_data = {
56 	.fwname = FIRMWARE_MT7668,
57 	.chipid = 0x7668,
58 	.lp_mbox_supported = false,
59 	.pm_runtime_supported = true,
60 };
61 
62 static const struct btmtksdio_data mt7921_data = {
63 	.fwname = FIRMWARE_MT7961,
64 	.chipid = 0x7921,
65 	.lp_mbox_supported = true,
66 	.pm_runtime_supported = true,
67 };
68 
69 static const struct btmtksdio_data mt7902_data = {
70 	.fwname = FIRMWARE_MT7902,
71 	.chipid = 0x7902,
72 	.lp_mbox_supported = false,
73 	.pm_runtime_supported = false,
74 };
75 
76 static const struct sdio_device_id btmtksdio_table[] = {
77 	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7663),
78 	 .driver_data = (kernel_ulong_t)&mt7663_data },
79 	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7668),
80 	 .driver_data = (kernel_ulong_t)&mt7668_data },
81 	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7961),
82 	 .driver_data = (kernel_ulong_t)&mt7921_data },
83 	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7902),
84 	.driver_data = (kernel_ulong_t)&mt7902_data },
85 	{ }	/* Terminating entry */
86 };
87 MODULE_DEVICE_TABLE(sdio, btmtksdio_table);
88 
89 #define MTK_REG_CHLPCR		0x4	/* W1S */
90 #define C_INT_EN_SET		BIT(0)
91 #define C_INT_EN_CLR		BIT(1)
92 #define C_FW_OWN_REQ_SET	BIT(8)  /* For write */
93 #define C_COM_DRV_OWN		BIT(8)  /* For read */
94 #define C_FW_OWN_REQ_CLR	BIT(9)
95 
96 #define MTK_REG_CSDIOCSR	0x8
97 #define SDIO_RE_INIT_EN		BIT(0)
98 #define SDIO_INT_CTL		BIT(2)
99 
100 #define MTK_REG_CHCR		0xc
101 #define C_INT_CLR_CTRL		BIT(1)
102 #define BT_RST_DONE		BIT(8)
103 
104 /* CHISR have the same bits field definition with CHIER */
105 #define MTK_REG_CHISR		0x10
106 #define MTK_REG_CHIER		0x14
107 #define FW_OWN_BACK_INT		BIT(0)
108 #define RX_DONE_INT		BIT(1)
109 #define TX_EMPTY		BIT(2)
110 #define TX_FIFO_OVERFLOW	BIT(8)
111 #define FW_MAILBOX_INT		BIT(15)
112 #define INT_MASK		GENMASK(15, 0)
113 #define RX_PKT_LEN		GENMASK(31, 16)
114 
115 #define MTK_REG_CSICR		0xc0
116 #define CSICR_CLR_MBOX_ACK BIT(0)
117 #define MTK_REG_PH2DSM0R	0xc4
118 #define PH2DSM0R_DRIVER_OWN	BIT(0)
119 #define MTK_REG_PD2HRM0R	0xdc
120 #define PD2HRM0R_DRV_OWN	BIT(0)
121 
122 #define MTK_REG_CTDR		0x18
123 
124 #define MTK_REG_CRDR		0x1c
125 
126 #define MTK_REG_CRPLR		0x24
127 
128 #define MTK_SDIO_BLOCK_SIZE	256
129 
130 #define BTMTKSDIO_TX_WAIT_VND_EVT	1
131 #define BTMTKSDIO_HW_TX_READY		2
132 #define BTMTKSDIO_FUNC_ENABLED		3
133 #define BTMTKSDIO_PATCH_ENABLED		4
134 #define BTMTKSDIO_HW_RESET_ACTIVE	5
135 #define BTMTKSDIO_BT_WAKE_ENABLED	6
136 
137 struct mtkbtsdio_hdr {
138 	__le16	len;
139 	__le16	reserved;
140 	u8	bt_type;
141 } __packed;
142 
143 struct btmtksdio_dev {
144 	struct hci_dev *hdev;
145 	struct sdio_func *func;
146 	struct device *dev;
147 
148 	struct work_struct txrx_work;
149 	unsigned long tx_state;
150 	struct sk_buff_head txq;
151 
152 	struct sk_buff *evt_skb;
153 
154 	const struct btmtksdio_data *data;
155 
156 	struct gpio_desc *reset;
157 };
158 
159 static int mtk_hci_wmt_sync(struct hci_dev *hdev,
160 			    struct btmtk_hci_wmt_params *wmt_params)
161 {
162 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
163 	struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
164 	struct btmtk_hci_wmt_evt_reg *wmt_evt_reg;
165 	u32 hlen, status = BTMTK_WMT_INVALID;
166 	struct btmtk_hci_wmt_evt *wmt_evt;
167 	struct btmtk_hci_wmt_cmd *wc;
168 	struct btmtk_wmt_hdr *hdr;
169 	int err;
170 
171 	/* Send the WMT command and wait until the WMT event returns */
172 	hlen = sizeof(*hdr) + wmt_params->dlen;
173 	if (hlen > 255)
174 		return -EINVAL;
175 
176 	wc = kzalloc(hlen, GFP_KERNEL);
177 	if (!wc)
178 		return -ENOMEM;
179 
180 	hdr = &wc->hdr;
181 	hdr->dir = 1;
182 	hdr->op = wmt_params->op;
183 	hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
184 	hdr->flag = wmt_params->flag;
185 	memcpy(wc->data, wmt_params->data, wmt_params->dlen);
186 
187 	set_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
188 
189 	err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
190 	if (err < 0) {
191 		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
192 		goto err_free_wc;
193 	}
194 
195 	/* The vendor specific WMT commands are all answered by a vendor
196 	 * specific event and will not have the Command Status or Command
197 	 * Complete as with usual HCI command flow control.
198 	 *
199 	 * After sending the command, wait for BTMTKSDIO_TX_WAIT_VND_EVT
200 	 * state to be cleared. The driver specific event receive routine
201 	 * will clear that state and with that indicate completion of the
202 	 * WMT command.
203 	 */
204 	err = wait_on_bit_timeout(&bdev->tx_state, BTMTKSDIO_TX_WAIT_VND_EVT,
205 				  TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
206 	if (err == -EINTR) {
207 		bt_dev_err(hdev, "Execution of wmt command interrupted");
208 		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
209 		goto err_free_wc;
210 	}
211 
212 	if (err) {
213 		bt_dev_err(hdev, "Execution of wmt command timed out");
214 		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
215 		err = -ETIMEDOUT;
216 		goto err_free_wc;
217 	}
218 
219 	/* Parse and handle the return WMT event */
220 	wmt_evt = (struct btmtk_hci_wmt_evt *)bdev->evt_skb->data;
221 	if (wmt_evt->whdr.op != hdr->op) {
222 		bt_dev_err(hdev, "Wrong op received %d expected %d",
223 			   wmt_evt->whdr.op, hdr->op);
224 		err = -EIO;
225 		goto err_free_skb;
226 	}
227 
228 	switch (wmt_evt->whdr.op) {
229 	case BTMTK_WMT_SEMAPHORE:
230 		if (wmt_evt->whdr.flag == 2)
231 			status = BTMTK_WMT_PATCH_UNDONE;
232 		else
233 			status = BTMTK_WMT_PATCH_DONE;
234 		break;
235 	case BTMTK_WMT_FUNC_CTRL:
236 		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
237 		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
238 			status = BTMTK_WMT_ON_DONE;
239 		else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
240 			status = BTMTK_WMT_ON_PROGRESS;
241 		else
242 			status = BTMTK_WMT_ON_UNDONE;
243 		break;
244 	case BTMTK_WMT_PATCH_DWNLD:
245 		if (wmt_evt->whdr.flag == 2)
246 			status = BTMTK_WMT_PATCH_DONE;
247 		else if (wmt_evt->whdr.flag == 1)
248 			status = BTMTK_WMT_PATCH_PROGRESS;
249 		else
250 			status = BTMTK_WMT_PATCH_UNDONE;
251 		break;
252 	case BTMTK_WMT_REGISTER:
253 		wmt_evt_reg = (struct btmtk_hci_wmt_evt_reg *)wmt_evt;
254 		if (le16_to_cpu(wmt_evt->whdr.dlen) == 12)
255 			status = le32_to_cpu(wmt_evt_reg->val);
256 		break;
257 	}
258 
259 	if (wmt_params->status)
260 		*wmt_params->status = status;
261 
262 err_free_skb:
263 	kfree_skb(bdev->evt_skb);
264 	bdev->evt_skb = NULL;
265 err_free_wc:
266 	kfree(wc);
267 
268 	return err;
269 }
270 
271 static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
272 			       struct sk_buff *skb)
273 {
274 	struct mtkbtsdio_hdr *sdio_hdr;
275 	int err;
276 
277 	/* Make sure that there are enough rooms for SDIO header */
278 	if (unlikely(skb_headroom(skb) < sizeof(*sdio_hdr))) {
279 		err = pskb_expand_head(skb, sizeof(*sdio_hdr), 0,
280 				       GFP_ATOMIC);
281 		if (err < 0)
282 			return err;
283 	}
284 
285 	/* Prepend MediaTek SDIO Specific Header */
286 	skb_push(skb, sizeof(*sdio_hdr));
287 
288 	sdio_hdr = (void *)skb->data;
289 	sdio_hdr->len = cpu_to_le16(skb->len);
290 	sdio_hdr->reserved = cpu_to_le16(0);
291 	sdio_hdr->bt_type = hci_skb_pkt_type(skb);
292 
293 	clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
294 	err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
295 			   round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
296 	if (err < 0)
297 		goto err_skb_pull;
298 
299 	bdev->hdev->stat.byte_tx += skb->len;
300 
301 	kfree_skb(skb);
302 
303 	return 0;
304 
305 err_skb_pull:
306 	skb_pull(skb, sizeof(*sdio_hdr));
307 
308 	return err;
309 }
310 
311 static u32 btmtksdio_drv_own_query(struct btmtksdio_dev *bdev)
312 {
313 	return sdio_readl(bdev->func, MTK_REG_CHLPCR, NULL);
314 }
315 
316 static u32 btmtksdio_drv_own_query_79xx(struct btmtksdio_dev *bdev)
317 {
318 	return sdio_readl(bdev->func, MTK_REG_PD2HRM0R, NULL);
319 }
320 
321 static u32 btmtksdio_chcr_query(struct btmtksdio_dev *bdev)
322 {
323 	return sdio_readl(bdev->func, MTK_REG_CHCR, NULL);
324 }
325 
326 static int btmtksdio_fw_pmctrl(struct btmtksdio_dev *bdev)
327 {
328 	u32 status;
329 	int err;
330 
331 	sdio_claim_host(bdev->func);
332 
333 	if (bdev->data->lp_mbox_supported &&
334 	    test_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state)) {
335 		sdio_writel(bdev->func, CSICR_CLR_MBOX_ACK, MTK_REG_CSICR,
336 			    &err);
337 		err = readx_poll_timeout(btmtksdio_drv_own_query_79xx, bdev,
338 					 status, !(status & PD2HRM0R_DRV_OWN),
339 					 2000, 1000000);
340 		if (err < 0) {
341 			bt_dev_err(bdev->hdev, "mailbox ACK not cleared");
342 			goto out;
343 		}
344 	}
345 
346 	/* Return ownership to the device */
347 	sdio_writel(bdev->func, C_FW_OWN_REQ_SET, MTK_REG_CHLPCR, &err);
348 	if (err < 0)
349 		goto out;
350 
351 	err = readx_poll_timeout(btmtksdio_drv_own_query, bdev, status,
352 				 !(status & C_COM_DRV_OWN), 2000, 1000000);
353 
354 out:
355 	sdio_release_host(bdev->func);
356 
357 	if (err < 0)
358 		bt_dev_err(bdev->hdev, "Cannot return ownership to device");
359 
360 	return err;
361 }
362 
363 static int btmtksdio_drv_pmctrl(struct btmtksdio_dev *bdev)
364 {
365 	u32 status;
366 	int err;
367 
368 	sdio_claim_host(bdev->func);
369 
370 	/* Get ownership from the device */
371 	sdio_writel(bdev->func, C_FW_OWN_REQ_CLR, MTK_REG_CHLPCR, &err);
372 	if (err < 0)
373 		goto out;
374 
375 	err = readx_poll_timeout(btmtksdio_drv_own_query, bdev, status,
376 				 status & C_COM_DRV_OWN, 2000, 1000000);
377 
378 	if (!err && bdev->data->lp_mbox_supported &&
379 	    test_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state))
380 		err = readx_poll_timeout(btmtksdio_drv_own_query_79xx, bdev,
381 					 status, status & PD2HRM0R_DRV_OWN,
382 					 2000, 1000000);
383 
384 out:
385 	sdio_release_host(bdev->func);
386 
387 	if (err < 0)
388 		bt_dev_err(bdev->hdev, "Cannot get ownership from device");
389 
390 	return err;
391 }
392 
393 static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
394 {
395 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
396 	struct hci_event_hdr *hdr = (void *)skb->data;
397 	u8 evt = hdr->evt;
398 	int err;
399 
400 	/* When someone waits for the WMT event, the skb is being cloned
401 	 * and being processed the events from there then.
402 	 */
403 	if (test_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state)) {
404 		bdev->evt_skb = skb_clone(skb, GFP_KERNEL);
405 		if (!bdev->evt_skb) {
406 			err = -ENOMEM;
407 			goto err_out;
408 		}
409 	}
410 
411 	err = hci_recv_frame(hdev, skb);
412 	if (err < 0)
413 		goto err_free_skb;
414 
415 	if (evt == HCI_EV_WMT) {
416 		if (test_and_clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT,
417 				       &bdev->tx_state)) {
418 			/* Barrier to sync with other CPUs */
419 			smp_mb__after_atomic();
420 			wake_up_bit(&bdev->tx_state, BTMTKSDIO_TX_WAIT_VND_EVT);
421 		}
422 	}
423 
424 	return 0;
425 
426 err_free_skb:
427 	kfree_skb(bdev->evt_skb);
428 	bdev->evt_skb = NULL;
429 
430 err_out:
431 	return err;
432 }
433 
434 static int btmtksdio_recv_acl(struct hci_dev *hdev, struct sk_buff *skb)
435 {
436 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
437 	u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
438 
439 	switch (handle) {
440 	case 0xfc6f:
441 		/* Firmware dump from device: when the firmware hangs, the
442 		 * device can no longer suspend and thus disable auto-suspend.
443 		 */
444 		pm_runtime_forbid(bdev->dev);
445 		fallthrough;
446 	case 0x05ff:
447 	case 0x05fe:
448 		/* Firmware debug logging */
449 		return hci_recv_diag(hdev, skb);
450 	}
451 
452 	return hci_recv_frame(hdev, skb);
453 }
454 
455 static const struct h4_recv_pkt mtk_recv_pkts[] = {
456 	{ H4_RECV_ACL,      .recv = btmtksdio_recv_acl },
457 	{ H4_RECV_SCO,      .recv = hci_recv_frame },
458 	{ H4_RECV_EVENT,    .recv = btmtksdio_recv_event },
459 };
460 
461 static int btmtksdio_rx_packet(struct btmtksdio_dev *bdev, u16 rx_size)
462 {
463 	const struct h4_recv_pkt *pkts = mtk_recv_pkts;
464 	int pkts_count = ARRAY_SIZE(mtk_recv_pkts);
465 	struct mtkbtsdio_hdr *sdio_hdr;
466 	int err, i, pad_size;
467 	struct sk_buff *skb;
468 	u16 dlen;
469 
470 	if (rx_size < sizeof(*sdio_hdr))
471 		return -EILSEQ;
472 
473 	/* A SDIO packet is exactly containing a Bluetooth packet */
474 	skb = bt_skb_alloc(rx_size, GFP_KERNEL);
475 	if (!skb)
476 		return -ENOMEM;
477 
478 	skb_put(skb, rx_size);
479 
480 	err = sdio_readsb(bdev->func, skb->data, MTK_REG_CRDR, rx_size);
481 	if (err < 0)
482 		goto err_kfree_skb;
483 
484 	sdio_hdr = (void *)skb->data;
485 
486 	/* We assume the default error as -EILSEQ simply to make the error path
487 	 * be cleaner.
488 	 */
489 	err = -EILSEQ;
490 
491 	if (rx_size != le16_to_cpu(sdio_hdr->len)) {
492 		bt_dev_err(bdev->hdev, "Rx size in sdio header is mismatched ");
493 		goto err_kfree_skb;
494 	}
495 
496 	hci_skb_pkt_type(skb) = sdio_hdr->bt_type;
497 
498 	/* Remove MediaTek SDIO header */
499 	skb_pull(skb, sizeof(*sdio_hdr));
500 
501 	/* We have to dig into the packet to get payload size and then know how
502 	 * many padding bytes at the tail, these padding bytes should be removed
503 	 * before the packet is indicated to the core layer.
504 	 */
505 	for (i = 0; i < pkts_count; i++) {
506 		if (sdio_hdr->bt_type == (&pkts[i])->type)
507 			break;
508 	}
509 
510 	if (i >= pkts_count) {
511 		bt_dev_err(bdev->hdev, "Invalid bt type 0x%02x",
512 			   sdio_hdr->bt_type);
513 		goto err_kfree_skb;
514 	}
515 
516 	/* Remaining bytes cannot hold a header*/
517 	if (skb->len < (&pkts[i])->hlen) {
518 		bt_dev_err(bdev->hdev, "The size of bt header is mismatched");
519 		goto err_kfree_skb;
520 	}
521 
522 	switch ((&pkts[i])->lsize) {
523 	case 1:
524 		dlen = skb->data[(&pkts[i])->loff];
525 		break;
526 	case 2:
527 		dlen = get_unaligned_le16(skb->data +
528 						  (&pkts[i])->loff);
529 		break;
530 	default:
531 		goto err_kfree_skb;
532 	}
533 
534 	pad_size = skb->len - (&pkts[i])->hlen -  dlen;
535 
536 	/* Remaining bytes cannot hold a payload */
537 	if (pad_size < 0) {
538 		bt_dev_err(bdev->hdev, "The size of bt payload is mismatched");
539 		goto err_kfree_skb;
540 	}
541 
542 	/* Remove padding bytes */
543 	skb_trim(skb, skb->len - pad_size);
544 
545 	/* Complete frame */
546 	(&pkts[i])->recv(bdev->hdev, skb);
547 
548 	bdev->hdev->stat.byte_rx += rx_size;
549 
550 	return 0;
551 
552 err_kfree_skb:
553 	kfree_skb(skb);
554 
555 	return err;
556 }
557 
558 static void btmtksdio_txrx_work(struct work_struct *work)
559 {
560 	struct btmtksdio_dev *bdev = container_of(work, struct btmtksdio_dev,
561 						  txrx_work);
562 	unsigned long txrx_timeout;
563 	u32 int_status, rx_size;
564 	struct sk_buff *skb;
565 	int err;
566 
567 	pm_runtime_get_sync(bdev->dev);
568 
569 	sdio_claim_host(bdev->func);
570 
571 	/* Disable interrupt */
572 	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
573 
574 	txrx_timeout = jiffies + 5 * HZ;
575 
576 	do {
577 		int_status = sdio_readl(bdev->func, MTK_REG_CHISR, NULL);
578 
579 		/* Ack an interrupt as soon as possible before any operation on
580 		 * hardware.
581 		 *
582 		 * Note that we don't ack any status during operations to avoid race
583 		 * condition between the host and the device such as it's possible to
584 		 * mistakenly ack RX_DONE for the next packet and then cause interrupts
585 		 * not be raised again but there is still pending data in the hardware
586 		 * FIFO.
587 		 */
588 		sdio_writel(bdev->func, int_status, MTK_REG_CHISR, NULL);
589 		int_status &= INT_MASK;
590 
591 		if ((int_status & FW_MAILBOX_INT) &&
592 		    bdev->data->chipid == 0x7921) {
593 			sdio_writel(bdev->func, PH2DSM0R_DRIVER_OWN,
594 				    MTK_REG_PH2DSM0R, NULL);
595 		}
596 
597 		if (int_status & FW_OWN_BACK_INT)
598 			bt_dev_dbg(bdev->hdev, "Get fw own back");
599 
600 		if (int_status & TX_EMPTY)
601 			set_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
602 
603 		else if (unlikely(int_status & TX_FIFO_OVERFLOW))
604 			bt_dev_warn(bdev->hdev, "Tx fifo overflow");
605 
606 		if (test_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state)) {
607 			skb = skb_dequeue(&bdev->txq);
608 			if (skb) {
609 				err = btmtksdio_tx_packet(bdev, skb);
610 				if (err < 0) {
611 					bdev->hdev->stat.err_tx++;
612 					skb_queue_head(&bdev->txq, skb);
613 				}
614 			}
615 		}
616 
617 		if (int_status & RX_DONE_INT) {
618 			rx_size = sdio_readl(bdev->func, MTK_REG_CRPLR, NULL);
619 			rx_size = (rx_size & RX_PKT_LEN) >> 16;
620 			if (btmtksdio_rx_packet(bdev, rx_size) < 0)
621 				bdev->hdev->stat.err_rx++;
622 		}
623 	} while (int_status || time_is_before_jiffies(txrx_timeout));
624 
625 	/* Enable interrupt */
626 	if (bdev->func->irq_handler)
627 		sdio_writel(bdev->func, C_INT_EN_SET, MTK_REG_CHLPCR, NULL);
628 
629 	sdio_release_host(bdev->func);
630 
631 	pm_runtime_put_autosuspend(bdev->dev);
632 }
633 
634 static void btmtksdio_interrupt(struct sdio_func *func)
635 {
636 	struct btmtksdio_dev *bdev = sdio_get_drvdata(func);
637 
638 	if (test_bit(BTMTKSDIO_BT_WAKE_ENABLED, &bdev->tx_state)) {
639 		if (bdev->hdev->suspended)
640 			pm_wakeup_event(bdev->dev, 0);
641 		clear_bit(BTMTKSDIO_BT_WAKE_ENABLED, &bdev->tx_state);
642 	}
643 
644 	/* Disable interrupt */
645 	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
646 
647 	schedule_work(&bdev->txrx_work);
648 }
649 
650 static int btmtksdio_open(struct hci_dev *hdev)
651 {
652 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
653 	u32 val;
654 	int err;
655 
656 	sdio_claim_host(bdev->func);
657 
658 	err = sdio_enable_func(bdev->func);
659 	if (err < 0)
660 		goto err_release_host;
661 
662 	set_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state);
663 
664 	err = btmtksdio_drv_pmctrl(bdev);
665 	if (err < 0)
666 		goto err_disable_func;
667 
668 	/* Disable interrupt & mask out all interrupt sources */
669 	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, &err);
670 	if (err < 0)
671 		goto err_disable_func;
672 
673 	sdio_writel(bdev->func, 0, MTK_REG_CHIER, &err);
674 	if (err < 0)
675 		goto err_disable_func;
676 
677 	err = sdio_claim_irq(bdev->func, btmtksdio_interrupt);
678 	if (err < 0)
679 		goto err_disable_func;
680 
681 	err = sdio_set_block_size(bdev->func, MTK_SDIO_BLOCK_SIZE);
682 	if (err < 0)
683 		goto err_release_irq;
684 
685 	/* SDIO CMD 5 allows the SDIO device back to idle state an
686 	 * synchronous interrupt is supported in SDIO 4-bit mode
687 	 */
688 	val = sdio_readl(bdev->func, MTK_REG_CSDIOCSR, &err);
689 	if (err < 0)
690 		goto err_release_irq;
691 
692 	val |= SDIO_INT_CTL;
693 	sdio_writel(bdev->func, val, MTK_REG_CSDIOCSR, &err);
694 	if (err < 0)
695 		goto err_release_irq;
696 
697 	/* Explicitly set write-1-clear method */
698 	val = sdio_readl(bdev->func, MTK_REG_CHCR, &err);
699 	if (err < 0)
700 		goto err_release_irq;
701 
702 	val |= C_INT_CLR_CTRL;
703 	sdio_writel(bdev->func, val, MTK_REG_CHCR, &err);
704 	if (err < 0)
705 		goto err_release_irq;
706 
707 	/* Setup interrupt sources */
708 	sdio_writel(bdev->func, RX_DONE_INT | TX_EMPTY | TX_FIFO_OVERFLOW,
709 		    MTK_REG_CHIER, &err);
710 	if (err < 0)
711 		goto err_release_irq;
712 
713 	/* Enable interrupt */
714 	sdio_writel(bdev->func, C_INT_EN_SET, MTK_REG_CHLPCR, &err);
715 	if (err < 0)
716 		goto err_release_irq;
717 
718 	sdio_release_host(bdev->func);
719 
720 	return 0;
721 
722 err_release_irq:
723 	sdio_release_irq(bdev->func);
724 
725 err_disable_func:
726 	sdio_disable_func(bdev->func);
727 
728 err_release_host:
729 	sdio_release_host(bdev->func);
730 
731 	return err;
732 }
733 
734 static int btmtksdio_close(struct hci_dev *hdev)
735 {
736 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
737 
738 	/* Skip btmtksdio_close if BTMTKSDIO_FUNC_ENABLED isn't set */
739 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
740 		return 0;
741 
742 	sdio_claim_host(bdev->func);
743 
744 	/* Disable interrupt */
745 	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
746 
747 	sdio_release_irq(bdev->func);
748 
749 	cancel_work_sync(&bdev->txrx_work);
750 
751 	btmtksdio_fw_pmctrl(bdev);
752 
753 	clear_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state);
754 	sdio_disable_func(bdev->func);
755 
756 	sdio_release_host(bdev->func);
757 
758 	return 0;
759 }
760 
761 static int btmtksdio_flush(struct hci_dev *hdev)
762 {
763 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
764 
765 	skb_queue_purge(&bdev->txq);
766 
767 	cancel_work_sync(&bdev->txrx_work);
768 
769 	return 0;
770 }
771 
772 static int btmtksdio_func_query(struct hci_dev *hdev)
773 {
774 	struct btmtk_hci_wmt_params wmt_params;
775 	int status, err;
776 	u8 param = 0;
777 
778 	/* Query whether the function is enabled */
779 	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
780 	wmt_params.flag = 4;
781 	wmt_params.dlen = sizeof(param);
782 	wmt_params.data = &param;
783 	wmt_params.status = &status;
784 
785 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
786 	if (err < 0) {
787 		bt_dev_err(hdev, "Failed to query function status (%d)", err);
788 		return err;
789 	}
790 
791 	return status;
792 }
793 
794 static int mt76xx_setup(struct hci_dev *hdev, const char *fwname)
795 {
796 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
797 	struct btmtk_hci_wmt_params wmt_params;
798 	struct btmtk_tci_sleep tci_sleep;
799 	struct sk_buff *skb;
800 	int err, status;
801 	u8 param = 0x1;
802 
803 	/* Query whether the firmware is already download */
804 	wmt_params.op = BTMTK_WMT_SEMAPHORE;
805 	wmt_params.flag = 1;
806 	wmt_params.dlen = 0;
807 	wmt_params.data = NULL;
808 	wmt_params.status = &status;
809 
810 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
811 	if (err < 0) {
812 		bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
813 		return err;
814 	}
815 
816 	if (status == BTMTK_WMT_PATCH_DONE) {
817 		bt_dev_info(hdev, "Firmware already downloaded");
818 		goto ignore_setup_fw;
819 	}
820 
821 	/* Setup a firmware which the device definitely requires */
822 	err = btmtk_setup_firmware(hdev, fwname, mtk_hci_wmt_sync);
823 	if (err < 0)
824 		return err;
825 
826 ignore_setup_fw:
827 	/* Query whether the device is already enabled */
828 	err = readx_poll_timeout(btmtksdio_func_query, hdev, status,
829 				 status < 0 || status != BTMTK_WMT_ON_PROGRESS,
830 				 2000, 5000000);
831 	/* -ETIMEDOUT happens */
832 	if (err < 0)
833 		return err;
834 
835 	/* The other errors happen in btusb_mtk_func_query */
836 	if (status < 0)
837 		return status;
838 
839 	if (status == BTMTK_WMT_ON_DONE) {
840 		bt_dev_info(hdev, "function already on");
841 		goto ignore_func_on;
842 	}
843 
844 	/* Enable Bluetooth protocol */
845 	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
846 	wmt_params.flag = 0;
847 	wmt_params.dlen = sizeof(param);
848 	wmt_params.data = &param;
849 	wmt_params.status = NULL;
850 
851 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
852 	if (err < 0) {
853 		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
854 		return err;
855 	}
856 
857 	set_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
858 
859 ignore_func_on:
860 	/* Apply the low power environment setup */
861 	tci_sleep.mode = 0x5;
862 	tci_sleep.duration = cpu_to_le16(0x640);
863 	tci_sleep.host_duration = cpu_to_le16(0x640);
864 	tci_sleep.host_wakeup_pin = 0;
865 	tci_sleep.time_compensation = 0;
866 
867 	skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
868 			     HCI_INIT_TIMEOUT);
869 	if (IS_ERR(skb)) {
870 		err = PTR_ERR(skb);
871 		bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
872 		return err;
873 	}
874 	kfree_skb(skb);
875 
876 	return 0;
877 }
878 
879 static int mt79xx_setup(struct hci_dev *hdev, const char *fwname)
880 {
881 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
882 	struct btmtk_hci_wmt_params wmt_params;
883 	u8 param = 0x1;
884 	int err;
885 
886 	err = btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync, 0);
887 	if (err < 0) {
888 		bt_dev_err(hdev, "Failed to setup 79xx firmware (%d)", err);
889 		return err;
890 	}
891 
892 	err = btmtksdio_fw_pmctrl(bdev);
893 	if (err < 0)
894 		return err;
895 
896 	err = btmtksdio_drv_pmctrl(bdev);
897 	if (err < 0)
898 		return err;
899 
900 	/* Enable Bluetooth protocol */
901 	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
902 	wmt_params.flag = 0;
903 	wmt_params.dlen = sizeof(param);
904 	wmt_params.data = &param;
905 	wmt_params.status = NULL;
906 
907 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
908 	if (err < 0) {
909 		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
910 		return err;
911 	}
912 
913 	hci_set_msft_opcode(hdev, 0xFD30);
914 	hci_set_aosp_capable(hdev);
915 	set_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
916 
917 	return err;
918 }
919 
920 static int btmtksdio_mtk_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
921 {
922 	struct btmtk_hci_wmt_params wmt_params;
923 	struct reg_read_cmd reg_read = {
924 		.type = 1,
925 		.num = 1,
926 	};
927 	u32 status;
928 	int err;
929 
930 	reg_read.addr = cpu_to_le32(reg);
931 	wmt_params.op = BTMTK_WMT_REGISTER;
932 	wmt_params.flag = BTMTK_WMT_REG_READ;
933 	wmt_params.dlen = sizeof(reg_read);
934 	wmt_params.data = &reg_read;
935 	wmt_params.status = &status;
936 
937 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
938 	if (err < 0) {
939 		bt_dev_err(hdev, "Failed to read reg (%d)", err);
940 		return err;
941 	}
942 
943 	*val = status;
944 
945 	return err;
946 }
947 
948 static int btmtksdio_mtk_reg_write(struct hci_dev *hdev, u32 reg, u32 val, u32 mask)
949 {
950 	struct btmtk_hci_wmt_params wmt_params;
951 	const struct reg_write_cmd reg_write = {
952 		.type = 1,
953 		.num = 1,
954 		.addr = cpu_to_le32(reg),
955 		.data = cpu_to_le32(val),
956 		.mask = cpu_to_le32(mask),
957 	};
958 	int err, status;
959 
960 	wmt_params.op = BTMTK_WMT_REGISTER;
961 	wmt_params.flag = BTMTK_WMT_REG_WRITE;
962 	wmt_params.dlen = sizeof(reg_write);
963 	wmt_params.data = &reg_write;
964 	wmt_params.status = &status;
965 
966 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
967 	if (err < 0)
968 		bt_dev_err(hdev, "Failed to write reg (%d)", err);
969 
970 	return err;
971 }
972 
973 static int btmtksdio_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
974 {
975 	/* uses 1 as data path id for all the usecases */
976 	*data_path_id = 1;
977 	return 0;
978 }
979 
980 static int btmtksdio_get_codec_config_data(struct hci_dev *hdev,
981 					   __u8 link, struct bt_codec *codec,
982 					   __u8 *ven_len, __u8 **ven_data)
983 {
984 	int err = 0;
985 
986 	if (!ven_data || !ven_len)
987 		return -EINVAL;
988 
989 	*ven_len = 0;
990 	*ven_data = NULL;
991 
992 	if (link != ESCO_LINK) {
993 		bt_dev_err(hdev, "Invalid link type(%u)", link);
994 		return -EINVAL;
995 	}
996 
997 	*ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
998 	if (!*ven_data) {
999 		err = -ENOMEM;
1000 		goto error;
1001 	}
1002 
1003 	/* supports only CVSD and mSBC offload codecs */
1004 	switch (codec->id) {
1005 	case 0x02:
1006 		**ven_data = 0x00;
1007 		break;
1008 	case 0x05:
1009 		**ven_data = 0x01;
1010 		break;
1011 	default:
1012 		err = -EINVAL;
1013 		bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
1014 		goto error;
1015 	}
1016 	/* codec and its capabilities are pre-defined to ids
1017 	 * preset id = 0x00 represents CVSD codec with sampling rate 8K
1018 	 * preset id = 0x01 represents mSBC codec with sampling rate 16K
1019 	 */
1020 	*ven_len = sizeof(__u8);
1021 	return err;
1022 
1023 error:
1024 	kfree(*ven_data);
1025 	*ven_data = NULL;
1026 	return err;
1027 }
1028 
1029 static int btmtksdio_sco_setting(struct hci_dev *hdev)
1030 {
1031 	const struct btmtk_sco sco_setting = {
1032 		.clock_config = 0x49,
1033 		.channel_format_config = 0x80,
1034 	};
1035 	struct sk_buff *skb;
1036 	u32 val;
1037 	int err;
1038 
1039 	/* Enable SCO over I2S/PCM for MediaTek chipset */
1040 	skb =  __hci_cmd_sync(hdev, 0xfc72, sizeof(sco_setting),
1041 			      &sco_setting, HCI_CMD_TIMEOUT);
1042 	if (IS_ERR(skb))
1043 		return PTR_ERR(skb);
1044 
1045 	kfree_skb(skb);
1046 
1047 	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_0, &val);
1048 	if (err < 0)
1049 		return err;
1050 
1051 	val |= 0x11000000;
1052 	err = btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_0, val, ~0);
1053 	if (err < 0)
1054 		return err;
1055 
1056 	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_1, &val);
1057 	if (err < 0)
1058 		return err;
1059 
1060 	val |= 0x00000101;
1061 	err =  btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_1, val, ~0);
1062 	if (err < 0)
1063 		return err;
1064 
1065 	hdev->get_data_path_id = btmtksdio_get_data_path_id;
1066 	hdev->get_codec_config_data = btmtksdio_get_codec_config_data;
1067 
1068 	return err;
1069 }
1070 
1071 static int btmtksdio_reset_setting(struct hci_dev *hdev)
1072 {
1073 	int err;
1074 	u32 val;
1075 
1076 	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_1, &val);
1077 	if (err < 0)
1078 		return err;
1079 
1080 	val |= 0x20; /* set the pin (bit field 11:8) work as GPIO mode */
1081 	err = btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_1, val, ~0);
1082 	if (err < 0)
1083 		return err;
1084 
1085 	err = btmtksdio_mtk_reg_read(hdev, MT7921_BTSYS_RST, &val);
1086 	if (err < 0)
1087 		return err;
1088 
1089 	val |= MT7921_BTSYS_RST_WITH_GPIO;
1090 	return btmtksdio_mtk_reg_write(hdev, MT7921_BTSYS_RST, val, ~0);
1091 }
1092 
1093 static int btmtksdio_setup(struct hci_dev *hdev)
1094 {
1095 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1096 	ktime_t calltime, delta, rettime;
1097 	unsigned long long duration;
1098 	char fwname[64];
1099 	int err, dev_id;
1100 	u32 fw_version = 0, val;
1101 
1102 	calltime = ktime_get();
1103 	set_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
1104 
1105 	switch (bdev->data->chipid) {
1106 	case 0x7902:
1107 	case 0x7921:
1108 		if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state)) {
1109 			err = btmtksdio_mtk_reg_read(hdev, MT7921_DLSTATUS,
1110 						     &val);
1111 			if (err < 0)
1112 				return err;
1113 
1114 			val &= ~BT_DL_STATE;
1115 			err = btmtksdio_mtk_reg_write(hdev, MT7921_DLSTATUS,
1116 						      val, ~0);
1117 			if (err < 0)
1118 				return err;
1119 
1120 			btmtksdio_fw_pmctrl(bdev);
1121 			msleep(20);
1122 			btmtksdio_drv_pmctrl(bdev);
1123 
1124 			clear_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state);
1125 		}
1126 
1127 		err = btmtksdio_mtk_reg_read(hdev, 0x70010200, &dev_id);
1128 		if (err < 0) {
1129 			bt_dev_err(hdev, "Failed to get device id (%d)", err);
1130 			return err;
1131 		}
1132 
1133 		err = btmtksdio_mtk_reg_read(hdev, 0x80021004, &fw_version);
1134 		if (err < 0) {
1135 			bt_dev_err(hdev, "Failed to get fw version (%d)", err);
1136 			return err;
1137 		}
1138 
1139 		btmtk_fw_get_filename(fwname, sizeof(fwname), dev_id,
1140 				      fw_version, 0);
1141 
1142 		snprintf(fwname, sizeof(fwname),
1143 			 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
1144 			 dev_id & 0xffff, (fw_version & 0xff) + 1);
1145 		err = mt79xx_setup(hdev, fwname);
1146 		if (err < 0)
1147 			return err;
1148 
1149 		/* Enable SCO over I2S/PCM */
1150 		err = btmtksdio_sco_setting(hdev);
1151 		if (err < 0) {
1152 			bt_dev_err(hdev, "Failed to enable SCO setting (%d)", err);
1153 			return err;
1154 		}
1155 
1156 		/* Enable WBS with mSBC codec */
1157 		hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
1158 
1159 		/* Enable GPIO reset mechanism */
1160 		if (bdev->reset) {
1161 			err = btmtksdio_reset_setting(hdev);
1162 			if (err < 0) {
1163 				bt_dev_err(hdev, "Failed to enable Reset setting (%d)", err);
1164 				devm_gpiod_put(bdev->dev, bdev->reset);
1165 				bdev->reset = NULL;
1166 			}
1167 		}
1168 
1169 		break;
1170 	case 0x7663:
1171 	case 0x7668:
1172 		err = mt76xx_setup(hdev, bdev->data->fwname);
1173 		if (err < 0)
1174 			return err;
1175 		break;
1176 	default:
1177 		return -ENODEV;
1178 	}
1179 
1180 	rettime = ktime_get();
1181 	delta = ktime_sub(rettime, calltime);
1182 	duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1183 
1184 	if (bdev->data->pm_runtime_supported) {
1185 		pm_runtime_set_autosuspend_delay(bdev->dev,
1186 						 MTKBTSDIO_AUTOSUSPEND_DELAY);
1187 		pm_runtime_use_autosuspend(bdev->dev);
1188 
1189 		err = pm_runtime_set_active(bdev->dev);
1190 		if (err < 0)
1191 			return err;
1192 
1193 		/* Default forbid runtime auto suspend, that can be allowed by
1194 		 * enable_autosuspend flag or the PM runtime entry under sysfs.
1195 		 */
1196 		pm_runtime_forbid(bdev->dev);
1197 		pm_runtime_enable(bdev->dev);
1198 
1199 		if (enable_autosuspend)
1200 			pm_runtime_allow(bdev->dev);
1201 	}
1202 
1203 	bt_dev_info(hdev, "Device setup in %llu usecs", duration);
1204 
1205 	return 0;
1206 }
1207 
1208 static int btmtksdio_shutdown(struct hci_dev *hdev)
1209 {
1210 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1211 	struct btmtk_hci_wmt_params wmt_params;
1212 	u8 param = 0x0;
1213 	int err;
1214 
1215 	/* Get back the state to be consistent with the state
1216 	 * in btmtksdio_setup.
1217 	 */
1218 	pm_runtime_get_sync(bdev->dev);
1219 
1220 	/* wmt command only works until the reset is complete */
1221 	if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state))
1222 		goto ignore_wmt_cmd;
1223 
1224 	/* Disable the device */
1225 	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1226 	wmt_params.flag = 0;
1227 	wmt_params.dlen = sizeof(param);
1228 	wmt_params.data = &param;
1229 	wmt_params.status = NULL;
1230 
1231 	err = mtk_hci_wmt_sync(hdev, &wmt_params);
1232 	if (err < 0) {
1233 		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1234 		return err;
1235 	}
1236 
1237 ignore_wmt_cmd:
1238 	pm_runtime_put_noidle(bdev->dev);
1239 	pm_runtime_disable(bdev->dev);
1240 
1241 	return 0;
1242 }
1243 
1244 static int btmtksdio_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1245 {
1246 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1247 
1248 	switch (hci_skb_pkt_type(skb)) {
1249 	case HCI_COMMAND_PKT:
1250 		hdev->stat.cmd_tx++;
1251 		break;
1252 
1253 	case HCI_ACLDATA_PKT:
1254 		hdev->stat.acl_tx++;
1255 		break;
1256 
1257 	case HCI_SCODATA_PKT:
1258 		hdev->stat.sco_tx++;
1259 		break;
1260 
1261 	default:
1262 		return -EILSEQ;
1263 	}
1264 
1265 	skb_queue_tail(&bdev->txq, skb);
1266 
1267 	schedule_work(&bdev->txrx_work);
1268 
1269 	return 0;
1270 }
1271 
1272 static void btmtksdio_reset(struct hci_dev *hdev)
1273 {
1274 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1275 	u32 status;
1276 	int err;
1277 
1278 	if (!bdev->reset || bdev->data->chipid != 0x7921)
1279 		return;
1280 
1281 	pm_runtime_get_sync(bdev->dev);
1282 
1283 	if (test_and_set_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state))
1284 		return;
1285 
1286 	sdio_claim_host(bdev->func);
1287 
1288 	/* set drv_pmctrl if BT is closed before doing reset */
1289 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
1290 		sdio_enable_func(bdev->func);
1291 		btmtksdio_drv_pmctrl(bdev);
1292 	}
1293 
1294 	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
1295 	skb_queue_purge(&bdev->txq);
1296 	cancel_work_sync(&bdev->txrx_work);
1297 
1298 	gpiod_set_value_cansleep(bdev->reset, 1);
1299 	msleep(100);
1300 	gpiod_set_value_cansleep(bdev->reset, 0);
1301 
1302 	err = readx_poll_timeout(btmtksdio_chcr_query, bdev, status,
1303 				 status & BT_RST_DONE, 100000, 2000000);
1304 	if (err < 0) {
1305 		bt_dev_err(hdev, "Failed to reset (%d)", err);
1306 		goto err;
1307 	}
1308 
1309 	/* set fw_pmctrl back if BT is closed after doing reset */
1310 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state)) {
1311 		btmtksdio_fw_pmctrl(bdev);
1312 		sdio_disable_func(bdev->func);
1313 	}
1314 
1315 	clear_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
1316 err:
1317 	sdio_release_host(bdev->func);
1318 
1319 	pm_runtime_put_noidle(bdev->dev);
1320 	pm_runtime_disable(bdev->dev);
1321 
1322 	hci_reset_dev(hdev);
1323 }
1324 
1325 static bool btmtksdio_sdio_inband_wakeup(struct hci_dev *hdev)
1326 {
1327 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1328 
1329 	return device_may_wakeup(bdev->dev);
1330 }
1331 
1332 static bool btmtksdio_sdio_wakeup(struct hci_dev *hdev)
1333 {
1334 	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
1335 	bool may_wakeup = device_may_wakeup(bdev->dev);
1336 	const struct btmtk_wakeon bt_awake = {
1337 		.mode = 0x1,
1338 		.gpo = 0,
1339 		.active_high = 0x1,
1340 		.enable_delay = cpu_to_le16(0xc80),
1341 		.wakeup_delay = cpu_to_le16(0x20),
1342 	};
1343 
1344 	if (may_wakeup && bdev->data->chipid == 0x7921) {
1345 		struct sk_buff *skb;
1346 
1347 		skb =  __hci_cmd_sync(hdev, 0xfc27, sizeof(bt_awake),
1348 				      &bt_awake, HCI_CMD_TIMEOUT);
1349 		if (IS_ERR(skb))
1350 			may_wakeup = false;
1351 		else
1352 			kfree_skb(skb);
1353 	}
1354 
1355 	return may_wakeup;
1356 }
1357 
1358 static int btmtksdio_probe(struct sdio_func *func,
1359 			   const struct sdio_device_id *id)
1360 {
1361 	struct btmtksdio_dev *bdev;
1362 	struct hci_dev *hdev;
1363 	struct device_node *old_node;
1364 	bool restore_node;
1365 	int err;
1366 
1367 	bdev = devm_kzalloc(&func->dev, sizeof(*bdev), GFP_KERNEL);
1368 	if (!bdev)
1369 		return -ENOMEM;
1370 
1371 	bdev->data = (void *)id->driver_data;
1372 	if (!bdev->data)
1373 		return -ENODEV;
1374 
1375 	bdev->dev = &func->dev;
1376 	bdev->func = func;
1377 
1378 	INIT_WORK(&bdev->txrx_work, btmtksdio_txrx_work);
1379 	skb_queue_head_init(&bdev->txq);
1380 
1381 	/* Initialize and register HCI device */
1382 	hdev = hci_alloc_dev();
1383 	if (!hdev) {
1384 		dev_err(&func->dev, "Can't allocate HCI device\n");
1385 		return -ENOMEM;
1386 	}
1387 
1388 	bdev->hdev = hdev;
1389 
1390 	hdev->bus = HCI_SDIO;
1391 	hci_set_drvdata(hdev, bdev);
1392 
1393 	hdev->open     = btmtksdio_open;
1394 	hdev->close    = btmtksdio_close;
1395 	hdev->reset    = btmtksdio_reset;
1396 	hdev->flush    = btmtksdio_flush;
1397 	hdev->setup    = btmtksdio_setup;
1398 	hdev->shutdown = btmtksdio_shutdown;
1399 	hdev->send     = btmtksdio_send_frame;
1400 	hdev->wakeup   = btmtksdio_sdio_wakeup;
1401 	/*
1402 	 * If SDIO controller supports wake on Bluetooth, sending a wakeon
1403 	 * command is not necessary.
1404 	 */
1405 	if (device_can_wakeup(func->card->host->parent))
1406 		hdev->wakeup = btmtksdio_sdio_inband_wakeup;
1407 	else
1408 		hdev->wakeup = btmtksdio_sdio_wakeup;
1409 	hdev->set_bdaddr = btmtk_set_bdaddr;
1410 
1411 	SET_HCIDEV_DEV(hdev, &func->dev);
1412 
1413 	hdev->manufacturer = 70;
1414 	hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
1415 
1416 	sdio_set_drvdata(func, bdev);
1417 
1418 	err = hci_register_dev(hdev);
1419 	if (err < 0) {
1420 		dev_err(&func->dev, "Can't register HCI device\n");
1421 		hci_free_dev(hdev);
1422 		return err;
1423 	}
1424 
1425 	/* pm_runtime_enable would be done after the firmware is being
1426 	 * downloaded because the core layer probably already enables
1427 	 * runtime PM for this func such as the case host->caps &
1428 	 * MMC_CAP_POWER_OFF_CARD.
1429 	 */
1430 	if (pm_runtime_enabled(bdev->dev))
1431 		pm_runtime_disable(bdev->dev);
1432 
1433 	/* As explanation in drivers/mmc/core/sdio_bus.c tells us:
1434 	 * Unbound SDIO functions are always suspended.
1435 	 * During probe, the function is set active and the usage count
1436 	 * is incremented.  If the driver supports runtime PM,
1437 	 * it should call pm_runtime_put_noidle() in its probe routine and
1438 	 * pm_runtime_get_noresume() in its remove routine.
1439 	 *
1440 	 * So, put a pm_runtime_put_noidle here !
1441 	 */
1442 	pm_runtime_put_noidle(bdev->dev);
1443 
1444 	err = devm_device_init_wakeup(bdev->dev);
1445 	if (err)
1446 		bt_dev_err(hdev, "failed to initialize device wakeup");
1447 
1448 	restore_node = false;
1449 	if (!of_device_is_compatible(bdev->dev->of_node, "mediatek,mt7921s-bluetooth")) {
1450 		restore_node = true;
1451 		old_node = bdev->dev->of_node;
1452 		bdev->dev->of_node = of_find_compatible_node(NULL, NULL,
1453 							     "mediatek,mt7921s-bluetooth");
1454 	}
1455 
1456 	bdev->reset = devm_gpiod_get_optional(bdev->dev, "reset",
1457 					      GPIOD_OUT_LOW);
1458 	if (IS_ERR(bdev->reset))
1459 		err = PTR_ERR(bdev->reset);
1460 
1461 	if (restore_node) {
1462 		of_node_put(bdev->dev->of_node);
1463 		bdev->dev->of_node = old_node;
1464 	}
1465 
1466 	return err;
1467 }
1468 
1469 static void btmtksdio_remove(struct sdio_func *func)
1470 {
1471 	struct btmtksdio_dev *bdev = sdio_get_drvdata(func);
1472 	struct hci_dev *hdev;
1473 
1474 	if (!bdev)
1475 		return;
1476 
1477 	hdev = bdev->hdev;
1478 
1479 	/* Make sure to call btmtksdio_close before removing sdio card */
1480 	if (test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
1481 		btmtksdio_close(hdev);
1482 
1483 	/* Be consistent the state in btmtksdio_probe */
1484 	pm_runtime_get_noresume(bdev->dev);
1485 
1486 	sdio_set_drvdata(func, NULL);
1487 	hci_unregister_dev(hdev);
1488 	hci_free_dev(hdev);
1489 }
1490 
1491 static int btmtksdio_runtime_suspend(struct device *dev)
1492 {
1493 	struct sdio_func *func = dev_to_sdio_func(dev);
1494 	struct btmtksdio_dev *bdev;
1495 	int err;
1496 
1497 	bdev = sdio_get_drvdata(func);
1498 	if (!bdev)
1499 		return 0;
1500 
1501 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
1502 		return 0;
1503 
1504 	sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
1505 
1506 	err = btmtksdio_fw_pmctrl(bdev);
1507 
1508 	bt_dev_dbg(bdev->hdev, "status (%d) return ownership to device", err);
1509 
1510 	return err;
1511 }
1512 
1513 static int btmtksdio_system_suspend(struct device *dev)
1514 {
1515 	struct sdio_func *func = dev_to_sdio_func(dev);
1516 	struct btmtksdio_dev *bdev;
1517 
1518 	bdev = sdio_get_drvdata(func);
1519 	if (!bdev)
1520 		return 0;
1521 
1522 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
1523 		return 0;
1524 
1525 	set_bit(BTMTKSDIO_BT_WAKE_ENABLED, &bdev->tx_state);
1526 
1527 	return btmtksdio_runtime_suspend(dev);
1528 }
1529 
1530 static int btmtksdio_runtime_resume(struct device *dev)
1531 {
1532 	struct sdio_func *func = dev_to_sdio_func(dev);
1533 	struct btmtksdio_dev *bdev;
1534 	int err;
1535 
1536 	bdev = sdio_get_drvdata(func);
1537 	if (!bdev)
1538 		return 0;
1539 
1540 	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
1541 		return 0;
1542 
1543 	err = btmtksdio_drv_pmctrl(bdev);
1544 
1545 	bt_dev_dbg(bdev->hdev, "status (%d) get ownership from device", err);
1546 
1547 	return err;
1548 }
1549 
1550 static int btmtksdio_system_resume(struct device *dev)
1551 {
1552 	return btmtksdio_runtime_resume(dev);
1553 }
1554 
1555 static const struct dev_pm_ops btmtksdio_pm_ops = {
1556 	SYSTEM_SLEEP_PM_OPS(btmtksdio_system_suspend, btmtksdio_system_resume)
1557 	RUNTIME_PM_OPS(btmtksdio_runtime_suspend, btmtksdio_runtime_resume, NULL)
1558 };
1559 
1560 static struct sdio_driver btmtksdio_driver = {
1561 	.name		= "btmtksdio",
1562 	.probe		= btmtksdio_probe,
1563 	.remove		= btmtksdio_remove,
1564 	.id_table	= btmtksdio_table,
1565 	.drv = {
1566 		.pm = pm_ptr(&btmtksdio_pm_ops),
1567 	}
1568 };
1569 
1570 module_sdio_driver(btmtksdio_driver);
1571 
1572 module_param(enable_autosuspend, bool, 0644);
1573 MODULE_PARM_DESC(enable_autosuspend, "Enable autosuspend by default");
1574 
1575 MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
1576 MODULE_DESCRIPTION("MediaTek Bluetooth SDIO driver ver " VERSION);
1577 MODULE_VERSION(VERSION);
1578 MODULE_LICENSE("GPL");
1579