1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *
4  *  Bluetooth HCI UART driver for marvell devices
5  *
6  *  Copyright (C) 2016  Marvell International Ltd.
7  *  Copyright (C) 2016  Intel Corporation
8  */
9 
10 #include <linux/kernel.h>
11 #include <linux/errno.h>
12 #include <linux/skbuff.h>
13 #include <linux/firmware.h>
14 #include <linux/module.h>
15 #include <linux/tty.h>
16 #include <linux/of.h>
17 #include <linux/serdev.h>
18 
19 #include <net/bluetooth/bluetooth.h>
20 #include <net/bluetooth/hci_core.h>
21 
22 #include "hci_uart.h"
23 
24 #define HCI_FW_REQ_PKT 0xA5
25 #define HCI_CHIP_VER_PKT 0xAA
26 
27 #define MRVL_ACK 0x5A
28 #define MRVL_NAK 0xBF
29 #define MRVL_RAW_DATA 0x1F
30 
31 enum {
32 	STATE_CHIP_VER_PENDING,
33 	STATE_FW_REQ_PENDING,
34 };
35 
36 struct mrvl_data {
37 	struct sk_buff *rx_skb;
38 	struct sk_buff_head txq;
39 	struct sk_buff_head rawq;
40 	unsigned long flags;
41 	unsigned int tx_len;
42 	u8 id, rev;
43 };
44 
45 struct mrvl_serdev {
46 	struct hci_uart hu;
47 };
48 
49 struct hci_mrvl_pkt {
50 	__le16 lhs;
51 	__le16 rhs;
52 } __packed;
53 #define HCI_MRVL_PKT_SIZE 4
54 
mrvl_open(struct hci_uart * hu)55 static int mrvl_open(struct hci_uart *hu)
56 {
57 	struct mrvl_data *mrvl;
58 	int ret;
59 
60 	BT_DBG("hu %p", hu);
61 
62 	if (!hci_uart_has_flow_control(hu))
63 		return -EOPNOTSUPP;
64 
65 	mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
66 	if (!mrvl)
67 		return -ENOMEM;
68 
69 	skb_queue_head_init(&mrvl->txq);
70 	skb_queue_head_init(&mrvl->rawq);
71 
72 	set_bit(STATE_CHIP_VER_PENDING, &mrvl->flags);
73 
74 	hu->priv = mrvl;
75 
76 	if (hu->serdev) {
77 		ret = serdev_device_open(hu->serdev);
78 		if (ret)
79 			goto err;
80 	}
81 
82 	return 0;
83 err:
84 	kfree(mrvl);
85 
86 	return ret;
87 }
88 
mrvl_close(struct hci_uart * hu)89 static int mrvl_close(struct hci_uart *hu)
90 {
91 	struct mrvl_data *mrvl = hu->priv;
92 
93 	BT_DBG("hu %p", hu);
94 
95 	if (hu->serdev)
96 		serdev_device_close(hu->serdev);
97 
98 	skb_queue_purge(&mrvl->txq);
99 	skb_queue_purge(&mrvl->rawq);
100 	kfree_skb(mrvl->rx_skb);
101 	kfree(mrvl);
102 
103 	hu->priv = NULL;
104 	return 0;
105 }
106 
mrvl_flush(struct hci_uart * hu)107 static int mrvl_flush(struct hci_uart *hu)
108 {
109 	struct mrvl_data *mrvl = hu->priv;
110 
111 	BT_DBG("hu %p", hu);
112 
113 	skb_queue_purge(&mrvl->txq);
114 	skb_queue_purge(&mrvl->rawq);
115 
116 	return 0;
117 }
118 
mrvl_dequeue(struct hci_uart * hu)119 static struct sk_buff *mrvl_dequeue(struct hci_uart *hu)
120 {
121 	struct mrvl_data *mrvl = hu->priv;
122 	struct sk_buff *skb;
123 
124 	skb = skb_dequeue(&mrvl->txq);
125 	if (!skb) {
126 		/* Any raw data ? */
127 		skb = skb_dequeue(&mrvl->rawq);
128 	} else {
129 		/* Prepend skb with frame type */
130 		memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
131 	}
132 
133 	return skb;
134 }
135 
mrvl_enqueue(struct hci_uart * hu,struct sk_buff * skb)136 static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb)
137 {
138 	struct mrvl_data *mrvl = hu->priv;
139 
140 	skb_queue_tail(&mrvl->txq, skb);
141 	return 0;
142 }
143 
mrvl_send_ack(struct hci_uart * hu,unsigned char type)144 static void mrvl_send_ack(struct hci_uart *hu, unsigned char type)
145 {
146 	struct mrvl_data *mrvl = hu->priv;
147 	struct sk_buff *skb;
148 
149 	/* No H4 payload, only 1 byte header */
150 	skb = bt_skb_alloc(0, GFP_ATOMIC);
151 	if (!skb) {
152 		bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet");
153 		return;
154 	}
155 	hci_skb_pkt_type(skb) = type;
156 
157 	skb_queue_tail(&mrvl->txq, skb);
158 	hci_uart_tx_wakeup(hu);
159 }
160 
mrvl_recv_fw_req(struct hci_dev * hdev,struct sk_buff * skb)161 static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb)
162 {
163 	struct hci_mrvl_pkt *pkt = (void *)skb->data;
164 	struct hci_uart *hu = hci_get_drvdata(hdev);
165 	struct mrvl_data *mrvl = hu->priv;
166 	int ret = 0;
167 
168 	if ((pkt->lhs ^ pkt->rhs) != 0xffff) {
169 		bt_dev_err(hdev, "Corrupted mrvl header");
170 		mrvl_send_ack(hu, MRVL_NAK);
171 		ret = -EINVAL;
172 		goto done;
173 	}
174 	mrvl_send_ack(hu, MRVL_ACK);
175 
176 	if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) {
177 		bt_dev_err(hdev, "Received unexpected firmware request");
178 		ret = -EINVAL;
179 		goto done;
180 	}
181 
182 	mrvl->tx_len = le16_to_cpu(pkt->lhs);
183 
184 	clear_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
185 	smp_mb__after_atomic();
186 	wake_up_bit(&mrvl->flags, STATE_FW_REQ_PENDING);
187 
188 done:
189 	kfree_skb(skb);
190 	return ret;
191 }
192 
mrvl_recv_chip_ver(struct hci_dev * hdev,struct sk_buff * skb)193 static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb)
194 {
195 	struct hci_mrvl_pkt *pkt = (void *)skb->data;
196 	struct hci_uart *hu = hci_get_drvdata(hdev);
197 	struct mrvl_data *mrvl = hu->priv;
198 	u16 version = le16_to_cpu(pkt->lhs);
199 	int ret = 0;
200 
201 	if ((pkt->lhs ^ pkt->rhs) != 0xffff) {
202 		bt_dev_err(hdev, "Corrupted mrvl header");
203 		mrvl_send_ack(hu, MRVL_NAK);
204 		ret = -EINVAL;
205 		goto done;
206 	}
207 	mrvl_send_ack(hu, MRVL_ACK);
208 
209 	if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) {
210 		bt_dev_err(hdev, "Received unexpected chip version");
211 		goto done;
212 	}
213 
214 	mrvl->id = version;
215 	mrvl->rev = version >> 8;
216 
217 	bt_dev_info(hdev, "Controller id = %x, rev = %x", mrvl->id, mrvl->rev);
218 
219 	clear_bit(STATE_CHIP_VER_PENDING, &mrvl->flags);
220 	smp_mb__after_atomic();
221 	wake_up_bit(&mrvl->flags, STATE_CHIP_VER_PENDING);
222 
223 done:
224 	kfree_skb(skb);
225 	return ret;
226 }
227 
228 #define HCI_RECV_CHIP_VER \
229 	.type = HCI_CHIP_VER_PKT, \
230 	.hlen = HCI_MRVL_PKT_SIZE, \
231 	.loff = 0, \
232 	.lsize = 0, \
233 	.maxlen = HCI_MRVL_PKT_SIZE
234 
235 #define HCI_RECV_FW_REQ \
236 	.type = HCI_FW_REQ_PKT, \
237 	.hlen = HCI_MRVL_PKT_SIZE, \
238 	.loff = 0, \
239 	.lsize = 0, \
240 	.maxlen = HCI_MRVL_PKT_SIZE
241 
242 static const struct h4_recv_pkt mrvl_recv_pkts[] = {
243 	{ H4_RECV_ACL,       .recv = hci_recv_frame     },
244 	{ H4_RECV_SCO,       .recv = hci_recv_frame     },
245 	{ H4_RECV_EVENT,     .recv = hci_recv_frame     },
246 	{ HCI_RECV_FW_REQ,   .recv = mrvl_recv_fw_req   },
247 	{ HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver },
248 };
249 
mrvl_recv(struct hci_uart * hu,const void * data,int count)250 static int mrvl_recv(struct hci_uart *hu, const void *data, int count)
251 {
252 	struct mrvl_data *mrvl = hu->priv;
253 
254 	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
255 		return -EUNATCH;
256 
257 	mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count,
258 				    mrvl_recv_pkts,
259 				    ARRAY_SIZE(mrvl_recv_pkts));
260 	if (IS_ERR(mrvl->rx_skb)) {
261 		int err = PTR_ERR(mrvl->rx_skb);
262 		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
263 		mrvl->rx_skb = NULL;
264 		return err;
265 	}
266 
267 	return count;
268 }
269 
mrvl_load_firmware(struct hci_dev * hdev,const char * name)270 static int mrvl_load_firmware(struct hci_dev *hdev, const char *name)
271 {
272 	struct hci_uart *hu = hci_get_drvdata(hdev);
273 	struct mrvl_data *mrvl = hu->priv;
274 	const struct firmware *fw = NULL;
275 	const u8 *fw_ptr, *fw_max;
276 	int err;
277 
278 	err = request_firmware(&fw, name, &hdev->dev);
279 	if (err < 0) {
280 		bt_dev_err(hdev, "Failed to load firmware file %s", name);
281 		return err;
282 	}
283 
284 	fw_ptr = fw->data;
285 	fw_max = fw->data + fw->size;
286 
287 	bt_dev_info(hdev, "Loading %s", name);
288 
289 	set_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
290 
291 	while (fw_ptr <= fw_max) {
292 		struct sk_buff *skb;
293 
294 		/* Controller drives the firmware load by sending firmware
295 		 * request packets containing the expected fragment size.
296 		 */
297 		err = wait_on_bit_timeout(&mrvl->flags, STATE_FW_REQ_PENDING,
298 					  TASK_INTERRUPTIBLE,
299 					  msecs_to_jiffies(2000));
300 		if (err == 1) {
301 			bt_dev_err(hdev, "Firmware load interrupted");
302 			err = -EINTR;
303 			break;
304 		} else if (err) {
305 			bt_dev_err(hdev, "Firmware request timeout");
306 			err = -ETIMEDOUT;
307 			break;
308 		}
309 
310 		bt_dev_dbg(hdev, "Firmware request, expecting %d bytes",
311 			   mrvl->tx_len);
312 
313 		if (fw_ptr == fw_max) {
314 			/* Controller requests a null size once firmware is
315 			 * fully loaded. If controller expects more data, there
316 			 * is an issue.
317 			 */
318 			if (!mrvl->tx_len) {
319 				bt_dev_info(hdev, "Firmware loading complete");
320 			} else {
321 				bt_dev_err(hdev, "Firmware loading failure");
322 				err = -EINVAL;
323 			}
324 			break;
325 		}
326 
327 		if (fw_ptr + mrvl->tx_len > fw_max) {
328 			mrvl->tx_len = fw_max - fw_ptr;
329 			bt_dev_dbg(hdev, "Adjusting tx_len to %d",
330 				   mrvl->tx_len);
331 		}
332 
333 		skb = bt_skb_alloc(mrvl->tx_len, GFP_KERNEL);
334 		if (!skb) {
335 			bt_dev_err(hdev, "Failed to alloc mem for FW packet");
336 			err = -ENOMEM;
337 			break;
338 		}
339 		bt_cb(skb)->pkt_type = MRVL_RAW_DATA;
340 
341 		skb_put_data(skb, fw_ptr, mrvl->tx_len);
342 		fw_ptr += mrvl->tx_len;
343 
344 		set_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
345 
346 		skb_queue_tail(&mrvl->rawq, skb);
347 		hci_uart_tx_wakeup(hu);
348 	}
349 
350 	release_firmware(fw);
351 	return err;
352 }
353 
mrvl_setup(struct hci_uart * hu)354 static int mrvl_setup(struct hci_uart *hu)
355 {
356 	int err;
357 
358 	hci_uart_set_flow_control(hu, true);
359 
360 	err = mrvl_load_firmware(hu->hdev, "mrvl/helper_uart_3000000.bin");
361 	if (err) {
362 		bt_dev_err(hu->hdev, "Unable to download firmware helper");
363 		return -EINVAL;
364 	}
365 
366 	/* Let the final ack go out before switching the baudrate */
367 	hci_uart_wait_until_sent(hu);
368 
369 	if (hu->serdev)
370 		serdev_device_set_baudrate(hu->serdev, 3000000);
371 	else
372 		hci_uart_set_baudrate(hu, 3000000);
373 
374 	hci_uart_set_flow_control(hu, false);
375 
376 	err = mrvl_load_firmware(hu->hdev, "mrvl/uart8897_bt.bin");
377 	if (err)
378 		return err;
379 
380 	return 0;
381 }
382 
383 static const struct hci_uart_proto mrvl_proto = {
384 	.id		= HCI_UART_MRVL,
385 	.name		= "Marvell",
386 	.init_speed	= 115200,
387 	.open		= mrvl_open,
388 	.close		= mrvl_close,
389 	.flush		= mrvl_flush,
390 	.setup		= mrvl_setup,
391 	.recv		= mrvl_recv,
392 	.enqueue	= mrvl_enqueue,
393 	.dequeue	= mrvl_dequeue,
394 };
395 
mrvl_serdev_probe(struct serdev_device * serdev)396 static int mrvl_serdev_probe(struct serdev_device *serdev)
397 {
398 	struct mrvl_serdev *mrvldev;
399 
400 	mrvldev = devm_kzalloc(&serdev->dev, sizeof(*mrvldev), GFP_KERNEL);
401 	if (!mrvldev)
402 		return -ENOMEM;
403 
404 	mrvldev->hu.serdev = serdev;
405 	serdev_device_set_drvdata(serdev, mrvldev);
406 
407 	return hci_uart_register_device(&mrvldev->hu, &mrvl_proto);
408 }
409 
mrvl_serdev_remove(struct serdev_device * serdev)410 static void mrvl_serdev_remove(struct serdev_device *serdev)
411 {
412 	struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev);
413 
414 	hci_uart_unregister_device(&mrvldev->hu);
415 }
416 
417 #ifdef CONFIG_OF
418 static const struct of_device_id mrvl_bluetooth_of_match[] = {
419 	{ .compatible = "mrvl,88w8897" },
420 	{ },
421 };
422 MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match);
423 #endif
424 
425 static struct serdev_device_driver mrvl_serdev_driver = {
426 	.probe = mrvl_serdev_probe,
427 	.remove = mrvl_serdev_remove,
428 	.driver = {
429 		.name = "hci_uart_mrvl",
430 		.of_match_table = of_match_ptr(mrvl_bluetooth_of_match),
431 	},
432 };
433 
mrvl_init(void)434 int __init mrvl_init(void)
435 {
436 	serdev_device_driver_register(&mrvl_serdev_driver);
437 
438 	return hci_uart_register_proto(&mrvl_proto);
439 }
440 
mrvl_deinit(void)441 int __exit mrvl_deinit(void)
442 {
443 	serdev_device_driver_unregister(&mrvl_serdev_driver);
444 
445 	return hci_uart_unregister_proto(&mrvl_proto);
446 }
447