drivers/bluetooth/btmtkuart.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 // Copyright (c) 2018 MediaTek Inc.
   3
   4 /*
   5  * Bluetooth support for MediaTek serial devices
   6  *
   7  * Author: Sean Wang <sean.wang@mediatek.com>
   8  *
   9  */
  10
  11 #include <asm/unaligned.h>
  12 #include <linux/atomic.h>
  13 #include <linux/clk.h>
  14 #include <linux/firmware.h>
  15 #include <linux/kernel.h>
  16 #include <linux/module.h>
  17 #include <linux/of.h>
  18 #include <linux/pm_runtime.h>
  19 #include <linux/serdev.h>
  20 #include <linux/skbuff.h>
  21
  22 #include <net/bluetooth/bluetooth.h>
  23 #include <net/bluetooth/hci_core.h>
  24
  25 #include "h4_recv.h"
  26
  27 #define VERSION "0.1"
  28
  29 #define FIRMWARE_MT7622         "/*(DEBLOBBED)*/"
  30
  31 #define MTK_STP_TLR_SIZE        2
  32
  33 #define BTMTKUART_TX_STATE_ACTIVE       1
  34 #define BTMTKUART_TX_STATE_WAKEUP       2
  35 #define BTMTKUART_TX_WAIT_VND_EVT       3
  36
  37 enum {
  38         MTK_WMT_PATCH_DWNLD = 0x1,
  39         MTK_WMT_FUNC_CTRL = 0x6,
  40         MTK_WMT_RST = 0x7
  41 };
  42
  43 struct mtk_stp_hdr {
  44         u8      prefix;
  45         __be16  dlen;
  46         u8      cs;
  47 } __packed;
  48
  49 struct mtk_wmt_hdr {
  50         u8      dir;
  51         u8      op;
  52         __le16  dlen;
  53         u8      flag;
  54 } __packed;
  55
  56 struct mtk_hci_wmt_cmd {
  57         struct mtk_wmt_hdr hdr;
  58         u8 data[256];
  59 } __packed;
  60
  61 struct btmtkuart_dev {
  62         struct hci_dev *hdev;
  63         struct serdev_device *serdev;
  64         struct clk *clk;
  65
  66         struct work_struct tx_work;
  67         unsigned long tx_state;
  68         struct sk_buff_head txq;
  69
  70         struct sk_buff *rx_skb;
  71
  72         u8      stp_pad[6];
  73         u8      stp_cursor;
  74         u16     stp_dlen;
  75 };
  76
  77 static int mtk_hci_wmt_sync(struct hci_dev *hdev, u8 op, u8 flag, u16 plen,
  78                             const void *param)
  79 {
  80         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
  81         struct mtk_hci_wmt_cmd wc;
  82         struct mtk_wmt_hdr *hdr;
  83         u32 hlen;
  84         int err;
  85
  86         hlen = sizeof(*hdr) + plen;
  87         if (hlen > 255)
  88                 return -EINVAL;
  89
  90         hdr = (struct mtk_wmt_hdr *)&wc;
  91         hdr->dir = 1;
  92         hdr->op = op;
  93         hdr->dlen = cpu_to_le16(plen + 1);
  94         hdr->flag = flag;
  95         memcpy(wc.data, param, plen);
  96
  97         set_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
  98
  99         err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);
 100         if (err < 0) {
 101                 clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
 102                 return err;
 103         }
 104
 105         /* The vendor specific WMT commands are all answered by a vendor
 106          * specific event and will not have the Command Status or Command
 107          * Complete as with usual HCI command flow control.
 108          *
 109          * After sending the command, wait for BTMTKUART_TX_WAIT_VND_EVT
 110          * state to be cleared. The driver speicfic event receive routine
 111          * will clear that state and with that indicate completion of the
 112          * WMT command.
 113          */
 114         err = wait_on_bit_timeout(&bdev->tx_state, BTMTKUART_TX_WAIT_VND_EVT,
 115                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
 116         if (err == -EINTR) {
 117                 bt_dev_err(hdev, "Execution of wmt command interrupted");
 118                 clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
 119                 return err;
 120         }
 121
 122         if (err) {
 123                 bt_dev_err(hdev, "Execution of wmt command timed out");
 124                 clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
 125                 return -ETIMEDOUT;
 126         }
 127
 128         return 0;
 129 }
 130
 131 static int mtk_setup_fw(struct hci_dev *hdev)
 132 {
 133         const struct firmware *fw;
 134         const u8 *fw_ptr;
 135         size_t fw_size;
 136         int err, dlen;
 137         u8 flag;
 138
 139         err = reject_firmware(&fw, FIRMWARE_MT7622, &hdev->dev);
 140         if (err < 0) {
 141                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
 142                 return err;
 143         }
 144
 145         fw_ptr = fw->data;
 146         fw_size = fw->size;
 147
 148         /* The size of patch header is 30 bytes, should be skip */
 149         if (fw_size < 30) {
 150                 err = -EINVAL;
 151                 goto free_fw;
 152         }
 153
 154         fw_size -= 30;
 155         fw_ptr += 30;
 156         flag = 1;
 157
 158         while (fw_size > 0) {
 159                 dlen = min_t(int, 250, fw_size);
 160
 161                 /* Tell device the position in sequence */
 162                 if (fw_size - dlen <= 0)
 163                         flag = 3;
 164                 else if (fw_size < fw->size - 30)
 165                         flag = 2;
 166
 167                 err = mtk_hci_wmt_sync(hdev, MTK_WMT_PATCH_DWNLD, flag, dlen,
 168                                        fw_ptr);
 169                 if (err < 0) {
 170                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
 171                                    err);
 172                         break;
 173                 }
 174
 175                 fw_size -= dlen;
 176                 fw_ptr += dlen;
 177         }
 178
 179 free_fw:
 180         release_firmware(fw);
 181         return err;
 182 }
 183
 184 static int btmtkuart_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
 185 {
 186         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 187         struct hci_event_hdr *hdr = (void *)skb->data;
 188         int err;
 189
 190         /* Fix up the vendor event id with 0xff for vendor specific instead
 191          * of 0xe4 so that event send via monitoring socket can be parsed
 192          * properly.
 193          */
 194         if (hdr->evt == 0xe4)
 195                 hdr->evt = HCI_EV_VENDOR;
 196
 197         err = hci_recv_frame(hdev, skb);
 198
 199         if (hdr->evt == HCI_EV_VENDOR) {
 200                 if (test_and_clear_bit(BTMTKUART_TX_WAIT_VND_EVT,
 201                                        &bdev->tx_state)) {
 202                         /* Barrier to sync with other CPUs */
 203                         smp_mb__after_atomic();
 204                         wake_up_bit(&bdev->tx_state, BTMTKUART_TX_WAIT_VND_EVT);
 205                 }
 206         }
 207
 208         return err;
 209 }
 210
 211 static const struct h4_recv_pkt mtk_recv_pkts[] = {
 212         { H4_RECV_ACL,      .recv = hci_recv_frame },
 213         { H4_RECV_SCO,      .recv = hci_recv_frame },
 214         { H4_RECV_EVENT,    .recv = btmtkuart_recv_event },
 215 };
 216
 217 static void btmtkuart_tx_work(struct work_struct *work)
 218 {
 219         struct btmtkuart_dev *bdev = container_of(work, struct btmtkuart_dev,
 220                                                    tx_work);
 221         struct serdev_device *serdev = bdev->serdev;
 222         struct hci_dev *hdev = bdev->hdev;
 223
 224         while (1) {
 225                 clear_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state);
 226
 227                 while (1) {
 228                         struct sk_buff *skb = skb_dequeue(&bdev->txq);
 229                         int len;
 230
 231                         if (!skb)
 232                                 break;
 233
 234                         len = serdev_device_write_buf(serdev, skb->data,
 235                                                       skb->len);
 236                         hdev->stat.byte_tx += len;
 237
 238                         skb_pull(skb, len);
 239                         if (skb->len > 0) {
 240                                 skb_queue_head(&bdev->txq, skb);
 241                                 break;
 242                         }
 243
 244                         switch (hci_skb_pkt_type(skb)) {
 245                         case HCI_COMMAND_PKT:
 246                                 hdev->stat.cmd_tx++;
 247                                 break;
 248                         case HCI_ACLDATA_PKT:
 249                                 hdev->stat.acl_tx++;
 250                                 break;
 251                         case HCI_SCODATA_PKT:
 252                                 hdev->stat.sco_tx++;
 253                                 break;
 254                         }
 255
 256                         kfree_skb(skb);
 257                 }
 258
 259                 if (!test_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state))
 260                         break;
 261         }
 262
 263         clear_bit(BTMTKUART_TX_STATE_ACTIVE, &bdev->tx_state);
 264 }
 265
 266 static void btmtkuart_tx_wakeup(struct btmtkuart_dev *bdev)
 267 {
 268         if (test_and_set_bit(BTMTKUART_TX_STATE_ACTIVE, &bdev->tx_state))
 269                 set_bit(BTMTKUART_TX_STATE_WAKEUP, &bdev->tx_state);
 270
 271         schedule_work(&bdev->tx_work);
 272 }
 273
 274 static const unsigned char *
 275 mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count,
 276               int *sz_h4)
 277 {
 278         struct mtk_stp_hdr *shdr;
 279
 280         /* The cursor is reset when all the data of STP is consumed out */
 281         if (!bdev->stp_dlen && bdev->stp_cursor >= 6)
 282                 bdev->stp_cursor = 0;
 283
 284         /* Filling pad until all STP info is obtained */
 285         while (bdev->stp_cursor < 6 && count > 0) {
 286                 bdev->stp_pad[bdev->stp_cursor] = *data;
 287                 bdev->stp_cursor++;
 288                 data++;
 289                 count--;
 290         }
 291
 292         /* Retrieve STP info and have a sanity check */
 293         if (!bdev->stp_dlen && bdev->stp_cursor >= 6) {
 294                 shdr = (struct mtk_stp_hdr *)&bdev->stp_pad[2];
 295                 bdev->stp_dlen = be16_to_cpu(shdr->dlen) & 0x0fff;
 296
 297                 /* Resync STP when unexpected data is being read */
 298                 if (shdr->prefix != 0x80 || bdev->stp_dlen > 2048) {
 299                         bt_dev_err(bdev->hdev, "stp format unexpect (%d, %d)",
 300                                    shdr->prefix, bdev->stp_dlen);
 301                         bdev->stp_cursor = 2;
 302                         bdev->stp_dlen = 0;
 303                 }
 304         }
 305
 306         /* Directly quit when there's no data found for H4 can process */
 307         if (count <= 0)
 308                 return NULL;
 309
 310         /* Tranlate to how much the size of data H4 can handle so far */
 311         *sz_h4 = min_t(int, count, bdev->stp_dlen);
 312
 313         /* Update the remaining size of STP packet */
 314         bdev->stp_dlen -= *sz_h4;
 315
 316         /* Data points to STP payload which can be handled by H4 */
 317         return data;
 318 }
 319
 320 static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
 321 {
 322         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 323         const unsigned char *p_left = data, *p_h4;
 324         int sz_left = count, sz_h4, adv;
 325         int err;
 326
 327         while (sz_left > 0) {
 328                 /*  The serial data received from MT7622 BT controller is
 329                  *  at all time padded around with the STP header and tailer.
 330                  *
 331                  *  A full STP packet is looking like
 332                  *   -----------------------------------
 333                  *  | STP header  |  H:4   | STP tailer |
 334                  *   -----------------------------------
 335                  *  but it doesn't guarantee to contain a full H:4 packet which
 336                  *  means that it's possible for multiple STP packets forms a
 337                  *  full H:4 packet that means extra STP header + length doesn't
 338                  *  indicate a full H:4 frame, things can fragment. Whose length
 339                  *  recorded in STP header just shows up the most length the
 340                  *  H:4 engine can handle currently.
 341                  */
 342
 343                 p_h4 = mtk_stp_split(bdev, p_left, sz_left, &sz_h4);
 344                 if (!p_h4)
 345                         break;
 346
 347                 adv = p_h4 - p_left;
 348                 sz_left -= adv;
 349                 p_left += adv;
 350
 351                 bdev->rx_skb = h4_recv_buf(bdev->hdev, bdev->rx_skb, p_h4,
 352                                            sz_h4, mtk_recv_pkts,
 353                                            ARRAY_SIZE(mtk_recv_pkts));
 354                 if (IS_ERR(bdev->rx_skb)) {
 355                         err = PTR_ERR(bdev->rx_skb);
 356                         bt_dev_err(bdev->hdev,
 357                                    "Frame reassembly failed (%d)", err);
 358                         bdev->rx_skb = NULL;
 359                         return err;
 360                 }
 361
 362                 sz_left -= sz_h4;
 363                 p_left += sz_h4;
 364         }
 365
 366         return 0;
 367 }
 368
 369 static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data,
 370                                  size_t count)
 371 {
 372         struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
 373         int err;
 374
 375         err = btmtkuart_recv(bdev->hdev, data, count);
 376         if (err < 0)
 377                 return err;
 378
 379         bdev->hdev->stat.byte_rx += count;
 380
 381         return count;
 382 }
 383
 384 static void btmtkuart_write_wakeup(struct serdev_device *serdev)
 385 {
 386         struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
 387
 388         btmtkuart_tx_wakeup(bdev);
 389 }
 390
 391 static const struct serdev_device_ops btmtkuart_client_ops = {
 392         .receive_buf = btmtkuart_receive_buf,
 393         .write_wakeup = btmtkuart_write_wakeup,
 394 };
 395
 396 static int btmtkuart_open(struct hci_dev *hdev)
 397 {
 398         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 399         struct device *dev;
 400         int err;
 401
 402         err = serdev_device_open(bdev->serdev);
 403         if (err) {
 404                 bt_dev_err(hdev, "Unable to open UART device %s",
 405                            dev_name(&bdev->serdev->dev));
 406                 goto err_open;
 407         }
 408
 409         bdev->stp_cursor = 2;
 410         bdev->stp_dlen = 0;
 411
 412         dev = &bdev->serdev->dev;
 413
 414         /* Enable the power domain and clock the device requires */
 415         pm_runtime_enable(dev);
 416         err = pm_runtime_get_sync(dev);
 417         if (err < 0) {
 418                 pm_runtime_put_noidle(dev);
 419                 goto err_disable_rpm;
 420         }
 421
 422         err = clk_prepare_enable(bdev->clk);
 423         if (err < 0)
 424                 goto err_put_rpm;
 425
 426         return 0;
 427
 428 err_put_rpm:
 429         pm_runtime_put_sync(dev);
 430 err_disable_rpm:
 431         pm_runtime_disable(dev);
 432 err_open:
 433         return err;
 434 }
 435
 436 static int btmtkuart_close(struct hci_dev *hdev)
 437 {
 438         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 439         struct device *dev = &bdev->serdev->dev;
 440
 441         /* Shutdown the clock and power domain the device requires */
 442         clk_disable_unprepare(bdev->clk);
 443         pm_runtime_put_sync(dev);
 444         pm_runtime_disable(dev);
 445
 446         serdev_device_close(bdev->serdev);
 447
 448         return 0;
 449 }
 450
 451 static int btmtkuart_flush(struct hci_dev *hdev)
 452 {
 453         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 454
 455         /* Flush any pending characters */
 456         serdev_device_write_flush(bdev->serdev);
 457         skb_queue_purge(&bdev->txq);
 458
 459         cancel_work_sync(&bdev->tx_work);
 460
 461         kfree_skb(bdev->rx_skb);
 462         bdev->rx_skb = NULL;
 463
 464         bdev->stp_cursor = 2;
 465         bdev->stp_dlen = 0;
 466
 467         return 0;
 468 }
 469
 470 static int btmtkuart_setup(struct hci_dev *hdev)
 471 {
 472         u8 param = 0x1;
 473         int err = 0;
 474
 475         /* Setup a firmware which the device definitely requires */
 476         err = mtk_setup_fw(hdev);
 477         if (err < 0)
 478                 return err;
 479
 480         /* Activate function the firmware providing to */
 481         err = mtk_hci_wmt_sync(hdev, MTK_WMT_RST, 0x4, 0, 0);
 482         if (err < 0) {
 483                 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
 484                 return err;
 485         }
 486
 487         /* Enable Bluetooth protocol */
 488         err = mtk_hci_wmt_sync(hdev, MTK_WMT_FUNC_CTRL, 0x0, sizeof(param),
 489                                &param);
 490         if (err < 0) {
 491                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
 492                 return err;
 493         }
 494
 495         return 0;
 496 }
 497
 498 static int btmtkuart_shutdown(struct hci_dev *hdev)
 499 {
 500         u8 param = 0x0;
 501         int err;
 502
 503         /* Disable the device */
 504         err = mtk_hci_wmt_sync(hdev, MTK_WMT_FUNC_CTRL, 0x0, sizeof(param),
 505                                &param);
 506         if (err < 0) {
 507                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
 508                 return err;
 509         }
 510
 511         return 0;
 512 }
 513
 514 static int btmtkuart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 515 {
 516         struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
 517         struct mtk_stp_hdr *shdr;
 518         int err, dlen, type = 0;
 519
 520         /* Prepend skb with frame type */
 521         memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
 522
 523         /* Make sure that there is enough rooms for STP header and trailer */
 524         if (unlikely(skb_headroom(skb) < sizeof(*shdr)) ||
 525             (skb_tailroom(skb) < MTK_STP_TLR_SIZE)) {
 526                 err = pskb_expand_head(skb, sizeof(*shdr), MTK_STP_TLR_SIZE,
 527                                        GFP_ATOMIC);
 528                 if (err < 0)
 529                         return err;
 530         }
 531
 532         /* Add the STP header */
 533         dlen = skb->len;
 534         shdr = skb_push(skb, sizeof(*shdr));
 535         shdr->prefix = 0x80;
 536         shdr->dlen = cpu_to_be16((dlen & 0x0fff) | (type << 12));
 537         shdr->cs = 0;           /* MT7622 doesn't care about checksum value */
 538
 539         /* Add the STP trailer */
 540         skb_put_zero(skb, MTK_STP_TLR_SIZE);
 541
 542         skb_queue_tail(&bdev->txq, skb);
 543
 544         btmtkuart_tx_wakeup(bdev);
 545         return 0;
 546 }
 547
 548 static int btmtkuart_probe(struct serdev_device *serdev)
 549 {
 550         struct btmtkuart_dev *bdev;
 551         struct hci_dev *hdev;
 552
 553         bdev = devm_kzalloc(&serdev->dev, sizeof(*bdev), GFP_KERNEL);
 554         if (!bdev)
 555                 return -ENOMEM;
 556
 557         bdev->clk = devm_clk_get(&serdev->dev, "ref");
 558         if (IS_ERR(bdev->clk))
 559                 return PTR_ERR(bdev->clk);
 560
 561         bdev->serdev = serdev;
 562         serdev_device_set_drvdata(serdev, bdev);
 563
 564         serdev_device_set_client_ops(serdev, &btmtkuart_client_ops);
 565
 566         INIT_WORK(&bdev->tx_work, btmtkuart_tx_work);
 567         skb_queue_head_init(&bdev->txq);
 568
 569         /* Initialize and register HCI device */
 570         hdev = hci_alloc_dev();
 571         if (!hdev) {
 572                 dev_err(&serdev->dev, "Can't allocate HCI device\n");
 573                 return -ENOMEM;
 574         }
 575
 576         bdev->hdev = hdev;
 577
 578         hdev->bus = HCI_UART;
 579         hci_set_drvdata(hdev, bdev);
 580
 581         hdev->open     = btmtkuart_open;
 582         hdev->close    = btmtkuart_close;
 583         hdev->flush    = btmtkuart_flush;
 584         hdev->setup    = btmtkuart_setup;
 585         hdev->shutdown = btmtkuart_shutdown;
 586         hdev->send     = btmtkuart_send_frame;
 587         SET_HCIDEV_DEV(hdev, &serdev->dev);
 588
 589         hdev->manufacturer = 70;
 590         set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 591
 592         if (hci_register_dev(hdev) < 0) {
 593                 dev_err(&serdev->dev, "Can't register HCI device\n");
 594                 hci_free_dev(hdev);
 595                 return -ENODEV;
 596         }
 597
 598         return 0;
 599 }
 600
 601 static void btmtkuart_remove(struct serdev_device *serdev)
 602 {
 603         struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
 604         struct hci_dev *hdev = bdev->hdev;
 605
 606         hci_unregister_dev(hdev);
 607         hci_free_dev(hdev);
 608 }
 609
 610 #ifdef CONFIG_OF
 611 static const struct of_device_id mtk_of_match_table[] = {
 612         { .compatible = "mediatek,mt7622-bluetooth"},
 613         { }
 614 };
 615 MODULE_DEVICE_TABLE(of, mtk_of_match_table);
 616 #endif
 617
 618 static struct serdev_device_driver btmtkuart_driver = {
 619         .probe = btmtkuart_probe,
 620         .remove = btmtkuart_remove,
 621         .driver = {
 622                 .name = "btmtkuart",
 623                 .of_match_table = of_match_ptr(mtk_of_match_table),
 624         },
 625 };
 626
 627 module_serdev_device_driver(btmtkuart_driver);
 628
 629 MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
 630 MODULE_DESCRIPTION("MediaTek Bluetooth Serial driver ver " VERSION);
 631 MODULE_VERSION(VERSION);
 632 MODULE_LICENSE("GPL");
 633 /*(DEBLOBBED)*/