1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * NXP Bluetooth driver
4 * Copyright 2023 NXP
5 */
6
7 #include <linux/module.h>
8 #include <linux/kernel.h>
9
10 #include <linux/serdev.h>
11 #include <linux/of.h>
12 #include <linux/skbuff.h>
13 #include <linux/unaligned.h>
14 #include <linux/firmware.h>
15 #include <linux/string.h>
16 #include <linux/crc8.h>
17 #include <linux/crc32.h>
18 #include <linux/string_helpers.h>
19
20 #include <net/bluetooth/bluetooth.h>
21 #include <net/bluetooth/hci_core.h>
22
23 #include "h4_recv.h"
24
25 #define MANUFACTURER_NXP 37
26
27 #define BTNXPUART_TX_STATE_ACTIVE 1
28 #define BTNXPUART_FW_DOWNLOADING 2
29 #define BTNXPUART_CHECK_BOOT_SIGNATURE 3
30 #define BTNXPUART_SERDEV_OPEN 4
31 #define BTNXPUART_IR_IN_PROGRESS 5
32 #define BTNXPUART_FW_DOWNLOAD_ABORT 6
33
34 /* NXP HW err codes */
35 #define BTNXPUART_IR_HW_ERR 0xb0
36
37 #define FIRMWARE_W8987 "uart8987_bt_v0.bin"
38 #define FIRMWARE_W8987_OLD "uartuart8987_bt.bin"
39 #define FIRMWARE_W8997 "uart8997_bt_v4.bin"
40 #define FIRMWARE_W8997_OLD "uartuart8997_bt_v4.bin"
41 #define FIRMWARE_W9098 "uart9098_bt_v1.bin"
42 #define FIRMWARE_W9098_OLD "uartuart9098_bt_v1.bin"
43 #define FIRMWARE_IW416 "uartiw416_bt_v0.bin"
44 #define FIRMWARE_IW612 "uartspi_n61x_v1.bin.se"
45 #define FIRMWARE_IW615 "uartspi_iw610_v0.bin"
46 #define FIRMWARE_SECURE_IW615 "uartspi_iw610_v0.bin.se"
47 #define FIRMWARE_IW624 "uartiw624_bt.bin"
48 #define FIRMWARE_SECURE_IW624 "uartiw624_bt.bin.se"
49 #define FIRMWARE_AW693 "uartaw693_bt.bin"
50 #define FIRMWARE_SECURE_AW693 "uartaw693_bt.bin.se"
51 #define FIRMWARE_AW693_A1 "uartaw693_bt_v1.bin"
52 #define FIRMWARE_SECURE_AW693_A1 "uartaw693_bt_v1.bin.se"
53 #define FIRMWARE_HELPER "helper_uart_3000000.bin"
54
55 #define CHIP_ID_W9098 0x5c03
56 #define CHIP_ID_IW416 0x7201
57 #define CHIP_ID_IW612 0x7601
58 #define CHIP_ID_IW624a 0x8000
59 #define CHIP_ID_IW624c 0x8001
60 #define CHIP_ID_AW693a0 0x8200
61 #define CHIP_ID_AW693a1 0x8201
62 #define CHIP_ID_IW615a0 0x8800
63 #define CHIP_ID_IW615a1 0x8801
64
65 #define FW_SECURE_MASK 0xc0
66 #define FW_OPEN 0x00
67 #define FW_AUTH_ILLEGAL 0x40
68 #define FW_AUTH_PLAIN 0x80
69 #define FW_AUTH_ENC 0xc0
70
71 #define HCI_NXP_PRI_BAUDRATE 115200
72 #define HCI_NXP_SEC_BAUDRATE 3000000
73
74 #define MAX_FW_FILE_NAME_LEN 50
75
76 /* Default ps timeout period in milliseconds */
77 #define PS_DEFAULT_TIMEOUT_PERIOD_MS 2000
78
79 /* wakeup methods */
80 #define WAKEUP_METHOD_DTR 0
81 #define WAKEUP_METHOD_BREAK 1
82 #define WAKEUP_METHOD_EXT_BREAK 2
83 #define WAKEUP_METHOD_RTS 3
84 #define WAKEUP_METHOD_INVALID 0xff
85
86 /* power save mode status */
87 #define PS_MODE_DISABLE 0
88 #define PS_MODE_ENABLE 1
89
90 /* Power Save Commands to ps_work_func */
91 #define PS_CMD_EXIT_PS 1
92 #define PS_CMD_ENTER_PS 2
93
94 /* power save state */
95 #define PS_STATE_AWAKE 0
96 #define PS_STATE_SLEEP 1
97
98 /* Bluetooth vendor command : Sleep mode */
99 #define HCI_NXP_AUTO_SLEEP_MODE 0xfc23
100 /* Bluetooth vendor command : Wakeup method */
101 #define HCI_NXP_WAKEUP_METHOD 0xfc53
102 /* Bluetooth vendor command : Set operational baudrate */
103 #define HCI_NXP_SET_OPER_SPEED 0xfc09
104 /* Bluetooth vendor command: Independent Reset */
105 #define HCI_NXP_IND_RESET 0xfcfc
106
107 /* Bluetooth Power State : Vendor cmd params */
108 #define BT_PS_ENABLE 0x02
109 #define BT_PS_DISABLE 0x03
110
111 /* Bluetooth Host Wakeup Methods */
112 #define BT_HOST_WAKEUP_METHOD_NONE 0x00
113 #define BT_HOST_WAKEUP_METHOD_DTR 0x01
114 #define BT_HOST_WAKEUP_METHOD_BREAK 0x02
115 #define BT_HOST_WAKEUP_METHOD_GPIO 0x03
116
117 /* Bluetooth Chip Wakeup Methods */
118 #define BT_CTRL_WAKEUP_METHOD_DSR 0x00
119 #define BT_CTRL_WAKEUP_METHOD_BREAK 0x01
120 #define BT_CTRL_WAKEUP_METHOD_GPIO 0x02
121 #define BT_CTRL_WAKEUP_METHOD_EXT_BREAK 0x04
122 #define BT_CTRL_WAKEUP_METHOD_RTS 0x05
123
124 struct ps_data {
125 u8 target_ps_mode; /* ps mode to be set */
126 u8 cur_psmode; /* current ps_mode */
127 u8 ps_state; /* controller's power save state */
128 u8 ps_cmd;
129 u8 h2c_wakeupmode;
130 u8 cur_h2c_wakeupmode;
131 u8 c2h_wakeupmode;
132 u8 c2h_wakeup_gpio;
133 u8 h2c_wakeup_gpio;
134 bool driver_sent_cmd;
135 u16 h2c_ps_interval;
136 u16 c2h_ps_interval;
137 struct hci_dev *hdev;
138 struct work_struct work;
139 struct timer_list ps_timer;
140 struct mutex ps_lock;
141 };
142
143 struct wakeup_cmd_payload {
144 u8 c2h_wakeupmode;
145 u8 c2h_wakeup_gpio;
146 u8 h2c_wakeupmode;
147 u8 h2c_wakeup_gpio;
148 } __packed;
149
150 struct psmode_cmd_payload {
151 u8 ps_cmd;
152 __le16 c2h_ps_interval;
153 } __packed;
154
155 struct btnxpuart_data {
156 const char *helper_fw_name;
157 const char *fw_name;
158 const char *fw_name_old;
159 };
160
161 struct btnxpuart_dev {
162 struct hci_dev *hdev;
163 struct serdev_device *serdev;
164
165 struct work_struct tx_work;
166 unsigned long tx_state;
167 struct sk_buff_head txq;
168 struct sk_buff *rx_skb;
169
170 const struct firmware *fw;
171 u8 fw_name[MAX_FW_FILE_NAME_LEN];
172 u32 fw_dnld_v1_offset;
173 u32 fw_v1_sent_bytes;
174 u32 fw_dnld_v3_offset;
175 u32 fw_v3_offset_correction;
176 u32 fw_v1_expected_len;
177 u32 boot_reg_offset;
178 wait_queue_head_t fw_dnld_done_wait_q;
179 wait_queue_head_t check_boot_sign_wait_q;
180
181 u32 new_baudrate;
182 u32 current_baudrate;
183 u32 fw_init_baudrate;
184 bool timeout_changed;
185 bool baudrate_changed;
186 bool helper_downloaded;
187
188 struct ps_data psdata;
189 struct btnxpuart_data *nxp_data;
190 };
191
192 #define NXP_V1_FW_REQ_PKT 0xa5
193 #define NXP_V1_CHIP_VER_PKT 0xaa
194 #define NXP_V3_FW_REQ_PKT 0xa7
195 #define NXP_V3_CHIP_VER_PKT 0xab
196
197 #define NXP_ACK_V1 0x5a
198 #define NXP_NAK_V1 0xbf
199 #define NXP_ACK_V3 0x7a
200 #define NXP_NAK_V3 0x7b
201 #define NXP_CRC_ERROR_V3 0x7c
202
203 /* Bootloader signature error codes */
204 #define NXP_ACK_RX_TIMEOUT 0x0002 /* ACK not received from host */
205 #define NXP_HDR_RX_TIMEOUT 0x0003 /* FW Header chunk not received */
206 #define NXP_DATA_RX_TIMEOUT 0x0004 /* FW Data chunk not received */
207
208 #define HDR_LEN 16
209
210 #define NXP_RECV_CHIP_VER_V1 \
211 .type = NXP_V1_CHIP_VER_PKT, \
212 .hlen = 4, \
213 .loff = 0, \
214 .lsize = 0, \
215 .maxlen = 4
216
217 #define NXP_RECV_FW_REQ_V1 \
218 .type = NXP_V1_FW_REQ_PKT, \
219 .hlen = 4, \
220 .loff = 0, \
221 .lsize = 0, \
222 .maxlen = 4
223
224 #define NXP_RECV_CHIP_VER_V3 \
225 .type = NXP_V3_CHIP_VER_PKT, \
226 .hlen = 4, \
227 .loff = 0, \
228 .lsize = 0, \
229 .maxlen = 4
230
231 #define NXP_RECV_FW_REQ_V3 \
232 .type = NXP_V3_FW_REQ_PKT, \
233 .hlen = 9, \
234 .loff = 0, \
235 .lsize = 0, \
236 .maxlen = 9
237
238 struct v1_data_req {
239 __le16 len;
240 __le16 len_comp;
241 } __packed;
242
243 struct v1_start_ind {
244 __le16 chip_id;
245 __le16 chip_id_comp;
246 } __packed;
247
248 struct v3_data_req {
249 __le16 len;
250 __le32 offset;
251 __le16 error;
252 u8 crc;
253 } __packed;
254
255 struct v3_start_ind {
256 __le16 chip_id;
257 u8 loader_ver;
258 u8 crc;
259 } __packed;
260
261 /* UART register addresses of BT chip */
262 #define CLKDIVADDR 0x7f00008f
263 #define UARTDIVADDR 0x7f000090
264 #define UARTMCRADDR 0x7f000091
265 #define UARTREINITADDR 0x7f000092
266 #define UARTICRADDR 0x7f000093
267 #define UARTFCRADDR 0x7f000094
268
269 #define MCR 0x00000022
270 #define INIT 0x00000001
271 #define ICR 0x000000c7
272 #define FCR 0x000000c7
273
274 #define POLYNOMIAL8 0x07
275
276 struct uart_reg {
277 __le32 address;
278 __le32 value;
279 } __packed;
280
281 struct uart_config {
282 struct uart_reg clkdiv;
283 struct uart_reg uartdiv;
284 struct uart_reg mcr;
285 struct uart_reg re_init;
286 struct uart_reg icr;
287 struct uart_reg fcr;
288 __be32 crc;
289 } __packed;
290
291 struct nxp_bootloader_cmd {
292 __le32 header;
293 __le32 arg;
294 __le32 payload_len;
295 __be32 crc;
296 } __packed;
297
298 struct nxp_v3_rx_timeout_nak {
299 u8 nak;
300 __le32 offset;
301 u8 crc;
302 } __packed;
303
304 union nxp_v3_rx_timeout_nak_u {
305 struct nxp_v3_rx_timeout_nak pkt;
306 u8 buf[6];
307 };
308
309 static u8 crc8_table[CRC8_TABLE_SIZE];
310
311 /* Default configurations */
312 #define DEFAULT_H2C_WAKEUP_MODE WAKEUP_METHOD_BREAK
313 #define DEFAULT_PS_MODE PS_MODE_ENABLE
314 #define FW_INIT_BAUDRATE HCI_NXP_PRI_BAUDRATE
315
nxp_drv_send_cmd(struct hci_dev * hdev,u16 opcode,u32 plen,void * param)316 static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode,
317 u32 plen,
318 void *param)
319 {
320 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
321 struct ps_data *psdata = &nxpdev->psdata;
322 struct sk_buff *skb;
323
324 /* set flag to prevent nxp_enqueue from parsing values from this command and
325 * calling hci_cmd_sync_queue() again.
326 */
327 psdata->driver_sent_cmd = true;
328 skb = __hci_cmd_sync(hdev, opcode, plen, param, HCI_CMD_TIMEOUT);
329 psdata->driver_sent_cmd = false;
330
331 return skb;
332 }
333
btnxpuart_tx_wakeup(struct btnxpuart_dev * nxpdev)334 static void btnxpuart_tx_wakeup(struct btnxpuart_dev *nxpdev)
335 {
336 if (schedule_work(&nxpdev->tx_work))
337 set_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
338 }
339
340 /* NXP Power Save Feature */
ps_start_timer(struct btnxpuart_dev * nxpdev)341 static void ps_start_timer(struct btnxpuart_dev *nxpdev)
342 {
343 struct ps_data *psdata = &nxpdev->psdata;
344
345 if (!psdata)
346 return;
347
348 if (psdata->cur_psmode == PS_MODE_ENABLE)
349 mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval));
350
351 if (psdata->ps_state == PS_STATE_AWAKE && psdata->ps_cmd == PS_CMD_ENTER_PS)
352 cancel_work_sync(&psdata->work);
353 }
354
ps_cancel_timer(struct btnxpuart_dev * nxpdev)355 static void ps_cancel_timer(struct btnxpuart_dev *nxpdev)
356 {
357 struct ps_data *psdata = &nxpdev->psdata;
358
359 flush_work(&psdata->work);
360 timer_shutdown_sync(&psdata->ps_timer);
361 }
362
ps_control(struct hci_dev * hdev,u8 ps_state)363 static void ps_control(struct hci_dev *hdev, u8 ps_state)
364 {
365 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
366 struct ps_data *psdata = &nxpdev->psdata;
367 int status;
368
369 if (psdata->ps_state == ps_state ||
370 !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state))
371 return;
372
373 mutex_lock(&psdata->ps_lock);
374 switch (psdata->cur_h2c_wakeupmode) {
375 case WAKEUP_METHOD_DTR:
376 if (ps_state == PS_STATE_AWAKE)
377 status = serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
378 else
379 status = serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
380 break;
381 case WAKEUP_METHOD_BREAK:
382 default:
383 if (ps_state == PS_STATE_AWAKE)
384 status = serdev_device_break_ctl(nxpdev->serdev, 0);
385 else
386 status = serdev_device_break_ctl(nxpdev->serdev, -1);
387 msleep(20); /* Allow chip to detect UART-break and enter sleep */
388 bt_dev_dbg(hdev, "Set UART break: %s, status=%d",
389 str_on_off(ps_state == PS_STATE_SLEEP), status);
390 break;
391 }
392 if (!status)
393 psdata->ps_state = ps_state;
394 mutex_unlock(&psdata->ps_lock);
395
396 if (ps_state == PS_STATE_AWAKE)
397 btnxpuart_tx_wakeup(nxpdev);
398 }
399
ps_work_func(struct work_struct * work)400 static void ps_work_func(struct work_struct *work)
401 {
402 struct ps_data *data = container_of(work, struct ps_data, work);
403
404 if (data->ps_cmd == PS_CMD_ENTER_PS && data->cur_psmode == PS_MODE_ENABLE)
405 ps_control(data->hdev, PS_STATE_SLEEP);
406 else if (data->ps_cmd == PS_CMD_EXIT_PS)
407 ps_control(data->hdev, PS_STATE_AWAKE);
408 }
409
ps_timeout_func(struct timer_list * t)410 static void ps_timeout_func(struct timer_list *t)
411 {
412 struct ps_data *data = from_timer(data, t, ps_timer);
413 struct hci_dev *hdev = data->hdev;
414 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
415
416 if (test_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state)) {
417 ps_start_timer(nxpdev);
418 } else {
419 data->ps_cmd = PS_CMD_ENTER_PS;
420 schedule_work(&data->work);
421 }
422 }
423
ps_setup(struct hci_dev * hdev)424 static void ps_setup(struct hci_dev *hdev)
425 {
426 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
427 struct ps_data *psdata = &nxpdev->psdata;
428
429 psdata->hdev = hdev;
430 INIT_WORK(&psdata->work, ps_work_func);
431 mutex_init(&psdata->ps_lock);
432 timer_setup(&psdata->ps_timer, ps_timeout_func, 0);
433 }
434
ps_wakeup(struct btnxpuart_dev * nxpdev)435 static bool ps_wakeup(struct btnxpuart_dev *nxpdev)
436 {
437 struct ps_data *psdata = &nxpdev->psdata;
438 u8 ps_state;
439
440 mutex_lock(&psdata->ps_lock);
441 ps_state = psdata->ps_state;
442 mutex_unlock(&psdata->ps_lock);
443
444 if (ps_state != PS_STATE_AWAKE) {
445 psdata->ps_cmd = PS_CMD_EXIT_PS;
446 schedule_work(&psdata->work);
447 return true;
448 }
449 return false;
450 }
451
ps_cleanup(struct btnxpuart_dev * nxpdev)452 static void ps_cleanup(struct btnxpuart_dev *nxpdev)
453 {
454 struct ps_data *psdata = &nxpdev->psdata;
455 u8 ps_state;
456
457 mutex_lock(&psdata->ps_lock);
458 ps_state = psdata->ps_state;
459 mutex_unlock(&psdata->ps_lock);
460
461 if (ps_state != PS_STATE_AWAKE)
462 ps_control(psdata->hdev, PS_STATE_AWAKE);
463
464 ps_cancel_timer(nxpdev);
465 cancel_work_sync(&psdata->work);
466 mutex_destroy(&psdata->ps_lock);
467 }
468
send_ps_cmd(struct hci_dev * hdev,void * data)469 static int send_ps_cmd(struct hci_dev *hdev, void *data)
470 {
471 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
472 struct ps_data *psdata = &nxpdev->psdata;
473 struct psmode_cmd_payload pcmd;
474 struct sk_buff *skb;
475 u8 *status;
476
477 if (psdata->target_ps_mode == PS_MODE_ENABLE)
478 pcmd.ps_cmd = BT_PS_ENABLE;
479 else
480 pcmd.ps_cmd = BT_PS_DISABLE;
481 pcmd.c2h_ps_interval = __cpu_to_le16(psdata->c2h_ps_interval);
482
483 skb = nxp_drv_send_cmd(hdev, HCI_NXP_AUTO_SLEEP_MODE, sizeof(pcmd), &pcmd);
484 if (IS_ERR(skb)) {
485 bt_dev_err(hdev, "Setting Power Save mode failed (%ld)", PTR_ERR(skb));
486 return PTR_ERR(skb);
487 }
488
489 status = skb_pull_data(skb, 1);
490 if (status) {
491 if (!*status)
492 psdata->cur_psmode = psdata->target_ps_mode;
493 else
494 psdata->target_ps_mode = psdata->cur_psmode;
495 if (psdata->cur_psmode == PS_MODE_ENABLE)
496 ps_start_timer(nxpdev);
497 else
498 ps_wakeup(nxpdev);
499 bt_dev_dbg(hdev, "Power Save mode response: status=%d, ps_mode=%d",
500 *status, psdata->cur_psmode);
501 }
502 kfree_skb(skb);
503
504 return 0;
505 }
506
send_wakeup_method_cmd(struct hci_dev * hdev,void * data)507 static int send_wakeup_method_cmd(struct hci_dev *hdev, void *data)
508 {
509 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
510 struct ps_data *psdata = &nxpdev->psdata;
511 struct wakeup_cmd_payload pcmd;
512 struct sk_buff *skb;
513 u8 *status;
514
515 pcmd.c2h_wakeupmode = psdata->c2h_wakeupmode;
516 pcmd.c2h_wakeup_gpio = psdata->c2h_wakeup_gpio;
517 switch (psdata->h2c_wakeupmode) {
518 case WAKEUP_METHOD_DTR:
519 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_DSR;
520 break;
521 case WAKEUP_METHOD_BREAK:
522 default:
523 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_BREAK;
524 break;
525 }
526 pcmd.h2c_wakeup_gpio = 0xff;
527
528 skb = nxp_drv_send_cmd(hdev, HCI_NXP_WAKEUP_METHOD, sizeof(pcmd), &pcmd);
529 if (IS_ERR(skb)) {
530 bt_dev_err(hdev, "Setting wake-up method failed (%ld)", PTR_ERR(skb));
531 return PTR_ERR(skb);
532 }
533
534 status = skb_pull_data(skb, 1);
535 if (status) {
536 if (*status == 0)
537 psdata->cur_h2c_wakeupmode = psdata->h2c_wakeupmode;
538 else
539 psdata->h2c_wakeupmode = psdata->cur_h2c_wakeupmode;
540 bt_dev_dbg(hdev, "Set Wakeup Method response: status=%d, h2c_wakeupmode=%d",
541 *status, psdata->cur_h2c_wakeupmode);
542 }
543 kfree_skb(skb);
544
545 return 0;
546 }
547
ps_init(struct hci_dev * hdev)548 static void ps_init(struct hci_dev *hdev)
549 {
550 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
551 struct ps_data *psdata = &nxpdev->psdata;
552
553 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_RTS);
554 usleep_range(5000, 10000);
555 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_RTS, 0);
556 usleep_range(5000, 10000);
557
558 psdata->ps_state = PS_STATE_AWAKE;
559 psdata->c2h_wakeupmode = BT_HOST_WAKEUP_METHOD_NONE;
560 psdata->c2h_wakeup_gpio = 0xff;
561
562 psdata->cur_h2c_wakeupmode = WAKEUP_METHOD_INVALID;
563 psdata->h2c_ps_interval = PS_DEFAULT_TIMEOUT_PERIOD_MS;
564 switch (DEFAULT_H2C_WAKEUP_MODE) {
565 case WAKEUP_METHOD_DTR:
566 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
567 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
568 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
569 break;
570 case WAKEUP_METHOD_BREAK:
571 default:
572 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
573 serdev_device_break_ctl(nxpdev->serdev, -1);
574 usleep_range(5000, 10000);
575 serdev_device_break_ctl(nxpdev->serdev, 0);
576 usleep_range(5000, 10000);
577 break;
578 }
579
580 psdata->cur_psmode = PS_MODE_DISABLE;
581 psdata->target_ps_mode = DEFAULT_PS_MODE;
582
583 if (psdata->cur_h2c_wakeupmode != psdata->h2c_wakeupmode)
584 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
585 if (psdata->cur_psmode != psdata->target_ps_mode)
586 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
587 }
588
589 /* NXP Firmware Download Feature */
nxp_download_firmware(struct hci_dev * hdev)590 static int nxp_download_firmware(struct hci_dev *hdev)
591 {
592 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
593 int err = 0;
594
595 nxpdev->fw_dnld_v1_offset = 0;
596 nxpdev->fw_v1_sent_bytes = 0;
597 nxpdev->fw_v1_expected_len = HDR_LEN;
598 nxpdev->boot_reg_offset = 0;
599 nxpdev->fw_dnld_v3_offset = 0;
600 nxpdev->fw_v3_offset_correction = 0;
601 nxpdev->baudrate_changed = false;
602 nxpdev->timeout_changed = false;
603 nxpdev->helper_downloaded = false;
604
605 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
606 serdev_device_set_flow_control(nxpdev->serdev, false);
607 nxpdev->current_baudrate = HCI_NXP_PRI_BAUDRATE;
608
609 /* Wait till FW is downloaded */
610 err = wait_event_interruptible_timeout(nxpdev->fw_dnld_done_wait_q,
611 !test_bit(BTNXPUART_FW_DOWNLOADING,
612 &nxpdev->tx_state),
613 msecs_to_jiffies(60000));
614
615 if (nxpdev->fw && strlen(nxpdev->fw_name)) {
616 release_firmware(nxpdev->fw);
617 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
618 }
619
620 if (err == 0) {
621 bt_dev_err(hdev, "FW Download Timeout. offset: %d",
622 nxpdev->fw_dnld_v1_offset ?
623 nxpdev->fw_dnld_v1_offset :
624 nxpdev->fw_dnld_v3_offset);
625 return -ETIMEDOUT;
626 }
627 if (test_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state)) {
628 bt_dev_err(hdev, "FW Download Aborted");
629 return -EINTR;
630 }
631
632 serdev_device_set_flow_control(nxpdev->serdev, true);
633
634 /* Allow the downloaded FW to initialize */
635 msleep(1200);
636
637 return 0;
638 }
639
nxp_send_ack(u8 ack,struct hci_dev * hdev)640 static void nxp_send_ack(u8 ack, struct hci_dev *hdev)
641 {
642 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
643 u8 ack_nak[2];
644 int len = 1;
645
646 ack_nak[0] = ack;
647 if (ack == NXP_ACK_V3) {
648 ack_nak[1] = crc8(crc8_table, ack_nak, 1, 0xff);
649 len = 2;
650 }
651 serdev_device_write_buf(nxpdev->serdev, ack_nak, len);
652 }
653
nxp_fw_change_baudrate(struct hci_dev * hdev,u16 req_len)654 static bool nxp_fw_change_baudrate(struct hci_dev *hdev, u16 req_len)
655 {
656 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
657 struct nxp_bootloader_cmd nxp_cmd5;
658 struct uart_config uart_config;
659 u32 clkdivaddr = CLKDIVADDR - nxpdev->boot_reg_offset;
660 u32 uartdivaddr = UARTDIVADDR - nxpdev->boot_reg_offset;
661 u32 uartmcraddr = UARTMCRADDR - nxpdev->boot_reg_offset;
662 u32 uartreinitaddr = UARTREINITADDR - nxpdev->boot_reg_offset;
663 u32 uarticraddr = UARTICRADDR - nxpdev->boot_reg_offset;
664 u32 uartfcraddr = UARTFCRADDR - nxpdev->boot_reg_offset;
665
666 if (req_len == sizeof(nxp_cmd5)) {
667 nxp_cmd5.header = __cpu_to_le32(5);
668 nxp_cmd5.arg = 0;
669 nxp_cmd5.payload_len = __cpu_to_le32(sizeof(uart_config));
670 /* FW expects swapped CRC bytes */
671 nxp_cmd5.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd5,
672 sizeof(nxp_cmd5) - 4));
673
674 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd5, sizeof(nxp_cmd5));
675 nxpdev->fw_v3_offset_correction += req_len;
676 } else if (req_len == sizeof(uart_config)) {
677 uart_config.clkdiv.address = __cpu_to_le32(clkdivaddr);
678 uart_config.clkdiv.value = __cpu_to_le32(0x00c00000);
679 uart_config.uartdiv.address = __cpu_to_le32(uartdivaddr);
680 uart_config.uartdiv.value = __cpu_to_le32(1);
681 uart_config.mcr.address = __cpu_to_le32(uartmcraddr);
682 uart_config.mcr.value = __cpu_to_le32(MCR);
683 uart_config.re_init.address = __cpu_to_le32(uartreinitaddr);
684 uart_config.re_init.value = __cpu_to_le32(INIT);
685 uart_config.icr.address = __cpu_to_le32(uarticraddr);
686 uart_config.icr.value = __cpu_to_le32(ICR);
687 uart_config.fcr.address = __cpu_to_le32(uartfcraddr);
688 uart_config.fcr.value = __cpu_to_le32(FCR);
689 /* FW expects swapped CRC bytes */
690 uart_config.crc = __cpu_to_be32(crc32_be(0UL, (char *)&uart_config,
691 sizeof(uart_config) - 4));
692
693 serdev_device_write_buf(nxpdev->serdev, (u8 *)&uart_config, sizeof(uart_config));
694 serdev_device_wait_until_sent(nxpdev->serdev, 0);
695 nxpdev->fw_v3_offset_correction += req_len;
696 return true;
697 }
698 return false;
699 }
700
nxp_fw_change_timeout(struct hci_dev * hdev,u16 req_len)701 static bool nxp_fw_change_timeout(struct hci_dev *hdev, u16 req_len)
702 {
703 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
704 struct nxp_bootloader_cmd nxp_cmd7;
705
706 if (req_len != sizeof(nxp_cmd7))
707 return false;
708
709 nxp_cmd7.header = __cpu_to_le32(7);
710 nxp_cmd7.arg = __cpu_to_le32(0x70);
711 nxp_cmd7.payload_len = 0;
712 /* FW expects swapped CRC bytes */
713 nxp_cmd7.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd7,
714 sizeof(nxp_cmd7) - 4));
715 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd7, sizeof(nxp_cmd7));
716 serdev_device_wait_until_sent(nxpdev->serdev, 0);
717 nxpdev->fw_v3_offset_correction += req_len;
718 return true;
719 }
720
nxp_get_data_len(const u8 * buf)721 static u32 nxp_get_data_len(const u8 *buf)
722 {
723 struct nxp_bootloader_cmd *hdr = (struct nxp_bootloader_cmd *)buf;
724
725 return __le32_to_cpu(hdr->payload_len);
726 }
727
is_fw_downloading(struct btnxpuart_dev * nxpdev)728 static bool is_fw_downloading(struct btnxpuart_dev *nxpdev)
729 {
730 return test_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
731 }
732
process_boot_signature(struct btnxpuart_dev * nxpdev)733 static bool process_boot_signature(struct btnxpuart_dev *nxpdev)
734 {
735 if (test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state)) {
736 clear_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
737 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
738 return false;
739 }
740 return is_fw_downloading(nxpdev);
741 }
742
nxp_request_firmware(struct hci_dev * hdev,const char * fw_name,const char * fw_name_old)743 static int nxp_request_firmware(struct hci_dev *hdev, const char *fw_name,
744 const char *fw_name_old)
745 {
746 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
747 const char *fw_name_dt;
748 int err = 0;
749
750 if (!fw_name)
751 return -ENOENT;
752
753 if (!strlen(nxpdev->fw_name)) {
754 if (strcmp(fw_name, FIRMWARE_HELPER) &&
755 !device_property_read_string(&nxpdev->serdev->dev,
756 "firmware-name",
757 &fw_name_dt))
758 fw_name = fw_name_dt;
759 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "nxp/%s", fw_name);
760 err = request_firmware_direct(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
761 if (err < 0 && fw_name_old) {
762 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "nxp/%s", fw_name_old);
763 err = request_firmware_direct(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
764 }
765
766 bt_dev_info(hdev, "Request Firmware: %s", nxpdev->fw_name);
767 if (err < 0) {
768 bt_dev_err(hdev, "Firmware file %s not found", nxpdev->fw_name);
769 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
770 }
771 }
772 return err;
773 }
774
775 /* for legacy chipsets with V1 bootloader */
nxp_recv_chip_ver_v1(struct hci_dev * hdev,struct sk_buff * skb)776 static int nxp_recv_chip_ver_v1(struct hci_dev *hdev, struct sk_buff *skb)
777 {
778 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
779 struct v1_start_ind *req;
780 __u16 chip_id;
781
782 req = skb_pull_data(skb, sizeof(*req));
783 if (!req)
784 goto free_skb;
785
786 chip_id = le16_to_cpu(req->chip_id ^ req->chip_id_comp);
787 if (chip_id == 0xffff && nxpdev->fw_dnld_v1_offset) {
788 nxpdev->fw_dnld_v1_offset = 0;
789 nxpdev->fw_v1_sent_bytes = 0;
790 nxpdev->fw_v1_expected_len = HDR_LEN;
791 release_firmware(nxpdev->fw);
792 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
793 nxp_send_ack(NXP_ACK_V1, hdev);
794 }
795
796 free_skb:
797 kfree_skb(skb);
798 return 0;
799 }
800
nxp_recv_fw_req_v1(struct hci_dev * hdev,struct sk_buff * skb)801 static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
802 {
803 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
804 struct btnxpuart_data *nxp_data = nxpdev->nxp_data;
805 struct v1_data_req *req;
806 __u16 len;
807
808 if (!process_boot_signature(nxpdev))
809 goto free_skb;
810
811 req = skb_pull_data(skb, sizeof(*req));
812 if (!req)
813 goto free_skb;
814
815 len = __le16_to_cpu(req->len ^ req->len_comp);
816 if (len != 0xffff) {
817 bt_dev_dbg(hdev, "ERR: Send NAK");
818 nxp_send_ack(NXP_NAK_V1, hdev);
819 goto free_skb;
820 }
821 nxp_send_ack(NXP_ACK_V1, hdev);
822
823 len = __le16_to_cpu(req->len);
824
825 if (!nxp_data->helper_fw_name) {
826 if (!nxpdev->timeout_changed) {
827 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev,
828 len);
829 goto free_skb;
830 }
831 if (!nxpdev->baudrate_changed) {
832 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev,
833 len);
834 if (nxpdev->baudrate_changed) {
835 serdev_device_set_baudrate(nxpdev->serdev,
836 HCI_NXP_SEC_BAUDRATE);
837 serdev_device_set_flow_control(nxpdev->serdev, true);
838 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
839 }
840 goto free_skb;
841 }
842 }
843
844 if (!nxp_data->helper_fw_name || nxpdev->helper_downloaded) {
845 if (nxp_request_firmware(hdev, nxp_data->fw_name, nxp_data->fw_name_old))
846 goto free_skb;
847 } else if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
848 if (nxp_request_firmware(hdev, nxp_data->helper_fw_name, NULL))
849 goto free_skb;
850 }
851
852 if (!len) {
853 bt_dev_info(hdev, "FW Download Complete: %zu bytes",
854 nxpdev->fw->size);
855 if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
856 nxpdev->helper_downloaded = true;
857 serdev_device_wait_until_sent(nxpdev->serdev, 0);
858 serdev_device_set_baudrate(nxpdev->serdev,
859 HCI_NXP_SEC_BAUDRATE);
860 serdev_device_set_flow_control(nxpdev->serdev, true);
861 } else {
862 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
863 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
864 }
865 goto free_skb;
866 }
867 if (len & 0x01) {
868 /* The CRC did not match at the other end.
869 * Simply send the same bytes again.
870 */
871 len = nxpdev->fw_v1_sent_bytes;
872 bt_dev_dbg(hdev, "CRC error. Resend %d bytes of FW.", len);
873 } else {
874 nxpdev->fw_dnld_v1_offset += nxpdev->fw_v1_sent_bytes;
875
876 /* The FW bin file is made up of many blocks of
877 * 16 byte header and payload data chunks. If the
878 * FW has requested a header, read the payload length
879 * info from the header, before sending the header.
880 * In the next iteration, the FW should request the
881 * payload data chunk, which should be equal to the
882 * payload length read from header. If there is a
883 * mismatch, clearly the driver and FW are out of sync,
884 * and we need to re-send the previous header again.
885 */
886 if (len == nxpdev->fw_v1_expected_len) {
887 if (len == HDR_LEN)
888 nxpdev->fw_v1_expected_len = nxp_get_data_len(nxpdev->fw->data +
889 nxpdev->fw_dnld_v1_offset);
890 else
891 nxpdev->fw_v1_expected_len = HDR_LEN;
892 } else if (len == HDR_LEN) {
893 /* FW download out of sync. Send previous chunk again */
894 nxpdev->fw_dnld_v1_offset -= nxpdev->fw_v1_sent_bytes;
895 nxpdev->fw_v1_expected_len = HDR_LEN;
896 }
897 }
898
899 if (nxpdev->fw_dnld_v1_offset + len <= nxpdev->fw->size)
900 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
901 nxpdev->fw_dnld_v1_offset, len);
902 nxpdev->fw_v1_sent_bytes = len;
903
904 free_skb:
905 kfree_skb(skb);
906 return 0;
907 }
908
nxp_get_fw_name_from_chipid(struct hci_dev * hdev,u16 chipid,u8 loader_ver)909 static char *nxp_get_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid,
910 u8 loader_ver)
911 {
912 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
913 char *fw_name = NULL;
914
915 switch (chipid) {
916 case CHIP_ID_W9098:
917 fw_name = FIRMWARE_W9098;
918 break;
919 case CHIP_ID_IW416:
920 fw_name = FIRMWARE_IW416;
921 break;
922 case CHIP_ID_IW612:
923 fw_name = FIRMWARE_IW612;
924 break;
925 case CHIP_ID_IW624a:
926 case CHIP_ID_IW624c:
927 nxpdev->boot_reg_offset = 1;
928 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
929 fw_name = FIRMWARE_IW624;
930 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
931 fw_name = FIRMWARE_SECURE_IW624;
932 else
933 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
934 break;
935 case CHIP_ID_AW693a0:
936 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
937 fw_name = FIRMWARE_AW693;
938 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
939 fw_name = FIRMWARE_SECURE_AW693;
940 else
941 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
942 break;
943 case CHIP_ID_AW693a1:
944 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
945 fw_name = FIRMWARE_AW693_A1;
946 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
947 fw_name = FIRMWARE_SECURE_AW693_A1;
948 else
949 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
950 break;
951 case CHIP_ID_IW615a0:
952 case CHIP_ID_IW615a1:
953 if ((loader_ver & FW_SECURE_MASK) == FW_OPEN)
954 fw_name = FIRMWARE_IW615;
955 else if ((loader_ver & FW_SECURE_MASK) != FW_AUTH_ILLEGAL)
956 fw_name = FIRMWARE_SECURE_IW615;
957 else
958 bt_dev_err(hdev, "Illegal loader version %02x", loader_ver);
959 break;
960 default:
961 bt_dev_err(hdev, "Unknown chip signature %04x", chipid);
962 break;
963 }
964 return fw_name;
965 }
966
nxp_get_old_fw_name_from_chipid(struct hci_dev * hdev,u16 chipid,u8 loader_ver)967 static char *nxp_get_old_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid,
968 u8 loader_ver)
969 {
970 char *fw_name_old = NULL;
971
972 switch (chipid) {
973 case CHIP_ID_W9098:
974 fw_name_old = FIRMWARE_W9098_OLD;
975 break;
976 }
977 return fw_name_old;
978 }
979
nxp_recv_chip_ver_v3(struct hci_dev * hdev,struct sk_buff * skb)980 static int nxp_recv_chip_ver_v3(struct hci_dev *hdev, struct sk_buff *skb)
981 {
982 struct v3_start_ind *req = skb_pull_data(skb, sizeof(*req));
983 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
984 const char *fw_name;
985 const char *fw_name_old;
986 u16 chip_id;
987 u8 loader_ver;
988
989 if (!process_boot_signature(nxpdev))
990 goto free_skb;
991
992 chip_id = le16_to_cpu(req->chip_id);
993 loader_ver = req->loader_ver;
994 bt_dev_info(hdev, "ChipID: %04x, Version: %d", chip_id, loader_ver);
995 fw_name = nxp_get_fw_name_from_chipid(hdev, chip_id, loader_ver);
996 fw_name_old = nxp_get_old_fw_name_from_chipid(hdev, chip_id, loader_ver);
997 if (!nxp_request_firmware(hdev, fw_name, fw_name_old))
998 nxp_send_ack(NXP_ACK_V3, hdev);
999
1000 free_skb:
1001 kfree_skb(skb);
1002 return 0;
1003 }
1004
nxp_handle_fw_download_error(struct hci_dev * hdev,struct v3_data_req * req)1005 static void nxp_handle_fw_download_error(struct hci_dev *hdev, struct v3_data_req *req)
1006 {
1007 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1008 __u32 offset = __le32_to_cpu(req->offset);
1009 __u16 err = __le16_to_cpu(req->error);
1010 union nxp_v3_rx_timeout_nak_u nak_tx_buf;
1011
1012 switch (err) {
1013 case NXP_ACK_RX_TIMEOUT:
1014 case NXP_HDR_RX_TIMEOUT:
1015 case NXP_DATA_RX_TIMEOUT:
1016 nak_tx_buf.pkt.nak = NXP_NAK_V3;
1017 nak_tx_buf.pkt.offset = __cpu_to_le32(offset);
1018 nak_tx_buf.pkt.crc = crc8(crc8_table, nak_tx_buf.buf,
1019 sizeof(nak_tx_buf) - 1, 0xff);
1020 serdev_device_write_buf(nxpdev->serdev, nak_tx_buf.buf,
1021 sizeof(nak_tx_buf));
1022 break;
1023 default:
1024 bt_dev_dbg(hdev, "Unknown bootloader error code: %d", err);
1025 break;
1026
1027 }
1028
1029 }
1030
nxp_recv_fw_req_v3(struct hci_dev * hdev,struct sk_buff * skb)1031 static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
1032 {
1033 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1034 struct v3_data_req *req;
1035 __u16 len;
1036 __u32 offset;
1037
1038 if (!process_boot_signature(nxpdev))
1039 goto free_skb;
1040
1041 req = skb_pull_data(skb, sizeof(*req));
1042 if (!req || !nxpdev->fw)
1043 goto free_skb;
1044
1045 if (!req->error) {
1046 nxp_send_ack(NXP_ACK_V3, hdev);
1047 } else {
1048 nxp_handle_fw_download_error(hdev, req);
1049 goto free_skb;
1050 }
1051
1052 len = __le16_to_cpu(req->len);
1053
1054 if (!nxpdev->timeout_changed) {
1055 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev, len);
1056 goto free_skb;
1057 }
1058
1059 if (!nxpdev->baudrate_changed) {
1060 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev, len);
1061 if (nxpdev->baudrate_changed) {
1062 serdev_device_set_baudrate(nxpdev->serdev,
1063 HCI_NXP_SEC_BAUDRATE);
1064 serdev_device_set_flow_control(nxpdev->serdev, true);
1065 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
1066 }
1067 goto free_skb;
1068 }
1069
1070 if (req->len == 0) {
1071 bt_dev_info(hdev, "FW Download Complete: %zu bytes",
1072 nxpdev->fw->size);
1073 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1074 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1075 goto free_skb;
1076 }
1077
1078 offset = __le32_to_cpu(req->offset);
1079 if (offset < nxpdev->fw_v3_offset_correction) {
1080 /* This scenario should ideally never occur. But if it ever does,
1081 * FW is out of sync and needs a power cycle.
1082 */
1083 bt_dev_err(hdev, "Something went wrong during FW download");
1084 bt_dev_err(hdev, "Please power cycle and try again");
1085 goto free_skb;
1086 }
1087
1088 nxpdev->fw_dnld_v3_offset = offset - nxpdev->fw_v3_offset_correction;
1089 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
1090 nxpdev->fw_dnld_v3_offset, len);
1091
1092 free_skb:
1093 kfree_skb(skb);
1094 return 0;
1095 }
1096
nxp_set_baudrate_cmd(struct hci_dev * hdev,void * data)1097 static int nxp_set_baudrate_cmd(struct hci_dev *hdev, void *data)
1098 {
1099 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1100 __le32 new_baudrate = __cpu_to_le32(nxpdev->new_baudrate);
1101 struct ps_data *psdata = &nxpdev->psdata;
1102 struct sk_buff *skb;
1103 u8 *status;
1104
1105 if (!psdata)
1106 return 0;
1107
1108 skb = nxp_drv_send_cmd(hdev, HCI_NXP_SET_OPER_SPEED, 4, (u8 *)&new_baudrate);
1109 if (IS_ERR(skb)) {
1110 bt_dev_err(hdev, "Setting baudrate failed (%ld)", PTR_ERR(skb));
1111 return PTR_ERR(skb);
1112 }
1113
1114 status = (u8 *)skb_pull_data(skb, 1);
1115 if (status) {
1116 if (*status == 0) {
1117 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->new_baudrate);
1118 nxpdev->current_baudrate = nxpdev->new_baudrate;
1119 }
1120 bt_dev_dbg(hdev, "Set baudrate response: status=%d, baudrate=%d",
1121 *status, nxpdev->new_baudrate);
1122 }
1123 kfree_skb(skb);
1124
1125 return 0;
1126 }
1127
nxp_check_boot_sign(struct btnxpuart_dev * nxpdev)1128 static int nxp_check_boot_sign(struct btnxpuart_dev *nxpdev)
1129 {
1130 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
1131 if (test_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state))
1132 serdev_device_set_flow_control(nxpdev->serdev, false);
1133 else
1134 serdev_device_set_flow_control(nxpdev->serdev, true);
1135 set_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
1136
1137 return wait_event_interruptible_timeout(nxpdev->check_boot_sign_wait_q,
1138 !test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE,
1139 &nxpdev->tx_state),
1140 msecs_to_jiffies(1000));
1141 }
1142
nxp_set_ind_reset(struct hci_dev * hdev,void * data)1143 static int nxp_set_ind_reset(struct hci_dev *hdev, void *data)
1144 {
1145 static const u8 ir_hw_err[] = { HCI_EV_HARDWARE_ERROR,
1146 0x01, BTNXPUART_IR_HW_ERR };
1147 struct sk_buff *skb;
1148
1149 skb = bt_skb_alloc(3, GFP_ATOMIC);
1150 if (!skb)
1151 return -ENOMEM;
1152
1153 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1154 skb_put_data(skb, ir_hw_err, 3);
1155
1156 /* Inject Hardware Error to upper stack */
1157 return hci_recv_frame(hdev, skb);
1158 }
1159
1160 /* NXP protocol */
nxp_setup(struct hci_dev * hdev)1161 static int nxp_setup(struct hci_dev *hdev)
1162 {
1163 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1164 int err = 0;
1165
1166 if (nxp_check_boot_sign(nxpdev)) {
1167 bt_dev_dbg(hdev, "Need FW Download.");
1168 err = nxp_download_firmware(hdev);
1169 if (err < 0)
1170 return err;
1171 } else {
1172 bt_dev_info(hdev, "FW already running.");
1173 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1174 }
1175
1176 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->fw_init_baudrate);
1177 nxpdev->current_baudrate = nxpdev->fw_init_baudrate;
1178
1179 if (nxpdev->current_baudrate != HCI_NXP_SEC_BAUDRATE) {
1180 nxpdev->new_baudrate = HCI_NXP_SEC_BAUDRATE;
1181 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1182 }
1183
1184 ps_init(hdev);
1185
1186 if (test_and_clear_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state))
1187 hci_dev_clear_flag(hdev, HCI_SETUP);
1188
1189 return 0;
1190 }
1191
nxp_hw_err(struct hci_dev * hdev,u8 code)1192 static void nxp_hw_err(struct hci_dev *hdev, u8 code)
1193 {
1194 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1195
1196 switch (code) {
1197 case BTNXPUART_IR_HW_ERR:
1198 set_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state);
1199 hci_dev_set_flag(hdev, HCI_SETUP);
1200 break;
1201 default:
1202 break;
1203 }
1204 }
1205
nxp_shutdown(struct hci_dev * hdev)1206 static int nxp_shutdown(struct hci_dev *hdev)
1207 {
1208 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1209 struct sk_buff *skb;
1210 u8 *status;
1211 u8 pcmd = 0;
1212
1213 if (test_bit(BTNXPUART_IR_IN_PROGRESS, &nxpdev->tx_state)) {
1214 skb = nxp_drv_send_cmd(hdev, HCI_NXP_IND_RESET, 1, &pcmd);
1215 if (IS_ERR(skb))
1216 return PTR_ERR(skb);
1217
1218 status = skb_pull_data(skb, 1);
1219 if (status) {
1220 serdev_device_set_flow_control(nxpdev->serdev, false);
1221 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1222 }
1223 kfree_skb(skb);
1224 }
1225
1226 return 0;
1227 }
1228
btnxpuart_queue_skb(struct hci_dev * hdev,struct sk_buff * skb)1229 static int btnxpuart_queue_skb(struct hci_dev *hdev, struct sk_buff *skb)
1230 {
1231 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1232
1233 /* Prepend skb with frame type */
1234 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
1235 skb_queue_tail(&nxpdev->txq, skb);
1236 btnxpuart_tx_wakeup(nxpdev);
1237 return 0;
1238 }
1239
nxp_enqueue(struct hci_dev * hdev,struct sk_buff * skb)1240 static int nxp_enqueue(struct hci_dev *hdev, struct sk_buff *skb)
1241 {
1242 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1243 struct ps_data *psdata = &nxpdev->psdata;
1244 struct hci_command_hdr *hdr;
1245 struct psmode_cmd_payload ps_parm;
1246 struct wakeup_cmd_payload wakeup_parm;
1247 __le32 baudrate_parm;
1248
1249 /* if vendor commands are received from user space (e.g. hcitool), update
1250 * driver flags accordingly and ask driver to re-send the command to FW.
1251 * In case the payload for any command does not match expected payload
1252 * length, let the firmware and user space program handle it, or throw
1253 * an error.
1254 */
1255 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT && !psdata->driver_sent_cmd) {
1256 hdr = (struct hci_command_hdr *)skb->data;
1257 if (hdr->plen != (skb->len - HCI_COMMAND_HDR_SIZE))
1258 return btnxpuart_queue_skb(hdev, skb);
1259
1260 switch (__le16_to_cpu(hdr->opcode)) {
1261 case HCI_NXP_AUTO_SLEEP_MODE:
1262 if (hdr->plen == sizeof(ps_parm)) {
1263 memcpy(&ps_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1264 if (ps_parm.ps_cmd == BT_PS_ENABLE)
1265 psdata->target_ps_mode = PS_MODE_ENABLE;
1266 else if (ps_parm.ps_cmd == BT_PS_DISABLE)
1267 psdata->target_ps_mode = PS_MODE_DISABLE;
1268 psdata->c2h_ps_interval = __le16_to_cpu(ps_parm.c2h_ps_interval);
1269 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
1270 goto free_skb;
1271 }
1272 break;
1273 case HCI_NXP_WAKEUP_METHOD:
1274 if (hdr->plen == sizeof(wakeup_parm)) {
1275 memcpy(&wakeup_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1276 psdata->c2h_wakeupmode = wakeup_parm.c2h_wakeupmode;
1277 psdata->c2h_wakeup_gpio = wakeup_parm.c2h_wakeup_gpio;
1278 psdata->h2c_wakeup_gpio = wakeup_parm.h2c_wakeup_gpio;
1279 switch (wakeup_parm.h2c_wakeupmode) {
1280 case BT_CTRL_WAKEUP_METHOD_DSR:
1281 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
1282 break;
1283 case BT_CTRL_WAKEUP_METHOD_BREAK:
1284 default:
1285 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
1286 break;
1287 }
1288 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
1289 goto free_skb;
1290 }
1291 break;
1292 case HCI_NXP_SET_OPER_SPEED:
1293 if (hdr->plen == sizeof(baudrate_parm)) {
1294 memcpy(&baudrate_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1295 nxpdev->new_baudrate = __le32_to_cpu(baudrate_parm);
1296 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1297 goto free_skb;
1298 }
1299 break;
1300 case HCI_NXP_IND_RESET:
1301 if (hdr->plen == 1) {
1302 hci_cmd_sync_queue(hdev, nxp_set_ind_reset, NULL, NULL);
1303 goto free_skb;
1304 }
1305 break;
1306 default:
1307 break;
1308 }
1309 }
1310
1311 return btnxpuart_queue_skb(hdev, skb);
1312
1313 free_skb:
1314 kfree_skb(skb);
1315 return 0;
1316 }
1317
nxp_dequeue(void * data)1318 static struct sk_buff *nxp_dequeue(void *data)
1319 {
1320 struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data;
1321
1322 ps_start_timer(nxpdev);
1323 return skb_dequeue(&nxpdev->txq);
1324 }
1325
1326 /* btnxpuart based on serdev */
btnxpuart_tx_work(struct work_struct * work)1327 static void btnxpuart_tx_work(struct work_struct *work)
1328 {
1329 struct btnxpuart_dev *nxpdev = container_of(work, struct btnxpuart_dev,
1330 tx_work);
1331 struct serdev_device *serdev = nxpdev->serdev;
1332 struct hci_dev *hdev = nxpdev->hdev;
1333 struct sk_buff *skb;
1334 int len;
1335
1336 if (ps_wakeup(nxpdev))
1337 return;
1338
1339 while ((skb = nxp_dequeue(nxpdev))) {
1340 len = serdev_device_write_buf(serdev, skb->data, skb->len);
1341 hdev->stat.byte_tx += len;
1342
1343 skb_pull(skb, len);
1344 if (skb->len > 0) {
1345 skb_queue_head(&nxpdev->txq, skb);
1346 continue;
1347 }
1348
1349 switch (hci_skb_pkt_type(skb)) {
1350 case HCI_COMMAND_PKT:
1351 hdev->stat.cmd_tx++;
1352 break;
1353 case HCI_ACLDATA_PKT:
1354 hdev->stat.acl_tx++;
1355 break;
1356 case HCI_SCODATA_PKT:
1357 hdev->stat.sco_tx++;
1358 break;
1359 }
1360
1361 kfree_skb(skb);
1362 }
1363 clear_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
1364 }
1365
btnxpuart_open(struct hci_dev * hdev)1366 static int btnxpuart_open(struct hci_dev *hdev)
1367 {
1368 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1369 int err = 0;
1370
1371 err = serdev_device_open(nxpdev->serdev);
1372 if (err) {
1373 bt_dev_err(hdev, "Unable to open UART device %s",
1374 dev_name(&nxpdev->serdev->dev));
1375 } else {
1376 set_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1377 }
1378 return err;
1379 }
1380
btnxpuart_close(struct hci_dev * hdev)1381 static int btnxpuart_close(struct hci_dev *hdev)
1382 {
1383 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1384
1385 serdev_device_close(nxpdev->serdev);
1386 skb_queue_purge(&nxpdev->txq);
1387 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1388 kfree_skb(nxpdev->rx_skb);
1389 nxpdev->rx_skb = NULL;
1390 }
1391 clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1392 return 0;
1393 }
1394
btnxpuart_flush(struct hci_dev * hdev)1395 static int btnxpuart_flush(struct hci_dev *hdev)
1396 {
1397 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1398
1399 /* Flush any pending characters */
1400 serdev_device_write_flush(nxpdev->serdev);
1401 skb_queue_purge(&nxpdev->txq);
1402
1403 cancel_work_sync(&nxpdev->tx_work);
1404
1405 if (!IS_ERR_OR_NULL(nxpdev->rx_skb)) {
1406 kfree_skb(nxpdev->rx_skb);
1407 nxpdev->rx_skb = NULL;
1408 }
1409
1410 return 0;
1411 }
1412
1413 static const struct h4_recv_pkt nxp_recv_pkts[] = {
1414 { H4_RECV_ACL, .recv = hci_recv_frame },
1415 { H4_RECV_SCO, .recv = hci_recv_frame },
1416 { H4_RECV_EVENT, .recv = hci_recv_frame },
1417 { H4_RECV_ISO, .recv = hci_recv_frame },
1418 { NXP_RECV_CHIP_VER_V1, .recv = nxp_recv_chip_ver_v1 },
1419 { NXP_RECV_FW_REQ_V1, .recv = nxp_recv_fw_req_v1 },
1420 { NXP_RECV_CHIP_VER_V3, .recv = nxp_recv_chip_ver_v3 },
1421 { NXP_RECV_FW_REQ_V3, .recv = nxp_recv_fw_req_v3 },
1422 };
1423
btnxpuart_receive_buf(struct serdev_device * serdev,const u8 * data,size_t count)1424 static size_t btnxpuart_receive_buf(struct serdev_device *serdev,
1425 const u8 *data, size_t count)
1426 {
1427 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1428
1429 ps_start_timer(nxpdev);
1430
1431 nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
1432 nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
1433 if (IS_ERR(nxpdev->rx_skb)) {
1434 int err = PTR_ERR(nxpdev->rx_skb);
1435 /* Safe to ignore out-of-sync bootloader signatures */
1436 if (!is_fw_downloading(nxpdev))
1437 bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
1438 return count;
1439 }
1440 if (!is_fw_downloading(nxpdev))
1441 nxpdev->hdev->stat.byte_rx += count;
1442 return count;
1443 }
1444
btnxpuart_write_wakeup(struct serdev_device * serdev)1445 static void btnxpuart_write_wakeup(struct serdev_device *serdev)
1446 {
1447 serdev_device_write_wakeup(serdev);
1448 }
1449
1450 static const struct serdev_device_ops btnxpuart_client_ops = {
1451 .receive_buf = btnxpuart_receive_buf,
1452 .write_wakeup = btnxpuart_write_wakeup,
1453 };
1454
nxp_serdev_probe(struct serdev_device * serdev)1455 static int nxp_serdev_probe(struct serdev_device *serdev)
1456 {
1457 struct hci_dev *hdev;
1458 struct btnxpuart_dev *nxpdev;
1459
1460 nxpdev = devm_kzalloc(&serdev->dev, sizeof(*nxpdev), GFP_KERNEL);
1461 if (!nxpdev)
1462 return -ENOMEM;
1463
1464 nxpdev->nxp_data = (struct btnxpuart_data *)device_get_match_data(&serdev->dev);
1465
1466 nxpdev->serdev = serdev;
1467 serdev_device_set_drvdata(serdev, nxpdev);
1468
1469 serdev_device_set_client_ops(serdev, &btnxpuart_client_ops);
1470
1471 INIT_WORK(&nxpdev->tx_work, btnxpuart_tx_work);
1472 skb_queue_head_init(&nxpdev->txq);
1473
1474 init_waitqueue_head(&nxpdev->fw_dnld_done_wait_q);
1475 init_waitqueue_head(&nxpdev->check_boot_sign_wait_q);
1476
1477 device_property_read_u32(&nxpdev->serdev->dev, "fw-init-baudrate",
1478 &nxpdev->fw_init_baudrate);
1479 if (!nxpdev->fw_init_baudrate)
1480 nxpdev->fw_init_baudrate = FW_INIT_BAUDRATE;
1481
1482 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1483
1484 crc8_populate_msb(crc8_table, POLYNOMIAL8);
1485
1486 /* Initialize and register HCI device */
1487 hdev = hci_alloc_dev();
1488 if (!hdev) {
1489 dev_err(&serdev->dev, "Can't allocate HCI device\n");
1490 return -ENOMEM;
1491 }
1492
1493 nxpdev->hdev = hdev;
1494
1495 hdev->bus = HCI_UART;
1496 hci_set_drvdata(hdev, nxpdev);
1497
1498 hdev->manufacturer = MANUFACTURER_NXP;
1499 hdev->open = btnxpuart_open;
1500 hdev->close = btnxpuart_close;
1501 hdev->flush = btnxpuart_flush;
1502 hdev->setup = nxp_setup;
1503 hdev->send = nxp_enqueue;
1504 hdev->hw_error = nxp_hw_err;
1505 hdev->shutdown = nxp_shutdown;
1506 SET_HCIDEV_DEV(hdev, &serdev->dev);
1507
1508 if (hci_register_dev(hdev) < 0) {
1509 dev_err(&serdev->dev, "Can't register HCI device\n");
1510 hci_free_dev(hdev);
1511 return -ENODEV;
1512 }
1513
1514 ps_setup(hdev);
1515
1516 return 0;
1517 }
1518
nxp_serdev_remove(struct serdev_device * serdev)1519 static void nxp_serdev_remove(struct serdev_device *serdev)
1520 {
1521 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1522 struct hci_dev *hdev = nxpdev->hdev;
1523
1524 if (is_fw_downloading(nxpdev)) {
1525 set_bit(BTNXPUART_FW_DOWNLOAD_ABORT, &nxpdev->tx_state);
1526 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1527 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
1528 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
1529 } else {
1530 /* Restore FW baudrate to fw_init_baudrate if changed.
1531 * This will ensure FW baudrate is in sync with
1532 * driver baudrate in case this driver is re-inserted.
1533 */
1534 if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
1535 nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
1536 nxp_set_baudrate_cmd(hdev, NULL);
1537 }
1538 }
1539 ps_cleanup(nxpdev);
1540 hci_unregister_dev(hdev);
1541 hci_free_dev(hdev);
1542 }
1543
1544 #ifdef CONFIG_PM_SLEEP
nxp_serdev_suspend(struct device * dev)1545 static int nxp_serdev_suspend(struct device *dev)
1546 {
1547 struct btnxpuart_dev *nxpdev = dev_get_drvdata(dev);
1548 struct ps_data *psdata = &nxpdev->psdata;
1549
1550 ps_control(psdata->hdev, PS_STATE_SLEEP);
1551 return 0;
1552 }
1553
nxp_serdev_resume(struct device * dev)1554 static int nxp_serdev_resume(struct device *dev)
1555 {
1556 struct btnxpuart_dev *nxpdev = dev_get_drvdata(dev);
1557 struct ps_data *psdata = &nxpdev->psdata;
1558
1559 ps_control(psdata->hdev, PS_STATE_AWAKE);
1560 return 0;
1561 }
1562 #endif
1563
1564 static struct btnxpuart_data w8987_data __maybe_unused = {
1565 .helper_fw_name = NULL,
1566 .fw_name = FIRMWARE_W8987,
1567 .fw_name_old = FIRMWARE_W8987_OLD,
1568 };
1569
1570 static struct btnxpuart_data w8997_data __maybe_unused = {
1571 .helper_fw_name = FIRMWARE_HELPER,
1572 .fw_name = FIRMWARE_W8997,
1573 .fw_name_old = FIRMWARE_W8997_OLD,
1574 };
1575
1576 static const struct of_device_id nxpuart_of_match_table[] __maybe_unused = {
1577 { .compatible = "nxp,88w8987-bt", .data = &w8987_data },
1578 { .compatible = "nxp,88w8997-bt", .data = &w8997_data },
1579 { }
1580 };
1581 MODULE_DEVICE_TABLE(of, nxpuart_of_match_table);
1582
1583 static const struct dev_pm_ops nxp_pm_ops = {
1584 SET_SYSTEM_SLEEP_PM_OPS(nxp_serdev_suspend, nxp_serdev_resume)
1585 };
1586
1587 static struct serdev_device_driver nxp_serdev_driver = {
1588 .probe = nxp_serdev_probe,
1589 .remove = nxp_serdev_remove,
1590 .driver = {
1591 .name = "btnxpuart",
1592 .of_match_table = of_match_ptr(nxpuart_of_match_table),
1593 .pm = &nxp_pm_ops,
1594 },
1595 };
1596
1597 module_serdev_device_driver(nxp_serdev_driver);
1598
1599 MODULE_AUTHOR("Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>");
1600 MODULE_DESCRIPTION("NXP Bluetooth Serial driver");
1601 MODULE_LICENSE("GPL");
1602