Loading...
1// SPDX-License-Identifier: ISC
2/* Copyright (C) 2021 MediaTek Inc.
3 *
4 */
5#include <linux/module.h>
6#include <linux/firmware.h>
7
8#include <net/bluetooth/bluetooth.h>
9#include <net/bluetooth/hci_core.h>
10
11#include "btmtk.h"
12
13#define VERSION "0.1"
14
15/* It is for mt79xx download rom patch*/
16#define MTK_FW_ROM_PATCH_HEADER_SIZE 32
17#define MTK_FW_ROM_PATCH_GD_SIZE 64
18#define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64
19#define MTK_SEC_MAP_COMMON_SIZE 12
20#define MTK_SEC_MAP_NEED_SEND_SIZE 52
21
22struct btmtk_patch_header {
23 u8 datetime[16];
24 u8 platform[4];
25 __le16 hwver;
26 __le16 swver;
27 __le32 magicnum;
28} __packed;
29
30struct btmtk_global_desc {
31 __le32 patch_ver;
32 __le32 sub_sys;
33 __le32 feature_opt;
34 __le32 section_num;
35} __packed;
36
37struct btmtk_section_map {
38 __le32 sectype;
39 __le32 secoffset;
40 __le32 secsize;
41 union {
42 __le32 u4SecSpec[13];
43 struct {
44 __le32 dlAddr;
45 __le32 dlsize;
46 __le32 seckeyidx;
47 __le32 alignlen;
48 __le32 sectype;
49 __le32 dlmodecrctype;
50 __le32 crc;
51 __le32 reserved[6];
52 } bin_info_spec;
53 };
54} __packed;
55
56int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
57 wmt_cmd_sync_func_t wmt_cmd_sync)
58{
59 struct btmtk_hci_wmt_params wmt_params;
60 struct btmtk_global_desc *globaldesc = NULL;
61 struct btmtk_section_map *sectionmap;
62 const struct firmware *fw;
63 const u8 *fw_ptr;
64 const u8 *fw_bin_ptr;
65 int err, dlen, i, status;
66 u8 flag, first_block, retry;
67 u32 section_num, dl_size, section_offset;
68 u8 cmd[64];
69
70 err = request_firmware(&fw, fwname, &hdev->dev);
71 if (err < 0) {
72 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
73 return err;
74 }
75
76 fw_ptr = fw->data;
77 fw_bin_ptr = fw_ptr;
78 globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
79 section_num = le32_to_cpu(globaldesc->section_num);
80
81 for (i = 0; i < section_num; i++) {
82 first_block = 1;
83 fw_ptr = fw_bin_ptr;
84 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
85 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
86
87 section_offset = le32_to_cpu(sectionmap->secoffset);
88 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
89
90 if (dl_size > 0) {
91 retry = 20;
92 while (retry > 0) {
93 cmd[0] = 0; /* 0 means legacy dl mode. */
94 memcpy(cmd + 1,
95 fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
96 MTK_FW_ROM_PATCH_GD_SIZE +
97 MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
98 MTK_SEC_MAP_COMMON_SIZE,
99 MTK_SEC_MAP_NEED_SEND_SIZE + 1);
100
101 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
102 wmt_params.status = &status;
103 wmt_params.flag = 0;
104 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
105 wmt_params.data = &cmd;
106
107 err = wmt_cmd_sync(hdev, &wmt_params);
108 if (err < 0) {
109 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
110 err);
111 goto err_release_fw;
112 }
113
114 if (status == BTMTK_WMT_PATCH_UNDONE) {
115 break;
116 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
117 msleep(100);
118 retry--;
119 } else if (status == BTMTK_WMT_PATCH_DONE) {
120 goto next_section;
121 } else {
122 bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
123 status);
124 err = -EIO;
125 goto err_release_fw;
126 }
127 }
128
129 fw_ptr += section_offset;
130 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
131 wmt_params.status = NULL;
132
133 while (dl_size > 0) {
134 dlen = min_t(int, 250, dl_size);
135 if (first_block == 1) {
136 flag = 1;
137 first_block = 0;
138 } else if (dl_size - dlen <= 0) {
139 flag = 3;
140 } else {
141 flag = 2;
142 }
143
144 wmt_params.flag = flag;
145 wmt_params.dlen = dlen;
146 wmt_params.data = fw_ptr;
147
148 err = wmt_cmd_sync(hdev, &wmt_params);
149 if (err < 0) {
150 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
151 err);
152 goto err_release_fw;
153 }
154
155 dl_size -= dlen;
156 fw_ptr += dlen;
157 }
158 }
159next_section:
160 continue;
161 }
162 /* Wait a few moments for firmware activation done */
163 usleep_range(100000, 120000);
164
165err_release_fw:
166 release_firmware(fw);
167
168 return err;
169}
170EXPORT_SYMBOL_GPL(btmtk_setup_firmware_79xx);
171
172int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
173 wmt_cmd_sync_func_t wmt_cmd_sync)
174{
175 struct btmtk_hci_wmt_params wmt_params;
176 const struct firmware *fw;
177 const u8 *fw_ptr;
178 size_t fw_size;
179 int err, dlen;
180 u8 flag, param;
181
182 err = request_firmware(&fw, fwname, &hdev->dev);
183 if (err < 0) {
184 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
185 return err;
186 }
187
188 /* Power on data RAM the firmware relies on. */
189 param = 1;
190 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
191 wmt_params.flag = 3;
192 wmt_params.dlen = sizeof(param);
193 wmt_params.data = ¶m;
194 wmt_params.status = NULL;
195
196 err = wmt_cmd_sync(hdev, &wmt_params);
197 if (err < 0) {
198 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
199 goto err_release_fw;
200 }
201
202 fw_ptr = fw->data;
203 fw_size = fw->size;
204
205 /* The size of patch header is 30 bytes, should be skip */
206 if (fw_size < 30) {
207 err = -EINVAL;
208 goto err_release_fw;
209 }
210
211 fw_size -= 30;
212 fw_ptr += 30;
213 flag = 1;
214
215 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
216 wmt_params.status = NULL;
217
218 while (fw_size > 0) {
219 dlen = min_t(int, 250, fw_size);
220
221 /* Tell device the position in sequence */
222 if (fw_size - dlen <= 0)
223 flag = 3;
224 else if (fw_size < fw->size - 30)
225 flag = 2;
226
227 wmt_params.flag = flag;
228 wmt_params.dlen = dlen;
229 wmt_params.data = fw_ptr;
230
231 err = wmt_cmd_sync(hdev, &wmt_params);
232 if (err < 0) {
233 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
234 err);
235 goto err_release_fw;
236 }
237
238 fw_size -= dlen;
239 fw_ptr += dlen;
240 }
241
242 wmt_params.op = BTMTK_WMT_RST;
243 wmt_params.flag = 4;
244 wmt_params.dlen = 0;
245 wmt_params.data = NULL;
246 wmt_params.status = NULL;
247
248 /* Activate funciton the firmware providing to */
249 err = wmt_cmd_sync(hdev, &wmt_params);
250 if (err < 0) {
251 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
252 goto err_release_fw;
253 }
254
255 /* Wait a few moments for firmware activation done */
256 usleep_range(10000, 12000);
257
258err_release_fw:
259 release_firmware(fw);
260
261 return err;
262}
263EXPORT_SYMBOL_GPL(btmtk_setup_firmware);
264
265int btmtk_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
266{
267 struct sk_buff *skb;
268 long ret;
269
270 skb = __hci_cmd_sync(hdev, 0xfc1a, 6, bdaddr, HCI_INIT_TIMEOUT);
271 if (IS_ERR(skb)) {
272 ret = PTR_ERR(skb);
273 bt_dev_err(hdev, "changing Mediatek device address failed (%ld)",
274 ret);
275 return ret;
276 }
277 kfree_skb(skb);
278
279 return 0;
280}
281EXPORT_SYMBOL_GPL(btmtk_set_bdaddr);
282
283MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
284MODULE_AUTHOR("Mark Chen <mark-yw.chen@mediatek.com>");
285MODULE_DESCRIPTION("Bluetooth support for MediaTek devices ver " VERSION);
286MODULE_VERSION(VERSION);
287MODULE_LICENSE("GPL");
288MODULE_FIRMWARE(FIRMWARE_MT7622);
289MODULE_FIRMWARE(FIRMWARE_MT7663);
290MODULE_FIRMWARE(FIRMWARE_MT7668);
291MODULE_FIRMWARE(FIRMWARE_MT7961);
1// SPDX-License-Identifier: ISC
2/* Copyright (C) 2021 MediaTek Inc.
3 *
4 */
5#include <linux/module.h>
6#include <linux/firmware.h>
7#include <linux/usb.h>
8#include <linux/iopoll.h>
9#include <linux/unaligned.h>
10
11#include <net/bluetooth/bluetooth.h>
12#include <net/bluetooth/hci_core.h>
13
14#include "btmtk.h"
15
16#define VERSION "0.1"
17
18/* It is for mt79xx download rom patch*/
19#define MTK_FW_ROM_PATCH_HEADER_SIZE 32
20#define MTK_FW_ROM_PATCH_GD_SIZE 64
21#define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64
22#define MTK_SEC_MAP_COMMON_SIZE 12
23#define MTK_SEC_MAP_NEED_SEND_SIZE 52
24
25/* It is for mt79xx iso data transmission setting */
26#define MTK_ISO_THRESHOLD 264
27
28struct btmtk_patch_header {
29 u8 datetime[16];
30 u8 platform[4];
31 __le16 hwver;
32 __le16 swver;
33 __le32 magicnum;
34} __packed;
35
36struct btmtk_global_desc {
37 __le32 patch_ver;
38 __le32 sub_sys;
39 __le32 feature_opt;
40 __le32 section_num;
41} __packed;
42
43struct btmtk_section_map {
44 __le32 sectype;
45 __le32 secoffset;
46 __le32 secsize;
47 union {
48 __le32 u4SecSpec[13];
49 struct {
50 __le32 dlAddr;
51 __le32 dlsize;
52 __le32 seckeyidx;
53 __le32 alignlen;
54 __le32 sectype;
55 __le32 dlmodecrctype;
56 __le32 crc;
57 __le32 reserved[6];
58 } bin_info_spec;
59 };
60} __packed;
61
62static void btmtk_coredump(struct hci_dev *hdev)
63{
64 int err;
65
66 err = __hci_cmd_send(hdev, 0xfd5b, 0, NULL);
67 if (err < 0)
68 bt_dev_err(hdev, "Coredump failed (%d)", err);
69}
70
71static void btmtk_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
72{
73 struct btmtk_data *data = hci_get_priv(hdev);
74 char buf[80];
75
76 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
77 data->dev_id);
78 skb_put_data(skb, buf, strlen(buf));
79
80 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
81 data->cd_info.fw_version);
82 skb_put_data(skb, buf, strlen(buf));
83
84 snprintf(buf, sizeof(buf), "Driver: %s\n",
85 data->cd_info.driver_name);
86 skb_put_data(skb, buf, strlen(buf));
87
88 snprintf(buf, sizeof(buf), "Vendor: MediaTek\n");
89 skb_put_data(skb, buf, strlen(buf));
90}
91
92static void btmtk_coredump_notify(struct hci_dev *hdev, int state)
93{
94 struct btmtk_data *data = hci_get_priv(hdev);
95
96 switch (state) {
97 case HCI_DEVCOREDUMP_IDLE:
98 data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
99 break;
100 case HCI_DEVCOREDUMP_ACTIVE:
101 data->cd_info.state = HCI_DEVCOREDUMP_ACTIVE;
102 break;
103 case HCI_DEVCOREDUMP_TIMEOUT:
104 case HCI_DEVCOREDUMP_ABORT:
105 case HCI_DEVCOREDUMP_DONE:
106 data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
107 btmtk_reset_sync(hdev);
108 break;
109 }
110}
111
112void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
113 u32 fw_flavor)
114{
115 if (dev_id == 0x7925)
116 snprintf(buf, size,
117 "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
118 dev_id & 0xffff, dev_id & 0xffff, (fw_ver & 0xff) + 1);
119 else if (dev_id == 0x7961 && fw_flavor)
120 snprintf(buf, size,
121 "mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin",
122 dev_id & 0xffff, (fw_ver & 0xff) + 1);
123 else
124 snprintf(buf, size,
125 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
126 dev_id & 0xffff, (fw_ver & 0xff) + 1);
127}
128EXPORT_SYMBOL_GPL(btmtk_fw_get_filename);
129
130int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
131 wmt_cmd_sync_func_t wmt_cmd_sync)
132{
133 struct btmtk_hci_wmt_params wmt_params;
134 struct btmtk_patch_header *hdr;
135 struct btmtk_global_desc *globaldesc = NULL;
136 struct btmtk_section_map *sectionmap;
137 const struct firmware *fw;
138 const u8 *fw_ptr;
139 const u8 *fw_bin_ptr;
140 int err, dlen, i, status;
141 u8 flag, first_block, retry;
142 u32 section_num, dl_size, section_offset;
143 u8 cmd[64];
144
145 err = request_firmware(&fw, fwname, &hdev->dev);
146 if (err < 0) {
147 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
148 return err;
149 }
150
151 fw_ptr = fw->data;
152 fw_bin_ptr = fw_ptr;
153 hdr = (struct btmtk_patch_header *)fw_ptr;
154 globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
155 section_num = le32_to_cpu(globaldesc->section_num);
156
157 bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
158 le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
159
160 for (i = 0; i < section_num; i++) {
161 first_block = 1;
162 fw_ptr = fw_bin_ptr;
163 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
164 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
165
166 section_offset = le32_to_cpu(sectionmap->secoffset);
167 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
168
169 if (dl_size > 0) {
170 retry = 20;
171 while (retry > 0) {
172 cmd[0] = 0; /* 0 means legacy dl mode. */
173 memcpy(cmd + 1,
174 fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
175 MTK_FW_ROM_PATCH_GD_SIZE +
176 MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
177 MTK_SEC_MAP_COMMON_SIZE,
178 MTK_SEC_MAP_NEED_SEND_SIZE + 1);
179
180 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
181 wmt_params.status = &status;
182 wmt_params.flag = 0;
183 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
184 wmt_params.data = &cmd;
185
186 err = wmt_cmd_sync(hdev, &wmt_params);
187 if (err < 0) {
188 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
189 err);
190 goto err_release_fw;
191 }
192
193 if (status == BTMTK_WMT_PATCH_UNDONE) {
194 break;
195 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
196 msleep(100);
197 retry--;
198 } else if (status == BTMTK_WMT_PATCH_DONE) {
199 goto next_section;
200 } else {
201 bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
202 status);
203 err = -EIO;
204 goto err_release_fw;
205 }
206 }
207
208 fw_ptr += section_offset;
209 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
210 wmt_params.status = NULL;
211
212 while (dl_size > 0) {
213 dlen = min_t(int, 250, dl_size);
214 if (first_block == 1) {
215 flag = 1;
216 first_block = 0;
217 } else if (dl_size - dlen <= 0) {
218 flag = 3;
219 } else {
220 flag = 2;
221 }
222
223 wmt_params.flag = flag;
224 wmt_params.dlen = dlen;
225 wmt_params.data = fw_ptr;
226
227 err = wmt_cmd_sync(hdev, &wmt_params);
228 if (err < 0) {
229 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
230 err);
231 goto err_release_fw;
232 }
233
234 dl_size -= dlen;
235 fw_ptr += dlen;
236 }
237 }
238next_section:
239 continue;
240 }
241 /* Wait a few moments for firmware activation done */
242 usleep_range(100000, 120000);
243
244err_release_fw:
245 release_firmware(fw);
246
247 return err;
248}
249EXPORT_SYMBOL_GPL(btmtk_setup_firmware_79xx);
250
251int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
252 wmt_cmd_sync_func_t wmt_cmd_sync)
253{
254 struct btmtk_hci_wmt_params wmt_params;
255 const struct firmware *fw;
256 const u8 *fw_ptr;
257 size_t fw_size;
258 int err, dlen;
259 u8 flag, param;
260
261 err = request_firmware(&fw, fwname, &hdev->dev);
262 if (err < 0) {
263 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
264 return err;
265 }
266
267 /* Power on data RAM the firmware relies on. */
268 param = 1;
269 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
270 wmt_params.flag = 3;
271 wmt_params.dlen = sizeof(param);
272 wmt_params.data = ¶m;
273 wmt_params.status = NULL;
274
275 err = wmt_cmd_sync(hdev, &wmt_params);
276 if (err < 0) {
277 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
278 goto err_release_fw;
279 }
280
281 fw_ptr = fw->data;
282 fw_size = fw->size;
283
284 /* The size of patch header is 30 bytes, should be skip */
285 if (fw_size < 30) {
286 err = -EINVAL;
287 goto err_release_fw;
288 }
289
290 fw_size -= 30;
291 fw_ptr += 30;
292 flag = 1;
293
294 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
295 wmt_params.status = NULL;
296
297 while (fw_size > 0) {
298 dlen = min_t(int, 250, fw_size);
299
300 /* Tell device the position in sequence */
301 if (fw_size - dlen <= 0)
302 flag = 3;
303 else if (fw_size < fw->size - 30)
304 flag = 2;
305
306 wmt_params.flag = flag;
307 wmt_params.dlen = dlen;
308 wmt_params.data = fw_ptr;
309
310 err = wmt_cmd_sync(hdev, &wmt_params);
311 if (err < 0) {
312 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
313 err);
314 goto err_release_fw;
315 }
316
317 fw_size -= dlen;
318 fw_ptr += dlen;
319 }
320
321 wmt_params.op = BTMTK_WMT_RST;
322 wmt_params.flag = 4;
323 wmt_params.dlen = 0;
324 wmt_params.data = NULL;
325 wmt_params.status = NULL;
326
327 /* Activate function the firmware providing to */
328 err = wmt_cmd_sync(hdev, &wmt_params);
329 if (err < 0) {
330 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
331 goto err_release_fw;
332 }
333
334 /* Wait a few moments for firmware activation done */
335 usleep_range(10000, 12000);
336
337err_release_fw:
338 release_firmware(fw);
339
340 return err;
341}
342EXPORT_SYMBOL_GPL(btmtk_setup_firmware);
343
344int btmtk_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
345{
346 struct sk_buff *skb;
347 long ret;
348
349 skb = __hci_cmd_sync(hdev, 0xfc1a, 6, bdaddr, HCI_INIT_TIMEOUT);
350 if (IS_ERR(skb)) {
351 ret = PTR_ERR(skb);
352 bt_dev_err(hdev, "changing Mediatek device address failed (%ld)",
353 ret);
354 return ret;
355 }
356 kfree_skb(skb);
357
358 return 0;
359}
360EXPORT_SYMBOL_GPL(btmtk_set_bdaddr);
361
362void btmtk_reset_sync(struct hci_dev *hdev)
363{
364 struct btmtk_data *reset_work = hci_get_priv(hdev);
365 int err;
366
367 hci_dev_lock(hdev);
368
369 err = hci_cmd_sync_queue(hdev, reset_work->reset_sync, NULL, NULL);
370 if (err)
371 bt_dev_err(hdev, "failed to reset (%d)", err);
372
373 hci_dev_unlock(hdev);
374}
375EXPORT_SYMBOL_GPL(btmtk_reset_sync);
376
377int btmtk_register_coredump(struct hci_dev *hdev, const char *name,
378 u32 fw_version)
379{
380 struct btmtk_data *data = hci_get_priv(hdev);
381
382 if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
383 return -EOPNOTSUPP;
384
385 data->cd_info.fw_version = fw_version;
386 data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
387 data->cd_info.driver_name = name;
388
389 return hci_devcd_register(hdev, btmtk_coredump, btmtk_coredump_hdr,
390 btmtk_coredump_notify);
391}
392EXPORT_SYMBOL_GPL(btmtk_register_coredump);
393
394int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
395{
396 struct btmtk_data *data = hci_get_priv(hdev);
397 int err;
398 bool complete = false;
399
400 if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) {
401 kfree_skb(skb);
402 return 0;
403 }
404
405 switch (data->cd_info.state) {
406 case HCI_DEVCOREDUMP_IDLE:
407 err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
408 if (err < 0) {
409 kfree_skb(skb);
410 break;
411 }
412 data->cd_info.cnt = 0;
413
414 /* It is supposed coredump can be done within 5 seconds */
415 schedule_delayed_work(&hdev->dump.dump_timeout,
416 msecs_to_jiffies(5000));
417 fallthrough;
418 case HCI_DEVCOREDUMP_ACTIVE:
419 default:
420 /* Mediatek coredump data would be more than MTK_COREDUMP_NUM */
421 if (data->cd_info.cnt >= MTK_COREDUMP_NUM &&
422 skb->len > MTK_COREDUMP_END_LEN)
423 if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN],
424 MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1))
425 complete = true;
426
427 err = hci_devcd_append(hdev, skb);
428 if (err < 0)
429 break;
430 data->cd_info.cnt++;
431
432 if (complete) {
433 bt_dev_info(hdev, "Mediatek coredump end");
434 hci_devcd_complete(hdev);
435 }
436
437 break;
438 }
439
440 return err;
441}
442EXPORT_SYMBOL_GPL(btmtk_process_coredump);
443
444#if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK)
445static void btmtk_usb_wmt_recv(struct urb *urb)
446{
447 struct hci_dev *hdev = urb->context;
448 struct btmtk_data *data = hci_get_priv(hdev);
449 struct sk_buff *skb;
450 int err;
451
452 if (urb->status == 0 && urb->actual_length > 0) {
453 hdev->stat.byte_rx += urb->actual_length;
454
455 /* WMT event shouldn't be fragmented and the size should be
456 * less than HCI_WMT_MAX_EVENT_SIZE.
457 */
458 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
459 if (!skb) {
460 hdev->stat.err_rx++;
461 kfree(urb->setup_packet);
462 return;
463 }
464
465 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
466 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
467
468 /* When someone waits for the WMT event, the skb is being cloned
469 * and being processed the events from there then.
470 */
471 if (test_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags)) {
472 data->evt_skb = skb_clone(skb, GFP_ATOMIC);
473 if (!data->evt_skb) {
474 kfree_skb(skb);
475 kfree(urb->setup_packet);
476 return;
477 }
478 }
479
480 err = hci_recv_frame(hdev, skb);
481 if (err < 0) {
482 kfree_skb(data->evt_skb);
483 data->evt_skb = NULL;
484 kfree(urb->setup_packet);
485 return;
486 }
487
488 if (test_and_clear_bit(BTMTK_TX_WAIT_VND_EVT,
489 &data->flags)) {
490 /* Barrier to sync with other CPUs */
491 smp_mb__after_atomic();
492 wake_up_bit(&data->flags,
493 BTMTK_TX_WAIT_VND_EVT);
494 }
495 kfree(urb->setup_packet);
496 return;
497 } else if (urb->status == -ENOENT) {
498 /* Avoid suspend failed when usb_kill_urb */
499 return;
500 }
501
502 usb_mark_last_busy(data->udev);
503
504 /* The URB complete handler is still called with urb->actual_length = 0
505 * when the event is not available, so we should keep re-submitting
506 * URB until WMT event returns, Also, It's necessary to wait some time
507 * between the two consecutive control URBs to relax the target device
508 * to generate the event. Otherwise, the WMT event cannot return from
509 * the device successfully.
510 */
511 udelay(500);
512
513 usb_anchor_urb(urb, data->ctrl_anchor);
514 err = usb_submit_urb(urb, GFP_ATOMIC);
515 if (err < 0) {
516 kfree(urb->setup_packet);
517 /* -EPERM: urb is being killed;
518 * -ENODEV: device got disconnected
519 */
520 if (err != -EPERM && err != -ENODEV)
521 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
522 urb, -err);
523 usb_unanchor_urb(urb);
524 }
525}
526
527static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
528{
529 struct btmtk_data *data = hci_get_priv(hdev);
530 struct usb_ctrlrequest *dr;
531 unsigned char *buf;
532 int err, size = 64;
533 unsigned int pipe;
534 struct urb *urb;
535
536 urb = usb_alloc_urb(0, GFP_KERNEL);
537 if (!urb)
538 return -ENOMEM;
539
540 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
541 if (!dr) {
542 usb_free_urb(urb);
543 return -ENOMEM;
544 }
545
546 dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
547 dr->bRequest = 1;
548 dr->wIndex = cpu_to_le16(0);
549 dr->wValue = cpu_to_le16(48);
550 dr->wLength = cpu_to_le16(size);
551
552 buf = kmalloc(size, GFP_KERNEL);
553 if (!buf) {
554 kfree(dr);
555 usb_free_urb(urb);
556 return -ENOMEM;
557 }
558
559 pipe = usb_rcvctrlpipe(data->udev, 0);
560
561 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
562 buf, size, btmtk_usb_wmt_recv, hdev);
563
564 urb->transfer_flags |= URB_FREE_BUFFER;
565
566 usb_anchor_urb(urb, data->ctrl_anchor);
567 err = usb_submit_urb(urb, GFP_KERNEL);
568 if (err < 0) {
569 if (err != -EPERM && err != -ENODEV)
570 bt_dev_err(hdev, "urb %p submission failed (%d)",
571 urb, -err);
572 usb_unanchor_urb(urb);
573 }
574
575 usb_free_urb(urb);
576
577 return err;
578}
579
580static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
581 struct btmtk_hci_wmt_params *wmt_params)
582{
583 struct btmtk_data *data = hci_get_priv(hdev);
584 struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
585 u32 hlen, status = BTMTK_WMT_INVALID;
586 struct btmtk_hci_wmt_evt *wmt_evt;
587 struct btmtk_hci_wmt_cmd *wc;
588 struct btmtk_wmt_hdr *hdr;
589 int err;
590
591 /* Send the WMT command and wait until the WMT event returns */
592 hlen = sizeof(*hdr) + wmt_params->dlen;
593 if (hlen > 255)
594 return -EINVAL;
595
596 wc = kzalloc(hlen, GFP_KERNEL);
597 if (!wc)
598 return -ENOMEM;
599
600 hdr = &wc->hdr;
601 hdr->dir = 1;
602 hdr->op = wmt_params->op;
603 hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
604 hdr->flag = wmt_params->flag;
605 memcpy(wc->data, wmt_params->data, wmt_params->dlen);
606
607 set_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
608
609 /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling,
610 * it needs constantly polling control pipe until the host received the
611 * WMT event, thus, we should require to specifically acquire PM counter
612 * on the USB to prevent the interface from entering auto suspended
613 * while WMT cmd/event in progress.
614 */
615 err = usb_autopm_get_interface(data->intf);
616 if (err < 0)
617 goto err_free_wc;
618
619 err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
620
621 if (err < 0) {
622 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
623 usb_autopm_put_interface(data->intf);
624 goto err_free_wc;
625 }
626
627 /* Submit control IN URB on demand to process the WMT event */
628 err = btmtk_usb_submit_wmt_recv_urb(hdev);
629
630 usb_autopm_put_interface(data->intf);
631
632 if (err < 0)
633 goto err_free_wc;
634
635 /* The vendor specific WMT commands are all answered by a vendor
636 * specific event and will have the Command Status or Command
637 * Complete as with usual HCI command flow control.
638 *
639 * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
640 * state to be cleared. The driver specific event receive routine
641 * will clear that state and with that indicate completion of the
642 * WMT command.
643 */
644 err = wait_on_bit_timeout(&data->flags, BTMTK_TX_WAIT_VND_EVT,
645 TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
646 if (err == -EINTR) {
647 bt_dev_err(hdev, "Execution of wmt command interrupted");
648 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
649 goto err_free_wc;
650 }
651
652 if (err) {
653 bt_dev_err(hdev, "Execution of wmt command timed out");
654 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
655 err = -ETIMEDOUT;
656 goto err_free_wc;
657 }
658
659 if (data->evt_skb == NULL)
660 goto err_free_wc;
661
662 /* Parse and handle the return WMT event */
663 wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
664 if (wmt_evt->whdr.op != hdr->op) {
665 bt_dev_err(hdev, "Wrong op received %d expected %d",
666 wmt_evt->whdr.op, hdr->op);
667 err = -EIO;
668 goto err_free_skb;
669 }
670
671 switch (wmt_evt->whdr.op) {
672 case BTMTK_WMT_SEMAPHORE:
673 if (wmt_evt->whdr.flag == 2)
674 status = BTMTK_WMT_PATCH_UNDONE;
675 else
676 status = BTMTK_WMT_PATCH_DONE;
677 break;
678 case BTMTK_WMT_FUNC_CTRL:
679 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
680 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
681 status = BTMTK_WMT_ON_DONE;
682 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
683 status = BTMTK_WMT_ON_PROGRESS;
684 else
685 status = BTMTK_WMT_ON_UNDONE;
686 break;
687 case BTMTK_WMT_PATCH_DWNLD:
688 if (wmt_evt->whdr.flag == 2)
689 status = BTMTK_WMT_PATCH_DONE;
690 else if (wmt_evt->whdr.flag == 1)
691 status = BTMTK_WMT_PATCH_PROGRESS;
692 else
693 status = BTMTK_WMT_PATCH_UNDONE;
694 break;
695 }
696
697 if (wmt_params->status)
698 *wmt_params->status = status;
699
700err_free_skb:
701 kfree_skb(data->evt_skb);
702 data->evt_skb = NULL;
703err_free_wc:
704 kfree(wc);
705 return err;
706}
707
708static int btmtk_usb_func_query(struct hci_dev *hdev)
709{
710 struct btmtk_hci_wmt_params wmt_params;
711 int status, err;
712 u8 param = 0;
713
714 /* Query whether the function is enabled */
715 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
716 wmt_params.flag = 4;
717 wmt_params.dlen = sizeof(param);
718 wmt_params.data = ¶m;
719 wmt_params.status = &status;
720
721 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
722 if (err < 0) {
723 bt_dev_err(hdev, "Failed to query function status (%d)", err);
724 return err;
725 }
726
727 return status;
728}
729
730static int btmtk_usb_uhw_reg_write(struct hci_dev *hdev, u32 reg, u32 val)
731{
732 struct btmtk_data *data = hci_get_priv(hdev);
733 int pipe, err;
734 void *buf;
735
736 buf = kzalloc(4, GFP_KERNEL);
737 if (!buf)
738 return -ENOMEM;
739
740 put_unaligned_le32(val, buf);
741
742 pipe = usb_sndctrlpipe(data->udev, 0);
743 err = usb_control_msg(data->udev, pipe, 0x02,
744 0x5E,
745 reg >> 16, reg & 0xffff,
746 buf, 4, USB_CTRL_SET_TIMEOUT);
747 if (err < 0)
748 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
749
750 kfree(buf);
751
752 return err;
753}
754
755static int btmtk_usb_uhw_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
756{
757 struct btmtk_data *data = hci_get_priv(hdev);
758 int pipe, err;
759 void *buf;
760
761 buf = kzalloc(4, GFP_KERNEL);
762 if (!buf)
763 return -ENOMEM;
764
765 pipe = usb_rcvctrlpipe(data->udev, 0);
766 err = usb_control_msg(data->udev, pipe, 0x01,
767 0xDE,
768 reg >> 16, reg & 0xffff,
769 buf, 4, USB_CTRL_GET_TIMEOUT);
770 if (err < 0) {
771 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
772 goto err_free_buf;
773 }
774
775 *val = get_unaligned_le32(buf);
776 bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
777
778err_free_buf:
779 kfree(buf);
780
781 return err;
782}
783
784static int btmtk_usb_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
785{
786 struct btmtk_data *data = hci_get_priv(hdev);
787 int pipe, err, size = sizeof(u32);
788 void *buf;
789
790 buf = kzalloc(size, GFP_KERNEL);
791 if (!buf)
792 return -ENOMEM;
793
794 pipe = usb_rcvctrlpipe(data->udev, 0);
795 err = usb_control_msg(data->udev, pipe, 0x63,
796 USB_TYPE_VENDOR | USB_DIR_IN,
797 reg >> 16, reg & 0xffff,
798 buf, size, USB_CTRL_GET_TIMEOUT);
799 if (err < 0)
800 goto err_free_buf;
801
802 *val = get_unaligned_le32(buf);
803
804err_free_buf:
805 kfree(buf);
806
807 return err;
808}
809
810static int btmtk_usb_id_get(struct hci_dev *hdev, u32 reg, u32 *id)
811{
812 return btmtk_usb_reg_read(hdev, reg, id);
813}
814
815static u32 btmtk_usb_reset_done(struct hci_dev *hdev)
816{
817 u32 val = 0;
818
819 btmtk_usb_uhw_reg_read(hdev, MTK_BT_MISC, &val);
820
821 return val & MTK_BT_RST_DONE;
822}
823
824int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
825{
826 u32 val;
827 int err;
828
829 if (dev_id == 0x7922) {
830 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
831 if (err < 0)
832 return err;
833 val |= 0x00002020;
834 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
835 if (err < 0)
836 return err;
837 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
838 if (err < 0)
839 return err;
840 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
841 if (err < 0)
842 return err;
843 val |= BIT(0);
844 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
845 if (err < 0)
846 return err;
847 msleep(100);
848 } else if (dev_id == 0x7925) {
849 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
850 if (err < 0)
851 return err;
852 val |= (1 << 5);
853 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
854 if (err < 0)
855 return err;
856 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
857 if (err < 0)
858 return err;
859 val &= 0xFFFF00FF;
860 val |= (1 << 13);
861 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
862 if (err < 0)
863 return err;
864 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
865 if (err < 0)
866 return err;
867 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
868 if (err < 0)
869 return err;
870 val |= (1 << 0);
871 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
872 if (err < 0)
873 return err;
874 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
875 if (err < 0)
876 return err;
877 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
878 if (err < 0)
879 return err;
880 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
881 if (err < 0)
882 return err;
883 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
884 if (err < 0)
885 return err;
886 msleep(100);
887 } else {
888 /* It's Device EndPoint Reset Option Register */
889 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
890 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
891 if (err < 0)
892 return err;
893 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_WDT_STATUS, &val);
894 if (err < 0)
895 return err;
896 /* Reset the bluetooth chip via USB interface. */
897 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 1);
898 if (err < 0)
899 return err;
900 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
901 if (err < 0)
902 return err;
903 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
904 if (err < 0)
905 return err;
906 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
907 if (err < 0)
908 return err;
909 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
910 if (err < 0)
911 return err;
912 /* MT7921 need to delay 20ms between toggle reset bit */
913 msleep(20);
914 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 0);
915 if (err < 0)
916 return err;
917 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
918 if (err < 0)
919 return err;
920 }
921
922 err = readx_poll_timeout(btmtk_usb_reset_done, hdev, val,
923 val & MTK_BT_RST_DONE, 20000, 1000000);
924 if (err < 0)
925 bt_dev_err(hdev, "Reset timeout");
926
927 if (dev_id == 0x7922) {
928 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
929 if (err < 0)
930 return err;
931 }
932
933 err = btmtk_usb_id_get(hdev, 0x70010200, &val);
934 if (err < 0 || !val)
935 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
936
937 return err;
938}
939EXPORT_SYMBOL_GPL(btmtk_usb_subsys_reset);
940
941int btmtk_usb_recv_acl(struct hci_dev *hdev, struct sk_buff *skb)
942{
943 struct btmtk_data *data = hci_get_priv(hdev);
944 u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
945
946 switch (handle) {
947 case 0xfc6f: /* Firmware dump from device */
948 /* When the firmware hangs, the device can no longer
949 * suspend and thus disable auto-suspend.
950 */
951 usb_disable_autosuspend(data->udev);
952
953 /* We need to forward the diagnostic packet to userspace daemon
954 * for backward compatibility, so we have to clone the packet
955 * extraly for the in-kernel coredump support.
956 */
957 if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
958 struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC);
959
960 if (skb_cd)
961 btmtk_process_coredump(hdev, skb_cd);
962 }
963
964 fallthrough;
965 case 0x05ff: /* Firmware debug logging 1 */
966 case 0x05fe: /* Firmware debug logging 2 */
967 return hci_recv_diag(hdev, skb);
968 }
969
970 return hci_recv_frame(hdev, skb);
971}
972EXPORT_SYMBOL_GPL(btmtk_usb_recv_acl);
973
974static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb)
975{
976 if (skb->len > MTK_ISO_THRESHOLD)
977 return -EINVAL;
978
979 if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len))
980 return -ENOMEM;
981
982 __skb_put(skb, MTK_ISO_THRESHOLD - skb->len);
983
984 return 0;
985}
986
987static int __set_mtk_intr_interface(struct hci_dev *hdev)
988{
989 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
990 struct usb_interface *intf = btmtk_data->isopkt_intf;
991 int i, err;
992
993 if (!btmtk_data->isopkt_intf)
994 return -ENODEV;
995
996 err = usb_set_interface(btmtk_data->udev, MTK_ISO_IFNUM, 1);
997 if (err < 0) {
998 bt_dev_err(hdev, "setting interface failed (%d)", -err);
999 return err;
1000 }
1001
1002 btmtk_data->isopkt_tx_ep = NULL;
1003 btmtk_data->isopkt_rx_ep = NULL;
1004
1005 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1006 struct usb_endpoint_descriptor *ep_desc;
1007
1008 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1009
1010 if (!btmtk_data->isopkt_tx_ep &&
1011 usb_endpoint_is_int_out(ep_desc)) {
1012 btmtk_data->isopkt_tx_ep = ep_desc;
1013 continue;
1014 }
1015
1016 if (!btmtk_data->isopkt_rx_ep &&
1017 usb_endpoint_is_int_in(ep_desc)) {
1018 btmtk_data->isopkt_rx_ep = ep_desc;
1019 continue;
1020 }
1021 }
1022
1023 if (!btmtk_data->isopkt_tx_ep ||
1024 !btmtk_data->isopkt_rx_ep) {
1025 bt_dev_err(hdev, "invalid interrupt descriptors");
1026 return -ENODEV;
1027 }
1028
1029 return 0;
1030}
1031
1032struct urb *alloc_mtk_intr_urb(struct hci_dev *hdev, struct sk_buff *skb,
1033 usb_complete_t tx_complete)
1034{
1035 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1036 struct urb *urb;
1037 unsigned int pipe;
1038
1039 if (!btmtk_data->isopkt_tx_ep)
1040 return ERR_PTR(-ENODEV);
1041
1042 urb = usb_alloc_urb(0, GFP_KERNEL);
1043 if (!urb)
1044 return ERR_PTR(-ENOMEM);
1045
1046 if (btmtk_isopkt_pad(hdev, skb))
1047 return ERR_PTR(-EINVAL);
1048
1049 pipe = usb_sndintpipe(btmtk_data->udev,
1050 btmtk_data->isopkt_tx_ep->bEndpointAddress);
1051
1052 usb_fill_int_urb(urb, btmtk_data->udev, pipe,
1053 skb->data, skb->len, tx_complete,
1054 skb, btmtk_data->isopkt_tx_ep->bInterval);
1055
1056 skb->dev = (void *)hdev;
1057
1058 return urb;
1059}
1060EXPORT_SYMBOL_GPL(alloc_mtk_intr_urb);
1061
1062static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count)
1063{
1064 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1065 struct sk_buff *skb;
1066 unsigned long flags;
1067 int err = 0;
1068
1069 spin_lock_irqsave(&btmtk_data->isorxlock, flags);
1070 skb = btmtk_data->isopkt_skb;
1071
1072 while (count) {
1073 int len;
1074
1075 if (!skb) {
1076 skb = bt_skb_alloc(HCI_MAX_ISO_SIZE, GFP_ATOMIC);
1077 if (!skb) {
1078 err = -ENOMEM;
1079 break;
1080 }
1081
1082 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
1083 hci_skb_expect(skb) = HCI_ISO_HDR_SIZE;
1084 }
1085
1086 len = min_t(uint, hci_skb_expect(skb), count);
1087 skb_put_data(skb, buffer, len);
1088
1089 count -= len;
1090 buffer += len;
1091 hci_skb_expect(skb) -= len;
1092
1093 if (skb->len == HCI_ISO_HDR_SIZE) {
1094 __le16 dlen = ((struct hci_iso_hdr *)skb->data)->dlen;
1095
1096 /* Complete ISO header */
1097 hci_skb_expect(skb) = __le16_to_cpu(dlen);
1098
1099 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1100 kfree_skb(skb);
1101 skb = NULL;
1102
1103 err = -EILSEQ;
1104 break;
1105 }
1106 }
1107
1108 if (!hci_skb_expect(skb)) {
1109 /* Complete frame */
1110 hci_recv_frame(hdev, skb);
1111 skb = NULL;
1112 }
1113 }
1114
1115 btmtk_data->isopkt_skb = skb;
1116 spin_unlock_irqrestore(&btmtk_data->isorxlock, flags);
1117
1118 return err;
1119}
1120
1121static void btmtk_intr_complete(struct urb *urb)
1122{
1123 struct hci_dev *hdev = urb->context;
1124 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1125 int err;
1126
1127 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1128 urb->actual_length);
1129
1130 if (!test_bit(HCI_RUNNING, &hdev->flags))
1131 return;
1132
1133 if (hdev->suspended)
1134 return;
1135
1136 if (urb->status == 0) {
1137 hdev->stat.byte_rx += urb->actual_length;
1138
1139 if (btmtk_recv_isopkt(hdev, urb->transfer_buffer,
1140 urb->actual_length) < 0) {
1141 bt_dev_err(hdev, "corrupted iso packet");
1142 hdev->stat.err_rx++;
1143 }
1144 } else if (urb->status == -ENOENT) {
1145 /* Avoid suspend failed when usb_kill_urb */
1146 return;
1147 }
1148
1149 usb_mark_last_busy(btmtk_data->udev);
1150 usb_anchor_urb(urb, &btmtk_data->isopkt_anchor);
1151
1152 err = usb_submit_urb(urb, GFP_ATOMIC);
1153 if (err < 0) {
1154 /* -EPERM: urb is being killed;
1155 * -ENODEV: device got disconnected
1156 */
1157 if (err != -EPERM && err != -ENODEV)
1158 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1159 urb, -err);
1160 if (err != -EPERM)
1161 hci_cmd_sync_cancel(hdev, -err);
1162 usb_unanchor_urb(urb);
1163 }
1164}
1165
1166static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1167{
1168 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1169 unsigned char *buf;
1170 unsigned int pipe;
1171 struct urb *urb;
1172 int err, size;
1173
1174 BT_DBG("%s", hdev->name);
1175
1176 if (!btmtk_data->isopkt_rx_ep)
1177 return -ENODEV;
1178
1179 urb = usb_alloc_urb(0, mem_flags);
1180 if (!urb)
1181 return -ENOMEM;
1182 size = le16_to_cpu(btmtk_data->isopkt_rx_ep->wMaxPacketSize);
1183
1184 buf = kmalloc(size, mem_flags);
1185 if (!buf) {
1186 usb_free_urb(urb);
1187 return -ENOMEM;
1188 }
1189
1190 pipe = usb_rcvintpipe(btmtk_data->udev,
1191 btmtk_data->isopkt_rx_ep->bEndpointAddress);
1192
1193 usb_fill_int_urb(urb, btmtk_data->udev, pipe, buf, size,
1194 btmtk_intr_complete, hdev,
1195 btmtk_data->isopkt_rx_ep->bInterval);
1196
1197 urb->transfer_flags |= URB_FREE_BUFFER;
1198
1199 usb_mark_last_busy(btmtk_data->udev);
1200 usb_anchor_urb(urb, &btmtk_data->isopkt_anchor);
1201
1202 err = usb_submit_urb(urb, mem_flags);
1203 if (err < 0) {
1204 if (err != -EPERM && err != -ENODEV)
1205 bt_dev_err(hdev, "urb %p submission failed (%d)",
1206 urb, -err);
1207 usb_unanchor_urb(urb);
1208 }
1209
1210 usb_free_urb(urb);
1211
1212 return err;
1213}
1214
1215static int btmtk_usb_isointf_init(struct hci_dev *hdev)
1216{
1217 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1218 u8 iso_param[2] = { 0x08, 0x01 };
1219 struct sk_buff *skb;
1220 int err;
1221
1222 spin_lock_init(&btmtk_data->isorxlock);
1223
1224 __set_mtk_intr_interface(hdev);
1225
1226 err = btmtk_submit_intr_urb(hdev, GFP_KERNEL);
1227 if (err < 0) {
1228 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
1229 bt_dev_err(hdev, "ISO intf not support (%d)", err);
1230 return err;
1231 }
1232
1233 skb = __hci_cmd_sync(hdev, 0xfd98, sizeof(iso_param), iso_param,
1234 HCI_INIT_TIMEOUT);
1235 if (IS_ERR(skb)) {
1236 bt_dev_err(hdev, "Failed to apply iso setting (%ld)", PTR_ERR(skb));
1237 return PTR_ERR(skb);
1238 }
1239 kfree_skb(skb);
1240
1241 return 0;
1242}
1243
1244int btmtk_usb_resume(struct hci_dev *hdev)
1245{
1246 /* This function describes the specific additional steps taken by MediaTek
1247 * when Bluetooth usb driver's resume function is called.
1248 */
1249 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1250
1251 /* Resubmit urb for iso data transmission */
1252 if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags)) {
1253 if (btmtk_submit_intr_urb(hdev, GFP_NOIO) < 0)
1254 clear_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
1255 }
1256
1257 return 0;
1258}
1259EXPORT_SYMBOL_GPL(btmtk_usb_resume);
1260
1261int btmtk_usb_suspend(struct hci_dev *hdev)
1262{
1263 /* This function describes the specific additional steps taken by MediaTek
1264 * when Bluetooth usb driver's suspend function is called.
1265 */
1266 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1267
1268 /* Stop urb anchor for iso data transmission */
1269 if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags))
1270 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
1271
1272 return 0;
1273}
1274EXPORT_SYMBOL_GPL(btmtk_usb_suspend);
1275
1276int btmtk_usb_setup(struct hci_dev *hdev)
1277{
1278 struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1279 struct btmtk_hci_wmt_params wmt_params;
1280 ktime_t calltime, delta, rettime;
1281 struct btmtk_tci_sleep tci_sleep;
1282 unsigned long long duration;
1283 struct sk_buff *skb;
1284 const char *fwname;
1285 int err, status;
1286 u32 dev_id = 0;
1287 char fw_bin_name[64];
1288 u32 fw_version = 0, fw_flavor = 0;
1289 u8 param;
1290
1291 calltime = ktime_get();
1292
1293 err = btmtk_usb_id_get(hdev, 0x80000008, &dev_id);
1294 if (err < 0) {
1295 bt_dev_err(hdev, "Failed to get device id (%d)", err);
1296 return err;
1297 }
1298
1299 if (!dev_id || dev_id != 0x7663) {
1300 err = btmtk_usb_id_get(hdev, 0x70010200, &dev_id);
1301 if (err < 0) {
1302 bt_dev_err(hdev, "Failed to get device id (%d)", err);
1303 return err;
1304 }
1305 err = btmtk_usb_id_get(hdev, 0x80021004, &fw_version);
1306 if (err < 0) {
1307 bt_dev_err(hdev, "Failed to get fw version (%d)", err);
1308 return err;
1309 }
1310 err = btmtk_usb_id_get(hdev, 0x70010020, &fw_flavor);
1311 if (err < 0) {
1312 bt_dev_err(hdev, "Failed to get fw flavor (%d)", err);
1313 return err;
1314 }
1315 fw_flavor = (fw_flavor & 0x00000080) >> 7;
1316 }
1317
1318 btmtk_data->dev_id = dev_id;
1319
1320 err = btmtk_register_coredump(hdev, btmtk_data->drv_name, fw_version);
1321 if (err < 0)
1322 bt_dev_err(hdev, "Failed to register coredump (%d)", err);
1323
1324 switch (dev_id) {
1325 case 0x7663:
1326 fwname = FIRMWARE_MT7663;
1327 break;
1328 case 0x7668:
1329 fwname = FIRMWARE_MT7668;
1330 break;
1331 case 0x7922:
1332 case 0x7961:
1333 case 0x7925:
1334 /* Reset the device to ensure it's in the initial state before
1335 * downloading the firmware to ensure.
1336 */
1337
1338 if (!test_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags))
1339 btmtk_usb_subsys_reset(hdev, dev_id);
1340
1341 btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
1342 fw_version, fw_flavor);
1343
1344 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
1345 btmtk_usb_hci_wmt_sync);
1346 if (err < 0) {
1347 bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
1348 clear_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
1349 return err;
1350 }
1351
1352 set_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
1353
1354 /* It's Device EndPoint Reset Option Register */
1355 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT,
1356 MTK_EP_RST_IN_OUT_OPT);
1357 if (err < 0)
1358 return err;
1359
1360 /* Enable Bluetooth protocol */
1361 param = 1;
1362 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1363 wmt_params.flag = 0;
1364 wmt_params.dlen = sizeof(param);
1365 wmt_params.data = ¶m;
1366 wmt_params.status = NULL;
1367
1368 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1369 if (err < 0) {
1370 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1371 return err;
1372 }
1373
1374 hci_set_msft_opcode(hdev, 0xFD30);
1375 hci_set_aosp_capable(hdev);
1376
1377 /* Set up ISO interface after protocol enabled */
1378 if (test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) {
1379 if (!btmtk_usb_isointf_init(hdev))
1380 set_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
1381 }
1382
1383 goto done;
1384 default:
1385 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
1386 dev_id);
1387 return -ENODEV;
1388 }
1389
1390 /* Query whether the firmware is already download */
1391 wmt_params.op = BTMTK_WMT_SEMAPHORE;
1392 wmt_params.flag = 1;
1393 wmt_params.dlen = 0;
1394 wmt_params.data = NULL;
1395 wmt_params.status = &status;
1396
1397 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1398 if (err < 0) {
1399 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
1400 return err;
1401 }
1402
1403 if (status == BTMTK_WMT_PATCH_DONE) {
1404 bt_dev_info(hdev, "firmware already downloaded");
1405 goto ignore_setup_fw;
1406 }
1407
1408 /* Setup a firmware which the device definitely requires */
1409 err = btmtk_setup_firmware(hdev, fwname,
1410 btmtk_usb_hci_wmt_sync);
1411 if (err < 0)
1412 return err;
1413
1414ignore_setup_fw:
1415 err = readx_poll_timeout(btmtk_usb_func_query, hdev, status,
1416 status < 0 || status != BTMTK_WMT_ON_PROGRESS,
1417 2000, 5000000);
1418 /* -ETIMEDOUT happens */
1419 if (err < 0)
1420 return err;
1421
1422 /* The other errors happen in btmtk_usb_func_query */
1423 if (status < 0)
1424 return status;
1425
1426 if (status == BTMTK_WMT_ON_DONE) {
1427 bt_dev_info(hdev, "function already on");
1428 goto ignore_func_on;
1429 }
1430
1431 /* Enable Bluetooth protocol */
1432 param = 1;
1433 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1434 wmt_params.flag = 0;
1435 wmt_params.dlen = sizeof(param);
1436 wmt_params.data = ¶m;
1437 wmt_params.status = NULL;
1438
1439 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1440 if (err < 0) {
1441 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1442 return err;
1443 }
1444
1445ignore_func_on:
1446 /* Apply the low power environment setup */
1447 tci_sleep.mode = 0x5;
1448 tci_sleep.duration = cpu_to_le16(0x640);
1449 tci_sleep.host_duration = cpu_to_le16(0x640);
1450 tci_sleep.host_wakeup_pin = 0;
1451 tci_sleep.time_compensation = 0;
1452
1453 skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
1454 HCI_INIT_TIMEOUT);
1455 if (IS_ERR(skb)) {
1456 err = PTR_ERR(skb);
1457 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
1458 return err;
1459 }
1460 kfree_skb(skb);
1461
1462done:
1463 rettime = ktime_get();
1464 delta = ktime_sub(rettime, calltime);
1465 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1466
1467 bt_dev_info(hdev, "Device setup in %llu usecs", duration);
1468
1469 return 0;
1470}
1471EXPORT_SYMBOL_GPL(btmtk_usb_setup);
1472
1473int btmtk_usb_shutdown(struct hci_dev *hdev)
1474{
1475 struct btmtk_data *data = hci_get_priv(hdev);
1476 struct btmtk_hci_wmt_params wmt_params;
1477 u8 param = 0;
1478 int err;
1479
1480 err = usb_autopm_get_interface(data->intf);
1481 if (err < 0)
1482 return err;
1483
1484 /* Disable the device */
1485 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1486 wmt_params.flag = 0;
1487 wmt_params.dlen = sizeof(param);
1488 wmt_params.data = ¶m;
1489 wmt_params.status = NULL;
1490
1491 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1492 if (err < 0) {
1493 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1494 usb_autopm_put_interface(data->intf);
1495 return err;
1496 }
1497
1498 usb_autopm_put_interface(data->intf);
1499 return 0;
1500}
1501EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
1502#endif
1503
1504MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
1505MODULE_AUTHOR("Mark Chen <mark-yw.chen@mediatek.com>");
1506MODULE_DESCRIPTION("Bluetooth support for MediaTek devices ver " VERSION);
1507MODULE_VERSION(VERSION);
1508MODULE_LICENSE("GPL");
1509MODULE_FIRMWARE(FIRMWARE_MT7622);
1510MODULE_FIRMWARE(FIRMWARE_MT7663);
1511MODULE_FIRMWARE(FIRMWARE_MT7668);
1512MODULE_FIRMWARE(FIRMWARE_MT7922);
1513MODULE_FIRMWARE(FIRMWARE_MT7961);
1514MODULE_FIRMWARE(FIRMWARE_MT7925);