Commit | Line | Data |
---|---|---|
8a061276 SP |
1 | // SPDX-License-Identifier: GPL-2.0-only OR MIT |
2 | /* | |
3 | * Bluetooth HCI driver for Broadcom 4377/4378/4387 devices attached via PCIe | |
4 | * | |
5 | * Copyright (C) The Asahi Linux Contributors | |
6 | */ | |
7 | ||
8 | #include <linux/async.h> | |
9 | #include <linux/bitfield.h> | |
10 | #include <linux/completion.h> | |
11 | #include <linux/dma-mapping.h> | |
12 | #include <linux/dmi.h> | |
13 | #include <linux/firmware.h> | |
14 | #include <linux/module.h> | |
15 | #include <linux/msi.h> | |
16 | #include <linux/of.h> | |
17 | #include <linux/pci.h> | |
18 | #include <linux/printk.h> | |
19 | ||
20 | #include <asm/unaligned.h> | |
21 | ||
22 | #include <net/bluetooth/bluetooth.h> | |
23 | #include <net/bluetooth/hci_core.h> | |
24 | ||
25 | enum bcm4377_chip { | |
26 | BCM4377 = 0, | |
27 | BCM4378, | |
28 | BCM4387, | |
29 | }; | |
30 | ||
31 | #define BCM4377_DEVICE_ID 0x5fa0 | |
32 | #define BCM4378_DEVICE_ID 0x5f69 | |
33 | #define BCM4387_DEVICE_ID 0x5f71 | |
34 | ||
35 | #define BCM4377_TIMEOUT 1000 | |
36 | ||
37 | /* | |
38 | * These devices only support DMA transactions inside a 32bit window | |
39 | * (possibly to avoid 64 bit arithmetic). The window size cannot exceed | |
40 | * 0xffffffff but is always aligned down to the previous 0x200 byte boundary | |
41 | * which effectively limits the window to [start, start+0xfffffe00]. | |
42 | * We just limit the DMA window to [0, 0xfffffe00] to make sure we don't | |
43 | * run into this limitation. | |
44 | */ | |
45 | #define BCM4377_DMA_MASK 0xfffffe00 | |
46 | ||
47 | #define BCM4377_PCIECFG_BAR0_WINDOW1 0x80 | |
48 | #define BCM4377_PCIECFG_BAR0_WINDOW2 0x70 | |
49 | #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW1 0x74 | |
50 | #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW2 0x78 | |
51 | #define BCM4377_PCIECFG_BAR2_WINDOW 0x84 | |
52 | ||
53 | #define BCM4377_PCIECFG_BAR0_CORE2_WINDOW1_DEFAULT 0x18011000 | |
54 | #define BCM4377_PCIECFG_BAR2_WINDOW_DEFAULT 0x19000000 | |
55 | ||
56 | #define BCM4377_PCIECFG_SUBSYSTEM_CTRL 0x88 | |
57 | ||
58 | #define BCM4377_BAR0_FW_DOORBELL 0x140 | |
59 | #define BCM4377_BAR0_RTI_CONTROL 0x144 | |
60 | ||
61 | #define BCM4377_BAR0_SLEEP_CONTROL 0x150 | |
62 | #define BCM4377_BAR0_SLEEP_CONTROL_UNQUIESCE 0 | |
63 | #define BCM4377_BAR0_SLEEP_CONTROL_AWAKE 2 | |
64 | #define BCM4377_BAR0_SLEEP_CONTROL_QUIESCE 3 | |
65 | ||
66 | #define BCM4377_BAR0_DOORBELL 0x174 | |
67 | #define BCM4377_BAR0_DOORBELL_VALUE GENMASK(31, 16) | |
68 | #define BCM4377_BAR0_DOORBELL_IDX GENMASK(15, 8) | |
69 | #define BCM4377_BAR0_DOORBELL_RING BIT(5) | |
70 | ||
71 | #define BCM4377_BAR0_HOST_WINDOW_LO 0x590 | |
72 | #define BCM4377_BAR0_HOST_WINDOW_HI 0x594 | |
73 | #define BCM4377_BAR0_HOST_WINDOW_SIZE 0x598 | |
74 | ||
75 | #define BCM4377_BAR2_BOOTSTAGE 0x200454 | |
76 | ||
77 | #define BCM4377_BAR2_FW_LO 0x200478 | |
78 | #define BCM4377_BAR2_FW_HI 0x20047c | |
79 | #define BCM4377_BAR2_FW_SIZE 0x200480 | |
80 | ||
81 | #define BCM4377_BAR2_CONTEXT_ADDR_LO 0x20048c | |
82 | #define BCM4377_BAR2_CONTEXT_ADDR_HI 0x200450 | |
83 | ||
84 | #define BCM4377_BAR2_RTI_STATUS 0x20045c | |
85 | #define BCM4377_BAR2_RTI_WINDOW_LO 0x200494 | |
86 | #define BCM4377_BAR2_RTI_WINDOW_HI 0x200498 | |
87 | #define BCM4377_BAR2_RTI_WINDOW_SIZE 0x20049c | |
88 | ||
89 | #define BCM4377_OTP_SIZE 0xe0 | |
90 | #define BCM4377_OTP_SYS_VENDOR 0x15 | |
91 | #define BCM4377_OTP_CIS 0x80 | |
92 | #define BCM4377_OTP_VENDOR_HDR 0x00000008 | |
93 | #define BCM4377_OTP_MAX_PARAM_LEN 16 | |
94 | ||
95 | #define BCM4377_N_TRANSFER_RINGS 9 | |
96 | #define BCM4377_N_COMPLETION_RINGS 6 | |
97 | ||
98 | #define BCM4377_MAX_RING_SIZE 256 | |
99 | ||
100 | #define BCM4377_MSGID_GENERATION GENMASK(15, 8) | |
101 | #define BCM4377_MSGID_ID GENMASK(7, 0) | |
102 | ||
103 | #define BCM4377_RING_N_ENTRIES 128 | |
104 | ||
105 | #define BCM4377_CONTROL_MSG_SIZE 0x34 | |
106 | #define BCM4377_XFER_RING_MAX_INPLACE_PAYLOAD_SIZE (4 * 0xff) | |
107 | ||
108 | #define MAX_ACL_PAYLOAD_SIZE (HCI_MAX_FRAME_SIZE + HCI_ACL_HDR_SIZE) | |
109 | #define MAX_SCO_PAYLOAD_SIZE (HCI_MAX_SCO_SIZE + HCI_SCO_HDR_SIZE) | |
110 | #define MAX_EVENT_PAYLOAD_SIZE (HCI_MAX_EVENT_SIZE + HCI_EVENT_HDR_SIZE) | |
111 | ||
112 | enum bcm4377_otp_params_type { | |
113 | BCM4377_OTP_BOARD_PARAMS, | |
114 | BCM4377_OTP_CHIP_PARAMS | |
115 | }; | |
116 | ||
117 | enum bcm4377_transfer_ring_id { | |
118 | BCM4377_XFER_RING_CONTROL = 0, | |
119 | BCM4377_XFER_RING_HCI_H2D = 1, | |
120 | BCM4377_XFER_RING_HCI_D2H = 2, | |
121 | BCM4377_XFER_RING_SCO_H2D = 3, | |
122 | BCM4377_XFER_RING_SCO_D2H = 4, | |
123 | BCM4377_XFER_RING_ACL_H2D = 5, | |
124 | BCM4377_XFER_RING_ACL_D2H = 6, | |
125 | }; | |
126 | ||
127 | enum bcm4377_completion_ring_id { | |
128 | BCM4377_ACK_RING_CONTROL = 0, | |
129 | BCM4377_ACK_RING_HCI_ACL = 1, | |
130 | BCM4377_EVENT_RING_HCI_ACL = 2, | |
131 | BCM4377_ACK_RING_SCO = 3, | |
132 | BCM4377_EVENT_RING_SCO = 4, | |
133 | }; | |
134 | ||
135 | enum bcm4377_doorbell { | |
136 | BCM4377_DOORBELL_CONTROL = 0, | |
137 | BCM4377_DOORBELL_HCI_H2D = 1, | |
138 | BCM4377_DOORBELL_HCI_D2H = 2, | |
139 | BCM4377_DOORBELL_ACL_H2D = 3, | |
140 | BCM4377_DOORBELL_ACL_D2H = 4, | |
141 | BCM4377_DOORBELL_SCO = 6, | |
142 | }; | |
143 | ||
144 | /* | |
145 | * Transfer ring entry | |
146 | * | |
147 | * flags: Flags to indicate if the payload is appended or mapped | |
148 | * len: Payload length | |
149 | * payload: Optional payload DMA address | |
150 | * id: Message id to recognize the answer in the completion ring entry | |
151 | */ | |
152 | struct bcm4377_xfer_ring_entry { | |
153 | #define BCM4377_XFER_RING_FLAG_PAYLOAD_MAPPED BIT(0) | |
154 | #define BCM4377_XFER_RING_FLAG_PAYLOAD_IN_FOOTER BIT(1) | |
155 | u8 flags; | |
156 | __le16 len; | |
157 | u8 _unk0; | |
158 | __le64 payload; | |
159 | __le16 id; | |
160 | u8 _unk1[2]; | |
161 | } __packed; | |
162 | static_assert(sizeof(struct bcm4377_xfer_ring_entry) == 0x10); | |
163 | ||
164 | /* | |
165 | * Completion ring entry | |
166 | * | |
167 | * flags: Flags to indicate if the payload is appended or mapped. If the payload | |
168 | * is mapped it can be found in the buffer of the corresponding transfer | |
169 | * ring message. | |
170 | * ring_id: Transfer ring ID which required this message | |
171 | * msg_id: Message ID specified in transfer ring entry | |
172 | * len: Payload length | |
173 | */ | |
174 | struct bcm4377_completion_ring_entry { | |
175 | u8 flags; | |
176 | u8 _unk0; | |
177 | __le16 ring_id; | |
178 | __le16 msg_id; | |
179 | __le32 len; | |
180 | u8 _unk1[6]; | |
181 | } __packed; | |
182 | static_assert(sizeof(struct bcm4377_completion_ring_entry) == 0x10); | |
183 | ||
184 | enum bcm4377_control_message_type { | |
185 | BCM4377_CONTROL_MSG_CREATE_XFER_RING = 1, | |
186 | BCM4377_CONTROL_MSG_CREATE_COMPLETION_RING = 2, | |
187 | BCM4377_CONTROL_MSG_DESTROY_XFER_RING = 3, | |
188 | BCM4377_CONTROL_MSG_DESTROY_COMPLETION_RING = 4, | |
189 | }; | |
190 | ||
191 | /* | |
192 | * Control message used to create a completion ring | |
193 | * | |
194 | * msg_type: Must be BCM4377_CONTROL_MSG_CREATE_COMPLETION_RING | |
195 | * header_size: Unknown, but probably reserved space in front of the entry | |
196 | * footer_size: Number of 32 bit words reserved for payloads after the entry | |
197 | * id/id_again: Completion ring index | |
198 | * ring_iova: DMA address of the ring buffer | |
199 | * n_elements: Number of elements inside the ring buffer | |
200 | * msi: MSI index, doesn't work for all rings though and should be zero | |
201 | * intmod_delay: Unknown delay | |
202 | * intmod_bytes: Unknown | |
203 | */ | |
204 | struct bcm4377_create_completion_ring_msg { | |
205 | u8 msg_type; | |
206 | u8 header_size; | |
207 | u8 footer_size; | |
208 | u8 _unk0; | |
209 | __le16 id; | |
210 | __le16 id_again; | |
211 | __le64 ring_iova; | |
212 | __le16 n_elements; | |
213 | __le32 unk; | |
214 | u8 _unk1[6]; | |
215 | __le16 msi; | |
216 | __le16 intmod_delay; | |
217 | __le32 intmod_bytes; | |
218 | __le16 _unk2; | |
219 | __le32 _unk3; | |
220 | u8 _unk4[10]; | |
221 | } __packed; | |
222 | static_assert(sizeof(struct bcm4377_create_completion_ring_msg) == | |
223 | BCM4377_CONTROL_MSG_SIZE); | |
224 | ||
225 | /* | |
226 | * Control ring message used to destroy a completion ring | |
227 | * | |
228 | * msg_type: Must be BCM4377_CONTROL_MSG_DESTROY_COMPLETION_RING | |
229 | * ring_id: Completion ring to be destroyed | |
230 | */ | |
231 | struct bcm4377_destroy_completion_ring_msg { | |
232 | u8 msg_type; | |
233 | u8 _pad0; | |
234 | __le16 ring_id; | |
235 | u8 _pad1[48]; | |
236 | } __packed; | |
237 | static_assert(sizeof(struct bcm4377_destroy_completion_ring_msg) == | |
238 | BCM4377_CONTROL_MSG_SIZE); | |
239 | ||
240 | /* | |
241 | * Control message used to create a transfer ring | |
242 | * | |
243 | * msg_type: Must be BCM4377_CONTROL_MSG_CREATE_XFER_RING | |
244 | * header_size: Number of 32 bit words reserved for unknown content before the | |
245 | * entry | |
246 | * footer_size: Number of 32 bit words reserved for payloads after the entry | |
247 | * ring_id/ring_id_again: Transfer ring index | |
248 | * ring_iova: DMA address of the ring buffer | |
249 | * n_elements: Number of elements inside the ring buffer | |
250 | * completion_ring_id: Completion ring index for acknowledgements and events | |
251 | * doorbell: Doorbell index used to notify device of new entries | |
252 | * flags: Transfer ring flags | |
253 | * - virtual: set if there is no associated shared memory and only the | |
254 | * corresponding completion ring is used | |
255 | * - sync: only set for the SCO rings | |
256 | */ | |
257 | struct bcm4377_create_transfer_ring_msg { | |
258 | u8 msg_type; | |
259 | u8 header_size; | |
260 | u8 footer_size; | |
261 | u8 _unk0; | |
262 | __le16 ring_id; | |
263 | __le16 ring_id_again; | |
264 | __le64 ring_iova; | |
265 | u8 _unk1[8]; | |
266 | __le16 n_elements; | |
267 | __le16 completion_ring_id; | |
268 | __le16 doorbell; | |
269 | #define BCM4377_XFER_RING_FLAG_VIRTUAL BIT(7) | |
270 | #define BCM4377_XFER_RING_FLAG_SYNC BIT(8) | |
271 | __le16 flags; | |
272 | u8 _unk2[20]; | |
273 | } __packed; | |
274 | static_assert(sizeof(struct bcm4377_create_transfer_ring_msg) == | |
275 | BCM4377_CONTROL_MSG_SIZE); | |
276 | ||
277 | /* | |
278 | * Control ring message used to destroy a transfer ring | |
279 | * | |
280 | * msg_type: Must be BCM4377_CONTROL_MSG_DESTROY_XFER_RING | |
281 | * ring_id: Transfer ring to be destroyed | |
282 | */ | |
283 | struct bcm4377_destroy_transfer_ring_msg { | |
284 | u8 msg_type; | |
285 | u8 _pad0; | |
286 | __le16 ring_id; | |
287 | u8 _pad1[48]; | |
288 | } __packed; | |
289 | static_assert(sizeof(struct bcm4377_destroy_transfer_ring_msg) == | |
290 | BCM4377_CONTROL_MSG_SIZE); | |
291 | ||
292 | /* | |
293 | * "Converged IPC" context struct used to make the device aware of all other | |
294 | * shared memory structures. A pointer to this structure is configured inside a | |
295 | * MMIO register. | |
296 | * | |
297 | * version: Protocol version, must be 2. | |
298 | * size: Size of this structure, must be 0x68. | |
299 | * enabled_caps: Enabled capabilities. Unknown bitfield but should be 2. | |
300 | * peripheral_info_addr: DMA address for a 0x20 buffer to which the device will | |
301 | * write unknown contents | |
302 | * {completion,xfer}_ring_{tails,heads}_addr: DMA pointers to ring heads/tails | |
303 | * n_completion_rings: Number of completion rings, the firmware only works if | |
304 | * this is set to BCM4377_N_COMPLETION_RINGS. | |
305 | * n_xfer_rings: Number of transfer rings, the firmware only works if | |
306 | * this is set to BCM4377_N_TRANSFER_RINGS. | |
307 | * control_completion_ring_addr: Control completion ring buffer DMA address | |
308 | * control_xfer_ring_addr: Control transfer ring buffer DMA address | |
309 | * control_xfer_ring_n_entries: Number of control transfer ring entries | |
310 | * control_completion_ring_n_entries: Number of control completion ring entries | |
311 | * control_xfer_ring_doorbell: Control transfer ring doorbell | |
312 | * control_completion_ring_doorbell: Control completion ring doorbell, | |
313 | * must be set to 0xffff | |
314 | * control_xfer_ring_msi: Control completion ring MSI index, must be 0 | |
315 | * control_completion_ring_msi: Control completion ring MSI index, must be 0. | |
316 | * control_xfer_ring_header_size: Number of 32 bit words reserved in front of | |
317 | * every control transfer ring entry | |
318 | * control_xfer_ring_footer_size: Number of 32 bit words reserved after every | |
319 | * control transfer ring entry | |
320 | * control_completion_ring_header_size: Number of 32 bit words reserved in front | |
321 | * of every control completion ring entry | |
322 | * control_completion_ring_footer_size: Number of 32 bit words reserved after | |
323 | * every control completion ring entry | |
324 | * scratch_pad: Optional scratch pad DMA address | |
325 | * scratch_pad_size: Scratch pad size | |
326 | */ | |
327 | struct bcm4377_context { | |
328 | __le16 version; | |
329 | __le16 size; | |
330 | __le32 enabled_caps; | |
331 | ||
332 | __le64 peripheral_info_addr; | |
333 | ||
334 | /* ring heads and tails */ | |
335 | __le64 completion_ring_heads_addr; | |
336 | __le64 xfer_ring_tails_addr; | |
337 | __le64 completion_ring_tails_addr; | |
338 | __le64 xfer_ring_heads_addr; | |
339 | __le16 n_completion_rings; | |
340 | __le16 n_xfer_rings; | |
341 | ||
342 | /* control ring configuration */ | |
343 | __le64 control_completion_ring_addr; | |
344 | __le64 control_xfer_ring_addr; | |
345 | __le16 control_xfer_ring_n_entries; | |
346 | __le16 control_completion_ring_n_entries; | |
347 | __le16 control_xfer_ring_doorbell; | |
348 | __le16 control_completion_ring_doorbell; | |
349 | __le16 control_xfer_ring_msi; | |
350 | __le16 control_completion_ring_msi; | |
351 | u8 control_xfer_ring_header_size; | |
352 | u8 control_xfer_ring_footer_size; | |
353 | u8 control_completion_ring_header_size; | |
354 | u8 control_completion_ring_footer_size; | |
355 | ||
356 | __le16 _unk0; | |
357 | __le16 _unk1; | |
358 | ||
359 | __le64 scratch_pad; | |
360 | __le32 scratch_pad_size; | |
361 | ||
362 | __le32 _unk3; | |
363 | } __packed; | |
364 | static_assert(sizeof(struct bcm4377_context) == 0x68); | |
365 | ||
366 | #define BCM4378_CALIBRATION_CHUNK_SIZE 0xe6 | |
367 | struct bcm4378_hci_send_calibration_cmd { | |
368 | u8 unk; | |
369 | __le16 blocks_left; | |
370 | u8 data[BCM4378_CALIBRATION_CHUNK_SIZE]; | |
371 | } __packed; | |
372 | ||
373 | #define BCM4378_PTB_CHUNK_SIZE 0xcf | |
374 | struct bcm4378_hci_send_ptb_cmd { | |
375 | __le16 blocks_left; | |
376 | u8 data[BCM4378_PTB_CHUNK_SIZE]; | |
377 | } __packed; | |
378 | ||
379 | /* | |
380 | * Shared memory structure used to store the ring head and tail pointers. | |
381 | */ | |
382 | struct bcm4377_ring_state { | |
383 | __le16 completion_ring_head[BCM4377_N_COMPLETION_RINGS]; | |
384 | __le16 completion_ring_tail[BCM4377_N_COMPLETION_RINGS]; | |
385 | __le16 xfer_ring_head[BCM4377_N_TRANSFER_RINGS]; | |
386 | __le16 xfer_ring_tail[BCM4377_N_TRANSFER_RINGS]; | |
387 | }; | |
388 | ||
389 | /* | |
390 | * A transfer ring can be used in two configurations: | |
391 | * 1) Send control or HCI messages to the device which are then acknowledged | |
392 | * in the corresponding completion ring | |
393 | * 2) Receiving HCI frames from the devices. In this case the transfer ring | |
394 | * itself contains empty messages that are acknowledged once data is | |
395 | * available from the device. If the payloads fit inside the footers | |
396 | * of the completion ring the transfer ring can be configured to be | |
397 | * virtual such that it has no ring buffer. | |
398 | * | |
399 | * ring_id: ring index hardcoded in the firmware | |
400 | * doorbell: doorbell index to notify device of new entries | |
401 | * payload_size: optional in-place payload size | |
402 | * mapped_payload_size: optional out-of-place payload size | |
403 | * completion_ring: index of corresponding completion ring | |
404 | * n_entries: number of entries inside this ring | |
405 | * generation: ring generation; incremented on hci_open to detect stale messages | |
406 | * sync: set to true for SCO rings | |
407 | * virtual: set to true if this ring has no entries and is just required to | |
408 | * setup a corresponding completion ring for device->host messages | |
409 | * d2h_buffers_only: set to true if this ring is only used to provide large | |
410 | * buffers used by device->host messages in the completion | |
411 | * ring | |
412 | * allow_wait: allow to wait for messages to be acknowledged | |
413 | * enabled: true once the ring has been created and can be used | |
414 | * ring: ring buffer for entries (struct bcm4377_xfer_ring_entry) | |
415 | * ring_dma: DMA address for ring entry buffer | |
416 | * payloads: payload buffer for mapped_payload_size payloads | |
417 | * payloads_dma:DMA address for payload buffer | |
418 | * events: pointer to array of completions if waiting is allowed | |
419 | * msgids: bitmap to keep track of used message ids | |
420 | * lock: Spinlock to protect access to ring structurs used in the irq handler | |
421 | */ | |
422 | struct bcm4377_transfer_ring { | |
423 | enum bcm4377_transfer_ring_id ring_id; | |
424 | enum bcm4377_doorbell doorbell; | |
425 | size_t payload_size; | |
426 | size_t mapped_payload_size; | |
427 | u8 completion_ring; | |
428 | u16 n_entries; | |
429 | u8 generation; | |
430 | ||
431 | bool sync; | |
432 | bool virtual; | |
433 | bool d2h_buffers_only; | |
434 | bool allow_wait; | |
435 | bool enabled; | |
436 | ||
437 | void *ring; | |
438 | dma_addr_t ring_dma; | |
439 | ||
440 | void *payloads; | |
441 | dma_addr_t payloads_dma; | |
442 | ||
443 | struct completion **events; | |
444 | DECLARE_BITMAP(msgids, BCM4377_MAX_RING_SIZE); | |
445 | spinlock_t lock; | |
446 | }; | |
447 | ||
448 | /* | |
449 | * A completion ring can be either used to either acknowledge messages sent in | |
450 | * the corresponding transfer ring or to receive messages associated with the | |
451 | * transfer ring. When used to receive messages the transfer ring either | |
452 | * has no ring buffer and is only advanced ("virtual transfer ring") or it | |
453 | * only contains empty DMA buffers to be used for the payloads. | |
454 | * | |
455 | * ring_id: completion ring id, hardcoded in firmware | |
456 | * payload_size: optional payload size after each entry | |
457 | * delay: unknown delay | |
458 | * n_entries: number of entries in this ring | |
459 | * enabled: true once the ring has been created and can be used | |
460 | * ring: ring buffer for entries (struct bcm4377_completion_ring_entry) | |
461 | * ring_dma: DMA address of ring buffer | |
462 | * transfer_rings: bitmap of corresponding transfer ring ids | |
463 | */ | |
464 | struct bcm4377_completion_ring { | |
465 | enum bcm4377_completion_ring_id ring_id; | |
466 | u16 payload_size; | |
467 | u16 delay; | |
468 | u16 n_entries; | |
469 | bool enabled; | |
470 | ||
471 | void *ring; | |
472 | dma_addr_t ring_dma; | |
473 | ||
474 | unsigned long transfer_rings; | |
475 | }; | |
476 | ||
477 | struct bcm4377_data; | |
478 | ||
479 | /* | |
480 | * Chip-specific configuration struct | |
481 | * | |
482 | * id: Chip id (e.g. 0x4377 for BCM4377) | |
483 | * otp_offset: Offset to the start of the OTP inside BAR0 | |
484 | * bar0_window1: Backplane address mapped to the first window in BAR0 | |
485 | * bar0_window2: Backplane address mapped to the second window in BAR0 | |
486 | * bar0_core2_window2: Optional backplane address mapped to the second core's | |
487 | * second window in BAR0 | |
488 | * has_bar0_core2_window2: Set to true if this chip requires the second core's | |
489 | * second window to be configured | |
490 | * clear_pciecfg_subsystem_ctrl_bit19: Set to true if bit 19 in the | |
491 | * vendor-specific subsystem control | |
492 | * register has to be cleared | |
493 | * disable_aspm: Set to true if ASPM must be disabled due to hardware errata | |
494 | * broken_ext_scan: Set to true if the chip erroneously claims to support | |
495 | * extended scanning | |
496 | * broken_mws_transport_config: Set to true if the chip erroneously claims to | |
497 | * support MWS Transport Configuration | |
498 | * send_calibration: Optional callback to send calibration data | |
499 | * send_ptb: Callback to send "PTB" regulatory/calibration data | |
500 | */ | |
501 | struct bcm4377_hw { | |
502 | unsigned int id; | |
503 | ||
504 | u32 otp_offset; | |
505 | ||
506 | u32 bar0_window1; | |
507 | u32 bar0_window2; | |
508 | u32 bar0_core2_window2; | |
509 | ||
510 | unsigned long has_bar0_core2_window2 : 1; | |
511 | unsigned long clear_pciecfg_subsystem_ctrl_bit19 : 1; | |
512 | unsigned long disable_aspm : 1; | |
513 | unsigned long broken_ext_scan : 1; | |
514 | unsigned long broken_mws_transport_config : 1; | |
41e9cdea | 515 | unsigned long broken_le_coded : 1; |
8a061276 SP |
516 | |
517 | int (*send_calibration)(struct bcm4377_data *bcm4377); | |
518 | int (*send_ptb)(struct bcm4377_data *bcm4377, | |
519 | const struct firmware *fw); | |
520 | }; | |
521 | ||
522 | static const struct bcm4377_hw bcm4377_hw_variants[]; | |
523 | static const struct dmi_system_id bcm4377_dmi_board_table[]; | |
524 | ||
525 | /* | |
526 | * Private struct associated with each device containing global state | |
527 | * | |
528 | * pdev: Pointer to associated struct pci_dev | |
529 | * hdev: Pointer to associated strucy hci_dev | |
530 | * bar0: iomem pointing to BAR0 | |
531 | * bar1: iomem pointing to BAR2 | |
532 | * bootstage: Current value of the bootstage | |
533 | * rti_status: Current "RTI" status value | |
534 | * hw: Pointer to chip-specific struct bcm4377_hw | |
535 | * taurus_cal_blob: "Taurus" calibration blob used for some chips | |
536 | * taurus_cal_size: "Taurus" calibration blob size | |
537 | * taurus_beamforming_cal_blob: "Taurus" beamforming calibration blob used for | |
538 | * some chips | |
539 | * taurus_beamforming_cal_size: "Taurus" beamforming calibration blob size | |
540 | * stepping: Chip stepping read from OTP; used for firmware selection | |
541 | * vendor: Antenna vendor read from OTP; used for firmware selection | |
542 | * board_type: Board type from FDT or DMI match; used for firmware selection | |
543 | * event: Event for changed bootstage or rti_status; used for booting firmware | |
544 | * ctx: "Converged IPC" context | |
545 | * ctx_dma: "Converged IPC" context DMA address | |
546 | * ring_state: Shared memory buffer containing ring head and tail indexes | |
547 | * ring_state_dma: DMA address for ring_state | |
548 | * {control,hci_acl,sco}_ack_ring: Completion rings used to acknowledge messages | |
549 | * {hci_acl,sco}_event_ring: Completion rings used for device->host messages | |
550 | * control_h2d_ring: Transfer ring used for control messages | |
551 | * {hci,sco,acl}_h2d_ring: Transfer ring used to transfer HCI frames | |
552 | * {hci,sco,acl}_d2h_ring: Transfer ring used to receive HCI frames in the | |
553 | * corresponding completion ring | |
554 | */ | |
555 | struct bcm4377_data { | |
556 | struct pci_dev *pdev; | |
557 | struct hci_dev *hdev; | |
558 | ||
559 | void __iomem *bar0; | |
560 | void __iomem *bar2; | |
561 | ||
562 | u32 bootstage; | |
563 | u32 rti_status; | |
564 | ||
565 | const struct bcm4377_hw *hw; | |
566 | ||
567 | const void *taurus_cal_blob; | |
568 | int taurus_cal_size; | |
569 | const void *taurus_beamforming_cal_blob; | |
570 | int taurus_beamforming_cal_size; | |
571 | ||
572 | char stepping[BCM4377_OTP_MAX_PARAM_LEN]; | |
573 | char vendor[BCM4377_OTP_MAX_PARAM_LEN]; | |
574 | const char *board_type; | |
575 | ||
576 | struct completion event; | |
577 | ||
578 | struct bcm4377_context *ctx; | |
579 | dma_addr_t ctx_dma; | |
580 | ||
581 | struct bcm4377_ring_state *ring_state; | |
582 | dma_addr_t ring_state_dma; | |
583 | ||
584 | /* | |
585 | * The HCI and ACL rings have to be merged because this structure is | |
586 | * hardcoded in the firmware. | |
587 | */ | |
588 | struct bcm4377_completion_ring control_ack_ring; | |
589 | struct bcm4377_completion_ring hci_acl_ack_ring; | |
590 | struct bcm4377_completion_ring hci_acl_event_ring; | |
591 | struct bcm4377_completion_ring sco_ack_ring; | |
592 | struct bcm4377_completion_ring sco_event_ring; | |
593 | ||
594 | struct bcm4377_transfer_ring control_h2d_ring; | |
595 | struct bcm4377_transfer_ring hci_h2d_ring; | |
596 | struct bcm4377_transfer_ring hci_d2h_ring; | |
597 | struct bcm4377_transfer_ring sco_h2d_ring; | |
598 | struct bcm4377_transfer_ring sco_d2h_ring; | |
599 | struct bcm4377_transfer_ring acl_h2d_ring; | |
600 | struct bcm4377_transfer_ring acl_d2h_ring; | |
601 | }; | |
602 | ||
603 | static void bcm4377_ring_doorbell(struct bcm4377_data *bcm4377, u8 doorbell, | |
604 | u16 val) | |
605 | { | |
606 | u32 db = 0; | |
607 | ||
608 | db |= FIELD_PREP(BCM4377_BAR0_DOORBELL_VALUE, val); | |
609 | db |= FIELD_PREP(BCM4377_BAR0_DOORBELL_IDX, doorbell); | |
610 | db |= BCM4377_BAR0_DOORBELL_RING; | |
611 | ||
612 | dev_dbg(&bcm4377->pdev->dev, "write %d to doorbell #%d (0x%x)\n", val, | |
613 | doorbell, db); | |
614 | iowrite32(db, bcm4377->bar0 + BCM4377_BAR0_DOORBELL); | |
615 | } | |
616 | ||
617 | static int bcm4377_extract_msgid(struct bcm4377_data *bcm4377, | |
618 | struct bcm4377_transfer_ring *ring, | |
619 | u16 raw_msgid, u8 *msgid) | |
620 | { | |
621 | u8 generation = FIELD_GET(BCM4377_MSGID_GENERATION, raw_msgid); | |
622 | *msgid = FIELD_GET(BCM4377_MSGID_ID, raw_msgid); | |
623 | ||
624 | if (generation != ring->generation) { | |
625 | dev_warn( | |
626 | &bcm4377->pdev->dev, | |
627 | "invalid message generation %d should be %d in entry for ring %d\n", | |
628 | generation, ring->generation, ring->ring_id); | |
629 | return -EINVAL; | |
630 | } | |
631 | ||
632 | if (*msgid >= ring->n_entries) { | |
633 | dev_warn(&bcm4377->pdev->dev, | |
634 | "invalid message id in entry for ring %d: %d > %d\n", | |
635 | ring->ring_id, *msgid, ring->n_entries); | |
636 | return -EINVAL; | |
637 | } | |
638 | ||
639 | return 0; | |
640 | } | |
641 | ||
642 | static void bcm4377_handle_event(struct bcm4377_data *bcm4377, | |
643 | struct bcm4377_transfer_ring *ring, | |
644 | u16 raw_msgid, u8 entry_flags, u8 type, | |
645 | void *payload, size_t len) | |
646 | { | |
647 | struct sk_buff *skb; | |
648 | u16 head; | |
649 | u8 msgid; | |
650 | unsigned long flags; | |
651 | ||
652 | spin_lock_irqsave(&ring->lock, flags); | |
653 | if (!ring->enabled) { | |
654 | dev_warn(&bcm4377->pdev->dev, | |
655 | "event for disabled transfer ring %d\n", | |
656 | ring->ring_id); | |
657 | goto out; | |
658 | } | |
659 | ||
660 | if (ring->d2h_buffers_only && | |
661 | entry_flags & BCM4377_XFER_RING_FLAG_PAYLOAD_MAPPED) { | |
662 | if (bcm4377_extract_msgid(bcm4377, ring, raw_msgid, &msgid)) | |
663 | goto out; | |
664 | ||
665 | if (len > ring->mapped_payload_size) { | |
666 | dev_warn( | |
667 | &bcm4377->pdev->dev, | |
668 | "invalid payload len in event for ring %d: %zu > %zu\n", | |
669 | ring->ring_id, len, ring->mapped_payload_size); | |
670 | goto out; | |
671 | } | |
672 | ||
673 | payload = ring->payloads + msgid * ring->mapped_payload_size; | |
674 | } | |
675 | ||
676 | skb = bt_skb_alloc(len, GFP_ATOMIC); | |
677 | if (!skb) | |
678 | goto out; | |
679 | ||
680 | memcpy(skb_put(skb, len), payload, len); | |
681 | hci_skb_pkt_type(skb) = type; | |
682 | hci_recv_frame(bcm4377->hdev, skb); | |
683 | ||
684 | out: | |
685 | head = le16_to_cpu(bcm4377->ring_state->xfer_ring_head[ring->ring_id]); | |
686 | head = (head + 1) % ring->n_entries; | |
687 | bcm4377->ring_state->xfer_ring_head[ring->ring_id] = cpu_to_le16(head); | |
688 | ||
689 | bcm4377_ring_doorbell(bcm4377, ring->doorbell, head); | |
690 | ||
691 | spin_unlock_irqrestore(&ring->lock, flags); | |
692 | } | |
693 | ||
694 | static void bcm4377_handle_ack(struct bcm4377_data *bcm4377, | |
695 | struct bcm4377_transfer_ring *ring, | |
696 | u16 raw_msgid) | |
697 | { | |
698 | unsigned long flags; | |
699 | u8 msgid; | |
700 | ||
701 | spin_lock_irqsave(&ring->lock, flags); | |
702 | ||
703 | if (bcm4377_extract_msgid(bcm4377, ring, raw_msgid, &msgid)) | |
704 | goto unlock; | |
705 | ||
706 | if (!test_bit(msgid, ring->msgids)) { | |
707 | dev_warn( | |
708 | &bcm4377->pdev->dev, | |
709 | "invalid message id in ack for ring %d: %d is not used\n", | |
710 | ring->ring_id, msgid); | |
711 | goto unlock; | |
712 | } | |
713 | ||
714 | if (ring->allow_wait && ring->events[msgid]) { | |
715 | complete(ring->events[msgid]); | |
716 | ring->events[msgid] = NULL; | |
717 | } | |
718 | ||
719 | bitmap_release_region(ring->msgids, msgid, ring->n_entries); | |
720 | ||
721 | unlock: | |
722 | spin_unlock_irqrestore(&ring->lock, flags); | |
723 | } | |
724 | ||
725 | static void bcm4377_handle_completion(struct bcm4377_data *bcm4377, | |
726 | struct bcm4377_completion_ring *ring, | |
727 | u16 pos) | |
728 | { | |
729 | struct bcm4377_completion_ring_entry *entry; | |
730 | u16 msg_id, transfer_ring; | |
731 | size_t entry_size, data_len; | |
732 | void *data; | |
733 | ||
734 | if (pos >= ring->n_entries) { | |
735 | dev_warn(&bcm4377->pdev->dev, | |
736 | "invalid offset %d for completion ring %d\n", pos, | |
737 | ring->ring_id); | |
738 | return; | |
739 | } | |
740 | ||
741 | entry_size = sizeof(*entry) + ring->payload_size; | |
742 | entry = ring->ring + pos * entry_size; | |
743 | data = ring->ring + pos * entry_size + sizeof(*entry); | |
744 | data_len = le32_to_cpu(entry->len); | |
745 | msg_id = le16_to_cpu(entry->msg_id); | |
746 | transfer_ring = le16_to_cpu(entry->ring_id); | |
747 | ||
748 | if ((ring->transfer_rings & BIT(transfer_ring)) == 0) { | |
749 | dev_warn( | |
750 | &bcm4377->pdev->dev, | |
751 | "invalid entry at offset %d for transfer ring %d in completion ring %d\n", | |
752 | pos, transfer_ring, ring->ring_id); | |
753 | return; | |
754 | } | |
755 | ||
756 | dev_dbg(&bcm4377->pdev->dev, | |
757 | "entry in completion ring %d for transfer ring %d with msg_id %d\n", | |
758 | ring->ring_id, transfer_ring, msg_id); | |
759 | ||
760 | switch (transfer_ring) { | |
761 | case BCM4377_XFER_RING_CONTROL: | |
762 | bcm4377_handle_ack(bcm4377, &bcm4377->control_h2d_ring, msg_id); | |
763 | break; | |
764 | case BCM4377_XFER_RING_HCI_H2D: | |
765 | bcm4377_handle_ack(bcm4377, &bcm4377->hci_h2d_ring, msg_id); | |
766 | break; | |
767 | case BCM4377_XFER_RING_SCO_H2D: | |
768 | bcm4377_handle_ack(bcm4377, &bcm4377->sco_h2d_ring, msg_id); | |
769 | break; | |
770 | case BCM4377_XFER_RING_ACL_H2D: | |
771 | bcm4377_handle_ack(bcm4377, &bcm4377->acl_h2d_ring, msg_id); | |
772 | break; | |
773 | ||
774 | case BCM4377_XFER_RING_HCI_D2H: | |
775 | bcm4377_handle_event(bcm4377, &bcm4377->hci_d2h_ring, msg_id, | |
776 | entry->flags, HCI_EVENT_PKT, data, | |
777 | data_len); | |
778 | break; | |
779 | case BCM4377_XFER_RING_SCO_D2H: | |
780 | bcm4377_handle_event(bcm4377, &bcm4377->sco_d2h_ring, msg_id, | |
781 | entry->flags, HCI_SCODATA_PKT, data, | |
782 | data_len); | |
783 | break; | |
784 | case BCM4377_XFER_RING_ACL_D2H: | |
785 | bcm4377_handle_event(bcm4377, &bcm4377->acl_d2h_ring, msg_id, | |
786 | entry->flags, HCI_ACLDATA_PKT, data, | |
787 | data_len); | |
788 | break; | |
789 | ||
790 | default: | |
791 | dev_warn( | |
792 | &bcm4377->pdev->dev, | |
793 | "entry in completion ring %d for unknown transfer ring %d with msg_id %d\n", | |
794 | ring->ring_id, transfer_ring, msg_id); | |
795 | } | |
796 | } | |
797 | ||
798 | static void bcm4377_poll_completion_ring(struct bcm4377_data *bcm4377, | |
799 | struct bcm4377_completion_ring *ring) | |
800 | { | |
801 | u16 tail; | |
802 | __le16 *heads = bcm4377->ring_state->completion_ring_head; | |
803 | __le16 *tails = bcm4377->ring_state->completion_ring_tail; | |
804 | ||
805 | if (!ring->enabled) | |
806 | return; | |
807 | ||
808 | tail = le16_to_cpu(tails[ring->ring_id]); | |
809 | dev_dbg(&bcm4377->pdev->dev, | |
810 | "completion ring #%d: head: %d, tail: %d\n", ring->ring_id, | |
811 | le16_to_cpu(heads[ring->ring_id]), tail); | |
812 | ||
813 | while (tail != le16_to_cpu(READ_ONCE(heads[ring->ring_id]))) { | |
814 | /* | |
815 | * ensure the CPU doesn't speculate through the comparison. | |
816 | * otherwise it might already read the (empty) queue entry | |
817 | * before the updated head has been loaded and checked. | |
818 | */ | |
819 | dma_rmb(); | |
820 | ||
821 | bcm4377_handle_completion(bcm4377, ring, tail); | |
822 | ||
823 | tail = (tail + 1) % ring->n_entries; | |
824 | tails[ring->ring_id] = cpu_to_le16(tail); | |
825 | } | |
826 | } | |
827 | ||
828 | static irqreturn_t bcm4377_irq(int irq, void *data) | |
829 | { | |
830 | struct bcm4377_data *bcm4377 = data; | |
831 | u32 bootstage, rti_status; | |
832 | ||
833 | bootstage = ioread32(bcm4377->bar2 + BCM4377_BAR2_BOOTSTAGE); | |
834 | rti_status = ioread32(bcm4377->bar2 + BCM4377_BAR2_RTI_STATUS); | |
835 | ||
836 | if (bootstage != bcm4377->bootstage || | |
837 | rti_status != bcm4377->rti_status) { | |
838 | dev_dbg(&bcm4377->pdev->dev, | |
839 | "bootstage = %d -> %d, rti state = %d -> %d\n", | |
840 | bcm4377->bootstage, bootstage, bcm4377->rti_status, | |
841 | rti_status); | |
842 | complete(&bcm4377->event); | |
843 | bcm4377->bootstage = bootstage; | |
844 | bcm4377->rti_status = rti_status; | |
845 | } | |
846 | ||
847 | if (rti_status > 2) | |
848 | dev_err(&bcm4377->pdev->dev, "RTI status is %d\n", rti_status); | |
849 | ||
850 | bcm4377_poll_completion_ring(bcm4377, &bcm4377->control_ack_ring); | |
851 | bcm4377_poll_completion_ring(bcm4377, &bcm4377->hci_acl_event_ring); | |
852 | bcm4377_poll_completion_ring(bcm4377, &bcm4377->hci_acl_ack_ring); | |
853 | bcm4377_poll_completion_ring(bcm4377, &bcm4377->sco_ack_ring); | |
854 | bcm4377_poll_completion_ring(bcm4377, &bcm4377->sco_event_ring); | |
855 | ||
856 | return IRQ_HANDLED; | |
857 | } | |
858 | ||
859 | static int bcm4377_enqueue(struct bcm4377_data *bcm4377, | |
860 | struct bcm4377_transfer_ring *ring, void *data, | |
861 | size_t len, bool wait) | |
862 | { | |
863 | unsigned long flags; | |
864 | struct bcm4377_xfer_ring_entry *entry; | |
865 | void *payload; | |
866 | size_t offset; | |
867 | u16 head, tail, new_head; | |
868 | u16 raw_msgid; | |
869 | int ret, msgid; | |
870 | DECLARE_COMPLETION_ONSTACK(event); | |
871 | ||
872 | if (len > ring->payload_size && len > ring->mapped_payload_size) { | |
873 | dev_warn( | |
874 | &bcm4377->pdev->dev, | |
875 | "payload len %zu is too large for ring %d (max is %zu or %zu)\n", | |
876 | len, ring->ring_id, ring->payload_size, | |
877 | ring->mapped_payload_size); | |
878 | return -EINVAL; | |
879 | } | |
880 | if (wait && !ring->allow_wait) | |
881 | return -EINVAL; | |
882 | if (ring->virtual) | |
883 | return -EINVAL; | |
884 | ||
885 | spin_lock_irqsave(&ring->lock, flags); | |
886 | ||
887 | head = le16_to_cpu(bcm4377->ring_state->xfer_ring_head[ring->ring_id]); | |
888 | tail = le16_to_cpu(bcm4377->ring_state->xfer_ring_tail[ring->ring_id]); | |
889 | ||
890 | new_head = (head + 1) % ring->n_entries; | |
891 | ||
892 | if (new_head == tail) { | |
893 | dev_warn(&bcm4377->pdev->dev, | |
894 | "can't send message because ring %d is full\n", | |
895 | ring->ring_id); | |
896 | ret = -EINVAL; | |
897 | goto out; | |
898 | } | |
899 | ||
900 | msgid = bitmap_find_free_region(ring->msgids, ring->n_entries, 0); | |
901 | if (msgid < 0) { | |
902 | dev_warn(&bcm4377->pdev->dev, | |
903 | "can't find message id for ring %d\n", ring->ring_id); | |
904 | ret = -EINVAL; | |
905 | goto out; | |
906 | } | |
907 | ||
908 | raw_msgid = FIELD_PREP(BCM4377_MSGID_GENERATION, ring->generation); | |
909 | raw_msgid |= FIELD_PREP(BCM4377_MSGID_ID, msgid); | |
910 | ||
911 | offset = head * (sizeof(*entry) + ring->payload_size); | |
912 | entry = ring->ring + offset; | |
913 | ||
914 | memset(entry, 0, sizeof(*entry)); | |
915 | entry->id = cpu_to_le16(raw_msgid); | |
916 | entry->len = cpu_to_le16(len); | |
917 | ||
918 | if (len <= ring->payload_size) { | |
919 | entry->flags = BCM4377_XFER_RING_FLAG_PAYLOAD_IN_FOOTER; | |
920 | payload = ring->ring + offset + sizeof(*entry); | |
921 | } else { | |
922 | entry->flags = BCM4377_XFER_RING_FLAG_PAYLOAD_MAPPED; | |
923 | entry->payload = cpu_to_le64(ring->payloads_dma + | |
924 | msgid * ring->mapped_payload_size); | |
925 | payload = ring->payloads + msgid * ring->mapped_payload_size; | |
926 | } | |
927 | ||
928 | memcpy(payload, data, len); | |
929 | ||
930 | if (wait) | |
931 | ring->events[msgid] = &event; | |
932 | ||
933 | /* | |
934 | * The 4377 chips stop responding to any commands as soon as they | |
935 | * have been idle for a while. Poking the sleep control register here | |
936 | * makes them come alive again. | |
937 | */ | |
938 | iowrite32(BCM4377_BAR0_SLEEP_CONTROL_AWAKE, | |
939 | bcm4377->bar0 + BCM4377_BAR0_SLEEP_CONTROL); | |
940 | ||
941 | dev_dbg(&bcm4377->pdev->dev, | |
942 | "updating head for transfer queue #%d to %d\n", ring->ring_id, | |
943 | new_head); | |
944 | bcm4377->ring_state->xfer_ring_head[ring->ring_id] = | |
945 | cpu_to_le16(new_head); | |
946 | ||
947 | if (!ring->sync) | |
948 | bcm4377_ring_doorbell(bcm4377, ring->doorbell, new_head); | |
949 | ret = 0; | |
950 | ||
951 | out: | |
952 | spin_unlock_irqrestore(&ring->lock, flags); | |
953 | ||
954 | if (ret == 0 && wait) { | |
955 | ret = wait_for_completion_interruptible_timeout( | |
956 | &event, BCM4377_TIMEOUT); | |
957 | if (ret == 0) | |
958 | ret = -ETIMEDOUT; | |
959 | else if (ret > 0) | |
960 | ret = 0; | |
961 | ||
962 | spin_lock_irqsave(&ring->lock, flags); | |
963 | ring->events[msgid] = NULL; | |
964 | spin_unlock_irqrestore(&ring->lock, flags); | |
965 | } | |
966 | ||
967 | return ret; | |
968 | } | |
969 | ||
970 | static int bcm4377_create_completion_ring(struct bcm4377_data *bcm4377, | |
971 | struct bcm4377_completion_ring *ring) | |
972 | { | |
973 | struct bcm4377_create_completion_ring_msg msg; | |
974 | int ret; | |
975 | ||
976 | if (ring->enabled) { | |
977 | dev_warn(&bcm4377->pdev->dev, | |
978 | "completion ring %d already enabled\n", ring->ring_id); | |
979 | return 0; | |
980 | } | |
981 | ||
982 | memset(ring->ring, 0, | |
983 | ring->n_entries * (sizeof(struct bcm4377_completion_ring_entry) + | |
984 | ring->payload_size)); | |
985 | memset(&msg, 0, sizeof(msg)); | |
986 | msg.msg_type = BCM4377_CONTROL_MSG_CREATE_COMPLETION_RING; | |
987 | msg.id = cpu_to_le16(ring->ring_id); | |
988 | msg.id_again = cpu_to_le16(ring->ring_id); | |
989 | msg.ring_iova = cpu_to_le64(ring->ring_dma); | |
990 | msg.n_elements = cpu_to_le16(ring->n_entries); | |
991 | msg.intmod_bytes = cpu_to_le32(0xffffffff); | |
992 | msg.unk = cpu_to_le32(0xffffffff); | |
993 | msg.intmod_delay = cpu_to_le16(ring->delay); | |
994 | msg.footer_size = ring->payload_size / 4; | |
995 | ||
996 | ret = bcm4377_enqueue(bcm4377, &bcm4377->control_h2d_ring, &msg, | |
997 | sizeof(msg), true); | |
998 | if (!ret) | |
999 | ring->enabled = true; | |
1000 | ||
1001 | return ret; | |
1002 | } | |
1003 | ||
1004 | static int bcm4377_destroy_completion_ring(struct bcm4377_data *bcm4377, | |
1005 | struct bcm4377_completion_ring *ring) | |
1006 | { | |
1007 | struct bcm4377_destroy_completion_ring_msg msg; | |
1008 | int ret; | |
1009 | ||
1010 | memset(&msg, 0, sizeof(msg)); | |
1011 | msg.msg_type = BCM4377_CONTROL_MSG_DESTROY_COMPLETION_RING; | |
1012 | msg.ring_id = cpu_to_le16(ring->ring_id); | |
1013 | ||
1014 | ret = bcm4377_enqueue(bcm4377, &bcm4377->control_h2d_ring, &msg, | |
1015 | sizeof(msg), true); | |
1016 | if (ret) | |
1017 | dev_warn(&bcm4377->pdev->dev, | |
1018 | "failed to destroy completion ring %d\n", | |
1019 | ring->ring_id); | |
1020 | ||
1021 | ring->enabled = false; | |
1022 | return ret; | |
1023 | } | |
1024 | ||
1025 | static int bcm4377_create_transfer_ring(struct bcm4377_data *bcm4377, | |
1026 | struct bcm4377_transfer_ring *ring) | |
1027 | { | |
1028 | struct bcm4377_create_transfer_ring_msg msg; | |
1029 | u16 flags = 0; | |
1030 | int ret, i; | |
1031 | unsigned long spinlock_flags; | |
1032 | ||
1033 | if (ring->virtual) | |
1034 | flags |= BCM4377_XFER_RING_FLAG_VIRTUAL; | |
1035 | if (ring->sync) | |
1036 | flags |= BCM4377_XFER_RING_FLAG_SYNC; | |
1037 | ||
1038 | spin_lock_irqsave(&ring->lock, spinlock_flags); | |
1039 | memset(&msg, 0, sizeof(msg)); | |
1040 | msg.msg_type = BCM4377_CONTROL_MSG_CREATE_XFER_RING; | |
1041 | msg.ring_id = cpu_to_le16(ring->ring_id); | |
1042 | msg.ring_id_again = cpu_to_le16(ring->ring_id); | |
1043 | msg.ring_iova = cpu_to_le64(ring->ring_dma); | |
1044 | msg.n_elements = cpu_to_le16(ring->n_entries); | |
1045 | msg.completion_ring_id = cpu_to_le16(ring->completion_ring); | |
1046 | msg.doorbell = cpu_to_le16(ring->doorbell); | |
1047 | msg.flags = cpu_to_le16(flags); | |
1048 | msg.footer_size = ring->payload_size / 4; | |
1049 | ||
1050 | bcm4377->ring_state->xfer_ring_head[ring->ring_id] = 0; | |
1051 | bcm4377->ring_state->xfer_ring_tail[ring->ring_id] = 0; | |
1052 | ring->generation++; | |
1053 | spin_unlock_irqrestore(&ring->lock, spinlock_flags); | |
1054 | ||
1055 | ret = bcm4377_enqueue(bcm4377, &bcm4377->control_h2d_ring, &msg, | |
1056 | sizeof(msg), true); | |
1057 | ||
1058 | spin_lock_irqsave(&ring->lock, spinlock_flags); | |
1059 | ||
1060 | if (ring->d2h_buffers_only) { | |
1061 | for (i = 0; i < ring->n_entries; ++i) { | |
1062 | struct bcm4377_xfer_ring_entry *entry = | |
1063 | ring->ring + i * sizeof(*entry); | |
1064 | u16 raw_msgid = FIELD_PREP(BCM4377_MSGID_GENERATION, | |
1065 | ring->generation); | |
1066 | raw_msgid |= FIELD_PREP(BCM4377_MSGID_ID, i); | |
1067 | ||
1068 | memset(entry, 0, sizeof(*entry)); | |
1069 | entry->id = cpu_to_le16(raw_msgid); | |
1070 | entry->len = cpu_to_le16(ring->mapped_payload_size); | |
1071 | entry->flags = BCM4377_XFER_RING_FLAG_PAYLOAD_MAPPED; | |
1072 | entry->payload = | |
1073 | cpu_to_le64(ring->payloads_dma + | |
1074 | i * ring->mapped_payload_size); | |
1075 | } | |
1076 | } | |
1077 | ||
1078 | /* | |
1079 | * send some messages if this is a device->host ring to allow the device | |
1080 | * to reply by acknowledging them in the completion ring | |
1081 | */ | |
1082 | if (ring->virtual || ring->d2h_buffers_only) { | |
1083 | bcm4377->ring_state->xfer_ring_head[ring->ring_id] = | |
1084 | cpu_to_le16(0xf); | |
1085 | bcm4377_ring_doorbell(bcm4377, ring->doorbell, 0xf); | |
1086 | } | |
1087 | ||
1088 | ring->enabled = true; | |
1089 | spin_unlock_irqrestore(&ring->lock, spinlock_flags); | |
1090 | ||
1091 | return ret; | |
1092 | } | |
1093 | ||
1094 | static int bcm4377_destroy_transfer_ring(struct bcm4377_data *bcm4377, | |
1095 | struct bcm4377_transfer_ring *ring) | |
1096 | { | |
1097 | struct bcm4377_destroy_transfer_ring_msg msg; | |
1098 | int ret; | |
1099 | ||
1100 | memset(&msg, 0, sizeof(msg)); | |
1101 | msg.msg_type = BCM4377_CONTROL_MSG_DESTROY_XFER_RING; | |
1102 | msg.ring_id = cpu_to_le16(ring->ring_id); | |
1103 | ||
1104 | ret = bcm4377_enqueue(bcm4377, &bcm4377->control_h2d_ring, &msg, | |
1105 | sizeof(msg), true); | |
1106 | if (ret) | |
1107 | dev_warn(&bcm4377->pdev->dev, | |
1108 | "failed to destroy transfer ring %d\n", ring->ring_id); | |
1109 | ||
1110 | ring->enabled = false; | |
1111 | return ret; | |
1112 | } | |
1113 | ||
1114 | static int __bcm4378_send_calibration_chunk(struct bcm4377_data *bcm4377, | |
1115 | const void *data, size_t data_len, | |
1116 | u16 blocks_left) | |
1117 | { | |
1118 | struct bcm4378_hci_send_calibration_cmd cmd; | |
1119 | struct sk_buff *skb; | |
1120 | ||
1121 | if (data_len > sizeof(cmd.data)) | |
1122 | return -EINVAL; | |
1123 | ||
1124 | memset(&cmd, 0, sizeof(cmd)); | |
1125 | cmd.unk = 0x03; | |
1126 | cmd.blocks_left = cpu_to_le16(blocks_left); | |
1127 | memcpy(cmd.data, data, data_len); | |
1128 | ||
1129 | skb = __hci_cmd_sync(bcm4377->hdev, 0xfd97, sizeof(cmd), &cmd, | |
1130 | HCI_INIT_TIMEOUT); | |
1131 | if (IS_ERR(skb)) | |
1132 | return PTR_ERR(skb); | |
1133 | ||
1134 | kfree_skb(skb); | |
1135 | return 0; | |
1136 | } | |
1137 | ||
1138 | static int __bcm4378_send_calibration(struct bcm4377_data *bcm4377, | |
1139 | const void *data, size_t data_size) | |
1140 | { | |
1141 | int ret; | |
1142 | size_t i, left, transfer_len; | |
1143 | size_t blocks = | |
1144 | DIV_ROUND_UP(data_size, (size_t)BCM4378_CALIBRATION_CHUNK_SIZE); | |
1145 | ||
1146 | if (!data) { | |
1147 | dev_err(&bcm4377->pdev->dev, | |
1148 | "no calibration data available.\n"); | |
1149 | return -ENOENT; | |
1150 | } | |
1151 | ||
1152 | for (i = 0, left = data_size; i < blocks; ++i, left -= transfer_len) { | |
1153 | transfer_len = | |
1154 | min_t(size_t, left, BCM4378_CALIBRATION_CHUNK_SIZE); | |
1155 | ||
1156 | ret = __bcm4378_send_calibration_chunk( | |
1157 | bcm4377, data + i * BCM4378_CALIBRATION_CHUNK_SIZE, | |
1158 | transfer_len, blocks - i - 1); | |
1159 | if (ret) { | |
1160 | dev_err(&bcm4377->pdev->dev, | |
1161 | "send calibration chunk failed with %d\n", ret); | |
1162 | return ret; | |
1163 | } | |
1164 | } | |
1165 | ||
1166 | return 0; | |
1167 | } | |
1168 | ||
1169 | static int bcm4378_send_calibration(struct bcm4377_data *bcm4377) | |
1170 | { | |
1171 | if ((strcmp(bcm4377->stepping, "b1") == 0) || | |
1172 | strcmp(bcm4377->stepping, "b3") == 0) | |
1173 | return __bcm4378_send_calibration( | |
1174 | bcm4377, bcm4377->taurus_beamforming_cal_blob, | |
1175 | bcm4377->taurus_beamforming_cal_size); | |
1176 | else | |
1177 | return __bcm4378_send_calibration(bcm4377, | |
1178 | bcm4377->taurus_cal_blob, | |
1179 | bcm4377->taurus_cal_size); | |
1180 | } | |
1181 | ||
1182 | static int bcm4387_send_calibration(struct bcm4377_data *bcm4377) | |
1183 | { | |
1184 | if (strcmp(bcm4377->stepping, "c2") == 0) | |
1185 | return __bcm4378_send_calibration( | |
1186 | bcm4377, bcm4377->taurus_beamforming_cal_blob, | |
1187 | bcm4377->taurus_beamforming_cal_size); | |
1188 | else | |
1189 | return __bcm4378_send_calibration(bcm4377, | |
1190 | bcm4377->taurus_cal_blob, | |
1191 | bcm4377->taurus_cal_size); | |
1192 | } | |
1193 | ||
1194 | static const struct firmware *bcm4377_request_blob(struct bcm4377_data *bcm4377, | |
1195 | const char *suffix) | |
1196 | { | |
1197 | const struct firmware *fw; | |
1198 | char name0[64], name1[64]; | |
1199 | int ret; | |
1200 | ||
1201 | snprintf(name0, sizeof(name0), "brcm/brcmbt%04x%s-%s-%s.%s", | |
1202 | bcm4377->hw->id, bcm4377->stepping, bcm4377->board_type, | |
1203 | bcm4377->vendor, suffix); | |
1204 | snprintf(name1, sizeof(name1), "brcm/brcmbt%04x%s-%s.%s", | |
1205 | bcm4377->hw->id, bcm4377->stepping, bcm4377->board_type, | |
1206 | suffix); | |
1207 | dev_dbg(&bcm4377->pdev->dev, "Trying to load firmware: '%s' or '%s'\n", | |
1208 | name0, name1); | |
1209 | ||
1210 | ret = firmware_request_nowarn(&fw, name0, &bcm4377->pdev->dev); | |
1211 | if (!ret) | |
1212 | return fw; | |
1213 | ret = firmware_request_nowarn(&fw, name1, &bcm4377->pdev->dev); | |
1214 | if (!ret) | |
1215 | return fw; | |
1216 | ||
1217 | dev_err(&bcm4377->pdev->dev, | |
1218 | "Unable to load firmware; tried '%s' and '%s'\n", name0, name1); | |
1219 | return NULL; | |
1220 | } | |
1221 | ||
1222 | static int bcm4377_send_ptb(struct bcm4377_data *bcm4377, | |
1223 | const struct firmware *fw) | |
1224 | { | |
1225 | struct sk_buff *skb; | |
1226 | ||
1227 | skb = __hci_cmd_sync(bcm4377->hdev, 0xfd98, fw->size, fw->data, | |
1228 | HCI_INIT_TIMEOUT); | |
1229 | /* | |
1230 | * This command seems to always fail on more recent firmware versions | |
1231 | * (even in traces taken from the macOS driver). It's unclear why this | |
1232 | * happens but because the PTB file contains calibration and/or | |
1233 | * regulatory data and may be required on older firmware we still try to | |
1234 | * send it here just in case and just ignore if it fails. | |
1235 | */ | |
1236 | if (!IS_ERR(skb)) | |
1237 | kfree_skb(skb); | |
1238 | return 0; | |
1239 | } | |
1240 | ||
1241 | static int bcm4378_send_ptb_chunk(struct bcm4377_data *bcm4377, | |
1242 | const void *data, size_t data_len, | |
1243 | u16 blocks_left) | |
1244 | { | |
1245 | struct bcm4378_hci_send_ptb_cmd cmd; | |
1246 | struct sk_buff *skb; | |
1247 | ||
1248 | if (data_len > BCM4378_PTB_CHUNK_SIZE) | |
1249 | return -EINVAL; | |
1250 | ||
1251 | memset(&cmd, 0, sizeof(cmd)); | |
1252 | cmd.blocks_left = cpu_to_le16(blocks_left); | |
1253 | memcpy(cmd.data, data, data_len); | |
1254 | ||
1255 | skb = __hci_cmd_sync(bcm4377->hdev, 0xfe0d, sizeof(cmd), &cmd, | |
1256 | HCI_INIT_TIMEOUT); | |
1257 | if (IS_ERR(skb)) | |
1258 | return PTR_ERR(skb); | |
1259 | ||
1260 | kfree_skb(skb); | |
1261 | return 0; | |
1262 | } | |
1263 | ||
1264 | static int bcm4378_send_ptb(struct bcm4377_data *bcm4377, | |
1265 | const struct firmware *fw) | |
1266 | { | |
1267 | size_t chunks = DIV_ROUND_UP(fw->size, (size_t)BCM4378_PTB_CHUNK_SIZE); | |
1268 | size_t i, left, transfer_len; | |
1269 | int ret; | |
1270 | ||
1271 | for (i = 0, left = fw->size; i < chunks; ++i, left -= transfer_len) { | |
1272 | transfer_len = min_t(size_t, left, BCM4378_PTB_CHUNK_SIZE); | |
1273 | ||
1274 | dev_dbg(&bcm4377->pdev->dev, "sending ptb chunk %zu/%zu\n", | |
1275 | i + 1, chunks); | |
1276 | ret = bcm4378_send_ptb_chunk( | |
1277 | bcm4377, fw->data + i * BCM4378_PTB_CHUNK_SIZE, | |
1278 | transfer_len, chunks - i - 1); | |
1279 | if (ret) { | |
1280 | dev_err(&bcm4377->pdev->dev, | |
1281 | "sending ptb chunk %zu failed (%d)", i, ret); | |
1282 | return ret; | |
1283 | } | |
1284 | } | |
1285 | ||
1286 | return 0; | |
1287 | } | |
1288 | ||
1289 | static int bcm4377_hci_open(struct hci_dev *hdev) | |
1290 | { | |
1291 | struct bcm4377_data *bcm4377 = hci_get_drvdata(hdev); | |
1292 | int ret; | |
1293 | ||
1294 | dev_dbg(&bcm4377->pdev->dev, "creating rings\n"); | |
1295 | ||
1296 | ret = bcm4377_create_completion_ring(bcm4377, | |
1297 | &bcm4377->hci_acl_ack_ring); | |
1298 | if (ret) | |
1299 | return ret; | |
1300 | ret = bcm4377_create_completion_ring(bcm4377, | |
1301 | &bcm4377->hci_acl_event_ring); | |
1302 | if (ret) | |
1303 | goto destroy_hci_acl_ack; | |
1304 | ret = bcm4377_create_completion_ring(bcm4377, &bcm4377->sco_ack_ring); | |
1305 | if (ret) | |
1306 | goto destroy_hci_acl_event; | |
1307 | ret = bcm4377_create_completion_ring(bcm4377, &bcm4377->sco_event_ring); | |
1308 | if (ret) | |
1309 | goto destroy_sco_ack; | |
1310 | dev_dbg(&bcm4377->pdev->dev, | |
1311 | "all completion rings successfully created!\n"); | |
1312 | ||
1313 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->hci_h2d_ring); | |
1314 | if (ret) | |
1315 | goto destroy_sco_event; | |
1316 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->hci_d2h_ring); | |
1317 | if (ret) | |
1318 | goto destroy_hci_h2d; | |
1319 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->sco_h2d_ring); | |
1320 | if (ret) | |
1321 | goto destroy_hci_d2h; | |
1322 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->sco_d2h_ring); | |
1323 | if (ret) | |
1324 | goto destroy_sco_h2d; | |
1325 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->acl_h2d_ring); | |
1326 | if (ret) | |
1327 | goto destroy_sco_d2h; | |
1328 | ret = bcm4377_create_transfer_ring(bcm4377, &bcm4377->acl_d2h_ring); | |
1329 | if (ret) | |
1330 | goto destroy_acl_h2d; | |
1331 | dev_dbg(&bcm4377->pdev->dev, | |
1332 | "all transfer rings successfully created!\n"); | |
1333 | ||
1334 | return 0; | |
1335 | ||
1336 | destroy_acl_h2d: | |
1337 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->acl_h2d_ring); | |
1338 | destroy_sco_d2h: | |
1339 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->sco_d2h_ring); | |
1340 | destroy_sco_h2d: | |
1341 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->sco_h2d_ring); | |
1342 | destroy_hci_d2h: | |
1343 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->hci_h2d_ring); | |
1344 | destroy_hci_h2d: | |
1345 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->hci_d2h_ring); | |
1346 | destroy_sco_event: | |
1347 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->sco_event_ring); | |
1348 | destroy_sco_ack: | |
1349 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->sco_ack_ring); | |
1350 | destroy_hci_acl_event: | |
1351 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->hci_acl_event_ring); | |
1352 | destroy_hci_acl_ack: | |
1353 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->hci_acl_ack_ring); | |
1354 | ||
1355 | dev_err(&bcm4377->pdev->dev, "Creating rings failed with %d\n", ret); | |
1356 | return ret; | |
1357 | } | |
1358 | ||
1359 | static int bcm4377_hci_close(struct hci_dev *hdev) | |
1360 | { | |
1361 | struct bcm4377_data *bcm4377 = hci_get_drvdata(hdev); | |
1362 | ||
1363 | dev_dbg(&bcm4377->pdev->dev, "destroying rings in hci_close\n"); | |
1364 | ||
1365 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->acl_d2h_ring); | |
1366 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->acl_h2d_ring); | |
1367 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->sco_d2h_ring); | |
1368 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->sco_h2d_ring); | |
1369 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->hci_d2h_ring); | |
1370 | bcm4377_destroy_transfer_ring(bcm4377, &bcm4377->hci_h2d_ring); | |
1371 | ||
1372 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->sco_event_ring); | |
1373 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->sco_ack_ring); | |
1374 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->hci_acl_event_ring); | |
1375 | bcm4377_destroy_completion_ring(bcm4377, &bcm4377->hci_acl_ack_ring); | |
1376 | ||
1377 | return 0; | |
1378 | } | |
1379 | ||
1380 | static bool bcm4377_is_valid_bdaddr(struct bcm4377_data *bcm4377, | |
1381 | bdaddr_t *addr) | |
1382 | { | |
1383 | if (addr->b[0] != 0x93) | |
1384 | return true; | |
1385 | if (addr->b[1] != 0x76) | |
1386 | return true; | |
1387 | if (addr->b[2] != 0x00) | |
1388 | return true; | |
1389 | if (addr->b[4] != (bcm4377->hw->id & 0xff)) | |
1390 | return true; | |
1391 | if (addr->b[5] != (bcm4377->hw->id >> 8)) | |
1392 | return true; | |
1393 | return false; | |
1394 | } | |
1395 | ||
1396 | static int bcm4377_check_bdaddr(struct bcm4377_data *bcm4377) | |
1397 | { | |
1398 | struct hci_rp_read_bd_addr *bda; | |
1399 | struct sk_buff *skb; | |
1400 | ||
1401 | skb = __hci_cmd_sync(bcm4377->hdev, HCI_OP_READ_BD_ADDR, 0, NULL, | |
1402 | HCI_INIT_TIMEOUT); | |
1403 | if (IS_ERR(skb)) { | |
1404 | int err = PTR_ERR(skb); | |
1405 | ||
1406 | dev_err(&bcm4377->pdev->dev, "HCI_OP_READ_BD_ADDR failed (%d)", | |
1407 | err); | |
1408 | return err; | |
1409 | } | |
1410 | ||
1411 | if (skb->len != sizeof(*bda)) { | |
1412 | dev_err(&bcm4377->pdev->dev, | |
1413 | "HCI_OP_READ_BD_ADDR reply length invalid"); | |
1414 | kfree_skb(skb); | |
1415 | return -EIO; | |
1416 | } | |
1417 | ||
1418 | bda = (struct hci_rp_read_bd_addr *)skb->data; | |
1419 | if (!bcm4377_is_valid_bdaddr(bcm4377, &bda->bdaddr)) | |
c17d2a7b | 1420 | set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &bcm4377->hdev->quirks); |
8a061276 SP |
1421 | |
1422 | kfree_skb(skb); | |
1423 | return 0; | |
1424 | } | |
1425 | ||
1426 | static int bcm4377_hci_setup(struct hci_dev *hdev) | |
1427 | { | |
1428 | struct bcm4377_data *bcm4377 = hci_get_drvdata(hdev); | |
1429 | const struct firmware *fw; | |
1430 | int ret; | |
1431 | ||
1432 | if (bcm4377->hw->send_calibration) { | |
1433 | ret = bcm4377->hw->send_calibration(bcm4377); | |
1434 | if (ret) | |
1435 | return ret; | |
1436 | } | |
1437 | ||
1438 | fw = bcm4377_request_blob(bcm4377, "ptb"); | |
1439 | if (!fw) { | |
1440 | dev_err(&bcm4377->pdev->dev, "failed to load PTB data"); | |
1441 | return -ENOENT; | |
1442 | } | |
1443 | ||
1444 | ret = bcm4377->hw->send_ptb(bcm4377, fw); | |
1445 | release_firmware(fw); | |
1446 | if (ret) | |
1447 | return ret; | |
1448 | ||
1449 | return bcm4377_check_bdaddr(bcm4377); | |
1450 | } | |
1451 | ||
1452 | static int bcm4377_hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) | |
1453 | { | |
1454 | struct bcm4377_data *bcm4377 = hci_get_drvdata(hdev); | |
1455 | struct bcm4377_transfer_ring *ring; | |
1456 | int ret; | |
1457 | ||
1458 | switch (hci_skb_pkt_type(skb)) { | |
1459 | case HCI_COMMAND_PKT: | |
1460 | hdev->stat.cmd_tx++; | |
1461 | ring = &bcm4377->hci_h2d_ring; | |
1462 | break; | |
1463 | ||
1464 | case HCI_ACLDATA_PKT: | |
1465 | hdev->stat.acl_tx++; | |
1466 | ring = &bcm4377->acl_h2d_ring; | |
1467 | break; | |
1468 | ||
1469 | case HCI_SCODATA_PKT: | |
1470 | hdev->stat.sco_tx++; | |
1471 | ring = &bcm4377->sco_h2d_ring; | |
1472 | break; | |
1473 | ||
1474 | default: | |
1475 | return -EILSEQ; | |
1476 | } | |
1477 | ||
1478 | ret = bcm4377_enqueue(bcm4377, ring, skb->data, skb->len, false); | |
1479 | if (ret < 0) { | |
1480 | hdev->stat.err_tx++; | |
1481 | return ret; | |
1482 | } | |
1483 | ||
1484 | hdev->stat.byte_tx += skb->len; | |
1485 | kfree_skb(skb); | |
1486 | return ret; | |
1487 | } | |
1488 | ||
1489 | static int bcm4377_hci_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) | |
1490 | { | |
1491 | struct bcm4377_data *bcm4377 = hci_get_drvdata(hdev); | |
1492 | struct sk_buff *skb; | |
1493 | int err; | |
1494 | ||
1495 | skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); | |
1496 | if (IS_ERR(skb)) { | |
1497 | err = PTR_ERR(skb); | |
1498 | dev_err(&bcm4377->pdev->dev, | |
1499 | "Change address command failed (%d)", err); | |
1500 | return err; | |
1501 | } | |
1502 | kfree_skb(skb); | |
1503 | ||
1504 | return 0; | |
1505 | } | |
1506 | ||
1507 | static int bcm4377_alloc_transfer_ring(struct bcm4377_data *bcm4377, | |
1508 | struct bcm4377_transfer_ring *ring) | |
1509 | { | |
1510 | size_t entry_size; | |
1511 | ||
1512 | spin_lock_init(&ring->lock); | |
1513 | ring->payload_size = ALIGN(ring->payload_size, 4); | |
1514 | ring->mapped_payload_size = ALIGN(ring->mapped_payload_size, 4); | |
1515 | ||
1516 | if (ring->payload_size > BCM4377_XFER_RING_MAX_INPLACE_PAYLOAD_SIZE) | |
1517 | return -EINVAL; | |
1518 | if (ring->n_entries > BCM4377_MAX_RING_SIZE) | |
1519 | return -EINVAL; | |
1520 | if (ring->virtual && ring->allow_wait) | |
1521 | return -EINVAL; | |
1522 | ||
1523 | if (ring->d2h_buffers_only) { | |
1524 | if (ring->virtual) | |
1525 | return -EINVAL; | |
1526 | if (ring->payload_size) | |
1527 | return -EINVAL; | |
1528 | if (!ring->mapped_payload_size) | |
1529 | return -EINVAL; | |
1530 | } | |
1531 | if (ring->virtual) | |
1532 | return 0; | |
1533 | ||
1534 | entry_size = | |
1535 | ring->payload_size + sizeof(struct bcm4377_xfer_ring_entry); | |
1536 | ring->ring = dmam_alloc_coherent(&bcm4377->pdev->dev, | |
1537 | ring->n_entries * entry_size, | |
1538 | &ring->ring_dma, GFP_KERNEL); | |
1539 | if (!ring->ring) | |
1540 | return -ENOMEM; | |
1541 | ||
1542 | if (ring->allow_wait) { | |
1543 | ring->events = devm_kcalloc(&bcm4377->pdev->dev, | |
1544 | ring->n_entries, | |
1545 | sizeof(*ring->events), GFP_KERNEL); | |
1546 | if (!ring->events) | |
1547 | return -ENOMEM; | |
1548 | } | |
1549 | ||
1550 | if (ring->mapped_payload_size) { | |
1551 | ring->payloads = dmam_alloc_coherent( | |
1552 | &bcm4377->pdev->dev, | |
1553 | ring->n_entries * ring->mapped_payload_size, | |
1554 | &ring->payloads_dma, GFP_KERNEL); | |
1555 | if (!ring->payloads) | |
1556 | return -ENOMEM; | |
1557 | } | |
1558 | ||
1559 | return 0; | |
1560 | } | |
1561 | ||
1562 | static int bcm4377_alloc_completion_ring(struct bcm4377_data *bcm4377, | |
1563 | struct bcm4377_completion_ring *ring) | |
1564 | { | |
1565 | size_t entry_size; | |
1566 | ||
1567 | ring->payload_size = ALIGN(ring->payload_size, 4); | |
1568 | if (ring->payload_size > BCM4377_XFER_RING_MAX_INPLACE_PAYLOAD_SIZE) | |
1569 | return -EINVAL; | |
1570 | if (ring->n_entries > BCM4377_MAX_RING_SIZE) | |
1571 | return -EINVAL; | |
1572 | ||
1573 | entry_size = ring->payload_size + | |
1574 | sizeof(struct bcm4377_completion_ring_entry); | |
1575 | ||
1576 | ring->ring = dmam_alloc_coherent(&bcm4377->pdev->dev, | |
1577 | ring->n_entries * entry_size, | |
1578 | &ring->ring_dma, GFP_KERNEL); | |
1579 | if (!ring->ring) | |
1580 | return -ENOMEM; | |
1581 | return 0; | |
1582 | } | |
1583 | ||
1584 | static int bcm4377_init_context(struct bcm4377_data *bcm4377) | |
1585 | { | |
1586 | struct device *dev = &bcm4377->pdev->dev; | |
1587 | dma_addr_t peripheral_info_dma; | |
1588 | ||
1589 | bcm4377->ctx = dmam_alloc_coherent(dev, sizeof(*bcm4377->ctx), | |
1590 | &bcm4377->ctx_dma, GFP_KERNEL); | |
1591 | if (!bcm4377->ctx) | |
1592 | return -ENOMEM; | |
1593 | memset(bcm4377->ctx, 0, sizeof(*bcm4377->ctx)); | |
1594 | ||
1595 | bcm4377->ring_state = | |
1596 | dmam_alloc_coherent(dev, sizeof(*bcm4377->ring_state), | |
1597 | &bcm4377->ring_state_dma, GFP_KERNEL); | |
1598 | if (!bcm4377->ring_state) | |
1599 | return -ENOMEM; | |
1600 | memset(bcm4377->ring_state, 0, sizeof(*bcm4377->ring_state)); | |
1601 | ||
1602 | bcm4377->ctx->version = cpu_to_le16(1); | |
1603 | bcm4377->ctx->size = cpu_to_le16(sizeof(*bcm4377->ctx)); | |
1604 | bcm4377->ctx->enabled_caps = cpu_to_le32(2); | |
1605 | ||
1606 | /* | |
1607 | * The BT device will write 0x20 bytes of data to this buffer but | |
1608 | * the exact contents are unknown. It only needs to exist for BT | |
1609 | * to work such that we can just allocate and then ignore it. | |
1610 | */ | |
1611 | if (!dmam_alloc_coherent(&bcm4377->pdev->dev, 0x20, | |
1612 | &peripheral_info_dma, GFP_KERNEL)) | |
1613 | return -ENOMEM; | |
1614 | bcm4377->ctx->peripheral_info_addr = cpu_to_le64(peripheral_info_dma); | |
1615 | ||
1616 | bcm4377->ctx->xfer_ring_heads_addr = cpu_to_le64( | |
1617 | bcm4377->ring_state_dma + | |
1618 | offsetof(struct bcm4377_ring_state, xfer_ring_head)); | |
1619 | bcm4377->ctx->xfer_ring_tails_addr = cpu_to_le64( | |
1620 | bcm4377->ring_state_dma + | |
1621 | offsetof(struct bcm4377_ring_state, xfer_ring_tail)); | |
1622 | bcm4377->ctx->completion_ring_heads_addr = cpu_to_le64( | |
1623 | bcm4377->ring_state_dma + | |
1624 | offsetof(struct bcm4377_ring_state, completion_ring_head)); | |
1625 | bcm4377->ctx->completion_ring_tails_addr = cpu_to_le64( | |
1626 | bcm4377->ring_state_dma + | |
1627 | offsetof(struct bcm4377_ring_state, completion_ring_tail)); | |
1628 | ||
1629 | bcm4377->ctx->n_completion_rings = | |
1630 | cpu_to_le16(BCM4377_N_COMPLETION_RINGS); | |
1631 | bcm4377->ctx->n_xfer_rings = cpu_to_le16(BCM4377_N_TRANSFER_RINGS); | |
1632 | ||
1633 | bcm4377->ctx->control_completion_ring_addr = | |
1634 | cpu_to_le64(bcm4377->control_ack_ring.ring_dma); | |
1635 | bcm4377->ctx->control_completion_ring_n_entries = | |
1636 | cpu_to_le16(bcm4377->control_ack_ring.n_entries); | |
1637 | bcm4377->ctx->control_completion_ring_doorbell = cpu_to_le16(0xffff); | |
1638 | bcm4377->ctx->control_completion_ring_msi = 0; | |
1639 | bcm4377->ctx->control_completion_ring_header_size = 0; | |
1640 | bcm4377->ctx->control_completion_ring_footer_size = 0; | |
1641 | ||
1642 | bcm4377->ctx->control_xfer_ring_addr = | |
1643 | cpu_to_le64(bcm4377->control_h2d_ring.ring_dma); | |
1644 | bcm4377->ctx->control_xfer_ring_n_entries = | |
1645 | cpu_to_le16(bcm4377->control_h2d_ring.n_entries); | |
1646 | bcm4377->ctx->control_xfer_ring_doorbell = | |
1647 | cpu_to_le16(bcm4377->control_h2d_ring.doorbell); | |
1648 | bcm4377->ctx->control_xfer_ring_msi = 0; | |
1649 | bcm4377->ctx->control_xfer_ring_header_size = 0; | |
1650 | bcm4377->ctx->control_xfer_ring_footer_size = | |
1651 | bcm4377->control_h2d_ring.payload_size / 4; | |
1652 | ||
1653 | dev_dbg(&bcm4377->pdev->dev, "context initialized at IOVA %pad", | |
1654 | &bcm4377->ctx_dma); | |
1655 | ||
1656 | return 0; | |
1657 | } | |
1658 | ||
1659 | static int bcm4377_prepare_rings(struct bcm4377_data *bcm4377) | |
1660 | { | |
1661 | int ret; | |
1662 | ||
1663 | /* | |
1664 | * Even though many of these settings appear to be configurable | |
1665 | * when sending the "create ring" messages most of these are | |
1666 | * actually hardcoded in some (and quite possibly all) firmware versions | |
1667 | * and changing them on the host has no effect. | |
1668 | * Specifically, this applies to at least the doorbells, the transfer | |
1669 | * and completion ring ids and their mapping (e.g. both HCI and ACL | |
1670 | * entries will always be queued in completion rings 1 and 2 no matter | |
1671 | * what we configure here). | |
1672 | */ | |
1673 | bcm4377->control_ack_ring.ring_id = BCM4377_ACK_RING_CONTROL; | |
1674 | bcm4377->control_ack_ring.n_entries = 32; | |
1675 | bcm4377->control_ack_ring.transfer_rings = | |
1676 | BIT(BCM4377_XFER_RING_CONTROL); | |
1677 | ||
1678 | bcm4377->hci_acl_ack_ring.ring_id = BCM4377_ACK_RING_HCI_ACL; | |
1679 | bcm4377->hci_acl_ack_ring.n_entries = 2 * BCM4377_RING_N_ENTRIES; | |
1680 | bcm4377->hci_acl_ack_ring.transfer_rings = | |
1681 | BIT(BCM4377_XFER_RING_HCI_H2D) | BIT(BCM4377_XFER_RING_ACL_H2D); | |
1682 | bcm4377->hci_acl_ack_ring.delay = 1000; | |
1683 | ||
1684 | /* | |
1685 | * A payload size of MAX_EVENT_PAYLOAD_SIZE is enough here since large | |
1686 | * ACL packets will be transmitted inside buffers mapped via | |
1687 | * acl_d2h_ring anyway. | |
1688 | */ | |
1689 | bcm4377->hci_acl_event_ring.ring_id = BCM4377_EVENT_RING_HCI_ACL; | |
1690 | bcm4377->hci_acl_event_ring.payload_size = MAX_EVENT_PAYLOAD_SIZE; | |
1691 | bcm4377->hci_acl_event_ring.n_entries = 2 * BCM4377_RING_N_ENTRIES; | |
1692 | bcm4377->hci_acl_event_ring.transfer_rings = | |
1693 | BIT(BCM4377_XFER_RING_HCI_D2H) | BIT(BCM4377_XFER_RING_ACL_D2H); | |
1694 | bcm4377->hci_acl_event_ring.delay = 1000; | |
1695 | ||
1696 | bcm4377->sco_ack_ring.ring_id = BCM4377_ACK_RING_SCO; | |
1697 | bcm4377->sco_ack_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1698 | bcm4377->sco_ack_ring.transfer_rings = BIT(BCM4377_XFER_RING_SCO_H2D); | |
1699 | ||
1700 | bcm4377->sco_event_ring.ring_id = BCM4377_EVENT_RING_SCO; | |
1701 | bcm4377->sco_event_ring.payload_size = MAX_SCO_PAYLOAD_SIZE; | |
1702 | bcm4377->sco_event_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1703 | bcm4377->sco_event_ring.transfer_rings = BIT(BCM4377_XFER_RING_SCO_D2H); | |
1704 | ||
1705 | bcm4377->control_h2d_ring.ring_id = BCM4377_XFER_RING_CONTROL; | |
1706 | bcm4377->control_h2d_ring.doorbell = BCM4377_DOORBELL_CONTROL; | |
1707 | bcm4377->control_h2d_ring.payload_size = BCM4377_CONTROL_MSG_SIZE; | |
1708 | bcm4377->control_h2d_ring.completion_ring = BCM4377_ACK_RING_CONTROL; | |
1709 | bcm4377->control_h2d_ring.allow_wait = true; | |
1710 | bcm4377->control_h2d_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1711 | ||
1712 | bcm4377->hci_h2d_ring.ring_id = BCM4377_XFER_RING_HCI_H2D; | |
1713 | bcm4377->hci_h2d_ring.doorbell = BCM4377_DOORBELL_HCI_H2D; | |
1714 | bcm4377->hci_h2d_ring.payload_size = MAX_EVENT_PAYLOAD_SIZE; | |
1715 | bcm4377->hci_h2d_ring.completion_ring = BCM4377_ACK_RING_HCI_ACL; | |
1716 | bcm4377->hci_h2d_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1717 | ||
1718 | bcm4377->hci_d2h_ring.ring_id = BCM4377_XFER_RING_HCI_D2H; | |
1719 | bcm4377->hci_d2h_ring.doorbell = BCM4377_DOORBELL_HCI_D2H; | |
1720 | bcm4377->hci_d2h_ring.completion_ring = BCM4377_EVENT_RING_HCI_ACL; | |
1721 | bcm4377->hci_d2h_ring.virtual = true; | |
1722 | bcm4377->hci_d2h_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1723 | ||
1724 | bcm4377->sco_h2d_ring.ring_id = BCM4377_XFER_RING_SCO_H2D; | |
1725 | bcm4377->sco_h2d_ring.doorbell = BCM4377_DOORBELL_SCO; | |
1726 | bcm4377->sco_h2d_ring.payload_size = MAX_SCO_PAYLOAD_SIZE; | |
1727 | bcm4377->sco_h2d_ring.completion_ring = BCM4377_ACK_RING_SCO; | |
1728 | bcm4377->sco_h2d_ring.sync = true; | |
1729 | bcm4377->sco_h2d_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1730 | ||
1731 | bcm4377->sco_d2h_ring.ring_id = BCM4377_XFER_RING_SCO_D2H; | |
1732 | bcm4377->sco_d2h_ring.doorbell = BCM4377_DOORBELL_SCO; | |
1733 | bcm4377->sco_d2h_ring.completion_ring = BCM4377_EVENT_RING_SCO; | |
1734 | bcm4377->sco_d2h_ring.virtual = true; | |
1735 | bcm4377->sco_d2h_ring.sync = true; | |
1736 | bcm4377->sco_d2h_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1737 | ||
1738 | /* | |
1739 | * This ring has to use mapped_payload_size because the largest ACL | |
1740 | * packet doesn't fit inside the largest possible footer | |
1741 | */ | |
1742 | bcm4377->acl_h2d_ring.ring_id = BCM4377_XFER_RING_ACL_H2D; | |
1743 | bcm4377->acl_h2d_ring.doorbell = BCM4377_DOORBELL_ACL_H2D; | |
1744 | bcm4377->acl_h2d_ring.mapped_payload_size = MAX_ACL_PAYLOAD_SIZE; | |
1745 | bcm4377->acl_h2d_ring.completion_ring = BCM4377_ACK_RING_HCI_ACL; | |
1746 | bcm4377->acl_h2d_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1747 | ||
1748 | /* | |
1749 | * This ring only contains empty buffers to be used by incoming | |
1750 | * ACL packets that do not fit inside the footer of hci_acl_event_ring | |
1751 | */ | |
1752 | bcm4377->acl_d2h_ring.ring_id = BCM4377_XFER_RING_ACL_D2H; | |
1753 | bcm4377->acl_d2h_ring.doorbell = BCM4377_DOORBELL_ACL_D2H; | |
1754 | bcm4377->acl_d2h_ring.completion_ring = BCM4377_EVENT_RING_HCI_ACL; | |
1755 | bcm4377->acl_d2h_ring.d2h_buffers_only = true; | |
1756 | bcm4377->acl_d2h_ring.mapped_payload_size = MAX_ACL_PAYLOAD_SIZE; | |
1757 | bcm4377->acl_d2h_ring.n_entries = BCM4377_RING_N_ENTRIES; | |
1758 | ||
1759 | /* | |
1760 | * no need for any cleanup since this is only called from _probe | |
1761 | * and only devres-managed allocations are used | |
1762 | */ | |
1763 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->control_h2d_ring); | |
1764 | if (ret) | |
1765 | return ret; | |
1766 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->hci_h2d_ring); | |
1767 | if (ret) | |
1768 | return ret; | |
1769 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->hci_d2h_ring); | |
1770 | if (ret) | |
1771 | return ret; | |
1772 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->sco_h2d_ring); | |
1773 | if (ret) | |
1774 | return ret; | |
1775 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->sco_d2h_ring); | |
1776 | if (ret) | |
1777 | return ret; | |
1778 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->acl_h2d_ring); | |
1779 | if (ret) | |
1780 | return ret; | |
1781 | ret = bcm4377_alloc_transfer_ring(bcm4377, &bcm4377->acl_d2h_ring); | |
1782 | if (ret) | |
1783 | return ret; | |
1784 | ||
1785 | ret = bcm4377_alloc_completion_ring(bcm4377, | |
1786 | &bcm4377->control_ack_ring); | |
1787 | if (ret) | |
1788 | return ret; | |
1789 | ret = bcm4377_alloc_completion_ring(bcm4377, | |
1790 | &bcm4377->hci_acl_ack_ring); | |
1791 | if (ret) | |
1792 | return ret; | |
1793 | ret = bcm4377_alloc_completion_ring(bcm4377, | |
1794 | &bcm4377->hci_acl_event_ring); | |
1795 | if (ret) | |
1796 | return ret; | |
1797 | ret = bcm4377_alloc_completion_ring(bcm4377, &bcm4377->sco_ack_ring); | |
1798 | if (ret) | |
1799 | return ret; | |
1800 | ret = bcm4377_alloc_completion_ring(bcm4377, &bcm4377->sco_event_ring); | |
1801 | if (ret) | |
1802 | return ret; | |
1803 | ||
1804 | dev_dbg(&bcm4377->pdev->dev, "all rings allocated and prepared\n"); | |
1805 | ||
1806 | return 0; | |
1807 | } | |
1808 | ||
1809 | static int bcm4377_boot(struct bcm4377_data *bcm4377) | |
1810 | { | |
1811 | const struct firmware *fw; | |
1812 | void *bfr; | |
1813 | dma_addr_t fw_dma; | |
1814 | int ret = 0; | |
1815 | u32 bootstage, rti_status; | |
1816 | ||
1817 | bootstage = ioread32(bcm4377->bar2 + BCM4377_BAR2_BOOTSTAGE); | |
1818 | rti_status = ioread32(bcm4377->bar2 + BCM4377_BAR2_RTI_STATUS); | |
1819 | ||
1820 | if (bootstage != 0) { | |
1821 | dev_err(&bcm4377->pdev->dev, "bootstage is %d and not 0\n", | |
1822 | bootstage); | |
1823 | return -EINVAL; | |
1824 | } | |
1825 | ||
1826 | if (rti_status != 0) { | |
1827 | dev_err(&bcm4377->pdev->dev, "RTI status is %d and not 0\n", | |
1828 | rti_status); | |
1829 | return -EINVAL; | |
1830 | } | |
1831 | ||
1832 | fw = bcm4377_request_blob(bcm4377, "bin"); | |
1833 | if (!fw) { | |
1834 | dev_err(&bcm4377->pdev->dev, "Failed to load firmware\n"); | |
1835 | return -ENOENT; | |
1836 | } | |
1837 | ||
1838 | bfr = dma_alloc_coherent(&bcm4377->pdev->dev, fw->size, &fw_dma, | |
1839 | GFP_KERNEL); | |
1840 | if (!bfr) { | |
1841 | ret = -ENOMEM; | |
1842 | goto out_release_fw; | |
1843 | } | |
1844 | ||
1845 | memcpy(bfr, fw->data, fw->size); | |
1846 | ||
1847 | iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_HOST_WINDOW_LO); | |
1848 | iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_HOST_WINDOW_HI); | |
1849 | iowrite32(BCM4377_DMA_MASK, | |
1850 | bcm4377->bar0 + BCM4377_BAR0_HOST_WINDOW_SIZE); | |
1851 | ||
1852 | iowrite32(lower_32_bits(fw_dma), bcm4377->bar2 + BCM4377_BAR2_FW_LO); | |
1853 | iowrite32(upper_32_bits(fw_dma), bcm4377->bar2 + BCM4377_BAR2_FW_HI); | |
1854 | iowrite32(fw->size, bcm4377->bar2 + BCM4377_BAR2_FW_SIZE); | |
1855 | iowrite32(0, bcm4377->bar0 + BCM4377_BAR0_FW_DOORBELL); | |
1856 | ||
1857 | dev_dbg(&bcm4377->pdev->dev, "waiting for firmware to boot\n"); | |
1858 | ||
1859 | ret = wait_for_completion_interruptible_timeout(&bcm4377->event, | |
1860 | BCM4377_TIMEOUT); | |
1861 | if (ret == 0) { | |
1862 | ret = -ETIMEDOUT; | |
1863 | goto out_dma_free; | |
1864 | } else if (ret < 0) { | |
1865 | goto out_dma_free; | |
1866 | } | |
1867 | ||
1868 | if (bcm4377->bootstage != 2) { | |
1869 | dev_err(&bcm4377->pdev->dev, "boostage %d != 2\n", | |
1870 | bcm4377->bootstage); | |
1871 | ret = -ENXIO; | |
1872 | goto out_dma_free; | |
1873 | } | |
1874 | ||
1875 | dev_dbg(&bcm4377->pdev->dev, "firmware has booted (stage = %x)\n", | |
1876 | bcm4377->bootstage); | |
1877 | ret = 0; | |
1878 | ||
1879 | out_dma_free: | |
1880 | dma_free_coherent(&bcm4377->pdev->dev, fw->size, bfr, fw_dma); | |
1881 | out_release_fw: | |
1882 | release_firmware(fw); | |
1883 | return ret; | |
1884 | } | |
1885 | ||
1886 | static int bcm4377_setup_rti(struct bcm4377_data *bcm4377) | |
1887 | { | |
1888 | int ret; | |
1889 | ||
1890 | dev_dbg(&bcm4377->pdev->dev, "starting RTI\n"); | |
1891 | iowrite32(1, bcm4377->bar0 + BCM4377_BAR0_RTI_CONTROL); | |
1892 | ||
1893 | ret = wait_for_completion_interruptible_timeout(&bcm4377->event, | |
1894 | BCM4377_TIMEOUT); | |
1895 | if (ret == 0) { | |
1896 | dev_err(&bcm4377->pdev->dev, | |
1897 | "timed out while waiting for RTI to transition to state 1"); | |
1898 | return -ETIMEDOUT; | |
1899 | } else if (ret < 0) { | |
1900 | return ret; | |
1901 | } | |
1902 | ||
1903 | if (bcm4377->rti_status != 1) { | |
1904 | dev_err(&bcm4377->pdev->dev, "RTI did not ack state 1 (%d)\n", | |
1905 | bcm4377->rti_status); | |
1906 | return -ENODEV; | |
1907 | } | |
1908 | dev_dbg(&bcm4377->pdev->dev, "RTI is in state 1\n"); | |
1909 | ||
1910 | /* allow access to the entire IOVA space again */ | |
1911 | iowrite32(0, bcm4377->bar2 + BCM4377_BAR2_RTI_WINDOW_LO); | |
1912 | iowrite32(0, bcm4377->bar2 + BCM4377_BAR2_RTI_WINDOW_HI); | |
1913 | iowrite32(BCM4377_DMA_MASK, | |
1914 | bcm4377->bar2 + BCM4377_BAR2_RTI_WINDOW_SIZE); | |
1915 | ||
1916 | /* setup "Converged IPC" context */ | |
1917 | iowrite32(lower_32_bits(bcm4377->ctx_dma), | |
1918 | bcm4377->bar2 + BCM4377_BAR2_CONTEXT_ADDR_LO); | |
1919 | iowrite32(upper_32_bits(bcm4377->ctx_dma), | |
1920 | bcm4377->bar2 + BCM4377_BAR2_CONTEXT_ADDR_HI); | |
1921 | iowrite32(2, bcm4377->bar0 + BCM4377_BAR0_RTI_CONTROL); | |
1922 | ||
1923 | ret = wait_for_completion_interruptible_timeout(&bcm4377->event, | |
1924 | BCM4377_TIMEOUT); | |
1925 | if (ret == 0) { | |
1926 | dev_err(&bcm4377->pdev->dev, | |
1927 | "timed out while waiting for RTI to transition to state 2"); | |
1928 | return -ETIMEDOUT; | |
1929 | } else if (ret < 0) { | |
1930 | return ret; | |
1931 | } | |
1932 | ||
1933 | if (bcm4377->rti_status != 2) { | |
1934 | dev_err(&bcm4377->pdev->dev, "RTI did not ack state 2 (%d)\n", | |
1935 | bcm4377->rti_status); | |
1936 | return -ENODEV; | |
1937 | } | |
1938 | ||
1939 | dev_dbg(&bcm4377->pdev->dev, | |
1940 | "RTI is in state 2; control ring is ready\n"); | |
1941 | bcm4377->control_ack_ring.enabled = true; | |
1942 | ||
1943 | return 0; | |
1944 | } | |
1945 | ||
1946 | static int bcm4377_parse_otp_board_params(struct bcm4377_data *bcm4377, | |
1947 | char tag, const char *val, size_t len) | |
1948 | { | |
1949 | if (tag != 'V') | |
1950 | return 0; | |
1951 | if (len >= sizeof(bcm4377->vendor)) | |
1952 | return -EINVAL; | |
1953 | ||
1954 | strscpy(bcm4377->vendor, val, len + 1); | |
1955 | return 0; | |
1956 | } | |
1957 | ||
1958 | static int bcm4377_parse_otp_chip_params(struct bcm4377_data *bcm4377, char tag, | |
1959 | const char *val, size_t len) | |
1960 | { | |
1961 | size_t idx = 0; | |
1962 | ||
1963 | if (tag != 's') | |
1964 | return 0; | |
1965 | if (len >= sizeof(bcm4377->stepping)) | |
1966 | return -EINVAL; | |
1967 | ||
1968 | while (len != 0) { | |
1969 | bcm4377->stepping[idx] = tolower(val[idx]); | |
1970 | if (val[idx] == '\0') | |
1971 | return 0; | |
1972 | ||
1973 | idx++; | |
1974 | len--; | |
1975 | } | |
1976 | ||
1977 | bcm4377->stepping[idx] = '\0'; | |
1978 | return 0; | |
1979 | } | |
1980 | ||
1981 | static int bcm4377_parse_otp_str(struct bcm4377_data *bcm4377, const u8 *str, | |
1982 | enum bcm4377_otp_params_type type) | |
1983 | { | |
1984 | const char *p; | |
1985 | int ret; | |
1986 | ||
1987 | p = skip_spaces(str); | |
1988 | while (*p) { | |
1989 | char tag = *p++; | |
1990 | const char *end; | |
1991 | size_t len; | |
1992 | ||
1993 | if (*p++ != '=') /* implicit NUL check */ | |
1994 | return -EINVAL; | |
1995 | ||
1996 | /* *p might be NUL here, if so end == p and len == 0 */ | |
1997 | end = strchrnul(p, ' '); | |
1998 | len = end - p; | |
1999 | ||
2000 | /* leave 1 byte for NUL in destination string */ | |
2001 | if (len > (BCM4377_OTP_MAX_PARAM_LEN - 1)) | |
2002 | return -EINVAL; | |
2003 | ||
2004 | switch (type) { | |
2005 | case BCM4377_OTP_BOARD_PARAMS: | |
2006 | ret = bcm4377_parse_otp_board_params(bcm4377, tag, p, | |
2007 | len); | |
2008 | break; | |
2009 | case BCM4377_OTP_CHIP_PARAMS: | |
2010 | ret = bcm4377_parse_otp_chip_params(bcm4377, tag, p, | |
2011 | len); | |
2012 | break; | |
2013 | default: | |
2014 | ret = -EINVAL; | |
2015 | break; | |
2016 | } | |
2017 | ||
2018 | if (ret) | |
2019 | return ret; | |
2020 | ||
2021 | /* Skip to next arg, if any */ | |
2022 | p = skip_spaces(end); | |
2023 | } | |
2024 | ||
2025 | return 0; | |
2026 | } | |
2027 | ||
2028 | static int bcm4377_parse_otp_sys_vendor(struct bcm4377_data *bcm4377, u8 *otp, | |
2029 | size_t size) | |
2030 | { | |
2031 | int idx = 4; | |
2032 | const char *chip_params; | |
2033 | const char *board_params; | |
2034 | int ret; | |
2035 | ||
2036 | /* 4-byte header and two empty strings */ | |
2037 | if (size < 6) | |
2038 | return -EINVAL; | |
2039 | ||
2040 | if (get_unaligned_le32(otp) != BCM4377_OTP_VENDOR_HDR) | |
2041 | return -EINVAL; | |
2042 | ||
2043 | chip_params = &otp[idx]; | |
2044 | ||
2045 | /* Skip first string, including terminator */ | |
2046 | idx += strnlen(chip_params, size - idx) + 1; | |
2047 | if (idx >= size) | |
2048 | return -EINVAL; | |
2049 | ||
2050 | board_params = &otp[idx]; | |
2051 | ||
2052 | /* Skip to terminator of second string */ | |
2053 | idx += strnlen(board_params, size - idx); | |
2054 | if (idx >= size) | |
2055 | return -EINVAL; | |
2056 | ||
2057 | /* At this point both strings are guaranteed NUL-terminated */ | |
2058 | dev_dbg(&bcm4377->pdev->dev, | |
2059 | "OTP: chip_params='%s' board_params='%s'\n", chip_params, | |
2060 | board_params); | |
2061 | ||
2062 | ret = bcm4377_parse_otp_str(bcm4377, chip_params, | |
2063 | BCM4377_OTP_CHIP_PARAMS); | |
2064 | if (ret) | |
2065 | return ret; | |
2066 | ||
2067 | ret = bcm4377_parse_otp_str(bcm4377, board_params, | |
2068 | BCM4377_OTP_BOARD_PARAMS); | |
2069 | if (ret) | |
2070 | return ret; | |
2071 | ||
2072 | if (!bcm4377->stepping[0] || !bcm4377->vendor[0]) | |
2073 | return -EINVAL; | |
2074 | ||
2075 | dev_dbg(&bcm4377->pdev->dev, "OTP: stepping=%s, vendor=%s\n", | |
2076 | bcm4377->stepping, bcm4377->vendor); | |
2077 | return 0; | |
2078 | } | |
2079 | ||
2080 | static int bcm4377_parse_otp(struct bcm4377_data *bcm4377) | |
2081 | { | |
2082 | u8 *otp; | |
2083 | int i; | |
2084 | int ret = -ENOENT; | |
2085 | ||
2086 | otp = kzalloc(BCM4377_OTP_SIZE, GFP_KERNEL); | |
2087 | if (!otp) | |
2088 | return -ENOMEM; | |
2089 | ||
2090 | for (i = 0; i < BCM4377_OTP_SIZE; ++i) | |
2091 | otp[i] = ioread8(bcm4377->bar0 + bcm4377->hw->otp_offset + i); | |
2092 | ||
2093 | i = 0; | |
2094 | while (i < (BCM4377_OTP_SIZE - 1)) { | |
2095 | u8 type = otp[i]; | |
2096 | u8 length = otp[i + 1]; | |
2097 | ||
2098 | if (type == 0) | |
2099 | break; | |
2100 | ||
2101 | if ((i + 2 + length) > BCM4377_OTP_SIZE) | |
2102 | break; | |
2103 | ||
2104 | switch (type) { | |
2105 | case BCM4377_OTP_SYS_VENDOR: | |
2106 | dev_dbg(&bcm4377->pdev->dev, | |
2107 | "OTP @ 0x%x (%d): SYS_VENDOR", i, length); | |
2108 | ret = bcm4377_parse_otp_sys_vendor(bcm4377, &otp[i + 2], | |
2109 | length); | |
2110 | break; | |
2111 | case BCM4377_OTP_CIS: | |
2112 | dev_dbg(&bcm4377->pdev->dev, "OTP @ 0x%x (%d): CIS", i, | |
2113 | length); | |
2114 | break; | |
2115 | default: | |
2116 | dev_dbg(&bcm4377->pdev->dev, "OTP @ 0x%x (%d): unknown", | |
2117 | i, length); | |
2118 | break; | |
2119 | } | |
2120 | ||
2121 | i += 2 + length; | |
2122 | } | |
2123 | ||
2124 | kfree(otp); | |
2125 | return ret; | |
2126 | } | |
2127 | ||
2128 | static int bcm4377_init_cfg(struct bcm4377_data *bcm4377) | |
2129 | { | |
2130 | int ret; | |
2131 | u32 ctrl; | |
2132 | ||
2133 | ret = pci_write_config_dword(bcm4377->pdev, | |
2134 | BCM4377_PCIECFG_BAR0_WINDOW1, | |
2135 | bcm4377->hw->bar0_window1); | |
2136 | if (ret) | |
2137 | return ret; | |
2138 | ||
2139 | ret = pci_write_config_dword(bcm4377->pdev, | |
2140 | BCM4377_PCIECFG_BAR0_WINDOW2, | |
2141 | bcm4377->hw->bar0_window2); | |
2142 | if (ret) | |
2143 | return ret; | |
2144 | ||
2145 | ret = pci_write_config_dword( | |
2146 | bcm4377->pdev, BCM4377_PCIECFG_BAR0_CORE2_WINDOW1, | |
2147 | BCM4377_PCIECFG_BAR0_CORE2_WINDOW1_DEFAULT); | |
2148 | if (ret) | |
2149 | return ret; | |
2150 | ||
2151 | if (bcm4377->hw->has_bar0_core2_window2) { | |
2152 | ret = pci_write_config_dword(bcm4377->pdev, | |
2153 | BCM4377_PCIECFG_BAR0_CORE2_WINDOW2, | |
2154 | bcm4377->hw->bar0_core2_window2); | |
2155 | if (ret) | |
2156 | return ret; | |
2157 | } | |
2158 | ||
2159 | ret = pci_write_config_dword(bcm4377->pdev, BCM4377_PCIECFG_BAR2_WINDOW, | |
2160 | BCM4377_PCIECFG_BAR2_WINDOW_DEFAULT); | |
2161 | if (ret) | |
2162 | return ret; | |
2163 | ||
2164 | ret = pci_read_config_dword(bcm4377->pdev, | |
2165 | BCM4377_PCIECFG_SUBSYSTEM_CTRL, &ctrl); | |
2166 | if (ret) | |
2167 | return ret; | |
2168 | ||
2169 | if (bcm4377->hw->clear_pciecfg_subsystem_ctrl_bit19) | |
2170 | ctrl &= ~BIT(19); | |
2171 | ctrl |= BIT(16); | |
2172 | ||
2173 | return pci_write_config_dword(bcm4377->pdev, | |
2174 | BCM4377_PCIECFG_SUBSYSTEM_CTRL, ctrl); | |
2175 | } | |
2176 | ||
2177 | static int bcm4377_probe_dmi(struct bcm4377_data *bcm4377) | |
2178 | { | |
2179 | const struct dmi_system_id *board_type_dmi_id; | |
2180 | ||
2181 | board_type_dmi_id = dmi_first_match(bcm4377_dmi_board_table); | |
2182 | if (board_type_dmi_id && board_type_dmi_id->driver_data) { | |
2183 | bcm4377->board_type = board_type_dmi_id->driver_data; | |
2184 | dev_dbg(&bcm4377->pdev->dev, | |
2185 | "found board type via DMI match: %s\n", | |
2186 | bcm4377->board_type); | |
2187 | } | |
2188 | ||
2189 | return 0; | |
2190 | } | |
2191 | ||
2192 | static int bcm4377_probe_of(struct bcm4377_data *bcm4377) | |
2193 | { | |
2194 | struct device_node *np = bcm4377->pdev->dev.of_node; | |
2195 | int ret; | |
2196 | ||
2197 | if (!np) | |
2198 | return 0; | |
2199 | ||
2200 | ret = of_property_read_string(np, "brcm,board-type", | |
2201 | &bcm4377->board_type); | |
2202 | if (ret) { | |
2203 | dev_err(&bcm4377->pdev->dev, "no brcm,board-type property\n"); | |
2204 | return ret; | |
2205 | } | |
2206 | ||
2207 | bcm4377->taurus_beamforming_cal_blob = | |
2208 | of_get_property(np, "brcm,taurus-bf-cal-blob", | |
2209 | &bcm4377->taurus_beamforming_cal_size); | |
2210 | if (!bcm4377->taurus_beamforming_cal_blob) { | |
2211 | dev_err(&bcm4377->pdev->dev, | |
2212 | "no brcm,taurus-bf-cal-blob property\n"); | |
2213 | return -ENOENT; | |
2214 | } | |
2215 | bcm4377->taurus_cal_blob = of_get_property(np, "brcm,taurus-cal-blob", | |
2216 | &bcm4377->taurus_cal_size); | |
2217 | if (!bcm4377->taurus_cal_blob) { | |
2218 | dev_err(&bcm4377->pdev->dev, | |
2219 | "no brcm,taurus-cal-blob property\n"); | |
2220 | return -ENOENT; | |
2221 | } | |
2222 | ||
2223 | return 0; | |
2224 | } | |
2225 | ||
2226 | static void bcm4377_disable_aspm(struct bcm4377_data *bcm4377) | |
2227 | { | |
2228 | pci_disable_link_state(bcm4377->pdev, | |
2229 | PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1); | |
2230 | ||
2231 | /* | |
2232 | * pci_disable_link_state can fail if either CONFIG_PCIEASPM is disabled | |
2233 | * or if the BIOS hasn't handed over control to us. We must *always* | |
2234 | * disable ASPM for this device due to hardware errata though. | |
2235 | */ | |
2236 | pcie_capability_clear_word(bcm4377->pdev, PCI_EXP_LNKCTL, | |
2237 | PCI_EXP_LNKCTL_ASPMC); | |
2238 | } | |
2239 | ||
2240 | static void bcm4377_pci_free_irq_vectors(void *data) | |
2241 | { | |
2242 | pci_free_irq_vectors(data); | |
2243 | } | |
2244 | ||
2245 | static void bcm4377_hci_free_dev(void *data) | |
2246 | { | |
2247 | hci_free_dev(data); | |
2248 | } | |
2249 | ||
2250 | static void bcm4377_hci_unregister_dev(void *data) | |
2251 | { | |
2252 | hci_unregister_dev(data); | |
2253 | } | |
2254 | ||
2255 | static int bcm4377_probe(struct pci_dev *pdev, const struct pci_device_id *id) | |
2256 | { | |
2257 | struct bcm4377_data *bcm4377; | |
2258 | struct hci_dev *hdev; | |
2259 | int ret, irq; | |
2260 | ||
2261 | ret = dma_set_mask_and_coherent(&pdev->dev, BCM4377_DMA_MASK); | |
2262 | if (ret) | |
2263 | return ret; | |
2264 | ||
2265 | bcm4377 = devm_kzalloc(&pdev->dev, sizeof(*bcm4377), GFP_KERNEL); | |
2266 | if (!bcm4377) | |
2267 | return -ENOMEM; | |
2268 | ||
2269 | bcm4377->pdev = pdev; | |
2270 | bcm4377->hw = &bcm4377_hw_variants[id->driver_data]; | |
2271 | init_completion(&bcm4377->event); | |
2272 | ||
2273 | ret = bcm4377_prepare_rings(bcm4377); | |
2274 | if (ret) | |
2275 | return ret; | |
2276 | ||
2277 | ret = bcm4377_init_context(bcm4377); | |
2278 | if (ret) | |
2279 | return ret; | |
2280 | ||
2281 | ret = bcm4377_probe_dmi(bcm4377); | |
2282 | if (ret) | |
2283 | return ret; | |
2284 | ret = bcm4377_probe_of(bcm4377); | |
2285 | if (ret) | |
2286 | return ret; | |
2287 | if (!bcm4377->board_type) { | |
2288 | dev_err(&pdev->dev, "unable to determine board type\n"); | |
2289 | return -ENODEV; | |
2290 | } | |
2291 | ||
2292 | if (bcm4377->hw->disable_aspm) | |
2293 | bcm4377_disable_aspm(bcm4377); | |
2294 | ||
2295 | ret = pci_reset_function_locked(pdev); | |
2296 | if (ret) | |
2297 | dev_warn( | |
2298 | &pdev->dev, | |
2299 | "function level reset failed with %d; trying to continue anyway\n", | |
2300 | ret); | |
2301 | ||
2302 | /* | |
2303 | * If this number is too low and we try to access any BAR too | |
2304 | * early the device will crash. Experiments have shown that | |
2305 | * approximately 50 msec is the minimum amount we have to wait. | |
2306 | * Let's double that to be safe. | |
2307 | */ | |
2308 | msleep(100); | |
2309 | ||
b1e05cfb | 2310 | ret = pcim_enable_device(pdev); |
8a061276 SP |
2311 | if (ret) |
2312 | return ret; | |
2313 | pci_set_master(pdev); | |
2314 | ||
2315 | ret = bcm4377_init_cfg(bcm4377); | |
2316 | if (ret) | |
2317 | return ret; | |
2318 | ||
2319 | bcm4377->bar0 = pcim_iomap(pdev, 0, 0); | |
2320 | if (!bcm4377->bar0) | |
2321 | return -EBUSY; | |
2322 | bcm4377->bar2 = pcim_iomap(pdev, 2, 0); | |
2323 | if (!bcm4377->bar2) | |
2324 | return -EBUSY; | |
2325 | ||
2326 | ret = bcm4377_parse_otp(bcm4377); | |
2327 | if (ret) { | |
2328 | dev_err(&pdev->dev, "Reading OTP failed with %d\n", ret); | |
2329 | return ret; | |
2330 | } | |
2331 | ||
2332 | /* | |
2333 | * Legacy interrupts result in an IRQ storm because we don't know where | |
2334 | * the interrupt mask and status registers for these chips are. | |
2335 | * MSIs are acked automatically instead. | |
2336 | */ | |
2337 | ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI); | |
2338 | if (ret < 0) | |
2339 | return -ENODEV; | |
2340 | ret = devm_add_action_or_reset(&pdev->dev, bcm4377_pci_free_irq_vectors, | |
2341 | pdev); | |
2342 | if (ret) | |
2343 | return ret; | |
2344 | ||
2345 | irq = pci_irq_vector(pdev, 0); | |
2346 | if (irq <= 0) | |
2347 | return -ENODEV; | |
2348 | ||
2349 | ret = devm_request_irq(&pdev->dev, irq, bcm4377_irq, 0, "bcm4377", | |
2350 | bcm4377); | |
2351 | if (ret) | |
2352 | return ret; | |
2353 | ||
2354 | hdev = hci_alloc_dev(); | |
2355 | if (!hdev) | |
2356 | return -ENOMEM; | |
2357 | ret = devm_add_action_or_reset(&pdev->dev, bcm4377_hci_free_dev, hdev); | |
2358 | if (ret) | |
2359 | return ret; | |
2360 | ||
2361 | bcm4377->hdev = hdev; | |
2362 | ||
2363 | hdev->bus = HCI_PCI; | |
2364 | hdev->dev_type = HCI_PRIMARY; | |
2365 | hdev->open = bcm4377_hci_open; | |
2366 | hdev->close = bcm4377_hci_close; | |
2367 | hdev->send = bcm4377_hci_send_frame; | |
2368 | hdev->set_bdaddr = bcm4377_hci_set_bdaddr; | |
2369 | hdev->setup = bcm4377_hci_setup; | |
2370 | ||
8a061276 SP |
2371 | if (bcm4377->hw->broken_mws_transport_config) |
2372 | set_bit(HCI_QUIRK_BROKEN_MWS_TRANSPORT_CONFIG, &hdev->quirks); | |
2373 | if (bcm4377->hw->broken_ext_scan) | |
2374 | set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks); | |
41e9cdea JG |
2375 | if (bcm4377->hw->broken_le_coded) |
2376 | set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); | |
8a061276 SP |
2377 | |
2378 | pci_set_drvdata(pdev, bcm4377); | |
2379 | hci_set_drvdata(hdev, bcm4377); | |
2380 | SET_HCIDEV_DEV(hdev, &pdev->dev); | |
2381 | ||
2382 | ret = bcm4377_boot(bcm4377); | |
2383 | if (ret) | |
2384 | return ret; | |
2385 | ||
2386 | ret = bcm4377_setup_rti(bcm4377); | |
2387 | if (ret) | |
2388 | return ret; | |
2389 | ||
2390 | ret = hci_register_dev(hdev); | |
2391 | if (ret) | |
2392 | return ret; | |
2393 | return devm_add_action_or_reset(&pdev->dev, bcm4377_hci_unregister_dev, | |
2394 | hdev); | |
2395 | } | |
2396 | ||
2397 | static int bcm4377_suspend(struct pci_dev *pdev, pm_message_t state) | |
2398 | { | |
2399 | struct bcm4377_data *bcm4377 = pci_get_drvdata(pdev); | |
2400 | int ret; | |
2401 | ||
2402 | ret = hci_suspend_dev(bcm4377->hdev); | |
2403 | if (ret) | |
2404 | return ret; | |
2405 | ||
2406 | iowrite32(BCM4377_BAR0_SLEEP_CONTROL_QUIESCE, | |
2407 | bcm4377->bar0 + BCM4377_BAR0_SLEEP_CONTROL); | |
2408 | ||
2409 | return 0; | |
2410 | } | |
2411 | ||
2412 | static int bcm4377_resume(struct pci_dev *pdev) | |
2413 | { | |
2414 | struct bcm4377_data *bcm4377 = pci_get_drvdata(pdev); | |
2415 | ||
2416 | iowrite32(BCM4377_BAR0_SLEEP_CONTROL_UNQUIESCE, | |
2417 | bcm4377->bar0 + BCM4377_BAR0_SLEEP_CONTROL); | |
2418 | ||
2419 | return hci_resume_dev(bcm4377->hdev); | |
2420 | } | |
2421 | ||
2422 | static const struct dmi_system_id bcm4377_dmi_board_table[] = { | |
2423 | { | |
2424 | .matches = { | |
2425 | DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."), | |
2426 | DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir9,1"), | |
2427 | }, | |
2428 | .driver_data = "apple,formosa", | |
2429 | }, | |
2430 | { | |
2431 | .matches = { | |
2432 | DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."), | |
2433 | DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro15,4"), | |
2434 | }, | |
2435 | .driver_data = "apple,formosa", | |
2436 | }, | |
2437 | { | |
2438 | .matches = { | |
2439 | DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."), | |
2440 | DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,3"), | |
2441 | }, | |
2442 | .driver_data = "apple,formosa", | |
2443 | }, | |
2444 | {} | |
2445 | }; | |
2446 | ||
2447 | static const struct bcm4377_hw bcm4377_hw_variants[] = { | |
2448 | [BCM4377] = { | |
2449 | .id = 0x4377, | |
2450 | .otp_offset = 0x4120, | |
2451 | .bar0_window1 = 0x1800b000, | |
2452 | .bar0_window2 = 0x1810c000, | |
2453 | .disable_aspm = true, | |
2454 | .broken_ext_scan = true, | |
2455 | .send_ptb = bcm4377_send_ptb, | |
2456 | }, | |
2457 | ||
2458 | [BCM4378] = { | |
2459 | .id = 0x4378, | |
2460 | .otp_offset = 0x4120, | |
2461 | .bar0_window1 = 0x18002000, | |
2462 | .bar0_window2 = 0x1810a000, | |
2463 | .bar0_core2_window2 = 0x18107000, | |
2464 | .has_bar0_core2_window2 = true, | |
2465 | .broken_mws_transport_config = true, | |
41e9cdea | 2466 | .broken_le_coded = true, |
8a061276 SP |
2467 | .send_calibration = bcm4378_send_calibration, |
2468 | .send_ptb = bcm4378_send_ptb, | |
2469 | }, | |
2470 | ||
2471 | [BCM4387] = { | |
2472 | .id = 0x4387, | |
2473 | .otp_offset = 0x413c, | |
2474 | .bar0_window1 = 0x18002000, | |
2475 | .bar0_window2 = 0x18109000, | |
2476 | .bar0_core2_window2 = 0x18106000, | |
2477 | .has_bar0_core2_window2 = true, | |
2478 | .clear_pciecfg_subsystem_ctrl_bit19 = true, | |
2479 | .broken_mws_transport_config = true, | |
41e9cdea | 2480 | .broken_le_coded = true, |
8a061276 SP |
2481 | .send_calibration = bcm4387_send_calibration, |
2482 | .send_ptb = bcm4378_send_ptb, | |
2483 | }, | |
2484 | }; | |
2485 | ||
2486 | #define BCM4377_DEVID_ENTRY(id) \ | |
2487 | { \ | |
2488 | PCI_VENDOR_ID_BROADCOM, BCM##id##_DEVICE_ID, PCI_ANY_ID, \ | |
2489 | PCI_ANY_ID, PCI_CLASS_NETWORK_OTHER << 8, 0xffff00, \ | |
2490 | BCM##id \ | |
2491 | } | |
2492 | ||
2493 | static const struct pci_device_id bcm4377_devid_table[] = { | |
2494 | BCM4377_DEVID_ENTRY(4377), | |
2495 | BCM4377_DEVID_ENTRY(4378), | |
2496 | BCM4377_DEVID_ENTRY(4387), | |
2497 | {}, | |
2498 | }; | |
2499 | MODULE_DEVICE_TABLE(pci, bcm4377_devid_table); | |
2500 | ||
2501 | static struct pci_driver bcm4377_pci_driver = { | |
2502 | .name = "hci_bcm4377", | |
2503 | .id_table = bcm4377_devid_table, | |
2504 | .probe = bcm4377_probe, | |
2505 | .suspend = bcm4377_suspend, | |
2506 | .resume = bcm4377_resume, | |
2507 | }; | |
2508 | module_pci_driver(bcm4377_pci_driver); | |
2509 | ||
2510 | MODULE_AUTHOR("Sven Peter <sven@svenpeter.dev>"); | |
2511 | MODULE_DESCRIPTION("Bluetooth support for Broadcom 4377/4378/4387 devices"); | |
2512 | MODULE_LICENSE("Dual MIT/GPL"); | |
2513 | MODULE_FIRMWARE("brcm/brcmbt4377*.bin"); | |
2514 | MODULE_FIRMWARE("brcm/brcmbt4377*.ptb"); | |
2515 | MODULE_FIRMWARE("brcm/brcmbt4378*.bin"); | |
2516 | MODULE_FIRMWARE("brcm/brcmbt4378*.ptb"); | |
2517 | MODULE_FIRMWARE("brcm/brcmbt4387*.bin"); | |
2518 | MODULE_FIRMWARE("brcm/brcmbt4387*.ptb"); |