1 // SPDX-License-Identifier: GPL-2.0-or-later
7 #include <linux/module.h>
8 #include <linux/kernel.h>
10 #include <linux/serdev.h>
12 #include <linux/skbuff.h>
13 #include <asm/unaligned.h>
14 #include <linux/firmware.h>
15 #include <linux/string.h>
16 #include <linux/crc8.h>
17 #include <linux/crc32.h>
18 #include <linux/string_helpers.h>
20 #include <net/bluetooth/bluetooth.h>
21 #include <net/bluetooth/hci_core.h>
25 #define MANUFACTURER_NXP 37
27 #define BTNXPUART_TX_STATE_ACTIVE 1
28 #define BTNXPUART_FW_DOWNLOADING 2
29 #define BTNXPUART_CHECK_BOOT_SIGNATURE 3
30 #define BTNXPUART_SERDEV_OPEN 4
32 #define FIRMWARE_W8987 "nxp/uartuart8987_bt.bin"
33 #define FIRMWARE_W8997 "nxp/uartuart8997_bt_v4.bin"
34 #define FIRMWARE_W9098 "nxp/uartuart9098_bt_v1.bin"
35 #define FIRMWARE_IW416 "nxp/uartiw416_bt_v0.bin"
36 #define FIRMWARE_IW612 "nxp/uartspi_n61x_v1.bin.se"
37 #define FIRMWARE_HELPER "nxp/helper_uart_3000000.bin"
39 #define CHIP_ID_W9098 0x5c03
40 #define CHIP_ID_IW416 0x7201
41 #define CHIP_ID_IW612 0x7601
43 #define HCI_NXP_PRI_BAUDRATE 115200
44 #define HCI_NXP_SEC_BAUDRATE 3000000
46 #define MAX_FW_FILE_NAME_LEN 50
48 /* Default ps timeout period in milliseconds */
49 #define PS_DEFAULT_TIMEOUT_PERIOD_MS 2000
52 #define WAKEUP_METHOD_DTR 0
53 #define WAKEUP_METHOD_BREAK 1
54 #define WAKEUP_METHOD_EXT_BREAK 2
55 #define WAKEUP_METHOD_RTS 3
56 #define WAKEUP_METHOD_INVALID 0xff
58 /* power save mode status */
59 #define PS_MODE_DISABLE 0
60 #define PS_MODE_ENABLE 1
62 /* Power Save Commands to ps_work_func */
63 #define PS_CMD_EXIT_PS 1
64 #define PS_CMD_ENTER_PS 2
66 /* power save state */
67 #define PS_STATE_AWAKE 0
68 #define PS_STATE_SLEEP 1
70 /* Bluetooth vendor command : Sleep mode */
71 #define HCI_NXP_AUTO_SLEEP_MODE 0xfc23
72 /* Bluetooth vendor command : Wakeup method */
73 #define HCI_NXP_WAKEUP_METHOD 0xfc53
74 /* Bluetooth vendor command : Set operational baudrate */
75 #define HCI_NXP_SET_OPER_SPEED 0xfc09
76 /* Bluetooth vendor command: Independent Reset */
77 #define HCI_NXP_IND_RESET 0xfcfc
79 /* Bluetooth Power State : Vendor cmd params */
80 #define BT_PS_ENABLE 0x02
81 #define BT_PS_DISABLE 0x03
83 /* Bluetooth Host Wakeup Methods */
84 #define BT_HOST_WAKEUP_METHOD_NONE 0x00
85 #define BT_HOST_WAKEUP_METHOD_DTR 0x01
86 #define BT_HOST_WAKEUP_METHOD_BREAK 0x02
87 #define BT_HOST_WAKEUP_METHOD_GPIO 0x03
89 /* Bluetooth Chip Wakeup Methods */
90 #define BT_CTRL_WAKEUP_METHOD_DSR 0x00
91 #define BT_CTRL_WAKEUP_METHOD_BREAK 0x01
92 #define BT_CTRL_WAKEUP_METHOD_GPIO 0x02
93 #define BT_CTRL_WAKEUP_METHOD_EXT_BREAK 0x04
94 #define BT_CTRL_WAKEUP_METHOD_RTS 0x05
97 u8 target_ps_mode; /* ps mode to be set */
98 u8 cur_psmode; /* current ps_mode */
99 u8 ps_state; /* controller's power save state */
102 u8 cur_h2c_wakeupmode;
106 bool driver_sent_cmd;
109 struct hci_dev *hdev;
110 struct work_struct work;
111 struct timer_list ps_timer;
114 struct wakeup_cmd_payload {
121 struct psmode_cmd_payload {
123 __le16 c2h_ps_interval;
126 struct btnxpuart_data {
127 const char *helper_fw_name;
131 struct btnxpuart_dev {
132 struct hci_dev *hdev;
133 struct serdev_device *serdev;
135 struct work_struct tx_work;
136 unsigned long tx_state;
137 struct sk_buff_head txq;
138 struct sk_buff *rx_skb;
140 const struct firmware *fw;
141 u8 fw_name[MAX_FW_FILE_NAME_LEN];
142 u32 fw_dnld_v1_offset;
143 u32 fw_v1_sent_bytes;
144 u32 fw_v3_offset_correction;
145 u32 fw_v1_expected_len;
146 wait_queue_head_t fw_dnld_done_wait_q;
147 wait_queue_head_t check_boot_sign_wait_q;
150 u32 current_baudrate;
151 u32 fw_init_baudrate;
152 bool timeout_changed;
153 bool baudrate_changed;
154 bool helper_downloaded;
156 struct ps_data psdata;
157 struct btnxpuart_data *nxp_data;
160 #define NXP_V1_FW_REQ_PKT 0xa5
161 #define NXP_V1_CHIP_VER_PKT 0xaa
162 #define NXP_V3_FW_REQ_PKT 0xa7
163 #define NXP_V3_CHIP_VER_PKT 0xab
165 #define NXP_ACK_V1 0x5a
166 #define NXP_NAK_V1 0xbf
167 #define NXP_ACK_V3 0x7a
168 #define NXP_NAK_V3 0x7b
169 #define NXP_CRC_ERROR_V3 0x7c
173 #define NXP_RECV_CHIP_VER_V1 \
174 .type = NXP_V1_CHIP_VER_PKT, \
180 #define NXP_RECV_FW_REQ_V1 \
181 .type = NXP_V1_FW_REQ_PKT, \
187 #define NXP_RECV_CHIP_VER_V3 \
188 .type = NXP_V3_CHIP_VER_PKT, \
194 #define NXP_RECV_FW_REQ_V3 \
195 .type = NXP_V3_FW_REQ_PKT, \
206 struct v1_start_ind {
218 struct v3_start_ind {
224 /* UART register addresses of BT chip */
225 #define CLKDIVADDR 0x7f00008f
226 #define UARTDIVADDR 0x7f000090
227 #define UARTMCRADDR 0x7f000091
228 #define UARTREINITADDR 0x7f000092
229 #define UARTICRADDR 0x7f000093
230 #define UARTFCRADDR 0x7f000094
232 #define MCR 0x00000022
233 #define INIT 0x00000001
234 #define ICR 0x000000c7
235 #define FCR 0x000000c7
237 #define POLYNOMIAL8 0x07
245 struct uart_reg clkdiv;
246 struct uart_reg uartdiv;
248 struct uart_reg re_init;
254 struct nxp_bootloader_cmd {
261 static u8 crc8_table[CRC8_TABLE_SIZE];
263 /* Default configurations */
264 #define DEFAULT_H2C_WAKEUP_MODE WAKEUP_METHOD_BREAK
265 #define DEFAULT_PS_MODE PS_MODE_DISABLE
266 #define FW_INIT_BAUDRATE HCI_NXP_PRI_BAUDRATE
268 static struct sk_buff *nxp_drv_send_cmd(struct hci_dev *hdev, u16 opcode,
272 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
273 struct ps_data *psdata = &nxpdev->psdata;
276 /* set flag to prevent nxp_enqueue from parsing values from this command and
277 * calling hci_cmd_sync_queue() again.
279 psdata->driver_sent_cmd = true;
280 skb = __hci_cmd_sync(hdev, opcode, plen, param, HCI_CMD_TIMEOUT);
281 psdata->driver_sent_cmd = false;
286 static void btnxpuart_tx_wakeup(struct btnxpuart_dev *nxpdev)
288 if (schedule_work(&nxpdev->tx_work))
289 set_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
292 /* NXP Power Save Feature */
293 static void ps_start_timer(struct btnxpuart_dev *nxpdev)
295 struct ps_data *psdata = &nxpdev->psdata;
300 if (psdata->cur_psmode == PS_MODE_ENABLE)
301 mod_timer(&psdata->ps_timer, jiffies + msecs_to_jiffies(psdata->h2c_ps_interval));
304 static void ps_cancel_timer(struct btnxpuart_dev *nxpdev)
306 struct ps_data *psdata = &nxpdev->psdata;
308 flush_work(&psdata->work);
309 del_timer_sync(&psdata->ps_timer);
312 static void ps_control(struct hci_dev *hdev, u8 ps_state)
314 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
315 struct ps_data *psdata = &nxpdev->psdata;
318 if (psdata->ps_state == ps_state ||
319 !test_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state))
322 switch (psdata->cur_h2c_wakeupmode) {
323 case WAKEUP_METHOD_DTR:
324 if (ps_state == PS_STATE_AWAKE)
325 status = serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
327 status = serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
329 case WAKEUP_METHOD_BREAK:
331 if (ps_state == PS_STATE_AWAKE)
332 status = serdev_device_break_ctl(nxpdev->serdev, 0);
334 status = serdev_device_break_ctl(nxpdev->serdev, -1);
335 bt_dev_dbg(hdev, "Set UART break: %s, status=%d",
336 str_on_off(ps_state == PS_STATE_SLEEP), status);
340 psdata->ps_state = ps_state;
341 if (ps_state == PS_STATE_AWAKE)
342 btnxpuart_tx_wakeup(nxpdev);
345 static void ps_work_func(struct work_struct *work)
347 struct ps_data *data = container_of(work, struct ps_data, work);
349 if (data->ps_cmd == PS_CMD_ENTER_PS && data->cur_psmode == PS_MODE_ENABLE)
350 ps_control(data->hdev, PS_STATE_SLEEP);
351 else if (data->ps_cmd == PS_CMD_EXIT_PS)
352 ps_control(data->hdev, PS_STATE_AWAKE);
355 static void ps_timeout_func(struct timer_list *t)
357 struct ps_data *data = from_timer(data, t, ps_timer);
358 struct hci_dev *hdev = data->hdev;
359 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
361 if (test_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state)) {
362 ps_start_timer(nxpdev);
364 data->ps_cmd = PS_CMD_ENTER_PS;
365 schedule_work(&data->work);
369 static int ps_init_work(struct hci_dev *hdev)
371 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
372 struct ps_data *psdata = &nxpdev->psdata;
374 psdata->h2c_ps_interval = PS_DEFAULT_TIMEOUT_PERIOD_MS;
375 psdata->ps_state = PS_STATE_AWAKE;
376 psdata->target_ps_mode = DEFAULT_PS_MODE;
378 psdata->c2h_wakeupmode = BT_HOST_WAKEUP_METHOD_NONE;
379 psdata->c2h_wakeup_gpio = 0xff;
381 switch (DEFAULT_H2C_WAKEUP_MODE) {
382 case WAKEUP_METHOD_DTR:
383 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
385 case WAKEUP_METHOD_BREAK:
387 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
390 psdata->cur_psmode = PS_MODE_DISABLE;
391 psdata->cur_h2c_wakeupmode = WAKEUP_METHOD_INVALID;
392 INIT_WORK(&psdata->work, ps_work_func);
397 static void ps_init_timer(struct hci_dev *hdev)
399 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
400 struct ps_data *psdata = &nxpdev->psdata;
402 timer_setup(&psdata->ps_timer, ps_timeout_func, 0);
405 static void ps_wakeup(struct btnxpuart_dev *nxpdev)
407 struct ps_data *psdata = &nxpdev->psdata;
409 if (psdata->ps_state != PS_STATE_AWAKE) {
410 psdata->ps_cmd = PS_CMD_EXIT_PS;
411 schedule_work(&psdata->work);
415 static int send_ps_cmd(struct hci_dev *hdev, void *data)
417 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
418 struct ps_data *psdata = &nxpdev->psdata;
419 struct psmode_cmd_payload pcmd;
423 if (psdata->target_ps_mode == PS_MODE_ENABLE)
424 pcmd.ps_cmd = BT_PS_ENABLE;
426 pcmd.ps_cmd = BT_PS_DISABLE;
427 pcmd.c2h_ps_interval = __cpu_to_le16(psdata->c2h_ps_interval);
429 skb = nxp_drv_send_cmd(hdev, HCI_NXP_AUTO_SLEEP_MODE, sizeof(pcmd), &pcmd);
431 bt_dev_err(hdev, "Setting Power Save mode failed (%ld)", PTR_ERR(skb));
435 status = skb_pull_data(skb, 1);
438 psdata->cur_psmode = psdata->target_ps_mode;
440 psdata->target_ps_mode = psdata->cur_psmode;
441 if (psdata->cur_psmode == PS_MODE_ENABLE)
442 ps_start_timer(nxpdev);
445 bt_dev_dbg(hdev, "Power Save mode response: status=%d, ps_mode=%d",
446 *status, psdata->cur_psmode);
453 static int send_wakeup_method_cmd(struct hci_dev *hdev, void *data)
455 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
456 struct ps_data *psdata = &nxpdev->psdata;
457 struct wakeup_cmd_payload pcmd;
461 pcmd.c2h_wakeupmode = psdata->c2h_wakeupmode;
462 pcmd.c2h_wakeup_gpio = psdata->c2h_wakeup_gpio;
463 switch (psdata->h2c_wakeupmode) {
464 case WAKEUP_METHOD_DTR:
465 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_DSR;
467 case WAKEUP_METHOD_BREAK:
469 pcmd.h2c_wakeupmode = BT_CTRL_WAKEUP_METHOD_BREAK;
472 pcmd.h2c_wakeup_gpio = 0xff;
474 skb = nxp_drv_send_cmd(hdev, HCI_NXP_WAKEUP_METHOD, sizeof(pcmd), &pcmd);
476 bt_dev_err(hdev, "Setting wake-up method failed (%ld)", PTR_ERR(skb));
480 status = skb_pull_data(skb, 1);
483 psdata->cur_h2c_wakeupmode = psdata->h2c_wakeupmode;
485 psdata->h2c_wakeupmode = psdata->cur_h2c_wakeupmode;
486 bt_dev_dbg(hdev, "Set Wakeup Method response: status=%d, h2c_wakeupmode=%d",
487 *status, psdata->cur_h2c_wakeupmode);
494 static void ps_init(struct hci_dev *hdev)
496 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
497 struct ps_data *psdata = &nxpdev->psdata;
499 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_RTS);
500 usleep_range(5000, 10000);
501 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_RTS, 0);
502 usleep_range(5000, 10000);
504 switch (psdata->h2c_wakeupmode) {
505 case WAKEUP_METHOD_DTR:
506 serdev_device_set_tiocm(nxpdev->serdev, 0, TIOCM_DTR);
507 serdev_device_set_tiocm(nxpdev->serdev, TIOCM_DTR, 0);
509 case WAKEUP_METHOD_BREAK:
511 serdev_device_break_ctl(nxpdev->serdev, -1);
512 usleep_range(5000, 10000);
513 serdev_device_break_ctl(nxpdev->serdev, 0);
514 usleep_range(5000, 10000);
517 if (psdata->cur_h2c_wakeupmode != psdata->h2c_wakeupmode)
518 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
519 if (psdata->cur_psmode != psdata->target_ps_mode)
520 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
523 /* NXP Firmware Download Feature */
524 static int nxp_download_firmware(struct hci_dev *hdev)
526 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
529 nxpdev->fw_dnld_v1_offset = 0;
530 nxpdev->fw_v1_sent_bytes = 0;
531 nxpdev->fw_v1_expected_len = HDR_LEN;
532 nxpdev->fw_v3_offset_correction = 0;
533 nxpdev->baudrate_changed = false;
534 nxpdev->timeout_changed = false;
535 nxpdev->helper_downloaded = false;
537 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
538 serdev_device_set_flow_control(nxpdev->serdev, false);
539 nxpdev->current_baudrate = HCI_NXP_PRI_BAUDRATE;
541 /* Wait till FW is downloaded and CTS becomes low */
542 err = wait_event_interruptible_timeout(nxpdev->fw_dnld_done_wait_q,
543 !test_bit(BTNXPUART_FW_DOWNLOADING,
545 msecs_to_jiffies(60000));
547 bt_dev_err(hdev, "FW Download Timeout.");
551 serdev_device_set_flow_control(nxpdev->serdev, true);
552 err = serdev_device_wait_for_cts(nxpdev->serdev, 1, 60000);
554 bt_dev_err(hdev, "CTS is still high. FW Download failed.");
557 release_firmware(nxpdev->fw);
558 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
560 /* Allow the downloaded FW to initialize */
561 usleep_range(800 * USEC_PER_MSEC, 1 * USEC_PER_SEC);
566 static void nxp_send_ack(u8 ack, struct hci_dev *hdev)
568 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
573 if (ack == NXP_ACK_V3) {
574 ack_nak[1] = crc8(crc8_table, ack_nak, 1, 0xff);
577 serdev_device_write_buf(nxpdev->serdev, ack_nak, len);
580 static bool nxp_fw_change_baudrate(struct hci_dev *hdev, u16 req_len)
582 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
583 struct nxp_bootloader_cmd nxp_cmd5;
584 struct uart_config uart_config;
586 if (req_len == sizeof(nxp_cmd5)) {
587 nxp_cmd5.header = __cpu_to_le32(5);
589 nxp_cmd5.payload_len = __cpu_to_le32(sizeof(uart_config));
590 /* FW expects swapped CRC bytes */
591 nxp_cmd5.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd5,
592 sizeof(nxp_cmd5) - 4));
594 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd5, sizeof(nxp_cmd5));
595 nxpdev->fw_v3_offset_correction += req_len;
596 } else if (req_len == sizeof(uart_config)) {
597 uart_config.clkdiv.address = __cpu_to_le32(CLKDIVADDR);
598 uart_config.clkdiv.value = __cpu_to_le32(0x00c00000);
599 uart_config.uartdiv.address = __cpu_to_le32(UARTDIVADDR);
600 uart_config.uartdiv.value = __cpu_to_le32(1);
601 uart_config.mcr.address = __cpu_to_le32(UARTMCRADDR);
602 uart_config.mcr.value = __cpu_to_le32(MCR);
603 uart_config.re_init.address = __cpu_to_le32(UARTREINITADDR);
604 uart_config.re_init.value = __cpu_to_le32(INIT);
605 uart_config.icr.address = __cpu_to_le32(UARTICRADDR);
606 uart_config.icr.value = __cpu_to_le32(ICR);
607 uart_config.fcr.address = __cpu_to_le32(UARTFCRADDR);
608 uart_config.fcr.value = __cpu_to_le32(FCR);
609 /* FW expects swapped CRC bytes */
610 uart_config.crc = __cpu_to_be32(crc32_be(0UL, (char *)&uart_config,
611 sizeof(uart_config) - 4));
613 serdev_device_write_buf(nxpdev->serdev, (u8 *)&uart_config, sizeof(uart_config));
614 serdev_device_wait_until_sent(nxpdev->serdev, 0);
615 nxpdev->fw_v3_offset_correction += req_len;
621 static bool nxp_fw_change_timeout(struct hci_dev *hdev, u16 req_len)
623 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
624 struct nxp_bootloader_cmd nxp_cmd7;
626 if (req_len != sizeof(nxp_cmd7))
629 nxp_cmd7.header = __cpu_to_le32(7);
630 nxp_cmd7.arg = __cpu_to_le32(0x70);
631 nxp_cmd7.payload_len = 0;
632 /* FW expects swapped CRC bytes */
633 nxp_cmd7.crc = __cpu_to_be32(crc32_be(0UL, (char *)&nxp_cmd7,
634 sizeof(nxp_cmd7) - 4));
635 serdev_device_write_buf(nxpdev->serdev, (u8 *)&nxp_cmd7, sizeof(nxp_cmd7));
636 serdev_device_wait_until_sent(nxpdev->serdev, 0);
637 nxpdev->fw_v3_offset_correction += req_len;
641 static u32 nxp_get_data_len(const u8 *buf)
643 struct nxp_bootloader_cmd *hdr = (struct nxp_bootloader_cmd *)buf;
645 return __le32_to_cpu(hdr->payload_len);
648 static bool is_fw_downloading(struct btnxpuart_dev *nxpdev)
650 return test_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
653 static bool process_boot_signature(struct btnxpuart_dev *nxpdev)
655 if (test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state)) {
656 clear_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
657 wake_up_interruptible(&nxpdev->check_boot_sign_wait_q);
660 return is_fw_downloading(nxpdev);
663 static int nxp_request_firmware(struct hci_dev *hdev, const char *fw_name)
665 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
668 if (!strlen(nxpdev->fw_name)) {
669 snprintf(nxpdev->fw_name, MAX_FW_FILE_NAME_LEN, "%s", fw_name);
671 bt_dev_dbg(hdev, "Request Firmware: %s", nxpdev->fw_name);
672 err = request_firmware(&nxpdev->fw, nxpdev->fw_name, &hdev->dev);
674 bt_dev_err(hdev, "Firmware file %s not found", nxpdev->fw_name);
675 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
681 /* for legacy chipsets with V1 bootloader */
682 static int nxp_recv_chip_ver_v1(struct hci_dev *hdev, struct sk_buff *skb)
684 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
685 struct v1_start_ind *req;
688 req = skb_pull_data(skb, sizeof(*req));
692 chip_id = le16_to_cpu(req->chip_id ^ req->chip_id_comp);
693 if (chip_id == 0xffff) {
694 nxpdev->fw_dnld_v1_offset = 0;
695 nxpdev->fw_v1_sent_bytes = 0;
696 nxpdev->fw_v1_expected_len = HDR_LEN;
697 release_firmware(nxpdev->fw);
698 memset(nxpdev->fw_name, 0, sizeof(nxpdev->fw_name));
699 nxp_send_ack(NXP_ACK_V1, hdev);
707 static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
709 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
710 struct btnxpuart_data *nxp_data = nxpdev->nxp_data;
711 struct v1_data_req *req;
714 if (!process_boot_signature(nxpdev))
717 req = skb_pull_data(skb, sizeof(*req));
721 len = __le16_to_cpu(req->len ^ req->len_comp);
723 bt_dev_dbg(hdev, "ERR: Send NAK");
724 nxp_send_ack(NXP_NAK_V1, hdev);
727 nxp_send_ack(NXP_ACK_V1, hdev);
729 len = __le16_to_cpu(req->len);
731 if (!nxp_data->helper_fw_name) {
732 if (!nxpdev->timeout_changed) {
733 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev,
737 if (!nxpdev->baudrate_changed) {
738 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev,
740 if (nxpdev->baudrate_changed) {
741 serdev_device_set_baudrate(nxpdev->serdev,
742 HCI_NXP_SEC_BAUDRATE);
743 serdev_device_set_flow_control(nxpdev->serdev, true);
744 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
750 if (!nxp_data->helper_fw_name || nxpdev->helper_downloaded) {
751 if (nxp_request_firmware(hdev, nxp_data->fw_name))
753 } else if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
754 if (nxp_request_firmware(hdev, nxp_data->helper_fw_name))
759 bt_dev_dbg(hdev, "FW Downloaded Successfully: %zu bytes",
761 if (nxp_data->helper_fw_name && !nxpdev->helper_downloaded) {
762 nxpdev->helper_downloaded = true;
763 serdev_device_wait_until_sent(nxpdev->serdev, 0);
764 serdev_device_set_baudrate(nxpdev->serdev,
765 HCI_NXP_SEC_BAUDRATE);
766 serdev_device_set_flow_control(nxpdev->serdev, true);
768 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
769 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
774 /* The CRC did not match at the other end.
775 * Simply send the same bytes again.
777 len = nxpdev->fw_v1_sent_bytes;
778 bt_dev_dbg(hdev, "CRC error. Resend %d bytes of FW.", len);
780 nxpdev->fw_dnld_v1_offset += nxpdev->fw_v1_sent_bytes;
782 /* The FW bin file is made up of many blocks of
783 * 16 byte header and payload data chunks. If the
784 * FW has requested a header, read the payload length
785 * info from the header, before sending the header.
786 * In the next iteration, the FW should request the
787 * payload data chunk, which should be equal to the
788 * payload length read from header. If there is a
789 * mismatch, clearly the driver and FW are out of sync,
790 * and we need to re-send the previous header again.
792 if (len == nxpdev->fw_v1_expected_len) {
794 nxpdev->fw_v1_expected_len = nxp_get_data_len(nxpdev->fw->data +
795 nxpdev->fw_dnld_v1_offset);
797 nxpdev->fw_v1_expected_len = HDR_LEN;
798 } else if (len == HDR_LEN) {
799 /* FW download out of sync. Send previous chunk again */
800 nxpdev->fw_dnld_v1_offset -= nxpdev->fw_v1_sent_bytes;
801 nxpdev->fw_v1_expected_len = HDR_LEN;
805 if (nxpdev->fw_dnld_v1_offset + len <= nxpdev->fw->size)
806 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data +
807 nxpdev->fw_dnld_v1_offset, len);
808 nxpdev->fw_v1_sent_bytes = len;
815 static char *nxp_get_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid)
817 char *fw_name = NULL;
821 fw_name = FIRMWARE_W9098;
824 fw_name = FIRMWARE_IW416;
827 fw_name = FIRMWARE_IW612;
830 bt_dev_err(hdev, "Unknown chip signature %04x", chipid);
836 static int nxp_recv_chip_ver_v3(struct hci_dev *hdev, struct sk_buff *skb)
838 struct v3_start_ind *req = skb_pull_data(skb, sizeof(*req));
839 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
842 if (!process_boot_signature(nxpdev))
845 chip_id = le16_to_cpu(req->chip_id);
846 if (!nxp_request_firmware(hdev, nxp_get_fw_name_from_chipid(hdev,
848 nxp_send_ack(NXP_ACK_V3, hdev);
855 static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
857 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
858 struct v3_data_req *req;
862 if (!process_boot_signature(nxpdev))
865 req = skb_pull_data(skb, sizeof(*req));
866 if (!req || !nxpdev->fw)
869 nxp_send_ack(NXP_ACK_V3, hdev);
871 len = __le16_to_cpu(req->len);
873 if (!nxpdev->timeout_changed) {
874 nxpdev->timeout_changed = nxp_fw_change_timeout(hdev, len);
878 if (!nxpdev->baudrate_changed) {
879 nxpdev->baudrate_changed = nxp_fw_change_baudrate(hdev, len);
880 if (nxpdev->baudrate_changed) {
881 serdev_device_set_baudrate(nxpdev->serdev,
882 HCI_NXP_SEC_BAUDRATE);
883 serdev_device_set_flow_control(nxpdev->serdev, true);
884 nxpdev->current_baudrate = HCI_NXP_SEC_BAUDRATE;
890 bt_dev_dbg(hdev, "FW Downloaded Successfully: %zu bytes",
892 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
893 wake_up_interruptible(&nxpdev->fw_dnld_done_wait_q);
897 bt_dev_dbg(hdev, "FW Download received err 0x%02x from chip",
900 offset = __le32_to_cpu(req->offset);
901 if (offset < nxpdev->fw_v3_offset_correction) {
902 /* This scenario should ideally never occur. But if it ever does,
903 * FW is out of sync and needs a power cycle.
905 bt_dev_err(hdev, "Something went wrong during FW download");
906 bt_dev_err(hdev, "Please power cycle and try again");
910 serdev_device_write_buf(nxpdev->serdev, nxpdev->fw->data + offset -
911 nxpdev->fw_v3_offset_correction, len);
918 static int nxp_set_baudrate_cmd(struct hci_dev *hdev, void *data)
920 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
921 __le32 new_baudrate = __cpu_to_le32(nxpdev->new_baudrate);
922 struct ps_data *psdata = &nxpdev->psdata;
929 skb = nxp_drv_send_cmd(hdev, HCI_NXP_SET_OPER_SPEED, 4, (u8 *)&new_baudrate);
931 bt_dev_err(hdev, "Setting baudrate failed (%ld)", PTR_ERR(skb));
935 status = (u8 *)skb_pull_data(skb, 1);
938 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->new_baudrate);
939 nxpdev->current_baudrate = nxpdev->new_baudrate;
941 bt_dev_dbg(hdev, "Set baudrate response: status=%d, baudrate=%d",
942 *status, nxpdev->new_baudrate);
949 static int nxp_set_ind_reset(struct hci_dev *hdev, void *data)
951 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
957 skb = nxp_drv_send_cmd(hdev, HCI_NXP_IND_RESET, 1, &pcmd);
961 status = skb_pull_data(skb, 1);
962 if (!status || *status)
965 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
966 err = nxp_download_firmware(hdev);
969 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->fw_init_baudrate);
970 nxpdev->current_baudrate = nxpdev->fw_init_baudrate;
971 if (nxpdev->current_baudrate != HCI_NXP_SEC_BAUDRATE) {
972 nxpdev->new_baudrate = HCI_NXP_SEC_BAUDRATE;
973 nxp_set_baudrate_cmd(hdev, NULL);
975 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
976 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
984 static int nxp_check_boot_sign(struct btnxpuart_dev *nxpdev)
986 serdev_device_set_baudrate(nxpdev->serdev, HCI_NXP_PRI_BAUDRATE);
987 serdev_device_set_flow_control(nxpdev->serdev, true);
988 set_bit(BTNXPUART_CHECK_BOOT_SIGNATURE, &nxpdev->tx_state);
990 return wait_event_interruptible_timeout(nxpdev->check_boot_sign_wait_q,
991 !test_bit(BTNXPUART_CHECK_BOOT_SIGNATURE,
993 msecs_to_jiffies(1000));
996 static int nxp_setup(struct hci_dev *hdev)
998 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1001 set_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1002 init_waitqueue_head(&nxpdev->fw_dnld_done_wait_q);
1003 init_waitqueue_head(&nxpdev->check_boot_sign_wait_q);
1005 if (nxp_check_boot_sign(nxpdev)) {
1006 bt_dev_dbg(hdev, "Need FW Download.");
1007 err = nxp_download_firmware(hdev);
1011 bt_dev_dbg(hdev, "FW already running.");
1012 clear_bit(BTNXPUART_FW_DOWNLOADING, &nxpdev->tx_state);
1015 device_property_read_u32(&nxpdev->serdev->dev, "fw-init-baudrate",
1016 &nxpdev->fw_init_baudrate);
1017 if (!nxpdev->fw_init_baudrate)
1018 nxpdev->fw_init_baudrate = FW_INIT_BAUDRATE;
1019 serdev_device_set_baudrate(nxpdev->serdev, nxpdev->fw_init_baudrate);
1020 nxpdev->current_baudrate = nxpdev->fw_init_baudrate;
1022 if (nxpdev->current_baudrate != HCI_NXP_SEC_BAUDRATE) {
1023 nxpdev->new_baudrate = HCI_NXP_SEC_BAUDRATE;
1024 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1032 static int btnxpuart_queue_skb(struct hci_dev *hdev, struct sk_buff *skb)
1034 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1036 /* Prepend skb with frame type */
1037 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
1038 skb_queue_tail(&nxpdev->txq, skb);
1039 btnxpuart_tx_wakeup(nxpdev);
1043 static int nxp_enqueue(struct hci_dev *hdev, struct sk_buff *skb)
1045 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1046 struct ps_data *psdata = &nxpdev->psdata;
1047 struct hci_command_hdr *hdr;
1048 struct psmode_cmd_payload ps_parm;
1049 struct wakeup_cmd_payload wakeup_parm;
1050 __le32 baudrate_parm;
1052 /* if vendor commands are received from user space (e.g. hcitool), update
1053 * driver flags accordingly and ask driver to re-send the command to FW.
1054 * In case the payload for any command does not match expected payload
1055 * length, let the firmware and user space program handle it, or throw
1058 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT && !psdata->driver_sent_cmd) {
1059 hdr = (struct hci_command_hdr *)skb->data;
1060 if (hdr->plen != (skb->len - HCI_COMMAND_HDR_SIZE))
1061 return btnxpuart_queue_skb(hdev, skb);
1063 switch (__le16_to_cpu(hdr->opcode)) {
1064 case HCI_NXP_AUTO_SLEEP_MODE:
1065 if (hdr->plen == sizeof(ps_parm)) {
1066 memcpy(&ps_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1067 if (ps_parm.ps_cmd == BT_PS_ENABLE)
1068 psdata->target_ps_mode = PS_MODE_ENABLE;
1069 else if (ps_parm.ps_cmd == BT_PS_DISABLE)
1070 psdata->target_ps_mode = PS_MODE_DISABLE;
1071 psdata->c2h_ps_interval = __le16_to_cpu(ps_parm.c2h_ps_interval);
1072 hci_cmd_sync_queue(hdev, send_ps_cmd, NULL, NULL);
1076 case HCI_NXP_WAKEUP_METHOD:
1077 if (hdr->plen == sizeof(wakeup_parm)) {
1078 memcpy(&wakeup_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1079 psdata->c2h_wakeupmode = wakeup_parm.c2h_wakeupmode;
1080 psdata->c2h_wakeup_gpio = wakeup_parm.c2h_wakeup_gpio;
1081 psdata->h2c_wakeup_gpio = wakeup_parm.h2c_wakeup_gpio;
1082 switch (wakeup_parm.h2c_wakeupmode) {
1083 case BT_CTRL_WAKEUP_METHOD_DSR:
1084 psdata->h2c_wakeupmode = WAKEUP_METHOD_DTR;
1086 case BT_CTRL_WAKEUP_METHOD_BREAK:
1088 psdata->h2c_wakeupmode = WAKEUP_METHOD_BREAK;
1091 hci_cmd_sync_queue(hdev, send_wakeup_method_cmd, NULL, NULL);
1095 case HCI_NXP_SET_OPER_SPEED:
1096 if (hdr->plen == sizeof(baudrate_parm)) {
1097 memcpy(&baudrate_parm, skb->data + HCI_COMMAND_HDR_SIZE, hdr->plen);
1098 nxpdev->new_baudrate = __le32_to_cpu(baudrate_parm);
1099 hci_cmd_sync_queue(hdev, nxp_set_baudrate_cmd, NULL, NULL);
1103 case HCI_NXP_IND_RESET:
1104 if (hdr->plen == 1) {
1105 hci_cmd_sync_queue(hdev, nxp_set_ind_reset, NULL, NULL);
1114 return btnxpuart_queue_skb(hdev, skb);
1121 static struct sk_buff *nxp_dequeue(void *data)
1123 struct btnxpuart_dev *nxpdev = (struct btnxpuart_dev *)data;
1126 ps_start_timer(nxpdev);
1127 return skb_dequeue(&nxpdev->txq);
1130 /* btnxpuart based on serdev */
1131 static void btnxpuart_tx_work(struct work_struct *work)
1133 struct btnxpuart_dev *nxpdev = container_of(work, struct btnxpuart_dev,
1135 struct serdev_device *serdev = nxpdev->serdev;
1136 struct hci_dev *hdev = nxpdev->hdev;
1137 struct sk_buff *skb;
1140 while ((skb = nxp_dequeue(nxpdev))) {
1141 len = serdev_device_write_buf(serdev, skb->data, skb->len);
1142 hdev->stat.byte_tx += len;
1146 skb_queue_head(&nxpdev->txq, skb);
1150 switch (hci_skb_pkt_type(skb)) {
1151 case HCI_COMMAND_PKT:
1152 hdev->stat.cmd_tx++;
1154 case HCI_ACLDATA_PKT:
1155 hdev->stat.acl_tx++;
1157 case HCI_SCODATA_PKT:
1158 hdev->stat.sco_tx++;
1164 clear_bit(BTNXPUART_TX_STATE_ACTIVE, &nxpdev->tx_state);
1167 static int btnxpuart_open(struct hci_dev *hdev)
1169 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1172 err = serdev_device_open(nxpdev->serdev);
1174 bt_dev_err(hdev, "Unable to open UART device %s",
1175 dev_name(&nxpdev->serdev->dev));
1177 set_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1182 static int btnxpuart_close(struct hci_dev *hdev)
1184 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1187 serdev_device_close(nxpdev->serdev);
1188 clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
1192 static int btnxpuart_flush(struct hci_dev *hdev)
1194 struct btnxpuart_dev *nxpdev = hci_get_drvdata(hdev);
1196 /* Flush any pending characters */
1197 serdev_device_write_flush(nxpdev->serdev);
1198 skb_queue_purge(&nxpdev->txq);
1200 cancel_work_sync(&nxpdev->tx_work);
1202 kfree_skb(nxpdev->rx_skb);
1203 nxpdev->rx_skb = NULL;
1208 static const struct h4_recv_pkt nxp_recv_pkts[] = {
1209 { H4_RECV_ACL, .recv = hci_recv_frame },
1210 { H4_RECV_SCO, .recv = hci_recv_frame },
1211 { H4_RECV_EVENT, .recv = hci_recv_frame },
1212 { NXP_RECV_CHIP_VER_V1, .recv = nxp_recv_chip_ver_v1 },
1213 { NXP_RECV_FW_REQ_V1, .recv = nxp_recv_fw_req_v1 },
1214 { NXP_RECV_CHIP_VER_V3, .recv = nxp_recv_chip_ver_v3 },
1215 { NXP_RECV_FW_REQ_V3, .recv = nxp_recv_fw_req_v3 },
1218 static int btnxpuart_receive_buf(struct serdev_device *serdev, const u8 *data,
1221 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1223 ps_start_timer(nxpdev);
1225 nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
1226 nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
1227 if (IS_ERR(nxpdev->rx_skb)) {
1228 int err = PTR_ERR(nxpdev->rx_skb);
1229 /* Safe to ignore out-of-sync bootloader signatures */
1230 if (is_fw_downloading(nxpdev))
1232 bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
1233 nxpdev->rx_skb = NULL;
1236 nxpdev->hdev->stat.byte_rx += count;
1240 static void btnxpuart_write_wakeup(struct serdev_device *serdev)
1242 serdev_device_write_wakeup(serdev);
1245 static const struct serdev_device_ops btnxpuart_client_ops = {
1246 .receive_buf = btnxpuart_receive_buf,
1247 .write_wakeup = btnxpuart_write_wakeup,
1250 static int nxp_serdev_probe(struct serdev_device *serdev)
1252 struct hci_dev *hdev;
1253 struct btnxpuart_dev *nxpdev;
1255 nxpdev = devm_kzalloc(&serdev->dev, sizeof(*nxpdev), GFP_KERNEL);
1259 nxpdev->nxp_data = (struct btnxpuart_data *)device_get_match_data(&serdev->dev);
1261 nxpdev->serdev = serdev;
1262 serdev_device_set_drvdata(serdev, nxpdev);
1264 serdev_device_set_client_ops(serdev, &btnxpuart_client_ops);
1266 INIT_WORK(&nxpdev->tx_work, btnxpuart_tx_work);
1267 skb_queue_head_init(&nxpdev->txq);
1269 crc8_populate_msb(crc8_table, POLYNOMIAL8);
1271 /* Initialize and register HCI device */
1272 hdev = hci_alloc_dev();
1274 dev_err(&serdev->dev, "Can't allocate HCI device\n");
1278 nxpdev->hdev = hdev;
1280 hdev->bus = HCI_UART;
1281 hci_set_drvdata(hdev, nxpdev);
1283 hdev->manufacturer = MANUFACTURER_NXP;
1284 hdev->open = btnxpuart_open;
1285 hdev->close = btnxpuart_close;
1286 hdev->flush = btnxpuart_flush;
1287 hdev->setup = nxp_setup;
1288 hdev->send = nxp_enqueue;
1289 SET_HCIDEV_DEV(hdev, &serdev->dev);
1291 if (hci_register_dev(hdev) < 0) {
1292 dev_err(&serdev->dev, "Can't register HCI device\n");
1298 ps_init_timer(hdev);
1303 static void nxp_serdev_remove(struct serdev_device *serdev)
1305 struct btnxpuart_dev *nxpdev = serdev_device_get_drvdata(serdev);
1306 struct hci_dev *hdev = nxpdev->hdev;
1308 /* Restore FW baudrate to fw_init_baudrate if changed.
1309 * This will ensure FW baudrate is in sync with
1310 * driver baudrate in case this driver is re-inserted.
1312 if (nxpdev->current_baudrate != nxpdev->fw_init_baudrate) {
1313 nxpdev->new_baudrate = nxpdev->fw_init_baudrate;
1314 nxp_set_baudrate_cmd(hdev, NULL);
1317 ps_cancel_timer(nxpdev);
1318 hci_unregister_dev(hdev);
1322 static struct btnxpuart_data w8987_data = {
1323 .helper_fw_name = NULL,
1324 .fw_name = FIRMWARE_W8987,
1327 static struct btnxpuart_data w8997_data = {
1328 .helper_fw_name = FIRMWARE_HELPER,
1329 .fw_name = FIRMWARE_W8997,
1332 static const struct of_device_id nxpuart_of_match_table[] = {
1333 { .compatible = "nxp,88w8987-bt", .data = &w8987_data },
1334 { .compatible = "nxp,88w8997-bt", .data = &w8997_data },
1337 MODULE_DEVICE_TABLE(of, nxpuart_of_match_table);
1339 static struct serdev_device_driver nxp_serdev_driver = {
1340 .probe = nxp_serdev_probe,
1341 .remove = nxp_serdev_remove,
1343 .name = "btnxpuart",
1344 .of_match_table = of_match_ptr(nxpuart_of_match_table),
1348 module_serdev_device_driver(nxp_serdev_driver);
1350 MODULE_AUTHOR("Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>");
1351 MODULE_DESCRIPTION("NXP Bluetooth Serial driver");
1352 MODULE_LICENSE("GPL");