drivers/bluetooth/btmtk.c

   1 // SPDX-License-Identifier: ISC
   2 /* Copyright (C) 2021 MediaTek Inc.
   3  *
   4  */
   5 #include <linux/module.h>
   6 #include <linux/firmware.h>
   7 #include <linux/usb.h>
   8 #include <linux/iopoll.h>
   9 #include <linux/unaligned.h>
  10
  11 #include <net/bluetooth/bluetooth.h>
  12 #include <net/bluetooth/hci_core.h>
  13
  14 #include "btmtk.h"
  15
  16 #define VERSION "0.1"
  17
  18 /* It is for mt79xx download rom patch*/
  19 #define MTK_FW_ROM_PATCH_HEADER_SIZE    32
  20 #define MTK_FW_ROM_PATCH_GD_SIZE        64
  21 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE   64
  22 #define MTK_SEC_MAP_COMMON_SIZE 12
  23 #define MTK_SEC_MAP_NEED_SEND_SIZE      52
  24
  25 /* It is for mt79xx iso data transmission setting */
  26 #define MTK_ISO_THRESHOLD       264
  27
  28 struct btmtk_patch_header {
  29         u8 datetime[16];
  30         u8 platform[4];
  31         __le16 hwver;
  32         __le16 swver;
  33         __le32 magicnum;
  34 } __packed;
  35
  36 struct btmtk_global_desc {
  37         __le32 patch_ver;
  38         __le32 sub_sys;
  39         __le32 feature_opt;
  40         __le32 section_num;
  41 } __packed;
  42
  43 struct btmtk_section_map {
  44         __le32 sectype;
  45         __le32 secoffset;
  46         __le32 secsize;
  47         union {
  48                 __le32 u4SecSpec[13];
  49                 struct {
  50                         __le32 dlAddr;
  51                         __le32 dlsize;
  52                         __le32 seckeyidx;
  53                         __le32 alignlen;
  54                         __le32 sectype;
  55                         __le32 dlmodecrctype;
  56                         __le32 crc;
  57                         __le32 reserved[6];
  58                 } bin_info_spec;
  59         };
  60 } __packed;
  61
  62 static void btmtk_coredump(struct hci_dev *hdev)
  63 {
  64         int err;
  65
  66         err = __hci_cmd_send(hdev, 0xfd5b, 0, NULL);
  67         if (err < 0)
  68                 bt_dev_err(hdev, "Coredump failed (%d)", err);
  69 }
  70
  71 static void btmtk_coredump_hdr(struct hci_dev *hdev, struct sk_buff *skb)
  72 {
  73         struct btmtk_data *data = hci_get_priv(hdev);
  74         char buf[80];
  75
  76         snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
  77                  data->dev_id);
  78         skb_put_data(skb, buf, strlen(buf));
  79
  80         snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
  81                  data->cd_info.fw_version);
  82         skb_put_data(skb, buf, strlen(buf));
  83
  84         snprintf(buf, sizeof(buf), "Driver: %s\n",
  85                  data->cd_info.driver_name);
  86         skb_put_data(skb, buf, strlen(buf));
  87
  88         snprintf(buf, sizeof(buf), "Vendor: MediaTek\n");
  89         skb_put_data(skb, buf, strlen(buf));
  90 }
  91
  92 static void btmtk_coredump_notify(struct hci_dev *hdev, int state)
  93 {
  94         struct btmtk_data *data = hci_get_priv(hdev);
  95
  96         switch (state) {
  97         case HCI_DEVCOREDUMP_IDLE:
  98                 data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
  99                 break;
 100         case HCI_DEVCOREDUMP_ACTIVE:
 101                 data->cd_info.state = HCI_DEVCOREDUMP_ACTIVE;
 102                 break;
 103         case HCI_DEVCOREDUMP_TIMEOUT:
 104         case HCI_DEVCOREDUMP_ABORT:
 105         case HCI_DEVCOREDUMP_DONE:
 106                 data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
 107                 btmtk_reset_sync(hdev);
 108                 break;
 109         }
 110 }
 111
 112 void btmtk_fw_get_filename(char *buf, size_t size, u32 dev_id, u32 fw_ver,
 113                            u32 fw_flavor)
 114 {
 115         if (dev_id == 0x7925)
 116                 snprintf(buf, size,
 117                          "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
 118                          dev_id & 0xffff, dev_id & 0xffff, (fw_ver & 0xff) + 1);
 119         else if (dev_id == 0x7961 && fw_flavor)
 120                 snprintf(buf, size,
 121                          "mediatek/BT_RAM_CODE_MT%04x_1a_%x_hdr.bin",
 122                          dev_id & 0xffff, (fw_ver & 0xff) + 1);
 123         else
 124                 snprintf(buf, size,
 125                          "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
 126                          dev_id & 0xffff, (fw_ver & 0xff) + 1);
 127 }
 128 EXPORT_SYMBOL_GPL(btmtk_fw_get_filename);
 129
 130 int btmtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname,
 131                               wmt_cmd_sync_func_t wmt_cmd_sync)
 132 {
 133         struct btmtk_hci_wmt_params wmt_params;
 134         struct btmtk_patch_header *hdr;
 135         struct btmtk_global_desc *globaldesc = NULL;
 136         struct btmtk_section_map *sectionmap;
 137         const struct firmware *fw;
 138         const u8 *fw_ptr;
 139         const u8 *fw_bin_ptr;
 140         int err, dlen, i, status;
 141         u8 flag, first_block, retry;
 142         u32 section_num, dl_size, section_offset;
 143         u8 cmd[64];
 144
 145         err = request_firmware(&fw, fwname, &hdev->dev);
 146         if (err < 0) {
 147                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
 148                 return err;
 149         }
 150
 151         fw_ptr = fw->data;
 152         fw_bin_ptr = fw_ptr;
 153         hdr = (struct btmtk_patch_header *)fw_ptr;
 154         globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
 155         section_num = le32_to_cpu(globaldesc->section_num);
 156
 157         bt_dev_info(hdev, "HW/SW Version: 0x%04x%04x, Build Time: %s",
 158                     le16_to_cpu(hdr->hwver), le16_to_cpu(hdr->swver), hdr->datetime);
 159
 160         for (i = 0; i < section_num; i++) {
 161                 first_block = 1;
 162                 fw_ptr = fw_bin_ptr;
 163                 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
 164                               MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
 165
 166                 section_offset = le32_to_cpu(sectionmap->secoffset);
 167                 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
 168
 169                 if (dl_size > 0) {
 170                         retry = 20;
 171                         while (retry > 0) {
 172                                 cmd[0] = 0; /* 0 means legacy dl mode. */
 173                                 memcpy(cmd + 1,
 174                                        fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
 175                                        MTK_FW_ROM_PATCH_GD_SIZE +
 176                                        MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
 177                                        MTK_SEC_MAP_COMMON_SIZE,
 178                                        MTK_SEC_MAP_NEED_SEND_SIZE + 1);
 179
 180                                 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
 181                                 wmt_params.status = &status;
 182                                 wmt_params.flag = 0;
 183                                 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
 184                                 wmt_params.data = &cmd;
 185
 186                                 err = wmt_cmd_sync(hdev, &wmt_params);
 187                                 if (err < 0) {
 188                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
 189                                                    err);
 190                                         goto err_release_fw;
 191                                 }
 192
 193                                 if (status == BTMTK_WMT_PATCH_UNDONE) {
 194                                         break;
 195                                 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
 196                                         msleep(100);
 197                                         retry--;
 198                                 } else if (status == BTMTK_WMT_PATCH_DONE) {
 199                                         goto next_section;
 200                                 } else {
 201                                         bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
 202                                                    status);
 203                                         err = -EIO;
 204                                         goto err_release_fw;
 205                                 }
 206                         }
 207
 208                         fw_ptr += section_offset;
 209                         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
 210                         wmt_params.status = NULL;
 211
 212                         while (dl_size > 0) {
 213                                 dlen = min_t(int, 250, dl_size);
 214                                 if (first_block == 1) {
 215                                         flag = 1;
 216                                         first_block = 0;
 217                                 } else if (dl_size - dlen <= 0) {
 218                                         flag = 3;
 219                                 } else {
 220                                         flag = 2;
 221                                 }
 222
 223                                 wmt_params.flag = flag;
 224                                 wmt_params.dlen = dlen;
 225                                 wmt_params.data = fw_ptr;
 226
 227                                 err = wmt_cmd_sync(hdev, &wmt_params);
 228                                 if (err < 0) {
 229                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
 230                                                    err);
 231                                         goto err_release_fw;
 232                                 }
 233
 234                                 dl_size -= dlen;
 235                                 fw_ptr += dlen;
 236                         }
 237                 }
 238 next_section:
 239                 continue;
 240         }
 241         /* Wait a few moments for firmware activation done */
 242         usleep_range(100000, 120000);
 243
 244 err_release_fw:
 245         release_firmware(fw);
 246
 247         return err;
 248 }
 249 EXPORT_SYMBOL_GPL(btmtk_setup_firmware_79xx);
 250
 251 int btmtk_setup_firmware(struct hci_dev *hdev, const char *fwname,
 252                          wmt_cmd_sync_func_t wmt_cmd_sync)
 253 {
 254         struct btmtk_hci_wmt_params wmt_params;
 255         const struct firmware *fw;
 256         const u8 *fw_ptr;
 257         size_t fw_size;
 258         int err, dlen;
 259         u8 flag, param;
 260
 261         err = request_firmware(&fw, fwname, &hdev->dev);
 262         if (err < 0) {
 263                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
 264                 return err;
 265         }
 266
 267         /* Power on data RAM the firmware relies on. */
 268         param = 1;
 269         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
 270         wmt_params.flag = 3;
 271         wmt_params.dlen = sizeof(param);
 272         wmt_params.data = &param;
 273         wmt_params.status = NULL;
 274
 275         err = wmt_cmd_sync(hdev, &wmt_params);
 276         if (err < 0) {
 277                 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
 278                 goto err_release_fw;
 279         }
 280
 281         fw_ptr = fw->data;
 282         fw_size = fw->size;
 283
 284         /* The size of patch header is 30 bytes, should be skip */
 285         if (fw_size < 30) {
 286                 err = -EINVAL;
 287                 goto err_release_fw;
 288         }
 289
 290         fw_size -= 30;
 291         fw_ptr += 30;
 292         flag = 1;
 293
 294         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
 295         wmt_params.status = NULL;
 296
 297         while (fw_size > 0) {
 298                 dlen = min_t(int, 250, fw_size);
 299
 300                 /* Tell device the position in sequence */
 301                 if (fw_size - dlen <= 0)
 302                         flag = 3;
 303                 else if (fw_size < fw->size - 30)
 304                         flag = 2;
 305
 306                 wmt_params.flag = flag;
 307                 wmt_params.dlen = dlen;
 308                 wmt_params.data = fw_ptr;
 309
 310                 err = wmt_cmd_sync(hdev, &wmt_params);
 311                 if (err < 0) {
 312                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
 313                                    err);
 314                         goto err_release_fw;
 315                 }
 316
 317                 fw_size -= dlen;
 318                 fw_ptr += dlen;
 319         }
 320
 321         wmt_params.op = BTMTK_WMT_RST;
 322         wmt_params.flag = 4;
 323         wmt_params.dlen = 0;
 324         wmt_params.data = NULL;
 325         wmt_params.status = NULL;
 326
 327         /* Activate function the firmware providing to */
 328         err = wmt_cmd_sync(hdev, &wmt_params);
 329         if (err < 0) {
 330                 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
 331                 goto err_release_fw;
 332         }
 333
 334         /* Wait a few moments for firmware activation done */
 335         usleep_range(10000, 12000);
 336
 337 err_release_fw:
 338         release_firmware(fw);
 339
 340         return err;
 341 }
 342 EXPORT_SYMBOL_GPL(btmtk_setup_firmware);
 343
 344 int btmtk_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 345 {
 346         struct sk_buff *skb;
 347         long ret;
 348
 349         skb = __hci_cmd_sync(hdev, 0xfc1a, 6, bdaddr, HCI_INIT_TIMEOUT);
 350         if (IS_ERR(skb)) {
 351                 ret = PTR_ERR(skb);
 352                 bt_dev_err(hdev, "changing Mediatek device address failed (%ld)",
 353                            ret);
 354                 return ret;
 355         }
 356         kfree_skb(skb);
 357
 358         return 0;
 359 }
 360 EXPORT_SYMBOL_GPL(btmtk_set_bdaddr);
 361
 362 void btmtk_reset_sync(struct hci_dev *hdev)
 363 {
 364         struct btmtk_data *reset_work = hci_get_priv(hdev);
 365         int err;
 366
 367         hci_dev_lock(hdev);
 368
 369         err = hci_cmd_sync_queue(hdev, reset_work->reset_sync, NULL, NULL);
 370         if (err)
 371                 bt_dev_err(hdev, "failed to reset (%d)", err);
 372
 373         hci_dev_unlock(hdev);
 374 }
 375 EXPORT_SYMBOL_GPL(btmtk_reset_sync);
 376
 377 int btmtk_register_coredump(struct hci_dev *hdev, const char *name,
 378                             u32 fw_version)
 379 {
 380         struct btmtk_data *data = hci_get_priv(hdev);
 381
 382         if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
 383                 return -EOPNOTSUPP;
 384
 385         data->cd_info.fw_version = fw_version;
 386         data->cd_info.state = HCI_DEVCOREDUMP_IDLE;
 387         data->cd_info.driver_name = name;
 388
 389         return hci_devcd_register(hdev, btmtk_coredump, btmtk_coredump_hdr,
 390                                   btmtk_coredump_notify);
 391 }
 392 EXPORT_SYMBOL_GPL(btmtk_register_coredump);
 393
 394 int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
 395 {
 396         struct btmtk_data *data = hci_get_priv(hdev);
 397         int err;
 398         bool complete = false;
 399
 400         if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) {
 401                 kfree_skb(skb);
 402                 return 0;
 403         }
 404
 405         switch (data->cd_info.state) {
 406         case HCI_DEVCOREDUMP_IDLE:
 407                 err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
 408                 if (err < 0) {
 409                         kfree_skb(skb);
 410                         break;
 411                 }
 412                 data->cd_info.cnt = 0;
 413
 414                 /* It is supposed coredump can be done within 5 seconds */
 415                 schedule_delayed_work(&hdev->dump.dump_timeout,
 416                                       msecs_to_jiffies(5000));
 417                 fallthrough;
 418         case HCI_DEVCOREDUMP_ACTIVE:
 419         default:
 420                 /* Mediatek coredump data would be more than MTK_COREDUMP_NUM */
 421                 if (data->cd_info.cnt >= MTK_COREDUMP_NUM &&
 422                     skb->len > MTK_COREDUMP_END_LEN)
 423                         if (!memcmp((char *)&skb->data[skb->len - MTK_COREDUMP_END_LEN],
 424                                     MTK_COREDUMP_END, MTK_COREDUMP_END_LEN - 1))
 425                                 complete = true;
 426
 427                 err = hci_devcd_append(hdev, skb);
 428                 if (err < 0)
 429                         break;
 430                 data->cd_info.cnt++;
 431
 432                 if (complete) {
 433                         bt_dev_info(hdev, "Mediatek coredump end");
 434                         hci_devcd_complete(hdev);
 435                 }
 436
 437                 break;
 438         }
 439
 440         return err;
 441 }
 442 EXPORT_SYMBOL_GPL(btmtk_process_coredump);
 443
 444 #if IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK)
 445 static void btmtk_usb_wmt_recv(struct urb *urb)
 446 {
 447         struct hci_dev *hdev = urb->context;
 448         struct btmtk_data *data = hci_get_priv(hdev);
 449         struct sk_buff *skb;
 450         int err;
 451
 452         if (urb->status == 0 && urb->actual_length > 0) {
 453                 hdev->stat.byte_rx += urb->actual_length;
 454
 455                 /* WMT event shouldn't be fragmented and the size should be
 456                  * less than HCI_WMT_MAX_EVENT_SIZE.
 457                  */
 458                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
 459                 if (!skb) {
 460                         hdev->stat.err_rx++;
 461                         kfree(urb->setup_packet);
 462                         return;
 463                 }
 464
 465                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 466                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
 467
 468                 /* When someone waits for the WMT event, the skb is being cloned
 469                  * and being processed the events from there then.
 470                  */
 471                 if (test_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags)) {
 472                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
 473                         if (!data->evt_skb) {
 474                                 kfree_skb(skb);
 475                                 kfree(urb->setup_packet);
 476                                 return;
 477                         }
 478                 }
 479
 480                 err = hci_recv_frame(hdev, skb);
 481                 if (err < 0) {
 482                         kfree_skb(data->evt_skb);
 483                         data->evt_skb = NULL;
 484                         kfree(urb->setup_packet);
 485                         return;
 486                 }
 487
 488                 if (test_and_clear_bit(BTMTK_TX_WAIT_VND_EVT,
 489                                        &data->flags)) {
 490                         /* Barrier to sync with other CPUs */
 491                         smp_mb__after_atomic();
 492                         wake_up_bit(&data->flags,
 493                                     BTMTK_TX_WAIT_VND_EVT);
 494                 }
 495                 kfree(urb->setup_packet);
 496                 return;
 497         } else if (urb->status == -ENOENT) {
 498                 /* Avoid suspend failed when usb_kill_urb */
 499                 return;
 500         }
 501
 502         usb_mark_last_busy(data->udev);
 503
 504         /* The URB complete handler is still called with urb->actual_length = 0
 505          * when the event is not available, so we should keep re-submitting
 506          * URB until WMT event returns, Also, It's necessary to wait some time
 507          * between the two consecutive control URBs to relax the target device
 508          * to generate the event. Otherwise, the WMT event cannot return from
 509          * the device successfully.
 510          */
 511         udelay(500);
 512
 513         usb_anchor_urb(urb, data->ctrl_anchor);
 514         err = usb_submit_urb(urb, GFP_ATOMIC);
 515         if (err < 0) {
 516                 kfree(urb->setup_packet);
 517                 /* -EPERM: urb is being killed;
 518                  * -ENODEV: device got disconnected
 519                  */
 520                 if (err != -EPERM && err != -ENODEV)
 521                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 522                                    urb, -err);
 523                 usb_unanchor_urb(urb);
 524         }
 525 }
 526
 527 static int btmtk_usb_submit_wmt_recv_urb(struct hci_dev *hdev)
 528 {
 529         struct btmtk_data *data = hci_get_priv(hdev);
 530         struct usb_ctrlrequest *dr;
 531         unsigned char *buf;
 532         int err, size = 64;
 533         unsigned int pipe;
 534         struct urb *urb;
 535
 536         urb = usb_alloc_urb(0, GFP_KERNEL);
 537         if (!urb)
 538                 return -ENOMEM;
 539
 540         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
 541         if (!dr) {
 542                 usb_free_urb(urb);
 543                 return -ENOMEM;
 544         }
 545
 546         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
 547         dr->bRequest     = 1;
 548         dr->wIndex       = cpu_to_le16(0);
 549         dr->wValue       = cpu_to_le16(48);
 550         dr->wLength      = cpu_to_le16(size);
 551
 552         buf = kmalloc(size, GFP_KERNEL);
 553         if (!buf) {
 554                 kfree(dr);
 555                 usb_free_urb(urb);
 556                 return -ENOMEM;
 557         }
 558
 559         pipe = usb_rcvctrlpipe(data->udev, 0);
 560
 561         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
 562                              buf, size, btmtk_usb_wmt_recv, hdev);
 563
 564         urb->transfer_flags |= URB_FREE_BUFFER;
 565
 566         usb_anchor_urb(urb, data->ctrl_anchor);
 567         err = usb_submit_urb(urb, GFP_KERNEL);
 568         if (err < 0) {
 569                 if (err != -EPERM && err != -ENODEV)
 570                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 571                                    urb, -err);
 572                 usb_unanchor_urb(urb);
 573         }
 574
 575         usb_free_urb(urb);
 576
 577         return err;
 578 }
 579
 580 static int btmtk_usb_hci_wmt_sync(struct hci_dev *hdev,
 581                                   struct btmtk_hci_wmt_params *wmt_params)
 582 {
 583         struct btmtk_data *data = hci_get_priv(hdev);
 584         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
 585         u32 hlen, status = BTMTK_WMT_INVALID;
 586         struct btmtk_hci_wmt_evt *wmt_evt;
 587         struct btmtk_hci_wmt_cmd *wc;
 588         struct btmtk_wmt_hdr *hdr;
 589         int err;
 590
 591         /* Send the WMT command and wait until the WMT event returns */
 592         hlen = sizeof(*hdr) + wmt_params->dlen;
 593         if (hlen > 255)
 594                 return -EINVAL;
 595
 596         wc = kzalloc(hlen, GFP_KERNEL);
 597         if (!wc)
 598                 return -ENOMEM;
 599
 600         hdr = &wc->hdr;
 601         hdr->dir = 1;
 602         hdr->op = wmt_params->op;
 603         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
 604         hdr->flag = wmt_params->flag;
 605         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
 606
 607         set_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
 608
 609         /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling,
 610          * it needs constantly polling control pipe until the host received the
 611          * WMT event, thus, we should require to specifically acquire PM counter
 612          * on the USB to prevent the interface from entering auto suspended
 613          * while WMT cmd/event in progress.
 614          */
 615         err = usb_autopm_get_interface(data->intf);
 616         if (err < 0)
 617                 goto err_free_wc;
 618
 619         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
 620
 621         if (err < 0) {
 622                 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
 623                 usb_autopm_put_interface(data->intf);
 624                 goto err_free_wc;
 625         }
 626
 627         /* Submit control IN URB on demand to process the WMT event */
 628         err = btmtk_usb_submit_wmt_recv_urb(hdev);
 629
 630         usb_autopm_put_interface(data->intf);
 631
 632         if (err < 0)
 633                 goto err_free_wc;
 634
 635         /* The vendor specific WMT commands are all answered by a vendor
 636          * specific event and will have the Command Status or Command
 637          * Complete as with usual HCI command flow control.
 638          *
 639          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
 640          * state to be cleared. The driver specific event receive routine
 641          * will clear that state and with that indicate completion of the
 642          * WMT command.
 643          */
 644         err = wait_on_bit_timeout(&data->flags, BTMTK_TX_WAIT_VND_EVT,
 645                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
 646         if (err == -EINTR) {
 647                 bt_dev_err(hdev, "Execution of wmt command interrupted");
 648                 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
 649                 goto err_free_wc;
 650         }
 651
 652         if (err) {
 653                 bt_dev_err(hdev, "Execution of wmt command timed out");
 654                 clear_bit(BTMTK_TX_WAIT_VND_EVT, &data->flags);
 655                 err = -ETIMEDOUT;
 656                 goto err_free_wc;
 657         }
 658
 659         if (data->evt_skb == NULL)
 660                 goto err_free_wc;
 661
 662         /* Parse and handle the return WMT event */
 663         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
 664         if (wmt_evt->whdr.op != hdr->op) {
 665                 bt_dev_err(hdev, "Wrong op received %d expected %d",
 666                            wmt_evt->whdr.op, hdr->op);
 667                 err = -EIO;
 668                 goto err_free_skb;
 669         }
 670
 671         switch (wmt_evt->whdr.op) {
 672         case BTMTK_WMT_SEMAPHORE:
 673                 if (wmt_evt->whdr.flag == 2)
 674                         status = BTMTK_WMT_PATCH_UNDONE;
 675                 else
 676                         status = BTMTK_WMT_PATCH_DONE;
 677                 break;
 678         case BTMTK_WMT_FUNC_CTRL:
 679                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
 680                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
 681                         status = BTMTK_WMT_ON_DONE;
 682                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
 683                         status = BTMTK_WMT_ON_PROGRESS;
 684                 else
 685                         status = BTMTK_WMT_ON_UNDONE;
 686                 break;
 687         case BTMTK_WMT_PATCH_DWNLD:
 688                 if (wmt_evt->whdr.flag == 2)
 689                         status = BTMTK_WMT_PATCH_DONE;
 690                 else if (wmt_evt->whdr.flag == 1)
 691                         status = BTMTK_WMT_PATCH_PROGRESS;
 692                 else
 693                         status = BTMTK_WMT_PATCH_UNDONE;
 694                 break;
 695         }
 696
 697         if (wmt_params->status)
 698                 *wmt_params->status = status;
 699
 700 err_free_skb:
 701         kfree_skb(data->evt_skb);
 702         data->evt_skb = NULL;
 703 err_free_wc:
 704         kfree(wc);
 705         return err;
 706 }
 707
 708 static int btmtk_usb_func_query(struct hci_dev *hdev)
 709 {
 710         struct btmtk_hci_wmt_params wmt_params;
 711         int status, err;
 712         u8 param = 0;
 713
 714         /* Query whether the function is enabled */
 715         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
 716         wmt_params.flag = 4;
 717         wmt_params.dlen = sizeof(param);
 718         wmt_params.data = &param;
 719         wmt_params.status = &status;
 720
 721         err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
 722         if (err < 0) {
 723                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
 724                 return err;
 725         }
 726
 727         return status;
 728 }
 729
 730 static int btmtk_usb_uhw_reg_write(struct hci_dev *hdev, u32 reg, u32 val)
 731 {
 732         struct btmtk_data *data = hci_get_priv(hdev);
 733         int pipe, err;
 734         void *buf;
 735
 736         buf = kzalloc(4, GFP_KERNEL);
 737         if (!buf)
 738                 return -ENOMEM;
 739
 740         put_unaligned_le32(val, buf);
 741
 742         pipe = usb_sndctrlpipe(data->udev, 0);
 743         err = usb_control_msg(data->udev, pipe, 0x02,
 744                               0x5E,
 745                               reg >> 16, reg & 0xffff,
 746                               buf, 4, USB_CTRL_SET_TIMEOUT);
 747         if (err < 0)
 748                 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
 749
 750         kfree(buf);
 751
 752         return err;
 753 }
 754
 755 static int btmtk_usb_uhw_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
 756 {
 757         struct btmtk_data *data = hci_get_priv(hdev);
 758         int pipe, err;
 759         void *buf;
 760
 761         buf = kzalloc(4, GFP_KERNEL);
 762         if (!buf)
 763                 return -ENOMEM;
 764
 765         pipe = usb_rcvctrlpipe(data->udev, 0);
 766         err = usb_control_msg(data->udev, pipe, 0x01,
 767                               0xDE,
 768                               reg >> 16, reg & 0xffff,
 769                               buf, 4, USB_CTRL_GET_TIMEOUT);
 770         if (err < 0) {
 771                 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
 772                 goto err_free_buf;
 773         }
 774
 775         *val = get_unaligned_le32(buf);
 776         bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
 777
 778 err_free_buf:
 779         kfree(buf);
 780
 781         return err;
 782 }
 783
 784 static int btmtk_usb_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
 785 {
 786         struct btmtk_data *data = hci_get_priv(hdev);
 787         int pipe, err, size = sizeof(u32);
 788         void *buf;
 789
 790         buf = kzalloc(size, GFP_KERNEL);
 791         if (!buf)
 792                 return -ENOMEM;
 793
 794         pipe = usb_rcvctrlpipe(data->udev, 0);
 795         err = usb_control_msg(data->udev, pipe, 0x63,
 796                               USB_TYPE_VENDOR | USB_DIR_IN,
 797                               reg >> 16, reg & 0xffff,
 798                               buf, size, USB_CTRL_GET_TIMEOUT);
 799         if (err < 0)
 800                 goto err_free_buf;
 801
 802         *val = get_unaligned_le32(buf);
 803
 804 err_free_buf:
 805         kfree(buf);
 806
 807         return err;
 808 }
 809
 810 static int btmtk_usb_id_get(struct hci_dev *hdev, u32 reg, u32 *id)
 811 {
 812         return btmtk_usb_reg_read(hdev, reg, id);
 813 }
 814
 815 static u32 btmtk_usb_reset_done(struct hci_dev *hdev)
 816 {
 817         u32 val = 0;
 818
 819         btmtk_usb_uhw_reg_read(hdev, MTK_BT_MISC, &val);
 820
 821         return val & MTK_BT_RST_DONE;
 822 }
 823
 824 int btmtk_usb_subsys_reset(struct hci_dev *hdev, u32 dev_id)
 825 {
 826         u32 val;
 827         int err;
 828
 829         if (dev_id == 0x7922) {
 830                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
 831                 if (err < 0)
 832                         return err;
 833                 val |= 0x00002020;
 834                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
 835                 if (err < 0)
 836                         return err;
 837                 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
 838                 if (err < 0)
 839                         return err;
 840                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
 841                 if (err < 0)
 842                         return err;
 843                 val |= BIT(0);
 844                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, val);
 845                 if (err < 0)
 846                         return err;
 847                 msleep(100);
 848         } else if (dev_id == 0x7925) {
 849                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
 850                 if (err < 0)
 851                         return err;
 852                 val |= (1 << 5);
 853                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
 854                 if (err < 0)
 855                         return err;
 856                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
 857                 if (err < 0)
 858                         return err;
 859                 val &= 0xFFFF00FF;
 860                 val |= (1 << 13);
 861                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
 862                 if (err < 0)
 863                         return err;
 864                 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, 0x00010001);
 865                 if (err < 0)
 866                         return err;
 867                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_RESET_REG_CONNV3, &val);
 868                 if (err < 0)
 869                         return err;
 870                 val |= (1 << 0);
 871                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_RESET_REG_CONNV3, val);
 872                 if (err < 0)
 873                         return err;
 874                 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
 875                 if (err < 0)
 876                         return err;
 877                 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
 878                 if (err < 0)
 879                         return err;
 880                 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
 881                 if (err < 0)
 882                         return err;
 883                 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
 884                 if (err < 0)
 885                         return err;
 886                 msleep(100);
 887         } else {
 888                 /* It's Device EndPoint Reset Option Register */
 889                 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
 890                 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
 891                 if (err < 0)
 892                         return err;
 893                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_WDT_STATUS, &val);
 894                 if (err < 0)
 895                         return err;
 896                 /* Reset the bluetooth chip via USB interface. */
 897                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 1);
 898                 if (err < 0)
 899                         return err;
 900                 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
 901                 if (err < 0)
 902                         return err;
 903                 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT, &val);
 904                 if (err < 0)
 905                         return err;
 906                 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT1, 0x000000FF);
 907                 if (err < 0)
 908                         return err;
 909                 err = btmtk_usb_uhw_reg_read(hdev, MTK_UDMA_INT_STA_BT1, &val);
 910                 if (err < 0)
 911                         return err;
 912                 /* MT7921 need to delay 20ms between toggle reset bit */
 913                 msleep(20);
 914                 err = btmtk_usb_uhw_reg_write(hdev, MTK_BT_SUBSYS_RST, 0);
 915                 if (err < 0)
 916                         return err;
 917                 err = btmtk_usb_uhw_reg_read(hdev, MTK_BT_SUBSYS_RST, &val);
 918                 if (err < 0)
 919                         return err;
 920         }
 921
 922         err = readx_poll_timeout(btmtk_usb_reset_done, hdev, val,
 923                                  val & MTK_BT_RST_DONE, 20000, 1000000);
 924         if (err < 0)
 925                 bt_dev_err(hdev, "Reset timeout");
 926
 927         if (dev_id == 0x7922) {
 928                 err = btmtk_usb_uhw_reg_write(hdev, MTK_UDMA_INT_STA_BT, 0x000000FF);
 929                 if (err < 0)
 930                         return err;
 931         }
 932
 933         err = btmtk_usb_id_get(hdev, 0x70010200, &val);
 934         if (err < 0 || !val)
 935                 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
 936
 937         return err;
 938 }
 939 EXPORT_SYMBOL_GPL(btmtk_usb_subsys_reset);
 940
 941 int btmtk_usb_recv_acl(struct hci_dev *hdev, struct sk_buff *skb)
 942 {
 943         struct btmtk_data *data = hci_get_priv(hdev);
 944         u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
 945
 946         switch (handle) {
 947         case 0xfc6f:            /* Firmware dump from device */
 948                 /* When the firmware hangs, the device can no longer
 949                  * suspend and thus disable auto-suspend.
 950                  */
 951                 usb_disable_autosuspend(data->udev);
 952
 953                 /* We need to forward the diagnostic packet to userspace daemon
 954                  * for backward compatibility, so we have to clone the packet
 955                  * extraly for the in-kernel coredump support.
 956                  */
 957                 if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
 958                         struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC);
 959
 960                         if (skb_cd)
 961                                 btmtk_process_coredump(hdev, skb_cd);
 962                 }
 963
 964                 fallthrough;
 965         case 0x05ff:            /* Firmware debug logging 1 */
 966         case 0x05fe:            /* Firmware debug logging 2 */
 967                 return hci_recv_diag(hdev, skb);
 968         }
 969
 970         return hci_recv_frame(hdev, skb);
 971 }
 972 EXPORT_SYMBOL_GPL(btmtk_usb_recv_acl);
 973
 974 static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb)
 975 {
 976         if (skb->len > MTK_ISO_THRESHOLD)
 977                 return -EINVAL;
 978
 979         if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len))
 980                 return -ENOMEM;
 981
 982         __skb_put(skb, MTK_ISO_THRESHOLD - skb->len);
 983
 984         return 0;
 985 }
 986
 987 static int __set_mtk_intr_interface(struct hci_dev *hdev)
 988 {
 989         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
 990         struct usb_interface *intf = btmtk_data->isopkt_intf;
 991         int i, err;
 992
 993         if (!btmtk_data->isopkt_intf)
 994                 return -ENODEV;
 995
 996         err = usb_set_interface(btmtk_data->udev, MTK_ISO_IFNUM, 1);
 997         if (err < 0) {
 998                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
 999                 return err;
1000         }
1001
1002         btmtk_data->isopkt_tx_ep = NULL;
1003         btmtk_data->isopkt_rx_ep = NULL;
1004
1005         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1006                 struct usb_endpoint_descriptor *ep_desc;
1007
1008                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1009
1010                 if (!btmtk_data->isopkt_tx_ep &&
1011                     usb_endpoint_is_int_out(ep_desc)) {
1012                         btmtk_data->isopkt_tx_ep = ep_desc;
1013                         continue;
1014                 }
1015
1016                 if (!btmtk_data->isopkt_rx_ep &&
1017                     usb_endpoint_is_int_in(ep_desc)) {
1018                         btmtk_data->isopkt_rx_ep = ep_desc;
1019                         continue;
1020                 }
1021         }
1022
1023         if (!btmtk_data->isopkt_tx_ep ||
1024             !btmtk_data->isopkt_rx_ep) {
1025                 bt_dev_err(hdev, "invalid interrupt descriptors");
1026                 return -ENODEV;
1027         }
1028
1029         return 0;
1030 }
1031
1032 struct urb *alloc_mtk_intr_urb(struct hci_dev *hdev, struct sk_buff *skb,
1033                                usb_complete_t tx_complete)
1034 {
1035         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1036         struct urb *urb;
1037         unsigned int pipe;
1038
1039         if (!btmtk_data->isopkt_tx_ep)
1040                 return ERR_PTR(-ENODEV);
1041
1042         urb = usb_alloc_urb(0, GFP_KERNEL);
1043         if (!urb)
1044                 return ERR_PTR(-ENOMEM);
1045
1046         if (btmtk_isopkt_pad(hdev, skb))
1047                 return ERR_PTR(-EINVAL);
1048
1049         pipe = usb_sndintpipe(btmtk_data->udev,
1050                               btmtk_data->isopkt_tx_ep->bEndpointAddress);
1051
1052         usb_fill_int_urb(urb, btmtk_data->udev, pipe,
1053                          skb->data, skb->len, tx_complete,
1054                          skb, btmtk_data->isopkt_tx_ep->bInterval);
1055
1056         skb->dev = (void *)hdev;
1057
1058         return urb;
1059 }
1060 EXPORT_SYMBOL_GPL(alloc_mtk_intr_urb);
1061
1062 static int btmtk_recv_isopkt(struct hci_dev *hdev, void *buffer, int count)
1063 {
1064         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1065         struct sk_buff *skb;
1066         unsigned long flags;
1067         int err = 0;
1068
1069         spin_lock_irqsave(&btmtk_data->isorxlock, flags);
1070         skb = btmtk_data->isopkt_skb;
1071
1072         while (count) {
1073                 int len;
1074
1075                 if (!skb) {
1076                         skb = bt_skb_alloc(HCI_MAX_ISO_SIZE, GFP_ATOMIC);
1077                         if (!skb) {
1078                                 err = -ENOMEM;
1079                                 break;
1080                         }
1081
1082                         hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
1083                         hci_skb_expect(skb) = HCI_ISO_HDR_SIZE;
1084                 }
1085
1086                 len = min_t(uint, hci_skb_expect(skb), count);
1087                 skb_put_data(skb, buffer, len);
1088
1089                 count -= len;
1090                 buffer += len;
1091                 hci_skb_expect(skb) -= len;
1092
1093                 if (skb->len == HCI_ISO_HDR_SIZE) {
1094                         __le16 dlen = ((struct hci_iso_hdr *)skb->data)->dlen;
1095
1096                         /* Complete ISO header */
1097                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
1098
1099                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1100                                 kfree_skb(skb);
1101                                 skb = NULL;
1102
1103                                 err = -EILSEQ;
1104                                 break;
1105                         }
1106                 }
1107
1108                 if (!hci_skb_expect(skb)) {
1109                         /* Complete frame */
1110                         hci_recv_frame(hdev, skb);
1111                         skb = NULL;
1112                 }
1113         }
1114
1115         btmtk_data->isopkt_skb = skb;
1116         spin_unlock_irqrestore(&btmtk_data->isorxlock, flags);
1117
1118         return err;
1119 }
1120
1121 static void btmtk_intr_complete(struct urb *urb)
1122 {
1123         struct hci_dev *hdev = urb->context;
1124         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1125         int err;
1126
1127         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1128                urb->actual_length);
1129
1130         if (!test_bit(HCI_RUNNING, &hdev->flags))
1131                 return;
1132
1133         if (hdev->suspended)
1134                 return;
1135
1136         if (urb->status == 0) {
1137                 hdev->stat.byte_rx += urb->actual_length;
1138
1139                 if (btmtk_recv_isopkt(hdev, urb->transfer_buffer,
1140                                       urb->actual_length) < 0) {
1141                         bt_dev_err(hdev, "corrupted iso packet");
1142                         hdev->stat.err_rx++;
1143                 }
1144         } else if (urb->status == -ENOENT) {
1145                 /* Avoid suspend failed when usb_kill_urb */
1146                 return;
1147         }
1148
1149         usb_mark_last_busy(btmtk_data->udev);
1150         usb_anchor_urb(urb, &btmtk_data->isopkt_anchor);
1151
1152         err = usb_submit_urb(urb, GFP_ATOMIC);
1153         if (err < 0) {
1154                 /* -EPERM: urb is being killed;
1155                  * -ENODEV: device got disconnected
1156                  */
1157                 if (err != -EPERM && err != -ENODEV)
1158                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1159                                    urb, -err);
1160                 if (err != -EPERM)
1161                         hci_cmd_sync_cancel(hdev, -err);
1162                 usb_unanchor_urb(urb);
1163         }
1164 }
1165
1166 static int btmtk_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1167 {
1168         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1169         unsigned char *buf;
1170         unsigned int pipe;
1171         struct urb *urb;
1172         int err, size;
1173
1174         BT_DBG("%s", hdev->name);
1175
1176         if (!btmtk_data->isopkt_rx_ep)
1177                 return -ENODEV;
1178
1179         urb = usb_alloc_urb(0, mem_flags);
1180         if (!urb)
1181                 return -ENOMEM;
1182         size = le16_to_cpu(btmtk_data->isopkt_rx_ep->wMaxPacketSize);
1183
1184         buf = kmalloc(size, mem_flags);
1185         if (!buf) {
1186                 usb_free_urb(urb);
1187                 return -ENOMEM;
1188         }
1189
1190         pipe = usb_rcvintpipe(btmtk_data->udev,
1191                               btmtk_data->isopkt_rx_ep->bEndpointAddress);
1192
1193         usb_fill_int_urb(urb, btmtk_data->udev, pipe, buf, size,
1194                          btmtk_intr_complete, hdev,
1195                          btmtk_data->isopkt_rx_ep->bInterval);
1196
1197         urb->transfer_flags |= URB_FREE_BUFFER;
1198
1199         usb_mark_last_busy(btmtk_data->udev);
1200         usb_anchor_urb(urb, &btmtk_data->isopkt_anchor);
1201
1202         err = usb_submit_urb(urb, mem_flags);
1203         if (err < 0) {
1204                 if (err != -EPERM && err != -ENODEV)
1205                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1206                                    urb, -err);
1207                 usb_unanchor_urb(urb);
1208         }
1209
1210         usb_free_urb(urb);
1211
1212         return err;
1213 }
1214
1215 static int btmtk_usb_isointf_init(struct hci_dev *hdev)
1216 {
1217         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1218         u8 iso_param[2] = { 0x08, 0x01 };
1219         struct sk_buff *skb;
1220         int err;
1221
1222         spin_lock_init(&btmtk_data->isorxlock);
1223
1224         __set_mtk_intr_interface(hdev);
1225
1226         err = btmtk_submit_intr_urb(hdev, GFP_KERNEL);
1227         if (err < 0) {
1228                 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
1229                 bt_dev_err(hdev, "ISO intf not support (%d)", err);
1230                 return err;
1231         }
1232
1233         skb = __hci_cmd_sync(hdev, 0xfd98, sizeof(iso_param), iso_param,
1234                              HCI_INIT_TIMEOUT);
1235         if (IS_ERR(skb)) {
1236                 bt_dev_err(hdev, "Failed to apply iso setting (%ld)", PTR_ERR(skb));
1237                 return PTR_ERR(skb);
1238         }
1239         kfree_skb(skb);
1240
1241         return 0;
1242 }
1243
1244 int btmtk_usb_resume(struct hci_dev *hdev)
1245 {
1246         /* This function describes the specific additional steps taken by MediaTek
1247          * when Bluetooth usb driver's resume function is called.
1248          */
1249         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1250
1251         /* Resubmit urb for iso data transmission */
1252         if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags)) {
1253                 if (btmtk_submit_intr_urb(hdev, GFP_NOIO) < 0)
1254                         clear_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
1255         }
1256
1257         return 0;
1258 }
1259 EXPORT_SYMBOL_GPL(btmtk_usb_resume);
1260
1261 int btmtk_usb_suspend(struct hci_dev *hdev)
1262 {
1263         /* This function describes the specific additional steps taken by MediaTek
1264          * when Bluetooth usb driver's suspend function is called.
1265          */
1266         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1267
1268         /* Stop urb anchor for iso data transmission */
1269         if (test_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags))
1270                 usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
1271
1272         return 0;
1273 }
1274 EXPORT_SYMBOL_GPL(btmtk_usb_suspend);
1275
1276 int btmtk_usb_setup(struct hci_dev *hdev)
1277 {
1278         struct btmtk_data *btmtk_data = hci_get_priv(hdev);
1279         struct btmtk_hci_wmt_params wmt_params;
1280         ktime_t calltime, delta, rettime;
1281         struct btmtk_tci_sleep tci_sleep;
1282         unsigned long long duration;
1283         struct sk_buff *skb;
1284         const char *fwname;
1285         int err, status;
1286         u32 dev_id = 0;
1287         char fw_bin_name[64];
1288         u32 fw_version = 0, fw_flavor = 0;
1289         u8 param;
1290
1291         calltime = ktime_get();
1292
1293         err = btmtk_usb_id_get(hdev, 0x80000008, &dev_id);
1294         if (err < 0) {
1295                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
1296                 return err;
1297         }
1298
1299         if (!dev_id || dev_id != 0x7663) {
1300                 err = btmtk_usb_id_get(hdev, 0x70010200, &dev_id);
1301                 if (err < 0) {
1302                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
1303                         return err;
1304                 }
1305                 err = btmtk_usb_id_get(hdev, 0x80021004, &fw_version);
1306                 if (err < 0) {
1307                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
1308                         return err;
1309                 }
1310                 err = btmtk_usb_id_get(hdev, 0x70010020, &fw_flavor);
1311                 if (err < 0) {
1312                         bt_dev_err(hdev, "Failed to get fw flavor (%d)", err);
1313                         return err;
1314                 }
1315                 fw_flavor = (fw_flavor & 0x00000080) >> 7;
1316         }
1317
1318         btmtk_data->dev_id = dev_id;
1319
1320         err = btmtk_register_coredump(hdev, btmtk_data->drv_name, fw_version);
1321         if (err < 0)
1322                 bt_dev_err(hdev, "Failed to register coredump (%d)", err);
1323
1324         switch (dev_id) {
1325         case 0x7663:
1326                 fwname = FIRMWARE_MT7663;
1327                 break;
1328         case 0x7668:
1329                 fwname = FIRMWARE_MT7668;
1330                 break;
1331         case 0x7922:
1332         case 0x7925:
1333                 /* Reset the device to ensure it's in the initial state before
1334                  * downloading the firmware to ensure.
1335                  */
1336
1337                 if (!test_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags))
1338                         btmtk_usb_subsys_reset(hdev, dev_id);
1339                 fallthrough;
1340         case 0x7961:
1341                 btmtk_fw_get_filename(fw_bin_name, sizeof(fw_bin_name), dev_id,
1342                                       fw_version, fw_flavor);
1343
1344                 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
1345                                                 btmtk_usb_hci_wmt_sync);
1346                 if (err < 0) {
1347                         bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
1348                         clear_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
1349                         return err;
1350                 }
1351
1352                 set_bit(BTMTK_FIRMWARE_LOADED, &btmtk_data->flags);
1353
1354                 /* It's Device EndPoint Reset Option Register */
1355                 err = btmtk_usb_uhw_reg_write(hdev, MTK_EP_RST_OPT,
1356                                               MTK_EP_RST_IN_OUT_OPT);
1357                 if (err < 0)
1358                         return err;
1359
1360                 /* Enable Bluetooth protocol */
1361                 param = 1;
1362                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1363                 wmt_params.flag = 0;
1364                 wmt_params.dlen = sizeof(param);
1365                 wmt_params.data = &param;
1366                 wmt_params.status = NULL;
1367
1368                 err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1369                 if (err < 0) {
1370                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1371                         return err;
1372                 }
1373
1374                 hci_set_msft_opcode(hdev, 0xFD30);
1375                 hci_set_aosp_capable(hdev);
1376
1377                 /* Set up ISO interface after protocol enabled */
1378                 if (test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) {
1379                         if (!btmtk_usb_isointf_init(hdev))
1380                                 set_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
1381                 }
1382
1383                 goto done;
1384         default:
1385                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
1386                            dev_id);
1387                 return -ENODEV;
1388         }
1389
1390         /* Query whether the firmware is already download */
1391         wmt_params.op = BTMTK_WMT_SEMAPHORE;
1392         wmt_params.flag = 1;
1393         wmt_params.dlen = 0;
1394         wmt_params.data = NULL;
1395         wmt_params.status = &status;
1396
1397         err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1398         if (err < 0) {
1399                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
1400                 return err;
1401         }
1402
1403         if (status == BTMTK_WMT_PATCH_DONE) {
1404                 bt_dev_info(hdev, "firmware already downloaded");
1405                 goto ignore_setup_fw;
1406         }
1407
1408         /* Setup a firmware which the device definitely requires */
1409         err = btmtk_setup_firmware(hdev, fwname,
1410                                    btmtk_usb_hci_wmt_sync);
1411         if (err < 0)
1412                 return err;
1413
1414 ignore_setup_fw:
1415         err = readx_poll_timeout(btmtk_usb_func_query, hdev, status,
1416                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
1417                                  2000, 5000000);
1418         /* -ETIMEDOUT happens */
1419         if (err < 0)
1420                 return err;
1421
1422         /* The other errors happen in btmtk_usb_func_query */
1423         if (status < 0)
1424                 return status;
1425
1426         if (status == BTMTK_WMT_ON_DONE) {
1427                 bt_dev_info(hdev, "function already on");
1428                 goto ignore_func_on;
1429         }
1430
1431         /* Enable Bluetooth protocol */
1432         param = 1;
1433         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1434         wmt_params.flag = 0;
1435         wmt_params.dlen = sizeof(param);
1436         wmt_params.data = &param;
1437         wmt_params.status = NULL;
1438
1439         err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1440         if (err < 0) {
1441                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1442                 return err;
1443         }
1444
1445 ignore_func_on:
1446         /* Apply the low power environment setup */
1447         tci_sleep.mode = 0x5;
1448         tci_sleep.duration = cpu_to_le16(0x640);
1449         tci_sleep.host_duration = cpu_to_le16(0x640);
1450         tci_sleep.host_wakeup_pin = 0;
1451         tci_sleep.time_compensation = 0;
1452
1453         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
1454                              HCI_INIT_TIMEOUT);
1455         if (IS_ERR(skb)) {
1456                 err = PTR_ERR(skb);
1457                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
1458                 return err;
1459         }
1460         kfree_skb(skb);
1461
1462 done:
1463         rettime = ktime_get();
1464         delta = ktime_sub(rettime, calltime);
1465         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1466
1467         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
1468
1469         return 0;
1470 }
1471 EXPORT_SYMBOL_GPL(btmtk_usb_setup);
1472
1473 int btmtk_usb_shutdown(struct hci_dev *hdev)
1474 {
1475         struct btmtk_data *data = hci_get_priv(hdev);
1476         struct btmtk_hci_wmt_params wmt_params;
1477         u8 param = 0;
1478         int err;
1479
1480         err = usb_autopm_get_interface(data->intf);
1481         if (err < 0)
1482                 return err;
1483
1484         /* Disable the device */
1485         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
1486         wmt_params.flag = 0;
1487         wmt_params.dlen = sizeof(param);
1488         wmt_params.data = &param;
1489         wmt_params.status = NULL;
1490
1491         err = btmtk_usb_hci_wmt_sync(hdev, &wmt_params);
1492         if (err < 0) {
1493                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
1494                 usb_autopm_put_interface(data->intf);
1495                 return err;
1496         }
1497
1498         usb_autopm_put_interface(data->intf);
1499         return 0;
1500 }
1501 EXPORT_SYMBOL_GPL(btmtk_usb_shutdown);
1502 #endif
1503
1504 MODULE_AUTHOR("Sean Wang <[email protected]>");
1505 MODULE_AUTHOR("Mark Chen <[email protected]>");
1506 MODULE_DESCRIPTION("Bluetooth support for MediaTek devices ver " VERSION);
1507 MODULE_VERSION(VERSION);
1508 MODULE_LICENSE("GPL");
1509 MODULE_FIRMWARE(FIRMWARE_MT7622);
1510 MODULE_FIRMWARE(FIRMWARE_MT7663);
1511 MODULE_FIRMWARE(FIRMWARE_MT7668);
1512 MODULE_FIRMWARE(FIRMWARE_MT7922);
1513 MODULE_FIRMWARE(FIRMWARE_MT7961);
1514 MODULE_FIRMWARE(FIRMWARE_MT7925);