1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Bluetooth support for Intel PCIe devices
5 *
6 * Copyright (C) 2024 Intel Corporation
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/firmware.h>
12 #include <linux/pci.h>
13 #include <linux/wait.h>
14 #include <linux/delay.h>
15 #include <linux/interrupt.h>
16
17 #include <linux/unaligned.h>
18
19 #include <net/bluetooth/bluetooth.h>
20 #include <net/bluetooth/hci_core.h>
21
22 #include "btintel.h"
23 #include "btintel_pcie.h"
24
25 #define VERSION "0.1"
26
27 #define BTINTEL_PCI_DEVICE(dev, subdev) \
28 .vendor = PCI_VENDOR_ID_INTEL, \
29 .device = (dev), \
30 .subvendor = PCI_ANY_ID, \
31 .subdevice = (subdev), \
32 .driver_data = 0
33
34 #define POLL_INTERVAL_US 10
35
36 /* Intel Bluetooth PCIe device id table */
37 static const struct pci_device_id btintel_pcie_table[] = {
38 { BTINTEL_PCI_DEVICE(0xA876, PCI_ANY_ID) },
39 { BTINTEL_PCI_DEVICE(0xE476, PCI_ANY_ID) },
40 { 0 }
41 };
42 MODULE_DEVICE_TABLE(pci, btintel_pcie_table);
43
44 /* Intel PCIe uses 4 bytes of HCI type instead of 1 byte BT SIG HCI type */
45 #define BTINTEL_PCIE_HCI_TYPE_LEN 4
46 #define BTINTEL_PCIE_HCI_CMD_PKT 0x00000001
47 #define BTINTEL_PCIE_HCI_ACL_PKT 0x00000002
48 #define BTINTEL_PCIE_HCI_SCO_PKT 0x00000003
49 #define BTINTEL_PCIE_HCI_EVT_PKT 0x00000004
50 #define BTINTEL_PCIE_HCI_ISO_PKT 0x00000005
51
52 /* Alive interrupt context */
53 enum {
54 BTINTEL_PCIE_ROM,
55 BTINTEL_PCIE_FW_DL,
56 BTINTEL_PCIE_HCI_RESET,
57 BTINTEL_PCIE_INTEL_HCI_RESET1,
58 BTINTEL_PCIE_INTEL_HCI_RESET2,
59 BTINTEL_PCIE_D0,
60 BTINTEL_PCIE_D3
61 };
62
ipc_print_ia_ring(struct hci_dev * hdev,struct ia * ia,u16 queue_num)63 static inline void ipc_print_ia_ring(struct hci_dev *hdev, struct ia *ia,
64 u16 queue_num)
65 {
66 bt_dev_dbg(hdev, "IA: %s: tr-h:%02u tr-t:%02u cr-h:%02u cr-t:%02u",
67 queue_num == BTINTEL_PCIE_TXQ_NUM ? "TXQ" : "RXQ",
68 ia->tr_hia[queue_num], ia->tr_tia[queue_num],
69 ia->cr_hia[queue_num], ia->cr_tia[queue_num]);
70 }
71
ipc_print_urbd1(struct hci_dev * hdev,struct urbd1 * urbd1,u16 index)72 static inline void ipc_print_urbd1(struct hci_dev *hdev, struct urbd1 *urbd1,
73 u16 index)
74 {
75 bt_dev_dbg(hdev, "RXQ:urbd1(%u) frbd_tag:%u status: 0x%x fixed:0x%x",
76 index, urbd1->frbd_tag, urbd1->status, urbd1->fixed);
77 }
78
btintel_pcie_get_data(struct msix_entry * entry)79 static struct btintel_pcie_data *btintel_pcie_get_data(struct msix_entry *entry)
80 {
81 u8 queue = entry->entry;
82 struct msix_entry *entries = entry - queue;
83
84 return container_of(entries, struct btintel_pcie_data, msix_entries[0]);
85 }
86
87 /* Set the doorbell for TXQ to notify the device that @index (actually index-1)
88 * of the TFD is updated and ready to transmit.
89 */
btintel_pcie_set_tx_db(struct btintel_pcie_data * data,u16 index)90 static void btintel_pcie_set_tx_db(struct btintel_pcie_data *data, u16 index)
91 {
92 u32 val;
93
94 val = index;
95 val |= (BTINTEL_PCIE_TX_DB_VEC << 16);
96
97 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_HBUS_TARG_WRPTR, val);
98 }
99
100 /* Copy the data to next(@tfd_index) data buffer and update the TFD(transfer
101 * descriptor) with the data length and the DMA address of the data buffer.
102 */
btintel_pcie_prepare_tx(struct txq * txq,u16 tfd_index,struct sk_buff * skb)103 static void btintel_pcie_prepare_tx(struct txq *txq, u16 tfd_index,
104 struct sk_buff *skb)
105 {
106 struct data_buf *buf;
107 struct tfd *tfd;
108
109 tfd = &txq->tfds[tfd_index];
110 memset(tfd, 0, sizeof(*tfd));
111
112 buf = &txq->bufs[tfd_index];
113
114 tfd->size = skb->len;
115 tfd->addr = buf->data_p_addr;
116
117 /* Copy the outgoing data to DMA buffer */
118 memcpy(buf->data, skb->data, tfd->size);
119 }
120
btintel_pcie_send_sync(struct btintel_pcie_data * data,struct sk_buff * skb)121 static int btintel_pcie_send_sync(struct btintel_pcie_data *data,
122 struct sk_buff *skb)
123 {
124 int ret;
125 u16 tfd_index;
126 struct txq *txq = &data->txq;
127
128 tfd_index = data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM];
129
130 if (tfd_index > txq->count)
131 return -ERANGE;
132
133 /* Prepare for TX. It updates the TFD with the length of data and
134 * address of the DMA buffer, and copy the data to the DMA buffer
135 */
136 btintel_pcie_prepare_tx(txq, tfd_index, skb);
137
138 tfd_index = (tfd_index + 1) % txq->count;
139 data->ia.tr_hia[BTINTEL_PCIE_TXQ_NUM] = tfd_index;
140
141 /* Arm wait event condition */
142 data->tx_wait_done = false;
143
144 /* Set the doorbell to notify the device */
145 btintel_pcie_set_tx_db(data, tfd_index);
146
147 /* Wait for the complete interrupt - URBD0 */
148 ret = wait_event_timeout(data->tx_wait_q, data->tx_wait_done,
149 msecs_to_jiffies(BTINTEL_PCIE_TX_WAIT_TIMEOUT_MS));
150 if (!ret)
151 return -ETIME;
152
153 return 0;
154 }
155
156 /* Set the doorbell for RXQ to notify the device that @index (actually index-1)
157 * is available to receive the data
158 */
btintel_pcie_set_rx_db(struct btintel_pcie_data * data,u16 index)159 static void btintel_pcie_set_rx_db(struct btintel_pcie_data *data, u16 index)
160 {
161 u32 val;
162
163 val = index;
164 val |= (BTINTEL_PCIE_RX_DB_VEC << 16);
165
166 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_HBUS_TARG_WRPTR, val);
167 }
168
169 /* Update the FRBD (free buffer descriptor) with the @frbd_index and the
170 * DMA address of the free buffer.
171 */
btintel_pcie_prepare_rx(struct rxq * rxq,u16 frbd_index)172 static void btintel_pcie_prepare_rx(struct rxq *rxq, u16 frbd_index)
173 {
174 struct data_buf *buf;
175 struct frbd *frbd;
176
177 /* Get the buffer of the FRBD for DMA */
178 buf = &rxq->bufs[frbd_index];
179
180 frbd = &rxq->frbds[frbd_index];
181 memset(frbd, 0, sizeof(*frbd));
182
183 /* Update FRBD */
184 frbd->tag = frbd_index;
185 frbd->addr = buf->data_p_addr;
186 }
187
btintel_pcie_submit_rx(struct btintel_pcie_data * data)188 static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
189 {
190 u16 frbd_index;
191 struct rxq *rxq = &data->rxq;
192
193 frbd_index = data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM];
194
195 if (frbd_index > rxq->count)
196 return -ERANGE;
197
198 /* Prepare for RX submit. It updates the FRBD with the address of DMA
199 * buffer
200 */
201 btintel_pcie_prepare_rx(rxq, frbd_index);
202
203 frbd_index = (frbd_index + 1) % rxq->count;
204 data->ia.tr_hia[BTINTEL_PCIE_RXQ_NUM] = frbd_index;
205 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_RXQ_NUM);
206
207 /* Set the doorbell to notify the device */
208 btintel_pcie_set_rx_db(data, frbd_index);
209
210 return 0;
211 }
212
btintel_pcie_start_rx(struct btintel_pcie_data * data)213 static int btintel_pcie_start_rx(struct btintel_pcie_data *data)
214 {
215 int i, ret;
216
217 for (i = 0; i < BTINTEL_PCIE_RX_MAX_QUEUE; i++) {
218 ret = btintel_pcie_submit_rx(data);
219 if (ret)
220 return ret;
221 }
222
223 return 0;
224 }
225
btintel_pcie_reset_ia(struct btintel_pcie_data * data)226 static void btintel_pcie_reset_ia(struct btintel_pcie_data *data)
227 {
228 memset(data->ia.tr_hia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES);
229 memset(data->ia.tr_tia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES);
230 memset(data->ia.cr_hia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES);
231 memset(data->ia.cr_tia, 0, sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES);
232 }
233
btintel_pcie_reset_bt(struct btintel_pcie_data * data)234 static int btintel_pcie_reset_bt(struct btintel_pcie_data *data)
235 {
236 u32 reg;
237 int retry = 3;
238
239 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
240
241 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA |
242 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT |
243 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT);
244 reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON;
245
246 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
247
248 do {
249 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
250 if (reg & BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_STS)
251 break;
252 usleep_range(10000, 12000);
253
254 } while (--retry > 0);
255 usleep_range(10000, 12000);
256
257 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
258
259 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA |
260 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT |
261 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT);
262 reg |= BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET;
263 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
264 usleep_range(10000, 12000);
265
266 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
267 bt_dev_dbg(data->hdev, "csr register after reset: 0x%8.8x", reg);
268
269 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_BOOT_STAGE_REG);
270
271 /* If shared hardware reset is success then boot stage register shall be
272 * set to 0
273 */
274 return reg == 0 ? 0 : -ENODEV;
275 }
276
277 /* This function enables BT function by setting BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT bit in
278 * BTINTEL_PCIE_CSR_FUNC_CTRL_REG register and wait for MSI-X with
279 * BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0.
280 * Then the host reads firmware version from BTINTEL_CSR_F2D_MBX and the boot stage
281 * from BTINTEL_PCIE_CSR_BOOT_STAGE_REG.
282 */
btintel_pcie_enable_bt(struct btintel_pcie_data * data)283 static int btintel_pcie_enable_bt(struct btintel_pcie_data *data)
284 {
285 int err;
286 u32 reg;
287
288 data->gp0_received = false;
289
290 /* Update the DMA address of CI struct to CSR */
291 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_CI_ADDR_LSB_REG,
292 data->ci_p_addr & 0xffffffff);
293 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_CI_ADDR_MSB_REG,
294 (u64)data->ci_p_addr >> 32);
295
296 /* Reset the cached value of boot stage. it is updated by the MSI-X
297 * gp0 interrupt handler.
298 */
299 data->boot_stage_cache = 0x0;
300
301 /* Set MAC_INIT bit to start primary bootloader */
302 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
303 reg &= ~(BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT |
304 BTINTEL_PCIE_CSR_FUNC_CTRL_BUS_MASTER_DISCON |
305 BTINTEL_PCIE_CSR_FUNC_CTRL_SW_RESET);
306 reg |= (BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_ENA |
307 BTINTEL_PCIE_CSR_FUNC_CTRL_MAC_INIT);
308
309 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG, reg);
310
311 /* MAC is ready. Enable BT FUNC */
312 btintel_pcie_set_reg_bits(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG,
313 BTINTEL_PCIE_CSR_FUNC_CTRL_FUNC_INIT);
314
315 btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_FUNC_CTRL_REG);
316
317 /* wait for interrupt from the device after booting up to primary
318 * bootloader.
319 */
320 data->alive_intr_ctxt = BTINTEL_PCIE_ROM;
321 err = wait_event_timeout(data->gp0_wait_q, data->gp0_received,
322 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS));
323 if (!err)
324 return -ETIME;
325
326 /* Check cached boot stage is BTINTEL_PCIE_CSR_BOOT_STAGE_ROM(BIT(0)) */
327 if (~data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ROM)
328 return -ENODEV;
329
330 return 0;
331 }
332
333 /* BIT(0) - ROM, BIT(1) - IML and BIT(3) - OP
334 * Sometimes during firmware image switching from ROM to IML or IML to OP image,
335 * the previous image bit is not cleared by firmware when alive interrupt is
336 * received. Driver needs to take care of these sticky bits when deciding the
337 * current image running on controller.
338 * Ex: 0x10 and 0x11 - both represents that controller is running IML
339 */
btintel_pcie_in_rom(struct btintel_pcie_data * data)340 static inline bool btintel_pcie_in_rom(struct btintel_pcie_data *data)
341 {
342 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_ROM &&
343 !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_IML) &&
344 !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW);
345 }
346
btintel_pcie_in_op(struct btintel_pcie_data * data)347 static inline bool btintel_pcie_in_op(struct btintel_pcie_data *data)
348 {
349 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW;
350 }
351
btintel_pcie_in_iml(struct btintel_pcie_data * data)352 static inline bool btintel_pcie_in_iml(struct btintel_pcie_data *data)
353 {
354 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_IML &&
355 !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_OPFW);
356 }
357
btintel_pcie_in_d3(struct btintel_pcie_data * data)358 static inline bool btintel_pcie_in_d3(struct btintel_pcie_data *data)
359 {
360 return data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY;
361 }
362
btintel_pcie_in_d0(struct btintel_pcie_data * data)363 static inline bool btintel_pcie_in_d0(struct btintel_pcie_data *data)
364 {
365 return !(data->boot_stage_cache & BTINTEL_PCIE_CSR_BOOT_STAGE_D3_STATE_READY);
366 }
367
btintel_pcie_wr_sleep_cntrl(struct btintel_pcie_data * data,u32 dxstate)368 static void btintel_pcie_wr_sleep_cntrl(struct btintel_pcie_data *data,
369 u32 dxstate)
370 {
371 bt_dev_dbg(data->hdev, "writing sleep_ctl_reg: 0x%8.8x", dxstate);
372 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_IPC_SLEEP_CTL_REG, dxstate);
373 }
374
btintel_pcie_alivectxt_state2str(u32 alive_intr_ctxt)375 static inline char *btintel_pcie_alivectxt_state2str(u32 alive_intr_ctxt)
376 {
377 switch (alive_intr_ctxt) {
378 case BTINTEL_PCIE_ROM:
379 return "rom";
380 case BTINTEL_PCIE_FW_DL:
381 return "fw_dl";
382 case BTINTEL_PCIE_D0:
383 return "d0";
384 case BTINTEL_PCIE_D3:
385 return "d3";
386 case BTINTEL_PCIE_HCI_RESET:
387 return "hci_reset";
388 case BTINTEL_PCIE_INTEL_HCI_RESET1:
389 return "intel_reset1";
390 case BTINTEL_PCIE_INTEL_HCI_RESET2:
391 return "intel_reset2";
392 default:
393 return "unknown";
394 }
395 }
396
397 /* This function handles the MSI-X interrupt for gp0 cause (bit 0 in
398 * BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES) which is sent for boot stage and image response.
399 */
btintel_pcie_msix_gp0_handler(struct btintel_pcie_data * data)400 static void btintel_pcie_msix_gp0_handler(struct btintel_pcie_data *data)
401 {
402 bool submit_rx, signal_waitq;
403 u32 reg, old_ctxt;
404
405 /* This interrupt is for three different causes and it is not easy to
406 * know what causes the interrupt. So, it compares each register value
407 * with cached value and update it before it wake up the queue.
408 */
409 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_BOOT_STAGE_REG);
410 if (reg != data->boot_stage_cache)
411 data->boot_stage_cache = reg;
412
413 bt_dev_dbg(data->hdev, "Alive context: %s old_boot_stage: 0x%8.8x new_boot_stage: 0x%8.8x",
414 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt),
415 data->boot_stage_cache, reg);
416 reg = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_IMG_RESPONSE_REG);
417 if (reg != data->img_resp_cache)
418 data->img_resp_cache = reg;
419
420 data->gp0_received = true;
421
422 old_ctxt = data->alive_intr_ctxt;
423 submit_rx = false;
424 signal_waitq = false;
425
426 switch (data->alive_intr_ctxt) {
427 case BTINTEL_PCIE_ROM:
428 data->alive_intr_ctxt = BTINTEL_PCIE_FW_DL;
429 signal_waitq = true;
430 break;
431 case BTINTEL_PCIE_FW_DL:
432 /* Error case is already handled. Ideally control shall not
433 * reach here
434 */
435 break;
436 case BTINTEL_PCIE_INTEL_HCI_RESET1:
437 if (btintel_pcie_in_op(data)) {
438 submit_rx = true;
439 break;
440 }
441
442 if (btintel_pcie_in_iml(data)) {
443 submit_rx = true;
444 data->alive_intr_ctxt = BTINTEL_PCIE_FW_DL;
445 break;
446 }
447 break;
448 case BTINTEL_PCIE_INTEL_HCI_RESET2:
449 if (btintel_test_and_clear_flag(data->hdev, INTEL_WAIT_FOR_D0)) {
450 btintel_wake_up_flag(data->hdev, INTEL_WAIT_FOR_D0);
451 data->alive_intr_ctxt = BTINTEL_PCIE_D0;
452 }
453 break;
454 case BTINTEL_PCIE_D0:
455 if (btintel_pcie_in_d3(data)) {
456 data->alive_intr_ctxt = BTINTEL_PCIE_D3;
457 signal_waitq = true;
458 break;
459 }
460 break;
461 case BTINTEL_PCIE_D3:
462 if (btintel_pcie_in_d0(data)) {
463 data->alive_intr_ctxt = BTINTEL_PCIE_D0;
464 submit_rx = true;
465 signal_waitq = true;
466 break;
467 }
468 break;
469 case BTINTEL_PCIE_HCI_RESET:
470 data->alive_intr_ctxt = BTINTEL_PCIE_D0;
471 submit_rx = true;
472 signal_waitq = true;
473 break;
474 default:
475 bt_dev_err(data->hdev, "Unknown state: 0x%2.2x",
476 data->alive_intr_ctxt);
477 break;
478 }
479
480 if (submit_rx) {
481 btintel_pcie_reset_ia(data);
482 btintel_pcie_start_rx(data);
483 }
484
485 if (signal_waitq) {
486 bt_dev_dbg(data->hdev, "wake up gp0 wait_q");
487 wake_up(&data->gp0_wait_q);
488 }
489
490 if (old_ctxt != data->alive_intr_ctxt)
491 bt_dev_dbg(data->hdev, "alive context changed: %s -> %s",
492 btintel_pcie_alivectxt_state2str(old_ctxt),
493 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));
494 }
495
496 /* This function handles the MSX-X interrupt for rx queue 0 which is for TX
497 */
btintel_pcie_msix_tx_handle(struct btintel_pcie_data * data)498 static void btintel_pcie_msix_tx_handle(struct btintel_pcie_data *data)
499 {
500 u16 cr_tia, cr_hia;
501 struct txq *txq;
502 struct urbd0 *urbd0;
503
504 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM];
505 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_TXQ_NUM];
506
507 if (cr_tia == cr_hia)
508 return;
509
510 txq = &data->txq;
511
512 while (cr_tia != cr_hia) {
513 data->tx_wait_done = true;
514 wake_up(&data->tx_wait_q);
515
516 urbd0 = &txq->urbd0s[cr_tia];
517
518 if (urbd0->tfd_index > txq->count)
519 return;
520
521 cr_tia = (cr_tia + 1) % txq->count;
522 data->ia.cr_tia[BTINTEL_PCIE_TXQ_NUM] = cr_tia;
523 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_TXQ_NUM);
524 }
525 }
526
btintel_pcie_recv_event(struct hci_dev * hdev,struct sk_buff * skb)527 static int btintel_pcie_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
528 {
529 struct hci_event_hdr *hdr = (void *)skb->data;
530 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 };
531 struct btintel_pcie_data *data = hci_get_drvdata(hdev);
532
533 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
534 hdr->plen > 0) {
535 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
536 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
537
538 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
539 switch (skb->data[2]) {
540 case 0x02:
541 /* When switching to the operational firmware
542 * the device sends a vendor specific event
543 * indicating that the bootup completed.
544 */
545 btintel_bootup(hdev, ptr, len);
546
547 /* If bootup event is from operational image,
548 * driver needs to write sleep control register to
549 * move into D0 state
550 */
551 if (btintel_pcie_in_op(data)) {
552 btintel_pcie_wr_sleep_cntrl(data, BTINTEL_PCIE_STATE_D0);
553 data->alive_intr_ctxt = BTINTEL_PCIE_INTEL_HCI_RESET2;
554 kfree_skb(skb);
555 return 0;
556 }
557
558 if (btintel_pcie_in_iml(data)) {
559 /* In case of IML, there is no concept
560 * of D0 transition. Just mimic as if
561 * IML moved to D0 by clearing INTEL_WAIT_FOR_D0
562 * bit and waking up the task waiting on
563 * INTEL_WAIT_FOR_D0. This is required
564 * as intel_boot() is common function for
565 * both IML and OP image loading.
566 */
567 if (btintel_test_and_clear_flag(data->hdev,
568 INTEL_WAIT_FOR_D0))
569 btintel_wake_up_flag(data->hdev,
570 INTEL_WAIT_FOR_D0);
571 }
572 kfree_skb(skb);
573 return 0;
574 case 0x06:
575 /* When the firmware loading completes the
576 * device sends out a vendor specific event
577 * indicating the result of the firmware
578 * loading.
579 */
580 btintel_secure_send_result(hdev, ptr, len);
581 kfree_skb(skb);
582 return 0;
583 }
584 }
585
586 /* Handle all diagnostics events separately. May still call
587 * hci_recv_frame.
588 */
589 if (len >= sizeof(diagnostics_hdr) &&
590 memcmp(&skb->data[2], diagnostics_hdr,
591 sizeof(diagnostics_hdr)) == 0) {
592 return btintel_diagnostics(hdev, skb);
593 }
594
595 /* This is a debug event that comes from IML and OP image when it
596 * starts execution. There is no need pass this event to stack.
597 */
598 if (skb->data[2] == 0x97)
599 return 0;
600 }
601
602 return hci_recv_frame(hdev, skb);
603 }
604 /* Process the received rx data
605 * It check the frame header to identify the data type and create skb
606 * and calling HCI API
607 */
btintel_pcie_recv_frame(struct btintel_pcie_data * data,struct sk_buff * skb)608 static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
609 struct sk_buff *skb)
610 {
611 int ret;
612 u8 pkt_type;
613 u16 plen;
614 u32 pcie_pkt_type;
615 struct sk_buff *new_skb;
616 void *pdata;
617 struct hci_dev *hdev = data->hdev;
618
619 spin_lock(&data->hci_rx_lock);
620
621 /* The first 4 bytes indicates the Intel PCIe specific packet type */
622 pdata = skb_pull_data(skb, BTINTEL_PCIE_HCI_TYPE_LEN);
623 if (!pdata) {
624 bt_dev_err(hdev, "Corrupted packet received");
625 ret = -EILSEQ;
626 goto exit_error;
627 }
628
629 pcie_pkt_type = get_unaligned_le32(pdata);
630
631 switch (pcie_pkt_type) {
632 case BTINTEL_PCIE_HCI_ACL_PKT:
633 if (skb->len >= HCI_ACL_HDR_SIZE) {
634 plen = HCI_ACL_HDR_SIZE + __le16_to_cpu(hci_acl_hdr(skb)->dlen);
635 pkt_type = HCI_ACLDATA_PKT;
636 } else {
637 bt_dev_err(hdev, "ACL packet is too short");
638 ret = -EILSEQ;
639 goto exit_error;
640 }
641 break;
642
643 case BTINTEL_PCIE_HCI_SCO_PKT:
644 if (skb->len >= HCI_SCO_HDR_SIZE) {
645 plen = HCI_SCO_HDR_SIZE + hci_sco_hdr(skb)->dlen;
646 pkt_type = HCI_SCODATA_PKT;
647 } else {
648 bt_dev_err(hdev, "SCO packet is too short");
649 ret = -EILSEQ;
650 goto exit_error;
651 }
652 break;
653
654 case BTINTEL_PCIE_HCI_EVT_PKT:
655 if (skb->len >= HCI_EVENT_HDR_SIZE) {
656 plen = HCI_EVENT_HDR_SIZE + hci_event_hdr(skb)->plen;
657 pkt_type = HCI_EVENT_PKT;
658 } else {
659 bt_dev_err(hdev, "Event packet is too short");
660 ret = -EILSEQ;
661 goto exit_error;
662 }
663 break;
664
665 case BTINTEL_PCIE_HCI_ISO_PKT:
666 if (skb->len >= HCI_ISO_HDR_SIZE) {
667 plen = HCI_ISO_HDR_SIZE + __le16_to_cpu(hci_iso_hdr(skb)->dlen);
668 pkt_type = HCI_ISODATA_PKT;
669 } else {
670 bt_dev_err(hdev, "ISO packet is too short");
671 ret = -EILSEQ;
672 goto exit_error;
673 }
674 break;
675
676 default:
677 bt_dev_err(hdev, "Invalid packet type received: 0x%4.4x",
678 pcie_pkt_type);
679 ret = -EINVAL;
680 goto exit_error;
681 }
682
683 if (skb->len < plen) {
684 bt_dev_err(hdev, "Received corrupted packet. type: 0x%2.2x",
685 pkt_type);
686 ret = -EILSEQ;
687 goto exit_error;
688 }
689
690 bt_dev_dbg(hdev, "pkt_type: 0x%2.2x len: %u", pkt_type, plen);
691
692 new_skb = bt_skb_alloc(plen, GFP_ATOMIC);
693 if (!new_skb) {
694 bt_dev_err(hdev, "Failed to allocate memory for skb of len: %u",
695 skb->len);
696 ret = -ENOMEM;
697 goto exit_error;
698 }
699
700 hci_skb_pkt_type(new_skb) = pkt_type;
701 skb_put_data(new_skb, skb->data, plen);
702 hdev->stat.byte_rx += plen;
703
704 if (pcie_pkt_type == BTINTEL_PCIE_HCI_EVT_PKT)
705 ret = btintel_pcie_recv_event(hdev, new_skb);
706 else
707 ret = hci_recv_frame(hdev, new_skb);
708
709 exit_error:
710 if (ret)
711 hdev->stat.err_rx++;
712
713 spin_unlock(&data->hci_rx_lock);
714
715 return ret;
716 }
717
btintel_pcie_rx_work(struct work_struct * work)718 static void btintel_pcie_rx_work(struct work_struct *work)
719 {
720 struct btintel_pcie_data *data = container_of(work,
721 struct btintel_pcie_data, rx_work);
722 struct sk_buff *skb;
723 int err;
724 struct hci_dev *hdev = data->hdev;
725
726 /* Process the sk_buf in queue and send to the HCI layer */
727 while ((skb = skb_dequeue(&data->rx_skb_q))) {
728 err = btintel_pcie_recv_frame(data, skb);
729 if (err)
730 bt_dev_err(hdev, "Failed to send received frame: %d",
731 err);
732 kfree_skb(skb);
733 }
734 }
735
736 /* create sk_buff with data and save it to queue and start RX work */
btintel_pcie_submit_rx_work(struct btintel_pcie_data * data,u8 status,void * buf)737 static int btintel_pcie_submit_rx_work(struct btintel_pcie_data *data, u8 status,
738 void *buf)
739 {
740 int ret, len;
741 struct rfh_hdr *rfh_hdr;
742 struct sk_buff *skb;
743
744 rfh_hdr = buf;
745
746 len = rfh_hdr->packet_len;
747 if (len <= 0) {
748 ret = -EINVAL;
749 goto resubmit;
750 }
751
752 /* Remove RFH header */
753 buf += sizeof(*rfh_hdr);
754
755 skb = alloc_skb(len, GFP_ATOMIC);
756 if (!skb)
757 goto resubmit;
758
759 skb_put_data(skb, buf, len);
760 skb_queue_tail(&data->rx_skb_q, skb);
761 queue_work(data->workqueue, &data->rx_work);
762
763 resubmit:
764 ret = btintel_pcie_submit_rx(data);
765
766 return ret;
767 }
768
769 /* Handles the MSI-X interrupt for rx queue 1 which is for RX */
btintel_pcie_msix_rx_handle(struct btintel_pcie_data * data)770 static void btintel_pcie_msix_rx_handle(struct btintel_pcie_data *data)
771 {
772 u16 cr_hia, cr_tia;
773 struct rxq *rxq;
774 struct urbd1 *urbd1;
775 struct data_buf *buf;
776 int ret;
777 struct hci_dev *hdev = data->hdev;
778
779 cr_hia = data->ia.cr_hia[BTINTEL_PCIE_RXQ_NUM];
780 cr_tia = data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM];
781
782 bt_dev_dbg(hdev, "RXQ: cr_hia: %u cr_tia: %u", cr_hia, cr_tia);
783
784 /* Check CR_TIA and CR_HIA for change */
785 if (cr_tia == cr_hia) {
786 bt_dev_warn(hdev, "RXQ: no new CD found");
787 return;
788 }
789
790 rxq = &data->rxq;
791
792 /* The firmware sends multiple CD in a single MSI-X and it needs to
793 * process all received CDs in this interrupt.
794 */
795 while (cr_tia != cr_hia) {
796 urbd1 = &rxq->urbd1s[cr_tia];
797 ipc_print_urbd1(data->hdev, urbd1, cr_tia);
798
799 buf = &rxq->bufs[urbd1->frbd_tag];
800 if (!buf) {
801 bt_dev_err(hdev, "RXQ: failed to get the DMA buffer for %d",
802 urbd1->frbd_tag);
803 return;
804 }
805
806 ret = btintel_pcie_submit_rx_work(data, urbd1->status,
807 buf->data);
808 if (ret) {
809 bt_dev_err(hdev, "RXQ: failed to submit rx request");
810 return;
811 }
812
813 cr_tia = (cr_tia + 1) % rxq->count;
814 data->ia.cr_tia[BTINTEL_PCIE_RXQ_NUM] = cr_tia;
815 ipc_print_ia_ring(data->hdev, &data->ia, BTINTEL_PCIE_RXQ_NUM);
816 }
817 }
818
btintel_pcie_msix_isr(int irq,void * data)819 static irqreturn_t btintel_pcie_msix_isr(int irq, void *data)
820 {
821 return IRQ_WAKE_THREAD;
822 }
823
btintel_pcie_irq_msix_handler(int irq,void * dev_id)824 static irqreturn_t btintel_pcie_irq_msix_handler(int irq, void *dev_id)
825 {
826 struct msix_entry *entry = dev_id;
827 struct btintel_pcie_data *data = btintel_pcie_get_data(entry);
828 u32 intr_fh, intr_hw;
829
830 spin_lock(&data->irq_lock);
831 intr_fh = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_CAUSES);
832 intr_hw = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES);
833
834 /* Clear causes registers to avoid being handling the same cause */
835 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_CAUSES, intr_fh);
836 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_CAUSES, intr_hw);
837 spin_unlock(&data->irq_lock);
838
839 if (unlikely(!(intr_fh | intr_hw))) {
840 /* Ignore interrupt, inta == 0 */
841 return IRQ_NONE;
842 }
843
844 /* This interrupt is triggered by the firmware after updating
845 * boot_stage register and image_response register
846 */
847 if (intr_hw & BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0)
848 btintel_pcie_msix_gp0_handler(data);
849
850 /* For TX */
851 if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0)
852 btintel_pcie_msix_tx_handle(data);
853
854 /* For RX */
855 if (intr_fh & BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1)
856 btintel_pcie_msix_rx_handle(data);
857
858 /*
859 * Before sending the interrupt the HW disables it to prevent a nested
860 * interrupt. This is done by writing 1 to the corresponding bit in
861 * the mask register. After handling the interrupt, it should be
862 * re-enabled by clearing this bit. This register is defined as write 1
863 * clear (W1C) register, meaning that it's cleared by writing 1
864 * to the bit.
865 */
866 btintel_pcie_wr_reg32(data, BTINTEL_PCIE_CSR_MSIX_AUTOMASK_ST,
867 BIT(entry->entry));
868
869 return IRQ_HANDLED;
870 }
871
872 /* This function requests the irq for MSI-X and registers the handlers per irq.
873 * Currently, it requests only 1 irq for all interrupt causes.
874 */
btintel_pcie_setup_irq(struct btintel_pcie_data * data)875 static int btintel_pcie_setup_irq(struct btintel_pcie_data *data)
876 {
877 int err;
878 int num_irqs, i;
879
880 for (i = 0; i < BTINTEL_PCIE_MSIX_VEC_MAX; i++)
881 data->msix_entries[i].entry = i;
882
883 num_irqs = pci_alloc_irq_vectors(data->pdev, BTINTEL_PCIE_MSIX_VEC_MIN,
884 BTINTEL_PCIE_MSIX_VEC_MAX, PCI_IRQ_MSIX);
885 if (num_irqs < 0)
886 return num_irqs;
887
888 data->alloc_vecs = num_irqs;
889 data->msix_enabled = 1;
890 data->def_irq = 0;
891
892 /* setup irq handler */
893 for (i = 0; i < data->alloc_vecs; i++) {
894 struct msix_entry *msix_entry;
895
896 msix_entry = &data->msix_entries[i];
897 msix_entry->vector = pci_irq_vector(data->pdev, i);
898
899 err = devm_request_threaded_irq(&data->pdev->dev,
900 msix_entry->vector,
901 btintel_pcie_msix_isr,
902 btintel_pcie_irq_msix_handler,
903 IRQF_SHARED,
904 KBUILD_MODNAME,
905 msix_entry);
906 if (err) {
907 pci_free_irq_vectors(data->pdev);
908 data->alloc_vecs = 0;
909 return err;
910 }
911 }
912 return 0;
913 }
914
915 struct btintel_pcie_causes_list {
916 u32 cause;
917 u32 mask_reg;
918 u8 cause_num;
919 };
920
921 static struct btintel_pcie_causes_list causes_list[] = {
922 { BTINTEL_PCIE_MSIX_FH_INT_CAUSES_0, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, 0x00 },
923 { BTINTEL_PCIE_MSIX_FH_INT_CAUSES_1, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK, 0x01 },
924 { BTINTEL_PCIE_MSIX_HW_INT_CAUSES_GP0, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK, 0x20 },
925 };
926
927 /* This function configures the interrupt masks for both HW_INT_CAUSES and
928 * FH_INT_CAUSES which are meaningful to us.
929 *
930 * After resetting BT function via PCIE FLR or FUNC_CTRL reset, the driver
931 * need to call this function again to configure since the masks
932 * are reset to 0xFFFFFFFF after reset.
933 */
btintel_pcie_config_msix(struct btintel_pcie_data * data)934 static void btintel_pcie_config_msix(struct btintel_pcie_data *data)
935 {
936 int i;
937 int val = data->def_irq | BTINTEL_PCIE_MSIX_NON_AUTO_CLEAR_CAUSE;
938
939 /* Set Non Auto Clear Cause */
940 for (i = 0; i < ARRAY_SIZE(causes_list); i++) {
941 btintel_pcie_wr_reg8(data,
942 BTINTEL_PCIE_CSR_MSIX_IVAR(causes_list[i].cause_num),
943 val);
944 btintel_pcie_clr_reg_bits(data,
945 causes_list[i].mask_reg,
946 causes_list[i].cause);
947 }
948
949 /* Save the initial interrupt mask */
950 data->fh_init_mask = ~btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_FH_INT_MASK);
951 data->hw_init_mask = ~btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_MSIX_HW_INT_MASK);
952 }
953
btintel_pcie_config_pcie(struct pci_dev * pdev,struct btintel_pcie_data * data)954 static int btintel_pcie_config_pcie(struct pci_dev *pdev,
955 struct btintel_pcie_data *data)
956 {
957 int err;
958
959 err = pcim_enable_device(pdev);
960 if (err)
961 return err;
962
963 pci_set_master(pdev);
964
965 err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
966 if (err) {
967 err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
968 if (err)
969 return err;
970 }
971
972 data->base_addr = pcim_iomap_region(pdev, 0, KBUILD_MODNAME);
973 if (IS_ERR(data->base_addr))
974 return PTR_ERR(data->base_addr);
975
976 err = btintel_pcie_setup_irq(data);
977 if (err)
978 return err;
979
980 /* Configure MSI-X with causes list */
981 btintel_pcie_config_msix(data);
982
983 return 0;
984 }
985
btintel_pcie_init_ci(struct btintel_pcie_data * data,struct ctx_info * ci)986 static void btintel_pcie_init_ci(struct btintel_pcie_data *data,
987 struct ctx_info *ci)
988 {
989 ci->version = 0x1;
990 ci->size = sizeof(*ci);
991 ci->config = 0x0000;
992 ci->addr_cr_hia = data->ia.cr_hia_p_addr;
993 ci->addr_tr_tia = data->ia.tr_tia_p_addr;
994 ci->addr_cr_tia = data->ia.cr_tia_p_addr;
995 ci->addr_tr_hia = data->ia.tr_hia_p_addr;
996 ci->num_cr_ia = BTINTEL_PCIE_NUM_QUEUES;
997 ci->num_tr_ia = BTINTEL_PCIE_NUM_QUEUES;
998 ci->addr_urbdq0 = data->txq.urbd0s_p_addr;
999 ci->addr_tfdq = data->txq.tfds_p_addr;
1000 ci->num_tfdq = data->txq.count;
1001 ci->num_urbdq0 = data->txq.count;
1002 ci->tfdq_db_vec = BTINTEL_PCIE_TXQ_NUM;
1003 ci->urbdq0_db_vec = BTINTEL_PCIE_TXQ_NUM;
1004 ci->rbd_size = BTINTEL_PCIE_RBD_SIZE_4K;
1005 ci->addr_frbdq = data->rxq.frbds_p_addr;
1006 ci->num_frbdq = data->rxq.count;
1007 ci->frbdq_db_vec = BTINTEL_PCIE_RXQ_NUM;
1008 ci->addr_urbdq1 = data->rxq.urbd1s_p_addr;
1009 ci->num_urbdq1 = data->rxq.count;
1010 ci->urbdq_db_vec = BTINTEL_PCIE_RXQ_NUM;
1011 }
1012
btintel_pcie_free_txq_bufs(struct btintel_pcie_data * data,struct txq * txq)1013 static void btintel_pcie_free_txq_bufs(struct btintel_pcie_data *data,
1014 struct txq *txq)
1015 {
1016 /* Free data buffers first */
1017 dma_free_coherent(&data->pdev->dev, txq->count * BTINTEL_PCIE_BUFFER_SIZE,
1018 txq->buf_v_addr, txq->buf_p_addr);
1019 kfree(txq->bufs);
1020 }
1021
btintel_pcie_setup_txq_bufs(struct btintel_pcie_data * data,struct txq * txq)1022 static int btintel_pcie_setup_txq_bufs(struct btintel_pcie_data *data,
1023 struct txq *txq)
1024 {
1025 int i;
1026 struct data_buf *buf;
1027
1028 /* Allocate the same number of buffers as the descriptor */
1029 txq->bufs = kmalloc_array(txq->count, sizeof(*buf), GFP_KERNEL);
1030 if (!txq->bufs)
1031 return -ENOMEM;
1032
1033 /* Allocate full chunk of data buffer for DMA first and do indexing and
1034 * initialization next, so it can be freed easily
1035 */
1036 txq->buf_v_addr = dma_alloc_coherent(&data->pdev->dev,
1037 txq->count * BTINTEL_PCIE_BUFFER_SIZE,
1038 &txq->buf_p_addr,
1039 GFP_KERNEL | __GFP_NOWARN);
1040 if (!txq->buf_v_addr) {
1041 kfree(txq->bufs);
1042 return -ENOMEM;
1043 }
1044
1045 /* Setup the allocated DMA buffer to bufs. Each data_buf should
1046 * have virtual address and physical address
1047 */
1048 for (i = 0; i < txq->count; i++) {
1049 buf = &txq->bufs[i];
1050 buf->data_p_addr = txq->buf_p_addr + (i * BTINTEL_PCIE_BUFFER_SIZE);
1051 buf->data = txq->buf_v_addr + (i * BTINTEL_PCIE_BUFFER_SIZE);
1052 }
1053
1054 return 0;
1055 }
1056
btintel_pcie_free_rxq_bufs(struct btintel_pcie_data * data,struct rxq * rxq)1057 static void btintel_pcie_free_rxq_bufs(struct btintel_pcie_data *data,
1058 struct rxq *rxq)
1059 {
1060 /* Free data buffers first */
1061 dma_free_coherent(&data->pdev->dev, rxq->count * BTINTEL_PCIE_BUFFER_SIZE,
1062 rxq->buf_v_addr, rxq->buf_p_addr);
1063 kfree(rxq->bufs);
1064 }
1065
btintel_pcie_setup_rxq_bufs(struct btintel_pcie_data * data,struct rxq * rxq)1066 static int btintel_pcie_setup_rxq_bufs(struct btintel_pcie_data *data,
1067 struct rxq *rxq)
1068 {
1069 int i;
1070 struct data_buf *buf;
1071
1072 /* Allocate the same number of buffers as the descriptor */
1073 rxq->bufs = kmalloc_array(rxq->count, sizeof(*buf), GFP_KERNEL);
1074 if (!rxq->bufs)
1075 return -ENOMEM;
1076
1077 /* Allocate full chunk of data buffer for DMA first and do indexing and
1078 * initialization next, so it can be freed easily
1079 */
1080 rxq->buf_v_addr = dma_alloc_coherent(&data->pdev->dev,
1081 rxq->count * BTINTEL_PCIE_BUFFER_SIZE,
1082 &rxq->buf_p_addr,
1083 GFP_KERNEL | __GFP_NOWARN);
1084 if (!rxq->buf_v_addr) {
1085 kfree(rxq->bufs);
1086 return -ENOMEM;
1087 }
1088
1089 /* Setup the allocated DMA buffer to bufs. Each data_buf should
1090 * have virtual address and physical address
1091 */
1092 for (i = 0; i < rxq->count; i++) {
1093 buf = &rxq->bufs[i];
1094 buf->data_p_addr = rxq->buf_p_addr + (i * BTINTEL_PCIE_BUFFER_SIZE);
1095 buf->data = rxq->buf_v_addr + (i * BTINTEL_PCIE_BUFFER_SIZE);
1096 }
1097
1098 return 0;
1099 }
1100
btintel_pcie_setup_ia(struct btintel_pcie_data * data,dma_addr_t p_addr,void * v_addr,struct ia * ia)1101 static void btintel_pcie_setup_ia(struct btintel_pcie_data *data,
1102 dma_addr_t p_addr, void *v_addr,
1103 struct ia *ia)
1104 {
1105 /* TR Head Index Array */
1106 ia->tr_hia_p_addr = p_addr;
1107 ia->tr_hia = v_addr;
1108
1109 /* TR Tail Index Array */
1110 ia->tr_tia_p_addr = p_addr + sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES;
1111 ia->tr_tia = v_addr + sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES;
1112
1113 /* CR Head index Array */
1114 ia->cr_hia_p_addr = p_addr + (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 2);
1115 ia->cr_hia = v_addr + (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 2);
1116
1117 /* CR Tail Index Array */
1118 ia->cr_tia_p_addr = p_addr + (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 3);
1119 ia->cr_tia = v_addr + (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 3);
1120 }
1121
btintel_pcie_free(struct btintel_pcie_data * data)1122 static void btintel_pcie_free(struct btintel_pcie_data *data)
1123 {
1124 btintel_pcie_free_rxq_bufs(data, &data->rxq);
1125 btintel_pcie_free_txq_bufs(data, &data->txq);
1126
1127 dma_pool_free(data->dma_pool, data->dma_v_addr, data->dma_p_addr);
1128 dma_pool_destroy(data->dma_pool);
1129 }
1130
1131 /* Allocate tx and rx queues, any related data structures and buffers.
1132 */
btintel_pcie_alloc(struct btintel_pcie_data * data)1133 static int btintel_pcie_alloc(struct btintel_pcie_data *data)
1134 {
1135 int err = 0;
1136 size_t total;
1137 dma_addr_t p_addr;
1138 void *v_addr;
1139
1140 /* Allocate the chunk of DMA memory for descriptors, index array, and
1141 * context information, instead of allocating individually.
1142 * The DMA memory for data buffer is allocated while setting up the
1143 * each queue.
1144 *
1145 * Total size is sum of the following
1146 * + size of TFD * Number of descriptors in queue
1147 * + size of URBD0 * Number of descriptors in queue
1148 * + size of FRBD * Number of descriptors in queue
1149 * + size of URBD1 * Number of descriptors in queue
1150 * + size of index * Number of queues(2) * type of index array(4)
1151 * + size of context information
1152 */
1153 total = (sizeof(struct tfd) + sizeof(struct urbd0) + sizeof(struct frbd)
1154 + sizeof(struct urbd1)) * BTINTEL_DESCS_COUNT;
1155
1156 /* Add the sum of size of index array and size of ci struct */
1157 total += (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 4) + sizeof(struct ctx_info);
1158
1159 /* Allocate DMA Pool */
1160 data->dma_pool = dma_pool_create(KBUILD_MODNAME, &data->pdev->dev,
1161 total, BTINTEL_PCIE_DMA_POOL_ALIGNMENT, 0);
1162 if (!data->dma_pool) {
1163 err = -ENOMEM;
1164 goto exit_error;
1165 }
1166
1167 v_addr = dma_pool_zalloc(data->dma_pool, GFP_KERNEL | __GFP_NOWARN,
1168 &p_addr);
1169 if (!v_addr) {
1170 dma_pool_destroy(data->dma_pool);
1171 err = -ENOMEM;
1172 goto exit_error;
1173 }
1174
1175 data->dma_p_addr = p_addr;
1176 data->dma_v_addr = v_addr;
1177
1178 /* Setup descriptor count */
1179 data->txq.count = BTINTEL_DESCS_COUNT;
1180 data->rxq.count = BTINTEL_DESCS_COUNT;
1181
1182 /* Setup tfds */
1183 data->txq.tfds_p_addr = p_addr;
1184 data->txq.tfds = v_addr;
1185
1186 p_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);
1187 v_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);
1188
1189 /* Setup urbd0 */
1190 data->txq.urbd0s_p_addr = p_addr;
1191 data->txq.urbd0s = v_addr;
1192
1193 p_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);
1194 v_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);
1195
1196 /* Setup FRBD*/
1197 data->rxq.frbds_p_addr = p_addr;
1198 data->rxq.frbds = v_addr;
1199
1200 p_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);
1201 v_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);
1202
1203 /* Setup urbd1 */
1204 data->rxq.urbd1s_p_addr = p_addr;
1205 data->rxq.urbd1s = v_addr;
1206
1207 p_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);
1208 v_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);
1209
1210 /* Setup data buffers for txq */
1211 err = btintel_pcie_setup_txq_bufs(data, &data->txq);
1212 if (err)
1213 goto exit_error_pool;
1214
1215 /* Setup data buffers for rxq */
1216 err = btintel_pcie_setup_rxq_bufs(data, &data->rxq);
1217 if (err)
1218 goto exit_error_txq;
1219
1220 /* Setup Index Array */
1221 btintel_pcie_setup_ia(data, p_addr, v_addr, &data->ia);
1222
1223 /* Setup Context Information */
1224 p_addr += sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 4;
1225 v_addr += sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 4;
1226
1227 data->ci = v_addr;
1228 data->ci_p_addr = p_addr;
1229
1230 /* Initialize the CI */
1231 btintel_pcie_init_ci(data, data->ci);
1232
1233 return 0;
1234
1235 exit_error_txq:
1236 btintel_pcie_free_txq_bufs(data, &data->txq);
1237 exit_error_pool:
1238 dma_pool_free(data->dma_pool, data->dma_v_addr, data->dma_p_addr);
1239 dma_pool_destroy(data->dma_pool);
1240 exit_error:
1241 return err;
1242 }
1243
btintel_pcie_open(struct hci_dev * hdev)1244 static int btintel_pcie_open(struct hci_dev *hdev)
1245 {
1246 bt_dev_dbg(hdev, "");
1247
1248 return 0;
1249 }
1250
btintel_pcie_close(struct hci_dev * hdev)1251 static int btintel_pcie_close(struct hci_dev *hdev)
1252 {
1253 bt_dev_dbg(hdev, "");
1254
1255 return 0;
1256 }
1257
btintel_pcie_inject_cmd_complete(struct hci_dev * hdev,__u16 opcode)1258 static int btintel_pcie_inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1259 {
1260 struct sk_buff *skb;
1261 struct hci_event_hdr *hdr;
1262 struct hci_ev_cmd_complete *evt;
1263
1264 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
1265 if (!skb)
1266 return -ENOMEM;
1267
1268 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr));
1269 hdr->evt = HCI_EV_CMD_COMPLETE;
1270 hdr->plen = sizeof(*evt) + 1;
1271
1272 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt));
1273 evt->ncmd = 0x01;
1274 evt->opcode = cpu_to_le16(opcode);
1275
1276 *(u8 *)skb_put(skb, 1) = 0x00;
1277
1278 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1279
1280 return hci_recv_frame(hdev, skb);
1281 }
1282
btintel_pcie_send_frame(struct hci_dev * hdev,struct sk_buff * skb)1283 static int btintel_pcie_send_frame(struct hci_dev *hdev,
1284 struct sk_buff *skb)
1285 {
1286 struct btintel_pcie_data *data = hci_get_drvdata(hdev);
1287 struct hci_command_hdr *cmd;
1288 __u16 opcode = ~0;
1289 int ret;
1290 u32 type;
1291 u32 old_ctxt;
1292
1293 /* Due to the fw limitation, the type header of the packet should be
1294 * 4 bytes unlike 1 byte for UART. In UART, the firmware can read
1295 * the first byte to get the packet type and redirect the rest of data
1296 * packet to the right handler.
1297 *
1298 * But for PCIe, THF(Transfer Flow Handler) fetches the 4 bytes of data
1299 * from DMA memory and by the time it reads the first 4 bytes, it has
1300 * already consumed some part of packet. Thus the packet type indicator
1301 * for iBT PCIe is 4 bytes.
1302 *
1303 * Luckily, when HCI core creates the skb, it allocates 8 bytes of
1304 * head room for profile and driver use, and before sending the data
1305 * to the device, append the iBT PCIe packet type in the front.
1306 */
1307 switch (hci_skb_pkt_type(skb)) {
1308 case HCI_COMMAND_PKT:
1309 type = BTINTEL_PCIE_HCI_CMD_PKT;
1310 cmd = (void *)skb->data;
1311 opcode = le16_to_cpu(cmd->opcode);
1312 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1313 struct hci_command_hdr *cmd = (void *)skb->data;
1314 __u16 opcode = le16_to_cpu(cmd->opcode);
1315
1316 /* When the 0xfc01 command is issued to boot into
1317 * the operational firmware, it will actually not
1318 * send a command complete event. To keep the flow
1319 * control working inject that event here.
1320 */
1321 if (opcode == 0xfc01)
1322 btintel_pcie_inject_cmd_complete(hdev, opcode);
1323 }
1324 /* Firmware raises alive interrupt on HCI_OP_RESET */
1325 if (opcode == HCI_OP_RESET)
1326 data->gp0_received = false;
1327
1328 hdev->stat.cmd_tx++;
1329 break;
1330 case HCI_ACLDATA_PKT:
1331 type = BTINTEL_PCIE_HCI_ACL_PKT;
1332 hdev->stat.acl_tx++;
1333 break;
1334 case HCI_SCODATA_PKT:
1335 type = BTINTEL_PCIE_HCI_SCO_PKT;
1336 hdev->stat.sco_tx++;
1337 break;
1338 case HCI_ISODATA_PKT:
1339 type = BTINTEL_PCIE_HCI_ISO_PKT;
1340 break;
1341 default:
1342 bt_dev_err(hdev, "Unknown HCI packet type");
1343 return -EILSEQ;
1344 }
1345 memcpy(skb_push(skb, BTINTEL_PCIE_HCI_TYPE_LEN), &type,
1346 BTINTEL_PCIE_HCI_TYPE_LEN);
1347
1348 ret = btintel_pcie_send_sync(data, skb);
1349 if (ret) {
1350 hdev->stat.err_tx++;
1351 bt_dev_err(hdev, "Failed to send frame (%d)", ret);
1352 goto exit_error;
1353 }
1354
1355 if (type == BTINTEL_PCIE_HCI_CMD_PKT &&
1356 (opcode == HCI_OP_RESET || opcode == 0xfc01)) {
1357 old_ctxt = data->alive_intr_ctxt;
1358 data->alive_intr_ctxt =
1359 (opcode == 0xfc01 ? BTINTEL_PCIE_INTEL_HCI_RESET1 :
1360 BTINTEL_PCIE_HCI_RESET);
1361 bt_dev_dbg(data->hdev, "sent cmd: 0x%4.4x alive context changed: %s -> %s",
1362 opcode, btintel_pcie_alivectxt_state2str(old_ctxt),
1363 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));
1364 if (opcode == HCI_OP_RESET) {
1365 ret = wait_event_timeout(data->gp0_wait_q,
1366 data->gp0_received,
1367 msecs_to_jiffies(BTINTEL_DEFAULT_INTR_TIMEOUT_MS));
1368 if (!ret) {
1369 hdev->stat.err_tx++;
1370 bt_dev_err(hdev, "No alive interrupt received for %s",
1371 btintel_pcie_alivectxt_state2str(data->alive_intr_ctxt));
1372 ret = -ETIME;
1373 goto exit_error;
1374 }
1375 }
1376 }
1377 hdev->stat.byte_tx += skb->len;
1378 kfree_skb(skb);
1379
1380 exit_error:
1381 return ret;
1382 }
1383
btintel_pcie_release_hdev(struct btintel_pcie_data * data)1384 static void btintel_pcie_release_hdev(struct btintel_pcie_data *data)
1385 {
1386 struct hci_dev *hdev;
1387
1388 hdev = data->hdev;
1389 hci_unregister_dev(hdev);
1390 hci_free_dev(hdev);
1391 data->hdev = NULL;
1392 }
1393
btintel_pcie_setup_internal(struct hci_dev * hdev)1394 static int btintel_pcie_setup_internal(struct hci_dev *hdev)
1395 {
1396 const u8 param[1] = { 0xFF };
1397 struct intel_version_tlv ver_tlv;
1398 struct sk_buff *skb;
1399 int err;
1400
1401 BT_DBG("%s", hdev->name);
1402
1403 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
1404 if (IS_ERR(skb)) {
1405 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
1406 PTR_ERR(skb));
1407 return PTR_ERR(skb);
1408 }
1409
1410 /* Check the status */
1411 if (skb->data[0]) {
1412 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
1413 skb->data[0]);
1414 err = -EIO;
1415 goto exit_error;
1416 }
1417
1418 /* Apply the common HCI quirks for Intel device */
1419 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
1420 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1421 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
1422
1423 /* Set up the quality report callback for Intel devices */
1424 hdev->set_quality_report = btintel_set_quality_report;
1425
1426 memset(&ver_tlv, 0, sizeof(ver_tlv));
1427 /* For TLV type device, parse the tlv data */
1428 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
1429 if (err) {
1430 bt_dev_err(hdev, "Failed to parse TLV version information");
1431 goto exit_error;
1432 }
1433
1434 switch (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)) {
1435 case 0x37:
1436 break;
1437 default:
1438 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
1439 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
1440 err = -EINVAL;
1441 goto exit_error;
1442 }
1443
1444 /* Check for supported iBT hardware variants of this firmware
1445 * loading method.
1446 *
1447 * This check has been put in place to ensure correct forward
1448 * compatibility options when newer hardware variants come
1449 * along.
1450 */
1451 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
1452 case 0x1e: /* BzrI */
1453 /* Display version information of TLV type */
1454 btintel_version_info_tlv(hdev, &ver_tlv);
1455
1456 /* Apply the device specific HCI quirks for TLV based devices
1457 *
1458 * All TLV based devices support WBS
1459 */
1460 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
1461
1462 /* Setup MSFT Extension support */
1463 btintel_set_msft_opcode(hdev,
1464 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
1465
1466 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
1467 if (err)
1468 goto exit_error;
1469 break;
1470 default:
1471 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
1472 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
1473 err = -EINVAL;
1474 goto exit_error;
1475 break;
1476 }
1477
1478 btintel_print_fseq_info(hdev);
1479 exit_error:
1480 kfree_skb(skb);
1481
1482 return err;
1483 }
1484
btintel_pcie_setup(struct hci_dev * hdev)1485 static int btintel_pcie_setup(struct hci_dev *hdev)
1486 {
1487 int err, fw_dl_retry = 0;
1488 struct btintel_pcie_data *data = hci_get_drvdata(hdev);
1489
1490 while ((err = btintel_pcie_setup_internal(hdev)) && fw_dl_retry++ < 1) {
1491 bt_dev_err(hdev, "Firmware download retry count: %d",
1492 fw_dl_retry);
1493 err = btintel_pcie_reset_bt(data);
1494 if (err) {
1495 bt_dev_err(hdev, "Failed to do shr reset: %d", err);
1496 break;
1497 }
1498 usleep_range(10000, 12000);
1499 btintel_pcie_reset_ia(data);
1500 btintel_pcie_config_msix(data);
1501 err = btintel_pcie_enable_bt(data);
1502 if (err) {
1503 bt_dev_err(hdev, "Failed to enable hardware: %d", err);
1504 break;
1505 }
1506 btintel_pcie_start_rx(data);
1507 }
1508 return err;
1509 }
1510
btintel_pcie_setup_hdev(struct btintel_pcie_data * data)1511 static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data)
1512 {
1513 int err;
1514 struct hci_dev *hdev;
1515
1516 hdev = hci_alloc_dev_priv(sizeof(struct btintel_data));
1517 if (!hdev)
1518 return -ENOMEM;
1519
1520 hdev->bus = HCI_PCI;
1521 hci_set_drvdata(hdev, data);
1522
1523 data->hdev = hdev;
1524 SET_HCIDEV_DEV(hdev, &data->pdev->dev);
1525
1526 hdev->manufacturer = 2;
1527 hdev->open = btintel_pcie_open;
1528 hdev->close = btintel_pcie_close;
1529 hdev->send = btintel_pcie_send_frame;
1530 hdev->setup = btintel_pcie_setup;
1531 hdev->shutdown = btintel_shutdown_combined;
1532 hdev->hw_error = btintel_hw_error;
1533 hdev->set_diag = btintel_set_diag;
1534 hdev->set_bdaddr = btintel_set_bdaddr;
1535
1536 err = hci_register_dev(hdev);
1537 if (err < 0) {
1538 BT_ERR("Failed to register to hdev (%d)", err);
1539 goto exit_error;
1540 }
1541
1542 return 0;
1543
1544 exit_error:
1545 hci_free_dev(hdev);
1546 return err;
1547 }
1548
btintel_pcie_probe(struct pci_dev * pdev,const struct pci_device_id * ent)1549 static int btintel_pcie_probe(struct pci_dev *pdev,
1550 const struct pci_device_id *ent)
1551 {
1552 int err;
1553 struct btintel_pcie_data *data;
1554
1555 if (!pdev)
1556 return -ENODEV;
1557
1558 data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
1559 if (!data)
1560 return -ENOMEM;
1561
1562 data->pdev = pdev;
1563
1564 spin_lock_init(&data->irq_lock);
1565 spin_lock_init(&data->hci_rx_lock);
1566
1567 init_waitqueue_head(&data->gp0_wait_q);
1568 data->gp0_received = false;
1569
1570 init_waitqueue_head(&data->tx_wait_q);
1571 data->tx_wait_done = false;
1572
1573 data->workqueue = alloc_ordered_workqueue(KBUILD_MODNAME, WQ_HIGHPRI);
1574 if (!data->workqueue)
1575 return -ENOMEM;
1576
1577 skb_queue_head_init(&data->rx_skb_q);
1578 INIT_WORK(&data->rx_work, btintel_pcie_rx_work);
1579
1580 data->boot_stage_cache = 0x00;
1581 data->img_resp_cache = 0x00;
1582
1583 err = btintel_pcie_config_pcie(pdev, data);
1584 if (err)
1585 goto exit_error;
1586
1587 pci_set_drvdata(pdev, data);
1588
1589 err = btintel_pcie_alloc(data);
1590 if (err)
1591 goto exit_error;
1592
1593 err = btintel_pcie_enable_bt(data);
1594 if (err)
1595 goto exit_error;
1596
1597 /* CNV information (CNVi and CNVr) is in CSR */
1598 data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
1599
1600 data->cnvr = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_RF_ID_REG);
1601
1602 err = btintel_pcie_start_rx(data);
1603 if (err)
1604 goto exit_error;
1605
1606 err = btintel_pcie_setup_hdev(data);
1607 if (err)
1608 goto exit_error;
1609
1610 bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
1611 data->cnvr);
1612 return 0;
1613
1614 exit_error:
1615 /* reset device before exit */
1616 btintel_pcie_reset_bt(data);
1617
1618 pci_clear_master(pdev);
1619
1620 pci_set_drvdata(pdev, NULL);
1621
1622 return err;
1623 }
1624
btintel_pcie_remove(struct pci_dev * pdev)1625 static void btintel_pcie_remove(struct pci_dev *pdev)
1626 {
1627 struct btintel_pcie_data *data;
1628
1629 data = pci_get_drvdata(pdev);
1630
1631 btintel_pcie_reset_bt(data);
1632 for (int i = 0; i < data->alloc_vecs; i++) {
1633 struct msix_entry *msix_entry;
1634
1635 msix_entry = &data->msix_entries[i];
1636 free_irq(msix_entry->vector, msix_entry);
1637 }
1638
1639 pci_free_irq_vectors(pdev);
1640
1641 btintel_pcie_release_hdev(data);
1642
1643 flush_work(&data->rx_work);
1644
1645 destroy_workqueue(data->workqueue);
1646
1647 btintel_pcie_free(data);
1648
1649 pci_clear_master(pdev);
1650
1651 pci_set_drvdata(pdev, NULL);
1652 }
1653
1654 static struct pci_driver btintel_pcie_driver = {
1655 .name = KBUILD_MODNAME,
1656 .id_table = btintel_pcie_table,
1657 .probe = btintel_pcie_probe,
1658 .remove = btintel_pcie_remove,
1659 };
1660 module_pci_driver(btintel_pcie_driver);
1661
1662 MODULE_AUTHOR("Tedd Ho-Jeong An <[email protected]>");
1663 MODULE_DESCRIPTION("Intel Bluetooth PCIe transport driver ver " VERSION);
1664 MODULE_VERSION(VERSION);
1665 MODULE_LICENSE("GPL");
1666