1
2
3
4
5
6
7#include <linux/module.h>
8#include <linux/firmware.h>
9
10#include <net/bluetooth/bluetooth.h>
11#include <net/bluetooth/hci_core.h>
12
13#include "btqca.h"
14
15#define VERSION "0.1"
16
17int qca_read_soc_version(struct hci_dev *hdev, struct qca_btsoc_version *ver,
18 enum qca_btsoc_type soc_type)
19{
20 struct sk_buff *skb;
21 struct edl_event_hdr *edl;
22 char cmd;
23 int err = 0;
24 u8 event_type = HCI_EV_VENDOR;
25 u8 rlen = sizeof(*edl) + sizeof(*ver);
26 u8 rtype = EDL_APP_VER_RES_EVT;
27
28 bt_dev_dbg(hdev, "QCA Version Request");
29
30
31
32
33
34 if (soc_type >= QCA_WCN3991) {
35 event_type = 0;
36 rlen += 1;
37 rtype = EDL_PATCH_VER_REQ_CMD;
38 }
39
40 cmd = EDL_PATCH_VER_REQ_CMD;
41 skb = __hci_cmd_sync_ev(hdev, EDL_PATCH_CMD_OPCODE, EDL_PATCH_CMD_LEN,
42 &cmd, event_type, HCI_INIT_TIMEOUT);
43 if (IS_ERR(skb)) {
44 err = PTR_ERR(skb);
45 bt_dev_err(hdev, "Reading QCA version information failed (%d)",
46 err);
47 return err;
48 }
49
50 if (skb->len != rlen) {
51 bt_dev_err(hdev, "QCA Version size mismatch len %d", skb->len);
52 err = -EILSEQ;
53 goto out;
54 }
55
56 edl = (struct edl_event_hdr *)(skb->data);
57 if (!edl) {
58 bt_dev_err(hdev, "QCA TLV with no header");
59 err = -EILSEQ;
60 goto out;
61 }
62
63 if (edl->cresp != EDL_CMD_REQ_RES_EVT ||
64 edl->rtype != rtype) {
65 bt_dev_err(hdev, "QCA Wrong packet received %d %d", edl->cresp,
66 edl->rtype);
67 err = -EIO;
68 goto out;
69 }
70
71 if (soc_type >= QCA_WCN3991)
72 memcpy(ver, edl->data + 1, sizeof(*ver));
73 else
74 memcpy(ver, &edl->data, sizeof(*ver));
75
76 bt_dev_info(hdev, "QCA Product ID :0x%08x",
77 le32_to_cpu(ver->product_id));
78 bt_dev_info(hdev, "QCA SOC Version :0x%08x",
79 le32_to_cpu(ver->soc_id));
80 bt_dev_info(hdev, "QCA ROM Version :0x%08x",
81 le16_to_cpu(ver->rom_ver));
82 bt_dev_info(hdev, "QCA Patch Version:0x%08x",
83 le16_to_cpu(ver->patch_ver));
84
85 if (ver->soc_id == 0 || ver->rom_ver == 0)
86 err = -EILSEQ;
87
88out:
89 kfree_skb(skb);
90 if (err)
91 bt_dev_err(hdev, "QCA Failed to get version (%d)", err);
92
93 return err;
94}
95EXPORT_SYMBOL_GPL(qca_read_soc_version);
96
97static int qca_read_fw_build_info(struct hci_dev *hdev)
98{
99 struct sk_buff *skb;
100 struct edl_event_hdr *edl;
101 char cmd, build_label[QCA_FW_BUILD_VER_LEN];
102 int build_lbl_len, err = 0;
103
104 bt_dev_dbg(hdev, "QCA read fw build info");
105
106 cmd = EDL_GET_BUILD_INFO_CMD;
107 skb = __hci_cmd_sync_ev(hdev, EDL_PATCH_CMD_OPCODE, EDL_PATCH_CMD_LEN,
108 &cmd, 0, HCI_INIT_TIMEOUT);
109 if (IS_ERR(skb)) {
110 err = PTR_ERR(skb);
111 bt_dev_err(hdev, "Reading QCA fw build info failed (%d)",
112 err);
113 return err;
114 }
115
116 edl = (struct edl_event_hdr *)(skb->data);
117 if (!edl) {
118 bt_dev_err(hdev, "QCA read fw build info with no header");
119 err = -EILSEQ;
120 goto out;
121 }
122
123 if (edl->cresp != EDL_CMD_REQ_RES_EVT ||
124 edl->rtype != EDL_GET_BUILD_INFO_CMD) {
125 bt_dev_err(hdev, "QCA Wrong packet received %d %d", edl->cresp,
126 edl->rtype);
127 err = -EIO;
128 goto out;
129 }
130
131 build_lbl_len = edl->data[0];
132 if (build_lbl_len <= QCA_FW_BUILD_VER_LEN - 1) {
133 memcpy(build_label, edl->data + 1, build_lbl_len);
134 *(build_label + build_lbl_len) = '\0';
135 }
136
137 hci_set_fw_info(hdev, "%s", build_label);
138
139out:
140 kfree_skb(skb);
141 return err;
142}
143
144static int qca_send_reset(struct hci_dev *hdev)
145{
146 struct sk_buff *skb;
147 int err;
148
149 bt_dev_dbg(hdev, "QCA HCI_RESET");
150
151 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
152 if (IS_ERR(skb)) {
153 err = PTR_ERR(skb);
154 bt_dev_err(hdev, "QCA Reset failed (%d)", err);
155 return err;
156 }
157
158 kfree_skb(skb);
159
160 return 0;
161}
162
163int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
164{
165 struct sk_buff *skb;
166 int err;
167
168 bt_dev_dbg(hdev, "QCA pre shutdown cmd");
169
170 skb = __hci_cmd_sync_ev(hdev, QCA_PRE_SHUTDOWN_CMD, 0,
171 NULL, HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
172
173 if (IS_ERR(skb)) {
174 err = PTR_ERR(skb);
175 bt_dev_err(hdev, "QCA preshutdown_cmd failed (%d)", err);
176 return err;
177 }
178
179 kfree_skb(skb);
180
181 return 0;
182}
183EXPORT_SYMBOL_GPL(qca_send_pre_shutdown_cmd);
184
185static void qca_tlv_check_data(struct qca_fw_config *config,
186 const struct firmware *fw, enum qca_btsoc_type soc_type)
187{
188 const u8 *data;
189 u32 type_len;
190 u16 tag_id, tag_len;
191 int idx, length;
192 struct tlv_type_hdr *tlv;
193 struct tlv_type_patch *tlv_patch;
194 struct tlv_type_nvm *tlv_nvm;
195 uint8_t nvm_baud_rate = config->user_baud_rate;
196
197 tlv = (struct tlv_type_hdr *)fw->data;
198
199 type_len = le32_to_cpu(tlv->type_len);
200 length = (type_len >> 8) & 0x00ffffff;
201
202 BT_DBG("TLV Type\t\t : 0x%x", type_len & 0x000000ff);
203 BT_DBG("Length\t\t : %d bytes", length);
204
205 config->dnld_mode = QCA_SKIP_EVT_NONE;
206 config->dnld_type = QCA_SKIP_EVT_NONE;
207
208 switch (config->type) {
209 case TLV_TYPE_PATCH:
210 tlv_patch = (struct tlv_type_patch *)tlv->data;
211
212
213
214
215
216
217
218 config->dnld_mode = tlv_patch->download_mode;
219 config->dnld_type = config->dnld_mode;
220
221 BT_DBG("Total Length : %d bytes",
222 le32_to_cpu(tlv_patch->total_size));
223 BT_DBG("Patch Data Length : %d bytes",
224 le32_to_cpu(tlv_patch->data_length));
225 BT_DBG("Signing Format Version : 0x%x",
226 tlv_patch->format_version);
227 BT_DBG("Signature Algorithm : 0x%x",
228 tlv_patch->signature);
229 BT_DBG("Download mode : 0x%x",
230 tlv_patch->download_mode);
231 BT_DBG("Reserved : 0x%x",
232 tlv_patch->reserved1);
233 BT_DBG("Product ID : 0x%04x",
234 le16_to_cpu(tlv_patch->product_id));
235 BT_DBG("Rom Build Version : 0x%04x",
236 le16_to_cpu(tlv_patch->rom_build));
237 BT_DBG("Patch Version : 0x%04x",
238 le16_to_cpu(tlv_patch->patch_version));
239 BT_DBG("Reserved : 0x%x",
240 le16_to_cpu(tlv_patch->reserved2));
241 BT_DBG("Patch Entry Address : 0x%x",
242 le32_to_cpu(tlv_patch->entry));
243 break;
244
245 case TLV_TYPE_NVM:
246 idx = 0;
247 data = tlv->data;
248 while (idx < length) {
249 tlv_nvm = (struct tlv_type_nvm *)(data + idx);
250
251 tag_id = le16_to_cpu(tlv_nvm->tag_id);
252 tag_len = le16_to_cpu(tlv_nvm->tag_len);
253
254
255 switch (tag_id) {
256 case EDL_TAG_ID_HCI:
257
258
259
260
261 tlv_nvm->data[0] |= 0x80;
262
263
264 if (soc_type >= QCA_WCN3991)
265 tlv_nvm->data[1] = nvm_baud_rate;
266 else
267 tlv_nvm->data[2] = nvm_baud_rate;
268
269 break;
270
271 case EDL_TAG_ID_DEEP_SLEEP:
272
273
274
275 tlv_nvm->data[0] |= 0x01;
276
277 break;
278 }
279
280 idx += (sizeof(u16) + sizeof(u16) + 8 + tag_len);
281 }
282 break;
283
284 default:
285 BT_ERR("Unknown TLV type %d", config->type);
286 break;
287 }
288}
289
290static int qca_tlv_send_segment(struct hci_dev *hdev, int seg_size,
291 const u8 *data, enum qca_tlv_dnld_mode mode,
292 enum qca_btsoc_type soc_type)
293{
294 struct sk_buff *skb;
295 struct edl_event_hdr *edl;
296 struct tlv_seg_resp *tlv_resp;
297 u8 cmd[MAX_SIZE_PER_TLV_SEGMENT + 2];
298 int err = 0;
299 u8 event_type = HCI_EV_VENDOR;
300 u8 rlen = (sizeof(*edl) + sizeof(*tlv_resp));
301 u8 rtype = EDL_TVL_DNLD_RES_EVT;
302
303 cmd[0] = EDL_PATCH_TLV_REQ_CMD;
304 cmd[1] = seg_size;
305 memcpy(cmd + 2, data, seg_size);
306
307 if (mode == QCA_SKIP_EVT_VSE_CC || mode == QCA_SKIP_EVT_VSE)
308 return __hci_cmd_send(hdev, EDL_PATCH_CMD_OPCODE, seg_size + 2,
309 cmd);
310
311
312
313
314
315 if (soc_type >= QCA_WCN3991) {
316 event_type = 0;
317 rlen = sizeof(*edl);
318 rtype = EDL_PATCH_TLV_REQ_CMD;
319 }
320
321 skb = __hci_cmd_sync_ev(hdev, EDL_PATCH_CMD_OPCODE, seg_size + 2, cmd,
322 event_type, HCI_INIT_TIMEOUT);
323 if (IS_ERR(skb)) {
324 err = PTR_ERR(skb);
325 bt_dev_err(hdev, "QCA Failed to send TLV segment (%d)", err);
326 return err;
327 }
328
329 if (skb->len != rlen) {
330 bt_dev_err(hdev, "QCA TLV response size mismatch");
331 err = -EILSEQ;
332 goto out;
333 }
334
335 edl = (struct edl_event_hdr *)(skb->data);
336 if (!edl) {
337 bt_dev_err(hdev, "TLV with no header");
338 err = -EILSEQ;
339 goto out;
340 }
341
342 if (edl->cresp != EDL_CMD_REQ_RES_EVT || edl->rtype != rtype) {
343 bt_dev_err(hdev, "QCA TLV with error stat 0x%x rtype 0x%x",
344 edl->cresp, edl->rtype);
345 err = -EIO;
346 }
347
348 if (soc_type >= QCA_WCN3991)
349 goto out;
350
351 tlv_resp = (struct tlv_seg_resp *)(edl->data);
352 if (tlv_resp->result) {
353 bt_dev_err(hdev, "QCA TLV with error stat 0x%x rtype 0x%x (0x%x)",
354 edl->cresp, edl->rtype, tlv_resp->result);
355 }
356
357out:
358 kfree_skb(skb);
359
360 return err;
361}
362
363static int qca_inject_cmd_complete_event(struct hci_dev *hdev)
364{
365 struct hci_event_hdr *hdr;
366 struct hci_ev_cmd_complete *evt;
367 struct sk_buff *skb;
368
369 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
370 if (!skb)
371 return -ENOMEM;
372
373 hdr = skb_put(skb, sizeof(*hdr));
374 hdr->evt = HCI_EV_CMD_COMPLETE;
375 hdr->plen = sizeof(*evt) + 1;
376
377 evt = skb_put(skb, sizeof(*evt));
378 evt->ncmd = 1;
379 evt->opcode = cpu_to_le16(QCA_HCI_CC_OPCODE);
380
381 skb_put_u8(skb, QCA_HCI_CC_SUCCESS);
382
383 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
384
385 return hci_recv_frame(hdev, skb);
386}
387
388static int qca_download_firmware(struct hci_dev *hdev,
389 struct qca_fw_config *config,
390 enum qca_btsoc_type soc_type)
391{
392 const struct firmware *fw;
393 const u8 *segment;
394 int ret, remain, i = 0;
395
396 bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
397
398 ret = request_firmware(&fw, config->fwname, &hdev->dev);
399 if (ret) {
400 bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
401 config->fwname, ret);
402 return ret;
403 }
404
405 qca_tlv_check_data(config, fw, soc_type);
406
407 segment = fw->data;
408 remain = fw->size;
409 while (remain > 0) {
410 int segsize = min(MAX_SIZE_PER_TLV_SEGMENT, remain);
411
412 bt_dev_dbg(hdev, "Send segment %d, size %d", i++, segsize);
413
414 remain -= segsize;
415
416 if (!remain || segsize < MAX_SIZE_PER_TLV_SEGMENT)
417 config->dnld_mode = QCA_SKIP_EVT_NONE;
418
419 ret = qca_tlv_send_segment(hdev, segsize, segment,
420 config->dnld_mode, soc_type);
421 if (ret)
422 goto out;
423
424 segment += segsize;
425 }
426
427
428
429
430
431
432
433 if (config->dnld_type == QCA_SKIP_EVT_VSE_CC ||
434 config->dnld_type == QCA_SKIP_EVT_VSE)
435 ret = qca_inject_cmd_complete_event(hdev);
436
437out:
438 release_firmware(fw);
439
440 return ret;
441}
442
443static int qca_disable_soc_logging(struct hci_dev *hdev)
444{
445 struct sk_buff *skb;
446 u8 cmd[2];
447 int err;
448
449 cmd[0] = QCA_DISABLE_LOGGING_SUB_OP;
450 cmd[1] = 0x00;
451 skb = __hci_cmd_sync_ev(hdev, QCA_DISABLE_LOGGING, sizeof(cmd), cmd,
452 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
453 if (IS_ERR(skb)) {
454 err = PTR_ERR(skb);
455 bt_dev_err(hdev, "QCA Failed to disable soc logging(%d)", err);
456 return err;
457 }
458
459 kfree_skb(skb);
460
461 return 0;
462}
463
464int qca_set_bdaddr_rome(struct hci_dev *hdev, const bdaddr_t *bdaddr)
465{
466 struct sk_buff *skb;
467 u8 cmd[9];
468 int err;
469
470 cmd[0] = EDL_NVM_ACCESS_SET_REQ_CMD;
471 cmd[1] = 0x02;
472 cmd[2] = sizeof(bdaddr_t);
473 memcpy(cmd + 3, bdaddr, sizeof(bdaddr_t));
474 skb = __hci_cmd_sync_ev(hdev, EDL_NVM_ACCESS_OPCODE, sizeof(cmd), cmd,
475 HCI_EV_VENDOR, HCI_INIT_TIMEOUT);
476 if (IS_ERR(skb)) {
477 err = PTR_ERR(skb);
478 bt_dev_err(hdev, "QCA Change address command failed (%d)", err);
479 return err;
480 }
481
482 kfree_skb(skb);
483
484 return 0;
485}
486EXPORT_SYMBOL_GPL(qca_set_bdaddr_rome);
487
488int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
489 enum qca_btsoc_type soc_type, struct qca_btsoc_version ver,
490 const char *firmware_name)
491{
492 struct qca_fw_config config;
493 int err;
494 u8 rom_ver = 0;
495 u32 soc_ver;
496
497 bt_dev_dbg(hdev, "QCA setup on UART");
498
499 soc_ver = get_soc_ver(ver.soc_id, ver.rom_ver);
500
501 bt_dev_info(hdev, "QCA controller version 0x%08x", soc_ver);
502
503 config.user_baud_rate = baudrate;
504
505
506 config.type = TLV_TYPE_PATCH;
507 if (qca_is_wcn399x(soc_type)) {
508
509
510
511 rom_ver = ((soc_ver & 0x00000f00) >> 0x04) |
512 (soc_ver & 0x0000000f);
513 snprintf(config.fwname, sizeof(config.fwname),
514 "qca/crbtfw%02x.tlv", rom_ver);
515 } else if (soc_type == QCA_QCA6390) {
516 rom_ver = ((soc_ver & 0x00000f00) >> 0x04) |
517 (soc_ver & 0x0000000f);
518 snprintf(config.fwname, sizeof(config.fwname),
519 "qca/htbtfw%02x.tlv", rom_ver);
520 } else {
521 snprintf(config.fwname, sizeof(config.fwname),
522 "qca/rampatch_%08x.bin", soc_ver);
523 }
524
525 err = qca_download_firmware(hdev, &config, soc_type);
526 if (err < 0) {
527 bt_dev_err(hdev, "QCA Failed to download patch (%d)", err);
528 return err;
529 }
530
531
532 msleep(10);
533
534
535 config.type = TLV_TYPE_NVM;
536 if (firmware_name)
537 snprintf(config.fwname, sizeof(config.fwname),
538 "qca/%s", firmware_name);
539 else if (qca_is_wcn399x(soc_type)) {
540 if (ver.soc_id == QCA_WCN3991_SOC_ID) {
541 snprintf(config.fwname, sizeof(config.fwname),
542 "qca/crnv%02xu.bin", rom_ver);
543 } else {
544 snprintf(config.fwname, sizeof(config.fwname),
545 "qca/crnv%02x.bin", rom_ver);
546 }
547 }
548 else if (soc_type == QCA_QCA6390)
549 snprintf(config.fwname, sizeof(config.fwname),
550 "qca/htnv%02x.bin", rom_ver);
551 else
552 snprintf(config.fwname, sizeof(config.fwname),
553 "qca/nvm_%08x.bin", soc_ver);
554
555 err = qca_download_firmware(hdev, &config, soc_type);
556 if (err < 0) {
557 bt_dev_err(hdev, "QCA Failed to download NVM (%d)", err);
558 return err;
559 }
560
561 if (soc_type >= QCA_WCN3991) {
562 err = qca_disable_soc_logging(hdev);
563 if (err < 0)
564 return err;
565 }
566
567
568
569
570 switch (soc_type) {
571 case QCA_WCN3990:
572 case QCA_WCN3991:
573 case QCA_WCN3998:
574 hci_set_msft_opcode(hdev, 0xFD70);
575 break;
576 default:
577 break;
578 }
579
580
581 err = qca_send_reset(hdev);
582 if (err < 0) {
583 bt_dev_err(hdev, "QCA Failed to run HCI_RESET (%d)", err);
584 return err;
585 }
586
587 if (soc_type == QCA_WCN3991) {
588
589 err = qca_read_fw_build_info(hdev);
590 if (err < 0)
591 return err;
592 }
593
594 bt_dev_info(hdev, "QCA setup on UART is completed");
595
596 return 0;
597}
598EXPORT_SYMBOL_GPL(qca_uart_setup);
599
600int qca_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
601{
602 struct sk_buff *skb;
603 int err;
604
605 skb = __hci_cmd_sync_ev(hdev, EDL_WRITE_BD_ADDR_OPCODE, 6, bdaddr,
606 HCI_EV_VENDOR, HCI_INIT_TIMEOUT);
607 if (IS_ERR(skb)) {
608 err = PTR_ERR(skb);
609 bt_dev_err(hdev, "QCA Change address cmd failed (%d)", err);
610 return err;
611 }
612
613 kfree_skb(skb);
614
615 return 0;
616}
617EXPORT_SYMBOL_GPL(qca_set_bdaddr);
618
619
620MODULE_AUTHOR("Ben Young Tae Kim <ytkim@qca.qualcomm.com>");
621MODULE_DESCRIPTION("Bluetooth support for Qualcomm Atheros family ver " VERSION);
622MODULE_VERSION(VERSION);
623MODULE_LICENSE("GPL");
624
