cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

btmtksdio.c (35617B)


      1// SPDX-License-Identifier: GPL-2.0
      2// Copyright (c) 2019 MediaTek Inc.
      3
      4/*
      5 * Bluetooth support for MediaTek SDIO devices
      6 *
      7 * This file is written based on btsdio.c and btmtkuart.c.
      8 *
      9 * Author: Sean Wang <sean.wang@mediatek.com>
     10 *
     11 */
     12
     13#include <asm/unaligned.h>
     14#include <linux/atomic.h>
     15#include <linux/gpio/consumer.h>
     16#include <linux/init.h>
     17#include <linux/iopoll.h>
     18#include <linux/kernel.h>
     19#include <linux/module.h>
     20#include <linux/of.h>
     21#include <linux/pm_runtime.h>
     22#include <linux/skbuff.h>
     23
     24#include <linux/mmc/host.h>
     25#include <linux/mmc/sdio_ids.h>
     26#include <linux/mmc/sdio_func.h>
     27
     28#include <net/bluetooth/bluetooth.h>
     29#include <net/bluetooth/hci_core.h>
     30
     31#include "h4_recv.h"
     32#include "btmtk.h"
     33
     34#define VERSION "0.1"
     35
     36#define MTKBTSDIO_AUTOSUSPEND_DELAY	1000
     37
     38static bool enable_autosuspend = true;
     39
     40struct btmtksdio_data {
     41	const char *fwname;
     42	u16 chipid;
     43	bool lp_mbox_supported;
     44};
     45
     46static const struct btmtksdio_data mt7663_data = {
     47	.fwname = FIRMWARE_MT7663,
     48	.chipid = 0x7663,
     49	.lp_mbox_supported = false,
     50};
     51
     52static const struct btmtksdio_data mt7668_data = {
     53	.fwname = FIRMWARE_MT7668,
     54	.chipid = 0x7668,
     55	.lp_mbox_supported = false,
     56};
     57
     58static const struct btmtksdio_data mt7921_data = {
     59	.fwname = FIRMWARE_MT7961,
     60	.chipid = 0x7921,
     61	.lp_mbox_supported = true,
     62};
     63
     64static const struct sdio_device_id btmtksdio_table[] = {
     65	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7663),
     66	 .driver_data = (kernel_ulong_t)&mt7663_data },
     67	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7668),
     68	 .driver_data = (kernel_ulong_t)&mt7668_data },
     69	{SDIO_DEVICE(SDIO_VENDOR_ID_MEDIATEK, SDIO_DEVICE_ID_MEDIATEK_MT7961),
     70	 .driver_data = (kernel_ulong_t)&mt7921_data },
     71	{ }	/* Terminating entry */
     72};
     73MODULE_DEVICE_TABLE(sdio, btmtksdio_table);
     74
     75#define MTK_REG_CHLPCR		0x4	/* W1S */
     76#define C_INT_EN_SET		BIT(0)
     77#define C_INT_EN_CLR		BIT(1)
     78#define C_FW_OWN_REQ_SET	BIT(8)  /* For write */
     79#define C_COM_DRV_OWN		BIT(8)  /* For read */
     80#define C_FW_OWN_REQ_CLR	BIT(9)
     81
     82#define MTK_REG_CSDIOCSR	0x8
     83#define SDIO_RE_INIT_EN		BIT(0)
     84#define SDIO_INT_CTL		BIT(2)
     85
     86#define MTK_REG_CHCR		0xc
     87#define C_INT_CLR_CTRL		BIT(1)
     88#define BT_RST_DONE		BIT(8)
     89
     90/* CHISR have the same bits field definition with CHIER */
     91#define MTK_REG_CHISR		0x10
     92#define MTK_REG_CHIER		0x14
     93#define FW_OWN_BACK_INT		BIT(0)
     94#define RX_DONE_INT		BIT(1)
     95#define TX_EMPTY		BIT(2)
     96#define TX_FIFO_OVERFLOW	BIT(8)
     97#define FW_MAILBOX_INT		BIT(15)
     98#define INT_MASK		GENMASK(15, 0)
     99#define RX_PKT_LEN		GENMASK(31, 16)
    100
    101#define MTK_REG_CSICR		0xc0
    102#define CSICR_CLR_MBOX_ACK BIT(0)
    103#define MTK_REG_PH2DSM0R	0xc4
    104#define PH2DSM0R_DRIVER_OWN	BIT(0)
    105#define MTK_REG_PD2HRM0R	0xdc
    106#define PD2HRM0R_DRV_OWN	BIT(0)
    107
    108#define MTK_REG_CTDR		0x18
    109
    110#define MTK_REG_CRDR		0x1c
    111
    112#define MTK_REG_CRPLR		0x24
    113
    114#define MTK_SDIO_BLOCK_SIZE	256
    115
    116#define BTMTKSDIO_TX_WAIT_VND_EVT	1
    117#define BTMTKSDIO_HW_TX_READY		2
    118#define BTMTKSDIO_FUNC_ENABLED		3
    119#define BTMTKSDIO_PATCH_ENABLED		4
    120#define BTMTKSDIO_HW_RESET_ACTIVE	5
    121
    122struct mtkbtsdio_hdr {
    123	__le16	len;
    124	__le16	reserved;
    125	u8	bt_type;
    126} __packed;
    127
    128struct btmtksdio_dev {
    129	struct hci_dev *hdev;
    130	struct sdio_func *func;
    131	struct device *dev;
    132
    133	struct work_struct txrx_work;
    134	unsigned long tx_state;
    135	struct sk_buff_head txq;
    136
    137	struct sk_buff *evt_skb;
    138
    139	const struct btmtksdio_data *data;
    140
    141	struct gpio_desc *reset;
    142};
    143
    144static int mtk_hci_wmt_sync(struct hci_dev *hdev,
    145			    struct btmtk_hci_wmt_params *wmt_params)
    146{
    147	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    148	struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
    149	struct btmtk_hci_wmt_evt_reg *wmt_evt_reg;
    150	u32 hlen, status = BTMTK_WMT_INVALID;
    151	struct btmtk_hci_wmt_evt *wmt_evt;
    152	struct btmtk_hci_wmt_cmd *wc;
    153	struct btmtk_wmt_hdr *hdr;
    154	int err;
    155
    156	/* Send the WMT command and wait until the WMT event returns */
    157	hlen = sizeof(*hdr) + wmt_params->dlen;
    158	if (hlen > 255)
    159		return -EINVAL;
    160
    161	wc = kzalloc(hlen, GFP_KERNEL);
    162	if (!wc)
    163		return -ENOMEM;
    164
    165	hdr = &wc->hdr;
    166	hdr->dir = 1;
    167	hdr->op = wmt_params->op;
    168	hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
    169	hdr->flag = wmt_params->flag;
    170	memcpy(wc->data, wmt_params->data, wmt_params->dlen);
    171
    172	set_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
    173
    174	err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
    175	if (err < 0) {
    176		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
    177		goto err_free_wc;
    178	}
    179
    180	/* The vendor specific WMT commands are all answered by a vendor
    181	 * specific event and will not have the Command Status or Command
    182	 * Complete as with usual HCI command flow control.
    183	 *
    184	 * After sending the command, wait for BTMTKSDIO_TX_WAIT_VND_EVT
    185	 * state to be cleared. The driver specific event receive routine
    186	 * will clear that state and with that indicate completion of the
    187	 * WMT command.
    188	 */
    189	err = wait_on_bit_timeout(&bdev->tx_state, BTMTKSDIO_TX_WAIT_VND_EVT,
    190				  TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
    191	if (err == -EINTR) {
    192		bt_dev_err(hdev, "Execution of wmt command interrupted");
    193		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
    194		goto err_free_wc;
    195	}
    196
    197	if (err) {
    198		bt_dev_err(hdev, "Execution of wmt command timed out");
    199		clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state);
    200		err = -ETIMEDOUT;
    201		goto err_free_wc;
    202	}
    203
    204	/* Parse and handle the return WMT event */
    205	wmt_evt = (struct btmtk_hci_wmt_evt *)bdev->evt_skb->data;
    206	if (wmt_evt->whdr.op != hdr->op) {
    207		bt_dev_err(hdev, "Wrong op received %d expected %d",
    208			   wmt_evt->whdr.op, hdr->op);
    209		err = -EIO;
    210		goto err_free_skb;
    211	}
    212
    213	switch (wmt_evt->whdr.op) {
    214	case BTMTK_WMT_SEMAPHORE:
    215		if (wmt_evt->whdr.flag == 2)
    216			status = BTMTK_WMT_PATCH_UNDONE;
    217		else
    218			status = BTMTK_WMT_PATCH_DONE;
    219		break;
    220	case BTMTK_WMT_FUNC_CTRL:
    221		wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
    222		if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
    223			status = BTMTK_WMT_ON_DONE;
    224		else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
    225			status = BTMTK_WMT_ON_PROGRESS;
    226		else
    227			status = BTMTK_WMT_ON_UNDONE;
    228		break;
    229	case BTMTK_WMT_PATCH_DWNLD:
    230		if (wmt_evt->whdr.flag == 2)
    231			status = BTMTK_WMT_PATCH_DONE;
    232		else if (wmt_evt->whdr.flag == 1)
    233			status = BTMTK_WMT_PATCH_PROGRESS;
    234		else
    235			status = BTMTK_WMT_PATCH_UNDONE;
    236		break;
    237	case BTMTK_WMT_REGISTER:
    238		wmt_evt_reg = (struct btmtk_hci_wmt_evt_reg *)wmt_evt;
    239		if (le16_to_cpu(wmt_evt->whdr.dlen) == 12)
    240			status = le32_to_cpu(wmt_evt_reg->val);
    241		break;
    242	}
    243
    244	if (wmt_params->status)
    245		*wmt_params->status = status;
    246
    247err_free_skb:
    248	kfree_skb(bdev->evt_skb);
    249	bdev->evt_skb = NULL;
    250err_free_wc:
    251	kfree(wc);
    252
    253	return err;
    254}
    255
    256static int btmtksdio_tx_packet(struct btmtksdio_dev *bdev,
    257			       struct sk_buff *skb)
    258{
    259	struct mtkbtsdio_hdr *sdio_hdr;
    260	int err;
    261
    262	/* Make sure that there are enough rooms for SDIO header */
    263	if (unlikely(skb_headroom(skb) < sizeof(*sdio_hdr))) {
    264		err = pskb_expand_head(skb, sizeof(*sdio_hdr), 0,
    265				       GFP_ATOMIC);
    266		if (err < 0)
    267			return err;
    268	}
    269
    270	/* Prepend MediaTek SDIO Specific Header */
    271	skb_push(skb, sizeof(*sdio_hdr));
    272
    273	sdio_hdr = (void *)skb->data;
    274	sdio_hdr->len = cpu_to_le16(skb->len);
    275	sdio_hdr->reserved = cpu_to_le16(0);
    276	sdio_hdr->bt_type = hci_skb_pkt_type(skb);
    277
    278	clear_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
    279	err = sdio_writesb(bdev->func, MTK_REG_CTDR, skb->data,
    280			   round_up(skb->len, MTK_SDIO_BLOCK_SIZE));
    281	if (err < 0)
    282		goto err_skb_pull;
    283
    284	bdev->hdev->stat.byte_tx += skb->len;
    285
    286	kfree_skb(skb);
    287
    288	return 0;
    289
    290err_skb_pull:
    291	skb_pull(skb, sizeof(*sdio_hdr));
    292
    293	return err;
    294}
    295
    296static u32 btmtksdio_drv_own_query(struct btmtksdio_dev *bdev)
    297{
    298	return sdio_readl(bdev->func, MTK_REG_CHLPCR, NULL);
    299}
    300
    301static u32 btmtksdio_drv_own_query_79xx(struct btmtksdio_dev *bdev)
    302{
    303	return sdio_readl(bdev->func, MTK_REG_PD2HRM0R, NULL);
    304}
    305
    306static u32 btmtksdio_chcr_query(struct btmtksdio_dev *bdev)
    307{
    308	return sdio_readl(bdev->func, MTK_REG_CHCR, NULL);
    309}
    310
    311static int btmtksdio_fw_pmctrl(struct btmtksdio_dev *bdev)
    312{
    313	u32 status;
    314	int err;
    315
    316	sdio_claim_host(bdev->func);
    317
    318	if (bdev->data->lp_mbox_supported &&
    319	    test_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state)) {
    320		sdio_writel(bdev->func, CSICR_CLR_MBOX_ACK, MTK_REG_CSICR,
    321			    &err);
    322		err = readx_poll_timeout(btmtksdio_drv_own_query_79xx, bdev,
    323					 status, !(status & PD2HRM0R_DRV_OWN),
    324					 2000, 1000000);
    325		if (err < 0) {
    326			bt_dev_err(bdev->hdev, "mailbox ACK not cleared");
    327			goto out;
    328		}
    329	}
    330
    331	/* Return ownership to the device */
    332	sdio_writel(bdev->func, C_FW_OWN_REQ_SET, MTK_REG_CHLPCR, &err);
    333	if (err < 0)
    334		goto out;
    335
    336	err = readx_poll_timeout(btmtksdio_drv_own_query, bdev, status,
    337				 !(status & C_COM_DRV_OWN), 2000, 1000000);
    338
    339out:
    340	sdio_release_host(bdev->func);
    341
    342	if (err < 0)
    343		bt_dev_err(bdev->hdev, "Cannot return ownership to device");
    344
    345	return err;
    346}
    347
    348static int btmtksdio_drv_pmctrl(struct btmtksdio_dev *bdev)
    349{
    350	u32 status;
    351	int err;
    352
    353	sdio_claim_host(bdev->func);
    354
    355	/* Get ownership from the device */
    356	sdio_writel(bdev->func, C_FW_OWN_REQ_CLR, MTK_REG_CHLPCR, &err);
    357	if (err < 0)
    358		goto out;
    359
    360	err = readx_poll_timeout(btmtksdio_drv_own_query, bdev, status,
    361				 status & C_COM_DRV_OWN, 2000, 1000000);
    362
    363	if (!err && bdev->data->lp_mbox_supported &&
    364	    test_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state))
    365		err = readx_poll_timeout(btmtksdio_drv_own_query_79xx, bdev,
    366					 status, status & PD2HRM0R_DRV_OWN,
    367					 2000, 1000000);
    368
    369out:
    370	sdio_release_host(bdev->func);
    371
    372	if (err < 0)
    373		bt_dev_err(bdev->hdev, "Cannot get ownership from device");
    374
    375	return err;
    376}
    377
    378static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
    379{
    380	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    381	struct hci_event_hdr *hdr = (void *)skb->data;
    382	u8 evt = hdr->evt;
    383	int err;
    384
    385	/* When someone waits for the WMT event, the skb is being cloned
    386	 * and being processed the events from there then.
    387	 */
    388	if (test_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state)) {
    389		bdev->evt_skb = skb_clone(skb, GFP_KERNEL);
    390		if (!bdev->evt_skb) {
    391			err = -ENOMEM;
    392			goto err_out;
    393		}
    394	}
    395
    396	err = hci_recv_frame(hdev, skb);
    397	if (err < 0)
    398		goto err_free_skb;
    399
    400	if (evt == HCI_EV_WMT) {
    401		if (test_and_clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT,
    402				       &bdev->tx_state)) {
    403			/* Barrier to sync with other CPUs */
    404			smp_mb__after_atomic();
    405			wake_up_bit(&bdev->tx_state, BTMTKSDIO_TX_WAIT_VND_EVT);
    406		}
    407	}
    408
    409	return 0;
    410
    411err_free_skb:
    412	kfree_skb(bdev->evt_skb);
    413	bdev->evt_skb = NULL;
    414
    415err_out:
    416	return err;
    417}
    418
    419static int btmtksdio_recv_acl(struct hci_dev *hdev, struct sk_buff *skb)
    420{
    421	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    422	u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
    423
    424	switch (handle) {
    425	case 0xfc6f:
    426		/* Firmware dump from device: when the firmware hangs, the
    427		 * device can no longer suspend and thus disable auto-suspend.
    428		 */
    429		pm_runtime_forbid(bdev->dev);
    430		fallthrough;
    431	case 0x05ff:
    432	case 0x05fe:
    433		/* Firmware debug logging */
    434		return hci_recv_diag(hdev, skb);
    435	}
    436
    437	return hci_recv_frame(hdev, skb);
    438}
    439
    440static const struct h4_recv_pkt mtk_recv_pkts[] = {
    441	{ H4_RECV_ACL,      .recv = btmtksdio_recv_acl },
    442	{ H4_RECV_SCO,      .recv = hci_recv_frame },
    443	{ H4_RECV_EVENT,    .recv = btmtksdio_recv_event },
    444};
    445
    446static int btmtksdio_rx_packet(struct btmtksdio_dev *bdev, u16 rx_size)
    447{
    448	const struct h4_recv_pkt *pkts = mtk_recv_pkts;
    449	int pkts_count = ARRAY_SIZE(mtk_recv_pkts);
    450	struct mtkbtsdio_hdr *sdio_hdr;
    451	int err, i, pad_size;
    452	struct sk_buff *skb;
    453	u16 dlen;
    454
    455	if (rx_size < sizeof(*sdio_hdr))
    456		return -EILSEQ;
    457
    458	/* A SDIO packet is exactly containing a Bluetooth packet */
    459	skb = bt_skb_alloc(rx_size, GFP_KERNEL);
    460	if (!skb)
    461		return -ENOMEM;
    462
    463	skb_put(skb, rx_size);
    464
    465	err = sdio_readsb(bdev->func, skb->data, MTK_REG_CRDR, rx_size);
    466	if (err < 0)
    467		goto err_kfree_skb;
    468
    469	sdio_hdr = (void *)skb->data;
    470
    471	/* We assume the default error as -EILSEQ simply to make the error path
    472	 * be cleaner.
    473	 */
    474	err = -EILSEQ;
    475
    476	if (rx_size != le16_to_cpu(sdio_hdr->len)) {
    477		bt_dev_err(bdev->hdev, "Rx size in sdio header is mismatched ");
    478		goto err_kfree_skb;
    479	}
    480
    481	hci_skb_pkt_type(skb) = sdio_hdr->bt_type;
    482
    483	/* Remove MediaTek SDIO header */
    484	skb_pull(skb, sizeof(*sdio_hdr));
    485
    486	/* We have to dig into the packet to get payload size and then know how
    487	 * many padding bytes at the tail, these padding bytes should be removed
    488	 * before the packet is indicated to the core layer.
    489	 */
    490	for (i = 0; i < pkts_count; i++) {
    491		if (sdio_hdr->bt_type == (&pkts[i])->type)
    492			break;
    493	}
    494
    495	if (i >= pkts_count) {
    496		bt_dev_err(bdev->hdev, "Invalid bt type 0x%02x",
    497			   sdio_hdr->bt_type);
    498		goto err_kfree_skb;
    499	}
    500
    501	/* Remaining bytes cannot hold a header*/
    502	if (skb->len < (&pkts[i])->hlen) {
    503		bt_dev_err(bdev->hdev, "The size of bt header is mismatched");
    504		goto err_kfree_skb;
    505	}
    506
    507	switch ((&pkts[i])->lsize) {
    508	case 1:
    509		dlen = skb->data[(&pkts[i])->loff];
    510		break;
    511	case 2:
    512		dlen = get_unaligned_le16(skb->data +
    513						  (&pkts[i])->loff);
    514		break;
    515	default:
    516		goto err_kfree_skb;
    517	}
    518
    519	pad_size = skb->len - (&pkts[i])->hlen -  dlen;
    520
    521	/* Remaining bytes cannot hold a payload */
    522	if (pad_size < 0) {
    523		bt_dev_err(bdev->hdev, "The size of bt payload is mismatched");
    524		goto err_kfree_skb;
    525	}
    526
    527	/* Remove padding bytes */
    528	skb_trim(skb, skb->len - pad_size);
    529
    530	/* Complete frame */
    531	(&pkts[i])->recv(bdev->hdev, skb);
    532
    533	bdev->hdev->stat.byte_rx += rx_size;
    534
    535	return 0;
    536
    537err_kfree_skb:
    538	kfree_skb(skb);
    539
    540	return err;
    541}
    542
    543static void btmtksdio_txrx_work(struct work_struct *work)
    544{
    545	struct btmtksdio_dev *bdev = container_of(work, struct btmtksdio_dev,
    546						  txrx_work);
    547	unsigned long txrx_timeout;
    548	u32 int_status, rx_size;
    549	struct sk_buff *skb;
    550	int err;
    551
    552	pm_runtime_get_sync(bdev->dev);
    553
    554	sdio_claim_host(bdev->func);
    555
    556	/* Disable interrupt */
    557	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, 0);
    558
    559	txrx_timeout = jiffies + 5 * HZ;
    560
    561	do {
    562		int_status = sdio_readl(bdev->func, MTK_REG_CHISR, NULL);
    563
    564		/* Ack an interrupt as soon as possible before any operation on
    565		 * hardware.
    566		 *
    567		 * Note that we don't ack any status during operations to avoid race
    568		 * condition between the host and the device such as it's possible to
    569		 * mistakenly ack RX_DONE for the next packet and then cause interrupts
    570		 * not be raised again but there is still pending data in the hardware
    571		 * FIFO.
    572		 */
    573		sdio_writel(bdev->func, int_status, MTK_REG_CHISR, NULL);
    574		int_status &= INT_MASK;
    575
    576		if ((int_status & FW_MAILBOX_INT) &&
    577		    bdev->data->chipid == 0x7921) {
    578			sdio_writel(bdev->func, PH2DSM0R_DRIVER_OWN,
    579				    MTK_REG_PH2DSM0R, 0);
    580		}
    581
    582		if (int_status & FW_OWN_BACK_INT)
    583			bt_dev_dbg(bdev->hdev, "Get fw own back");
    584
    585		if (int_status & TX_EMPTY)
    586			set_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
    587
    588		else if (unlikely(int_status & TX_FIFO_OVERFLOW))
    589			bt_dev_warn(bdev->hdev, "Tx fifo overflow");
    590
    591		if (test_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state)) {
    592			skb = skb_dequeue(&bdev->txq);
    593			if (skb) {
    594				err = btmtksdio_tx_packet(bdev, skb);
    595				if (err < 0) {
    596					bdev->hdev->stat.err_tx++;
    597					skb_queue_head(&bdev->txq, skb);
    598				}
    599			}
    600		}
    601
    602		if (int_status & RX_DONE_INT) {
    603			rx_size = sdio_readl(bdev->func, MTK_REG_CRPLR, NULL);
    604			rx_size = (rx_size & RX_PKT_LEN) >> 16;
    605			if (btmtksdio_rx_packet(bdev, rx_size) < 0)
    606				bdev->hdev->stat.err_rx++;
    607		}
    608	} while (int_status || time_is_before_jiffies(txrx_timeout));
    609
    610	/* Enable interrupt */
    611	sdio_writel(bdev->func, C_INT_EN_SET, MTK_REG_CHLPCR, 0);
    612
    613	sdio_release_host(bdev->func);
    614
    615	pm_runtime_mark_last_busy(bdev->dev);
    616	pm_runtime_put_autosuspend(bdev->dev);
    617}
    618
    619static void btmtksdio_interrupt(struct sdio_func *func)
    620{
    621	struct btmtksdio_dev *bdev = sdio_get_drvdata(func);
    622
    623	/* Disable interrupt */
    624	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, 0);
    625
    626	schedule_work(&bdev->txrx_work);
    627}
    628
    629static int btmtksdio_open(struct hci_dev *hdev)
    630{
    631	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    632	u32 val;
    633	int err;
    634
    635	sdio_claim_host(bdev->func);
    636
    637	err = sdio_enable_func(bdev->func);
    638	if (err < 0)
    639		goto err_release_host;
    640
    641	set_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state);
    642
    643	err = btmtksdio_drv_pmctrl(bdev);
    644	if (err < 0)
    645		goto err_disable_func;
    646
    647	/* Disable interrupt & mask out all interrupt sources */
    648	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, &err);
    649	if (err < 0)
    650		goto err_disable_func;
    651
    652	sdio_writel(bdev->func, 0, MTK_REG_CHIER, &err);
    653	if (err < 0)
    654		goto err_disable_func;
    655
    656	err = sdio_claim_irq(bdev->func, btmtksdio_interrupt);
    657	if (err < 0)
    658		goto err_disable_func;
    659
    660	err = sdio_set_block_size(bdev->func, MTK_SDIO_BLOCK_SIZE);
    661	if (err < 0)
    662		goto err_release_irq;
    663
    664	/* SDIO CMD 5 allows the SDIO device back to idle state an
    665	 * synchronous interrupt is supported in SDIO 4-bit mode
    666	 */
    667	val = sdio_readl(bdev->func, MTK_REG_CSDIOCSR, &err);
    668	if (err < 0)
    669		goto err_release_irq;
    670
    671	val |= SDIO_INT_CTL;
    672	sdio_writel(bdev->func, val, MTK_REG_CSDIOCSR, &err);
    673	if (err < 0)
    674		goto err_release_irq;
    675
    676	/* Explitly set write-1-clear method */
    677	val = sdio_readl(bdev->func, MTK_REG_CHCR, &err);
    678	if (err < 0)
    679		goto err_release_irq;
    680
    681	val |= C_INT_CLR_CTRL;
    682	sdio_writel(bdev->func, val, MTK_REG_CHCR, &err);
    683	if (err < 0)
    684		goto err_release_irq;
    685
    686	/* Setup interrupt sources */
    687	sdio_writel(bdev->func, RX_DONE_INT | TX_EMPTY | TX_FIFO_OVERFLOW,
    688		    MTK_REG_CHIER, &err);
    689	if (err < 0)
    690		goto err_release_irq;
    691
    692	/* Enable interrupt */
    693	sdio_writel(bdev->func, C_INT_EN_SET, MTK_REG_CHLPCR, &err);
    694	if (err < 0)
    695		goto err_release_irq;
    696
    697	sdio_release_host(bdev->func);
    698
    699	return 0;
    700
    701err_release_irq:
    702	sdio_release_irq(bdev->func);
    703
    704err_disable_func:
    705	sdio_disable_func(bdev->func);
    706
    707err_release_host:
    708	sdio_release_host(bdev->func);
    709
    710	return err;
    711}
    712
    713static int btmtksdio_close(struct hci_dev *hdev)
    714{
    715	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    716
    717	sdio_claim_host(bdev->func);
    718
    719	/* Disable interrupt */
    720	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
    721
    722	sdio_release_irq(bdev->func);
    723
    724	cancel_work_sync(&bdev->txrx_work);
    725
    726	btmtksdio_fw_pmctrl(bdev);
    727
    728	clear_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state);
    729	sdio_disable_func(bdev->func);
    730
    731	sdio_release_host(bdev->func);
    732
    733	return 0;
    734}
    735
    736static int btmtksdio_flush(struct hci_dev *hdev)
    737{
    738	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    739
    740	skb_queue_purge(&bdev->txq);
    741
    742	cancel_work_sync(&bdev->txrx_work);
    743
    744	return 0;
    745}
    746
    747static int btmtksdio_func_query(struct hci_dev *hdev)
    748{
    749	struct btmtk_hci_wmt_params wmt_params;
    750	int status, err;
    751	u8 param = 0;
    752
    753	/* Query whether the function is enabled */
    754	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
    755	wmt_params.flag = 4;
    756	wmt_params.dlen = sizeof(param);
    757	wmt_params.data = &param;
    758	wmt_params.status = &status;
    759
    760	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    761	if (err < 0) {
    762		bt_dev_err(hdev, "Failed to query function status (%d)", err);
    763		return err;
    764	}
    765
    766	return status;
    767}
    768
    769static int mt76xx_setup(struct hci_dev *hdev, const char *fwname)
    770{
    771	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    772	struct btmtk_hci_wmt_params wmt_params;
    773	struct btmtk_tci_sleep tci_sleep;
    774	struct sk_buff *skb;
    775	int err, status;
    776	u8 param = 0x1;
    777
    778	/* Query whether the firmware is already download */
    779	wmt_params.op = BTMTK_WMT_SEMAPHORE;
    780	wmt_params.flag = 1;
    781	wmt_params.dlen = 0;
    782	wmt_params.data = NULL;
    783	wmt_params.status = &status;
    784
    785	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    786	if (err < 0) {
    787		bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
    788		return err;
    789	}
    790
    791	if (status == BTMTK_WMT_PATCH_DONE) {
    792		bt_dev_info(hdev, "Firmware already downloaded");
    793		goto ignore_setup_fw;
    794	}
    795
    796	/* Setup a firmware which the device definitely requires */
    797	err = btmtk_setup_firmware(hdev, fwname, mtk_hci_wmt_sync);
    798	if (err < 0)
    799		return err;
    800
    801ignore_setup_fw:
    802	/* Query whether the device is already enabled */
    803	err = readx_poll_timeout(btmtksdio_func_query, hdev, status,
    804				 status < 0 || status != BTMTK_WMT_ON_PROGRESS,
    805				 2000, 5000000);
    806	/* -ETIMEDOUT happens */
    807	if (err < 0)
    808		return err;
    809
    810	/* The other errors happen in btusb_mtk_func_query */
    811	if (status < 0)
    812		return status;
    813
    814	if (status == BTMTK_WMT_ON_DONE) {
    815		bt_dev_info(hdev, "function already on");
    816		goto ignore_func_on;
    817	}
    818
    819	/* Enable Bluetooth protocol */
    820	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
    821	wmt_params.flag = 0;
    822	wmt_params.dlen = sizeof(param);
    823	wmt_params.data = &param;
    824	wmt_params.status = NULL;
    825
    826	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    827	if (err < 0) {
    828		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
    829		return err;
    830	}
    831
    832	set_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
    833
    834ignore_func_on:
    835	/* Apply the low power environment setup */
    836	tci_sleep.mode = 0x5;
    837	tci_sleep.duration = cpu_to_le16(0x640);
    838	tci_sleep.host_duration = cpu_to_le16(0x640);
    839	tci_sleep.host_wakeup_pin = 0;
    840	tci_sleep.time_compensation = 0;
    841
    842	skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
    843			     HCI_INIT_TIMEOUT);
    844	if (IS_ERR(skb)) {
    845		err = PTR_ERR(skb);
    846		bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
    847		return err;
    848	}
    849	kfree_skb(skb);
    850
    851	return 0;
    852}
    853
    854static int mt79xx_setup(struct hci_dev *hdev, const char *fwname)
    855{
    856	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
    857	struct btmtk_hci_wmt_params wmt_params;
    858	u8 param = 0x1;
    859	int err;
    860
    861	err = btmtk_setup_firmware_79xx(hdev, fwname, mtk_hci_wmt_sync);
    862	if (err < 0) {
    863		bt_dev_err(hdev, "Failed to setup 79xx firmware (%d)", err);
    864		return err;
    865	}
    866
    867	err = btmtksdio_fw_pmctrl(bdev);
    868	if (err < 0)
    869		return err;
    870
    871	err = btmtksdio_drv_pmctrl(bdev);
    872	if (err < 0)
    873		return err;
    874
    875	/* Enable Bluetooth protocol */
    876	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
    877	wmt_params.flag = 0;
    878	wmt_params.dlen = sizeof(param);
    879	wmt_params.data = &param;
    880	wmt_params.status = NULL;
    881
    882	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    883	if (err < 0) {
    884		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
    885		return err;
    886	}
    887
    888	hci_set_msft_opcode(hdev, 0xFD30);
    889	hci_set_aosp_capable(hdev);
    890	set_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
    891
    892	return err;
    893}
    894
    895static int btmtksdio_mtk_reg_read(struct hci_dev *hdev, u32 reg, u32 *val)
    896{
    897	struct btmtk_hci_wmt_params wmt_params;
    898	struct reg_read_cmd reg_read = {
    899		.type = 1,
    900		.num = 1,
    901	};
    902	u32 status;
    903	int err;
    904
    905	reg_read.addr = cpu_to_le32(reg);
    906	wmt_params.op = BTMTK_WMT_REGISTER;
    907	wmt_params.flag = BTMTK_WMT_REG_READ;
    908	wmt_params.dlen = sizeof(reg_read);
    909	wmt_params.data = &reg_read;
    910	wmt_params.status = &status;
    911
    912	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    913	if (err < 0) {
    914		bt_dev_err(hdev, "Failed to read reg (%d)", err);
    915		return err;
    916	}
    917
    918	*val = status;
    919
    920	return err;
    921}
    922
    923static int btmtksdio_mtk_reg_write(struct hci_dev *hdev, u32 reg, u32 val, u32 mask)
    924{
    925	struct btmtk_hci_wmt_params wmt_params;
    926	const struct reg_write_cmd reg_write = {
    927		.type = 1,
    928		.num = 1,
    929		.addr = cpu_to_le32(reg),
    930		.data = cpu_to_le32(val),
    931		.mask = cpu_to_le32(mask),
    932	};
    933	int err, status;
    934
    935	wmt_params.op = BTMTK_WMT_REGISTER;
    936	wmt_params.flag = BTMTK_WMT_REG_WRITE;
    937	wmt_params.dlen = sizeof(reg_write);
    938	wmt_params.data = &reg_write;
    939	wmt_params.status = &status;
    940
    941	err = mtk_hci_wmt_sync(hdev, &wmt_params);
    942	if (err < 0)
    943		bt_dev_err(hdev, "Failed to write reg (%d)", err);
    944
    945	return err;
    946}
    947
    948static int btmtksdio_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
    949{
    950	/* uses 1 as data path id for all the usecases */
    951	*data_path_id = 1;
    952	return 0;
    953}
    954
    955static int btmtksdio_get_codec_config_data(struct hci_dev *hdev,
    956					   __u8 link, struct bt_codec *codec,
    957					   __u8 *ven_len, __u8 **ven_data)
    958{
    959	int err = 0;
    960
    961	if (!ven_data || !ven_len)
    962		return -EINVAL;
    963
    964	*ven_len = 0;
    965	*ven_data = NULL;
    966
    967	if (link != ESCO_LINK) {
    968		bt_dev_err(hdev, "Invalid link type(%u)", link);
    969		return -EINVAL;
    970	}
    971
    972	*ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
    973	if (!*ven_data) {
    974		err = -ENOMEM;
    975		goto error;
    976	}
    977
    978	/* supports only CVSD and mSBC offload codecs */
    979	switch (codec->id) {
    980	case 0x02:
    981		**ven_data = 0x00;
    982		break;
    983	case 0x05:
    984		**ven_data = 0x01;
    985		break;
    986	default:
    987		err = -EINVAL;
    988		bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
    989		goto error;
    990	}
    991	/* codec and its capabilities are pre-defined to ids
    992	 * preset id = 0x00 represents CVSD codec with sampling rate 8K
    993	 * preset id = 0x01 represents mSBC codec with sampling rate 16K
    994	 */
    995	*ven_len = sizeof(__u8);
    996	return err;
    997
    998error:
    999	kfree(*ven_data);
   1000	*ven_data = NULL;
   1001	return err;
   1002}
   1003
   1004static int btmtksdio_sco_setting(struct hci_dev *hdev)
   1005{
   1006	const struct btmtk_sco sco_setting = {
   1007		.clock_config = 0x49,
   1008		.channel_format_config = 0x80,
   1009	};
   1010	struct sk_buff *skb;
   1011	u32 val;
   1012	int err;
   1013
   1014	/* Enable SCO over I2S/PCM for MediaTek chipset */
   1015	skb =  __hci_cmd_sync(hdev, 0xfc72, sizeof(sco_setting),
   1016			      &sco_setting, HCI_CMD_TIMEOUT);
   1017	if (IS_ERR(skb))
   1018		return PTR_ERR(skb);
   1019
   1020	kfree_skb(skb);
   1021
   1022	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_0, &val);
   1023	if (err < 0)
   1024		return err;
   1025
   1026	val |= 0x11000000;
   1027	err = btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_0, val, ~0);
   1028	if (err < 0)
   1029		return err;
   1030
   1031	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_1, &val);
   1032	if (err < 0)
   1033		return err;
   1034
   1035	val |= 0x00000101;
   1036	err =  btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_1, val, ~0);
   1037	if (err < 0)
   1038		return err;
   1039
   1040	hdev->get_data_path_id = btmtksdio_get_data_path_id;
   1041	hdev->get_codec_config_data = btmtksdio_get_codec_config_data;
   1042
   1043	return err;
   1044}
   1045
   1046static int btmtksdio_reset_setting(struct hci_dev *hdev)
   1047{
   1048	int err;
   1049	u32 val;
   1050
   1051	err = btmtksdio_mtk_reg_read(hdev, MT7921_PINMUX_1, &val);
   1052	if (err < 0)
   1053		return err;
   1054
   1055	val |= 0x20; /* set the pin (bit field 11:8) work as GPIO mode */
   1056	err = btmtksdio_mtk_reg_write(hdev, MT7921_PINMUX_1, val, ~0);
   1057	if (err < 0)
   1058		return err;
   1059
   1060	err = btmtksdio_mtk_reg_read(hdev, MT7921_BTSYS_RST, &val);
   1061	if (err < 0)
   1062		return err;
   1063
   1064	val |= MT7921_BTSYS_RST_WITH_GPIO;
   1065	return btmtksdio_mtk_reg_write(hdev, MT7921_BTSYS_RST, val, ~0);
   1066}
   1067
   1068static int btmtksdio_setup(struct hci_dev *hdev)
   1069{
   1070	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
   1071	ktime_t calltime, delta, rettime;
   1072	unsigned long long duration;
   1073	char fwname[64];
   1074	int err, dev_id;
   1075	u32 fw_version = 0, val;
   1076
   1077	calltime = ktime_get();
   1078	set_bit(BTMTKSDIO_HW_TX_READY, &bdev->tx_state);
   1079
   1080	switch (bdev->data->chipid) {
   1081	case 0x7921:
   1082		if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state)) {
   1083			err = btmtksdio_mtk_reg_read(hdev, MT7921_DLSTATUS,
   1084						     &val);
   1085			if (err < 0)
   1086				return err;
   1087
   1088			val &= ~BT_DL_STATE;
   1089			err = btmtksdio_mtk_reg_write(hdev, MT7921_DLSTATUS,
   1090						      val, ~0);
   1091			if (err < 0)
   1092				return err;
   1093
   1094			btmtksdio_fw_pmctrl(bdev);
   1095			msleep(20);
   1096			btmtksdio_drv_pmctrl(bdev);
   1097
   1098			clear_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state);
   1099		}
   1100
   1101		err = btmtksdio_mtk_reg_read(hdev, 0x70010200, &dev_id);
   1102		if (err < 0) {
   1103			bt_dev_err(hdev, "Failed to get device id (%d)", err);
   1104			return err;
   1105		}
   1106
   1107		err = btmtksdio_mtk_reg_read(hdev, 0x80021004, &fw_version);
   1108		if (err < 0) {
   1109			bt_dev_err(hdev, "Failed to get fw version (%d)", err);
   1110			return err;
   1111		}
   1112
   1113		snprintf(fwname, sizeof(fwname),
   1114			 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
   1115			 dev_id & 0xffff, (fw_version & 0xff) + 1);
   1116		err = mt79xx_setup(hdev, fwname);
   1117		if (err < 0)
   1118			return err;
   1119
   1120		/* Enable SCO over I2S/PCM */
   1121		err = btmtksdio_sco_setting(hdev);
   1122		if (err < 0) {
   1123			bt_dev_err(hdev, "Failed to enable SCO setting (%d)", err);
   1124			return err;
   1125		}
   1126
   1127		/* Enable WBS with mSBC codec */
   1128		set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
   1129
   1130		/* Enable GPIO reset mechanism */
   1131		if (bdev->reset) {
   1132			err = btmtksdio_reset_setting(hdev);
   1133			if (err < 0) {
   1134				bt_dev_err(hdev, "Failed to enable Reset setting (%d)", err);
   1135				devm_gpiod_put(bdev->dev, bdev->reset);
   1136				bdev->reset = NULL;
   1137			}
   1138		}
   1139
   1140		/* Valid LE States quirk for MediaTek 7921 */
   1141		set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
   1142
   1143		break;
   1144	case 0x7663:
   1145	case 0x7668:
   1146		err = mt76xx_setup(hdev, bdev->data->fwname);
   1147		if (err < 0)
   1148			return err;
   1149		break;
   1150	default:
   1151		return -ENODEV;
   1152	}
   1153
   1154	rettime = ktime_get();
   1155	delta = ktime_sub(rettime, calltime);
   1156	duration = (unsigned long long)ktime_to_ns(delta) >> 10;
   1157
   1158	pm_runtime_set_autosuspend_delay(bdev->dev,
   1159					 MTKBTSDIO_AUTOSUSPEND_DELAY);
   1160	pm_runtime_use_autosuspend(bdev->dev);
   1161
   1162	err = pm_runtime_set_active(bdev->dev);
   1163	if (err < 0)
   1164		return err;
   1165
   1166	/* Default forbid runtime auto suspend, that can be allowed by
   1167	 * enable_autosuspend flag or the PM runtime entry under sysfs.
   1168	 */
   1169	pm_runtime_forbid(bdev->dev);
   1170	pm_runtime_enable(bdev->dev);
   1171
   1172	if (enable_autosuspend)
   1173		pm_runtime_allow(bdev->dev);
   1174
   1175	bt_dev_info(hdev, "Device setup in %llu usecs", duration);
   1176
   1177	return 0;
   1178}
   1179
   1180static int btmtksdio_shutdown(struct hci_dev *hdev)
   1181{
   1182	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
   1183	struct btmtk_hci_wmt_params wmt_params;
   1184	u8 param = 0x0;
   1185	int err;
   1186
   1187	/* Get back the state to be consistent with the state
   1188	 * in btmtksdio_setup.
   1189	 */
   1190	pm_runtime_get_sync(bdev->dev);
   1191
   1192	/* wmt command only works until the reset is complete */
   1193	if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state))
   1194		goto ignore_wmt_cmd;
   1195
   1196	/* Disable the device */
   1197	wmt_params.op = BTMTK_WMT_FUNC_CTRL;
   1198	wmt_params.flag = 0;
   1199	wmt_params.dlen = sizeof(param);
   1200	wmt_params.data = &param;
   1201	wmt_params.status = NULL;
   1202
   1203	err = mtk_hci_wmt_sync(hdev, &wmt_params);
   1204	if (err < 0) {
   1205		bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
   1206		return err;
   1207	}
   1208
   1209ignore_wmt_cmd:
   1210	pm_runtime_put_noidle(bdev->dev);
   1211	pm_runtime_disable(bdev->dev);
   1212
   1213	return 0;
   1214}
   1215
   1216static int btmtksdio_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
   1217{
   1218	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
   1219
   1220	switch (hci_skb_pkt_type(skb)) {
   1221	case HCI_COMMAND_PKT:
   1222		hdev->stat.cmd_tx++;
   1223		break;
   1224
   1225	case HCI_ACLDATA_PKT:
   1226		hdev->stat.acl_tx++;
   1227		break;
   1228
   1229	case HCI_SCODATA_PKT:
   1230		hdev->stat.sco_tx++;
   1231		break;
   1232
   1233	default:
   1234		return -EILSEQ;
   1235	}
   1236
   1237	skb_queue_tail(&bdev->txq, skb);
   1238
   1239	schedule_work(&bdev->txrx_work);
   1240
   1241	return 0;
   1242}
   1243
   1244static void btmtksdio_cmd_timeout(struct hci_dev *hdev)
   1245{
   1246	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
   1247	u32 status;
   1248	int err;
   1249
   1250	if (!bdev->reset || bdev->data->chipid != 0x7921)
   1251		return;
   1252
   1253	pm_runtime_get_sync(bdev->dev);
   1254
   1255	if (test_and_set_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state))
   1256		return;
   1257
   1258	sdio_claim_host(bdev->func);
   1259
   1260	sdio_writel(bdev->func, C_INT_EN_CLR, MTK_REG_CHLPCR, NULL);
   1261	skb_queue_purge(&bdev->txq);
   1262	cancel_work_sync(&bdev->txrx_work);
   1263
   1264	gpiod_set_value_cansleep(bdev->reset, 1);
   1265	msleep(100);
   1266	gpiod_set_value_cansleep(bdev->reset, 0);
   1267
   1268	err = readx_poll_timeout(btmtksdio_chcr_query, bdev, status,
   1269				 status & BT_RST_DONE, 100000, 2000000);
   1270	if (err < 0) {
   1271		bt_dev_err(hdev, "Failed to reset (%d)", err);
   1272		goto err;
   1273	}
   1274
   1275	clear_bit(BTMTKSDIO_PATCH_ENABLED, &bdev->tx_state);
   1276err:
   1277	sdio_release_host(bdev->func);
   1278
   1279	pm_runtime_put_noidle(bdev->dev);
   1280	pm_runtime_disable(bdev->dev);
   1281
   1282	hci_reset_dev(hdev);
   1283}
   1284
   1285static bool btmtksdio_sdio_wakeup(struct hci_dev *hdev)
   1286{
   1287	struct btmtksdio_dev *bdev = hci_get_drvdata(hdev);
   1288	bool may_wakeup = device_may_wakeup(bdev->dev);
   1289	const struct btmtk_wakeon bt_awake = {
   1290		.mode = 0x1,
   1291		.gpo = 0,
   1292		.active_high = 0x1,
   1293		.enable_delay = cpu_to_le16(0xc80),
   1294		.wakeup_delay = cpu_to_le16(0x20),
   1295	};
   1296
   1297	if (may_wakeup && bdev->data->chipid == 0x7921) {
   1298		struct sk_buff *skb;
   1299
   1300		skb =  __hci_cmd_sync(hdev, 0xfc27, sizeof(bt_awake),
   1301				      &bt_awake, HCI_CMD_TIMEOUT);
   1302		if (IS_ERR(skb))
   1303			may_wakeup = false;
   1304		else
   1305			kfree_skb(skb);
   1306	}
   1307
   1308	return may_wakeup;
   1309}
   1310
   1311static int btmtksdio_probe(struct sdio_func *func,
   1312			   const struct sdio_device_id *id)
   1313{
   1314	struct btmtksdio_dev *bdev;
   1315	struct hci_dev *hdev;
   1316	int err;
   1317
   1318	bdev = devm_kzalloc(&func->dev, sizeof(*bdev), GFP_KERNEL);
   1319	if (!bdev)
   1320		return -ENOMEM;
   1321
   1322	bdev->data = (void *)id->driver_data;
   1323	if (!bdev->data)
   1324		return -ENODEV;
   1325
   1326	bdev->dev = &func->dev;
   1327	bdev->func = func;
   1328
   1329	INIT_WORK(&bdev->txrx_work, btmtksdio_txrx_work);
   1330	skb_queue_head_init(&bdev->txq);
   1331
   1332	/* Initialize and register HCI device */
   1333	hdev = hci_alloc_dev();
   1334	if (!hdev) {
   1335		dev_err(&func->dev, "Can't allocate HCI device\n");
   1336		return -ENOMEM;
   1337	}
   1338
   1339	bdev->hdev = hdev;
   1340
   1341	hdev->bus = HCI_SDIO;
   1342	hci_set_drvdata(hdev, bdev);
   1343
   1344	hdev->open     = btmtksdio_open;
   1345	hdev->close    = btmtksdio_close;
   1346	hdev->cmd_timeout = btmtksdio_cmd_timeout;
   1347	hdev->flush    = btmtksdio_flush;
   1348	hdev->setup    = btmtksdio_setup;
   1349	hdev->shutdown = btmtksdio_shutdown;
   1350	hdev->send     = btmtksdio_send_frame;
   1351	hdev->wakeup   = btmtksdio_sdio_wakeup;
   1352	hdev->set_bdaddr = btmtk_set_bdaddr;
   1353
   1354	SET_HCIDEV_DEV(hdev, &func->dev);
   1355
   1356	hdev->manufacturer = 70;
   1357	set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
   1358
   1359	sdio_set_drvdata(func, bdev);
   1360
   1361	err = hci_register_dev(hdev);
   1362	if (err < 0) {
   1363		dev_err(&func->dev, "Can't register HCI device\n");
   1364		hci_free_dev(hdev);
   1365		return err;
   1366	}
   1367
   1368	/* pm_runtime_enable would be done after the firmware is being
   1369	 * downloaded because the core layer probably already enables
   1370	 * runtime PM for this func such as the case host->caps &
   1371	 * MMC_CAP_POWER_OFF_CARD.
   1372	 */
   1373	if (pm_runtime_enabled(bdev->dev))
   1374		pm_runtime_disable(bdev->dev);
   1375
   1376	/* As explaination in drivers/mmc/core/sdio_bus.c tells us:
   1377	 * Unbound SDIO functions are always suspended.
   1378	 * During probe, the function is set active and the usage count
   1379	 * is incremented.  If the driver supports runtime PM,
   1380	 * it should call pm_runtime_put_noidle() in its probe routine and
   1381	 * pm_runtime_get_noresume() in its remove routine.
   1382	 *
   1383	 * So, put a pm_runtime_put_noidle here !
   1384	 */
   1385	pm_runtime_put_noidle(bdev->dev);
   1386
   1387	err = device_init_wakeup(bdev->dev, true);
   1388	if (err)
   1389		bt_dev_err(hdev, "failed to initialize device wakeup");
   1390
   1391	bdev->dev->of_node = of_find_compatible_node(NULL, NULL,
   1392						     "mediatek,mt7921s-bluetooth");
   1393	bdev->reset = devm_gpiod_get_optional(bdev->dev, "reset",
   1394					      GPIOD_OUT_LOW);
   1395	if (IS_ERR(bdev->reset))
   1396		err = PTR_ERR(bdev->reset);
   1397
   1398	return err;
   1399}
   1400
   1401static void btmtksdio_remove(struct sdio_func *func)
   1402{
   1403	struct btmtksdio_dev *bdev = sdio_get_drvdata(func);
   1404	struct hci_dev *hdev;
   1405
   1406	if (!bdev)
   1407		return;
   1408
   1409	/* Be consistent the state in btmtksdio_probe */
   1410	pm_runtime_get_noresume(bdev->dev);
   1411
   1412	hdev = bdev->hdev;
   1413
   1414	sdio_set_drvdata(func, NULL);
   1415	hci_unregister_dev(hdev);
   1416	hci_free_dev(hdev);
   1417}
   1418
   1419#ifdef CONFIG_PM
   1420static int btmtksdio_runtime_suspend(struct device *dev)
   1421{
   1422	struct sdio_func *func = dev_to_sdio_func(dev);
   1423	struct btmtksdio_dev *bdev;
   1424	int err;
   1425
   1426	bdev = sdio_get_drvdata(func);
   1427	if (!bdev)
   1428		return 0;
   1429
   1430	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
   1431		return 0;
   1432
   1433	sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
   1434
   1435	err = btmtksdio_fw_pmctrl(bdev);
   1436
   1437	bt_dev_dbg(bdev->hdev, "status (%d) return ownership to device", err);
   1438
   1439	return err;
   1440}
   1441
   1442static int btmtksdio_runtime_resume(struct device *dev)
   1443{
   1444	struct sdio_func *func = dev_to_sdio_func(dev);
   1445	struct btmtksdio_dev *bdev;
   1446	int err;
   1447
   1448	bdev = sdio_get_drvdata(func);
   1449	if (!bdev)
   1450		return 0;
   1451
   1452	if (!test_bit(BTMTKSDIO_FUNC_ENABLED, &bdev->tx_state))
   1453		return 0;
   1454
   1455	err = btmtksdio_drv_pmctrl(bdev);
   1456
   1457	bt_dev_dbg(bdev->hdev, "status (%d) get ownership from device", err);
   1458
   1459	return err;
   1460}
   1461
   1462static UNIVERSAL_DEV_PM_OPS(btmtksdio_pm_ops, btmtksdio_runtime_suspend,
   1463			    btmtksdio_runtime_resume, NULL);
   1464#define BTMTKSDIO_PM_OPS (&btmtksdio_pm_ops)
   1465#else	/* CONFIG_PM */
   1466#define BTMTKSDIO_PM_OPS NULL
   1467#endif	/* CONFIG_PM */
   1468
   1469static struct sdio_driver btmtksdio_driver = {
   1470	.name		= "btmtksdio",
   1471	.probe		= btmtksdio_probe,
   1472	.remove		= btmtksdio_remove,
   1473	.id_table	= btmtksdio_table,
   1474	.drv = {
   1475		.owner = THIS_MODULE,
   1476		.pm = BTMTKSDIO_PM_OPS,
   1477	}
   1478};
   1479
   1480module_sdio_driver(btmtksdio_driver);
   1481
   1482module_param(enable_autosuspend, bool, 0644);
   1483MODULE_PARM_DESC(enable_autosuspend, "Enable autosuspend by default");
   1484
   1485MODULE_AUTHOR("Sean Wang <sean.wang@mediatek.com>");
   1486MODULE_DESCRIPTION("MediaTek Bluetooth SDIO driver ver " VERSION);
   1487MODULE_VERSION(VERSION);
   1488MODULE_LICENSE("GPL");