cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

hci_mrvl.c (9621B)


      1// SPDX-License-Identifier: GPL-2.0-or-later
      2/*
      3 *
      4 *  Bluetooth HCI UART driver for marvell devices
      5 *
      6 *  Copyright (C) 2016  Marvell International Ltd.
      7 *  Copyright (C) 2016  Intel Corporation
      8 */
      9
     10#include <linux/kernel.h>
     11#include <linux/errno.h>
     12#include <linux/skbuff.h>
     13#include <linux/firmware.h>
     14#include <linux/module.h>
     15#include <linux/tty.h>
     16#include <linux/of.h>
     17#include <linux/serdev.h>
     18
     19#include <net/bluetooth/bluetooth.h>
     20#include <net/bluetooth/hci_core.h>
     21
     22#include "hci_uart.h"
     23
     24#define HCI_FW_REQ_PKT 0xA5
     25#define HCI_CHIP_VER_PKT 0xAA
     26
     27#define MRVL_ACK 0x5A
     28#define MRVL_NAK 0xBF
     29#define MRVL_RAW_DATA 0x1F
     30
     31enum {
     32	STATE_CHIP_VER_PENDING,
     33	STATE_FW_REQ_PENDING,
     34};
     35
     36struct mrvl_data {
     37	struct sk_buff *rx_skb;
     38	struct sk_buff_head txq;
     39	struct sk_buff_head rawq;
     40	unsigned long flags;
     41	unsigned int tx_len;
     42	u8 id, rev;
     43};
     44
     45struct mrvl_serdev {
     46	struct hci_uart hu;
     47};
     48
     49struct hci_mrvl_pkt {
     50	__le16 lhs;
     51	__le16 rhs;
     52} __packed;
     53#define HCI_MRVL_PKT_SIZE 4
     54
     55static int mrvl_open(struct hci_uart *hu)
     56{
     57	struct mrvl_data *mrvl;
     58	int ret;
     59
     60	BT_DBG("hu %p", hu);
     61
     62	if (!hci_uart_has_flow_control(hu))
     63		return -EOPNOTSUPP;
     64
     65	mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
     66	if (!mrvl)
     67		return -ENOMEM;
     68
     69	skb_queue_head_init(&mrvl->txq);
     70	skb_queue_head_init(&mrvl->rawq);
     71
     72	set_bit(STATE_CHIP_VER_PENDING, &mrvl->flags);
     73
     74	hu->priv = mrvl;
     75
     76	if (hu->serdev) {
     77		ret = serdev_device_open(hu->serdev);
     78		if (ret)
     79			goto err;
     80	}
     81
     82	return 0;
     83err:
     84	kfree(mrvl);
     85
     86	return ret;
     87}
     88
     89static int mrvl_close(struct hci_uart *hu)
     90{
     91	struct mrvl_data *mrvl = hu->priv;
     92
     93	BT_DBG("hu %p", hu);
     94
     95	if (hu->serdev)
     96		serdev_device_close(hu->serdev);
     97
     98	skb_queue_purge(&mrvl->txq);
     99	skb_queue_purge(&mrvl->rawq);
    100	kfree_skb(mrvl->rx_skb);
    101	kfree(mrvl);
    102
    103	hu->priv = NULL;
    104	return 0;
    105}
    106
    107static int mrvl_flush(struct hci_uart *hu)
    108{
    109	struct mrvl_data *mrvl = hu->priv;
    110
    111	BT_DBG("hu %p", hu);
    112
    113	skb_queue_purge(&mrvl->txq);
    114	skb_queue_purge(&mrvl->rawq);
    115
    116	return 0;
    117}
    118
    119static struct sk_buff *mrvl_dequeue(struct hci_uart *hu)
    120{
    121	struct mrvl_data *mrvl = hu->priv;
    122	struct sk_buff *skb;
    123
    124	skb = skb_dequeue(&mrvl->txq);
    125	if (!skb) {
    126		/* Any raw data ? */
    127		skb = skb_dequeue(&mrvl->rawq);
    128	} else {
    129		/* Prepend skb with frame type */
    130		memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
    131	}
    132
    133	return skb;
    134}
    135
    136static int mrvl_enqueue(struct hci_uart *hu, struct sk_buff *skb)
    137{
    138	struct mrvl_data *mrvl = hu->priv;
    139
    140	skb_queue_tail(&mrvl->txq, skb);
    141	return 0;
    142}
    143
    144static void mrvl_send_ack(struct hci_uart *hu, unsigned char type)
    145{
    146	struct mrvl_data *mrvl = hu->priv;
    147	struct sk_buff *skb;
    148
    149	/* No H4 payload, only 1 byte header */
    150	skb = bt_skb_alloc(0, GFP_ATOMIC);
    151	if (!skb) {
    152		bt_dev_err(hu->hdev, "Unable to alloc ack/nak packet");
    153		return;
    154	}
    155	hci_skb_pkt_type(skb) = type;
    156
    157	skb_queue_tail(&mrvl->txq, skb);
    158	hci_uart_tx_wakeup(hu);
    159}
    160
    161static int mrvl_recv_fw_req(struct hci_dev *hdev, struct sk_buff *skb)
    162{
    163	struct hci_mrvl_pkt *pkt = (void *)skb->data;
    164	struct hci_uart *hu = hci_get_drvdata(hdev);
    165	struct mrvl_data *mrvl = hu->priv;
    166	int ret = 0;
    167
    168	if ((pkt->lhs ^ pkt->rhs) != 0xffff) {
    169		bt_dev_err(hdev, "Corrupted mrvl header");
    170		mrvl_send_ack(hu, MRVL_NAK);
    171		ret = -EINVAL;
    172		goto done;
    173	}
    174	mrvl_send_ack(hu, MRVL_ACK);
    175
    176	if (!test_bit(STATE_FW_REQ_PENDING, &mrvl->flags)) {
    177		bt_dev_err(hdev, "Received unexpected firmware request");
    178		ret = -EINVAL;
    179		goto done;
    180	}
    181
    182	mrvl->tx_len = le16_to_cpu(pkt->lhs);
    183
    184	clear_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
    185	smp_mb__after_atomic();
    186	wake_up_bit(&mrvl->flags, STATE_FW_REQ_PENDING);
    187
    188done:
    189	kfree_skb(skb);
    190	return ret;
    191}
    192
    193static int mrvl_recv_chip_ver(struct hci_dev *hdev, struct sk_buff *skb)
    194{
    195	struct hci_mrvl_pkt *pkt = (void *)skb->data;
    196	struct hci_uart *hu = hci_get_drvdata(hdev);
    197	struct mrvl_data *mrvl = hu->priv;
    198	u16 version = le16_to_cpu(pkt->lhs);
    199	int ret = 0;
    200
    201	if ((pkt->lhs ^ pkt->rhs) != 0xffff) {
    202		bt_dev_err(hdev, "Corrupted mrvl header");
    203		mrvl_send_ack(hu, MRVL_NAK);
    204		ret = -EINVAL;
    205		goto done;
    206	}
    207	mrvl_send_ack(hu, MRVL_ACK);
    208
    209	if (!test_bit(STATE_CHIP_VER_PENDING, &mrvl->flags)) {
    210		bt_dev_err(hdev, "Received unexpected chip version");
    211		goto done;
    212	}
    213
    214	mrvl->id = version;
    215	mrvl->rev = version >> 8;
    216
    217	bt_dev_info(hdev, "Controller id = %x, rev = %x", mrvl->id, mrvl->rev);
    218
    219	clear_bit(STATE_CHIP_VER_PENDING, &mrvl->flags);
    220	smp_mb__after_atomic();
    221	wake_up_bit(&mrvl->flags, STATE_CHIP_VER_PENDING);
    222
    223done:
    224	kfree_skb(skb);
    225	return ret;
    226}
    227
    228#define HCI_RECV_CHIP_VER \
    229	.type = HCI_CHIP_VER_PKT, \
    230	.hlen = HCI_MRVL_PKT_SIZE, \
    231	.loff = 0, \
    232	.lsize = 0, \
    233	.maxlen = HCI_MRVL_PKT_SIZE
    234
    235#define HCI_RECV_FW_REQ \
    236	.type = HCI_FW_REQ_PKT, \
    237	.hlen = HCI_MRVL_PKT_SIZE, \
    238	.loff = 0, \
    239	.lsize = 0, \
    240	.maxlen = HCI_MRVL_PKT_SIZE
    241
    242static const struct h4_recv_pkt mrvl_recv_pkts[] = {
    243	{ H4_RECV_ACL,       .recv = hci_recv_frame     },
    244	{ H4_RECV_SCO,       .recv = hci_recv_frame     },
    245	{ H4_RECV_EVENT,     .recv = hci_recv_frame     },
    246	{ HCI_RECV_FW_REQ,   .recv = mrvl_recv_fw_req   },
    247	{ HCI_RECV_CHIP_VER, .recv = mrvl_recv_chip_ver },
    248};
    249
    250static int mrvl_recv(struct hci_uart *hu, const void *data, int count)
    251{
    252	struct mrvl_data *mrvl = hu->priv;
    253
    254	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
    255		return -EUNATCH;
    256
    257	mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count,
    258				    mrvl_recv_pkts,
    259				    ARRAY_SIZE(mrvl_recv_pkts));
    260	if (IS_ERR(mrvl->rx_skb)) {
    261		int err = PTR_ERR(mrvl->rx_skb);
    262		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
    263		mrvl->rx_skb = NULL;
    264		return err;
    265	}
    266
    267	return count;
    268}
    269
    270static int mrvl_load_firmware(struct hci_dev *hdev, const char *name)
    271{
    272	struct hci_uart *hu = hci_get_drvdata(hdev);
    273	struct mrvl_data *mrvl = hu->priv;
    274	const struct firmware *fw = NULL;
    275	const u8 *fw_ptr, *fw_max;
    276	int err;
    277
    278	err = request_firmware(&fw, name, &hdev->dev);
    279	if (err < 0) {
    280		bt_dev_err(hdev, "Failed to load firmware file %s", name);
    281		return err;
    282	}
    283
    284	fw_ptr = fw->data;
    285	fw_max = fw->data + fw->size;
    286
    287	bt_dev_info(hdev, "Loading %s", name);
    288
    289	set_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
    290
    291	while (fw_ptr <= fw_max) {
    292		struct sk_buff *skb;
    293
    294		/* Controller drives the firmware load by sending firmware
    295		 * request packets containing the expected fragment size.
    296		 */
    297		err = wait_on_bit_timeout(&mrvl->flags, STATE_FW_REQ_PENDING,
    298					  TASK_INTERRUPTIBLE,
    299					  msecs_to_jiffies(2000));
    300		if (err == 1) {
    301			bt_dev_err(hdev, "Firmware load interrupted");
    302			err = -EINTR;
    303			break;
    304		} else if (err) {
    305			bt_dev_err(hdev, "Firmware request timeout");
    306			err = -ETIMEDOUT;
    307			break;
    308		}
    309
    310		bt_dev_dbg(hdev, "Firmware request, expecting %d bytes",
    311			   mrvl->tx_len);
    312
    313		if (fw_ptr == fw_max) {
    314			/* Controller requests a null size once firmware is
    315			 * fully loaded. If controller expects more data, there
    316			 * is an issue.
    317			 */
    318			if (!mrvl->tx_len) {
    319				bt_dev_info(hdev, "Firmware loading complete");
    320			} else {
    321				bt_dev_err(hdev, "Firmware loading failure");
    322				err = -EINVAL;
    323			}
    324			break;
    325		}
    326
    327		if (fw_ptr + mrvl->tx_len > fw_max) {
    328			mrvl->tx_len = fw_max - fw_ptr;
    329			bt_dev_dbg(hdev, "Adjusting tx_len to %d",
    330				   mrvl->tx_len);
    331		}
    332
    333		skb = bt_skb_alloc(mrvl->tx_len, GFP_KERNEL);
    334		if (!skb) {
    335			bt_dev_err(hdev, "Failed to alloc mem for FW packet");
    336			err = -ENOMEM;
    337			break;
    338		}
    339		bt_cb(skb)->pkt_type = MRVL_RAW_DATA;
    340
    341		skb_put_data(skb, fw_ptr, mrvl->tx_len);
    342		fw_ptr += mrvl->tx_len;
    343
    344		set_bit(STATE_FW_REQ_PENDING, &mrvl->flags);
    345
    346		skb_queue_tail(&mrvl->rawq, skb);
    347		hci_uart_tx_wakeup(hu);
    348	}
    349
    350	release_firmware(fw);
    351	return err;
    352}
    353
    354static int mrvl_setup(struct hci_uart *hu)
    355{
    356	int err;
    357
    358	hci_uart_set_flow_control(hu, true);
    359
    360	err = mrvl_load_firmware(hu->hdev, "mrvl/helper_uart_3000000.bin");
    361	if (err) {
    362		bt_dev_err(hu->hdev, "Unable to download firmware helper");
    363		return -EINVAL;
    364	}
    365
    366	/* Let the final ack go out before switching the baudrate */
    367	hci_uart_wait_until_sent(hu);
    368
    369	if (hu->serdev)
    370		serdev_device_set_baudrate(hu->serdev, 3000000);
    371	else
    372		hci_uart_set_baudrate(hu, 3000000);
    373
    374	hci_uart_set_flow_control(hu, false);
    375
    376	err = mrvl_load_firmware(hu->hdev, "mrvl/uart8897_bt.bin");
    377	if (err)
    378		return err;
    379
    380	return 0;
    381}
    382
    383static const struct hci_uart_proto mrvl_proto = {
    384	.id		= HCI_UART_MRVL,
    385	.name		= "Marvell",
    386	.init_speed	= 115200,
    387	.open		= mrvl_open,
    388	.close		= mrvl_close,
    389	.flush		= mrvl_flush,
    390	.setup		= mrvl_setup,
    391	.recv		= mrvl_recv,
    392	.enqueue	= mrvl_enqueue,
    393	.dequeue	= mrvl_dequeue,
    394};
    395
    396static int mrvl_serdev_probe(struct serdev_device *serdev)
    397{
    398	struct mrvl_serdev *mrvldev;
    399
    400	mrvldev = devm_kzalloc(&serdev->dev, sizeof(*mrvldev), GFP_KERNEL);
    401	if (!mrvldev)
    402		return -ENOMEM;
    403
    404	mrvldev->hu.serdev = serdev;
    405	serdev_device_set_drvdata(serdev, mrvldev);
    406
    407	return hci_uart_register_device(&mrvldev->hu, &mrvl_proto);
    408}
    409
    410static void mrvl_serdev_remove(struct serdev_device *serdev)
    411{
    412	struct mrvl_serdev *mrvldev = serdev_device_get_drvdata(serdev);
    413
    414	hci_uart_unregister_device(&mrvldev->hu);
    415}
    416
    417#ifdef CONFIG_OF
    418static const struct of_device_id mrvl_bluetooth_of_match[] = {
    419	{ .compatible = "mrvl,88w8897" },
    420	{ },
    421};
    422MODULE_DEVICE_TABLE(of, mrvl_bluetooth_of_match);
    423#endif
    424
    425static struct serdev_device_driver mrvl_serdev_driver = {
    426	.probe = mrvl_serdev_probe,
    427	.remove = mrvl_serdev_remove,
    428	.driver = {
    429		.name = "hci_uart_mrvl",
    430		.of_match_table = of_match_ptr(mrvl_bluetooth_of_match),
    431	},
    432};
    433
    434int __init mrvl_init(void)
    435{
    436	serdev_device_driver_register(&mrvl_serdev_driver);
    437
    438	return hci_uart_register_proto(&mrvl_proto);
    439}
    440
    441int __exit mrvl_deinit(void)
    442{
    443	serdev_device_driver_unregister(&mrvl_serdev_driver);
    444
    445	return hci_uart_unregister_proto(&mrvl_proto);
    446}