1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_REV2 2 55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 56 57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 58 struct cmd_write_boot_params { 59 __le32 boot_addr; 60 u8 fw_build_num; 61 u8 fw_build_ww; 62 u8 fw_build_yy; 63 } __packed; 64 65 static struct { 66 const char *driver_name; 67 u8 hw_variant; 68 u32 fw_build_num; 69 u32 fw_sha; 70 } coredump_info; 71 72 const guid_t btintel_guid_dsm = 73 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 74 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 75 EXPORT_SYMBOL_GPL(btintel_guid_dsm); 76 77 int btintel_check_bdaddr(struct hci_dev *hdev) 78 { 79 struct hci_rp_read_bd_addr *bda; 80 struct sk_buff *skb; 81 82 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 83 HCI_INIT_TIMEOUT); 84 if (IS_ERR(skb)) { 85 int err = PTR_ERR(skb); 86 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 87 err); 88 return err; 89 } 90 91 if (skb->len != sizeof(*bda)) { 92 bt_dev_err(hdev, "Intel device address length mismatch"); 93 kfree_skb(skb); 94 return -EIO; 95 } 96 97 bda = (struct hci_rp_read_bd_addr *)skb->data; 98 99 /* For some Intel based controllers, the default Bluetooth device 100 * address 00:03:19:9E:8B:00 can be found. These controllers are 101 * fully operational, but have the danger of duplicate addresses 102 * and that in turn can cause problems with Bluetooth operation. 103 */ 104 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 105 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 106 &bda->bdaddr); 107 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 108 } 109 110 kfree_skb(skb); 111 112 return 0; 113 } 114 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 115 116 int btintel_enter_mfg(struct hci_dev *hdev) 117 { 118 static const u8 param[] = { 0x01, 0x00 }; 119 struct sk_buff *skb; 120 121 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 122 if (IS_ERR(skb)) { 123 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 124 PTR_ERR(skb)); 125 return PTR_ERR(skb); 126 } 127 kfree_skb(skb); 128 129 return 0; 130 } 131 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 132 133 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 134 { 135 u8 param[] = { 0x00, 0x00 }; 136 struct sk_buff *skb; 137 138 /* The 2nd command parameter specifies the manufacturing exit method: 139 * 0x00: Just disable the manufacturing mode (0x00). 140 * 0x01: Disable manufacturing mode and reset with patches deactivated. 141 * 0x02: Disable manufacturing mode and reset with patches activated. 142 */ 143 if (reset) 144 param[1] |= patched ? 0x02 : 0x01; 145 146 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 147 if (IS_ERR(skb)) { 148 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 149 PTR_ERR(skb)); 150 return PTR_ERR(skb); 151 } 152 kfree_skb(skb); 153 154 return 0; 155 } 156 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 157 158 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 159 { 160 struct sk_buff *skb; 161 int err; 162 163 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 164 if (IS_ERR(skb)) { 165 err = PTR_ERR(skb); 166 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 167 err); 168 return err; 169 } 170 kfree_skb(skb); 171 172 return 0; 173 } 174 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 175 176 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 177 { 178 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 179 struct sk_buff *skb; 180 int err; 181 182 if (debug) 183 mask[1] |= 0x62; 184 185 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 186 if (IS_ERR(skb)) { 187 err = PTR_ERR(skb); 188 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 189 return err; 190 } 191 kfree_skb(skb); 192 193 return 0; 194 } 195 196 int btintel_set_diag(struct hci_dev *hdev, bool enable) 197 { 198 struct sk_buff *skb; 199 u8 param[3]; 200 int err; 201 202 if (enable) { 203 param[0] = 0x03; 204 param[1] = 0x03; 205 param[2] = 0x03; 206 } else { 207 param[0] = 0x00; 208 param[1] = 0x00; 209 param[2] = 0x00; 210 } 211 212 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 213 if (IS_ERR(skb)) { 214 err = PTR_ERR(skb); 215 if (err == -ENODATA) 216 goto done; 217 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 218 err); 219 return err; 220 } 221 kfree_skb(skb); 222 223 done: 224 btintel_set_event_mask(hdev, enable); 225 return 0; 226 } 227 EXPORT_SYMBOL_GPL(btintel_set_diag); 228 229 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 230 { 231 int err, ret; 232 233 err = btintel_enter_mfg(hdev); 234 if (err) 235 return err; 236 237 ret = btintel_set_diag(hdev, enable); 238 239 err = btintel_exit_mfg(hdev, false, false); 240 if (err) 241 return err; 242 243 return ret; 244 } 245 246 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 247 { 248 int ret; 249 250 /* Legacy ROM device needs to be in the manufacturer mode to apply 251 * diagnostic setting 252 * 253 * This flag is set after reading the Intel version. 254 */ 255 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 256 ret = btintel_set_diag_mfg(hdev, enable); 257 else 258 ret = btintel_set_diag(hdev, enable); 259 260 return ret; 261 } 262 263 void btintel_hw_error(struct hci_dev *hdev, u8 code) 264 { 265 struct sk_buff *skb; 266 u8 type = 0x00; 267 268 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 269 270 hci_req_sync_lock(hdev); 271 272 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 273 if (IS_ERR(skb)) { 274 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 275 PTR_ERR(skb)); 276 goto unlock; 277 } 278 kfree_skb(skb); 279 280 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 281 if (IS_ERR(skb)) { 282 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 283 PTR_ERR(skb)); 284 goto unlock; 285 } 286 287 if (skb->len != 13) { 288 bt_dev_err(hdev, "Exception info size mismatch"); 289 kfree_skb(skb); 290 goto unlock; 291 } 292 293 bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1), 294 (char *)(skb->data + 1)); 295 296 kfree_skb(skb); 297 298 unlock: 299 hci_req_sync_unlock(hdev); 300 } 301 EXPORT_SYMBOL_GPL(btintel_hw_error); 302 303 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 304 { 305 const char *variant; 306 307 /* The hardware platform number has a fixed value of 0x37 and 308 * for now only accept this single value. 309 */ 310 if (ver->hw_platform != 0x37) { 311 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 312 ver->hw_platform); 313 return -EINVAL; 314 } 315 316 /* Check for supported iBT hardware variants of this firmware 317 * loading method. 318 * 319 * This check has been put in place to ensure correct forward 320 * compatibility options when newer hardware variants come along. 321 */ 322 switch (ver->hw_variant) { 323 case 0x07: /* WP - Legacy ROM */ 324 case 0x08: /* StP - Legacy ROM */ 325 case 0x0b: /* SfP */ 326 case 0x0c: /* WsP */ 327 case 0x11: /* JfP */ 328 case 0x12: /* ThP */ 329 case 0x13: /* HrP */ 330 case 0x14: /* CcP */ 331 break; 332 default: 333 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 334 ver->hw_variant); 335 return -EINVAL; 336 } 337 338 switch (ver->fw_variant) { 339 case 0x01: 340 variant = "Legacy ROM 2.5"; 341 break; 342 case 0x06: 343 variant = "Bootloader"; 344 break; 345 case 0x22: 346 variant = "Legacy ROM 2.x"; 347 break; 348 case 0x23: 349 variant = "Firmware"; 350 break; 351 default: 352 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 353 return -EINVAL; 354 } 355 356 coredump_info.hw_variant = ver->hw_variant; 357 coredump_info.fw_build_num = ver->fw_build_num; 358 359 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 360 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 361 ver->fw_build_num, ver->fw_build_ww, 362 2000 + ver->fw_build_yy); 363 364 return 0; 365 } 366 EXPORT_SYMBOL_GPL(btintel_version_info); 367 368 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 369 const void *param) 370 { 371 while (plen > 0) { 372 struct sk_buff *skb; 373 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 374 375 cmd_param[0] = fragment_type; 376 memcpy(cmd_param + 1, param, fragment_len); 377 378 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 379 cmd_param, HCI_INIT_TIMEOUT); 380 if (IS_ERR(skb)) 381 return PTR_ERR(skb); 382 383 kfree_skb(skb); 384 385 plen -= fragment_len; 386 param += fragment_len; 387 } 388 389 return 0; 390 } 391 392 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 393 { 394 const struct firmware *fw; 395 struct sk_buff *skb; 396 const u8 *fw_ptr; 397 int err; 398 399 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 400 if (err < 0) { 401 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 402 ddc_name, err); 403 return err; 404 } 405 406 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 407 408 fw_ptr = fw->data; 409 410 /* DDC file contains one or more DDC structure which has 411 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 412 */ 413 while (fw->size > (size_t)(fw_ptr - fw->data)) { 414 size_t remaining = fw->size - (fw_ptr - fw->data); 415 unsigned int cmd_plen = fw_ptr[0] + 1U; 416 417 if (cmd_plen < 3 || cmd_plen > U8_MAX || cmd_plen > remaining) { 418 bt_dev_err(hdev, "Malformed DDC record (plen=%u, remaining=%zu)", 419 cmd_plen, remaining); 420 release_firmware(fw); 421 return -EINVAL; 422 } 423 424 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 425 HCI_INIT_TIMEOUT); 426 if (IS_ERR(skb)) { 427 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 428 PTR_ERR(skb)); 429 release_firmware(fw); 430 return PTR_ERR(skb); 431 } 432 433 fw_ptr += cmd_plen; 434 kfree_skb(skb); 435 } 436 437 release_firmware(fw); 438 439 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 440 441 return 0; 442 } 443 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 444 445 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 446 { 447 int err, ret; 448 449 err = btintel_enter_mfg(hdev); 450 if (err) 451 return err; 452 453 ret = btintel_set_event_mask(hdev, debug); 454 455 err = btintel_exit_mfg(hdev, false, false); 456 if (err) 457 return err; 458 459 return ret; 460 } 461 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 462 463 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 464 { 465 struct sk_buff *skb; 466 467 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 468 if (IS_ERR(skb)) { 469 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 470 PTR_ERR(skb)); 471 return PTR_ERR(skb); 472 } 473 474 if (!skb || skb->len != sizeof(*ver)) { 475 bt_dev_err(hdev, "Intel version event size mismatch"); 476 kfree_skb(skb); 477 return -EILSEQ; 478 } 479 480 memcpy(ver, skb->data, sizeof(*ver)); 481 482 kfree_skb(skb); 483 484 return 0; 485 } 486 EXPORT_SYMBOL_GPL(btintel_read_version); 487 488 int btintel_version_info_tlv(struct hci_dev *hdev, 489 struct intel_version_tlv *version) 490 { 491 const char *variant; 492 493 /* The hardware platform number has a fixed value of 0x37 and 494 * for now only accept this single value. 495 */ 496 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 497 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 498 INTEL_HW_PLATFORM(version->cnvi_bt)); 499 return -EINVAL; 500 } 501 502 /* Check for supported iBT hardware variants of this firmware 503 * loading method. 504 * 505 * This check has been put in place to ensure correct forward 506 * compatibility options when newer hardware variants come along. 507 */ 508 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 509 case 0x17: /* TyP */ 510 case 0x18: /* Slr */ 511 case 0x19: /* Slr-F */ 512 case 0x1b: /* Mgr */ 513 case 0x1c: /* Gale Peak (GaP) */ 514 case 0x1d: /* BlazarU (BzrU) */ 515 case 0x1e: /* BlazarI (Bzr) */ 516 case 0x1f: /* Scorpious Peak */ 517 case 0x20: /* Scorpious Peak2 */ 518 case 0x21: /* Scorpious Peak2 F */ 519 case 0x22: /* BlazarIW (BzrIW) */ 520 case 0x23: /* Draco */ 521 break; 522 default: 523 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 524 INTEL_HW_VARIANT(version->cnvi_bt)); 525 return -EINVAL; 526 } 527 528 switch (version->img_type) { 529 case BTINTEL_IMG_BOOTLOADER: 530 variant = "Bootloader"; 531 /* It is required that every single firmware fragment is acknowledged 532 * with a command complete event. If the boot parameters indicate 533 * that this bootloader does not send them, then abort the setup. 534 */ 535 if (version->limited_cce != 0x00) { 536 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 537 version->limited_cce); 538 return -EINVAL; 539 } 540 541 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 542 if (version->sbe_type > 0x03) { 543 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 544 version->sbe_type); 545 return -EINVAL; 546 } 547 548 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 549 bt_dev_info(hdev, "Secure boot is %s", 550 str_enabled_disabled(version->secure_boot)); 551 bt_dev_info(hdev, "OTP lock is %s", 552 str_enabled_disabled(version->otp_lock)); 553 bt_dev_info(hdev, "API lock is %s", 554 str_enabled_disabled(version->api_lock)); 555 bt_dev_info(hdev, "Debug lock is %s", 556 str_enabled_disabled(version->debug_lock)); 557 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 558 version->min_fw_build_nn, version->min_fw_build_cw, 559 2000 + version->min_fw_build_yy); 560 break; 561 case BTINTEL_IMG_IML: 562 variant = "Intermediate loader"; 563 break; 564 case BTINTEL_IMG_OP: 565 variant = "Firmware"; 566 break; 567 default: 568 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 569 return -EINVAL; 570 } 571 572 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 573 coredump_info.fw_build_num = version->build_num; 574 coredump_info.fw_sha = version->git_sha1; 575 576 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 577 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 578 version->build_type, version->build_num); 579 if (version->img_type == BTINTEL_IMG_OP) 580 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 581 582 if (!mem_is_zero(version->platform_id, sizeof(version->platform_id))) 583 bt_dev_info(hdev, "Platform ID: %6phN", version->platform_id); 584 585 bt_dev_info(hdev, "Unlock policy: 0x%2.2x", version->unlock_policy); 586 587 return 0; 588 } 589 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 590 591 static u8 btintel_version_tlv_min_len(u8 type) 592 { 593 switch (type) { 594 case INTEL_TLV_CNVI_TOP: 595 case INTEL_TLV_CNVR_TOP: 596 case INTEL_TLV_CNVI_BT: 597 case INTEL_TLV_CNVR_BT: 598 case INTEL_TLV_BUILD_NUM: 599 case INTEL_TLV_GIT_SHA1: 600 return sizeof(u32); 601 case INTEL_TLV_DEV_REV_ID: 602 case INTEL_TLV_TIME_STAMP: 603 return sizeof(u16); 604 case INTEL_TLV_IMAGE_TYPE: 605 case INTEL_TLV_BUILD_TYPE: 606 case INTEL_TLV_SECURE_BOOT: 607 case INTEL_TLV_OTP_LOCK: 608 case INTEL_TLV_API_LOCK: 609 case INTEL_TLV_DEBUG_LOCK: 610 case INTEL_TLV_LIMITED_CCE: 611 case INTEL_TLV_SBE_TYPE: 612 case INTEL_TLV_UNLOCK_POLICY: 613 return sizeof(u8); 614 case INTEL_TLV_MIN_FW: 615 return 3; 616 case INTEL_TLV_OTP_BDADDR: 617 return sizeof(bdaddr_t); 618 case INTEL_TLV_PLATFORM_ID: 619 return sizeof(((struct intel_version_tlv *)0)->platform_id); 620 default: 621 return 0; 622 } 623 } 624 625 int btintel_parse_version_tlv(struct hci_dev *hdev, 626 struct intel_version_tlv *version, 627 struct sk_buff *skb) 628 { 629 /* Consume Command Complete Status field */ 630 if (!skb_pull(skb, 1)) 631 return -EINVAL; 632 633 /* Event parameters contain multiple TLVs. Read each of them 634 * and only keep the required data. Also, it use existing legacy 635 * version field like hw_platform, hw_variant, and fw_variant 636 * to keep the existing setup flow 637 */ 638 while (skb->len) { 639 struct intel_tlv *tlv; 640 641 /* Make sure skb has a minimum length of the header */ 642 if (skb->len < sizeof(*tlv)) 643 return -EINVAL; 644 645 tlv = (struct intel_tlv *)skb->data; 646 647 /* Make sure skb has a enough data */ 648 if (skb->len < tlv->len + sizeof(*tlv)) 649 return -EINVAL; 650 651 if (tlv->len < btintel_version_tlv_min_len(tlv->type)) 652 return -EINVAL; 653 654 switch (tlv->type) { 655 case INTEL_TLV_CNVI_TOP: 656 version->cnvi_top = get_unaligned_le32(tlv->val); 657 break; 658 case INTEL_TLV_CNVR_TOP: 659 version->cnvr_top = get_unaligned_le32(tlv->val); 660 break; 661 case INTEL_TLV_CNVI_BT: 662 version->cnvi_bt = get_unaligned_le32(tlv->val); 663 break; 664 case INTEL_TLV_CNVR_BT: 665 version->cnvr_bt = get_unaligned_le32(tlv->val); 666 break; 667 case INTEL_TLV_DEV_REV_ID: 668 version->dev_rev_id = get_unaligned_le16(tlv->val); 669 break; 670 case INTEL_TLV_IMAGE_TYPE: 671 version->img_type = tlv->val[0]; 672 break; 673 case INTEL_TLV_TIME_STAMP: 674 /* If image type is Operational firmware (0x03), then 675 * running FW Calendar Week and Year information can 676 * be extracted from Timestamp information 677 */ 678 version->min_fw_build_cw = tlv->val[0]; 679 version->min_fw_build_yy = tlv->val[1]; 680 version->timestamp = get_unaligned_le16(tlv->val); 681 break; 682 case INTEL_TLV_BUILD_TYPE: 683 version->build_type = tlv->val[0]; 684 break; 685 case INTEL_TLV_BUILD_NUM: 686 /* If image type is Operational firmware (0x03), then 687 * running FW build number can be extracted from the 688 * Build information 689 */ 690 version->min_fw_build_nn = tlv->val[0]; 691 version->build_num = get_unaligned_le32(tlv->val); 692 break; 693 case INTEL_TLV_SECURE_BOOT: 694 version->secure_boot = tlv->val[0]; 695 break; 696 case INTEL_TLV_OTP_LOCK: 697 version->otp_lock = tlv->val[0]; 698 break; 699 case INTEL_TLV_API_LOCK: 700 version->api_lock = tlv->val[0]; 701 break; 702 case INTEL_TLV_DEBUG_LOCK: 703 version->debug_lock = tlv->val[0]; 704 break; 705 case INTEL_TLV_MIN_FW: 706 version->min_fw_build_nn = tlv->val[0]; 707 version->min_fw_build_cw = tlv->val[1]; 708 version->min_fw_build_yy = tlv->val[2]; 709 break; 710 case INTEL_TLV_LIMITED_CCE: 711 version->limited_cce = tlv->val[0]; 712 break; 713 case INTEL_TLV_SBE_TYPE: 714 version->sbe_type = tlv->val[0]; 715 break; 716 case INTEL_TLV_OTP_BDADDR: 717 memcpy(&version->otp_bd_addr, tlv->val, 718 sizeof(bdaddr_t)); 719 break; 720 case INTEL_TLV_GIT_SHA1: 721 version->git_sha1 = get_unaligned_le32(tlv->val); 722 break; 723 case INTEL_TLV_FW_ID: 724 snprintf(version->fw_id, sizeof(version->fw_id), 725 "%.*s", tlv->len, tlv->val); 726 break; 727 case INTEL_TLV_UNLOCK_POLICY: 728 version->unlock_policy = tlv->val[0]; 729 break; 730 case INTEL_TLV_PLATFORM_ID: 731 memcpy(version->platform_id, tlv->val, 732 sizeof(version->platform_id)); 733 break; 734 default: 735 /* Ignore rest of information */ 736 break; 737 } 738 /* consume the current tlv and move to next*/ 739 skb_pull(skb, tlv->len + sizeof(*tlv)); 740 } 741 742 return 0; 743 } 744 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 745 746 static int btintel_read_version_tlv(struct hci_dev *hdev, 747 struct intel_version_tlv *version) 748 { 749 struct sk_buff *skb; 750 const u8 param[1] = { 0xFF }; 751 int err; 752 753 if (!version) 754 return -EINVAL; 755 756 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 757 if (IS_ERR(skb)) { 758 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 759 PTR_ERR(skb)); 760 return PTR_ERR(skb); 761 } 762 763 if (skb->data[0]) { 764 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 765 skb->data[0]); 766 kfree_skb(skb); 767 return -EIO; 768 } 769 770 memset(version, 0, sizeof(*version)); 771 err = btintel_parse_version_tlv(hdev, version, skb); 772 773 kfree_skb(skb); 774 return err; 775 } 776 777 /* ------- REGMAP IBT SUPPORT ------- */ 778 779 #define IBT_REG_MODE_8BIT 0x00 780 #define IBT_REG_MODE_16BIT 0x01 781 #define IBT_REG_MODE_32BIT 0x02 782 783 struct regmap_ibt_context { 784 struct hci_dev *hdev; 785 __u16 op_write; 786 __u16 op_read; 787 }; 788 789 struct ibt_cp_reg_access { 790 __le32 addr; 791 __u8 mode; 792 __u8 len; 793 __u8 data[]; 794 } __packed; 795 796 struct ibt_rp_reg_access { 797 __u8 status; 798 __le32 addr; 799 __u8 data[]; 800 } __packed; 801 802 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 803 void *val, size_t val_size) 804 { 805 struct regmap_ibt_context *ctx = context; 806 struct ibt_cp_reg_access cp; 807 struct ibt_rp_reg_access *rp; 808 struct sk_buff *skb; 809 int err = 0; 810 811 if (reg_size != sizeof(__le32)) 812 return -EINVAL; 813 814 switch (val_size) { 815 case 1: 816 cp.mode = IBT_REG_MODE_8BIT; 817 break; 818 case 2: 819 cp.mode = IBT_REG_MODE_16BIT; 820 break; 821 case 4: 822 cp.mode = IBT_REG_MODE_32BIT; 823 break; 824 default: 825 return -EINVAL; 826 } 827 828 /* regmap provides a little-endian formatted addr */ 829 cp.addr = *(__le32 *)addr; 830 cp.len = val_size; 831 832 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 833 834 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 835 HCI_CMD_TIMEOUT); 836 if (IS_ERR(skb)) { 837 err = PTR_ERR(skb); 838 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 839 le32_to_cpu(cp.addr), err); 840 return err; 841 } 842 843 if (skb->len != sizeof(*rp) + val_size) { 844 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 845 le32_to_cpu(cp.addr)); 846 err = -EINVAL; 847 goto done; 848 } 849 850 rp = (struct ibt_rp_reg_access *)skb->data; 851 852 if (rp->addr != cp.addr) { 853 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 854 le32_to_cpu(rp->addr)); 855 err = -EINVAL; 856 goto done; 857 } 858 859 memcpy(val, rp->data, val_size); 860 861 done: 862 kfree_skb(skb); 863 return err; 864 } 865 866 static int regmap_ibt_gather_write(void *context, 867 const void *addr, size_t reg_size, 868 const void *val, size_t val_size) 869 { 870 struct regmap_ibt_context *ctx = context; 871 struct ibt_cp_reg_access *cp; 872 struct sk_buff *skb; 873 int plen = sizeof(*cp) + val_size; 874 u8 mode; 875 int err = 0; 876 877 if (reg_size != sizeof(__le32)) 878 return -EINVAL; 879 880 switch (val_size) { 881 case 1: 882 mode = IBT_REG_MODE_8BIT; 883 break; 884 case 2: 885 mode = IBT_REG_MODE_16BIT; 886 break; 887 case 4: 888 mode = IBT_REG_MODE_32BIT; 889 break; 890 default: 891 return -EINVAL; 892 } 893 894 cp = kmalloc(plen, GFP_KERNEL); 895 if (!cp) 896 return -ENOMEM; 897 898 /* regmap provides a little-endian formatted addr/value */ 899 cp->addr = *(__le32 *)addr; 900 cp->mode = mode; 901 cp->len = val_size; 902 memcpy(&cp->data, val, val_size); 903 904 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 905 906 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 907 if (IS_ERR(skb)) { 908 err = PTR_ERR(skb); 909 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 910 le32_to_cpu(cp->addr), err); 911 goto done; 912 } 913 kfree_skb(skb); 914 915 done: 916 kfree(cp); 917 return err; 918 } 919 920 static int regmap_ibt_write(void *context, const void *data, size_t count) 921 { 922 /* data contains register+value, since we only support 32bit addr, 923 * minimum data size is 4 bytes. 924 */ 925 if (WARN_ONCE(count < 4, "Invalid register access")) 926 return -EINVAL; 927 928 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 929 } 930 931 static void regmap_ibt_free_context(void *context) 932 { 933 kfree(context); 934 } 935 936 static const struct regmap_bus regmap_ibt = { 937 .read = regmap_ibt_read, 938 .write = regmap_ibt_write, 939 .gather_write = regmap_ibt_gather_write, 940 .free_context = regmap_ibt_free_context, 941 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 942 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 943 }; 944 945 /* Config is the same for all register regions */ 946 static const struct regmap_config regmap_ibt_cfg = { 947 .name = "btintel_regmap", 948 .reg_bits = 32, 949 .val_bits = 32, 950 }; 951 952 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 953 u16 opcode_write) 954 { 955 struct regmap_ibt_context *ctx; 956 957 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 958 opcode_write); 959 960 ctx = kzalloc_obj(*ctx); 961 if (!ctx) 962 return ERR_PTR(-ENOMEM); 963 964 ctx->op_read = opcode_read; 965 ctx->op_write = opcode_write; 966 ctx->hdev = hdev; 967 968 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 969 } 970 EXPORT_SYMBOL_GPL(btintel_regmap_init); 971 972 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 973 { 974 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 975 struct sk_buff *skb; 976 977 params.boot_param = cpu_to_le32(boot_param); 978 979 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 980 HCI_INIT_TIMEOUT); 981 if (IS_ERR(skb)) { 982 bt_dev_err(hdev, "Failed to send Intel Reset command"); 983 return PTR_ERR(skb); 984 } 985 986 kfree_skb(skb); 987 988 return 0; 989 } 990 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 991 992 static void btintel_get_rom_debug_info(struct hci_dev *hdev) 993 { 994 struct btintel_rp_get_rom_debug_info *rom_debug_info; 995 struct sk_buff *skb; 996 997 skb = __hci_cmd_sync(hdev, BTINTEL_GET_ROM_DEBUG_INFO, 0, NULL, 998 HCI_CMD_TIMEOUT); 999 if (IS_ERR(skb)) { 1000 bt_dev_err(hdev, "Failed to send Intel get rom debug info command (%ld)", 1001 PTR_ERR(skb)); 1002 return; 1003 } 1004 1005 if (skb->len != sizeof(*rom_debug_info)) { 1006 bt_dev_err(hdev, 1007 "Intel get rom debug info size mismatch (%u != %zu)", 1008 skb->len, sizeof(*rom_debug_info)); 1009 kfree_skb(skb); 1010 return; 1011 } 1012 1013 rom_debug_info = (struct btintel_rp_get_rom_debug_info *)skb->data; 1014 1015 /* A non-zero status here would have already been turned into an 1016 * error by the HCI core and reported via the IS_ERR(skb) check above. 1017 */ 1018 bt_dev_info(hdev, "Intel get rom debug info: dr0:0x%08x dr1:0x%08x dr2:0x%08x dr3:0x%08x", 1019 le32_to_cpu(rom_debug_info->debug_reg0), 1020 le32_to_cpu(rom_debug_info->debug_reg1), 1021 le32_to_cpu(rom_debug_info->debug_reg2), 1022 le32_to_cpu(rom_debug_info->debug_reg3)); 1023 1024 kfree_skb(skb); 1025 } 1026 1027 int btintel_read_boot_params(struct hci_dev *hdev, 1028 struct intel_boot_params *params) 1029 { 1030 struct sk_buff *skb; 1031 1032 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 1033 if (IS_ERR(skb)) { 1034 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 1035 PTR_ERR(skb)); 1036 return PTR_ERR(skb); 1037 } 1038 1039 if (skb->len != sizeof(*params)) { 1040 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 1041 kfree_skb(skb); 1042 return -EILSEQ; 1043 } 1044 1045 memcpy(params, skb->data, sizeof(*params)); 1046 1047 kfree_skb(skb); 1048 1049 if (params->status) { 1050 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 1051 params->status); 1052 return -bt_to_errno(params->status); 1053 } 1054 1055 bt_dev_info(hdev, "Device revision is %u", 1056 le16_to_cpu(params->dev_revid)); 1057 1058 bt_dev_info(hdev, "Secure boot is %s", 1059 str_enabled_disabled(params->secure_boot)); 1060 1061 bt_dev_info(hdev, "OTP lock is %s", 1062 str_enabled_disabled(params->otp_lock)); 1063 1064 bt_dev_info(hdev, "API lock is %s", 1065 str_enabled_disabled(params->api_lock)); 1066 1067 bt_dev_info(hdev, "Debug lock is %s", 1068 str_enabled_disabled(params->debug_lock)); 1069 1070 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 1071 params->min_fw_build_nn, params->min_fw_build_cw, 1072 2000 + params->min_fw_build_yy); 1073 1074 return 0; 1075 } 1076 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 1077 1078 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 1079 const struct firmware *fw) 1080 { 1081 int err; 1082 1083 /* Start the firmware download transaction with the Init fragment 1084 * represented by the 128 bytes of CSS header. 1085 */ 1086 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 1087 if (err < 0) { 1088 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1089 goto done; 1090 } 1091 1092 /* Send the 256 bytes of public key information from the firmware 1093 * as the PKey fragment. 1094 */ 1095 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 1096 if (err < 0) { 1097 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1098 goto done; 1099 } 1100 1101 /* Send the 256 bytes of signature information from the firmware 1102 * as the Sign fragment. 1103 */ 1104 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1105 if (err < 0) { 1106 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1107 goto done; 1108 } 1109 1110 done: 1111 return err; 1112 } 1113 1114 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1115 const struct firmware *fw) 1116 { 1117 int err; 1118 1119 /* Start the firmware download transaction with the Init fragment 1120 * represented by the 128 bytes of CSS header. 1121 */ 1122 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1123 if (err < 0) { 1124 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1125 return err; 1126 } 1127 1128 /* Send the 96 bytes of public key information from the firmware 1129 * as the PKey fragment. 1130 */ 1131 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1132 if (err < 0) { 1133 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1134 return err; 1135 } 1136 1137 /* Send the 96 bytes of signature information from the firmware 1138 * as the Sign fragment 1139 */ 1140 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1141 if (err < 0) { 1142 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1143 err); 1144 return err; 1145 } 1146 return 0; 1147 } 1148 1149 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1150 const struct firmware *fw) 1151 { 1152 int err; 1153 1154 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1155 if (err < 0) { 1156 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1157 return err; 1158 } 1159 1160 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1161 fw->data + BTINTEL_ECDSA_OFFSET); 1162 if (err < 0) { 1163 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1164 return err; 1165 } 1166 1167 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1168 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1169 if (err < 0) { 1170 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1171 return err; 1172 } 1173 1174 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1175 fw->data + BTINTEL_LMS_OFFSET); 1176 if (err < 0) { 1177 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1178 return err; 1179 } 1180 1181 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1182 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1183 if (err < 0) { 1184 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1185 return err; 1186 } 1187 1188 return 0; 1189 } 1190 1191 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1192 const struct firmware *fw, 1193 size_t offset) 1194 { 1195 int err; 1196 const u8 *fw_ptr; 1197 u32 frag_len; 1198 1199 fw_ptr = fw->data + offset; 1200 frag_len = 0; 1201 err = -EINVAL; 1202 1203 while (fw_ptr - fw->data < fw->size) { 1204 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1205 1206 frag_len += sizeof(*cmd) + cmd->plen; 1207 1208 /* The parameter length of the secure send command requires 1209 * a 4 byte alignment. It happens so that the firmware file 1210 * contains proper Intel_NOP commands to align the fragments 1211 * as needed. 1212 * 1213 * Send set of commands with 4 byte alignment from the 1214 * firmware data buffer as a single Data fragment. 1215 */ 1216 if (!(frag_len % 4)) { 1217 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1218 if (err < 0) { 1219 bt_dev_err(hdev, 1220 "Failed to send firmware data (%d)", 1221 err); 1222 goto done; 1223 } 1224 1225 fw_ptr += frag_len; 1226 frag_len = 0; 1227 } 1228 } 1229 1230 done: 1231 return err; 1232 } 1233 1234 static bool btintel_firmware_version(struct hci_dev *hdev, 1235 u8 num, u8 ww, u8 yy, 1236 const struct firmware *fw, 1237 u32 *boot_addr) 1238 { 1239 const u8 *fw_ptr; 1240 1241 fw_ptr = fw->data; 1242 1243 while (fw_ptr - fw->data < fw->size) { 1244 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1245 1246 /* Each SKU has a different reset parameter to use in the 1247 * HCI_Intel_Reset command and it is embedded in the firmware 1248 * data. So, instead of using static value per SKU, check 1249 * the firmware data and save it for later use. 1250 */ 1251 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1252 struct cmd_write_boot_params *params; 1253 1254 params = (void *)(fw_ptr + sizeof(*cmd)); 1255 1256 *boot_addr = le32_to_cpu(params->boot_addr); 1257 1258 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1259 1260 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1261 params->fw_build_num, params->fw_build_ww, 1262 params->fw_build_yy); 1263 1264 return (num == params->fw_build_num && 1265 ww == params->fw_build_ww && 1266 yy == params->fw_build_yy); 1267 } 1268 1269 fw_ptr += sizeof(*cmd) + cmd->plen; 1270 } 1271 1272 return false; 1273 } 1274 1275 int btintel_download_firmware(struct hci_dev *hdev, 1276 struct intel_version *ver, 1277 const struct firmware *fw, 1278 u32 *boot_param) 1279 { 1280 int err; 1281 1282 /* SfP and WsP don't seem to update the firmware version on file 1283 * so version checking is currently not possible. 1284 */ 1285 switch (ver->hw_variant) { 1286 case 0x0b: /* SfP */ 1287 case 0x0c: /* WsP */ 1288 /* Skip version checking */ 1289 break; 1290 default: 1291 1292 /* Skip download if firmware has the same version */ 1293 if (btintel_firmware_version(hdev, ver->fw_build_num, 1294 ver->fw_build_ww, ver->fw_build_yy, 1295 fw, boot_param)) { 1296 bt_dev_info(hdev, "Firmware already loaded"); 1297 /* Return -EALREADY to indicate that the firmware has 1298 * already been loaded. 1299 */ 1300 return -EALREADY; 1301 } 1302 } 1303 1304 /* The firmware variant determines if the device is in bootloader 1305 * mode or is running operational firmware. The value 0x06 identifies 1306 * the bootloader and the value 0x23 identifies the operational 1307 * firmware. 1308 * 1309 * If the firmware version has changed that means it needs to be reset 1310 * to bootloader when operational so the new firmware can be loaded. 1311 */ 1312 if (ver->fw_variant == 0x23) 1313 return -EINVAL; 1314 1315 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1316 if (err) 1317 return err; 1318 1319 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1320 } 1321 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1322 1323 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1324 struct intel_version_tlv *ver, 1325 const struct firmware *fw, u32 *boot_param, 1326 u8 hw_variant, u8 sbe_type) 1327 { 1328 int err; 1329 u32 css_header_ver; 1330 1331 /* Skip download if firmware has the same version */ 1332 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1333 ver->min_fw_build_cw, 1334 ver->min_fw_build_yy, 1335 fw, boot_param)) { 1336 bt_dev_info(hdev, "Firmware already loaded"); 1337 /* Return -EALREADY to indicate that firmware has 1338 * already been loaded. 1339 */ 1340 return -EALREADY; 1341 } 1342 1343 /* The firmware variant determines if the device is in bootloader 1344 * mode or is running operational firmware. The value 0x01 identifies 1345 * the bootloader and the value 0x03 identifies the operational 1346 * firmware. 1347 * 1348 * If the firmware version has changed that means it needs to be reset 1349 * to bootloader when operational so the new firmware can be loaded. 1350 */ 1351 if (ver->img_type == BTINTEL_IMG_OP) 1352 return -EINVAL; 1353 1354 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1355 * only RSA secure boot engine. Hence, the corresponding sfi file will 1356 * have RSA header of 644 bytes followed by Command Buffer. 1357 * 1358 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1359 * secure boot engine. As a result, the corresponding sfi file will 1360 * have RSA header of 644, ECDSA header of 320 bytes followed by 1361 * Command Buffer. 1362 * 1363 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1364 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1365 */ 1366 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1367 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1368 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1369 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1370 return -EINVAL; 1371 } 1372 1373 if (hw_variant <= 0x14) { 1374 if (sbe_type != 0x00) { 1375 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1376 hw_variant); 1377 return -EINVAL; 1378 } 1379 1380 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1381 if (err) 1382 return err; 1383 1384 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1385 if (err) 1386 return err; 1387 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1388 /* Check if CSS header for ECDSA follows the RSA header */ 1389 if (fw->data[ECDSA_OFFSET] != 0x06) 1390 return -EINVAL; 1391 1392 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1393 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1394 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1395 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1396 return -EINVAL; 1397 } 1398 1399 if (sbe_type == 0x00) { 1400 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1401 if (err) 1402 return err; 1403 1404 err = btintel_download_firmware_payload(hdev, fw, 1405 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1406 if (err) 1407 return err; 1408 } else if (sbe_type == 0x01) { 1409 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1410 if (err) 1411 return err; 1412 1413 err = btintel_download_firmware_payload(hdev, fw, 1414 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1415 if (err) 1416 return err; 1417 } 1418 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1419 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1420 if (err) 1421 return err; 1422 1423 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1424 if (err) 1425 return err; 1426 } 1427 return 0; 1428 } 1429 1430 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1431 { 1432 struct intel_reset params; 1433 struct sk_buff *skb; 1434 1435 /* PCIe transport uses shared hardware reset mechanism for recovery 1436 * which gets triggered in pcie *setup* function on error. 1437 */ 1438 if (hdev->bus == HCI_PCI) 1439 return; 1440 1441 /* Send Intel Reset command. This will result in 1442 * re-enumeration of BT controller. 1443 * 1444 * Intel Reset parameter description: 1445 * reset_type : 0x00 (Soft reset), 1446 * 0x01 (Hard reset) 1447 * patch_enable : 0x00 (Do not enable), 1448 * 0x01 (Enable) 1449 * ddc_reload : 0x00 (Do not reload), 1450 * 0x01 (Reload) 1451 * boot_option: 0x00 (Current image), 1452 * 0x01 (Specified boot address) 1453 * boot_param: Boot address 1454 * 1455 */ 1456 1457 params.reset_type = 0x01; 1458 params.patch_enable = 0x01; 1459 params.ddc_reload = 0x01; 1460 params.boot_option = 0x00; 1461 params.boot_param = cpu_to_le32(0x00000000); 1462 1463 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1464 ¶ms, HCI_INIT_TIMEOUT); 1465 if (IS_ERR(skb)) { 1466 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1467 PTR_ERR(skb)); 1468 return; 1469 } 1470 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1471 kfree_skb(skb); 1472 1473 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1474 * lines for 2ms when it receives Intel Reset in bootloader mode. 1475 * Whereas, the upcoming Intel BT controllers will hold USB reset 1476 * for 150ms. To keep the delay generic, 150ms is chosen here. 1477 */ 1478 msleep(150); 1479 } 1480 1481 static int btintel_read_debug_features(struct hci_dev *hdev, 1482 struct intel_debug_features *features) 1483 { 1484 struct sk_buff *skb; 1485 u8 page_no = 1; 1486 1487 /* Intel controller supports two pages, each page is of 128-bit 1488 * feature bit mask. And each bit defines specific feature support 1489 */ 1490 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1491 HCI_INIT_TIMEOUT); 1492 if (IS_ERR(skb)) { 1493 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1494 PTR_ERR(skb)); 1495 return PTR_ERR(skb); 1496 } 1497 1498 if (skb->len != (sizeof(features->page1) + 3)) { 1499 bt_dev_err(hdev, "Supported features event size mismatch"); 1500 kfree_skb(skb); 1501 return -EILSEQ; 1502 } 1503 1504 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1505 1506 /* Read the supported features page2 if required in future. 1507 */ 1508 kfree_skb(skb); 1509 return 0; 1510 } 1511 1512 static int btintel_set_debug_features(struct hci_dev *hdev, 1513 const struct intel_debug_features *features) 1514 { 1515 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1516 0x00, 0x00, 0x00 }; 1517 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1518 u8 trace_enable = 0x02; 1519 struct sk_buff *skb; 1520 1521 if (!features) { 1522 bt_dev_warn(hdev, "Debug features not read"); 1523 return -EINVAL; 1524 } 1525 1526 if (!(features->page1[0] & 0x3f)) { 1527 bt_dev_info(hdev, "Telemetry exception format not supported"); 1528 return 0; 1529 } 1530 1531 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1532 if (IS_ERR(skb)) { 1533 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1534 PTR_ERR(skb)); 1535 return PTR_ERR(skb); 1536 } 1537 kfree_skb(skb); 1538 1539 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1540 if (IS_ERR(skb)) { 1541 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1542 PTR_ERR(skb)); 1543 return PTR_ERR(skb); 1544 } 1545 kfree_skb(skb); 1546 1547 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1548 if (IS_ERR(skb)) { 1549 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1550 PTR_ERR(skb)); 1551 return PTR_ERR(skb); 1552 } 1553 kfree_skb(skb); 1554 1555 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1556 trace_enable, mask[3]); 1557 1558 return 0; 1559 } 1560 1561 static int btintel_reset_debug_features(struct hci_dev *hdev, 1562 const struct intel_debug_features *features) 1563 { 1564 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1565 0x00, 0x00, 0x00 }; 1566 u8 trace_enable = 0x00; 1567 struct sk_buff *skb; 1568 1569 if (!features) { 1570 bt_dev_warn(hdev, "Debug features not read"); 1571 return -EINVAL; 1572 } 1573 1574 if (!(features->page1[0] & 0x3f)) { 1575 bt_dev_info(hdev, "Telemetry exception format not supported"); 1576 return 0; 1577 } 1578 1579 /* Should stop the trace before writing ddc event mask. */ 1580 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1581 if (IS_ERR(skb)) { 1582 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1583 PTR_ERR(skb)); 1584 return PTR_ERR(skb); 1585 } 1586 kfree_skb(skb); 1587 1588 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1589 if (IS_ERR(skb)) { 1590 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1591 PTR_ERR(skb)); 1592 return PTR_ERR(skb); 1593 } 1594 kfree_skb(skb); 1595 1596 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1597 trace_enable, mask[3]); 1598 1599 return 0; 1600 } 1601 1602 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1603 { 1604 struct intel_debug_features features; 1605 int err; 1606 1607 bt_dev_dbg(hdev, "enable %d", enable); 1608 1609 /* Read the Intel supported features and if new exception formats 1610 * supported, need to load the additional DDC config to enable. 1611 */ 1612 err = btintel_read_debug_features(hdev, &features); 1613 if (err) 1614 return err; 1615 1616 /* Set or reset the debug features. */ 1617 if (enable) 1618 err = btintel_set_debug_features(hdev, &features); 1619 else 1620 err = btintel_reset_debug_features(hdev, &features); 1621 1622 return err; 1623 } 1624 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1625 1626 static void btintel_coredump(struct hci_dev *hdev) 1627 { 1628 struct sk_buff *skb; 1629 1630 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1631 if (IS_ERR(skb)) { 1632 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1633 return; 1634 } 1635 1636 kfree_skb(skb); 1637 } 1638 1639 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1640 { 1641 char buf[80]; 1642 1643 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1644 coredump_info.hw_variant); 1645 skb_put_data(skb, buf, strlen(buf)); 1646 1647 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1648 coredump_info.fw_build_num); 1649 skb_put_data(skb, buf, strlen(buf)); 1650 1651 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1652 skb_put_data(skb, buf, strlen(buf)); 1653 1654 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1655 skb_put_data(skb, buf, strlen(buf)); 1656 } 1657 1658 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1659 { 1660 struct intel_debug_features features; 1661 int err; 1662 1663 err = btintel_read_debug_features(hdev, &features); 1664 if (err) { 1665 bt_dev_info(hdev, "Error reading debug features"); 1666 return err; 1667 } 1668 1669 if (!(features.page1[0] & 0x3f)) { 1670 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1671 return -EOPNOTSUPP; 1672 } 1673 1674 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1675 1676 return err; 1677 } 1678 1679 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1680 struct intel_version *ver) 1681 { 1682 const struct firmware *fw; 1683 char fwname[64]; 1684 int ret; 1685 1686 snprintf(fwname, sizeof(fwname), 1687 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1688 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1689 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1690 ver->fw_build_ww, ver->fw_build_yy); 1691 1692 ret = request_firmware(&fw, fwname, &hdev->dev); 1693 if (ret < 0) { 1694 if (ret == -EINVAL) { 1695 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1696 ret); 1697 return NULL; 1698 } 1699 1700 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1701 fwname, ret); 1702 1703 /* If the correct firmware patch file is not found, use the 1704 * default firmware patch file instead 1705 */ 1706 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1707 ver->hw_platform, ver->hw_variant); 1708 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1709 bt_dev_err(hdev, "failed to open default fw file: %s", 1710 fwname); 1711 return NULL; 1712 } 1713 } 1714 1715 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1716 1717 return fw; 1718 } 1719 1720 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1721 const struct firmware *fw, 1722 const u8 **fw_ptr, int *disable_patch) 1723 { 1724 struct sk_buff *skb; 1725 struct hci_command_hdr *cmd; 1726 const u8 *cmd_param; 1727 struct hci_event_hdr *evt = NULL; 1728 const u8 *evt_param = NULL; 1729 int remain = fw->size - (*fw_ptr - fw->data); 1730 1731 /* The first byte indicates the types of the patch command or event. 1732 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1733 * in the current firmware buffer doesn't start with 0x01 or 1734 * the size of remain buffer is smaller than HCI command header, 1735 * the firmware file is corrupted and it should stop the patching 1736 * process. 1737 */ 1738 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1739 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1740 return -EINVAL; 1741 } 1742 (*fw_ptr)++; 1743 remain--; 1744 1745 cmd = (struct hci_command_hdr *)(*fw_ptr); 1746 *fw_ptr += sizeof(*cmd); 1747 remain -= sizeof(*cmd); 1748 1749 /* Ensure that the remain firmware data is long enough than the length 1750 * of command parameter. If not, the firmware file is corrupted. 1751 */ 1752 if (remain < cmd->plen) { 1753 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1754 return -EFAULT; 1755 } 1756 1757 /* If there is a command that loads a patch in the firmware 1758 * file, then enable the patch upon success, otherwise just 1759 * disable the manufacturer mode, for example patch activation 1760 * is not required when the default firmware patch file is used 1761 * because there are no patch data to load. 1762 */ 1763 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1764 *disable_patch = 0; 1765 1766 cmd_param = *fw_ptr; 1767 *fw_ptr += cmd->plen; 1768 remain -= cmd->plen; 1769 1770 /* This reads the expected events when the above command is sent to the 1771 * device. Some vendor commands expects more than one events, for 1772 * example command status event followed by vendor specific event. 1773 * For this case, it only keeps the last expected event. so the command 1774 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1775 * last expected event. 1776 */ 1777 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1778 (*fw_ptr)++; 1779 remain--; 1780 1781 evt = (struct hci_event_hdr *)(*fw_ptr); 1782 *fw_ptr += sizeof(*evt); 1783 remain -= sizeof(*evt); 1784 1785 if (remain < evt->plen) { 1786 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1787 return -EFAULT; 1788 } 1789 1790 evt_param = *fw_ptr; 1791 *fw_ptr += evt->plen; 1792 remain -= evt->plen; 1793 } 1794 1795 /* Every HCI commands in the firmware file has its correspond event. 1796 * If event is not found or remain is smaller than zero, the firmware 1797 * file is corrupted. 1798 */ 1799 if (!evt || !evt_param || remain < 0) { 1800 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1801 return -EFAULT; 1802 } 1803 1804 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1805 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1806 if (IS_ERR(skb)) { 1807 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1808 cmd->opcode, PTR_ERR(skb)); 1809 return PTR_ERR(skb); 1810 } 1811 1812 /* It ensures that the returned event matches the event data read from 1813 * the firmware file. At fist, it checks the length and then 1814 * the contents of the event. 1815 */ 1816 if (skb->len != evt->plen) { 1817 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1818 le16_to_cpu(cmd->opcode)); 1819 kfree_skb(skb); 1820 return -EFAULT; 1821 } 1822 1823 if (memcmp(skb->data, evt_param, evt->plen)) { 1824 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1825 le16_to_cpu(cmd->opcode)); 1826 kfree_skb(skb); 1827 return -EFAULT; 1828 } 1829 kfree_skb(skb); 1830 1831 return 0; 1832 } 1833 1834 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1835 struct intel_version *ver) 1836 { 1837 const struct firmware *fw; 1838 const u8 *fw_ptr; 1839 int disable_patch, err; 1840 struct intel_version new_ver; 1841 1842 BT_DBG("%s", hdev->name); 1843 1844 /* fw_patch_num indicates the version of patch the device currently 1845 * have. If there is no patch data in the device, it is always 0x00. 1846 * So, if it is other than 0x00, no need to patch the device again. 1847 */ 1848 if (ver->fw_patch_num) { 1849 bt_dev_info(hdev, 1850 "Intel device is already patched. patch num: %02x", 1851 ver->fw_patch_num); 1852 goto complete; 1853 } 1854 1855 /* Opens the firmware patch file based on the firmware version read 1856 * from the controller. If it fails to open the matching firmware 1857 * patch file, it tries to open the default firmware patch file. 1858 * If no patch file is found, allow the device to operate without 1859 * a patch. 1860 */ 1861 fw = btintel_legacy_rom_get_fw(hdev, ver); 1862 if (!fw) 1863 goto complete; 1864 fw_ptr = fw->data; 1865 1866 /* Enable the manufacturer mode of the controller. 1867 * Only while this mode is enabled, the driver can download the 1868 * firmware patch data and configuration parameters. 1869 */ 1870 err = btintel_enter_mfg(hdev); 1871 if (err) { 1872 release_firmware(fw); 1873 return err; 1874 } 1875 1876 disable_patch = 1; 1877 1878 /* The firmware data file consists of list of Intel specific HCI 1879 * commands and its expected events. The first byte indicates the 1880 * type of the message, either HCI command or HCI event. 1881 * 1882 * It reads the command and its expected event from the firmware file, 1883 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1884 * the returned event is compared with the event read from the firmware 1885 * file and it will continue until all the messages are downloaded to 1886 * the controller. 1887 * 1888 * Once the firmware patching is completed successfully, 1889 * the manufacturer mode is disabled with reset and activating the 1890 * downloaded patch. 1891 * 1892 * If the firmware patching fails, the manufacturer mode is 1893 * disabled with reset and deactivating the patch. 1894 * 1895 * If the default patch file is used, no reset is done when disabling 1896 * the manufacturer. 1897 */ 1898 while (fw->size > fw_ptr - fw->data) { 1899 int ret; 1900 1901 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1902 &disable_patch); 1903 if (ret < 0) 1904 goto exit_mfg_deactivate; 1905 } 1906 1907 release_firmware(fw); 1908 1909 if (disable_patch) 1910 goto exit_mfg_disable; 1911 1912 /* Patching completed successfully and disable the manufacturer mode 1913 * with reset and activate the downloaded firmware patches. 1914 */ 1915 err = btintel_exit_mfg(hdev, true, true); 1916 if (err) 1917 return err; 1918 1919 /* Need build number for downloaded fw patches in 1920 * every power-on boot 1921 */ 1922 err = btintel_read_version(hdev, &new_ver); 1923 if (err) 1924 return err; 1925 1926 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1927 new_ver.fw_patch_num); 1928 1929 goto complete; 1930 1931 exit_mfg_disable: 1932 /* Disable the manufacturer mode without reset */ 1933 err = btintel_exit_mfg(hdev, false, false); 1934 if (err) 1935 return err; 1936 1937 bt_dev_info(hdev, "Intel firmware patch completed"); 1938 1939 goto complete; 1940 1941 exit_mfg_deactivate: 1942 release_firmware(fw); 1943 1944 /* Patching failed. Disable the manufacturer mode with reset and 1945 * deactivate the downloaded firmware patches. 1946 */ 1947 err = btintel_exit_mfg(hdev, true, false); 1948 if (err) 1949 return err; 1950 1951 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1952 1953 complete: 1954 /* Set the event mask for Intel specific vendor events. This enables 1955 * a few extra events that are useful during general operation. 1956 */ 1957 btintel_set_event_mask_mfg(hdev, false); 1958 1959 btintel_check_bdaddr(hdev); 1960 1961 return 0; 1962 } 1963 1964 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1965 { 1966 ktime_t delta, rettime; 1967 unsigned long long duration; 1968 int err; 1969 1970 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1971 1972 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1973 1974 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1975 TASK_INTERRUPTIBLE, 1976 msecs_to_jiffies(msec)); 1977 if (err == -EINTR) { 1978 bt_dev_err(hdev, "Firmware loading interrupted"); 1979 return err; 1980 } 1981 1982 if (err) { 1983 bt_dev_err(hdev, "Firmware loading timeout"); 1984 return -ETIMEDOUT; 1985 } 1986 1987 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1988 bt_dev_err(hdev, "Firmware loading failed"); 1989 return -ENOEXEC; 1990 } 1991 1992 rettime = ktime_get(); 1993 delta = ktime_sub(rettime, calltime); 1994 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1995 1996 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1997 1998 return 0; 1999 } 2000 2001 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 2002 { 2003 ktime_t delta, rettime; 2004 unsigned long long duration; 2005 int err; 2006 2007 bt_dev_info(hdev, "Waiting for device to boot"); 2008 2009 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 2010 TASK_INTERRUPTIBLE, 2011 msecs_to_jiffies(msec)); 2012 if (err == -EINTR) { 2013 bt_dev_err(hdev, "Device boot interrupted"); 2014 return -EINTR; 2015 } 2016 2017 if (err) { 2018 bt_dev_err(hdev, "Device boot timeout"); 2019 return -ETIMEDOUT; 2020 } 2021 2022 rettime = ktime_get(); 2023 delta = ktime_sub(rettime, calltime); 2024 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2025 2026 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 2027 2028 return 0; 2029 } 2030 2031 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 2032 int msec) 2033 { 2034 ktime_t delta, rettime; 2035 unsigned long long duration; 2036 int err; 2037 2038 bt_dev_info(hdev, "Waiting for device transition to d0"); 2039 2040 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 2041 TASK_INTERRUPTIBLE, 2042 msecs_to_jiffies(msec)); 2043 if (err == -EINTR) { 2044 bt_dev_err(hdev, "Device d0 move interrupted"); 2045 return -EINTR; 2046 } 2047 2048 if (err) { 2049 bt_dev_err(hdev, "Device d0 move timeout"); 2050 return -ETIMEDOUT; 2051 } 2052 2053 rettime = ktime_get(); 2054 delta = ktime_sub(rettime, calltime); 2055 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 2056 2057 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 2058 2059 return 0; 2060 } 2061 2062 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 2063 { 2064 ktime_t calltime; 2065 int err; 2066 2067 calltime = ktime_get(); 2068 2069 btintel_set_flag(hdev, INTEL_BOOTING); 2070 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 2071 2072 err = btintel_send_intel_reset(hdev, boot_addr); 2073 if (err) { 2074 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 2075 btintel_reset_to_bootloader(hdev); 2076 return err; 2077 } 2078 2079 /* The bootloader will not indicate when the device is ready. This 2080 * is done by the operational firmware sending bootup notification. 2081 * 2082 * Booting into operational firmware should not take longer than 2083 * 5 second. However if that happens, then just fail the setup 2084 * since something went wrong. 2085 */ 2086 err = btintel_boot_wait(hdev, calltime, 5000); 2087 if (err == -ETIMEDOUT) { 2088 btintel_reset_to_bootloader(hdev); 2089 goto exit_error; 2090 } 2091 2092 if (hdev->bus == HCI_PCI) { 2093 /* In case of PCIe, after receiving bootup event, driver performs 2094 * D0 entry by writing 0 to sleep control register (check 2095 * btintel_pcie_recv_event()) 2096 * Firmware acks with alive interrupt indicating host is full ready to 2097 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 2098 * bit is cleared. 2099 */ 2100 calltime = ktime_get(); 2101 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2102 } 2103 2104 exit_error: 2105 return err; 2106 } 2107 2108 static int btintel_get_fw_name(struct intel_version *ver, 2109 struct intel_boot_params *params, 2110 char *fw_name, size_t len, 2111 const char *suffix) 2112 { 2113 switch (ver->hw_variant) { 2114 case 0x0b: /* SfP */ 2115 case 0x0c: /* WsP */ 2116 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2117 ver->hw_variant, 2118 le16_to_cpu(params->dev_revid), 2119 suffix); 2120 break; 2121 case 0x11: /* JfP */ 2122 case 0x12: /* ThP */ 2123 case 0x13: /* HrP */ 2124 case 0x14: /* CcP */ 2125 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2126 ver->hw_variant, 2127 ver->hw_revision, 2128 ver->fw_revision, 2129 suffix); 2130 break; 2131 default: 2132 return -EINVAL; 2133 } 2134 2135 return 0; 2136 } 2137 2138 static int btintel_download_fw(struct hci_dev *hdev, 2139 struct intel_version *ver, 2140 struct intel_boot_params *params, 2141 u32 *boot_param) 2142 { 2143 const struct firmware *fw; 2144 char fwname[64]; 2145 int err; 2146 ktime_t calltime; 2147 2148 if (!ver || !params) 2149 return -EINVAL; 2150 2151 /* The firmware variant determines if the device is in bootloader 2152 * mode or is running operational firmware. The value 0x06 identifies 2153 * the bootloader and the value 0x23 identifies the operational 2154 * firmware. 2155 * 2156 * When the operational firmware is already present, then only 2157 * the check for valid Bluetooth device address is needed. This 2158 * determines if the device will be added as configured or 2159 * unconfigured controller. 2160 * 2161 * It is not possible to use the Secure Boot Parameters in this 2162 * case since that command is only available in bootloader mode. 2163 */ 2164 if (ver->fw_variant == 0x23) { 2165 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2166 btintel_check_bdaddr(hdev); 2167 2168 /* SfP and WsP don't seem to update the firmware version on file 2169 * so version checking is currently possible. 2170 */ 2171 switch (ver->hw_variant) { 2172 case 0x0b: /* SfP */ 2173 case 0x0c: /* WsP */ 2174 return 0; 2175 } 2176 2177 /* Proceed to download to check if the version matches */ 2178 goto download; 2179 } 2180 2181 /* Read the secure boot parameters to identify the operating 2182 * details of the bootloader. 2183 */ 2184 err = btintel_read_boot_params(hdev, params); 2185 if (err) 2186 return err; 2187 2188 /* It is required that every single firmware fragment is acknowledged 2189 * with a command complete event. If the boot parameters indicate 2190 * that this bootloader does not send them, then abort the setup. 2191 */ 2192 if (params->limited_cce != 0x00) { 2193 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2194 params->limited_cce); 2195 return -EINVAL; 2196 } 2197 2198 /* If the OTP has no valid Bluetooth device address, then there will 2199 * also be no valid address for the operational firmware. 2200 */ 2201 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2202 bt_dev_info(hdev, "No device address configured"); 2203 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2204 } 2205 2206 download: 2207 /* With this Intel bootloader only the hardware variant and device 2208 * revision information are used to select the right firmware for SfP 2209 * and WsP. 2210 * 2211 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2212 * 2213 * Currently the supported hardware variants are: 2214 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2215 * 12 (0x0c) for iBT3.5 (WsP) 2216 * 2217 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2218 * variant, HW revision and FW revision, as these are dependent on CNVi 2219 * and RF Combination. 2220 * 2221 * 17 (0x11) for iBT3.5 (JfP) 2222 * 18 (0x12) for iBT3.5 (ThP) 2223 * 2224 * The firmware file name for these will be 2225 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2226 * 2227 */ 2228 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2229 if (err < 0) { 2230 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2231 /* Firmware has already been loaded */ 2232 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2233 return 0; 2234 } 2235 2236 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2237 return -EINVAL; 2238 } 2239 2240 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2241 if (err < 0) { 2242 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2243 /* Firmware has already been loaded */ 2244 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2245 return 0; 2246 } 2247 2248 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2249 fwname, err); 2250 return err; 2251 } 2252 2253 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2254 2255 if (fw->size < 644) { 2256 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2257 fw->size); 2258 err = -EBADF; 2259 goto done; 2260 } 2261 2262 calltime = ktime_get(); 2263 2264 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2265 2266 /* Start firmware downloading and get boot parameter */ 2267 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2268 if (err < 0) { 2269 if (err == -EALREADY) { 2270 /* Firmware has already been loaded */ 2271 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2272 err = 0; 2273 goto done; 2274 } 2275 2276 btintel_get_rom_debug_info(hdev); 2277 2278 /* When FW download fails, send Intel Reset to retry 2279 * FW download. 2280 */ 2281 btintel_reset_to_bootloader(hdev); 2282 goto done; 2283 } 2284 2285 /* Before switching the device into operational mode and with that 2286 * booting the loaded firmware, wait for the bootloader notification 2287 * that all fragments have been successfully received. 2288 * 2289 * When the event processing receives the notification, then the 2290 * INTEL_DOWNLOADING flag will be cleared. 2291 * 2292 * The firmware loading should not take longer than 5 seconds 2293 * and thus just timeout if that happens and fail the setup 2294 * of this device. 2295 */ 2296 err = btintel_download_wait(hdev, calltime, 5000); 2297 if (err == -ETIMEDOUT) { 2298 btintel_get_rom_debug_info(hdev); 2299 btintel_reset_to_bootloader(hdev); 2300 } 2301 2302 done: 2303 release_firmware(fw); 2304 return err; 2305 } 2306 2307 static int btintel_bootloader_setup(struct hci_dev *hdev, 2308 struct intel_version *ver) 2309 { 2310 struct intel_version new_ver; 2311 struct intel_boot_params params; 2312 u32 boot_param; 2313 char ddcname[64]; 2314 int err; 2315 2316 BT_DBG("%s", hdev->name); 2317 2318 /* Set the default boot parameter to 0x0 and it is updated to 2319 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2320 * command while downloading the firmware. 2321 */ 2322 boot_param = 0x00000000; 2323 2324 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2325 2326 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2327 if (err) 2328 return err; 2329 2330 /* controller is already having an operational firmware */ 2331 if (ver->fw_variant == 0x23) 2332 goto finish; 2333 2334 err = btintel_boot(hdev, boot_param); 2335 if (err) 2336 return err; 2337 2338 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2339 2340 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2341 sizeof(ddcname), "ddc"); 2342 2343 if (err < 0) { 2344 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2345 } else { 2346 /* Once the device is running in operational mode, it needs to 2347 * apply the device configuration (DDC) parameters. 2348 * 2349 * The device can work without DDC parameters, so even if it 2350 * fails to load the file, no need to fail the setup. 2351 */ 2352 btintel_load_ddc_config(hdev, ddcname); 2353 } 2354 2355 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2356 2357 /* Read the Intel version information after loading the FW */ 2358 err = btintel_read_version(hdev, &new_ver); 2359 if (err) 2360 return err; 2361 2362 btintel_version_info(hdev, &new_ver); 2363 2364 finish: 2365 /* Set the event mask for Intel specific vendor events. This enables 2366 * a few extra events that are useful during general operation. It 2367 * does not enable any debugging related events. 2368 * 2369 * The device will function correctly without these events enabled 2370 * and thus no need to fail the setup. 2371 */ 2372 btintel_set_event_mask(hdev, false); 2373 2374 return 0; 2375 } 2376 2377 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2378 char *fw_name, size_t len, 2379 const char *suffix) 2380 { 2381 const char *format; 2382 u32 cnvi, cnvr; 2383 2384 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2385 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2386 2387 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2388 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2389 2390 /* Only Blazar product supports downloading of intermediate loader 2391 * image 2392 */ 2393 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2394 u8 zero[BTINTEL_FWID_MAXLEN]; 2395 2396 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2397 format = "intel/ibt-%04x-%04x-iml.%s"; 2398 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2399 return; 2400 } 2401 2402 memset(zero, 0, sizeof(zero)); 2403 2404 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2405 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2406 format = "intel/ibt-%04x-%04x-%s.%s"; 2407 snprintf(fw_name, len, format, cnvi, cnvr, 2408 ver->fw_id, suffix); 2409 return; 2410 } 2411 /* If firmware id is not present, fallback to legacy naming 2412 * convention 2413 */ 2414 } 2415 /* Fallback to legacy naming convention for other controllers 2416 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2417 */ 2418 format = "intel/ibt-%04x-%04x.%s"; 2419 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2420 } 2421 2422 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2423 char *fw_name, size_t len, 2424 const char *suffix) 2425 { 2426 const char *format; 2427 u32 cnvi, cnvr; 2428 2429 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2430 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2431 2432 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2433 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2434 2435 format = "intel/ibt-%04x-%04x-iml.%s"; 2436 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2437 } 2438 2439 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2440 struct intel_version_tlv *ver, 2441 u32 *boot_param) 2442 { 2443 struct btintel_data *intel_data = hci_get_priv(hdev); 2444 const struct firmware *fw; 2445 char fwname[128]; 2446 int err; 2447 ktime_t calltime; 2448 2449 if (!ver || !boot_param) 2450 return -EINVAL; 2451 2452 /* The firmware variant determines if the device is in bootloader 2453 * mode or is running operational firmware. The value 0x03 identifies 2454 * the bootloader and the value 0x23 identifies the operational 2455 * firmware. 2456 * 2457 * When the operational firmware is already present, then only 2458 * the check for valid Bluetooth device address is needed. This 2459 * determines if the device will be added as configured or 2460 * unconfigured controller. 2461 * 2462 * It is not possible to use the Secure Boot Parameters in this 2463 * case since that command is only available in bootloader mode. 2464 */ 2465 if (ver->img_type == BTINTEL_IMG_OP) { 2466 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2467 btintel_check_bdaddr(hdev); 2468 } else { 2469 /* 2470 * Check for valid bd address in boot loader mode. Device 2471 * will be marked as unconfigured if empty bd address is 2472 * found. 2473 */ 2474 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2475 bt_dev_info(hdev, "No device address configured"); 2476 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2477 } 2478 } 2479 2480 if (ver->img_type == BTINTEL_IMG_OP) { 2481 /* Controller running OP image. In case of FW downgrade, 2482 * FWID TLV may not be present and driver may attempt to load 2483 * firmware image which doesn't exist. Lets compare the version 2484 * of IML image 2485 */ 2486 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2487 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2488 else 2489 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2490 } else { 2491 if (intel_data->unlocker) { 2492 strscpy(fwname, "intel/unlocker.sfi"); 2493 intel_data->unlocker = false; 2494 } else { 2495 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2496 } 2497 } 2498 2499 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2500 if (err < 0) { 2501 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2502 /* Firmware has already been loaded */ 2503 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2504 return 0; 2505 } 2506 2507 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2508 fwname, err); 2509 2510 return err; 2511 } 2512 2513 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2514 2515 if (fw->size < 644) { 2516 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2517 fw->size); 2518 err = -EBADF; 2519 goto done; 2520 } 2521 2522 calltime = ktime_get(); 2523 2524 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2525 2526 /* Start firmware downloading and get boot parameter */ 2527 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2528 INTEL_HW_VARIANT(ver->cnvi_bt), 2529 ver->sbe_type); 2530 if (err < 0) { 2531 if (err == -EALREADY) { 2532 /* Firmware has already been loaded */ 2533 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2534 err = 0; 2535 goto done; 2536 } 2537 2538 btintel_get_rom_debug_info(hdev); 2539 2540 /* When FW download fails, send Intel Reset to retry 2541 * FW download. 2542 */ 2543 btintel_reset_to_bootloader(hdev); 2544 goto done; 2545 } 2546 2547 /* Before switching the device into operational mode and with that 2548 * booting the loaded firmware, wait for the bootloader notification 2549 * that all fragments have been successfully received. 2550 * 2551 * When the event processing receives the notification, then the 2552 * BTUSB_DOWNLOADING flag will be cleared. 2553 * 2554 * The firmware loading should not take longer than 5 seconds 2555 * and thus just timeout if that happens and fail the setup 2556 * of this device. 2557 */ 2558 err = btintel_download_wait(hdev, calltime, 5000); 2559 if (err == -ETIMEDOUT) { 2560 btintel_get_rom_debug_info(hdev); 2561 btintel_reset_to_bootloader(hdev); 2562 } 2563 2564 done: 2565 intel_data->cnvi_bt = ver->cnvi_bt; 2566 release_firmware(fw); 2567 return err; 2568 } 2569 2570 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2571 __u8 link, struct bt_codec *codec, 2572 __u8 *ven_len, __u8 **ven_data) 2573 { 2574 int err = 0; 2575 2576 if (!ven_data || !ven_len) 2577 return -EINVAL; 2578 2579 *ven_len = 0; 2580 *ven_data = NULL; 2581 2582 if (link != ESCO_LINK) { 2583 bt_dev_err(hdev, "Invalid link type(%u)", link); 2584 return -EINVAL; 2585 } 2586 2587 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2588 if (!*ven_data) { 2589 err = -ENOMEM; 2590 goto error; 2591 } 2592 2593 /* supports only CVSD and mSBC offload codecs */ 2594 switch (codec->id) { 2595 case 0x02: 2596 **ven_data = 0x00; 2597 break; 2598 case 0x05: 2599 **ven_data = 0x01; 2600 break; 2601 default: 2602 err = -EINVAL; 2603 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2604 goto error; 2605 } 2606 /* codec and its capabilities are pre-defined to ids 2607 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2608 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2609 */ 2610 *ven_len = sizeof(__u8); 2611 return err; 2612 2613 error: 2614 kfree(*ven_data); 2615 *ven_data = NULL; 2616 return err; 2617 } 2618 2619 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2620 { 2621 /* Intel uses 1 as data path id for all the usecases */ 2622 *data_path_id = 1; 2623 return 0; 2624 } 2625 2626 static int btintel_configure_offload(struct hci_dev *hdev) 2627 { 2628 struct sk_buff *skb; 2629 int err = 0; 2630 struct intel_offload_use_cases *use_cases; 2631 2632 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2633 if (IS_ERR(skb)) { 2634 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2635 PTR_ERR(skb)); 2636 return PTR_ERR(skb); 2637 } 2638 2639 if (skb->len < sizeof(*use_cases)) { 2640 err = -EIO; 2641 goto error; 2642 } 2643 2644 use_cases = (void *)skb->data; 2645 2646 if (use_cases->status) { 2647 err = -bt_to_errno(skb->data[0]); 2648 goto error; 2649 } 2650 2651 if (use_cases->preset[0] & 0x03) { 2652 hdev->get_data_path_id = btintel_get_data_path_id; 2653 hdev->get_codec_config_data = btintel_get_codec_config_data; 2654 } 2655 error: 2656 kfree_skb(skb); 2657 return err; 2658 } 2659 2660 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2661 { 2662 struct sk_buff *skb; 2663 struct hci_ppag_enable_cmd ppag_cmd; 2664 acpi_handle handle; 2665 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2666 union acpi_object *p, *elements; 2667 u32 domain, mode; 2668 acpi_status status; 2669 2670 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2671 switch (ver->cnvr_top & 0xFFF) { 2672 case 0x504: /* Hrp2 */ 2673 case 0x202: /* Jfp2 */ 2674 case 0x201: /* Jfp1 */ 2675 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2676 ver->cnvr_top & 0xFFF); 2677 return; 2678 } 2679 2680 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2681 if (!handle) { 2682 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2683 return; 2684 } 2685 2686 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2687 if (ACPI_FAILURE(status)) { 2688 if (status == AE_NOT_FOUND) { 2689 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2690 return; 2691 } 2692 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2693 return; 2694 } 2695 2696 p = buffer.pointer; 2697 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2698 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2699 p->type, p->package.count); 2700 kfree(buffer.pointer); 2701 return; 2702 } 2703 2704 elements = p->package.elements; 2705 2706 /* PPAG table is located at element[1] */ 2707 p = &elements[1]; 2708 2709 domain = (u32)p->package.elements[0].integer.value; 2710 mode = (u32)p->package.elements[1].integer.value; 2711 kfree(buffer.pointer); 2712 2713 if (domain != 0x12) { 2714 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2715 return; 2716 } 2717 2718 /* PPAG mode 2719 * BIT 0 : 0 Disabled in EU 2720 * 1 Enabled in EU 2721 * BIT 1 : 0 Disabled in China 2722 * 1 Enabled in China 2723 */ 2724 mode &= 0x03; 2725 2726 if (!mode) { 2727 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2728 return; 2729 } 2730 2731 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2732 2733 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2734 &ppag_cmd, HCI_CMD_TIMEOUT); 2735 if (IS_ERR(skb)) { 2736 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2737 return; 2738 } 2739 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2740 kfree_skb(skb); 2741 } 2742 2743 int btintel_acpi_reset_method(struct hci_dev *hdev) 2744 { 2745 int ret = 0; 2746 acpi_status status; 2747 union acpi_object *p, *ref; 2748 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2749 2750 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2751 if (ACPI_FAILURE(status) || !buffer.pointer) { 2752 bt_dev_err(hdev, "Failed to run _PRR method"); 2753 ret = -ENODEV; 2754 return ret; 2755 } 2756 p = buffer.pointer; 2757 2758 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) { 2759 bt_dev_err(hdev, "Invalid arguments"); 2760 ret = -EINVAL; 2761 goto exit_on_error; 2762 } 2763 2764 ref = &p->package.elements[0]; 2765 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2766 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2767 ret = -EINVAL; 2768 goto exit_on_error; 2769 } 2770 2771 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2772 if (ACPI_FAILURE(status)) { 2773 bt_dev_err(hdev, "Failed to run_RST method"); 2774 ret = -ENODEV; 2775 goto exit_on_error; 2776 } 2777 2778 exit_on_error: 2779 kfree(buffer.pointer); 2780 return ret; 2781 } 2782 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method); 2783 2784 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2785 struct intel_version_tlv *ver_tlv) 2786 { 2787 struct btintel_data *data = hci_get_priv(hdev); 2788 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2789 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2790 union acpi_object *obj, argv4; 2791 enum { 2792 RESET_TYPE_WDISABLE2, 2793 RESET_TYPE_VSEC 2794 }; 2795 2796 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2797 2798 if (!handle) { 2799 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2800 return; 2801 } 2802 2803 if (!acpi_has_method(handle, "_PRR")) { 2804 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2805 return; 2806 } 2807 2808 switch (ver_tlv->cnvi_top & 0xfff) { 2809 case 0x910: /* GalePeak2 */ 2810 reset_payload[2] = RESET_TYPE_VSEC; 2811 break; 2812 default: 2813 /* WDISABLE2 is the default reset method */ 2814 reset_payload[2] = RESET_TYPE_WDISABLE2; 2815 2816 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2817 BIT(DSM_SET_WDISABLE2_DELAY))) { 2818 bt_dev_err(hdev, "No dsm support to set reset delay"); 2819 return; 2820 } 2821 argv4.integer.type = ACPI_TYPE_INTEGER; 2822 /* delay required to toggle BT power */ 2823 argv4.integer.value = 160; 2824 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2825 DSM_SET_WDISABLE2_DELAY, &argv4); 2826 if (!obj) { 2827 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2828 return; 2829 } 2830 ACPI_FREE(obj); 2831 } 2832 2833 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2834 2835 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2836 DSM_SET_RESET_METHOD)) { 2837 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2838 return; 2839 } 2840 argv4.buffer.type = ACPI_TYPE_BUFFER; 2841 argv4.buffer.length = sizeof(reset_payload); 2842 argv4.buffer.pointer = reset_payload; 2843 2844 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2845 DSM_SET_RESET_METHOD, &argv4); 2846 if (!obj) { 2847 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2848 return; 2849 } 2850 ACPI_FREE(obj); 2851 data->acpi_reset_method = btintel_acpi_reset_method; 2852 } 2853 2854 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2855 2856 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2857 { 2858 /* 2859 * Distinguish ISO data packets form ACL data packets 2860 * based on their connection handle value range. 2861 */ 2862 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2863 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE) 2864 return HCI_ISODATA_PKT; 2865 } 2866 2867 return hci_skb_pkt_type(skb); 2868 } 2869 2870 /* 2871 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2872 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2873 * overcome the potential STEP errors on their designs. Based on the 2874 * configauration, bluetooth firmware shall adjust the BRI response line drive 2875 * strength. The below structure represents DSBR data. 2876 * struct { 2877 * u8 header; 2878 * u32 dsbr; 2879 * } __packed; 2880 * 2881 * header - defines revision number of the structure 2882 * dsbr - defines drive strength BRI response 2883 * bit0 2884 * 0 - instructs bluetooth firmware to use default values 2885 * 1 - instructs bluetooth firmware to override default values 2886 * bit3:1 2887 * Reserved 2888 * bit7:4 2889 * DSBR override values (only if bit0 is set. Default value is 0xF 2890 * bit31:7 2891 * Reserved 2892 * Expected values for dsbr field: 2893 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2894 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2895 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2896 * that the resistor on board is 10 Ohm 2897 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2898 * firmware to use default values. 2899 * 2900 */ 2901 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2902 { 2903 struct btintel_dsbr { 2904 u8 header; 2905 u32 dsbr; 2906 } __packed data; 2907 2908 efi_status_t status; 2909 unsigned long data_size = sizeof(data); 2910 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2911 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2912 2913 if (!IS_ENABLED(CONFIG_EFI)) 2914 return -EOPNOTSUPP; 2915 2916 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2917 return -EOPNOTSUPP; 2918 2919 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2920 &data); 2921 2922 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2923 return -ENXIO; 2924 2925 *dsbr_var = data.dsbr; 2926 return 0; 2927 } 2928 2929 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2930 { 2931 struct btintel_dsbr_cmd { 2932 u8 enable; 2933 u8 dsbr; 2934 } __packed; 2935 2936 struct btintel_dsbr_cmd cmd; 2937 struct sk_buff *skb; 2938 u32 dsbr; 2939 u8 status, hw_variant; 2940 int err; 2941 2942 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2943 /* DSBR command needs to be sent for, 2944 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2945 * 2. Gale Peak2 or BlazarU in OP image. 2946 * 3. Scorpious Peak in IML image. 2947 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2948 */ 2949 2950 switch (hw_variant) { 2951 case BTINTEL_HWID_BZRI: 2952 case BTINTEL_HWID_BZRIW: 2953 if (ver->img_type == BTINTEL_IMG_IML && 2954 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2955 break; 2956 return 0; 2957 case BTINTEL_HWID_GAP: 2958 case BTINTEL_HWID_BZRU: 2959 if (ver->img_type == BTINTEL_IMG_OP && 2960 hdev->bus == HCI_USB) 2961 break; 2962 return 0; 2963 case BTINTEL_HWID_SCP: 2964 if (ver->img_type == BTINTEL_IMG_IML) 2965 break; 2966 return 0; 2967 default: 2968 /* Scorpius Peak2 onwards */ 2969 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2970 && ver->img_type == BTINTEL_IMG_IML) 2971 break; 2972 return 0; 2973 } 2974 2975 dsbr = 0; 2976 err = btintel_uefi_get_dsbr(&dsbr); 2977 if (err < 0) 2978 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2979 BTINTEL_EFI_DSBR, err); 2980 2981 cmd.enable = dsbr & BIT(0); 2982 cmd.dsbr = dsbr >> 4 & 0xF; 2983 2984 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2985 cmd.dsbr); 2986 2987 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2988 if (IS_ERR(skb)) 2989 return -bt_to_errno(PTR_ERR(skb)); 2990 2991 status = skb->data[0]; 2992 kfree_skb(skb); 2993 2994 if (status) 2995 return -bt_to_errno(status); 2996 2997 return 0; 2998 } 2999 3000 #ifdef CONFIG_ACPI 3001 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 3002 acpi_string method, 3003 union acpi_object **ptr, 3004 u8 pkg_size) 3005 { 3006 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 3007 union acpi_object *p; 3008 acpi_status status; 3009 acpi_handle handle; 3010 3011 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 3012 if (!handle) { 3013 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 3014 return AE_NOT_EXIST; 3015 } 3016 3017 status = acpi_evaluate_object(handle, method, NULL, &buffer); 3018 3019 if (ACPI_FAILURE(status)) { 3020 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 3021 acpi_format_exception(status), method); 3022 return status; 3023 } 3024 3025 p = buffer.pointer; 3026 3027 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 3028 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 3029 p->type, p->package.count); 3030 kfree(buffer.pointer); 3031 return AE_ERROR; 3032 } 3033 3034 *ptr = buffer.pointer; 3035 return 0; 3036 } 3037 3038 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 3039 { 3040 union acpi_object *domain, *bt_pkg; 3041 int i; 3042 3043 for (i = 1; i < buffer->package.count; i++) { 3044 bt_pkg = &buffer->package.elements[i]; 3045 domain = &bt_pkg->package.elements[0]; 3046 if (domain->type == ACPI_TYPE_INTEGER && 3047 domain->integer.value == BTINTEL_BT_DOMAIN) 3048 return bt_pkg; 3049 } 3050 return ERR_PTR(-ENOENT); 3051 } 3052 3053 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 3054 { 3055 struct sk_buff *skb; 3056 3057 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 3058 if (IS_ERR(skb)) { 3059 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 3060 le16_to_cpu(data->id), PTR_ERR(skb)); 3061 return PTR_ERR(skb); 3062 } 3063 kfree_skb(skb); 3064 return 0; 3065 } 3066 3067 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3068 int id, struct btintel_sar_inc_pwr *sar) 3069 { 3070 cmd->len = 5; 3071 cmd->id = cpu_to_le16(id); 3072 cmd->data[0] = sar->br >> 3; 3073 cmd->data[1] = sar->edr2 >> 3; 3074 cmd->data[2] = sar->edr3 >> 3; 3075 return btintel_send_sar_ddc(hdev, cmd, 6); 3076 } 3077 3078 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3079 int id, struct btintel_sar_inc_pwr *sar) 3080 { 3081 cmd->len = 3; 3082 cmd->id = cpu_to_le16(id); 3083 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 3084 return btintel_send_sar_ddc(hdev, cmd, 4); 3085 } 3086 3087 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3088 int id, struct btintel_sar_inc_pwr *sar) 3089 { 3090 cmd->len = 3; 3091 cmd->id = cpu_to_le16(id); 3092 cmd->data[0] = sar->br >> 3; 3093 return btintel_send_sar_ddc(hdev, cmd, 4); 3094 } 3095 3096 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3097 int id, struct btintel_sar_inc_pwr *sar) 3098 { 3099 cmd->len = 3; 3100 cmd->id = cpu_to_le16(id); 3101 cmd->data[0] = sar->br; 3102 return btintel_send_sar_ddc(hdev, cmd, 4); 3103 } 3104 3105 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3106 int id, struct btintel_sar_inc_pwr *sar) 3107 { 3108 cmd->len = 3; 3109 cmd->id = cpu_to_le16(id); 3110 cmd->data[0] = sar->edr2; 3111 return btintel_send_sar_ddc(hdev, cmd, 4); 3112 } 3113 3114 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3115 int id, struct btintel_sar_inc_pwr *sar) 3116 { 3117 cmd->len = 3; 3118 cmd->id = cpu_to_le16(id); 3119 cmd->data[0] = sar->edr3; 3120 return btintel_send_sar_ddc(hdev, cmd, 4); 3121 } 3122 3123 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3124 { 3125 struct btintel_cp_ddc_write *cmd; 3126 u8 buffer[64]; 3127 int ret; 3128 3129 cmd = (void *)buffer; 3130 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3131 if (ret) 3132 return ret; 3133 3134 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3135 if (ret) 3136 return ret; 3137 3138 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3139 if (ret) 3140 return ret; 3141 3142 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3143 if (ret) 3144 return ret; 3145 3146 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3147 if (ret) 3148 return ret; 3149 3150 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3151 if (ret) 3152 return ret; 3153 3154 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3155 3156 return ret; 3157 } 3158 3159 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3160 { 3161 struct btintel_cp_ddc_write *cmd; 3162 struct sk_buff *skb; 3163 u8 buffer[64]; 3164 bool enable; 3165 int ret; 3166 3167 cmd = (void *)buffer; 3168 3169 cmd->len = 3; 3170 cmd->id = cpu_to_le16(0x019e); 3171 3172 if (sar->revision == BTINTEL_SAR_INC_PWR && 3173 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3174 cmd->data[0] = 0x01; 3175 else 3176 cmd->data[0] = 0x00; 3177 3178 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3179 if (ret) 3180 return ret; 3181 3182 if (sar->revision == BTINTEL_SAR_INC_PWR && 3183 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3184 cmd->len = 3; 3185 cmd->id = cpu_to_le16(0x019f); 3186 cmd->data[0] = sar->sar_2400_chain_a; 3187 3188 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3189 if (ret) 3190 return ret; 3191 } 3192 3193 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3194 if (ret) 3195 return ret; 3196 3197 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3198 if (ret) 3199 return ret; 3200 3201 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3202 if (ret) 3203 return ret; 3204 3205 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3206 if (ret) 3207 return ret; 3208 3209 enable = true; 3210 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3211 if (IS_ERR(skb)) { 3212 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3213 return PTR_ERR(skb); 3214 } 3215 3216 kfree_skb(skb); 3217 return 0; 3218 } 3219 3220 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band 3221 * 3222 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value]. 3223 * cmd->len = 4 (2 id + 2 data) 3224 * HCI total = 5 bytes (1 len + 4) 3225 */ 3226 static int btintel_send_sar_rev2_band(struct hci_dev *hdev, 3227 struct btintel_cp_ddc_write *cmd, 3228 u16 id, u8 chain_a, u8 chain_b) 3229 { 3230 cmd->len = 4; 3231 cmd->id = cpu_to_le16(id); 3232 cmd->data[0] = chain_a; 3233 cmd->data[1] = chain_b; 3234 return btintel_send_sar_ddc(hdev, cmd, 5); 3235 } 3236 3237 static int btintel_set_sar_rev2(struct hci_dev *hdev, 3238 struct btintel_sar_rev2 *sar) 3239 { 3240 struct btintel_cp_ddc_write *cmd; 3241 struct sk_buff *skb; 3242 u8 buffer[64]; 3243 u8 enable; 3244 int ret; 3245 3246 cmd = (void *)buffer; 3247 3248 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */ 3249 cmd->len = 3; 3250 cmd->id = cpu_to_le16(0x019e); 3251 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ? 3252 0x01 : 0x00; 3253 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3254 if (ret) 3255 return ret; 3256 3257 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */ 3258 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311, 3259 sar->chain_a.subband_2g4, 3260 sar->chain_b.subband_2g4); 3261 if (ret) 3262 return ret; 3263 3264 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312, 3265 sar->chain_a.subband_5g2, 3266 sar->chain_b.subband_5g2); 3267 if (ret) 3268 return ret; 3269 3270 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */ 3271 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313, 3272 sar->chain_a.subband_5g8_5g9, 3273 sar->chain_b.subband_5g8_5g9); 3274 if (ret) 3275 return ret; 3276 3277 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314, 3278 sar->chain_a.subband_5g8_5g9, 3279 sar->chain_b.subband_5g8_5g9); 3280 if (ret) 3281 return ret; 3282 3283 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315, 3284 sar->chain_a.subband_6g1, 3285 sar->chain_b.subband_6g1); 3286 if (ret) 3287 return ret; 3288 3289 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316, 3290 sar->chain_a.subband_6g3, 3291 sar->chain_b.subband_6g3); 3292 if (ret) 3293 return ret; 3294 3295 /* Notify firmware that SAR initialisation is complete */ 3296 enable = 0x01; 3297 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT); 3298 if (IS_ERR(skb)) { 3299 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)", 3300 PTR_ERR(skb)); 3301 return PTR_ERR(skb); 3302 } 3303 3304 kfree_skb(skb); 3305 return 0; 3306 } 3307 3308 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev, 3309 struct btintel_sar_rev2 *sar, 3310 struct intel_version_tlv *ver) 3311 { 3312 u16 cnvi = ver->cnvi_top & 0xfff; 3313 u16 cnvr = ver->cnvr_top & 0xfff; 3314 3315 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) { 3316 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)", 3317 cnvi, cnvr); 3318 return -EOPNOTSUPP; 3319 } 3320 3321 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2"); 3322 return btintel_set_sar_rev2(hdev, sar); 3323 } 3324 3325 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3326 struct intel_version_tlv *ver) 3327 { 3328 u16 cnvi, cnvr; 3329 int ret; 3330 3331 cnvi = ver->cnvi_top & 0xfff; 3332 cnvr = ver->cnvr_top & 0xfff; 3333 3334 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3335 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3336 ret = btintel_set_legacy_sar(hdev, sar); 3337 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3338 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3339 ret = btintel_set_mutual_sar(hdev, sar); 3340 } else { 3341 ret = -EOPNOTSUPP; 3342 } 3343 3344 return ret; 3345 } 3346 3347 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3348 { 3349 union acpi_object *bt_pkg, *buffer = NULL; 3350 struct btintel_sar_inc_pwr sar; 3351 struct btintel_sar_rev2 sar_rev2; 3352 acpi_status status; 3353 u8 revision; 3354 int ret; 3355 3356 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3357 if (ACPI_FAILURE(status)) 3358 return -ENOENT; 3359 3360 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3361 3362 if (IS_ERR(bt_pkg)) { 3363 ret = PTR_ERR(bt_pkg); 3364 goto error; 3365 } 3366 3367 if (!bt_pkg->package.count) { 3368 ret = -EINVAL; 3369 goto error; 3370 } 3371 3372 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) { 3373 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field"); 3374 ret = -EINVAL; 3375 goto error; 3376 } 3377 3378 revision = buffer->package.elements[0].integer.value; 3379 3380 if (revision > BTINTEL_SAR_REV2) { 3381 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3382 ret = -EOPNOTSUPP; 3383 goto error; 3384 } 3385 3386 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) { 3387 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12), 3388 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32), 3389 * 3..12 = per-chain sub-band limits (u8 each). 3390 */ 3391 static const u64 rev2_max[13] = { 3392 U8_MAX, /* domain ID */ 3393 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */ 3394 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */ 3395 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */ 3396 }; 3397 union acpi_object *e; 3398 int i; 3399 3400 for (i = 0; i < 13; i++) { 3401 e = &bt_pkg->package.elements[i]; 3402 if (e->type != ACPI_TYPE_INTEGER) { 3403 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d", 3404 i); 3405 ret = -EINVAL; 3406 goto error; 3407 } 3408 if (e->integer.value > rev2_max[i]) { 3409 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range", 3410 i, e->integer.value); 3411 ret = -ERANGE; 3412 goto error; 3413 } 3414 } 3415 3416 memset(&sar_rev2, 0, sizeof(sar_rev2)); 3417 sar_rev2.revision = revision; 3418 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3419 3420 if (sar_rev2.bt_sar_bios != 1) { 3421 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled"); 3422 ret = -EOPNOTSUPP; 3423 goto error; 3424 } 3425 3426 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3427 3428 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value; 3429 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value; 3430 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value; 3431 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value; 3432 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value; 3433 3434 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value; 3435 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value; 3436 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value; 3437 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value; 3438 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value; 3439 3440 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u", 3441 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode); 3442 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3443 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2, 3444 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1, 3445 sar_rev2.chain_a.subband_6g3); 3446 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3447 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2, 3448 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1, 3449 sar_rev2.chain_b.subband_6g3); 3450 3451 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver); 3452 goto error; 3453 } 3454 3455 if (revision == BTINTEL_SAR_REV2) { 3456 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)", 3457 bt_pkg->package.count); 3458 ret = -EINVAL; 3459 goto error; 3460 } 3461 3462 memset(&sar, 0, sizeof(sar)); 3463 3464 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3465 sar.revision = revision; 3466 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3467 sar.br = bt_pkg->package.elements[2].integer.value; 3468 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3469 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3470 sar.le = bt_pkg->package.elements[5].integer.value; 3471 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3472 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3473 3474 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3475 sar.revision = revision; 3476 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3477 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3478 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3479 sar.br = bt_pkg->package.elements[4].integer.value; 3480 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3481 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3482 sar.le = bt_pkg->package.elements[7].integer.value; 3483 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3484 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3485 } else { 3486 ret = -EINVAL; 3487 goto error; 3488 } 3489 3490 /* Apply only if it is enabled in BIOS */ 3491 if (sar.bt_sar_bios != 1) { 3492 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3493 ret = -EOPNOTSUPP; 3494 goto error; 3495 } 3496 3497 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3498 error: 3499 kfree(buffer); 3500 return ret; 3501 } 3502 #endif /* CONFIG_ACPI */ 3503 3504 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3505 struct intel_version_tlv *ver) 3506 { 3507 #ifdef CONFIG_ACPI 3508 return btintel_acpi_set_sar(hdev, ver); 3509 #endif 3510 return 0; 3511 } 3512 3513 /* Attempt to load intel/unlocker.sfi if it is present in the firmware 3514 * search path. If the file is not available the device will be booted 3515 * with a signed operational firmware, which is the common case, so its 3516 * absence must be treated as normal and not logged as an error. 3517 */ 3518 static int btintel_try_load_unlocker(struct hci_dev *hdev, 3519 struct intel_version_tlv *ver) 3520 { 3521 struct btintel_data *data = hci_get_priv(hdev); 3522 const struct firmware *fw; 3523 u32 boot_param = 0; 3524 int err; 3525 3526 err = firmware_request_nowarn(&fw, "intel/unlocker.sfi", &hdev->dev); 3527 if (err) { 3528 bt_dev_dbg(hdev, "intel/unlocker.sfi not present (%d), skipping unlocker load", 3529 err); 3530 return 0; 3531 } 3532 release_firmware(fw); 3533 3534 data->unlocker = true; 3535 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3536 if (err) { 3537 bt_dev_err(hdev, "Failed to load intel/unlocker.sfi (%d)", err); 3538 data->unlocker = false; 3539 } 3540 return err; 3541 } 3542 3543 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3544 struct intel_version_tlv *ver) 3545 { 3546 u32 boot_param; 3547 char ddcname[64]; 3548 int err; 3549 struct intel_version_tlv new_ver; 3550 struct btintel_data *data = hci_get_priv(hdev); 3551 u8 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 3552 3553 bt_dev_dbg(hdev, ""); 3554 3555 /* Set the default boot parameter to 0x0 and it is updated to 3556 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3557 * command while downloading the firmware. 3558 */ 3559 boot_param = 0x00000000; 3560 3561 /* In case of PCIe, this function might get called multiple times with 3562 * same hdev instance if there is any error on firmware download. 3563 * Need to clear stale bits of previous firmware download attempt. 3564 */ 3565 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3566 btintel_clear_flag(hdev, i); 3567 3568 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3569 3570 data->unlocker = false; 3571 3572 /* Legacy unlocker flow (BlazarI / BlazarIW / BlazarU / Gale Peak): 3573 * Boot ROM -> unlocker.sfi -> IML -> OPFW 3574 * 3575 * Skip the unlocker check when the controller is already running 3576 * operational firmware (can happen on USB); the unlocker flow is 3577 * only meaningful from the bootloader stage. 3578 */ 3579 if (ver->img_type != BTINTEL_IMG_OP && 3580 ver->api_lock && ver->unlock_policy == 0) { 3581 switch (hw_variant) { 3582 case BTINTEL_HWID_BZRI: 3583 case BTINTEL_HWID_BZRIW: 3584 case BTINTEL_HWID_BZRU: 3585 case BTINTEL_HWID_GAP: 3586 err = btintel_try_load_unlocker(hdev, ver); 3587 if (err) 3588 return err; 3589 break; 3590 default: 3591 break; 3592 } 3593 } 3594 3595 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3596 if (err) 3597 return err; 3598 3599 /* check if controller is already having an operational firmware */ 3600 if (ver->img_type == BTINTEL_IMG_OP) 3601 goto finish; 3602 3603 err = btintel_boot(hdev, boot_param); 3604 if (err) 3605 return err; 3606 3607 err = btintel_read_version_tlv(hdev, ver); 3608 if (err) 3609 return err; 3610 3611 /* set drive strength of BRI response */ 3612 err = btintel_set_dsbr(hdev, ver); 3613 if (err) { 3614 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3615 return err; 3616 } 3617 3618 /* New unlocker flow (Scorpius Peak onwards): 3619 * Boot ROM -> IML -> unlocker.sfi -> OPFW 3620 */ 3621 if (hw_variant >= BTINTEL_HWID_SCP && 3622 ver->api_lock && ver->unlock_policy == 1) { 3623 err = btintel_try_load_unlocker(hdev, ver); 3624 if (err) 3625 return err; 3626 } 3627 3628 /* Transition to Operational Firmware 3629 * If image type returned is BTINTEL_IMG_IML, then controller supports 3630 * intermediate loader image. 3631 */ 3632 if (ver->img_type == BTINTEL_IMG_IML) { 3633 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3634 if (err) 3635 return err; 3636 3637 err = btintel_boot(hdev, boot_param); 3638 if (err) 3639 return err; 3640 } 3641 3642 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3643 3644 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3645 /* Once the device is running in operational mode, it needs to 3646 * apply the device configuration (DDC) parameters. 3647 * 3648 * The device can work without DDC parameters, so even if it 3649 * fails to load the file, no need to fail the setup. 3650 */ 3651 btintel_load_ddc_config(hdev, ddcname); 3652 3653 /* Read supported use cases and set callbacks to fetch datapath id */ 3654 btintel_configure_offload(hdev); 3655 3656 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3657 3658 /* Send sar values to controller */ 3659 btintel_set_specific_absorption_rate(hdev, ver); 3660 3661 /* Set PPAG feature */ 3662 btintel_set_ppag(hdev, ver); 3663 3664 /* Read the Intel version information after loading the FW */ 3665 err = btintel_read_version_tlv(hdev, &new_ver); 3666 if (err) 3667 return err; 3668 3669 btintel_version_info_tlv(hdev, &new_ver); 3670 3671 /* Update ver with the operational firmware version */ 3672 *ver = new_ver; 3673 3674 finish: 3675 /* Set the event mask for Intel specific vendor events. This enables 3676 * a few extra events that are useful during general operation. It 3677 * does not enable any debugging related events. 3678 * 3679 * The device will function correctly without these events enabled 3680 * and thus no need to fail the setup. 3681 */ 3682 btintel_set_event_mask(hdev, false); 3683 3684 return 0; 3685 } 3686 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3687 3688 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3689 { 3690 switch (hw_variant) { 3691 /* Legacy bootloader devices that supports MSFT Extension */ 3692 case 0x11: /* JfP */ 3693 case 0x12: /* ThP */ 3694 case 0x13: /* HrP */ 3695 case 0x14: /* CcP */ 3696 /* All Intel new generation controllers support the Microsoft vendor 3697 * extension are using 0xFC1E for VsMsftOpCode. 3698 */ 3699 case 0x17: 3700 case 0x18: 3701 case 0x19: 3702 case 0x1b: 3703 case 0x1c: 3704 case 0x1d: 3705 case 0x1e: 3706 case 0x1f: 3707 case 0x20: 3708 case 0x21: 3709 case 0x22: 3710 case 0x23: 3711 hci_set_msft_opcode(hdev, 0xFC1E); 3712 break; 3713 default: 3714 /* Not supported */ 3715 break; 3716 } 3717 } 3718 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3719 3720 void btintel_print_fseq_info(struct hci_dev *hdev) 3721 { 3722 struct sk_buff *skb; 3723 u8 *p; 3724 u32 val; 3725 const char *str; 3726 3727 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3728 if (IS_ERR(skb)) { 3729 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3730 PTR_ERR(skb)); 3731 return; 3732 } 3733 3734 if (skb->len < (sizeof(u32) * 16 + 2)) { 3735 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3736 skb->len); 3737 kfree_skb(skb); 3738 return; 3739 } 3740 3741 p = skb_pull_data(skb, 1); 3742 if (*p) { 3743 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3744 kfree_skb(skb); 3745 return; 3746 } 3747 3748 p = skb_pull_data(skb, 1); 3749 switch (*p) { 3750 case 0: 3751 str = "Success"; 3752 break; 3753 case 1: 3754 str = "Fatal error"; 3755 break; 3756 case 2: 3757 str = "Semaphore acquire error"; 3758 break; 3759 default: 3760 str = "Unknown error"; 3761 break; 3762 } 3763 3764 if (*p) { 3765 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3766 kfree_skb(skb); 3767 return; 3768 } 3769 3770 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3771 3772 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3773 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3774 3775 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3776 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3777 3778 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3779 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3780 3781 p = skb->data; 3782 skb_pull_data(skb, 4); 3783 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3784 p[2], p[3]); 3785 3786 p = skb->data; 3787 skb_pull_data(skb, 4); 3788 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3789 p[2], p[3]); 3790 3791 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3792 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3793 3794 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3795 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3796 3797 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3798 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3799 3800 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3801 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3802 3803 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3804 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3805 3806 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3807 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3808 3809 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3810 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3811 3812 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3813 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3814 3815 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3816 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3817 3818 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3819 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3820 3821 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3822 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3823 3824 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3825 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3826 3827 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3828 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3829 3830 kfree_skb(skb); 3831 } 3832 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3833 3834 static int btintel_setup_combined(struct hci_dev *hdev) 3835 { 3836 const u8 param[1] = { 0xFF }; 3837 struct intel_version ver; 3838 struct intel_version_tlv ver_tlv; 3839 struct sk_buff *skb; 3840 int err; 3841 3842 BT_DBG("%s", hdev->name); 3843 3844 /* The some controllers have a bug with the first HCI command sent to it 3845 * returning number of completed commands as zero. This would stall the 3846 * command processing in the Bluetooth core. 3847 * 3848 * As a workaround, send HCI Reset command first which will reset the 3849 * number of completed commands and allow normal command processing 3850 * from now on. 3851 * 3852 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3853 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3854 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3855 * state, the only way to exit out of it is sending the HCI_Reset 3856 * command. 3857 */ 3858 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3859 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3860 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3861 HCI_INIT_TIMEOUT); 3862 if (IS_ERR(skb)) { 3863 bt_dev_err(hdev, 3864 "sending initial HCI reset failed (%ld)", 3865 PTR_ERR(skb)); 3866 return PTR_ERR(skb); 3867 } 3868 kfree_skb(skb); 3869 } 3870 3871 /* Starting from TyP device, the command parameter and response are 3872 * changed even though the OCF for HCI_Intel_Read_Version command 3873 * remains same. The legacy devices can handle even if the 3874 * command has a parameter and returns a correct version information. 3875 * So, it uses new format to support both legacy and new format. 3876 */ 3877 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3878 if (IS_ERR(skb)) { 3879 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3880 PTR_ERR(skb)); 3881 return PTR_ERR(skb); 3882 } 3883 3884 /* Check the status */ 3885 if (skb->data[0]) { 3886 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3887 skb->data[0]); 3888 err = -EIO; 3889 goto exit_error; 3890 } 3891 3892 /* Apply the common HCI quirks for Intel device */ 3893 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3894 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3895 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3896 3897 /* Set up the quality report callback for Intel devices */ 3898 hdev->set_quality_report = btintel_set_quality_report; 3899 3900 /* For Legacy device, check the HW platform value and size */ 3901 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3902 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3903 3904 memcpy(&ver, skb->data, sizeof(ver)); 3905 3906 /* Display version information */ 3907 btintel_version_info(hdev, &ver); 3908 3909 /* Check for supported iBT hardware variants of this firmware 3910 * loading method. 3911 * 3912 * This check has been put in place to ensure correct forward 3913 * compatibility options when newer hardware variants come 3914 * along. 3915 */ 3916 switch (ver.hw_variant) { 3917 case 0x07: /* WP */ 3918 case 0x08: /* StP */ 3919 /* Legacy ROM product */ 3920 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3921 3922 /* Apply the device specific HCI quirks 3923 * 3924 * WBS for SdP - For the Legacy ROM products, only SdP 3925 * supports the WBS. But the version information is not 3926 * enough to use here because the StP2 and SdP have same 3927 * hw_variant and fw_variant. So, this flag is set by 3928 * the transport driver (btusb) based on the HW info 3929 * (idProduct) 3930 */ 3931 if (!btintel_test_flag(hdev, 3932 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3933 hci_set_quirk(hdev, 3934 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3935 3936 err = btintel_legacy_rom_setup(hdev, &ver); 3937 break; 3938 case 0x0b: /* SfP */ 3939 case 0x11: /* JfP */ 3940 case 0x12: /* ThP */ 3941 case 0x13: /* HrP */ 3942 case 0x14: /* CcP */ 3943 fallthrough; 3944 case 0x0c: /* WsP */ 3945 /* Apply the device specific HCI quirks 3946 * 3947 * All Legacy bootloader devices support WBS 3948 */ 3949 hci_set_quirk(hdev, 3950 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3951 3952 /* These variants don't seem to support LE Coded PHY */ 3953 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3954 3955 /* Setup MSFT Extension support */ 3956 btintel_set_msft_opcode(hdev, ver.hw_variant); 3957 3958 err = btintel_bootloader_setup(hdev, &ver); 3959 btintel_register_devcoredump_support(hdev); 3960 break; 3961 default: 3962 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3963 ver.hw_variant); 3964 err = -EINVAL; 3965 } 3966 3967 hci_set_hw_info(hdev, 3968 "INTEL platform=%u variant=%u revision=%u", 3969 ver.hw_platform, ver.hw_variant, 3970 ver.hw_revision); 3971 3972 goto exit_error; 3973 } 3974 3975 /* memset ver_tlv to start with clean state as few fields are exclusive 3976 * to bootloader mode and are not populated in operational mode 3977 */ 3978 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3979 /* For TLV type device, parse the tlv data */ 3980 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3981 if (err) { 3982 bt_dev_err(hdev, "Failed to parse TLV version information"); 3983 goto exit_error; 3984 } 3985 3986 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3987 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3988 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3989 err = -EINVAL; 3990 goto exit_error; 3991 } 3992 3993 /* Check for supported iBT hardware variants of this firmware 3994 * loading method. 3995 * 3996 * This check has been put in place to ensure correct forward 3997 * compatibility options when newer hardware variants come 3998 * along. 3999 */ 4000 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 4001 case 0x11: /* JfP */ 4002 case 0x12: /* ThP */ 4003 case 0x13: /* HrP */ 4004 case 0x14: /* CcP */ 4005 /* Some legacy bootloader devices starting from JfP, 4006 * the operational firmware supports both old and TLV based 4007 * HCI_Intel_Read_Version command based on the command 4008 * parameter. 4009 * 4010 * For upgrading firmware case, the TLV based version cannot 4011 * be used because the firmware filename for legacy bootloader 4012 * is based on the old format. 4013 * 4014 * Also, it is not easy to convert TLV based version from the 4015 * legacy version format. 4016 * 4017 * So, as a workaround for those devices, use the legacy 4018 * HCI_Intel_Read_Version to get the version information and 4019 * run the legacy bootloader setup. 4020 */ 4021 err = btintel_read_version(hdev, &ver); 4022 if (err) 4023 break; 4024 4025 /* Apply the device specific HCI quirks 4026 * 4027 * All Legacy bootloader devices support WBS 4028 */ 4029 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 4030 4031 /* These variants don't seem to support LE Coded PHY */ 4032 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 4033 4034 /* Setup MSFT Extension support */ 4035 btintel_set_msft_opcode(hdev, ver.hw_variant); 4036 4037 err = btintel_bootloader_setup(hdev, &ver); 4038 btintel_register_devcoredump_support(hdev); 4039 break; 4040 case 0x18: /* GfP2 */ 4041 case 0x1c: /* GaP */ 4042 /* Re-classify packet type for controllers with LE audio */ 4043 hdev->classify_pkt_type = btintel_classify_pkt_type; 4044 fallthrough; 4045 case 0x17: 4046 case 0x19: 4047 case 0x1b: 4048 case 0x1d: 4049 case 0x1e: 4050 case 0x1f: 4051 case 0x20: 4052 case 0x21: 4053 case 0x22: 4054 case 0x23: 4055 /* Display version information of TLV type */ 4056 btintel_version_info_tlv(hdev, &ver_tlv); 4057 4058 /* Apply the device specific HCI quirks for TLV based devices 4059 * 4060 * All TLV based devices support WBS 4061 */ 4062 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 4063 4064 /* Setup MSFT Extension support */ 4065 btintel_set_msft_opcode(hdev, 4066 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 4067 btintel_set_dsm_reset_method(hdev, &ver_tlv); 4068 4069 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 4070 if (err) 4071 goto exit_error; 4072 4073 btintel_register_devcoredump_support(hdev); 4074 btintel_print_fseq_info(hdev); 4075 break; 4076 default: 4077 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 4078 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 4079 err = -EINVAL; 4080 break; 4081 } 4082 4083 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 4084 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 4085 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 4086 4087 exit_error: 4088 kfree_skb(skb); 4089 4090 return err; 4091 } 4092 4093 int btintel_shutdown_combined(struct hci_dev *hdev) 4094 { 4095 struct sk_buff *skb; 4096 int ret; 4097 4098 /* Send HCI Reset to the controller to stop any BT activity which 4099 * were triggered. This will help to save power and maintain the 4100 * sync b/w Host and controller 4101 */ 4102 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 4103 if (IS_ERR(skb)) { 4104 bt_dev_err(hdev, "HCI reset during shutdown failed"); 4105 return PTR_ERR(skb); 4106 } 4107 kfree_skb(skb); 4108 4109 4110 /* Some platforms have an issue with BT LED when the interface is 4111 * down or BT radio is turned off, which takes 5 seconds to BT LED 4112 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 4113 * device in the RFKILL ON state which turns off the BT LED immediately. 4114 */ 4115 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 4116 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 4117 if (IS_ERR(skb)) { 4118 ret = PTR_ERR(skb); 4119 bt_dev_err(hdev, "turning off Intel device LED failed"); 4120 return ret; 4121 } 4122 kfree_skb(skb); 4123 } 4124 4125 return 0; 4126 } 4127 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 4128 4129 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 4130 { 4131 hdev->manufacturer = 2; 4132 hdev->setup = btintel_setup_combined; 4133 hdev->shutdown = btintel_shutdown_combined; 4134 hdev->hw_error = btintel_hw_error; 4135 hdev->set_diag = btintel_set_diag_combined; 4136 hdev->set_bdaddr = btintel_set_bdaddr; 4137 4138 coredump_info.driver_name = driver_name; 4139 4140 return 0; 4141 } 4142 EXPORT_SYMBOL_GPL(btintel_configure_setup); 4143 4144 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 4145 { 4146 struct intel_tlv *tlv = (void *)&skb->data[5]; 4147 4148 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0])) 4149 goto recv_frame; 4150 4151 /* The first event is always an event type TLV */ 4152 if (tlv->type != INTEL_TLV_TYPE_ID) 4153 goto recv_frame; 4154 4155 switch (tlv->val[0]) { 4156 case INTEL_TLV_SYSTEM_EXCEPTION: 4157 case INTEL_TLV_FATAL_EXCEPTION: 4158 case INTEL_TLV_DEBUG_EXCEPTION: 4159 case INTEL_TLV_TEST_EXCEPTION: 4160 /* Generate devcoredump from exception */ 4161 if (!hci_devcd_init(hdev, skb->len)) { 4162 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 4163 hci_devcd_complete(hdev); 4164 } else { 4165 bt_dev_err(hdev, "Failed to generate devcoredump"); 4166 } 4167 break; 4168 default: 4169 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 4170 } 4171 4172 recv_frame: 4173 return hci_recv_frame(hdev, skb); 4174 } 4175 4176 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 4177 { 4178 struct hci_event_hdr *hdr = (void *)skb->data; 4179 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 4180 4181 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) { 4182 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 4183 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 4184 4185 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 4186 switch (skb->data[2]) { 4187 case 0x02: 4188 /* When switching to the operational firmware 4189 * the device sends a vendor specific event 4190 * indicating that the bootup completed. 4191 */ 4192 btintel_bootup(hdev, ptr, len); 4193 kfree_skb(skb); 4194 return 0; 4195 case 0x06: 4196 /* When the firmware loading completes the 4197 * device sends out a vendor specific event 4198 * indicating the result of the firmware 4199 * loading. 4200 */ 4201 btintel_secure_send_result(hdev, ptr, len); 4202 kfree_skb(skb); 4203 return 0; 4204 } 4205 } 4206 4207 /* Handle all diagnostics events separately. May still call 4208 * hci_recv_frame. 4209 */ 4210 if (len + 1 >= sizeof(diagnostics_hdr) && 4211 memcmp(&skb->data[2], diagnostics_hdr, 4212 sizeof(diagnostics_hdr)) == 0) { 4213 return btintel_diagnostics(hdev, skb); 4214 } 4215 } 4216 4217 return hci_recv_frame(hdev, skb); 4218 } 4219 EXPORT_SYMBOL_GPL(btintel_recv_event); 4220 4221 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 4222 { 4223 const struct intel_bootup *evt = ptr; 4224 4225 if (len != sizeof(*evt)) 4226 return; 4227 4228 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 4229 btintel_wake_up_flag(hdev, INTEL_BOOTING); 4230 } 4231 EXPORT_SYMBOL_GPL(btintel_bootup); 4232 4233 void btintel_secure_send_result(struct hci_dev *hdev, 4234 const void *ptr, unsigned int len) 4235 { 4236 const struct intel_secure_send_result *evt = ptr; 4237 4238 if (len != sizeof(*evt)) 4239 return; 4240 4241 if (evt->result) 4242 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 4243 4244 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 4245 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 4246 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 4247 } 4248 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 4249 4250 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 4251 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 4252 MODULE_VERSION(VERSION); 4253 MODULE_LICENSE("GPL"); 4254 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 4255 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 4256 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 4257 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 4258