1 /*
2 * ng_ubt_intel.c
3 */
4
5 /*-
6 * SPDX-License-Identifier: BSD-2-Clause
7 *
8 * Copyright (c) 2019, 2021 Vladimir Kondratyev <wulf@FreeBSD.org>
9 * Copyright (c) 2023 Future Crew LLC.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Attempt to initialize FreeBSD bluetooth stack while Intel Wireless 8260/8265
35 * device is in bootloader mode locks the adapter hardly so it requires power
36 * on/off cycle to restore. This driver blocks ng_ubt attachment until
37 * operational firmware is loaded by iwmbtfw utility thus avoiding the lock up.
38 */
39
40 #include <sys/types.h>
41 #include <sys/bus.h>
42 #include <sys/kernel.h>
43 #include <sys/mbuf.h>
44 #include <sys/module.h>
45 #include <sys/systm.h>
46 #include <sys/taskqueue.h>
47
48 #include "usbdevs.h"
49 #include <dev/usb/usb.h>
50 #include <dev/usb/usbdi.h>
51
52 #include <netgraph/ng_message.h>
53 #include <netgraph/netgraph.h>
54 #include <netgraph/ng_parse.h>
55 #include <netgraph/bluetooth/include/ng_bluetooth.h>
56 #include <netgraph/bluetooth/include/ng_hci.h>
57 #include <netgraph/bluetooth/include/ng_ubt.h>
58 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h>
59
60 #define UBT_INTEL_HCICMD_TIMEOUT 2000 /* ms */
61 #define UBT_INTEL_TLV_IMAGE_TYPE 0x1c
62
63 enum {
64 UBT_INTEL_DEVICE_7260,
65 UBT_INTEL_DEVICE_8260,
66 UBT_INTEL_DEVICE_9260,
67 };
68
69 struct ubt_intel_version_rp {
70 uint8_t status;
71 uint8_t hw_platform;
72 uint8_t hw_variant;
73 uint8_t hw_revision;
74 uint8_t fw_variant;
75 uint8_t fw_revision;
76 uint8_t fw_build_num;
77 uint8_t fw_build_ww;
78 uint8_t fw_build_yy;
79 uint8_t fw_patch_num;
80 } __attribute__ ((packed));
81
82 static device_probe_t ubt_intel_probe;
83
84 /*
85 * List of supported bluetooth devices. If you add a new device PID here ensure
86 * that it is blacklisted in ng_ubt.c and is supported by iwmbtfw utility.
87 */
88
89 static const STRUCT_USB_HOST_ID ubt_intel_devs[] =
90 {
91 /* Intel Wireless 7260/7265 and successors */
92 { USB_VPI(USB_VENDOR_INTEL2, 0x07dc, UBT_INTEL_DEVICE_7260) },
93 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2a, UBT_INTEL_DEVICE_7260) },
94 { USB_VPI(USB_VENDOR_INTEL2, 0x0aa7, UBT_INTEL_DEVICE_7260) },
95 /* Intel Wireless 8260/8265 and successors */
96 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2b, UBT_INTEL_DEVICE_8260) },
97 { USB_VPI(USB_VENDOR_INTEL2, 0x0aaa, UBT_INTEL_DEVICE_8260) },
98 { USB_VPI(USB_VENDOR_INTEL2, 0x0025, UBT_INTEL_DEVICE_8260) },
99 { USB_VPI(USB_VENDOR_INTEL2, 0x0026, UBT_INTEL_DEVICE_8260) },
100 { USB_VPI(USB_VENDOR_INTEL2, 0x0029, UBT_INTEL_DEVICE_8260) },
101 /* Intel Wireless 9260/9560 and successors */
102 { USB_VPI(USB_VENDOR_INTEL2, 0x0032, UBT_INTEL_DEVICE_9260) },
103 { USB_VPI(USB_VENDOR_INTEL2, 0x0033, UBT_INTEL_DEVICE_9260) },
104 };
105
106 /*
107 * Execute generic HCI command and return response in provided buffer.
108 */
109
110 static usb_error_t
ubt_intel_do_hci_request(struct usb_device * udev,uint16_t opcode,void * resp,uint8_t resp_len)111 ubt_intel_do_hci_request(struct usb_device *udev, uint16_t opcode,
112 void *resp, uint8_t resp_len)
113 {
114 struct ubt_hci_event_command_compl *evt;
115 struct ubt_hci_cmd cmd;
116 usb_error_t error;
117
118 memset(&cmd, 0, sizeof(cmd));
119 cmd.opcode = htole16(opcode);
120 evt = malloc(offsetof(struct ubt_hci_event_command_compl, data) +
121 resp_len, M_TEMP, M_ZERO | M_WAITOK);
122 evt->header.event = NG_HCI_EVENT_COMMAND_COMPL;
123 evt->header.length = resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE;
124
125 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT);
126 if (error != USB_ERR_NORMAL_COMPLETION)
127 goto exit;
128
129 if (evt->header.length == resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE)
130 memcpy(resp, evt->data, resp_len);
131 else
132 error = USB_ERR_INVAL;
133 exit:
134 free(evt, M_TEMP);
135 return (error);
136 }
137
138 static uint8_t
ubt_intel_get_img_type(struct usb_device * udev)139 ubt_intel_get_img_type(struct usb_device *udev)
140 {
141 #define UBT_INTEL_MAX_EVT_SIZE 256
142 static struct ubt_hci_cmd cmd = {
143 .opcode = htole16(NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05)),
144 .length = 1,
145 .data = { 0xff },
146 };
147 struct ubt_hci_event_command_compl *evt;
148 usb_error_t error;
149 uint8_t status, datalen, type, len, img_type = 0;
150 uint8_t *data;
151
152 evt = malloc(UBT_INTEL_MAX_EVT_SIZE, M_TEMP, M_ZERO | M_WAITOK);
153 evt->header.event = NG_HCI_EVENT_COMMAND_COMPL;
154 evt->header.length =
155 UBT_INTEL_MAX_EVT_SIZE - sizeof(struct ubt_hci_evhdr);
156
157 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT);
158 if (error != USB_ERR_NORMAL_COMPLETION)
159 goto exit;
160
161 datalen = evt->header.length - UBT_HCI_EVENT_COMPL_HEAD_SIZE;
162 data = evt->data;
163 status = *data++;
164 if (status != 0)
165 goto exit;
166 datalen--;
167
168 while (datalen >= 2) {
169 type = *data++;
170 len = *data++;
171 datalen -= 2;
172 if (datalen < len)
173 break;
174 if (type == UBT_INTEL_TLV_IMAGE_TYPE && len == 1) {
175 img_type = *data;
176 break;
177 }
178 datalen -= len;
179 data += len;
180 }
181 exit:
182 free(evt, M_TEMP);
183 return (img_type);
184 }
185
186 /*
187 * Probe for a Intel Wireless Bluetooth device.
188 */
189
190 static int
ubt_intel_probe(device_t dev)191 ubt_intel_probe(device_t dev)
192 {
193 struct usb_attach_arg *uaa = device_get_ivars(dev);
194 struct ubt_intel_version_rp version;
195 ng_hci_reset_rp reset;
196 int error;
197 uint8_t img_type;
198
199 if (uaa->usb_mode != USB_MODE_HOST)
200 return (ENXIO);
201
202 if (uaa->info.bIfaceIndex != 0)
203 return (ENXIO);
204
205 error = usbd_lookup_id_by_uaa(ubt_intel_devs, sizeof(ubt_intel_devs),
206 uaa);
207 if (error != 0)
208 return (error);
209
210 switch (USB_GET_DRIVER_INFO(uaa)) {
211 case UBT_INTEL_DEVICE_7260:
212 /*
213 * Send HCI Reset command to workaround controller bug with the
214 * first HCI command sent to it returning number of completed
215 * commands as zero. This will reset the number of completed
216 * commands and allow further normal command processing.
217 */
218 if (ubt_intel_do_hci_request(uaa->device,
219 NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND, NG_HCI_OCF_RESET),
220 &reset, sizeof(reset)) != USB_ERR_NORMAL_COMPLETION)
221 return (ENXIO);
222 if (reset.status != 0)
223 return (ENXIO);
224 /*
225 * fw_patch_num indicates the version of patch the device
226 * currently have. If there is no patch data in the device,
227 * it is always 0x00 and we need to patch the device again.
228 */
229 if (ubt_intel_do_hci_request(uaa->device,
230 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05),
231 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION)
232 return (ENXIO);
233 if (version.fw_patch_num == 0)
234 return (ENXIO);
235 break;
236
237 case UBT_INTEL_DEVICE_8260:
238 /*
239 * Find if the Intel Wireless 8260/8265 device is in bootloader
240 * mode or is running operational firmware with checking of
241 * variant byte of "Intel version" HCI command response.
242 * The value 0x23 identifies the operational firmware.
243 */
244 if (ubt_intel_do_hci_request(uaa->device,
245 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05),
246 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION)
247 return (ENXIO);
248 if (version.fw_variant != 0x23)
249 return (ENXIO);
250 break;
251
252 case UBT_INTEL_DEVICE_9260:
253 /*
254 * Find if the Intel Wireless 9260/9560 device is in bootloader
255 * mode or is running operational firmware with checking of
256 * image type byte of "Intel version" HCI command response.
257 * The value 0x03 identifies the operational firmware.
258 */
259 img_type = ubt_intel_get_img_type(uaa->device);
260 if (img_type != 0x03)
261 return (ENXIO);
262 break;
263
264 default:
265 KASSERT(0 == 1, ("Unknown DRIVER_INFO"));
266 }
267
268 return (BUS_PROBE_DEFAULT);
269 }
270
271 /*
272 * Module interface. Attach and detach methods, netgraph node type
273 * registration and PNP string are inherited from ng_ubt.c driver.
274 */
275
276 static device_method_t ubt_intel_methods[] =
277 {
278 DEVMETHOD(device_probe, ubt_intel_probe),
279 DEVMETHOD_END
280 };
281
282 DEFINE_CLASS_1(ubt, ubt_intel_driver, ubt_intel_methods,
283 sizeof(struct ubt_softc), ubt_driver);
284 DRIVER_MODULE(ng_ubt_intel, uhub, ubt_intel_driver, 0, 0);
285 MODULE_VERSION(ng_ubt_intel, NG_BLUETOOTH_VERSION);
286 MODULE_DEPEND(ng_ubt_intel, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION);
287 MODULE_DEPEND(ng_ubt_intel, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
288 MODULE_DEPEND(ng_ubt_intel, usb, 1, 1, 1);
289