1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_REV2 2 55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 56 57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 58 struct cmd_write_boot_params { 59 __le32 boot_addr; 60 u8 fw_build_num; 61 u8 fw_build_ww; 62 u8 fw_build_yy; 63 } __packed; 64 65 static struct { 66 const char *driver_name; 67 u8 hw_variant; 68 u32 fw_build_num; 69 } coredump_info; 70 71 const guid_t btintel_guid_dsm = 72 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 73 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 74 EXPORT_SYMBOL_GPL(btintel_guid_dsm); 75 76 int btintel_check_bdaddr(struct hci_dev *hdev) 77 { 78 struct hci_rp_read_bd_addr *bda; 79 struct sk_buff *skb; 80 81 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 82 HCI_INIT_TIMEOUT); 83 if (IS_ERR(skb)) { 84 int err = PTR_ERR(skb); 85 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 86 err); 87 return err; 88 } 89 90 if (skb->len != sizeof(*bda)) { 91 bt_dev_err(hdev, "Intel device address length mismatch"); 92 kfree_skb(skb); 93 return -EIO; 94 } 95 96 bda = (struct hci_rp_read_bd_addr *)skb->data; 97 98 /* For some Intel based controllers, the default Bluetooth device 99 * address 00:03:19:9E:8B:00 can be found. These controllers are 100 * fully operational, but have the danger of duplicate addresses 101 * and that in turn can cause problems with Bluetooth operation. 102 */ 103 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 104 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 105 &bda->bdaddr); 106 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 107 } 108 109 kfree_skb(skb); 110 111 return 0; 112 } 113 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 114 115 int btintel_enter_mfg(struct hci_dev *hdev) 116 { 117 static const u8 param[] = { 0x01, 0x00 }; 118 struct sk_buff *skb; 119 120 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 121 if (IS_ERR(skb)) { 122 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 123 PTR_ERR(skb)); 124 return PTR_ERR(skb); 125 } 126 kfree_skb(skb); 127 128 return 0; 129 } 130 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 131 132 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 133 { 134 u8 param[] = { 0x00, 0x00 }; 135 struct sk_buff *skb; 136 137 /* The 2nd command parameter specifies the manufacturing exit method: 138 * 0x00: Just disable the manufacturing mode (0x00). 139 * 0x01: Disable manufacturing mode and reset with patches deactivated. 140 * 0x02: Disable manufacturing mode and reset with patches activated. 141 */ 142 if (reset) 143 param[1] |= patched ? 0x02 : 0x01; 144 145 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 146 if (IS_ERR(skb)) { 147 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 148 PTR_ERR(skb)); 149 return PTR_ERR(skb); 150 } 151 kfree_skb(skb); 152 153 return 0; 154 } 155 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 156 157 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 158 { 159 struct sk_buff *skb; 160 int err; 161 162 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 163 if (IS_ERR(skb)) { 164 err = PTR_ERR(skb); 165 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 166 err); 167 return err; 168 } 169 kfree_skb(skb); 170 171 return 0; 172 } 173 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 174 175 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 176 { 177 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 178 struct sk_buff *skb; 179 int err; 180 181 if (debug) 182 mask[1] |= 0x62; 183 184 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 185 if (IS_ERR(skb)) { 186 err = PTR_ERR(skb); 187 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 188 return err; 189 } 190 kfree_skb(skb); 191 192 return 0; 193 } 194 195 int btintel_set_diag(struct hci_dev *hdev, bool enable) 196 { 197 struct sk_buff *skb; 198 u8 param[3]; 199 int err; 200 201 if (enable) { 202 param[0] = 0x03; 203 param[1] = 0x03; 204 param[2] = 0x03; 205 } else { 206 param[0] = 0x00; 207 param[1] = 0x00; 208 param[2] = 0x00; 209 } 210 211 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 212 if (IS_ERR(skb)) { 213 err = PTR_ERR(skb); 214 if (err == -ENODATA) 215 goto done; 216 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 217 err); 218 return err; 219 } 220 kfree_skb(skb); 221 222 done: 223 btintel_set_event_mask(hdev, enable); 224 return 0; 225 } 226 EXPORT_SYMBOL_GPL(btintel_set_diag); 227 228 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 229 { 230 int err, ret; 231 232 err = btintel_enter_mfg(hdev); 233 if (err) 234 return err; 235 236 ret = btintel_set_diag(hdev, enable); 237 238 err = btintel_exit_mfg(hdev, false, false); 239 if (err) 240 return err; 241 242 return ret; 243 } 244 245 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 246 { 247 int ret; 248 249 /* Legacy ROM device needs to be in the manufacturer mode to apply 250 * diagnostic setting 251 * 252 * This flag is set after reading the Intel version. 253 */ 254 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 255 ret = btintel_set_diag_mfg(hdev, enable); 256 else 257 ret = btintel_set_diag(hdev, enable); 258 259 return ret; 260 } 261 262 void btintel_hw_error(struct hci_dev *hdev, u8 code) 263 { 264 struct sk_buff *skb; 265 u8 type = 0x00; 266 267 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 268 269 hci_req_sync_lock(hdev); 270 271 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 272 if (IS_ERR(skb)) { 273 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 274 PTR_ERR(skb)); 275 goto unlock; 276 } 277 kfree_skb(skb); 278 279 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 280 if (IS_ERR(skb)) { 281 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 282 PTR_ERR(skb)); 283 goto unlock; 284 } 285 286 if (skb->len != 13) { 287 bt_dev_err(hdev, "Exception info size mismatch"); 288 kfree_skb(skb); 289 goto unlock; 290 } 291 292 bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1), 293 (char *)(skb->data + 1)); 294 295 kfree_skb(skb); 296 297 unlock: 298 hci_req_sync_unlock(hdev); 299 } 300 EXPORT_SYMBOL_GPL(btintel_hw_error); 301 302 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 303 { 304 const char *variant; 305 306 /* The hardware platform number has a fixed value of 0x37 and 307 * for now only accept this single value. 308 */ 309 if (ver->hw_platform != 0x37) { 310 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 311 ver->hw_platform); 312 return -EINVAL; 313 } 314 315 /* Check for supported iBT hardware variants of this firmware 316 * loading method. 317 * 318 * This check has been put in place to ensure correct forward 319 * compatibility options when newer hardware variants come along. 320 */ 321 switch (ver->hw_variant) { 322 case 0x07: /* WP - Legacy ROM */ 323 case 0x08: /* StP - Legacy ROM */ 324 case 0x0b: /* SfP */ 325 case 0x0c: /* WsP */ 326 case 0x11: /* JfP */ 327 case 0x12: /* ThP */ 328 case 0x13: /* HrP */ 329 case 0x14: /* CcP */ 330 break; 331 default: 332 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 333 ver->hw_variant); 334 return -EINVAL; 335 } 336 337 switch (ver->fw_variant) { 338 case 0x01: 339 variant = "Legacy ROM 2.5"; 340 break; 341 case 0x06: 342 variant = "Bootloader"; 343 break; 344 case 0x22: 345 variant = "Legacy ROM 2.x"; 346 break; 347 case 0x23: 348 variant = "Firmware"; 349 break; 350 default: 351 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 352 return -EINVAL; 353 } 354 355 coredump_info.hw_variant = ver->hw_variant; 356 coredump_info.fw_build_num = ver->fw_build_num; 357 358 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 359 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 360 ver->fw_build_num, ver->fw_build_ww, 361 2000 + ver->fw_build_yy); 362 363 return 0; 364 } 365 EXPORT_SYMBOL_GPL(btintel_version_info); 366 367 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 368 const void *param) 369 { 370 while (plen > 0) { 371 struct sk_buff *skb; 372 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 373 374 cmd_param[0] = fragment_type; 375 memcpy(cmd_param + 1, param, fragment_len); 376 377 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 378 cmd_param, HCI_INIT_TIMEOUT); 379 if (IS_ERR(skb)) 380 return PTR_ERR(skb); 381 382 kfree_skb(skb); 383 384 plen -= fragment_len; 385 param += fragment_len; 386 } 387 388 return 0; 389 } 390 391 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 392 { 393 const struct firmware *fw; 394 struct sk_buff *skb; 395 const u8 *fw_ptr; 396 int err; 397 398 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 399 if (err < 0) { 400 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 401 ddc_name, err); 402 return err; 403 } 404 405 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 406 407 fw_ptr = fw->data; 408 409 /* DDC file contains one or more DDC structure which has 410 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 411 */ 412 while (fw->size > (size_t)(fw_ptr - fw->data)) { 413 size_t remaining = fw->size - (fw_ptr - fw->data); 414 unsigned int cmd_plen = fw_ptr[0] + 1U; 415 416 if (cmd_plen < 3 || cmd_plen > U8_MAX || cmd_plen > remaining) { 417 bt_dev_err(hdev, "Malformed DDC record (plen=%u, remaining=%zu)", 418 cmd_plen, remaining); 419 release_firmware(fw); 420 return -EINVAL; 421 } 422 423 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 424 HCI_INIT_TIMEOUT); 425 if (IS_ERR(skb)) { 426 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 427 PTR_ERR(skb)); 428 release_firmware(fw); 429 return PTR_ERR(skb); 430 } 431 432 fw_ptr += cmd_plen; 433 kfree_skb(skb); 434 } 435 436 release_firmware(fw); 437 438 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 439 440 return 0; 441 } 442 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 443 444 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 445 { 446 int err, ret; 447 448 err = btintel_enter_mfg(hdev); 449 if (err) 450 return err; 451 452 ret = btintel_set_event_mask(hdev, debug); 453 454 err = btintel_exit_mfg(hdev, false, false); 455 if (err) 456 return err; 457 458 return ret; 459 } 460 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 461 462 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 463 { 464 struct sk_buff *skb; 465 466 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 467 if (IS_ERR(skb)) { 468 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 469 PTR_ERR(skb)); 470 return PTR_ERR(skb); 471 } 472 473 if (!skb || skb->len != sizeof(*ver)) { 474 bt_dev_err(hdev, "Intel version event size mismatch"); 475 kfree_skb(skb); 476 return -EILSEQ; 477 } 478 479 memcpy(ver, skb->data, sizeof(*ver)); 480 481 kfree_skb(skb); 482 483 return 0; 484 } 485 EXPORT_SYMBOL_GPL(btintel_read_version); 486 487 int btintel_version_info_tlv(struct hci_dev *hdev, 488 struct intel_version_tlv *version) 489 { 490 const char *variant; 491 492 /* The hardware platform number has a fixed value of 0x37 and 493 * for now only accept this single value. 494 */ 495 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 496 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 497 INTEL_HW_PLATFORM(version->cnvi_bt)); 498 return -EINVAL; 499 } 500 501 /* Check for supported iBT hardware variants of this firmware 502 * loading method. 503 * 504 * This check has been put in place to ensure correct forward 505 * compatibility options when newer hardware variants come along. 506 */ 507 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 508 case 0x17: /* TyP */ 509 case 0x18: /* Slr */ 510 case 0x19: /* Slr-F */ 511 case 0x1b: /* Mgr */ 512 case 0x1c: /* Gale Peak (GaP) */ 513 case 0x1d: /* BlazarU (BzrU) */ 514 case 0x1e: /* BlazarI (Bzr) */ 515 case 0x1f: /* Scorpious Peak */ 516 case 0x20: /* Scorpious Peak2 */ 517 case 0x21: /* Scorpious Peak2 F */ 518 case 0x22: /* BlazarIW (BzrIW) */ 519 break; 520 default: 521 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 522 INTEL_HW_VARIANT(version->cnvi_bt)); 523 return -EINVAL; 524 } 525 526 switch (version->img_type) { 527 case BTINTEL_IMG_BOOTLOADER: 528 variant = "Bootloader"; 529 /* It is required that every single firmware fragment is acknowledged 530 * with a command complete event. If the boot parameters indicate 531 * that this bootloader does not send them, then abort the setup. 532 */ 533 if (version->limited_cce != 0x00) { 534 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 535 version->limited_cce); 536 return -EINVAL; 537 } 538 539 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 540 if (version->sbe_type > 0x03) { 541 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 542 version->sbe_type); 543 return -EINVAL; 544 } 545 546 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 547 bt_dev_info(hdev, "Secure boot is %s", 548 str_enabled_disabled(version->secure_boot)); 549 bt_dev_info(hdev, "OTP lock is %s", 550 str_enabled_disabled(version->otp_lock)); 551 bt_dev_info(hdev, "API lock is %s", 552 str_enabled_disabled(version->api_lock)); 553 bt_dev_info(hdev, "Debug lock is %s", 554 str_enabled_disabled(version->debug_lock)); 555 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 556 version->min_fw_build_nn, version->min_fw_build_cw, 557 2000 + version->min_fw_build_yy); 558 break; 559 case BTINTEL_IMG_IML: 560 variant = "Intermediate loader"; 561 break; 562 case BTINTEL_IMG_OP: 563 variant = "Firmware"; 564 break; 565 default: 566 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 567 return -EINVAL; 568 } 569 570 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 571 coredump_info.fw_build_num = version->build_num; 572 573 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 574 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 575 version->build_type, version->build_num); 576 if (version->img_type == BTINTEL_IMG_OP) 577 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 578 579 return 0; 580 } 581 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 582 583 static u8 btintel_version_tlv_min_len(u8 type) 584 { 585 switch (type) { 586 case INTEL_TLV_CNVI_TOP: 587 case INTEL_TLV_CNVR_TOP: 588 case INTEL_TLV_CNVI_BT: 589 case INTEL_TLV_CNVR_BT: 590 case INTEL_TLV_BUILD_NUM: 591 case INTEL_TLV_GIT_SHA1: 592 return sizeof(u32); 593 case INTEL_TLV_DEV_REV_ID: 594 case INTEL_TLV_TIME_STAMP: 595 return sizeof(u16); 596 case INTEL_TLV_IMAGE_TYPE: 597 case INTEL_TLV_BUILD_TYPE: 598 case INTEL_TLV_SECURE_BOOT: 599 case INTEL_TLV_OTP_LOCK: 600 case INTEL_TLV_API_LOCK: 601 case INTEL_TLV_DEBUG_LOCK: 602 case INTEL_TLV_LIMITED_CCE: 603 case INTEL_TLV_SBE_TYPE: 604 return sizeof(u8); 605 case INTEL_TLV_MIN_FW: 606 return 3; 607 case INTEL_TLV_OTP_BDADDR: 608 return sizeof(bdaddr_t); 609 default: 610 return 0; 611 } 612 } 613 614 int btintel_parse_version_tlv(struct hci_dev *hdev, 615 struct intel_version_tlv *version, 616 struct sk_buff *skb) 617 { 618 /* Consume Command Complete Status field */ 619 if (!skb_pull(skb, 1)) 620 return -EINVAL; 621 622 /* Event parameters contain multiple TLVs. Read each of them 623 * and only keep the required data. Also, it use existing legacy 624 * version field like hw_platform, hw_variant, and fw_variant 625 * to keep the existing setup flow 626 */ 627 while (skb->len) { 628 struct intel_tlv *tlv; 629 630 /* Make sure skb has a minimum length of the header */ 631 if (skb->len < sizeof(*tlv)) 632 return -EINVAL; 633 634 tlv = (struct intel_tlv *)skb->data; 635 636 /* Make sure skb has a enough data */ 637 if (skb->len < tlv->len + sizeof(*tlv)) 638 return -EINVAL; 639 640 if (tlv->len < btintel_version_tlv_min_len(tlv->type)) 641 return -EINVAL; 642 643 switch (tlv->type) { 644 case INTEL_TLV_CNVI_TOP: 645 version->cnvi_top = get_unaligned_le32(tlv->val); 646 break; 647 case INTEL_TLV_CNVR_TOP: 648 version->cnvr_top = get_unaligned_le32(tlv->val); 649 break; 650 case INTEL_TLV_CNVI_BT: 651 version->cnvi_bt = get_unaligned_le32(tlv->val); 652 break; 653 case INTEL_TLV_CNVR_BT: 654 version->cnvr_bt = get_unaligned_le32(tlv->val); 655 break; 656 case INTEL_TLV_DEV_REV_ID: 657 version->dev_rev_id = get_unaligned_le16(tlv->val); 658 break; 659 case INTEL_TLV_IMAGE_TYPE: 660 version->img_type = tlv->val[0]; 661 break; 662 case INTEL_TLV_TIME_STAMP: 663 /* If image type is Operational firmware (0x03), then 664 * running FW Calendar Week and Year information can 665 * be extracted from Timestamp information 666 */ 667 version->min_fw_build_cw = tlv->val[0]; 668 version->min_fw_build_yy = tlv->val[1]; 669 version->timestamp = get_unaligned_le16(tlv->val); 670 break; 671 case INTEL_TLV_BUILD_TYPE: 672 version->build_type = tlv->val[0]; 673 break; 674 case INTEL_TLV_BUILD_NUM: 675 /* If image type is Operational firmware (0x03), then 676 * running FW build number can be extracted from the 677 * Build information 678 */ 679 version->min_fw_build_nn = tlv->val[0]; 680 version->build_num = get_unaligned_le32(tlv->val); 681 break; 682 case INTEL_TLV_SECURE_BOOT: 683 version->secure_boot = tlv->val[0]; 684 break; 685 case INTEL_TLV_OTP_LOCK: 686 version->otp_lock = tlv->val[0]; 687 break; 688 case INTEL_TLV_API_LOCK: 689 version->api_lock = tlv->val[0]; 690 break; 691 case INTEL_TLV_DEBUG_LOCK: 692 version->debug_lock = tlv->val[0]; 693 break; 694 case INTEL_TLV_MIN_FW: 695 version->min_fw_build_nn = tlv->val[0]; 696 version->min_fw_build_cw = tlv->val[1]; 697 version->min_fw_build_yy = tlv->val[2]; 698 break; 699 case INTEL_TLV_LIMITED_CCE: 700 version->limited_cce = tlv->val[0]; 701 break; 702 case INTEL_TLV_SBE_TYPE: 703 version->sbe_type = tlv->val[0]; 704 break; 705 case INTEL_TLV_OTP_BDADDR: 706 memcpy(&version->otp_bd_addr, tlv->val, 707 sizeof(bdaddr_t)); 708 break; 709 case INTEL_TLV_GIT_SHA1: 710 version->git_sha1 = get_unaligned_le32(tlv->val); 711 break; 712 case INTEL_TLV_FW_ID: 713 snprintf(version->fw_id, sizeof(version->fw_id), 714 "%.*s", tlv->len, tlv->val); 715 break; 716 default: 717 /* Ignore rest of information */ 718 break; 719 } 720 /* consume the current tlv and move to next*/ 721 skb_pull(skb, tlv->len + sizeof(*tlv)); 722 } 723 724 return 0; 725 } 726 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 727 728 static int btintel_read_version_tlv(struct hci_dev *hdev, 729 struct intel_version_tlv *version) 730 { 731 struct sk_buff *skb; 732 const u8 param[1] = { 0xFF }; 733 int err; 734 735 if (!version) 736 return -EINVAL; 737 738 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 739 if (IS_ERR(skb)) { 740 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 741 PTR_ERR(skb)); 742 return PTR_ERR(skb); 743 } 744 745 if (skb->data[0]) { 746 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 747 skb->data[0]); 748 kfree_skb(skb); 749 return -EIO; 750 } 751 752 err = btintel_parse_version_tlv(hdev, version, skb); 753 754 kfree_skb(skb); 755 return err; 756 } 757 758 /* ------- REGMAP IBT SUPPORT ------- */ 759 760 #define IBT_REG_MODE_8BIT 0x00 761 #define IBT_REG_MODE_16BIT 0x01 762 #define IBT_REG_MODE_32BIT 0x02 763 764 struct regmap_ibt_context { 765 struct hci_dev *hdev; 766 __u16 op_write; 767 __u16 op_read; 768 }; 769 770 struct ibt_cp_reg_access { 771 __le32 addr; 772 __u8 mode; 773 __u8 len; 774 __u8 data[]; 775 } __packed; 776 777 struct ibt_rp_reg_access { 778 __u8 status; 779 __le32 addr; 780 __u8 data[]; 781 } __packed; 782 783 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 784 void *val, size_t val_size) 785 { 786 struct regmap_ibt_context *ctx = context; 787 struct ibt_cp_reg_access cp; 788 struct ibt_rp_reg_access *rp; 789 struct sk_buff *skb; 790 int err = 0; 791 792 if (reg_size != sizeof(__le32)) 793 return -EINVAL; 794 795 switch (val_size) { 796 case 1: 797 cp.mode = IBT_REG_MODE_8BIT; 798 break; 799 case 2: 800 cp.mode = IBT_REG_MODE_16BIT; 801 break; 802 case 4: 803 cp.mode = IBT_REG_MODE_32BIT; 804 break; 805 default: 806 return -EINVAL; 807 } 808 809 /* regmap provides a little-endian formatted addr */ 810 cp.addr = *(__le32 *)addr; 811 cp.len = val_size; 812 813 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 814 815 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 816 HCI_CMD_TIMEOUT); 817 if (IS_ERR(skb)) { 818 err = PTR_ERR(skb); 819 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 820 le32_to_cpu(cp.addr), err); 821 return err; 822 } 823 824 if (skb->len != sizeof(*rp) + val_size) { 825 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 826 le32_to_cpu(cp.addr)); 827 err = -EINVAL; 828 goto done; 829 } 830 831 rp = (struct ibt_rp_reg_access *)skb->data; 832 833 if (rp->addr != cp.addr) { 834 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 835 le32_to_cpu(rp->addr)); 836 err = -EINVAL; 837 goto done; 838 } 839 840 memcpy(val, rp->data, val_size); 841 842 done: 843 kfree_skb(skb); 844 return err; 845 } 846 847 static int regmap_ibt_gather_write(void *context, 848 const void *addr, size_t reg_size, 849 const void *val, size_t val_size) 850 { 851 struct regmap_ibt_context *ctx = context; 852 struct ibt_cp_reg_access *cp; 853 struct sk_buff *skb; 854 int plen = sizeof(*cp) + val_size; 855 u8 mode; 856 int err = 0; 857 858 if (reg_size != sizeof(__le32)) 859 return -EINVAL; 860 861 switch (val_size) { 862 case 1: 863 mode = IBT_REG_MODE_8BIT; 864 break; 865 case 2: 866 mode = IBT_REG_MODE_16BIT; 867 break; 868 case 4: 869 mode = IBT_REG_MODE_32BIT; 870 break; 871 default: 872 return -EINVAL; 873 } 874 875 cp = kmalloc(plen, GFP_KERNEL); 876 if (!cp) 877 return -ENOMEM; 878 879 /* regmap provides a little-endian formatted addr/value */ 880 cp->addr = *(__le32 *)addr; 881 cp->mode = mode; 882 cp->len = val_size; 883 memcpy(&cp->data, val, val_size); 884 885 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 886 887 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 888 if (IS_ERR(skb)) { 889 err = PTR_ERR(skb); 890 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 891 le32_to_cpu(cp->addr), err); 892 goto done; 893 } 894 kfree_skb(skb); 895 896 done: 897 kfree(cp); 898 return err; 899 } 900 901 static int regmap_ibt_write(void *context, const void *data, size_t count) 902 { 903 /* data contains register+value, since we only support 32bit addr, 904 * minimum data size is 4 bytes. 905 */ 906 if (WARN_ONCE(count < 4, "Invalid register access")) 907 return -EINVAL; 908 909 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 910 } 911 912 static void regmap_ibt_free_context(void *context) 913 { 914 kfree(context); 915 } 916 917 static const struct regmap_bus regmap_ibt = { 918 .read = regmap_ibt_read, 919 .write = regmap_ibt_write, 920 .gather_write = regmap_ibt_gather_write, 921 .free_context = regmap_ibt_free_context, 922 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 923 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 924 }; 925 926 /* Config is the same for all register regions */ 927 static const struct regmap_config regmap_ibt_cfg = { 928 .name = "btintel_regmap", 929 .reg_bits = 32, 930 .val_bits = 32, 931 }; 932 933 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 934 u16 opcode_write) 935 { 936 struct regmap_ibt_context *ctx; 937 938 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 939 opcode_write); 940 941 ctx = kzalloc_obj(*ctx); 942 if (!ctx) 943 return ERR_PTR(-ENOMEM); 944 945 ctx->op_read = opcode_read; 946 ctx->op_write = opcode_write; 947 ctx->hdev = hdev; 948 949 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 950 } 951 EXPORT_SYMBOL_GPL(btintel_regmap_init); 952 953 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 954 { 955 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 956 struct sk_buff *skb; 957 958 params.boot_param = cpu_to_le32(boot_param); 959 960 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 961 HCI_INIT_TIMEOUT); 962 if (IS_ERR(skb)) { 963 bt_dev_err(hdev, "Failed to send Intel Reset command"); 964 return PTR_ERR(skb); 965 } 966 967 kfree_skb(skb); 968 969 return 0; 970 } 971 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 972 973 int btintel_read_boot_params(struct hci_dev *hdev, 974 struct intel_boot_params *params) 975 { 976 struct sk_buff *skb; 977 978 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 979 if (IS_ERR(skb)) { 980 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 981 PTR_ERR(skb)); 982 return PTR_ERR(skb); 983 } 984 985 if (skb->len != sizeof(*params)) { 986 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 987 kfree_skb(skb); 988 return -EILSEQ; 989 } 990 991 memcpy(params, skb->data, sizeof(*params)); 992 993 kfree_skb(skb); 994 995 if (params->status) { 996 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 997 params->status); 998 return -bt_to_errno(params->status); 999 } 1000 1001 bt_dev_info(hdev, "Device revision is %u", 1002 le16_to_cpu(params->dev_revid)); 1003 1004 bt_dev_info(hdev, "Secure boot is %s", 1005 str_enabled_disabled(params->secure_boot)); 1006 1007 bt_dev_info(hdev, "OTP lock is %s", 1008 str_enabled_disabled(params->otp_lock)); 1009 1010 bt_dev_info(hdev, "API lock is %s", 1011 str_enabled_disabled(params->api_lock)); 1012 1013 bt_dev_info(hdev, "Debug lock is %s", 1014 str_enabled_disabled(params->debug_lock)); 1015 1016 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 1017 params->min_fw_build_nn, params->min_fw_build_cw, 1018 2000 + params->min_fw_build_yy); 1019 1020 return 0; 1021 } 1022 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 1023 1024 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 1025 const struct firmware *fw) 1026 { 1027 int err; 1028 1029 /* Start the firmware download transaction with the Init fragment 1030 * represented by the 128 bytes of CSS header. 1031 */ 1032 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 1033 if (err < 0) { 1034 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1035 goto done; 1036 } 1037 1038 /* Send the 256 bytes of public key information from the firmware 1039 * as the PKey fragment. 1040 */ 1041 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 1042 if (err < 0) { 1043 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1044 goto done; 1045 } 1046 1047 /* Send the 256 bytes of signature information from the firmware 1048 * as the Sign fragment. 1049 */ 1050 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1051 if (err < 0) { 1052 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1053 goto done; 1054 } 1055 1056 done: 1057 return err; 1058 } 1059 1060 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1061 const struct firmware *fw) 1062 { 1063 int err; 1064 1065 /* Start the firmware download transaction with the Init fragment 1066 * represented by the 128 bytes of CSS header. 1067 */ 1068 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1069 if (err < 0) { 1070 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1071 return err; 1072 } 1073 1074 /* Send the 96 bytes of public key information from the firmware 1075 * as the PKey fragment. 1076 */ 1077 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1078 if (err < 0) { 1079 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1080 return err; 1081 } 1082 1083 /* Send the 96 bytes of signature information from the firmware 1084 * as the Sign fragment 1085 */ 1086 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1087 if (err < 0) { 1088 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1089 err); 1090 return err; 1091 } 1092 return 0; 1093 } 1094 1095 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1096 const struct firmware *fw) 1097 { 1098 int err; 1099 1100 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1101 if (err < 0) { 1102 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1103 return err; 1104 } 1105 1106 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1107 fw->data + BTINTEL_ECDSA_OFFSET); 1108 if (err < 0) { 1109 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1110 return err; 1111 } 1112 1113 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1114 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1115 if (err < 0) { 1116 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1117 return err; 1118 } 1119 1120 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1121 fw->data + BTINTEL_LMS_OFFSET); 1122 if (err < 0) { 1123 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1124 return err; 1125 } 1126 1127 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1128 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1129 if (err < 0) { 1130 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1131 return err; 1132 } 1133 1134 return 0; 1135 } 1136 1137 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1138 const struct firmware *fw, 1139 size_t offset) 1140 { 1141 int err; 1142 const u8 *fw_ptr; 1143 u32 frag_len; 1144 1145 fw_ptr = fw->data + offset; 1146 frag_len = 0; 1147 err = -EINVAL; 1148 1149 while (fw_ptr - fw->data < fw->size) { 1150 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1151 1152 frag_len += sizeof(*cmd) + cmd->plen; 1153 1154 /* The parameter length of the secure send command requires 1155 * a 4 byte alignment. It happens so that the firmware file 1156 * contains proper Intel_NOP commands to align the fragments 1157 * as needed. 1158 * 1159 * Send set of commands with 4 byte alignment from the 1160 * firmware data buffer as a single Data fragment. 1161 */ 1162 if (!(frag_len % 4)) { 1163 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1164 if (err < 0) { 1165 bt_dev_err(hdev, 1166 "Failed to send firmware data (%d)", 1167 err); 1168 goto done; 1169 } 1170 1171 fw_ptr += frag_len; 1172 frag_len = 0; 1173 } 1174 } 1175 1176 done: 1177 return err; 1178 } 1179 1180 static bool btintel_firmware_version(struct hci_dev *hdev, 1181 u8 num, u8 ww, u8 yy, 1182 const struct firmware *fw, 1183 u32 *boot_addr) 1184 { 1185 const u8 *fw_ptr; 1186 1187 fw_ptr = fw->data; 1188 1189 while (fw_ptr - fw->data < fw->size) { 1190 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1191 1192 /* Each SKU has a different reset parameter to use in the 1193 * HCI_Intel_Reset command and it is embedded in the firmware 1194 * data. So, instead of using static value per SKU, check 1195 * the firmware data and save it for later use. 1196 */ 1197 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1198 struct cmd_write_boot_params *params; 1199 1200 params = (void *)(fw_ptr + sizeof(*cmd)); 1201 1202 *boot_addr = le32_to_cpu(params->boot_addr); 1203 1204 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1205 1206 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1207 params->fw_build_num, params->fw_build_ww, 1208 params->fw_build_yy); 1209 1210 return (num == params->fw_build_num && 1211 ww == params->fw_build_ww && 1212 yy == params->fw_build_yy); 1213 } 1214 1215 fw_ptr += sizeof(*cmd) + cmd->plen; 1216 } 1217 1218 return false; 1219 } 1220 1221 int btintel_download_firmware(struct hci_dev *hdev, 1222 struct intel_version *ver, 1223 const struct firmware *fw, 1224 u32 *boot_param) 1225 { 1226 int err; 1227 1228 /* SfP and WsP don't seem to update the firmware version on file 1229 * so version checking is currently not possible. 1230 */ 1231 switch (ver->hw_variant) { 1232 case 0x0b: /* SfP */ 1233 case 0x0c: /* WsP */ 1234 /* Skip version checking */ 1235 break; 1236 default: 1237 1238 /* Skip download if firmware has the same version */ 1239 if (btintel_firmware_version(hdev, ver->fw_build_num, 1240 ver->fw_build_ww, ver->fw_build_yy, 1241 fw, boot_param)) { 1242 bt_dev_info(hdev, "Firmware already loaded"); 1243 /* Return -EALREADY to indicate that the firmware has 1244 * already been loaded. 1245 */ 1246 return -EALREADY; 1247 } 1248 } 1249 1250 /* The firmware variant determines if the device is in bootloader 1251 * mode or is running operational firmware. The value 0x06 identifies 1252 * the bootloader and the value 0x23 identifies the operational 1253 * firmware. 1254 * 1255 * If the firmware version has changed that means it needs to be reset 1256 * to bootloader when operational so the new firmware can be loaded. 1257 */ 1258 if (ver->fw_variant == 0x23) 1259 return -EINVAL; 1260 1261 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1262 if (err) 1263 return err; 1264 1265 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1266 } 1267 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1268 1269 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1270 struct intel_version_tlv *ver, 1271 const struct firmware *fw, u32 *boot_param, 1272 u8 hw_variant, u8 sbe_type) 1273 { 1274 int err; 1275 u32 css_header_ver; 1276 1277 /* Skip download if firmware has the same version */ 1278 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1279 ver->min_fw_build_cw, 1280 ver->min_fw_build_yy, 1281 fw, boot_param)) { 1282 bt_dev_info(hdev, "Firmware already loaded"); 1283 /* Return -EALREADY to indicate that firmware has 1284 * already been loaded. 1285 */ 1286 return -EALREADY; 1287 } 1288 1289 /* The firmware variant determines if the device is in bootloader 1290 * mode or is running operational firmware. The value 0x01 identifies 1291 * the bootloader and the value 0x03 identifies the operational 1292 * firmware. 1293 * 1294 * If the firmware version has changed that means it needs to be reset 1295 * to bootloader when operational so the new firmware can be loaded. 1296 */ 1297 if (ver->img_type == BTINTEL_IMG_OP) 1298 return -EINVAL; 1299 1300 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1301 * only RSA secure boot engine. Hence, the corresponding sfi file will 1302 * have RSA header of 644 bytes followed by Command Buffer. 1303 * 1304 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1305 * secure boot engine. As a result, the corresponding sfi file will 1306 * have RSA header of 644, ECDSA header of 320 bytes followed by 1307 * Command Buffer. 1308 * 1309 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1310 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1311 */ 1312 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1313 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1314 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1315 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1316 return -EINVAL; 1317 } 1318 1319 if (hw_variant <= 0x14) { 1320 if (sbe_type != 0x00) { 1321 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1322 hw_variant); 1323 return -EINVAL; 1324 } 1325 1326 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1327 if (err) 1328 return err; 1329 1330 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1331 if (err) 1332 return err; 1333 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1334 /* Check if CSS header for ECDSA follows the RSA header */ 1335 if (fw->data[ECDSA_OFFSET] != 0x06) 1336 return -EINVAL; 1337 1338 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1339 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1340 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1341 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1342 return -EINVAL; 1343 } 1344 1345 if (sbe_type == 0x00) { 1346 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1347 if (err) 1348 return err; 1349 1350 err = btintel_download_firmware_payload(hdev, fw, 1351 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1352 if (err) 1353 return err; 1354 } else if (sbe_type == 0x01) { 1355 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1356 if (err) 1357 return err; 1358 1359 err = btintel_download_firmware_payload(hdev, fw, 1360 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1361 if (err) 1362 return err; 1363 } 1364 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1365 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1366 if (err) 1367 return err; 1368 1369 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1370 if (err) 1371 return err; 1372 } 1373 return 0; 1374 } 1375 1376 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1377 { 1378 struct intel_reset params; 1379 struct sk_buff *skb; 1380 1381 /* PCIe transport uses shared hardware reset mechanism for recovery 1382 * which gets triggered in pcie *setup* function on error. 1383 */ 1384 if (hdev->bus == HCI_PCI) 1385 return; 1386 1387 /* Send Intel Reset command. This will result in 1388 * re-enumeration of BT controller. 1389 * 1390 * Intel Reset parameter description: 1391 * reset_type : 0x00 (Soft reset), 1392 * 0x01 (Hard reset) 1393 * patch_enable : 0x00 (Do not enable), 1394 * 0x01 (Enable) 1395 * ddc_reload : 0x00 (Do not reload), 1396 * 0x01 (Reload) 1397 * boot_option: 0x00 (Current image), 1398 * 0x01 (Specified boot address) 1399 * boot_param: Boot address 1400 * 1401 */ 1402 1403 params.reset_type = 0x01; 1404 params.patch_enable = 0x01; 1405 params.ddc_reload = 0x01; 1406 params.boot_option = 0x00; 1407 params.boot_param = cpu_to_le32(0x00000000); 1408 1409 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1410 ¶ms, HCI_INIT_TIMEOUT); 1411 if (IS_ERR(skb)) { 1412 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1413 PTR_ERR(skb)); 1414 return; 1415 } 1416 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1417 kfree_skb(skb); 1418 1419 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1420 * lines for 2ms when it receives Intel Reset in bootloader mode. 1421 * Whereas, the upcoming Intel BT controllers will hold USB reset 1422 * for 150ms. To keep the delay generic, 150ms is chosen here. 1423 */ 1424 msleep(150); 1425 } 1426 1427 static int btintel_read_debug_features(struct hci_dev *hdev, 1428 struct intel_debug_features *features) 1429 { 1430 struct sk_buff *skb; 1431 u8 page_no = 1; 1432 1433 /* Intel controller supports two pages, each page is of 128-bit 1434 * feature bit mask. And each bit defines specific feature support 1435 */ 1436 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1437 HCI_INIT_TIMEOUT); 1438 if (IS_ERR(skb)) { 1439 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1440 PTR_ERR(skb)); 1441 return PTR_ERR(skb); 1442 } 1443 1444 if (skb->len != (sizeof(features->page1) + 3)) { 1445 bt_dev_err(hdev, "Supported features event size mismatch"); 1446 kfree_skb(skb); 1447 return -EILSEQ; 1448 } 1449 1450 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1451 1452 /* Read the supported features page2 if required in future. 1453 */ 1454 kfree_skb(skb); 1455 return 0; 1456 } 1457 1458 static int btintel_set_debug_features(struct hci_dev *hdev, 1459 const struct intel_debug_features *features) 1460 { 1461 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1462 0x00, 0x00, 0x00 }; 1463 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1464 u8 trace_enable = 0x02; 1465 struct sk_buff *skb; 1466 1467 if (!features) { 1468 bt_dev_warn(hdev, "Debug features not read"); 1469 return -EINVAL; 1470 } 1471 1472 if (!(features->page1[0] & 0x3f)) { 1473 bt_dev_info(hdev, "Telemetry exception format not supported"); 1474 return 0; 1475 } 1476 1477 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1478 if (IS_ERR(skb)) { 1479 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1480 PTR_ERR(skb)); 1481 return PTR_ERR(skb); 1482 } 1483 kfree_skb(skb); 1484 1485 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1486 if (IS_ERR(skb)) { 1487 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1488 PTR_ERR(skb)); 1489 return PTR_ERR(skb); 1490 } 1491 kfree_skb(skb); 1492 1493 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1494 if (IS_ERR(skb)) { 1495 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1496 PTR_ERR(skb)); 1497 return PTR_ERR(skb); 1498 } 1499 kfree_skb(skb); 1500 1501 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1502 trace_enable, mask[3]); 1503 1504 return 0; 1505 } 1506 1507 static int btintel_reset_debug_features(struct hci_dev *hdev, 1508 const struct intel_debug_features *features) 1509 { 1510 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1511 0x00, 0x00, 0x00 }; 1512 u8 trace_enable = 0x00; 1513 struct sk_buff *skb; 1514 1515 if (!features) { 1516 bt_dev_warn(hdev, "Debug features not read"); 1517 return -EINVAL; 1518 } 1519 1520 if (!(features->page1[0] & 0x3f)) { 1521 bt_dev_info(hdev, "Telemetry exception format not supported"); 1522 return 0; 1523 } 1524 1525 /* Should stop the trace before writing ddc event mask. */ 1526 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1527 if (IS_ERR(skb)) { 1528 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1529 PTR_ERR(skb)); 1530 return PTR_ERR(skb); 1531 } 1532 kfree_skb(skb); 1533 1534 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1535 if (IS_ERR(skb)) { 1536 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1537 PTR_ERR(skb)); 1538 return PTR_ERR(skb); 1539 } 1540 kfree_skb(skb); 1541 1542 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1543 trace_enable, mask[3]); 1544 1545 return 0; 1546 } 1547 1548 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1549 { 1550 struct intel_debug_features features; 1551 int err; 1552 1553 bt_dev_dbg(hdev, "enable %d", enable); 1554 1555 /* Read the Intel supported features and if new exception formats 1556 * supported, need to load the additional DDC config to enable. 1557 */ 1558 err = btintel_read_debug_features(hdev, &features); 1559 if (err) 1560 return err; 1561 1562 /* Set or reset the debug features. */ 1563 if (enable) 1564 err = btintel_set_debug_features(hdev, &features); 1565 else 1566 err = btintel_reset_debug_features(hdev, &features); 1567 1568 return err; 1569 } 1570 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1571 1572 static void btintel_coredump(struct hci_dev *hdev) 1573 { 1574 struct sk_buff *skb; 1575 1576 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1577 if (IS_ERR(skb)) { 1578 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1579 return; 1580 } 1581 1582 kfree_skb(skb); 1583 } 1584 1585 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1586 { 1587 char buf[80]; 1588 1589 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1590 coredump_info.hw_variant); 1591 skb_put_data(skb, buf, strlen(buf)); 1592 1593 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1594 coredump_info.fw_build_num); 1595 skb_put_data(skb, buf, strlen(buf)); 1596 1597 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1598 skb_put_data(skb, buf, strlen(buf)); 1599 1600 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1601 skb_put_data(skb, buf, strlen(buf)); 1602 } 1603 1604 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1605 { 1606 struct intel_debug_features features; 1607 int err; 1608 1609 err = btintel_read_debug_features(hdev, &features); 1610 if (err) { 1611 bt_dev_info(hdev, "Error reading debug features"); 1612 return err; 1613 } 1614 1615 if (!(features.page1[0] & 0x3f)) { 1616 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1617 return -EOPNOTSUPP; 1618 } 1619 1620 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1621 1622 return err; 1623 } 1624 1625 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1626 struct intel_version *ver) 1627 { 1628 const struct firmware *fw; 1629 char fwname[64]; 1630 int ret; 1631 1632 snprintf(fwname, sizeof(fwname), 1633 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1634 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1635 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1636 ver->fw_build_ww, ver->fw_build_yy); 1637 1638 ret = request_firmware(&fw, fwname, &hdev->dev); 1639 if (ret < 0) { 1640 if (ret == -EINVAL) { 1641 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1642 ret); 1643 return NULL; 1644 } 1645 1646 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1647 fwname, ret); 1648 1649 /* If the correct firmware patch file is not found, use the 1650 * default firmware patch file instead 1651 */ 1652 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1653 ver->hw_platform, ver->hw_variant); 1654 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1655 bt_dev_err(hdev, "failed to open default fw file: %s", 1656 fwname); 1657 return NULL; 1658 } 1659 } 1660 1661 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1662 1663 return fw; 1664 } 1665 1666 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1667 const struct firmware *fw, 1668 const u8 **fw_ptr, int *disable_patch) 1669 { 1670 struct sk_buff *skb; 1671 struct hci_command_hdr *cmd; 1672 const u8 *cmd_param; 1673 struct hci_event_hdr *evt = NULL; 1674 const u8 *evt_param = NULL; 1675 int remain = fw->size - (*fw_ptr - fw->data); 1676 1677 /* The first byte indicates the types of the patch command or event. 1678 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1679 * in the current firmware buffer doesn't start with 0x01 or 1680 * the size of remain buffer is smaller than HCI command header, 1681 * the firmware file is corrupted and it should stop the patching 1682 * process. 1683 */ 1684 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1685 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1686 return -EINVAL; 1687 } 1688 (*fw_ptr)++; 1689 remain--; 1690 1691 cmd = (struct hci_command_hdr *)(*fw_ptr); 1692 *fw_ptr += sizeof(*cmd); 1693 remain -= sizeof(*cmd); 1694 1695 /* Ensure that the remain firmware data is long enough than the length 1696 * of command parameter. If not, the firmware file is corrupted. 1697 */ 1698 if (remain < cmd->plen) { 1699 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1700 return -EFAULT; 1701 } 1702 1703 /* If there is a command that loads a patch in the firmware 1704 * file, then enable the patch upon success, otherwise just 1705 * disable the manufacturer mode, for example patch activation 1706 * is not required when the default firmware patch file is used 1707 * because there are no patch data to load. 1708 */ 1709 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1710 *disable_patch = 0; 1711 1712 cmd_param = *fw_ptr; 1713 *fw_ptr += cmd->plen; 1714 remain -= cmd->plen; 1715 1716 /* This reads the expected events when the above command is sent to the 1717 * device. Some vendor commands expects more than one events, for 1718 * example command status event followed by vendor specific event. 1719 * For this case, it only keeps the last expected event. so the command 1720 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1721 * last expected event. 1722 */ 1723 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1724 (*fw_ptr)++; 1725 remain--; 1726 1727 evt = (struct hci_event_hdr *)(*fw_ptr); 1728 *fw_ptr += sizeof(*evt); 1729 remain -= sizeof(*evt); 1730 1731 if (remain < evt->plen) { 1732 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1733 return -EFAULT; 1734 } 1735 1736 evt_param = *fw_ptr; 1737 *fw_ptr += evt->plen; 1738 remain -= evt->plen; 1739 } 1740 1741 /* Every HCI commands in the firmware file has its correspond event. 1742 * If event is not found or remain is smaller than zero, the firmware 1743 * file is corrupted. 1744 */ 1745 if (!evt || !evt_param || remain < 0) { 1746 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1747 return -EFAULT; 1748 } 1749 1750 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1751 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1752 if (IS_ERR(skb)) { 1753 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1754 cmd->opcode, PTR_ERR(skb)); 1755 return PTR_ERR(skb); 1756 } 1757 1758 /* It ensures that the returned event matches the event data read from 1759 * the firmware file. At fist, it checks the length and then 1760 * the contents of the event. 1761 */ 1762 if (skb->len != evt->plen) { 1763 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1764 le16_to_cpu(cmd->opcode)); 1765 kfree_skb(skb); 1766 return -EFAULT; 1767 } 1768 1769 if (memcmp(skb->data, evt_param, evt->plen)) { 1770 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1771 le16_to_cpu(cmd->opcode)); 1772 kfree_skb(skb); 1773 return -EFAULT; 1774 } 1775 kfree_skb(skb); 1776 1777 return 0; 1778 } 1779 1780 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1781 struct intel_version *ver) 1782 { 1783 const struct firmware *fw; 1784 const u8 *fw_ptr; 1785 int disable_patch, err; 1786 struct intel_version new_ver; 1787 1788 BT_DBG("%s", hdev->name); 1789 1790 /* fw_patch_num indicates the version of patch the device currently 1791 * have. If there is no patch data in the device, it is always 0x00. 1792 * So, if it is other than 0x00, no need to patch the device again. 1793 */ 1794 if (ver->fw_patch_num) { 1795 bt_dev_info(hdev, 1796 "Intel device is already patched. patch num: %02x", 1797 ver->fw_patch_num); 1798 goto complete; 1799 } 1800 1801 /* Opens the firmware patch file based on the firmware version read 1802 * from the controller. If it fails to open the matching firmware 1803 * patch file, it tries to open the default firmware patch file. 1804 * If no patch file is found, allow the device to operate without 1805 * a patch. 1806 */ 1807 fw = btintel_legacy_rom_get_fw(hdev, ver); 1808 if (!fw) 1809 goto complete; 1810 fw_ptr = fw->data; 1811 1812 /* Enable the manufacturer mode of the controller. 1813 * Only while this mode is enabled, the driver can download the 1814 * firmware patch data and configuration parameters. 1815 */ 1816 err = btintel_enter_mfg(hdev); 1817 if (err) { 1818 release_firmware(fw); 1819 return err; 1820 } 1821 1822 disable_patch = 1; 1823 1824 /* The firmware data file consists of list of Intel specific HCI 1825 * commands and its expected events. The first byte indicates the 1826 * type of the message, either HCI command or HCI event. 1827 * 1828 * It reads the command and its expected event from the firmware file, 1829 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1830 * the returned event is compared with the event read from the firmware 1831 * file and it will continue until all the messages are downloaded to 1832 * the controller. 1833 * 1834 * Once the firmware patching is completed successfully, 1835 * the manufacturer mode is disabled with reset and activating the 1836 * downloaded patch. 1837 * 1838 * If the firmware patching fails, the manufacturer mode is 1839 * disabled with reset and deactivating the patch. 1840 * 1841 * If the default patch file is used, no reset is done when disabling 1842 * the manufacturer. 1843 */ 1844 while (fw->size > fw_ptr - fw->data) { 1845 int ret; 1846 1847 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1848 &disable_patch); 1849 if (ret < 0) 1850 goto exit_mfg_deactivate; 1851 } 1852 1853 release_firmware(fw); 1854 1855 if (disable_patch) 1856 goto exit_mfg_disable; 1857 1858 /* Patching completed successfully and disable the manufacturer mode 1859 * with reset and activate the downloaded firmware patches. 1860 */ 1861 err = btintel_exit_mfg(hdev, true, true); 1862 if (err) 1863 return err; 1864 1865 /* Need build number for downloaded fw patches in 1866 * every power-on boot 1867 */ 1868 err = btintel_read_version(hdev, &new_ver); 1869 if (err) 1870 return err; 1871 1872 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1873 new_ver.fw_patch_num); 1874 1875 goto complete; 1876 1877 exit_mfg_disable: 1878 /* Disable the manufacturer mode without reset */ 1879 err = btintel_exit_mfg(hdev, false, false); 1880 if (err) 1881 return err; 1882 1883 bt_dev_info(hdev, "Intel firmware patch completed"); 1884 1885 goto complete; 1886 1887 exit_mfg_deactivate: 1888 release_firmware(fw); 1889 1890 /* Patching failed. Disable the manufacturer mode with reset and 1891 * deactivate the downloaded firmware patches. 1892 */ 1893 err = btintel_exit_mfg(hdev, true, false); 1894 if (err) 1895 return err; 1896 1897 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1898 1899 complete: 1900 /* Set the event mask for Intel specific vendor events. This enables 1901 * a few extra events that are useful during general operation. 1902 */ 1903 btintel_set_event_mask_mfg(hdev, false); 1904 1905 btintel_check_bdaddr(hdev); 1906 1907 return 0; 1908 } 1909 1910 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1911 { 1912 ktime_t delta, rettime; 1913 unsigned long long duration; 1914 int err; 1915 1916 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1917 1918 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1919 1920 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1921 TASK_INTERRUPTIBLE, 1922 msecs_to_jiffies(msec)); 1923 if (err == -EINTR) { 1924 bt_dev_err(hdev, "Firmware loading interrupted"); 1925 return err; 1926 } 1927 1928 if (err) { 1929 bt_dev_err(hdev, "Firmware loading timeout"); 1930 return -ETIMEDOUT; 1931 } 1932 1933 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1934 bt_dev_err(hdev, "Firmware loading failed"); 1935 return -ENOEXEC; 1936 } 1937 1938 rettime = ktime_get(); 1939 delta = ktime_sub(rettime, calltime); 1940 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1941 1942 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1943 1944 return 0; 1945 } 1946 1947 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1948 { 1949 ktime_t delta, rettime; 1950 unsigned long long duration; 1951 int err; 1952 1953 bt_dev_info(hdev, "Waiting for device to boot"); 1954 1955 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1956 TASK_INTERRUPTIBLE, 1957 msecs_to_jiffies(msec)); 1958 if (err == -EINTR) { 1959 bt_dev_err(hdev, "Device boot interrupted"); 1960 return -EINTR; 1961 } 1962 1963 if (err) { 1964 bt_dev_err(hdev, "Device boot timeout"); 1965 return -ETIMEDOUT; 1966 } 1967 1968 rettime = ktime_get(); 1969 delta = ktime_sub(rettime, calltime); 1970 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1971 1972 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1973 1974 return 0; 1975 } 1976 1977 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1978 int msec) 1979 { 1980 ktime_t delta, rettime; 1981 unsigned long long duration; 1982 int err; 1983 1984 bt_dev_info(hdev, "Waiting for device transition to d0"); 1985 1986 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1987 TASK_INTERRUPTIBLE, 1988 msecs_to_jiffies(msec)); 1989 if (err == -EINTR) { 1990 bt_dev_err(hdev, "Device d0 move interrupted"); 1991 return -EINTR; 1992 } 1993 1994 if (err) { 1995 bt_dev_err(hdev, "Device d0 move timeout"); 1996 return -ETIMEDOUT; 1997 } 1998 1999 rettime = ktime_get(); 2000 delta = ktime_sub(rettime, calltime); 2001 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 2002 2003 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 2004 2005 return 0; 2006 } 2007 2008 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 2009 { 2010 ktime_t calltime; 2011 int err; 2012 2013 calltime = ktime_get(); 2014 2015 btintel_set_flag(hdev, INTEL_BOOTING); 2016 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 2017 2018 err = btintel_send_intel_reset(hdev, boot_addr); 2019 if (err) { 2020 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 2021 btintel_reset_to_bootloader(hdev); 2022 return err; 2023 } 2024 2025 /* The bootloader will not indicate when the device is ready. This 2026 * is done by the operational firmware sending bootup notification. 2027 * 2028 * Booting into operational firmware should not take longer than 2029 * 5 second. However if that happens, then just fail the setup 2030 * since something went wrong. 2031 */ 2032 err = btintel_boot_wait(hdev, calltime, 5000); 2033 if (err == -ETIMEDOUT) { 2034 btintel_reset_to_bootloader(hdev); 2035 goto exit_error; 2036 } 2037 2038 if (hdev->bus == HCI_PCI) { 2039 /* In case of PCIe, after receiving bootup event, driver performs 2040 * D0 entry by writing 0 to sleep control register (check 2041 * btintel_pcie_recv_event()) 2042 * Firmware acks with alive interrupt indicating host is full ready to 2043 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 2044 * bit is cleared. 2045 */ 2046 calltime = ktime_get(); 2047 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2048 } 2049 2050 exit_error: 2051 return err; 2052 } 2053 2054 static int btintel_get_fw_name(struct intel_version *ver, 2055 struct intel_boot_params *params, 2056 char *fw_name, size_t len, 2057 const char *suffix) 2058 { 2059 switch (ver->hw_variant) { 2060 case 0x0b: /* SfP */ 2061 case 0x0c: /* WsP */ 2062 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2063 ver->hw_variant, 2064 le16_to_cpu(params->dev_revid), 2065 suffix); 2066 break; 2067 case 0x11: /* JfP */ 2068 case 0x12: /* ThP */ 2069 case 0x13: /* HrP */ 2070 case 0x14: /* CcP */ 2071 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2072 ver->hw_variant, 2073 ver->hw_revision, 2074 ver->fw_revision, 2075 suffix); 2076 break; 2077 default: 2078 return -EINVAL; 2079 } 2080 2081 return 0; 2082 } 2083 2084 static int btintel_download_fw(struct hci_dev *hdev, 2085 struct intel_version *ver, 2086 struct intel_boot_params *params, 2087 u32 *boot_param) 2088 { 2089 const struct firmware *fw; 2090 char fwname[64]; 2091 int err; 2092 ktime_t calltime; 2093 2094 if (!ver || !params) 2095 return -EINVAL; 2096 2097 /* The firmware variant determines if the device is in bootloader 2098 * mode or is running operational firmware. The value 0x06 identifies 2099 * the bootloader and the value 0x23 identifies the operational 2100 * firmware. 2101 * 2102 * When the operational firmware is already present, then only 2103 * the check for valid Bluetooth device address is needed. This 2104 * determines if the device will be added as configured or 2105 * unconfigured controller. 2106 * 2107 * It is not possible to use the Secure Boot Parameters in this 2108 * case since that command is only available in bootloader mode. 2109 */ 2110 if (ver->fw_variant == 0x23) { 2111 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2112 btintel_check_bdaddr(hdev); 2113 2114 /* SfP and WsP don't seem to update the firmware version on file 2115 * so version checking is currently possible. 2116 */ 2117 switch (ver->hw_variant) { 2118 case 0x0b: /* SfP */ 2119 case 0x0c: /* WsP */ 2120 return 0; 2121 } 2122 2123 /* Proceed to download to check if the version matches */ 2124 goto download; 2125 } 2126 2127 /* Read the secure boot parameters to identify the operating 2128 * details of the bootloader. 2129 */ 2130 err = btintel_read_boot_params(hdev, params); 2131 if (err) 2132 return err; 2133 2134 /* It is required that every single firmware fragment is acknowledged 2135 * with a command complete event. If the boot parameters indicate 2136 * that this bootloader does not send them, then abort the setup. 2137 */ 2138 if (params->limited_cce != 0x00) { 2139 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2140 params->limited_cce); 2141 return -EINVAL; 2142 } 2143 2144 /* If the OTP has no valid Bluetooth device address, then there will 2145 * also be no valid address for the operational firmware. 2146 */ 2147 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2148 bt_dev_info(hdev, "No device address configured"); 2149 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2150 } 2151 2152 download: 2153 /* With this Intel bootloader only the hardware variant and device 2154 * revision information are used to select the right firmware for SfP 2155 * and WsP. 2156 * 2157 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2158 * 2159 * Currently the supported hardware variants are: 2160 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2161 * 12 (0x0c) for iBT3.5 (WsP) 2162 * 2163 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2164 * variant, HW revision and FW revision, as these are dependent on CNVi 2165 * and RF Combination. 2166 * 2167 * 17 (0x11) for iBT3.5 (JfP) 2168 * 18 (0x12) for iBT3.5 (ThP) 2169 * 2170 * The firmware file name for these will be 2171 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2172 * 2173 */ 2174 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2175 if (err < 0) { 2176 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2177 /* Firmware has already been loaded */ 2178 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2179 return 0; 2180 } 2181 2182 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2183 return -EINVAL; 2184 } 2185 2186 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2187 if (err < 0) { 2188 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2189 /* Firmware has already been loaded */ 2190 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2191 return 0; 2192 } 2193 2194 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2195 fwname, err); 2196 return err; 2197 } 2198 2199 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2200 2201 if (fw->size < 644) { 2202 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2203 fw->size); 2204 err = -EBADF; 2205 goto done; 2206 } 2207 2208 calltime = ktime_get(); 2209 2210 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2211 2212 /* Start firmware downloading and get boot parameter */ 2213 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2214 if (err < 0) { 2215 if (err == -EALREADY) { 2216 /* Firmware has already been loaded */ 2217 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2218 err = 0; 2219 goto done; 2220 } 2221 2222 /* When FW download fails, send Intel Reset to retry 2223 * FW download. 2224 */ 2225 btintel_reset_to_bootloader(hdev); 2226 goto done; 2227 } 2228 2229 /* Before switching the device into operational mode and with that 2230 * booting the loaded firmware, wait for the bootloader notification 2231 * that all fragments have been successfully received. 2232 * 2233 * When the event processing receives the notification, then the 2234 * INTEL_DOWNLOADING flag will be cleared. 2235 * 2236 * The firmware loading should not take longer than 5 seconds 2237 * and thus just timeout if that happens and fail the setup 2238 * of this device. 2239 */ 2240 err = btintel_download_wait(hdev, calltime, 5000); 2241 if (err == -ETIMEDOUT) 2242 btintel_reset_to_bootloader(hdev); 2243 2244 done: 2245 release_firmware(fw); 2246 return err; 2247 } 2248 2249 static int btintel_bootloader_setup(struct hci_dev *hdev, 2250 struct intel_version *ver) 2251 { 2252 struct intel_version new_ver; 2253 struct intel_boot_params params; 2254 u32 boot_param; 2255 char ddcname[64]; 2256 int err; 2257 2258 BT_DBG("%s", hdev->name); 2259 2260 /* Set the default boot parameter to 0x0 and it is updated to 2261 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2262 * command while downloading the firmware. 2263 */ 2264 boot_param = 0x00000000; 2265 2266 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2267 2268 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2269 if (err) 2270 return err; 2271 2272 /* controller is already having an operational firmware */ 2273 if (ver->fw_variant == 0x23) 2274 goto finish; 2275 2276 err = btintel_boot(hdev, boot_param); 2277 if (err) 2278 return err; 2279 2280 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2281 2282 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2283 sizeof(ddcname), "ddc"); 2284 2285 if (err < 0) { 2286 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2287 } else { 2288 /* Once the device is running in operational mode, it needs to 2289 * apply the device configuration (DDC) parameters. 2290 * 2291 * The device can work without DDC parameters, so even if it 2292 * fails to load the file, no need to fail the setup. 2293 */ 2294 btintel_load_ddc_config(hdev, ddcname); 2295 } 2296 2297 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2298 2299 /* Read the Intel version information after loading the FW */ 2300 err = btintel_read_version(hdev, &new_ver); 2301 if (err) 2302 return err; 2303 2304 btintel_version_info(hdev, &new_ver); 2305 2306 finish: 2307 /* Set the event mask for Intel specific vendor events. This enables 2308 * a few extra events that are useful during general operation. It 2309 * does not enable any debugging related events. 2310 * 2311 * The device will function correctly without these events enabled 2312 * and thus no need to fail the setup. 2313 */ 2314 btintel_set_event_mask(hdev, false); 2315 2316 return 0; 2317 } 2318 2319 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2320 char *fw_name, size_t len, 2321 const char *suffix) 2322 { 2323 const char *format; 2324 u32 cnvi, cnvr; 2325 2326 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2327 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2328 2329 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2330 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2331 2332 /* Only Blazar product supports downloading of intermediate loader 2333 * image 2334 */ 2335 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2336 u8 zero[BTINTEL_FWID_MAXLEN]; 2337 2338 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2339 format = "intel/ibt-%04x-%04x-iml.%s"; 2340 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2341 return; 2342 } 2343 2344 memset(zero, 0, sizeof(zero)); 2345 2346 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2347 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2348 format = "intel/ibt-%04x-%04x-%s.%s"; 2349 snprintf(fw_name, len, format, cnvi, cnvr, 2350 ver->fw_id, suffix); 2351 return; 2352 } 2353 /* If firmware id is not present, fallback to legacy naming 2354 * convention 2355 */ 2356 } 2357 /* Fallback to legacy naming convention for other controllers 2358 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2359 */ 2360 format = "intel/ibt-%04x-%04x.%s"; 2361 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2362 } 2363 2364 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2365 char *fw_name, size_t len, 2366 const char *suffix) 2367 { 2368 const char *format; 2369 u32 cnvi, cnvr; 2370 2371 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2372 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2373 2374 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2375 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2376 2377 format = "intel/ibt-%04x-%04x-iml.%s"; 2378 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2379 } 2380 2381 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2382 struct intel_version_tlv *ver, 2383 u32 *boot_param) 2384 { 2385 const struct firmware *fw; 2386 char fwname[128]; 2387 int err; 2388 ktime_t calltime; 2389 2390 if (!ver || !boot_param) 2391 return -EINVAL; 2392 2393 /* The firmware variant determines if the device is in bootloader 2394 * mode or is running operational firmware. The value 0x03 identifies 2395 * the bootloader and the value 0x23 identifies the operational 2396 * firmware. 2397 * 2398 * When the operational firmware is already present, then only 2399 * the check for valid Bluetooth device address is needed. This 2400 * determines if the device will be added as configured or 2401 * unconfigured controller. 2402 * 2403 * It is not possible to use the Secure Boot Parameters in this 2404 * case since that command is only available in bootloader mode. 2405 */ 2406 if (ver->img_type == BTINTEL_IMG_OP) { 2407 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2408 btintel_check_bdaddr(hdev); 2409 } else { 2410 /* 2411 * Check for valid bd address in boot loader mode. Device 2412 * will be marked as unconfigured if empty bd address is 2413 * found. 2414 */ 2415 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2416 bt_dev_info(hdev, "No device address configured"); 2417 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2418 } 2419 } 2420 2421 if (ver->img_type == BTINTEL_IMG_OP) { 2422 /* Controller running OP image. In case of FW downgrade, 2423 * FWID TLV may not be present and driver may attempt to load 2424 * firmware image which doesn't exist. Lets compare the version 2425 * of IML image 2426 */ 2427 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2428 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2429 else 2430 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2431 } else { 2432 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2433 } 2434 2435 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2436 if (err < 0) { 2437 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2438 /* Firmware has already been loaded */ 2439 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2440 return 0; 2441 } 2442 2443 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2444 fwname, err); 2445 2446 return err; 2447 } 2448 2449 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2450 2451 if (fw->size < 644) { 2452 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2453 fw->size); 2454 err = -EBADF; 2455 goto done; 2456 } 2457 2458 calltime = ktime_get(); 2459 2460 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2461 2462 /* Start firmware downloading and get boot parameter */ 2463 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2464 INTEL_HW_VARIANT(ver->cnvi_bt), 2465 ver->sbe_type); 2466 if (err < 0) { 2467 if (err == -EALREADY) { 2468 /* Firmware has already been loaded */ 2469 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2470 err = 0; 2471 goto done; 2472 } 2473 2474 /* When FW download fails, send Intel Reset to retry 2475 * FW download. 2476 */ 2477 btintel_reset_to_bootloader(hdev); 2478 goto done; 2479 } 2480 2481 /* Before switching the device into operational mode and with that 2482 * booting the loaded firmware, wait for the bootloader notification 2483 * that all fragments have been successfully received. 2484 * 2485 * When the event processing receives the notification, then the 2486 * BTUSB_DOWNLOADING flag will be cleared. 2487 * 2488 * The firmware loading should not take longer than 5 seconds 2489 * and thus just timeout if that happens and fail the setup 2490 * of this device. 2491 */ 2492 err = btintel_download_wait(hdev, calltime, 5000); 2493 if (err == -ETIMEDOUT) 2494 btintel_reset_to_bootloader(hdev); 2495 2496 done: 2497 release_firmware(fw); 2498 return err; 2499 } 2500 2501 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2502 __u8 link, struct bt_codec *codec, 2503 __u8 *ven_len, __u8 **ven_data) 2504 { 2505 int err = 0; 2506 2507 if (!ven_data || !ven_len) 2508 return -EINVAL; 2509 2510 *ven_len = 0; 2511 *ven_data = NULL; 2512 2513 if (link != ESCO_LINK) { 2514 bt_dev_err(hdev, "Invalid link type(%u)", link); 2515 return -EINVAL; 2516 } 2517 2518 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2519 if (!*ven_data) { 2520 err = -ENOMEM; 2521 goto error; 2522 } 2523 2524 /* supports only CVSD and mSBC offload codecs */ 2525 switch (codec->id) { 2526 case 0x02: 2527 **ven_data = 0x00; 2528 break; 2529 case 0x05: 2530 **ven_data = 0x01; 2531 break; 2532 default: 2533 err = -EINVAL; 2534 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2535 goto error; 2536 } 2537 /* codec and its capabilities are pre-defined to ids 2538 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2539 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2540 */ 2541 *ven_len = sizeof(__u8); 2542 return err; 2543 2544 error: 2545 kfree(*ven_data); 2546 *ven_data = NULL; 2547 return err; 2548 } 2549 2550 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2551 { 2552 /* Intel uses 1 as data path id for all the usecases */ 2553 *data_path_id = 1; 2554 return 0; 2555 } 2556 2557 static int btintel_configure_offload(struct hci_dev *hdev) 2558 { 2559 struct sk_buff *skb; 2560 int err = 0; 2561 struct intel_offload_use_cases *use_cases; 2562 2563 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2564 if (IS_ERR(skb)) { 2565 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2566 PTR_ERR(skb)); 2567 return PTR_ERR(skb); 2568 } 2569 2570 if (skb->len < sizeof(*use_cases)) { 2571 err = -EIO; 2572 goto error; 2573 } 2574 2575 use_cases = (void *)skb->data; 2576 2577 if (use_cases->status) { 2578 err = -bt_to_errno(skb->data[0]); 2579 goto error; 2580 } 2581 2582 if (use_cases->preset[0] & 0x03) { 2583 hdev->get_data_path_id = btintel_get_data_path_id; 2584 hdev->get_codec_config_data = btintel_get_codec_config_data; 2585 } 2586 error: 2587 kfree_skb(skb); 2588 return err; 2589 } 2590 2591 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2592 { 2593 struct sk_buff *skb; 2594 struct hci_ppag_enable_cmd ppag_cmd; 2595 acpi_handle handle; 2596 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2597 union acpi_object *p, *elements; 2598 u32 domain, mode; 2599 acpi_status status; 2600 2601 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2602 switch (ver->cnvr_top & 0xFFF) { 2603 case 0x504: /* Hrp2 */ 2604 case 0x202: /* Jfp2 */ 2605 case 0x201: /* Jfp1 */ 2606 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2607 ver->cnvr_top & 0xFFF); 2608 return; 2609 } 2610 2611 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2612 if (!handle) { 2613 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2614 return; 2615 } 2616 2617 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2618 if (ACPI_FAILURE(status)) { 2619 if (status == AE_NOT_FOUND) { 2620 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2621 return; 2622 } 2623 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2624 return; 2625 } 2626 2627 p = buffer.pointer; 2628 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2629 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2630 p->type, p->package.count); 2631 kfree(buffer.pointer); 2632 return; 2633 } 2634 2635 elements = p->package.elements; 2636 2637 /* PPAG table is located at element[1] */ 2638 p = &elements[1]; 2639 2640 domain = (u32)p->package.elements[0].integer.value; 2641 mode = (u32)p->package.elements[1].integer.value; 2642 kfree(buffer.pointer); 2643 2644 if (domain != 0x12) { 2645 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2646 return; 2647 } 2648 2649 /* PPAG mode 2650 * BIT 0 : 0 Disabled in EU 2651 * 1 Enabled in EU 2652 * BIT 1 : 0 Disabled in China 2653 * 1 Enabled in China 2654 */ 2655 mode &= 0x03; 2656 2657 if (!mode) { 2658 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2659 return; 2660 } 2661 2662 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2663 2664 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2665 &ppag_cmd, HCI_CMD_TIMEOUT); 2666 if (IS_ERR(skb)) { 2667 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2668 return; 2669 } 2670 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2671 kfree_skb(skb); 2672 } 2673 2674 int btintel_acpi_reset_method(struct hci_dev *hdev) 2675 { 2676 int ret = 0; 2677 acpi_status status; 2678 union acpi_object *p, *ref; 2679 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2680 2681 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2682 if (ACPI_FAILURE(status) || !buffer.pointer) { 2683 bt_dev_err(hdev, "Failed to run _PRR method"); 2684 ret = -ENODEV; 2685 return ret; 2686 } 2687 p = buffer.pointer; 2688 2689 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) { 2690 bt_dev_err(hdev, "Invalid arguments"); 2691 ret = -EINVAL; 2692 goto exit_on_error; 2693 } 2694 2695 ref = &p->package.elements[0]; 2696 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2697 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2698 ret = -EINVAL; 2699 goto exit_on_error; 2700 } 2701 2702 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2703 if (ACPI_FAILURE(status)) { 2704 bt_dev_err(hdev, "Failed to run_RST method"); 2705 ret = -ENODEV; 2706 goto exit_on_error; 2707 } 2708 2709 exit_on_error: 2710 kfree(buffer.pointer); 2711 return ret; 2712 } 2713 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method); 2714 2715 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2716 struct intel_version_tlv *ver_tlv) 2717 { 2718 struct btintel_data *data = hci_get_priv(hdev); 2719 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2720 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2721 union acpi_object *obj, argv4; 2722 enum { 2723 RESET_TYPE_WDISABLE2, 2724 RESET_TYPE_VSEC 2725 }; 2726 2727 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2728 2729 if (!handle) { 2730 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2731 return; 2732 } 2733 2734 if (!acpi_has_method(handle, "_PRR")) { 2735 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2736 return; 2737 } 2738 2739 switch (ver_tlv->cnvi_top & 0xfff) { 2740 case 0x910: /* GalePeak2 */ 2741 reset_payload[2] = RESET_TYPE_VSEC; 2742 break; 2743 default: 2744 /* WDISABLE2 is the default reset method */ 2745 reset_payload[2] = RESET_TYPE_WDISABLE2; 2746 2747 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2748 BIT(DSM_SET_WDISABLE2_DELAY))) { 2749 bt_dev_err(hdev, "No dsm support to set reset delay"); 2750 return; 2751 } 2752 argv4.integer.type = ACPI_TYPE_INTEGER; 2753 /* delay required to toggle BT power */ 2754 argv4.integer.value = 160; 2755 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2756 DSM_SET_WDISABLE2_DELAY, &argv4); 2757 if (!obj) { 2758 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2759 return; 2760 } 2761 ACPI_FREE(obj); 2762 } 2763 2764 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2765 2766 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2767 DSM_SET_RESET_METHOD)) { 2768 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2769 return; 2770 } 2771 argv4.buffer.type = ACPI_TYPE_BUFFER; 2772 argv4.buffer.length = sizeof(reset_payload); 2773 argv4.buffer.pointer = reset_payload; 2774 2775 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2776 DSM_SET_RESET_METHOD, &argv4); 2777 if (!obj) { 2778 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2779 return; 2780 } 2781 ACPI_FREE(obj); 2782 data->acpi_reset_method = btintel_acpi_reset_method; 2783 } 2784 2785 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2786 2787 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2788 { 2789 /* 2790 * Distinguish ISO data packets form ACL data packets 2791 * based on their connection handle value range. 2792 */ 2793 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2794 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE) 2795 return HCI_ISODATA_PKT; 2796 } 2797 2798 return hci_skb_pkt_type(skb); 2799 } 2800 2801 /* 2802 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2803 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2804 * overcome the potential STEP errors on their designs. Based on the 2805 * configauration, bluetooth firmware shall adjust the BRI response line drive 2806 * strength. The below structure represents DSBR data. 2807 * struct { 2808 * u8 header; 2809 * u32 dsbr; 2810 * } __packed; 2811 * 2812 * header - defines revision number of the structure 2813 * dsbr - defines drive strength BRI response 2814 * bit0 2815 * 0 - instructs bluetooth firmware to use default values 2816 * 1 - instructs bluetooth firmware to override default values 2817 * bit3:1 2818 * Reserved 2819 * bit7:4 2820 * DSBR override values (only if bit0 is set. Default value is 0xF 2821 * bit31:7 2822 * Reserved 2823 * Expected values for dsbr field: 2824 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2825 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2826 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2827 * that the resistor on board is 10 Ohm 2828 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2829 * firmware to use default values. 2830 * 2831 */ 2832 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2833 { 2834 struct btintel_dsbr { 2835 u8 header; 2836 u32 dsbr; 2837 } __packed data; 2838 2839 efi_status_t status; 2840 unsigned long data_size = sizeof(data); 2841 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2842 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2843 2844 if (!IS_ENABLED(CONFIG_EFI)) 2845 return -EOPNOTSUPP; 2846 2847 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2848 return -EOPNOTSUPP; 2849 2850 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2851 &data); 2852 2853 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2854 return -ENXIO; 2855 2856 *dsbr_var = data.dsbr; 2857 return 0; 2858 } 2859 2860 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2861 { 2862 struct btintel_dsbr_cmd { 2863 u8 enable; 2864 u8 dsbr; 2865 } __packed; 2866 2867 struct btintel_dsbr_cmd cmd; 2868 struct sk_buff *skb; 2869 u32 dsbr; 2870 u8 status, hw_variant; 2871 int err; 2872 2873 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2874 /* DSBR command needs to be sent for, 2875 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2876 * 2. Gale Peak2 or BlazarU in OP image. 2877 * 3. Scorpious Peak in IML image. 2878 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2879 */ 2880 2881 switch (hw_variant) { 2882 case BTINTEL_HWID_BZRI: 2883 case BTINTEL_HWID_BZRIW: 2884 if (ver->img_type == BTINTEL_IMG_IML && 2885 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2886 break; 2887 return 0; 2888 case BTINTEL_HWID_GAP: 2889 case BTINTEL_HWID_BZRU: 2890 if (ver->img_type == BTINTEL_IMG_OP && 2891 hdev->bus == HCI_USB) 2892 break; 2893 return 0; 2894 case BTINTEL_HWID_SCP: 2895 if (ver->img_type == BTINTEL_IMG_IML) 2896 break; 2897 return 0; 2898 default: 2899 /* Scorpius Peak2 onwards */ 2900 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2901 && ver->img_type == BTINTEL_IMG_IML) 2902 break; 2903 return 0; 2904 } 2905 2906 dsbr = 0; 2907 err = btintel_uefi_get_dsbr(&dsbr); 2908 if (err < 0) 2909 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2910 BTINTEL_EFI_DSBR, err); 2911 2912 cmd.enable = dsbr & BIT(0); 2913 cmd.dsbr = dsbr >> 4 & 0xF; 2914 2915 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2916 cmd.dsbr); 2917 2918 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2919 if (IS_ERR(skb)) 2920 return -bt_to_errno(PTR_ERR(skb)); 2921 2922 status = skb->data[0]; 2923 kfree_skb(skb); 2924 2925 if (status) 2926 return -bt_to_errno(status); 2927 2928 return 0; 2929 } 2930 2931 #ifdef CONFIG_ACPI 2932 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2933 acpi_string method, 2934 union acpi_object **ptr, 2935 u8 pkg_size) 2936 { 2937 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2938 union acpi_object *p; 2939 acpi_status status; 2940 acpi_handle handle; 2941 2942 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2943 if (!handle) { 2944 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2945 return AE_NOT_EXIST; 2946 } 2947 2948 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2949 2950 if (ACPI_FAILURE(status)) { 2951 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2952 acpi_format_exception(status), method); 2953 return status; 2954 } 2955 2956 p = buffer.pointer; 2957 2958 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2959 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2960 p->type, p->package.count); 2961 kfree(buffer.pointer); 2962 return AE_ERROR; 2963 } 2964 2965 *ptr = buffer.pointer; 2966 return 0; 2967 } 2968 2969 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2970 { 2971 union acpi_object *domain, *bt_pkg; 2972 int i; 2973 2974 for (i = 1; i < buffer->package.count; i++) { 2975 bt_pkg = &buffer->package.elements[i]; 2976 domain = &bt_pkg->package.elements[0]; 2977 if (domain->type == ACPI_TYPE_INTEGER && 2978 domain->integer.value == BTINTEL_BT_DOMAIN) 2979 return bt_pkg; 2980 } 2981 return ERR_PTR(-ENOENT); 2982 } 2983 2984 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2985 { 2986 struct sk_buff *skb; 2987 2988 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2989 if (IS_ERR(skb)) { 2990 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2991 le16_to_cpu(data->id), PTR_ERR(skb)); 2992 return PTR_ERR(skb); 2993 } 2994 kfree_skb(skb); 2995 return 0; 2996 } 2997 2998 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2999 int id, struct btintel_sar_inc_pwr *sar) 3000 { 3001 cmd->len = 5; 3002 cmd->id = cpu_to_le16(id); 3003 cmd->data[0] = sar->br >> 3; 3004 cmd->data[1] = sar->edr2 >> 3; 3005 cmd->data[2] = sar->edr3 >> 3; 3006 return btintel_send_sar_ddc(hdev, cmd, 6); 3007 } 3008 3009 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3010 int id, struct btintel_sar_inc_pwr *sar) 3011 { 3012 cmd->len = 3; 3013 cmd->id = cpu_to_le16(id); 3014 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 3015 return btintel_send_sar_ddc(hdev, cmd, 4); 3016 } 3017 3018 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3019 int id, struct btintel_sar_inc_pwr *sar) 3020 { 3021 cmd->len = 3; 3022 cmd->id = cpu_to_le16(id); 3023 cmd->data[0] = sar->br >> 3; 3024 return btintel_send_sar_ddc(hdev, cmd, 4); 3025 } 3026 3027 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3028 int id, struct btintel_sar_inc_pwr *sar) 3029 { 3030 cmd->len = 3; 3031 cmd->id = cpu_to_le16(id); 3032 cmd->data[0] = sar->br; 3033 return btintel_send_sar_ddc(hdev, cmd, 4); 3034 } 3035 3036 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3037 int id, struct btintel_sar_inc_pwr *sar) 3038 { 3039 cmd->len = 3; 3040 cmd->id = cpu_to_le16(id); 3041 cmd->data[0] = sar->edr2; 3042 return btintel_send_sar_ddc(hdev, cmd, 4); 3043 } 3044 3045 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3046 int id, struct btintel_sar_inc_pwr *sar) 3047 { 3048 cmd->len = 3; 3049 cmd->id = cpu_to_le16(id); 3050 cmd->data[0] = sar->edr3; 3051 return btintel_send_sar_ddc(hdev, cmd, 4); 3052 } 3053 3054 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3055 { 3056 struct btintel_cp_ddc_write *cmd; 3057 u8 buffer[64]; 3058 int ret; 3059 3060 cmd = (void *)buffer; 3061 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3062 if (ret) 3063 return ret; 3064 3065 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3066 if (ret) 3067 return ret; 3068 3069 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3070 if (ret) 3071 return ret; 3072 3073 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3074 if (ret) 3075 return ret; 3076 3077 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3078 if (ret) 3079 return ret; 3080 3081 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3082 if (ret) 3083 return ret; 3084 3085 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3086 3087 return ret; 3088 } 3089 3090 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3091 { 3092 struct btintel_cp_ddc_write *cmd; 3093 struct sk_buff *skb; 3094 u8 buffer[64]; 3095 bool enable; 3096 int ret; 3097 3098 cmd = (void *)buffer; 3099 3100 cmd->len = 3; 3101 cmd->id = cpu_to_le16(0x019e); 3102 3103 if (sar->revision == BTINTEL_SAR_INC_PWR && 3104 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3105 cmd->data[0] = 0x01; 3106 else 3107 cmd->data[0] = 0x00; 3108 3109 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3110 if (ret) 3111 return ret; 3112 3113 if (sar->revision == BTINTEL_SAR_INC_PWR && 3114 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3115 cmd->len = 3; 3116 cmd->id = cpu_to_le16(0x019f); 3117 cmd->data[0] = sar->sar_2400_chain_a; 3118 3119 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3120 if (ret) 3121 return ret; 3122 } 3123 3124 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3125 if (ret) 3126 return ret; 3127 3128 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3129 if (ret) 3130 return ret; 3131 3132 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3133 if (ret) 3134 return ret; 3135 3136 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3137 if (ret) 3138 return ret; 3139 3140 enable = true; 3141 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3142 if (IS_ERR(skb)) { 3143 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3144 return PTR_ERR(skb); 3145 } 3146 3147 kfree_skb(skb); 3148 return 0; 3149 } 3150 3151 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band 3152 * 3153 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value]. 3154 * cmd->len = 4 (2 id + 2 data) 3155 * HCI total = 5 bytes (1 len + 4) 3156 */ 3157 static int btintel_send_sar_rev2_band(struct hci_dev *hdev, 3158 struct btintel_cp_ddc_write *cmd, 3159 u16 id, u8 chain_a, u8 chain_b) 3160 { 3161 cmd->len = 4; 3162 cmd->id = cpu_to_le16(id); 3163 cmd->data[0] = chain_a; 3164 cmd->data[1] = chain_b; 3165 return btintel_send_sar_ddc(hdev, cmd, 5); 3166 } 3167 3168 static int btintel_set_sar_rev2(struct hci_dev *hdev, 3169 struct btintel_sar_rev2 *sar) 3170 { 3171 struct btintel_cp_ddc_write *cmd; 3172 struct sk_buff *skb; 3173 u8 buffer[64]; 3174 u8 enable; 3175 int ret; 3176 3177 cmd = (void *)buffer; 3178 3179 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */ 3180 cmd->len = 3; 3181 cmd->id = cpu_to_le16(0x019e); 3182 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ? 3183 0x01 : 0x00; 3184 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3185 if (ret) 3186 return ret; 3187 3188 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */ 3189 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311, 3190 sar->chain_a.subband_2g4, 3191 sar->chain_b.subband_2g4); 3192 if (ret) 3193 return ret; 3194 3195 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312, 3196 sar->chain_a.subband_5g2, 3197 sar->chain_b.subband_5g2); 3198 if (ret) 3199 return ret; 3200 3201 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */ 3202 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313, 3203 sar->chain_a.subband_5g8_5g9, 3204 sar->chain_b.subband_5g8_5g9); 3205 if (ret) 3206 return ret; 3207 3208 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314, 3209 sar->chain_a.subband_5g8_5g9, 3210 sar->chain_b.subband_5g8_5g9); 3211 if (ret) 3212 return ret; 3213 3214 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315, 3215 sar->chain_a.subband_6g1, 3216 sar->chain_b.subband_6g1); 3217 if (ret) 3218 return ret; 3219 3220 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316, 3221 sar->chain_a.subband_6g3, 3222 sar->chain_b.subband_6g3); 3223 if (ret) 3224 return ret; 3225 3226 /* Notify firmware that SAR initialisation is complete */ 3227 enable = 0x01; 3228 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT); 3229 if (IS_ERR(skb)) { 3230 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)", 3231 PTR_ERR(skb)); 3232 return PTR_ERR(skb); 3233 } 3234 3235 kfree_skb(skb); 3236 return 0; 3237 } 3238 3239 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev, 3240 struct btintel_sar_rev2 *sar, 3241 struct intel_version_tlv *ver) 3242 { 3243 u16 cnvi = ver->cnvi_top & 0xfff; 3244 u16 cnvr = ver->cnvr_top & 0xfff; 3245 3246 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) { 3247 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)", 3248 cnvi, cnvr); 3249 return -EOPNOTSUPP; 3250 } 3251 3252 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2"); 3253 return btintel_set_sar_rev2(hdev, sar); 3254 } 3255 3256 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3257 struct intel_version_tlv *ver) 3258 { 3259 u16 cnvi, cnvr; 3260 int ret; 3261 3262 cnvi = ver->cnvi_top & 0xfff; 3263 cnvr = ver->cnvr_top & 0xfff; 3264 3265 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3266 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3267 ret = btintel_set_legacy_sar(hdev, sar); 3268 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3269 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3270 ret = btintel_set_mutual_sar(hdev, sar); 3271 } else { 3272 ret = -EOPNOTSUPP; 3273 } 3274 3275 return ret; 3276 } 3277 3278 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3279 { 3280 union acpi_object *bt_pkg, *buffer = NULL; 3281 struct btintel_sar_inc_pwr sar; 3282 struct btintel_sar_rev2 sar_rev2; 3283 acpi_status status; 3284 u8 revision; 3285 int ret; 3286 3287 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3288 if (ACPI_FAILURE(status)) 3289 return -ENOENT; 3290 3291 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3292 3293 if (IS_ERR(bt_pkg)) { 3294 ret = PTR_ERR(bt_pkg); 3295 goto error; 3296 } 3297 3298 if (!bt_pkg->package.count) { 3299 ret = -EINVAL; 3300 goto error; 3301 } 3302 3303 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) { 3304 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field"); 3305 ret = -EINVAL; 3306 goto error; 3307 } 3308 3309 revision = buffer->package.elements[0].integer.value; 3310 3311 if (revision > BTINTEL_SAR_REV2) { 3312 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3313 ret = -EOPNOTSUPP; 3314 goto error; 3315 } 3316 3317 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) { 3318 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12), 3319 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32), 3320 * 3..12 = per-chain sub-band limits (u8 each). 3321 */ 3322 static const u64 rev2_max[13] = { 3323 U8_MAX, /* domain ID */ 3324 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */ 3325 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */ 3326 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */ 3327 }; 3328 union acpi_object *e; 3329 int i; 3330 3331 for (i = 0; i < 13; i++) { 3332 e = &bt_pkg->package.elements[i]; 3333 if (e->type != ACPI_TYPE_INTEGER) { 3334 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d", 3335 i); 3336 ret = -EINVAL; 3337 goto error; 3338 } 3339 if (e->integer.value > rev2_max[i]) { 3340 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range", 3341 i, e->integer.value); 3342 ret = -ERANGE; 3343 goto error; 3344 } 3345 } 3346 3347 memset(&sar_rev2, 0, sizeof(sar_rev2)); 3348 sar_rev2.revision = revision; 3349 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3350 3351 if (sar_rev2.bt_sar_bios != 1) { 3352 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled"); 3353 ret = -EOPNOTSUPP; 3354 goto error; 3355 } 3356 3357 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3358 3359 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value; 3360 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value; 3361 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value; 3362 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value; 3363 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value; 3364 3365 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value; 3366 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value; 3367 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value; 3368 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value; 3369 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value; 3370 3371 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u", 3372 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode); 3373 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3374 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2, 3375 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1, 3376 sar_rev2.chain_a.subband_6g3); 3377 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3378 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2, 3379 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1, 3380 sar_rev2.chain_b.subband_6g3); 3381 3382 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver); 3383 goto error; 3384 } 3385 3386 if (revision == BTINTEL_SAR_REV2) { 3387 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)", 3388 bt_pkg->package.count); 3389 ret = -EINVAL; 3390 goto error; 3391 } 3392 3393 memset(&sar, 0, sizeof(sar)); 3394 3395 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3396 sar.revision = revision; 3397 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3398 sar.br = bt_pkg->package.elements[2].integer.value; 3399 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3400 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3401 sar.le = bt_pkg->package.elements[5].integer.value; 3402 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3403 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3404 3405 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3406 sar.revision = revision; 3407 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3408 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3409 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3410 sar.br = bt_pkg->package.elements[4].integer.value; 3411 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3412 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3413 sar.le = bt_pkg->package.elements[7].integer.value; 3414 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3415 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3416 } else { 3417 ret = -EINVAL; 3418 goto error; 3419 } 3420 3421 /* Apply only if it is enabled in BIOS */ 3422 if (sar.bt_sar_bios != 1) { 3423 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3424 ret = -EOPNOTSUPP; 3425 goto error; 3426 } 3427 3428 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3429 error: 3430 kfree(buffer); 3431 return ret; 3432 } 3433 #endif /* CONFIG_ACPI */ 3434 3435 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3436 struct intel_version_tlv *ver) 3437 { 3438 #ifdef CONFIG_ACPI 3439 return btintel_acpi_set_sar(hdev, ver); 3440 #endif 3441 return 0; 3442 } 3443 3444 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3445 struct intel_version_tlv *ver) 3446 { 3447 u32 boot_param; 3448 char ddcname[64]; 3449 int err; 3450 struct intel_version_tlv new_ver; 3451 3452 bt_dev_dbg(hdev, ""); 3453 3454 /* Set the default boot parameter to 0x0 and it is updated to 3455 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3456 * command while downloading the firmware. 3457 */ 3458 boot_param = 0x00000000; 3459 3460 /* In case of PCIe, this function might get called multiple times with 3461 * same hdev instance if there is any error on firmware download. 3462 * Need to clear stale bits of previous firmware download attempt. 3463 */ 3464 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3465 btintel_clear_flag(hdev, i); 3466 3467 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3468 3469 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3470 if (err) 3471 return err; 3472 3473 /* check if controller is already having an operational firmware */ 3474 if (ver->img_type == BTINTEL_IMG_OP) 3475 goto finish; 3476 3477 err = btintel_boot(hdev, boot_param); 3478 if (err) 3479 return err; 3480 3481 err = btintel_read_version_tlv(hdev, ver); 3482 if (err) 3483 return err; 3484 3485 /* set drive strength of BRI response */ 3486 err = btintel_set_dsbr(hdev, ver); 3487 if (err) { 3488 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3489 return err; 3490 } 3491 3492 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3493 * intermediate loader image 3494 */ 3495 if (ver->img_type == BTINTEL_IMG_IML) { 3496 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3497 if (err) 3498 return err; 3499 3500 err = btintel_boot(hdev, boot_param); 3501 if (err) 3502 return err; 3503 } 3504 3505 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3506 3507 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3508 /* Once the device is running in operational mode, it needs to 3509 * apply the device configuration (DDC) parameters. 3510 * 3511 * The device can work without DDC parameters, so even if it 3512 * fails to load the file, no need to fail the setup. 3513 */ 3514 btintel_load_ddc_config(hdev, ddcname); 3515 3516 /* Read supported use cases and set callbacks to fetch datapath id */ 3517 btintel_configure_offload(hdev); 3518 3519 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3520 3521 /* Send sar values to controller */ 3522 btintel_set_specific_absorption_rate(hdev, ver); 3523 3524 /* Set PPAG feature */ 3525 btintel_set_ppag(hdev, ver); 3526 3527 /* Read the Intel version information after loading the FW */ 3528 err = btintel_read_version_tlv(hdev, &new_ver); 3529 if (err) 3530 return err; 3531 3532 btintel_version_info_tlv(hdev, &new_ver); 3533 3534 finish: 3535 /* Set the event mask for Intel specific vendor events. This enables 3536 * a few extra events that are useful during general operation. It 3537 * does not enable any debugging related events. 3538 * 3539 * The device will function correctly without these events enabled 3540 * and thus no need to fail the setup. 3541 */ 3542 btintel_set_event_mask(hdev, false); 3543 3544 return 0; 3545 } 3546 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3547 3548 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3549 { 3550 switch (hw_variant) { 3551 /* Legacy bootloader devices that supports MSFT Extension */ 3552 case 0x11: /* JfP */ 3553 case 0x12: /* ThP */ 3554 case 0x13: /* HrP */ 3555 case 0x14: /* CcP */ 3556 /* All Intel new generation controllers support the Microsoft vendor 3557 * extension are using 0xFC1E for VsMsftOpCode. 3558 */ 3559 case 0x17: 3560 case 0x18: 3561 case 0x19: 3562 case 0x1b: 3563 case 0x1c: 3564 case 0x1d: 3565 case 0x1e: 3566 case 0x1f: 3567 case 0x20: 3568 case 0x21: 3569 case 0x22: 3570 hci_set_msft_opcode(hdev, 0xFC1E); 3571 break; 3572 default: 3573 /* Not supported */ 3574 break; 3575 } 3576 } 3577 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3578 3579 void btintel_print_fseq_info(struct hci_dev *hdev) 3580 { 3581 struct sk_buff *skb; 3582 u8 *p; 3583 u32 val; 3584 const char *str; 3585 3586 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3587 if (IS_ERR(skb)) { 3588 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3589 PTR_ERR(skb)); 3590 return; 3591 } 3592 3593 if (skb->len < (sizeof(u32) * 16 + 2)) { 3594 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3595 skb->len); 3596 kfree_skb(skb); 3597 return; 3598 } 3599 3600 p = skb_pull_data(skb, 1); 3601 if (*p) { 3602 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3603 kfree_skb(skb); 3604 return; 3605 } 3606 3607 p = skb_pull_data(skb, 1); 3608 switch (*p) { 3609 case 0: 3610 str = "Success"; 3611 break; 3612 case 1: 3613 str = "Fatal error"; 3614 break; 3615 case 2: 3616 str = "Semaphore acquire error"; 3617 break; 3618 default: 3619 str = "Unknown error"; 3620 break; 3621 } 3622 3623 if (*p) { 3624 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3625 kfree_skb(skb); 3626 return; 3627 } 3628 3629 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3630 3631 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3632 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3633 3634 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3635 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3636 3637 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3638 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3639 3640 p = skb->data; 3641 skb_pull_data(skb, 4); 3642 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3643 p[2], p[3]); 3644 3645 p = skb->data; 3646 skb_pull_data(skb, 4); 3647 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3648 p[2], p[3]); 3649 3650 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3651 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3652 3653 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3654 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3655 3656 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3657 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3658 3659 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3660 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3661 3662 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3663 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3664 3665 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3666 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3667 3668 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3669 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3670 3671 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3672 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3673 3674 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3675 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3676 3677 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3678 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3679 3680 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3681 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3682 3683 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3684 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3685 3686 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3687 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3688 3689 kfree_skb(skb); 3690 } 3691 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3692 3693 static int btintel_setup_combined(struct hci_dev *hdev) 3694 { 3695 const u8 param[1] = { 0xFF }; 3696 struct intel_version ver; 3697 struct intel_version_tlv ver_tlv; 3698 struct sk_buff *skb; 3699 int err; 3700 3701 BT_DBG("%s", hdev->name); 3702 3703 /* The some controllers have a bug with the first HCI command sent to it 3704 * returning number of completed commands as zero. This would stall the 3705 * command processing in the Bluetooth core. 3706 * 3707 * As a workaround, send HCI Reset command first which will reset the 3708 * number of completed commands and allow normal command processing 3709 * from now on. 3710 * 3711 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3712 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3713 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3714 * state, the only way to exit out of it is sending the HCI_Reset 3715 * command. 3716 */ 3717 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3718 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3719 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3720 HCI_INIT_TIMEOUT); 3721 if (IS_ERR(skb)) { 3722 bt_dev_err(hdev, 3723 "sending initial HCI reset failed (%ld)", 3724 PTR_ERR(skb)); 3725 return PTR_ERR(skb); 3726 } 3727 kfree_skb(skb); 3728 } 3729 3730 /* Starting from TyP device, the command parameter and response are 3731 * changed even though the OCF for HCI_Intel_Read_Version command 3732 * remains same. The legacy devices can handle even if the 3733 * command has a parameter and returns a correct version information. 3734 * So, it uses new format to support both legacy and new format. 3735 */ 3736 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3737 if (IS_ERR(skb)) { 3738 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3739 PTR_ERR(skb)); 3740 return PTR_ERR(skb); 3741 } 3742 3743 /* Check the status */ 3744 if (skb->data[0]) { 3745 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3746 skb->data[0]); 3747 err = -EIO; 3748 goto exit_error; 3749 } 3750 3751 /* Apply the common HCI quirks for Intel device */ 3752 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3753 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3754 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3755 3756 /* Set up the quality report callback for Intel devices */ 3757 hdev->set_quality_report = btintel_set_quality_report; 3758 3759 /* For Legacy device, check the HW platform value and size */ 3760 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3761 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3762 3763 memcpy(&ver, skb->data, sizeof(ver)); 3764 3765 /* Display version information */ 3766 btintel_version_info(hdev, &ver); 3767 3768 /* Check for supported iBT hardware variants of this firmware 3769 * loading method. 3770 * 3771 * This check has been put in place to ensure correct forward 3772 * compatibility options when newer hardware variants come 3773 * along. 3774 */ 3775 switch (ver.hw_variant) { 3776 case 0x07: /* WP */ 3777 case 0x08: /* StP */ 3778 /* Legacy ROM product */ 3779 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3780 3781 /* Apply the device specific HCI quirks 3782 * 3783 * WBS for SdP - For the Legacy ROM products, only SdP 3784 * supports the WBS. But the version information is not 3785 * enough to use here because the StP2 and SdP have same 3786 * hw_variant and fw_variant. So, this flag is set by 3787 * the transport driver (btusb) based on the HW info 3788 * (idProduct) 3789 */ 3790 if (!btintel_test_flag(hdev, 3791 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3792 hci_set_quirk(hdev, 3793 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3794 3795 err = btintel_legacy_rom_setup(hdev, &ver); 3796 break; 3797 case 0x0b: /* SfP */ 3798 case 0x11: /* JfP */ 3799 case 0x12: /* ThP */ 3800 case 0x13: /* HrP */ 3801 case 0x14: /* CcP */ 3802 fallthrough; 3803 case 0x0c: /* WsP */ 3804 /* Apply the device specific HCI quirks 3805 * 3806 * All Legacy bootloader devices support WBS 3807 */ 3808 hci_set_quirk(hdev, 3809 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3810 3811 /* These variants don't seem to support LE Coded PHY */ 3812 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3813 3814 /* Setup MSFT Extension support */ 3815 btintel_set_msft_opcode(hdev, ver.hw_variant); 3816 3817 err = btintel_bootloader_setup(hdev, &ver); 3818 btintel_register_devcoredump_support(hdev); 3819 break; 3820 default: 3821 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3822 ver.hw_variant); 3823 err = -EINVAL; 3824 } 3825 3826 hci_set_hw_info(hdev, 3827 "INTEL platform=%u variant=%u revision=%u", 3828 ver.hw_platform, ver.hw_variant, 3829 ver.hw_revision); 3830 3831 goto exit_error; 3832 } 3833 3834 /* memset ver_tlv to start with clean state as few fields are exclusive 3835 * to bootloader mode and are not populated in operational mode 3836 */ 3837 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3838 /* For TLV type device, parse the tlv data */ 3839 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3840 if (err) { 3841 bt_dev_err(hdev, "Failed to parse TLV version information"); 3842 goto exit_error; 3843 } 3844 3845 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3846 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3847 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3848 err = -EINVAL; 3849 goto exit_error; 3850 } 3851 3852 /* Check for supported iBT hardware variants of this firmware 3853 * loading method. 3854 * 3855 * This check has been put in place to ensure correct forward 3856 * compatibility options when newer hardware variants come 3857 * along. 3858 */ 3859 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3860 case 0x11: /* JfP */ 3861 case 0x12: /* ThP */ 3862 case 0x13: /* HrP */ 3863 case 0x14: /* CcP */ 3864 /* Some legacy bootloader devices starting from JfP, 3865 * the operational firmware supports both old and TLV based 3866 * HCI_Intel_Read_Version command based on the command 3867 * parameter. 3868 * 3869 * For upgrading firmware case, the TLV based version cannot 3870 * be used because the firmware filename for legacy bootloader 3871 * is based on the old format. 3872 * 3873 * Also, it is not easy to convert TLV based version from the 3874 * legacy version format. 3875 * 3876 * So, as a workaround for those devices, use the legacy 3877 * HCI_Intel_Read_Version to get the version information and 3878 * run the legacy bootloader setup. 3879 */ 3880 err = btintel_read_version(hdev, &ver); 3881 if (err) 3882 break; 3883 3884 /* Apply the device specific HCI quirks 3885 * 3886 * All Legacy bootloader devices support WBS 3887 */ 3888 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3889 3890 /* These variants don't seem to support LE Coded PHY */ 3891 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3892 3893 /* Setup MSFT Extension support */ 3894 btintel_set_msft_opcode(hdev, ver.hw_variant); 3895 3896 err = btintel_bootloader_setup(hdev, &ver); 3897 btintel_register_devcoredump_support(hdev); 3898 break; 3899 case 0x18: /* GfP2 */ 3900 case 0x1c: /* GaP */ 3901 /* Re-classify packet type for controllers with LE audio */ 3902 hdev->classify_pkt_type = btintel_classify_pkt_type; 3903 fallthrough; 3904 case 0x17: 3905 case 0x19: 3906 case 0x1b: 3907 case 0x1d: 3908 case 0x1e: 3909 case 0x1f: 3910 case 0x20: 3911 case 0x21: 3912 case 0x22: 3913 /* Display version information of TLV type */ 3914 btintel_version_info_tlv(hdev, &ver_tlv); 3915 3916 /* Apply the device specific HCI quirks for TLV based devices 3917 * 3918 * All TLV based devices support WBS 3919 */ 3920 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3921 3922 /* Setup MSFT Extension support */ 3923 btintel_set_msft_opcode(hdev, 3924 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3925 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3926 3927 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3928 if (err) 3929 goto exit_error; 3930 3931 btintel_register_devcoredump_support(hdev); 3932 btintel_print_fseq_info(hdev); 3933 break; 3934 default: 3935 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3936 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3937 err = -EINVAL; 3938 break; 3939 } 3940 3941 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3942 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3943 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3944 3945 exit_error: 3946 kfree_skb(skb); 3947 3948 return err; 3949 } 3950 3951 int btintel_shutdown_combined(struct hci_dev *hdev) 3952 { 3953 struct sk_buff *skb; 3954 int ret; 3955 3956 /* Send HCI Reset to the controller to stop any BT activity which 3957 * were triggered. This will help to save power and maintain the 3958 * sync b/w Host and controller 3959 */ 3960 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3961 if (IS_ERR(skb)) { 3962 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3963 return PTR_ERR(skb); 3964 } 3965 kfree_skb(skb); 3966 3967 3968 /* Some platforms have an issue with BT LED when the interface is 3969 * down or BT radio is turned off, which takes 5 seconds to BT LED 3970 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3971 * device in the RFKILL ON state which turns off the BT LED immediately. 3972 */ 3973 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3974 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3975 if (IS_ERR(skb)) { 3976 ret = PTR_ERR(skb); 3977 bt_dev_err(hdev, "turning off Intel device LED failed"); 3978 return ret; 3979 } 3980 kfree_skb(skb); 3981 } 3982 3983 return 0; 3984 } 3985 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3986 3987 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3988 { 3989 hdev->manufacturer = 2; 3990 hdev->setup = btintel_setup_combined; 3991 hdev->shutdown = btintel_shutdown_combined; 3992 hdev->hw_error = btintel_hw_error; 3993 hdev->set_diag = btintel_set_diag_combined; 3994 hdev->set_bdaddr = btintel_set_bdaddr; 3995 3996 coredump_info.driver_name = driver_name; 3997 3998 return 0; 3999 } 4000 EXPORT_SYMBOL_GPL(btintel_configure_setup); 4001 4002 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 4003 { 4004 struct intel_tlv *tlv = (void *)&skb->data[5]; 4005 4006 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0])) 4007 goto recv_frame; 4008 4009 /* The first event is always an event type TLV */ 4010 if (tlv->type != INTEL_TLV_TYPE_ID) 4011 goto recv_frame; 4012 4013 switch (tlv->val[0]) { 4014 case INTEL_TLV_SYSTEM_EXCEPTION: 4015 case INTEL_TLV_FATAL_EXCEPTION: 4016 case INTEL_TLV_DEBUG_EXCEPTION: 4017 case INTEL_TLV_TEST_EXCEPTION: 4018 /* Generate devcoredump from exception */ 4019 if (!hci_devcd_init(hdev, skb->len)) { 4020 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 4021 hci_devcd_complete(hdev); 4022 } else { 4023 bt_dev_err(hdev, "Failed to generate devcoredump"); 4024 } 4025 break; 4026 default: 4027 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 4028 } 4029 4030 recv_frame: 4031 return hci_recv_frame(hdev, skb); 4032 } 4033 4034 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 4035 { 4036 struct hci_event_hdr *hdr = (void *)skb->data; 4037 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 4038 4039 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) { 4040 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 4041 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 4042 4043 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 4044 switch (skb->data[2]) { 4045 case 0x02: 4046 /* When switching to the operational firmware 4047 * the device sends a vendor specific event 4048 * indicating that the bootup completed. 4049 */ 4050 btintel_bootup(hdev, ptr, len); 4051 kfree_skb(skb); 4052 return 0; 4053 case 0x06: 4054 /* When the firmware loading completes the 4055 * device sends out a vendor specific event 4056 * indicating the result of the firmware 4057 * loading. 4058 */ 4059 btintel_secure_send_result(hdev, ptr, len); 4060 kfree_skb(skb); 4061 return 0; 4062 } 4063 } 4064 4065 /* Handle all diagnostics events separately. May still call 4066 * hci_recv_frame. 4067 */ 4068 if (len + 1 >= sizeof(diagnostics_hdr) && 4069 memcmp(&skb->data[2], diagnostics_hdr, 4070 sizeof(diagnostics_hdr)) == 0) { 4071 return btintel_diagnostics(hdev, skb); 4072 } 4073 } 4074 4075 return hci_recv_frame(hdev, skb); 4076 } 4077 EXPORT_SYMBOL_GPL(btintel_recv_event); 4078 4079 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 4080 { 4081 const struct intel_bootup *evt = ptr; 4082 4083 if (len != sizeof(*evt)) 4084 return; 4085 4086 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 4087 btintel_wake_up_flag(hdev, INTEL_BOOTING); 4088 } 4089 EXPORT_SYMBOL_GPL(btintel_bootup); 4090 4091 void btintel_secure_send_result(struct hci_dev *hdev, 4092 const void *ptr, unsigned int len) 4093 { 4094 const struct intel_secure_send_result *evt = ptr; 4095 4096 if (len != sizeof(*evt)) 4097 return; 4098 4099 if (evt->result) 4100 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 4101 4102 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 4103 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 4104 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 4105 } 4106 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 4107 4108 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 4109 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 4110 MODULE_VERSION(VERSION); 4111 MODULE_LICENSE("GPL"); 4112 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 4113 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 4114 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 4115 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 4116