1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 #define BTINTEL_BT_DOMAIN 0x12 39 #define BTINTEL_SAR_LEGACY 0 40 #define BTINTEL_SAR_INC_PWR 1 41 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 42 43 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 44 struct cmd_write_boot_params { 45 __le32 boot_addr; 46 u8 fw_build_num; 47 u8 fw_build_ww; 48 u8 fw_build_yy; 49 } __packed; 50 51 static struct { 52 const char *driver_name; 53 u8 hw_variant; 54 u32 fw_build_num; 55 } coredump_info; 56 57 static const guid_t btintel_guid_dsm = 58 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 59 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 60 61 int btintel_check_bdaddr(struct hci_dev *hdev) 62 { 63 struct hci_rp_read_bd_addr *bda; 64 struct sk_buff *skb; 65 66 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 67 HCI_INIT_TIMEOUT); 68 if (IS_ERR(skb)) { 69 int err = PTR_ERR(skb); 70 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 71 err); 72 return err; 73 } 74 75 if (skb->len != sizeof(*bda)) { 76 bt_dev_err(hdev, "Intel device address length mismatch"); 77 kfree_skb(skb); 78 return -EIO; 79 } 80 81 bda = (struct hci_rp_read_bd_addr *)skb->data; 82 83 /* For some Intel based controllers, the default Bluetooth device 84 * address 00:03:19:9E:8B:00 can be found. These controllers are 85 * fully operational, but have the danger of duplicate addresses 86 * and that in turn can cause problems with Bluetooth operation. 87 */ 88 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 89 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 90 &bda->bdaddr); 91 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 92 } 93 94 kfree_skb(skb); 95 96 return 0; 97 } 98 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 99 100 int btintel_enter_mfg(struct hci_dev *hdev) 101 { 102 static const u8 param[] = { 0x01, 0x00 }; 103 struct sk_buff *skb; 104 105 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 106 if (IS_ERR(skb)) { 107 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 108 PTR_ERR(skb)); 109 return PTR_ERR(skb); 110 } 111 kfree_skb(skb); 112 113 return 0; 114 } 115 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 116 117 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 118 { 119 u8 param[] = { 0x00, 0x00 }; 120 struct sk_buff *skb; 121 122 /* The 2nd command parameter specifies the manufacturing exit method: 123 * 0x00: Just disable the manufacturing mode (0x00). 124 * 0x01: Disable manufacturing mode and reset with patches deactivated. 125 * 0x02: Disable manufacturing mode and reset with patches activated. 126 */ 127 if (reset) 128 param[1] |= patched ? 0x02 : 0x01; 129 130 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 131 if (IS_ERR(skb)) { 132 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 133 PTR_ERR(skb)); 134 return PTR_ERR(skb); 135 } 136 kfree_skb(skb); 137 138 return 0; 139 } 140 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 141 142 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 143 { 144 struct sk_buff *skb; 145 int err; 146 147 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 148 if (IS_ERR(skb)) { 149 err = PTR_ERR(skb); 150 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 151 err); 152 return err; 153 } 154 kfree_skb(skb); 155 156 return 0; 157 } 158 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 159 160 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 161 { 162 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 163 struct sk_buff *skb; 164 int err; 165 166 if (debug) 167 mask[1] |= 0x62; 168 169 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 170 if (IS_ERR(skb)) { 171 err = PTR_ERR(skb); 172 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 173 return err; 174 } 175 kfree_skb(skb); 176 177 return 0; 178 } 179 180 int btintel_set_diag(struct hci_dev *hdev, bool enable) 181 { 182 struct sk_buff *skb; 183 u8 param[3]; 184 int err; 185 186 if (enable) { 187 param[0] = 0x03; 188 param[1] = 0x03; 189 param[2] = 0x03; 190 } else { 191 param[0] = 0x00; 192 param[1] = 0x00; 193 param[2] = 0x00; 194 } 195 196 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 197 if (IS_ERR(skb)) { 198 err = PTR_ERR(skb); 199 if (err == -ENODATA) 200 goto done; 201 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 202 err); 203 return err; 204 } 205 kfree_skb(skb); 206 207 done: 208 btintel_set_event_mask(hdev, enable); 209 return 0; 210 } 211 EXPORT_SYMBOL_GPL(btintel_set_diag); 212 213 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 214 { 215 int err, ret; 216 217 err = btintel_enter_mfg(hdev); 218 if (err) 219 return err; 220 221 ret = btintel_set_diag(hdev, enable); 222 223 err = btintel_exit_mfg(hdev, false, false); 224 if (err) 225 return err; 226 227 return ret; 228 } 229 230 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 231 { 232 int ret; 233 234 /* Legacy ROM device needs to be in the manufacturer mode to apply 235 * diagnostic setting 236 * 237 * This flag is set after reading the Intel version. 238 */ 239 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 240 ret = btintel_set_diag_mfg(hdev, enable); 241 else 242 ret = btintel_set_diag(hdev, enable); 243 244 return ret; 245 } 246 247 void btintel_hw_error(struct hci_dev *hdev, u8 code) 248 { 249 struct sk_buff *skb; 250 u8 type = 0x00; 251 252 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 253 254 hci_req_sync_lock(hdev); 255 256 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 257 if (IS_ERR(skb)) { 258 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 259 PTR_ERR(skb)); 260 goto unlock; 261 } 262 kfree_skb(skb); 263 264 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 265 if (IS_ERR(skb)) { 266 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 267 PTR_ERR(skb)); 268 goto unlock; 269 } 270 271 if (skb->len != 13) { 272 bt_dev_err(hdev, "Exception info size mismatch"); 273 kfree_skb(skb); 274 goto unlock; 275 } 276 277 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 278 279 kfree_skb(skb); 280 281 unlock: 282 hci_req_sync_unlock(hdev); 283 } 284 EXPORT_SYMBOL_GPL(btintel_hw_error); 285 286 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 287 { 288 const char *variant; 289 290 /* The hardware platform number has a fixed value of 0x37 and 291 * for now only accept this single value. 292 */ 293 if (ver->hw_platform != 0x37) { 294 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 295 ver->hw_platform); 296 return -EINVAL; 297 } 298 299 /* Check for supported iBT hardware variants of this firmware 300 * loading method. 301 * 302 * This check has been put in place to ensure correct forward 303 * compatibility options when newer hardware variants come along. 304 */ 305 switch (ver->hw_variant) { 306 case 0x07: /* WP - Legacy ROM */ 307 case 0x08: /* StP - Legacy ROM */ 308 case 0x0b: /* SfP */ 309 case 0x0c: /* WsP */ 310 case 0x11: /* JfP */ 311 case 0x12: /* ThP */ 312 case 0x13: /* HrP */ 313 case 0x14: /* CcP */ 314 break; 315 default: 316 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 317 ver->hw_variant); 318 return -EINVAL; 319 } 320 321 switch (ver->fw_variant) { 322 case 0x01: 323 variant = "Legacy ROM 2.5"; 324 break; 325 case 0x06: 326 variant = "Bootloader"; 327 break; 328 case 0x22: 329 variant = "Legacy ROM 2.x"; 330 break; 331 case 0x23: 332 variant = "Firmware"; 333 break; 334 default: 335 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 336 return -EINVAL; 337 } 338 339 coredump_info.hw_variant = ver->hw_variant; 340 coredump_info.fw_build_num = ver->fw_build_num; 341 342 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 343 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 344 ver->fw_build_num, ver->fw_build_ww, 345 2000 + ver->fw_build_yy); 346 347 return 0; 348 } 349 EXPORT_SYMBOL_GPL(btintel_version_info); 350 351 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 352 const void *param) 353 { 354 while (plen > 0) { 355 struct sk_buff *skb; 356 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 357 358 cmd_param[0] = fragment_type; 359 memcpy(cmd_param + 1, param, fragment_len); 360 361 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 362 cmd_param, HCI_INIT_TIMEOUT); 363 if (IS_ERR(skb)) 364 return PTR_ERR(skb); 365 366 kfree_skb(skb); 367 368 plen -= fragment_len; 369 param += fragment_len; 370 } 371 372 return 0; 373 } 374 375 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 376 { 377 const struct firmware *fw; 378 struct sk_buff *skb; 379 const u8 *fw_ptr; 380 int err; 381 382 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 383 if (err < 0) { 384 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 385 ddc_name, err); 386 return err; 387 } 388 389 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 390 391 fw_ptr = fw->data; 392 393 /* DDC file contains one or more DDC structure which has 394 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 395 */ 396 while (fw->size > fw_ptr - fw->data) { 397 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 398 399 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 400 HCI_INIT_TIMEOUT); 401 if (IS_ERR(skb)) { 402 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 403 PTR_ERR(skb)); 404 release_firmware(fw); 405 return PTR_ERR(skb); 406 } 407 408 fw_ptr += cmd_plen; 409 kfree_skb(skb); 410 } 411 412 release_firmware(fw); 413 414 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 415 416 return 0; 417 } 418 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 419 420 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 421 { 422 int err, ret; 423 424 err = btintel_enter_mfg(hdev); 425 if (err) 426 return err; 427 428 ret = btintel_set_event_mask(hdev, debug); 429 430 err = btintel_exit_mfg(hdev, false, false); 431 if (err) 432 return err; 433 434 return ret; 435 } 436 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 437 438 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 439 { 440 struct sk_buff *skb; 441 442 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 443 if (IS_ERR(skb)) { 444 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 445 PTR_ERR(skb)); 446 return PTR_ERR(skb); 447 } 448 449 if (!skb || skb->len != sizeof(*ver)) { 450 bt_dev_err(hdev, "Intel version event size mismatch"); 451 kfree_skb(skb); 452 return -EILSEQ; 453 } 454 455 memcpy(ver, skb->data, sizeof(*ver)); 456 457 kfree_skb(skb); 458 459 return 0; 460 } 461 EXPORT_SYMBOL_GPL(btintel_read_version); 462 463 int btintel_version_info_tlv(struct hci_dev *hdev, 464 struct intel_version_tlv *version) 465 { 466 const char *variant; 467 468 /* The hardware platform number has a fixed value of 0x37 and 469 * for now only accept this single value. 470 */ 471 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 472 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 473 INTEL_HW_PLATFORM(version->cnvi_bt)); 474 return -EINVAL; 475 } 476 477 /* Check for supported iBT hardware variants of this firmware 478 * loading method. 479 * 480 * This check has been put in place to ensure correct forward 481 * compatibility options when newer hardware variants come along. 482 */ 483 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 484 case 0x17: /* TyP */ 485 case 0x18: /* Slr */ 486 case 0x19: /* Slr-F */ 487 case 0x1b: /* Mgr */ 488 case 0x1c: /* Gale Peak (GaP) */ 489 case 0x1d: /* BlazarU (BzrU) */ 490 case 0x1e: /* BlazarI (Bzr) */ 491 case 0x1f: /* Scorpious Peak */ 492 case 0x22: /* BlazarIW (BzrIW) */ 493 break; 494 default: 495 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 496 INTEL_HW_VARIANT(version->cnvi_bt)); 497 return -EINVAL; 498 } 499 500 switch (version->img_type) { 501 case BTINTEL_IMG_BOOTLOADER: 502 variant = "Bootloader"; 503 /* It is required that every single firmware fragment is acknowledged 504 * with a command complete event. If the boot parameters indicate 505 * that this bootloader does not send them, then abort the setup. 506 */ 507 if (version->limited_cce != 0x00) { 508 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 509 version->limited_cce); 510 return -EINVAL; 511 } 512 513 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */ 514 if (version->sbe_type > 0x01) { 515 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 516 version->sbe_type); 517 return -EINVAL; 518 } 519 520 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 521 bt_dev_info(hdev, "Secure boot is %s", 522 str_enabled_disabled(version->secure_boot)); 523 bt_dev_info(hdev, "OTP lock is %s", 524 str_enabled_disabled(version->otp_lock)); 525 bt_dev_info(hdev, "API lock is %s", 526 str_enabled_disabled(version->api_lock)); 527 bt_dev_info(hdev, "Debug lock is %s", 528 str_enabled_disabled(version->debug_lock)); 529 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 530 version->min_fw_build_nn, version->min_fw_build_cw, 531 2000 + version->min_fw_build_yy); 532 break; 533 case BTINTEL_IMG_IML: 534 variant = "Intermediate loader"; 535 break; 536 case BTINTEL_IMG_OP: 537 variant = "Firmware"; 538 break; 539 default: 540 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 541 return -EINVAL; 542 } 543 544 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 545 coredump_info.fw_build_num = version->build_num; 546 547 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 548 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 549 version->build_type, version->build_num); 550 if (version->img_type == BTINTEL_IMG_OP) 551 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 552 553 return 0; 554 } 555 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 556 557 int btintel_parse_version_tlv(struct hci_dev *hdev, 558 struct intel_version_tlv *version, 559 struct sk_buff *skb) 560 { 561 /* Consume Command Complete Status field */ 562 skb_pull(skb, 1); 563 564 /* Event parameters contain multiple TLVs. Read each of them 565 * and only keep the required data. Also, it use existing legacy 566 * version field like hw_platform, hw_variant, and fw_variant 567 * to keep the existing setup flow 568 */ 569 while (skb->len) { 570 struct intel_tlv *tlv; 571 572 /* Make sure skb has a minimum length of the header */ 573 if (skb->len < sizeof(*tlv)) 574 return -EINVAL; 575 576 tlv = (struct intel_tlv *)skb->data; 577 578 /* Make sure skb has a enough data */ 579 if (skb->len < tlv->len + sizeof(*tlv)) 580 return -EINVAL; 581 582 switch (tlv->type) { 583 case INTEL_TLV_CNVI_TOP: 584 version->cnvi_top = get_unaligned_le32(tlv->val); 585 break; 586 case INTEL_TLV_CNVR_TOP: 587 version->cnvr_top = get_unaligned_le32(tlv->val); 588 break; 589 case INTEL_TLV_CNVI_BT: 590 version->cnvi_bt = get_unaligned_le32(tlv->val); 591 break; 592 case INTEL_TLV_CNVR_BT: 593 version->cnvr_bt = get_unaligned_le32(tlv->val); 594 break; 595 case INTEL_TLV_DEV_REV_ID: 596 version->dev_rev_id = get_unaligned_le16(tlv->val); 597 break; 598 case INTEL_TLV_IMAGE_TYPE: 599 version->img_type = tlv->val[0]; 600 break; 601 case INTEL_TLV_TIME_STAMP: 602 /* If image type is Operational firmware (0x03), then 603 * running FW Calendar Week and Year information can 604 * be extracted from Timestamp information 605 */ 606 version->min_fw_build_cw = tlv->val[0]; 607 version->min_fw_build_yy = tlv->val[1]; 608 version->timestamp = get_unaligned_le16(tlv->val); 609 break; 610 case INTEL_TLV_BUILD_TYPE: 611 version->build_type = tlv->val[0]; 612 break; 613 case INTEL_TLV_BUILD_NUM: 614 /* If image type is Operational firmware (0x03), then 615 * running FW build number can be extracted from the 616 * Build information 617 */ 618 version->min_fw_build_nn = tlv->val[0]; 619 version->build_num = get_unaligned_le32(tlv->val); 620 break; 621 case INTEL_TLV_SECURE_BOOT: 622 version->secure_boot = tlv->val[0]; 623 break; 624 case INTEL_TLV_OTP_LOCK: 625 version->otp_lock = tlv->val[0]; 626 break; 627 case INTEL_TLV_API_LOCK: 628 version->api_lock = tlv->val[0]; 629 break; 630 case INTEL_TLV_DEBUG_LOCK: 631 version->debug_lock = tlv->val[0]; 632 break; 633 case INTEL_TLV_MIN_FW: 634 version->min_fw_build_nn = tlv->val[0]; 635 version->min_fw_build_cw = tlv->val[1]; 636 version->min_fw_build_yy = tlv->val[2]; 637 break; 638 case INTEL_TLV_LIMITED_CCE: 639 version->limited_cce = tlv->val[0]; 640 break; 641 case INTEL_TLV_SBE_TYPE: 642 version->sbe_type = tlv->val[0]; 643 break; 644 case INTEL_TLV_OTP_BDADDR: 645 memcpy(&version->otp_bd_addr, tlv->val, 646 sizeof(bdaddr_t)); 647 break; 648 case INTEL_TLV_GIT_SHA1: 649 version->git_sha1 = get_unaligned_le32(tlv->val); 650 break; 651 case INTEL_TLV_FW_ID: 652 snprintf(version->fw_id, sizeof(version->fw_id), 653 "%s", tlv->val); 654 break; 655 default: 656 /* Ignore rest of information */ 657 break; 658 } 659 /* consume the current tlv and move to next*/ 660 skb_pull(skb, tlv->len + sizeof(*tlv)); 661 } 662 663 return 0; 664 } 665 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 666 667 static int btintel_read_version_tlv(struct hci_dev *hdev, 668 struct intel_version_tlv *version) 669 { 670 struct sk_buff *skb; 671 const u8 param[1] = { 0xFF }; 672 673 if (!version) 674 return -EINVAL; 675 676 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 677 if (IS_ERR(skb)) { 678 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 679 PTR_ERR(skb)); 680 return PTR_ERR(skb); 681 } 682 683 if (skb->data[0]) { 684 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 685 skb->data[0]); 686 kfree_skb(skb); 687 return -EIO; 688 } 689 690 btintel_parse_version_tlv(hdev, version, skb); 691 692 kfree_skb(skb); 693 return 0; 694 } 695 696 /* ------- REGMAP IBT SUPPORT ------- */ 697 698 #define IBT_REG_MODE_8BIT 0x00 699 #define IBT_REG_MODE_16BIT 0x01 700 #define IBT_REG_MODE_32BIT 0x02 701 702 struct regmap_ibt_context { 703 struct hci_dev *hdev; 704 __u16 op_write; 705 __u16 op_read; 706 }; 707 708 struct ibt_cp_reg_access { 709 __le32 addr; 710 __u8 mode; 711 __u8 len; 712 __u8 data[]; 713 } __packed; 714 715 struct ibt_rp_reg_access { 716 __u8 status; 717 __le32 addr; 718 __u8 data[]; 719 } __packed; 720 721 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 722 void *val, size_t val_size) 723 { 724 struct regmap_ibt_context *ctx = context; 725 struct ibt_cp_reg_access cp; 726 struct ibt_rp_reg_access *rp; 727 struct sk_buff *skb; 728 int err = 0; 729 730 if (reg_size != sizeof(__le32)) 731 return -EINVAL; 732 733 switch (val_size) { 734 case 1: 735 cp.mode = IBT_REG_MODE_8BIT; 736 break; 737 case 2: 738 cp.mode = IBT_REG_MODE_16BIT; 739 break; 740 case 4: 741 cp.mode = IBT_REG_MODE_32BIT; 742 break; 743 default: 744 return -EINVAL; 745 } 746 747 /* regmap provides a little-endian formatted addr */ 748 cp.addr = *(__le32 *)addr; 749 cp.len = val_size; 750 751 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 752 753 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 754 HCI_CMD_TIMEOUT); 755 if (IS_ERR(skb)) { 756 err = PTR_ERR(skb); 757 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 758 le32_to_cpu(cp.addr), err); 759 return err; 760 } 761 762 if (skb->len != sizeof(*rp) + val_size) { 763 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 764 le32_to_cpu(cp.addr)); 765 err = -EINVAL; 766 goto done; 767 } 768 769 rp = (struct ibt_rp_reg_access *)skb->data; 770 771 if (rp->addr != cp.addr) { 772 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 773 le32_to_cpu(rp->addr)); 774 err = -EINVAL; 775 goto done; 776 } 777 778 memcpy(val, rp->data, val_size); 779 780 done: 781 kfree_skb(skb); 782 return err; 783 } 784 785 static int regmap_ibt_gather_write(void *context, 786 const void *addr, size_t reg_size, 787 const void *val, size_t val_size) 788 { 789 struct regmap_ibt_context *ctx = context; 790 struct ibt_cp_reg_access *cp; 791 struct sk_buff *skb; 792 int plen = sizeof(*cp) + val_size; 793 u8 mode; 794 int err = 0; 795 796 if (reg_size != sizeof(__le32)) 797 return -EINVAL; 798 799 switch (val_size) { 800 case 1: 801 mode = IBT_REG_MODE_8BIT; 802 break; 803 case 2: 804 mode = IBT_REG_MODE_16BIT; 805 break; 806 case 4: 807 mode = IBT_REG_MODE_32BIT; 808 break; 809 default: 810 return -EINVAL; 811 } 812 813 cp = kmalloc(plen, GFP_KERNEL); 814 if (!cp) 815 return -ENOMEM; 816 817 /* regmap provides a little-endian formatted addr/value */ 818 cp->addr = *(__le32 *)addr; 819 cp->mode = mode; 820 cp->len = val_size; 821 memcpy(&cp->data, val, val_size); 822 823 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 824 825 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 826 if (IS_ERR(skb)) { 827 err = PTR_ERR(skb); 828 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 829 le32_to_cpu(cp->addr), err); 830 goto done; 831 } 832 kfree_skb(skb); 833 834 done: 835 kfree(cp); 836 return err; 837 } 838 839 static int regmap_ibt_write(void *context, const void *data, size_t count) 840 { 841 /* data contains register+value, since we only support 32bit addr, 842 * minimum data size is 4 bytes. 843 */ 844 if (WARN_ONCE(count < 4, "Invalid register access")) 845 return -EINVAL; 846 847 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 848 } 849 850 static void regmap_ibt_free_context(void *context) 851 { 852 kfree(context); 853 } 854 855 static const struct regmap_bus regmap_ibt = { 856 .read = regmap_ibt_read, 857 .write = regmap_ibt_write, 858 .gather_write = regmap_ibt_gather_write, 859 .free_context = regmap_ibt_free_context, 860 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 861 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 862 }; 863 864 /* Config is the same for all register regions */ 865 static const struct regmap_config regmap_ibt_cfg = { 866 .name = "btintel_regmap", 867 .reg_bits = 32, 868 .val_bits = 32, 869 }; 870 871 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 872 u16 opcode_write) 873 { 874 struct regmap_ibt_context *ctx; 875 876 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 877 opcode_write); 878 879 ctx = kzalloc_obj(*ctx); 880 if (!ctx) 881 return ERR_PTR(-ENOMEM); 882 883 ctx->op_read = opcode_read; 884 ctx->op_write = opcode_write; 885 ctx->hdev = hdev; 886 887 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 888 } 889 EXPORT_SYMBOL_GPL(btintel_regmap_init); 890 891 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 892 { 893 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 894 struct sk_buff *skb; 895 896 params.boot_param = cpu_to_le32(boot_param); 897 898 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 899 HCI_INIT_TIMEOUT); 900 if (IS_ERR(skb)) { 901 bt_dev_err(hdev, "Failed to send Intel Reset command"); 902 return PTR_ERR(skb); 903 } 904 905 kfree_skb(skb); 906 907 return 0; 908 } 909 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 910 911 int btintel_read_boot_params(struct hci_dev *hdev, 912 struct intel_boot_params *params) 913 { 914 struct sk_buff *skb; 915 916 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 917 if (IS_ERR(skb)) { 918 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 919 PTR_ERR(skb)); 920 return PTR_ERR(skb); 921 } 922 923 if (skb->len != sizeof(*params)) { 924 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 925 kfree_skb(skb); 926 return -EILSEQ; 927 } 928 929 memcpy(params, skb->data, sizeof(*params)); 930 931 kfree_skb(skb); 932 933 if (params->status) { 934 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 935 params->status); 936 return -bt_to_errno(params->status); 937 } 938 939 bt_dev_info(hdev, "Device revision is %u", 940 le16_to_cpu(params->dev_revid)); 941 942 bt_dev_info(hdev, "Secure boot is %s", 943 str_enabled_disabled(params->secure_boot)); 944 945 bt_dev_info(hdev, "OTP lock is %s", 946 str_enabled_disabled(params->otp_lock)); 947 948 bt_dev_info(hdev, "API lock is %s", 949 str_enabled_disabled(params->api_lock)); 950 951 bt_dev_info(hdev, "Debug lock is %s", 952 str_enabled_disabled(params->debug_lock)); 953 954 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 955 params->min_fw_build_nn, params->min_fw_build_cw, 956 2000 + params->min_fw_build_yy); 957 958 return 0; 959 } 960 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 961 962 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 963 const struct firmware *fw) 964 { 965 int err; 966 967 /* Start the firmware download transaction with the Init fragment 968 * represented by the 128 bytes of CSS header. 969 */ 970 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 971 if (err < 0) { 972 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 973 goto done; 974 } 975 976 /* Send the 256 bytes of public key information from the firmware 977 * as the PKey fragment. 978 */ 979 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 980 if (err < 0) { 981 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 982 goto done; 983 } 984 985 /* Send the 256 bytes of signature information from the firmware 986 * as the Sign fragment. 987 */ 988 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 989 if (err < 0) { 990 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 991 goto done; 992 } 993 994 done: 995 return err; 996 } 997 998 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 999 const struct firmware *fw) 1000 { 1001 int err; 1002 1003 /* Start the firmware download transaction with the Init fragment 1004 * represented by the 128 bytes of CSS header. 1005 */ 1006 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1007 if (err < 0) { 1008 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1009 return err; 1010 } 1011 1012 /* Send the 96 bytes of public key information from the firmware 1013 * as the PKey fragment. 1014 */ 1015 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1016 if (err < 0) { 1017 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1018 return err; 1019 } 1020 1021 /* Send the 96 bytes of signature information from the firmware 1022 * as the Sign fragment 1023 */ 1024 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1025 if (err < 0) { 1026 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1027 err); 1028 return err; 1029 } 1030 return 0; 1031 } 1032 1033 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1034 const struct firmware *fw, 1035 size_t offset) 1036 { 1037 int err; 1038 const u8 *fw_ptr; 1039 u32 frag_len; 1040 1041 fw_ptr = fw->data + offset; 1042 frag_len = 0; 1043 err = -EINVAL; 1044 1045 while (fw_ptr - fw->data < fw->size) { 1046 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1047 1048 frag_len += sizeof(*cmd) + cmd->plen; 1049 1050 /* The parameter length of the secure send command requires 1051 * a 4 byte alignment. It happens so that the firmware file 1052 * contains proper Intel_NOP commands to align the fragments 1053 * as needed. 1054 * 1055 * Send set of commands with 4 byte alignment from the 1056 * firmware data buffer as a single Data fragment. 1057 */ 1058 if (!(frag_len % 4)) { 1059 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1060 if (err < 0) { 1061 bt_dev_err(hdev, 1062 "Failed to send firmware data (%d)", 1063 err); 1064 goto done; 1065 } 1066 1067 fw_ptr += frag_len; 1068 frag_len = 0; 1069 } 1070 } 1071 1072 done: 1073 return err; 1074 } 1075 1076 static bool btintel_firmware_version(struct hci_dev *hdev, 1077 u8 num, u8 ww, u8 yy, 1078 const struct firmware *fw, 1079 u32 *boot_addr) 1080 { 1081 const u8 *fw_ptr; 1082 1083 fw_ptr = fw->data; 1084 1085 while (fw_ptr - fw->data < fw->size) { 1086 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1087 1088 /* Each SKU has a different reset parameter to use in the 1089 * HCI_Intel_Reset command and it is embedded in the firmware 1090 * data. So, instead of using static value per SKU, check 1091 * the firmware data and save it for later use. 1092 */ 1093 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1094 struct cmd_write_boot_params *params; 1095 1096 params = (void *)(fw_ptr + sizeof(*cmd)); 1097 1098 *boot_addr = le32_to_cpu(params->boot_addr); 1099 1100 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1101 1102 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1103 params->fw_build_num, params->fw_build_ww, 1104 params->fw_build_yy); 1105 1106 return (num == params->fw_build_num && 1107 ww == params->fw_build_ww && 1108 yy == params->fw_build_yy); 1109 } 1110 1111 fw_ptr += sizeof(*cmd) + cmd->plen; 1112 } 1113 1114 return false; 1115 } 1116 1117 int btintel_download_firmware(struct hci_dev *hdev, 1118 struct intel_version *ver, 1119 const struct firmware *fw, 1120 u32 *boot_param) 1121 { 1122 int err; 1123 1124 /* SfP and WsP don't seem to update the firmware version on file 1125 * so version checking is currently not possible. 1126 */ 1127 switch (ver->hw_variant) { 1128 case 0x0b: /* SfP */ 1129 case 0x0c: /* WsP */ 1130 /* Skip version checking */ 1131 break; 1132 default: 1133 1134 /* Skip download if firmware has the same version */ 1135 if (btintel_firmware_version(hdev, ver->fw_build_num, 1136 ver->fw_build_ww, ver->fw_build_yy, 1137 fw, boot_param)) { 1138 bt_dev_info(hdev, "Firmware already loaded"); 1139 /* Return -EALREADY to indicate that the firmware has 1140 * already been loaded. 1141 */ 1142 return -EALREADY; 1143 } 1144 } 1145 1146 /* The firmware variant determines if the device is in bootloader 1147 * mode or is running operational firmware. The value 0x06 identifies 1148 * the bootloader and the value 0x23 identifies the operational 1149 * firmware. 1150 * 1151 * If the firmware version has changed that means it needs to be reset 1152 * to bootloader when operational so the new firmware can be loaded. 1153 */ 1154 if (ver->fw_variant == 0x23) 1155 return -EINVAL; 1156 1157 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1158 if (err) 1159 return err; 1160 1161 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1162 } 1163 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1164 1165 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1166 struct intel_version_tlv *ver, 1167 const struct firmware *fw, u32 *boot_param, 1168 u8 hw_variant, u8 sbe_type) 1169 { 1170 int err; 1171 u32 css_header_ver; 1172 1173 /* Skip download if firmware has the same version */ 1174 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1175 ver->min_fw_build_cw, 1176 ver->min_fw_build_yy, 1177 fw, boot_param)) { 1178 bt_dev_info(hdev, "Firmware already loaded"); 1179 /* Return -EALREADY to indicate that firmware has 1180 * already been loaded. 1181 */ 1182 return -EALREADY; 1183 } 1184 1185 /* The firmware variant determines if the device is in bootloader 1186 * mode or is running operational firmware. The value 0x01 identifies 1187 * the bootloader and the value 0x03 identifies the operational 1188 * firmware. 1189 * 1190 * If the firmware version has changed that means it needs to be reset 1191 * to bootloader when operational so the new firmware can be loaded. 1192 */ 1193 if (ver->img_type == BTINTEL_IMG_OP) 1194 return -EINVAL; 1195 1196 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1197 * only RSA secure boot engine. Hence, the corresponding sfi file will 1198 * have RSA header of 644 bytes followed by Command Buffer. 1199 * 1200 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1201 * secure boot engine. As a result, the corresponding sfi file will 1202 * have RSA header of 644, ECDSA header of 320 bytes followed by 1203 * Command Buffer. 1204 * 1205 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1206 * version: RSA(0x00010000) , ECDSA (0x00020000) 1207 */ 1208 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1209 if (css_header_ver != 0x00010000) { 1210 bt_dev_err(hdev, "Invalid CSS Header version"); 1211 return -EINVAL; 1212 } 1213 1214 if (hw_variant <= 0x14) { 1215 if (sbe_type != 0x00) { 1216 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1217 hw_variant); 1218 return -EINVAL; 1219 } 1220 1221 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1222 if (err) 1223 return err; 1224 1225 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1226 if (err) 1227 return err; 1228 } else if (hw_variant >= 0x17) { 1229 /* Check if CSS header for ECDSA follows the RSA header */ 1230 if (fw->data[ECDSA_OFFSET] != 0x06) 1231 return -EINVAL; 1232 1233 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1234 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1235 if (css_header_ver != 0x00020000) { 1236 bt_dev_err(hdev, "Invalid CSS Header version"); 1237 return -EINVAL; 1238 } 1239 1240 if (sbe_type == 0x00) { 1241 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1242 if (err) 1243 return err; 1244 1245 err = btintel_download_firmware_payload(hdev, fw, 1246 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1247 if (err) 1248 return err; 1249 } else if (sbe_type == 0x01) { 1250 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1251 if (err) 1252 return err; 1253 1254 err = btintel_download_firmware_payload(hdev, fw, 1255 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1256 if (err) 1257 return err; 1258 } 1259 } 1260 return 0; 1261 } 1262 1263 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1264 { 1265 struct intel_reset params; 1266 struct sk_buff *skb; 1267 1268 /* PCIe transport uses shared hardware reset mechanism for recovery 1269 * which gets triggered in pcie *setup* function on error. 1270 */ 1271 if (hdev->bus == HCI_PCI) 1272 return; 1273 1274 /* Send Intel Reset command. This will result in 1275 * re-enumeration of BT controller. 1276 * 1277 * Intel Reset parameter description: 1278 * reset_type : 0x00 (Soft reset), 1279 * 0x01 (Hard reset) 1280 * patch_enable : 0x00 (Do not enable), 1281 * 0x01 (Enable) 1282 * ddc_reload : 0x00 (Do not reload), 1283 * 0x01 (Reload) 1284 * boot_option: 0x00 (Current image), 1285 * 0x01 (Specified boot address) 1286 * boot_param: Boot address 1287 * 1288 */ 1289 1290 params.reset_type = 0x01; 1291 params.patch_enable = 0x01; 1292 params.ddc_reload = 0x01; 1293 params.boot_option = 0x00; 1294 params.boot_param = cpu_to_le32(0x00000000); 1295 1296 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1297 ¶ms, HCI_INIT_TIMEOUT); 1298 if (IS_ERR(skb)) { 1299 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1300 PTR_ERR(skb)); 1301 return; 1302 } 1303 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1304 kfree_skb(skb); 1305 1306 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1307 * lines for 2ms when it receives Intel Reset in bootloader mode. 1308 * Whereas, the upcoming Intel BT controllers will hold USB reset 1309 * for 150ms. To keep the delay generic, 150ms is chosen here. 1310 */ 1311 msleep(150); 1312 } 1313 1314 static int btintel_read_debug_features(struct hci_dev *hdev, 1315 struct intel_debug_features *features) 1316 { 1317 struct sk_buff *skb; 1318 u8 page_no = 1; 1319 1320 /* Intel controller supports two pages, each page is of 128-bit 1321 * feature bit mask. And each bit defines specific feature support 1322 */ 1323 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1324 HCI_INIT_TIMEOUT); 1325 if (IS_ERR(skb)) { 1326 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1327 PTR_ERR(skb)); 1328 return PTR_ERR(skb); 1329 } 1330 1331 if (skb->len != (sizeof(features->page1) + 3)) { 1332 bt_dev_err(hdev, "Supported features event size mismatch"); 1333 kfree_skb(skb); 1334 return -EILSEQ; 1335 } 1336 1337 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1338 1339 /* Read the supported features page2 if required in future. 1340 */ 1341 kfree_skb(skb); 1342 return 0; 1343 } 1344 1345 static int btintel_set_debug_features(struct hci_dev *hdev, 1346 const struct intel_debug_features *features) 1347 { 1348 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1349 0x00, 0x00, 0x00 }; 1350 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1351 u8 trace_enable = 0x02; 1352 struct sk_buff *skb; 1353 1354 if (!features) { 1355 bt_dev_warn(hdev, "Debug features not read"); 1356 return -EINVAL; 1357 } 1358 1359 if (!(features->page1[0] & 0x3f)) { 1360 bt_dev_info(hdev, "Telemetry exception format not supported"); 1361 return 0; 1362 } 1363 1364 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1365 if (IS_ERR(skb)) { 1366 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1367 PTR_ERR(skb)); 1368 return PTR_ERR(skb); 1369 } 1370 kfree_skb(skb); 1371 1372 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1373 if (IS_ERR(skb)) { 1374 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1375 PTR_ERR(skb)); 1376 return PTR_ERR(skb); 1377 } 1378 kfree_skb(skb); 1379 1380 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1381 if (IS_ERR(skb)) { 1382 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1383 PTR_ERR(skb)); 1384 return PTR_ERR(skb); 1385 } 1386 kfree_skb(skb); 1387 1388 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1389 trace_enable, mask[3]); 1390 1391 return 0; 1392 } 1393 1394 static int btintel_reset_debug_features(struct hci_dev *hdev, 1395 const struct intel_debug_features *features) 1396 { 1397 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1398 0x00, 0x00, 0x00 }; 1399 u8 trace_enable = 0x00; 1400 struct sk_buff *skb; 1401 1402 if (!features) { 1403 bt_dev_warn(hdev, "Debug features not read"); 1404 return -EINVAL; 1405 } 1406 1407 if (!(features->page1[0] & 0x3f)) { 1408 bt_dev_info(hdev, "Telemetry exception format not supported"); 1409 return 0; 1410 } 1411 1412 /* Should stop the trace before writing ddc event mask. */ 1413 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1414 if (IS_ERR(skb)) { 1415 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1416 PTR_ERR(skb)); 1417 return PTR_ERR(skb); 1418 } 1419 kfree_skb(skb); 1420 1421 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1422 if (IS_ERR(skb)) { 1423 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1424 PTR_ERR(skb)); 1425 return PTR_ERR(skb); 1426 } 1427 kfree_skb(skb); 1428 1429 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1430 trace_enable, mask[3]); 1431 1432 return 0; 1433 } 1434 1435 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1436 { 1437 struct intel_debug_features features; 1438 int err; 1439 1440 bt_dev_dbg(hdev, "enable %d", enable); 1441 1442 /* Read the Intel supported features and if new exception formats 1443 * supported, need to load the additional DDC config to enable. 1444 */ 1445 err = btintel_read_debug_features(hdev, &features); 1446 if (err) 1447 return err; 1448 1449 /* Set or reset the debug features. */ 1450 if (enable) 1451 err = btintel_set_debug_features(hdev, &features); 1452 else 1453 err = btintel_reset_debug_features(hdev, &features); 1454 1455 return err; 1456 } 1457 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1458 1459 static void btintel_coredump(struct hci_dev *hdev) 1460 { 1461 struct sk_buff *skb; 1462 1463 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1464 if (IS_ERR(skb)) { 1465 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1466 return; 1467 } 1468 1469 kfree_skb(skb); 1470 } 1471 1472 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1473 { 1474 char buf[80]; 1475 1476 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1477 coredump_info.hw_variant); 1478 skb_put_data(skb, buf, strlen(buf)); 1479 1480 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1481 coredump_info.fw_build_num); 1482 skb_put_data(skb, buf, strlen(buf)); 1483 1484 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1485 skb_put_data(skb, buf, strlen(buf)); 1486 1487 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1488 skb_put_data(skb, buf, strlen(buf)); 1489 } 1490 1491 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1492 { 1493 struct intel_debug_features features; 1494 int err; 1495 1496 err = btintel_read_debug_features(hdev, &features); 1497 if (err) { 1498 bt_dev_info(hdev, "Error reading debug features"); 1499 return err; 1500 } 1501 1502 if (!(features.page1[0] & 0x3f)) { 1503 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1504 return -EOPNOTSUPP; 1505 } 1506 1507 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1508 1509 return err; 1510 } 1511 1512 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1513 struct intel_version *ver) 1514 { 1515 const struct firmware *fw; 1516 char fwname[64]; 1517 int ret; 1518 1519 snprintf(fwname, sizeof(fwname), 1520 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1521 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1522 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1523 ver->fw_build_ww, ver->fw_build_yy); 1524 1525 ret = request_firmware(&fw, fwname, &hdev->dev); 1526 if (ret < 0) { 1527 if (ret == -EINVAL) { 1528 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1529 ret); 1530 return NULL; 1531 } 1532 1533 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1534 fwname, ret); 1535 1536 /* If the correct firmware patch file is not found, use the 1537 * default firmware patch file instead 1538 */ 1539 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1540 ver->hw_platform, ver->hw_variant); 1541 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1542 bt_dev_err(hdev, "failed to open default fw file: %s", 1543 fwname); 1544 return NULL; 1545 } 1546 } 1547 1548 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1549 1550 return fw; 1551 } 1552 1553 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1554 const struct firmware *fw, 1555 const u8 **fw_ptr, int *disable_patch) 1556 { 1557 struct sk_buff *skb; 1558 struct hci_command_hdr *cmd; 1559 const u8 *cmd_param; 1560 struct hci_event_hdr *evt = NULL; 1561 const u8 *evt_param = NULL; 1562 int remain = fw->size - (*fw_ptr - fw->data); 1563 1564 /* The first byte indicates the types of the patch command or event. 1565 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1566 * in the current firmware buffer doesn't start with 0x01 or 1567 * the size of remain buffer is smaller than HCI command header, 1568 * the firmware file is corrupted and it should stop the patching 1569 * process. 1570 */ 1571 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1572 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1573 return -EINVAL; 1574 } 1575 (*fw_ptr)++; 1576 remain--; 1577 1578 cmd = (struct hci_command_hdr *)(*fw_ptr); 1579 *fw_ptr += sizeof(*cmd); 1580 remain -= sizeof(*cmd); 1581 1582 /* Ensure that the remain firmware data is long enough than the length 1583 * of command parameter. If not, the firmware file is corrupted. 1584 */ 1585 if (remain < cmd->plen) { 1586 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1587 return -EFAULT; 1588 } 1589 1590 /* If there is a command that loads a patch in the firmware 1591 * file, then enable the patch upon success, otherwise just 1592 * disable the manufacturer mode, for example patch activation 1593 * is not required when the default firmware patch file is used 1594 * because there are no patch data to load. 1595 */ 1596 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1597 *disable_patch = 0; 1598 1599 cmd_param = *fw_ptr; 1600 *fw_ptr += cmd->plen; 1601 remain -= cmd->plen; 1602 1603 /* This reads the expected events when the above command is sent to the 1604 * device. Some vendor commands expects more than one events, for 1605 * example command status event followed by vendor specific event. 1606 * For this case, it only keeps the last expected event. so the command 1607 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1608 * last expected event. 1609 */ 1610 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1611 (*fw_ptr)++; 1612 remain--; 1613 1614 evt = (struct hci_event_hdr *)(*fw_ptr); 1615 *fw_ptr += sizeof(*evt); 1616 remain -= sizeof(*evt); 1617 1618 if (remain < evt->plen) { 1619 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1620 return -EFAULT; 1621 } 1622 1623 evt_param = *fw_ptr; 1624 *fw_ptr += evt->plen; 1625 remain -= evt->plen; 1626 } 1627 1628 /* Every HCI commands in the firmware file has its correspond event. 1629 * If event is not found or remain is smaller than zero, the firmware 1630 * file is corrupted. 1631 */ 1632 if (!evt || !evt_param || remain < 0) { 1633 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1634 return -EFAULT; 1635 } 1636 1637 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1638 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1639 if (IS_ERR(skb)) { 1640 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1641 cmd->opcode, PTR_ERR(skb)); 1642 return PTR_ERR(skb); 1643 } 1644 1645 /* It ensures that the returned event matches the event data read from 1646 * the firmware file. At fist, it checks the length and then 1647 * the contents of the event. 1648 */ 1649 if (skb->len != evt->plen) { 1650 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1651 le16_to_cpu(cmd->opcode)); 1652 kfree_skb(skb); 1653 return -EFAULT; 1654 } 1655 1656 if (memcmp(skb->data, evt_param, evt->plen)) { 1657 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1658 le16_to_cpu(cmd->opcode)); 1659 kfree_skb(skb); 1660 return -EFAULT; 1661 } 1662 kfree_skb(skb); 1663 1664 return 0; 1665 } 1666 1667 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1668 struct intel_version *ver) 1669 { 1670 const struct firmware *fw; 1671 const u8 *fw_ptr; 1672 int disable_patch, err; 1673 struct intel_version new_ver; 1674 1675 BT_DBG("%s", hdev->name); 1676 1677 /* fw_patch_num indicates the version of patch the device currently 1678 * have. If there is no patch data in the device, it is always 0x00. 1679 * So, if it is other than 0x00, no need to patch the device again. 1680 */ 1681 if (ver->fw_patch_num) { 1682 bt_dev_info(hdev, 1683 "Intel device is already patched. patch num: %02x", 1684 ver->fw_patch_num); 1685 goto complete; 1686 } 1687 1688 /* Opens the firmware patch file based on the firmware version read 1689 * from the controller. If it fails to open the matching firmware 1690 * patch file, it tries to open the default firmware patch file. 1691 * If no patch file is found, allow the device to operate without 1692 * a patch. 1693 */ 1694 fw = btintel_legacy_rom_get_fw(hdev, ver); 1695 if (!fw) 1696 goto complete; 1697 fw_ptr = fw->data; 1698 1699 /* Enable the manufacturer mode of the controller. 1700 * Only while this mode is enabled, the driver can download the 1701 * firmware patch data and configuration parameters. 1702 */ 1703 err = btintel_enter_mfg(hdev); 1704 if (err) { 1705 release_firmware(fw); 1706 return err; 1707 } 1708 1709 disable_patch = 1; 1710 1711 /* The firmware data file consists of list of Intel specific HCI 1712 * commands and its expected events. The first byte indicates the 1713 * type of the message, either HCI command or HCI event. 1714 * 1715 * It reads the command and its expected event from the firmware file, 1716 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1717 * the returned event is compared with the event read from the firmware 1718 * file and it will continue until all the messages are downloaded to 1719 * the controller. 1720 * 1721 * Once the firmware patching is completed successfully, 1722 * the manufacturer mode is disabled with reset and activating the 1723 * downloaded patch. 1724 * 1725 * If the firmware patching fails, the manufacturer mode is 1726 * disabled with reset and deactivating the patch. 1727 * 1728 * If the default patch file is used, no reset is done when disabling 1729 * the manufacturer. 1730 */ 1731 while (fw->size > fw_ptr - fw->data) { 1732 int ret; 1733 1734 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1735 &disable_patch); 1736 if (ret < 0) 1737 goto exit_mfg_deactivate; 1738 } 1739 1740 release_firmware(fw); 1741 1742 if (disable_patch) 1743 goto exit_mfg_disable; 1744 1745 /* Patching completed successfully and disable the manufacturer mode 1746 * with reset and activate the downloaded firmware patches. 1747 */ 1748 err = btintel_exit_mfg(hdev, true, true); 1749 if (err) 1750 return err; 1751 1752 /* Need build number for downloaded fw patches in 1753 * every power-on boot 1754 */ 1755 err = btintel_read_version(hdev, &new_ver); 1756 if (err) 1757 return err; 1758 1759 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1760 new_ver.fw_patch_num); 1761 1762 goto complete; 1763 1764 exit_mfg_disable: 1765 /* Disable the manufacturer mode without reset */ 1766 err = btintel_exit_mfg(hdev, false, false); 1767 if (err) 1768 return err; 1769 1770 bt_dev_info(hdev, "Intel firmware patch completed"); 1771 1772 goto complete; 1773 1774 exit_mfg_deactivate: 1775 release_firmware(fw); 1776 1777 /* Patching failed. Disable the manufacturer mode with reset and 1778 * deactivate the downloaded firmware patches. 1779 */ 1780 err = btintel_exit_mfg(hdev, true, false); 1781 if (err) 1782 return err; 1783 1784 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1785 1786 complete: 1787 /* Set the event mask for Intel specific vendor events. This enables 1788 * a few extra events that are useful during general operation. 1789 */ 1790 btintel_set_event_mask_mfg(hdev, false); 1791 1792 btintel_check_bdaddr(hdev); 1793 1794 return 0; 1795 } 1796 1797 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1798 { 1799 ktime_t delta, rettime; 1800 unsigned long long duration; 1801 int err; 1802 1803 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1804 1805 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1806 1807 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1808 TASK_INTERRUPTIBLE, 1809 msecs_to_jiffies(msec)); 1810 if (err == -EINTR) { 1811 bt_dev_err(hdev, "Firmware loading interrupted"); 1812 return err; 1813 } 1814 1815 if (err) { 1816 bt_dev_err(hdev, "Firmware loading timeout"); 1817 return -ETIMEDOUT; 1818 } 1819 1820 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1821 bt_dev_err(hdev, "Firmware loading failed"); 1822 return -ENOEXEC; 1823 } 1824 1825 rettime = ktime_get(); 1826 delta = ktime_sub(rettime, calltime); 1827 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1828 1829 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1830 1831 return 0; 1832 } 1833 1834 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1835 { 1836 ktime_t delta, rettime; 1837 unsigned long long duration; 1838 int err; 1839 1840 bt_dev_info(hdev, "Waiting for device to boot"); 1841 1842 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1843 TASK_INTERRUPTIBLE, 1844 msecs_to_jiffies(msec)); 1845 if (err == -EINTR) { 1846 bt_dev_err(hdev, "Device boot interrupted"); 1847 return -EINTR; 1848 } 1849 1850 if (err) { 1851 bt_dev_err(hdev, "Device boot timeout"); 1852 return -ETIMEDOUT; 1853 } 1854 1855 rettime = ktime_get(); 1856 delta = ktime_sub(rettime, calltime); 1857 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1858 1859 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1860 1861 return 0; 1862 } 1863 1864 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1865 int msec) 1866 { 1867 ktime_t delta, rettime; 1868 unsigned long long duration; 1869 int err; 1870 1871 bt_dev_info(hdev, "Waiting for device transition to d0"); 1872 1873 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1874 TASK_INTERRUPTIBLE, 1875 msecs_to_jiffies(msec)); 1876 if (err == -EINTR) { 1877 bt_dev_err(hdev, "Device d0 move interrupted"); 1878 return -EINTR; 1879 } 1880 1881 if (err) { 1882 bt_dev_err(hdev, "Device d0 move timeout"); 1883 return -ETIMEDOUT; 1884 } 1885 1886 rettime = ktime_get(); 1887 delta = ktime_sub(rettime, calltime); 1888 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1889 1890 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 1891 1892 return 0; 1893 } 1894 1895 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1896 { 1897 ktime_t calltime; 1898 int err; 1899 1900 calltime = ktime_get(); 1901 1902 btintel_set_flag(hdev, INTEL_BOOTING); 1903 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 1904 1905 err = btintel_send_intel_reset(hdev, boot_addr); 1906 if (err) { 1907 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1908 btintel_reset_to_bootloader(hdev); 1909 return err; 1910 } 1911 1912 /* The bootloader will not indicate when the device is ready. This 1913 * is done by the operational firmware sending bootup notification. 1914 * 1915 * Booting into operational firmware should not take longer than 1916 * 5 second. However if that happens, then just fail the setup 1917 * since something went wrong. 1918 */ 1919 err = btintel_boot_wait(hdev, calltime, 5000); 1920 if (err == -ETIMEDOUT) { 1921 btintel_reset_to_bootloader(hdev); 1922 goto exit_error; 1923 } 1924 1925 if (hdev->bus == HCI_PCI) { 1926 /* In case of PCIe, after receiving bootup event, driver performs 1927 * D0 entry by writing 0 to sleep control register (check 1928 * btintel_pcie_recv_event()) 1929 * Firmware acks with alive interrupt indicating host is full ready to 1930 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 1931 * bit is cleared. 1932 */ 1933 calltime = ktime_get(); 1934 err = btintel_boot_wait_d0(hdev, calltime, 2000); 1935 } 1936 1937 exit_error: 1938 return err; 1939 } 1940 1941 static int btintel_get_fw_name(struct intel_version *ver, 1942 struct intel_boot_params *params, 1943 char *fw_name, size_t len, 1944 const char *suffix) 1945 { 1946 switch (ver->hw_variant) { 1947 case 0x0b: /* SfP */ 1948 case 0x0c: /* WsP */ 1949 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 1950 ver->hw_variant, 1951 le16_to_cpu(params->dev_revid), 1952 suffix); 1953 break; 1954 case 0x11: /* JfP */ 1955 case 0x12: /* ThP */ 1956 case 0x13: /* HrP */ 1957 case 0x14: /* CcP */ 1958 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 1959 ver->hw_variant, 1960 ver->hw_revision, 1961 ver->fw_revision, 1962 suffix); 1963 break; 1964 default: 1965 return -EINVAL; 1966 } 1967 1968 return 0; 1969 } 1970 1971 static int btintel_download_fw(struct hci_dev *hdev, 1972 struct intel_version *ver, 1973 struct intel_boot_params *params, 1974 u32 *boot_param) 1975 { 1976 const struct firmware *fw; 1977 char fwname[64]; 1978 int err; 1979 ktime_t calltime; 1980 1981 if (!ver || !params) 1982 return -EINVAL; 1983 1984 /* The firmware variant determines if the device is in bootloader 1985 * mode or is running operational firmware. The value 0x06 identifies 1986 * the bootloader and the value 0x23 identifies the operational 1987 * firmware. 1988 * 1989 * When the operational firmware is already present, then only 1990 * the check for valid Bluetooth device address is needed. This 1991 * determines if the device will be added as configured or 1992 * unconfigured controller. 1993 * 1994 * It is not possible to use the Secure Boot Parameters in this 1995 * case since that command is only available in bootloader mode. 1996 */ 1997 if (ver->fw_variant == 0x23) { 1998 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 1999 btintel_check_bdaddr(hdev); 2000 2001 /* SfP and WsP don't seem to update the firmware version on file 2002 * so version checking is currently possible. 2003 */ 2004 switch (ver->hw_variant) { 2005 case 0x0b: /* SfP */ 2006 case 0x0c: /* WsP */ 2007 return 0; 2008 } 2009 2010 /* Proceed to download to check if the version matches */ 2011 goto download; 2012 } 2013 2014 /* Read the secure boot parameters to identify the operating 2015 * details of the bootloader. 2016 */ 2017 err = btintel_read_boot_params(hdev, params); 2018 if (err) 2019 return err; 2020 2021 /* It is required that every single firmware fragment is acknowledged 2022 * with a command complete event. If the boot parameters indicate 2023 * that this bootloader does not send them, then abort the setup. 2024 */ 2025 if (params->limited_cce != 0x00) { 2026 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2027 params->limited_cce); 2028 return -EINVAL; 2029 } 2030 2031 /* If the OTP has no valid Bluetooth device address, then there will 2032 * also be no valid address for the operational firmware. 2033 */ 2034 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2035 bt_dev_info(hdev, "No device address configured"); 2036 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2037 } 2038 2039 download: 2040 /* With this Intel bootloader only the hardware variant and device 2041 * revision information are used to select the right firmware for SfP 2042 * and WsP. 2043 * 2044 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2045 * 2046 * Currently the supported hardware variants are: 2047 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2048 * 12 (0x0c) for iBT3.5 (WsP) 2049 * 2050 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2051 * variant, HW revision and FW revision, as these are dependent on CNVi 2052 * and RF Combination. 2053 * 2054 * 17 (0x11) for iBT3.5 (JfP) 2055 * 18 (0x12) for iBT3.5 (ThP) 2056 * 2057 * The firmware file name for these will be 2058 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2059 * 2060 */ 2061 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2062 if (err < 0) { 2063 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2064 /* Firmware has already been loaded */ 2065 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2066 return 0; 2067 } 2068 2069 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2070 return -EINVAL; 2071 } 2072 2073 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2074 if (err < 0) { 2075 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2076 /* Firmware has already been loaded */ 2077 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2078 return 0; 2079 } 2080 2081 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2082 fwname, err); 2083 return err; 2084 } 2085 2086 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2087 2088 if (fw->size < 644) { 2089 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2090 fw->size); 2091 err = -EBADF; 2092 goto done; 2093 } 2094 2095 calltime = ktime_get(); 2096 2097 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2098 2099 /* Start firmware downloading and get boot parameter */ 2100 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2101 if (err < 0) { 2102 if (err == -EALREADY) { 2103 /* Firmware has already been loaded */ 2104 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2105 err = 0; 2106 goto done; 2107 } 2108 2109 /* When FW download fails, send Intel Reset to retry 2110 * FW download. 2111 */ 2112 btintel_reset_to_bootloader(hdev); 2113 goto done; 2114 } 2115 2116 /* Before switching the device into operational mode and with that 2117 * booting the loaded firmware, wait for the bootloader notification 2118 * that all fragments have been successfully received. 2119 * 2120 * When the event processing receives the notification, then the 2121 * INTEL_DOWNLOADING flag will be cleared. 2122 * 2123 * The firmware loading should not take longer than 5 seconds 2124 * and thus just timeout if that happens and fail the setup 2125 * of this device. 2126 */ 2127 err = btintel_download_wait(hdev, calltime, 5000); 2128 if (err == -ETIMEDOUT) 2129 btintel_reset_to_bootloader(hdev); 2130 2131 done: 2132 release_firmware(fw); 2133 return err; 2134 } 2135 2136 static int btintel_bootloader_setup(struct hci_dev *hdev, 2137 struct intel_version *ver) 2138 { 2139 struct intel_version new_ver; 2140 struct intel_boot_params params; 2141 u32 boot_param; 2142 char ddcname[64]; 2143 int err; 2144 2145 BT_DBG("%s", hdev->name); 2146 2147 /* Set the default boot parameter to 0x0 and it is updated to 2148 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2149 * command while downloading the firmware. 2150 */ 2151 boot_param = 0x00000000; 2152 2153 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2154 2155 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2156 if (err) 2157 return err; 2158 2159 /* controller is already having an operational firmware */ 2160 if (ver->fw_variant == 0x23) 2161 goto finish; 2162 2163 err = btintel_boot(hdev, boot_param); 2164 if (err) 2165 return err; 2166 2167 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2168 2169 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2170 sizeof(ddcname), "ddc"); 2171 2172 if (err < 0) { 2173 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2174 } else { 2175 /* Once the device is running in operational mode, it needs to 2176 * apply the device configuration (DDC) parameters. 2177 * 2178 * The device can work without DDC parameters, so even if it 2179 * fails to load the file, no need to fail the setup. 2180 */ 2181 btintel_load_ddc_config(hdev, ddcname); 2182 } 2183 2184 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2185 2186 /* Read the Intel version information after loading the FW */ 2187 err = btintel_read_version(hdev, &new_ver); 2188 if (err) 2189 return err; 2190 2191 btintel_version_info(hdev, &new_ver); 2192 2193 finish: 2194 /* Set the event mask for Intel specific vendor events. This enables 2195 * a few extra events that are useful during general operation. It 2196 * does not enable any debugging related events. 2197 * 2198 * The device will function correctly without these events enabled 2199 * and thus no need to fail the setup. 2200 */ 2201 btintel_set_event_mask(hdev, false); 2202 2203 return 0; 2204 } 2205 2206 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2207 char *fw_name, size_t len, 2208 const char *suffix) 2209 { 2210 const char *format; 2211 u32 cnvi, cnvr; 2212 2213 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2214 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2215 2216 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2217 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2218 2219 /* Only Blazar product supports downloading of intermediate loader 2220 * image 2221 */ 2222 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2223 u8 zero[BTINTEL_FWID_MAXLEN]; 2224 2225 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2226 format = "intel/ibt-%04x-%04x-iml.%s"; 2227 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2228 return; 2229 } 2230 2231 memset(zero, 0, sizeof(zero)); 2232 2233 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2234 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2235 format = "intel/ibt-%04x-%04x-%s.%s"; 2236 snprintf(fw_name, len, format, cnvi, cnvr, 2237 ver->fw_id, suffix); 2238 return; 2239 } 2240 /* If firmware id is not present, fallback to legacy naming 2241 * convention 2242 */ 2243 } 2244 /* Fallback to legacy naming convention for other controllers 2245 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2246 */ 2247 format = "intel/ibt-%04x-%04x.%s"; 2248 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2249 } 2250 2251 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2252 char *fw_name, size_t len, 2253 const char *suffix) 2254 { 2255 const char *format; 2256 u32 cnvi, cnvr; 2257 2258 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2259 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2260 2261 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2262 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2263 2264 format = "intel/ibt-%04x-%04x-iml.%s"; 2265 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2266 } 2267 2268 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2269 struct intel_version_tlv *ver, 2270 u32 *boot_param) 2271 { 2272 const struct firmware *fw; 2273 char fwname[128]; 2274 int err; 2275 ktime_t calltime; 2276 2277 if (!ver || !boot_param) 2278 return -EINVAL; 2279 2280 /* The firmware variant determines if the device is in bootloader 2281 * mode or is running operational firmware. The value 0x03 identifies 2282 * the bootloader and the value 0x23 identifies the operational 2283 * firmware. 2284 * 2285 * When the operational firmware is already present, then only 2286 * the check for valid Bluetooth device address is needed. This 2287 * determines if the device will be added as configured or 2288 * unconfigured controller. 2289 * 2290 * It is not possible to use the Secure Boot Parameters in this 2291 * case since that command is only available in bootloader mode. 2292 */ 2293 if (ver->img_type == BTINTEL_IMG_OP) { 2294 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2295 btintel_check_bdaddr(hdev); 2296 } else { 2297 /* 2298 * Check for valid bd address in boot loader mode. Device 2299 * will be marked as unconfigured if empty bd address is 2300 * found. 2301 */ 2302 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2303 bt_dev_info(hdev, "No device address configured"); 2304 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2305 } 2306 } 2307 2308 if (ver->img_type == BTINTEL_IMG_OP) { 2309 /* Controller running OP image. In case of FW downgrade, 2310 * FWID TLV may not be present and driver may attempt to load 2311 * firmware image which doesn't exist. Lets compare the version 2312 * of IML image 2313 */ 2314 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2315 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2316 else 2317 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2318 } else { 2319 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2320 } 2321 2322 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2323 if (err < 0) { 2324 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2325 /* Firmware has already been loaded */ 2326 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2327 return 0; 2328 } 2329 2330 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2331 fwname, err); 2332 2333 return err; 2334 } 2335 2336 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2337 2338 if (fw->size < 644) { 2339 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2340 fw->size); 2341 err = -EBADF; 2342 goto done; 2343 } 2344 2345 calltime = ktime_get(); 2346 2347 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2348 2349 /* Start firmware downloading and get boot parameter */ 2350 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2351 INTEL_HW_VARIANT(ver->cnvi_bt), 2352 ver->sbe_type); 2353 if (err < 0) { 2354 if (err == -EALREADY) { 2355 /* Firmware has already been loaded */ 2356 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2357 err = 0; 2358 goto done; 2359 } 2360 2361 /* When FW download fails, send Intel Reset to retry 2362 * FW download. 2363 */ 2364 btintel_reset_to_bootloader(hdev); 2365 goto done; 2366 } 2367 2368 /* Before switching the device into operational mode and with that 2369 * booting the loaded firmware, wait for the bootloader notification 2370 * that all fragments have been successfully received. 2371 * 2372 * When the event processing receives the notification, then the 2373 * BTUSB_DOWNLOADING flag will be cleared. 2374 * 2375 * The firmware loading should not take longer than 5 seconds 2376 * and thus just timeout if that happens and fail the setup 2377 * of this device. 2378 */ 2379 err = btintel_download_wait(hdev, calltime, 5000); 2380 if (err == -ETIMEDOUT) 2381 btintel_reset_to_bootloader(hdev); 2382 2383 done: 2384 release_firmware(fw); 2385 return err; 2386 } 2387 2388 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2389 __u8 link, struct bt_codec *codec, 2390 __u8 *ven_len, __u8 **ven_data) 2391 { 2392 int err = 0; 2393 2394 if (!ven_data || !ven_len) 2395 return -EINVAL; 2396 2397 *ven_len = 0; 2398 *ven_data = NULL; 2399 2400 if (link != ESCO_LINK) { 2401 bt_dev_err(hdev, "Invalid link type(%u)", link); 2402 return -EINVAL; 2403 } 2404 2405 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2406 if (!*ven_data) { 2407 err = -ENOMEM; 2408 goto error; 2409 } 2410 2411 /* supports only CVSD and mSBC offload codecs */ 2412 switch (codec->id) { 2413 case 0x02: 2414 **ven_data = 0x00; 2415 break; 2416 case 0x05: 2417 **ven_data = 0x01; 2418 break; 2419 default: 2420 err = -EINVAL; 2421 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2422 goto error; 2423 } 2424 /* codec and its capabilities are pre-defined to ids 2425 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2426 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2427 */ 2428 *ven_len = sizeof(__u8); 2429 return err; 2430 2431 error: 2432 kfree(*ven_data); 2433 *ven_data = NULL; 2434 return err; 2435 } 2436 2437 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2438 { 2439 /* Intel uses 1 as data path id for all the usecases */ 2440 *data_path_id = 1; 2441 return 0; 2442 } 2443 2444 static int btintel_configure_offload(struct hci_dev *hdev) 2445 { 2446 struct sk_buff *skb; 2447 int err = 0; 2448 struct intel_offload_use_cases *use_cases; 2449 2450 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2451 if (IS_ERR(skb)) { 2452 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2453 PTR_ERR(skb)); 2454 return PTR_ERR(skb); 2455 } 2456 2457 if (skb->len < sizeof(*use_cases)) { 2458 err = -EIO; 2459 goto error; 2460 } 2461 2462 use_cases = (void *)skb->data; 2463 2464 if (use_cases->status) { 2465 err = -bt_to_errno(skb->data[0]); 2466 goto error; 2467 } 2468 2469 if (use_cases->preset[0] & 0x03) { 2470 hdev->get_data_path_id = btintel_get_data_path_id; 2471 hdev->get_codec_config_data = btintel_get_codec_config_data; 2472 } 2473 error: 2474 kfree_skb(skb); 2475 return err; 2476 } 2477 2478 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2479 { 2480 struct sk_buff *skb; 2481 struct hci_ppag_enable_cmd ppag_cmd; 2482 acpi_handle handle; 2483 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2484 union acpi_object *p, *elements; 2485 u32 domain, mode; 2486 acpi_status status; 2487 2488 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2489 switch (ver->cnvr_top & 0xFFF) { 2490 case 0x504: /* Hrp2 */ 2491 case 0x202: /* Jfp2 */ 2492 case 0x201: /* Jfp1 */ 2493 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2494 ver->cnvr_top & 0xFFF); 2495 return; 2496 } 2497 2498 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2499 if (!handle) { 2500 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2501 return; 2502 } 2503 2504 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2505 if (ACPI_FAILURE(status)) { 2506 if (status == AE_NOT_FOUND) { 2507 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2508 return; 2509 } 2510 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2511 return; 2512 } 2513 2514 p = buffer.pointer; 2515 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2516 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2517 p->type, p->package.count); 2518 kfree(buffer.pointer); 2519 return; 2520 } 2521 2522 elements = p->package.elements; 2523 2524 /* PPAG table is located at element[1] */ 2525 p = &elements[1]; 2526 2527 domain = (u32)p->package.elements[0].integer.value; 2528 mode = (u32)p->package.elements[1].integer.value; 2529 kfree(buffer.pointer); 2530 2531 if (domain != 0x12) { 2532 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2533 return; 2534 } 2535 2536 /* PPAG mode 2537 * BIT 0 : 0 Disabled in EU 2538 * 1 Enabled in EU 2539 * BIT 1 : 0 Disabled in China 2540 * 1 Enabled in China 2541 */ 2542 mode &= 0x03; 2543 2544 if (!mode) { 2545 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2546 return; 2547 } 2548 2549 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2550 2551 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2552 &ppag_cmd, HCI_CMD_TIMEOUT); 2553 if (IS_ERR(skb)) { 2554 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2555 return; 2556 } 2557 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2558 kfree_skb(skb); 2559 } 2560 2561 static int btintel_acpi_reset_method(struct hci_dev *hdev) 2562 { 2563 int ret = 0; 2564 acpi_status status; 2565 union acpi_object *p, *ref; 2566 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2567 2568 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2569 if (ACPI_FAILURE(status)) { 2570 bt_dev_err(hdev, "Failed to run _PRR method"); 2571 ret = -ENODEV; 2572 return ret; 2573 } 2574 p = buffer.pointer; 2575 2576 if (p->package.count != 1 || p->type != ACPI_TYPE_PACKAGE) { 2577 bt_dev_err(hdev, "Invalid arguments"); 2578 ret = -EINVAL; 2579 goto exit_on_error; 2580 } 2581 2582 ref = &p->package.elements[0]; 2583 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2584 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2585 ret = -EINVAL; 2586 goto exit_on_error; 2587 } 2588 2589 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2590 if (ACPI_FAILURE(status)) { 2591 bt_dev_err(hdev, "Failed to run_RST method"); 2592 ret = -ENODEV; 2593 goto exit_on_error; 2594 } 2595 2596 exit_on_error: 2597 kfree(buffer.pointer); 2598 return ret; 2599 } 2600 2601 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2602 struct intel_version_tlv *ver_tlv) 2603 { 2604 struct btintel_data *data = hci_get_priv(hdev); 2605 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2606 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2607 union acpi_object *obj, argv4; 2608 enum { 2609 RESET_TYPE_WDISABLE2, 2610 RESET_TYPE_VSEC 2611 }; 2612 2613 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2614 2615 if (!handle) { 2616 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2617 return; 2618 } 2619 2620 if (!acpi_has_method(handle, "_PRR")) { 2621 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2622 return; 2623 } 2624 2625 switch (ver_tlv->cnvi_top & 0xfff) { 2626 case 0x910: /* GalePeak2 */ 2627 reset_payload[2] = RESET_TYPE_VSEC; 2628 break; 2629 default: 2630 /* WDISABLE2 is the default reset method */ 2631 reset_payload[2] = RESET_TYPE_WDISABLE2; 2632 2633 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2634 BIT(DSM_SET_WDISABLE2_DELAY))) { 2635 bt_dev_err(hdev, "No dsm support to set reset delay"); 2636 return; 2637 } 2638 argv4.integer.type = ACPI_TYPE_INTEGER; 2639 /* delay required to toggle BT power */ 2640 argv4.integer.value = 160; 2641 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2642 DSM_SET_WDISABLE2_DELAY, &argv4); 2643 if (!obj) { 2644 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2645 return; 2646 } 2647 ACPI_FREE(obj); 2648 } 2649 2650 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2651 2652 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2653 DSM_SET_RESET_METHOD)) { 2654 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2655 return; 2656 } 2657 argv4.buffer.type = ACPI_TYPE_BUFFER; 2658 argv4.buffer.length = sizeof(reset_payload); 2659 argv4.buffer.pointer = reset_payload; 2660 2661 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2662 DSM_SET_RESET_METHOD, &argv4); 2663 if (!obj) { 2664 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2665 return; 2666 } 2667 ACPI_FREE(obj); 2668 data->acpi_reset_method = btintel_acpi_reset_method; 2669 } 2670 2671 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2672 2673 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2674 { 2675 /* 2676 * Distinguish ISO data packets form ACL data packets 2677 * based on their connection handle value range. 2678 */ 2679 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2680 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2681 2682 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) 2683 return HCI_ISODATA_PKT; 2684 } 2685 2686 return hci_skb_pkt_type(skb); 2687 } 2688 2689 /* 2690 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2691 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2692 * overcome the potential STEP errors on their designs. Based on the 2693 * configauration, bluetooth firmware shall adjust the BRI response line drive 2694 * strength. The below structure represents DSBR data. 2695 * struct { 2696 * u8 header; 2697 * u32 dsbr; 2698 * } __packed; 2699 * 2700 * header - defines revision number of the structure 2701 * dsbr - defines drive strength BRI response 2702 * bit0 2703 * 0 - instructs bluetooth firmware to use default values 2704 * 1 - instructs bluetooth firmware to override default values 2705 * bit3:1 2706 * Reserved 2707 * bit7:4 2708 * DSBR override values (only if bit0 is set. Default value is 0xF 2709 * bit31:7 2710 * Reserved 2711 * Expected values for dsbr field: 2712 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2713 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2714 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2715 * that the resistor on board is 10 Ohm 2716 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2717 * firmware to use default values. 2718 * 2719 */ 2720 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2721 { 2722 struct btintel_dsbr { 2723 u8 header; 2724 u32 dsbr; 2725 } __packed data; 2726 2727 efi_status_t status; 2728 unsigned long data_size = sizeof(data); 2729 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2730 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2731 2732 if (!IS_ENABLED(CONFIG_EFI)) 2733 return -EOPNOTSUPP; 2734 2735 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2736 return -EOPNOTSUPP; 2737 2738 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2739 &data); 2740 2741 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2742 return -ENXIO; 2743 2744 *dsbr_var = data.dsbr; 2745 return 0; 2746 } 2747 2748 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2749 { 2750 struct btintel_dsbr_cmd { 2751 u8 enable; 2752 u8 dsbr; 2753 } __packed; 2754 2755 struct btintel_dsbr_cmd cmd; 2756 struct sk_buff *skb; 2757 u32 dsbr, cnvi; 2758 u8 status; 2759 int err; 2760 2761 cnvi = ver->cnvi_top & 0xfff; 2762 /* DSBR command needs to be sent for, 2763 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2764 * 2. Gale Peak2 or BlazarU in OP image. 2765 * 3. Scorpious Peak in IML image. 2766 */ 2767 2768 switch (cnvi) { 2769 case BTINTEL_CNVI_BLAZARI: 2770 case BTINTEL_CNVI_BLAZARIW: 2771 if (ver->img_type == BTINTEL_IMG_IML && 2772 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2773 break; 2774 return 0; 2775 case BTINTEL_CNVI_GAP: 2776 case BTINTEL_CNVI_BLAZARU: 2777 if (ver->img_type == BTINTEL_IMG_OP && 2778 hdev->bus == HCI_USB) 2779 break; 2780 return 0; 2781 case BTINTEL_CNVI_SCP: 2782 if (ver->img_type == BTINTEL_IMG_IML) 2783 break; 2784 return 0; 2785 default: 2786 return 0; 2787 } 2788 2789 dsbr = 0; 2790 err = btintel_uefi_get_dsbr(&dsbr); 2791 if (err < 0) 2792 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2793 BTINTEL_EFI_DSBR, err); 2794 2795 cmd.enable = dsbr & BIT(0); 2796 cmd.dsbr = dsbr >> 4 & 0xF; 2797 2798 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2799 cmd.dsbr); 2800 2801 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2802 if (IS_ERR(skb)) 2803 return -bt_to_errno(PTR_ERR(skb)); 2804 2805 status = skb->data[0]; 2806 kfree_skb(skb); 2807 2808 if (status) 2809 return -bt_to_errno(status); 2810 2811 return 0; 2812 } 2813 2814 #ifdef CONFIG_ACPI 2815 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2816 acpi_string method, 2817 union acpi_object **ptr, 2818 u8 pkg_size) 2819 { 2820 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2821 union acpi_object *p; 2822 acpi_status status; 2823 acpi_handle handle; 2824 2825 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2826 if (!handle) { 2827 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2828 return AE_NOT_EXIST; 2829 } 2830 2831 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2832 2833 if (ACPI_FAILURE(status)) { 2834 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2835 acpi_format_exception(status), method); 2836 return status; 2837 } 2838 2839 p = buffer.pointer; 2840 2841 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2842 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2843 p->type, p->package.count); 2844 kfree(buffer.pointer); 2845 return AE_ERROR; 2846 } 2847 2848 *ptr = buffer.pointer; 2849 return 0; 2850 } 2851 2852 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2853 { 2854 union acpi_object *domain, *bt_pkg; 2855 int i; 2856 2857 for (i = 1; i < buffer->package.count; i++) { 2858 bt_pkg = &buffer->package.elements[i]; 2859 domain = &bt_pkg->package.elements[0]; 2860 if (domain->type == ACPI_TYPE_INTEGER && 2861 domain->integer.value == BTINTEL_BT_DOMAIN) 2862 return bt_pkg; 2863 } 2864 return ERR_PTR(-ENOENT); 2865 } 2866 2867 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2868 { 2869 struct sk_buff *skb; 2870 2871 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2872 if (IS_ERR(skb)) { 2873 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2874 le16_to_cpu(data->id), PTR_ERR(skb)); 2875 return PTR_ERR(skb); 2876 } 2877 kfree_skb(skb); 2878 return 0; 2879 } 2880 2881 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2882 int id, struct btintel_sar_inc_pwr *sar) 2883 { 2884 cmd->len = 5; 2885 cmd->id = cpu_to_le16(id); 2886 cmd->data[0] = sar->br >> 3; 2887 cmd->data[1] = sar->edr2 >> 3; 2888 cmd->data[2] = sar->edr3 >> 3; 2889 return btintel_send_sar_ddc(hdev, cmd, 6); 2890 } 2891 2892 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2893 int id, struct btintel_sar_inc_pwr *sar) 2894 { 2895 cmd->len = 3; 2896 cmd->id = cpu_to_le16(id); 2897 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 2898 return btintel_send_sar_ddc(hdev, cmd, 4); 2899 } 2900 2901 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2902 int id, struct btintel_sar_inc_pwr *sar) 2903 { 2904 cmd->len = 3; 2905 cmd->id = cpu_to_le16(id); 2906 cmd->data[0] = sar->br >> 3; 2907 return btintel_send_sar_ddc(hdev, cmd, 4); 2908 } 2909 2910 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2911 int id, struct btintel_sar_inc_pwr *sar) 2912 { 2913 cmd->len = 3; 2914 cmd->id = cpu_to_le16(id); 2915 cmd->data[0] = sar->br; 2916 return btintel_send_sar_ddc(hdev, cmd, 4); 2917 } 2918 2919 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2920 int id, struct btintel_sar_inc_pwr *sar) 2921 { 2922 cmd->len = 3; 2923 cmd->id = cpu_to_le16(id); 2924 cmd->data[0] = sar->edr2; 2925 return btintel_send_sar_ddc(hdev, cmd, 4); 2926 } 2927 2928 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2929 int id, struct btintel_sar_inc_pwr *sar) 2930 { 2931 cmd->len = 3; 2932 cmd->id = cpu_to_le16(id); 2933 cmd->data[0] = sar->edr3; 2934 return btintel_send_sar_ddc(hdev, cmd, 4); 2935 } 2936 2937 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 2938 { 2939 struct btintel_cp_ddc_write *cmd; 2940 u8 buffer[64]; 2941 int ret; 2942 2943 cmd = (void *)buffer; 2944 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 2945 if (ret) 2946 return ret; 2947 2948 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 2949 if (ret) 2950 return ret; 2951 2952 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 2953 if (ret) 2954 return ret; 2955 2956 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 2957 if (ret) 2958 return ret; 2959 2960 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 2961 if (ret) 2962 return ret; 2963 2964 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 2965 if (ret) 2966 return ret; 2967 2968 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 2969 2970 return ret; 2971 } 2972 2973 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 2974 { 2975 struct btintel_cp_ddc_write *cmd; 2976 struct sk_buff *skb; 2977 u8 buffer[64]; 2978 bool enable; 2979 int ret; 2980 2981 cmd = (void *)buffer; 2982 2983 cmd->len = 3; 2984 cmd->id = cpu_to_le16(0x019e); 2985 2986 if (sar->revision == BTINTEL_SAR_INC_PWR && 2987 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 2988 cmd->data[0] = 0x01; 2989 else 2990 cmd->data[0] = 0x00; 2991 2992 ret = btintel_send_sar_ddc(hdev, cmd, 4); 2993 if (ret) 2994 return ret; 2995 2996 if (sar->revision == BTINTEL_SAR_INC_PWR && 2997 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 2998 cmd->len = 3; 2999 cmd->id = cpu_to_le16(0x019f); 3000 cmd->data[0] = sar->sar_2400_chain_a; 3001 3002 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3003 if (ret) 3004 return ret; 3005 } 3006 3007 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3008 if (ret) 3009 return ret; 3010 3011 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3012 if (ret) 3013 return ret; 3014 3015 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3016 if (ret) 3017 return ret; 3018 3019 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3020 if (ret) 3021 return ret; 3022 3023 enable = true; 3024 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3025 if (IS_ERR(skb)) { 3026 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3027 return PTR_ERR(skb); 3028 } 3029 3030 kfree_skb(skb); 3031 return 0; 3032 } 3033 3034 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3035 struct intel_version_tlv *ver) 3036 { 3037 u16 cnvi, cnvr; 3038 int ret; 3039 3040 cnvi = ver->cnvi_top & 0xfff; 3041 cnvr = ver->cnvr_top & 0xfff; 3042 3043 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3044 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3045 ret = btintel_set_legacy_sar(hdev, sar); 3046 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3047 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3048 ret = btintel_set_mutual_sar(hdev, sar); 3049 } else { 3050 ret = -EOPNOTSUPP; 3051 } 3052 3053 return ret; 3054 } 3055 3056 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3057 { 3058 union acpi_object *bt_pkg, *buffer = NULL; 3059 struct btintel_sar_inc_pwr sar; 3060 acpi_status status; 3061 u8 revision; 3062 int ret; 3063 3064 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3065 if (ACPI_FAILURE(status)) 3066 return -ENOENT; 3067 3068 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3069 3070 if (IS_ERR(bt_pkg)) { 3071 ret = PTR_ERR(bt_pkg); 3072 goto error; 3073 } 3074 3075 if (!bt_pkg->package.count) { 3076 ret = -EINVAL; 3077 goto error; 3078 } 3079 3080 revision = buffer->package.elements[0].integer.value; 3081 3082 if (revision > BTINTEL_SAR_INC_PWR) { 3083 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3084 ret = -EOPNOTSUPP; 3085 goto error; 3086 } 3087 3088 memset(&sar, 0, sizeof(sar)); 3089 3090 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3091 sar.revision = revision; 3092 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3093 sar.br = bt_pkg->package.elements[2].integer.value; 3094 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3095 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3096 sar.le = bt_pkg->package.elements[5].integer.value; 3097 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3098 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3099 3100 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3101 sar.revision = revision; 3102 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3103 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3104 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3105 sar.br = bt_pkg->package.elements[4].integer.value; 3106 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3107 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3108 sar.le = bt_pkg->package.elements[7].integer.value; 3109 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3110 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3111 } else { 3112 ret = -EINVAL; 3113 goto error; 3114 } 3115 3116 /* Apply only if it is enabled in BIOS */ 3117 if (sar.bt_sar_bios != 1) { 3118 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3119 ret = -EOPNOTSUPP; 3120 goto error; 3121 } 3122 3123 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3124 error: 3125 kfree(buffer); 3126 return ret; 3127 } 3128 #endif /* CONFIG_ACPI */ 3129 3130 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3131 struct intel_version_tlv *ver) 3132 { 3133 #ifdef CONFIG_ACPI 3134 return btintel_acpi_set_sar(hdev, ver); 3135 #endif 3136 return 0; 3137 } 3138 3139 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3140 struct intel_version_tlv *ver) 3141 { 3142 u32 boot_param; 3143 char ddcname[64]; 3144 int err; 3145 struct intel_version_tlv new_ver; 3146 3147 bt_dev_dbg(hdev, ""); 3148 3149 /* Set the default boot parameter to 0x0 and it is updated to 3150 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3151 * command while downloading the firmware. 3152 */ 3153 boot_param = 0x00000000; 3154 3155 /* In case of PCIe, this function might get called multiple times with 3156 * same hdev instance if there is any error on firmware download. 3157 * Need to clear stale bits of previous firmware download attempt. 3158 */ 3159 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3160 btintel_clear_flag(hdev, i); 3161 3162 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3163 3164 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3165 if (err) 3166 return err; 3167 3168 /* check if controller is already having an operational firmware */ 3169 if (ver->img_type == BTINTEL_IMG_OP) 3170 goto finish; 3171 3172 err = btintel_boot(hdev, boot_param); 3173 if (err) 3174 return err; 3175 3176 err = btintel_read_version_tlv(hdev, ver); 3177 if (err) 3178 return err; 3179 3180 /* set drive strength of BRI response */ 3181 err = btintel_set_dsbr(hdev, ver); 3182 if (err) { 3183 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3184 return err; 3185 } 3186 3187 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3188 * intermediate loader image 3189 */ 3190 if (ver->img_type == BTINTEL_IMG_IML) { 3191 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3192 if (err) 3193 return err; 3194 3195 err = btintel_boot(hdev, boot_param); 3196 if (err) 3197 return err; 3198 } 3199 3200 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3201 3202 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3203 /* Once the device is running in operational mode, it needs to 3204 * apply the device configuration (DDC) parameters. 3205 * 3206 * The device can work without DDC parameters, so even if it 3207 * fails to load the file, no need to fail the setup. 3208 */ 3209 btintel_load_ddc_config(hdev, ddcname); 3210 3211 /* Read supported use cases and set callbacks to fetch datapath id */ 3212 btintel_configure_offload(hdev); 3213 3214 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3215 3216 /* Send sar values to controller */ 3217 btintel_set_specific_absorption_rate(hdev, ver); 3218 3219 /* Set PPAG feature */ 3220 btintel_set_ppag(hdev, ver); 3221 3222 /* Read the Intel version information after loading the FW */ 3223 err = btintel_read_version_tlv(hdev, &new_ver); 3224 if (err) 3225 return err; 3226 3227 btintel_version_info_tlv(hdev, &new_ver); 3228 3229 finish: 3230 /* Set the event mask for Intel specific vendor events. This enables 3231 * a few extra events that are useful during general operation. It 3232 * does not enable any debugging related events. 3233 * 3234 * The device will function correctly without these events enabled 3235 * and thus no need to fail the setup. 3236 */ 3237 btintel_set_event_mask(hdev, false); 3238 3239 return 0; 3240 } 3241 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3242 3243 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3244 { 3245 switch (hw_variant) { 3246 /* Legacy bootloader devices that supports MSFT Extension */ 3247 case 0x11: /* JfP */ 3248 case 0x12: /* ThP */ 3249 case 0x13: /* HrP */ 3250 case 0x14: /* CcP */ 3251 /* All Intel new generation controllers support the Microsoft vendor 3252 * extension are using 0xFC1E for VsMsftOpCode. 3253 */ 3254 case 0x17: 3255 case 0x18: 3256 case 0x19: 3257 case 0x1b: 3258 case 0x1c: 3259 case 0x1d: 3260 case 0x1e: 3261 case 0x1f: 3262 case 0x22: 3263 hci_set_msft_opcode(hdev, 0xFC1E); 3264 break; 3265 default: 3266 /* Not supported */ 3267 break; 3268 } 3269 } 3270 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3271 3272 void btintel_print_fseq_info(struct hci_dev *hdev) 3273 { 3274 struct sk_buff *skb; 3275 u8 *p; 3276 u32 val; 3277 const char *str; 3278 3279 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3280 if (IS_ERR(skb)) { 3281 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3282 PTR_ERR(skb)); 3283 return; 3284 } 3285 3286 if (skb->len < (sizeof(u32) * 16 + 2)) { 3287 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3288 skb->len); 3289 kfree_skb(skb); 3290 return; 3291 } 3292 3293 p = skb_pull_data(skb, 1); 3294 if (*p) { 3295 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3296 kfree_skb(skb); 3297 return; 3298 } 3299 3300 p = skb_pull_data(skb, 1); 3301 switch (*p) { 3302 case 0: 3303 str = "Success"; 3304 break; 3305 case 1: 3306 str = "Fatal error"; 3307 break; 3308 case 2: 3309 str = "Semaphore acquire error"; 3310 break; 3311 default: 3312 str = "Unknown error"; 3313 break; 3314 } 3315 3316 if (*p) { 3317 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3318 kfree_skb(skb); 3319 return; 3320 } 3321 3322 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3323 3324 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3325 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3326 3327 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3328 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3329 3330 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3331 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3332 3333 p = skb->data; 3334 skb_pull_data(skb, 4); 3335 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3336 p[2], p[3]); 3337 3338 p = skb->data; 3339 skb_pull_data(skb, 4); 3340 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3341 p[2], p[3]); 3342 3343 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3344 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3345 3346 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3347 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3348 3349 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3350 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3351 3352 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3353 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3354 3355 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3356 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3357 3358 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3359 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3360 3361 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3362 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3363 3364 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3365 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3366 3367 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3368 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3369 3370 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3371 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3372 3373 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3374 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3375 3376 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3377 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3378 3379 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3380 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3381 3382 kfree_skb(skb); 3383 } 3384 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3385 3386 static int btintel_setup_combined(struct hci_dev *hdev) 3387 { 3388 const u8 param[1] = { 0xFF }; 3389 struct intel_version ver; 3390 struct intel_version_tlv ver_tlv; 3391 struct sk_buff *skb; 3392 int err; 3393 3394 BT_DBG("%s", hdev->name); 3395 3396 /* The some controllers have a bug with the first HCI command sent to it 3397 * returning number of completed commands as zero. This would stall the 3398 * command processing in the Bluetooth core. 3399 * 3400 * As a workaround, send HCI Reset command first which will reset the 3401 * number of completed commands and allow normal command processing 3402 * from now on. 3403 * 3404 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3405 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3406 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3407 * state, the only way to exit out of it is sending the HCI_Reset 3408 * command. 3409 */ 3410 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3411 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3412 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3413 HCI_INIT_TIMEOUT); 3414 if (IS_ERR(skb)) { 3415 bt_dev_err(hdev, 3416 "sending initial HCI reset failed (%ld)", 3417 PTR_ERR(skb)); 3418 return PTR_ERR(skb); 3419 } 3420 kfree_skb(skb); 3421 } 3422 3423 /* Starting from TyP device, the command parameter and response are 3424 * changed even though the OCF for HCI_Intel_Read_Version command 3425 * remains same. The legacy devices can handle even if the 3426 * command has a parameter and returns a correct version information. 3427 * So, it uses new format to support both legacy and new format. 3428 */ 3429 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3430 if (IS_ERR(skb)) { 3431 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3432 PTR_ERR(skb)); 3433 return PTR_ERR(skb); 3434 } 3435 3436 /* Check the status */ 3437 if (skb->data[0]) { 3438 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3439 skb->data[0]); 3440 err = -EIO; 3441 goto exit_error; 3442 } 3443 3444 /* Apply the common HCI quirks for Intel device */ 3445 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3446 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3447 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3448 3449 /* Set up the quality report callback for Intel devices */ 3450 hdev->set_quality_report = btintel_set_quality_report; 3451 3452 /* For Legacy device, check the HW platform value and size */ 3453 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3454 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3455 3456 memcpy(&ver, skb->data, sizeof(ver)); 3457 3458 /* Display version information */ 3459 btintel_version_info(hdev, &ver); 3460 3461 /* Check for supported iBT hardware variants of this firmware 3462 * loading method. 3463 * 3464 * This check has been put in place to ensure correct forward 3465 * compatibility options when newer hardware variants come 3466 * along. 3467 */ 3468 switch (ver.hw_variant) { 3469 case 0x07: /* WP */ 3470 case 0x08: /* StP */ 3471 /* Legacy ROM product */ 3472 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3473 3474 /* Apply the device specific HCI quirks 3475 * 3476 * WBS for SdP - For the Legacy ROM products, only SdP 3477 * supports the WBS. But the version information is not 3478 * enough to use here because the StP2 and SdP have same 3479 * hw_variant and fw_variant. So, this flag is set by 3480 * the transport driver (btusb) based on the HW info 3481 * (idProduct) 3482 */ 3483 if (!btintel_test_flag(hdev, 3484 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3485 hci_set_quirk(hdev, 3486 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3487 3488 err = btintel_legacy_rom_setup(hdev, &ver); 3489 break; 3490 case 0x0b: /* SfP */ 3491 case 0x11: /* JfP */ 3492 case 0x12: /* ThP */ 3493 case 0x13: /* HrP */ 3494 case 0x14: /* CcP */ 3495 fallthrough; 3496 case 0x0c: /* WsP */ 3497 /* Apply the device specific HCI quirks 3498 * 3499 * All Legacy bootloader devices support WBS 3500 */ 3501 hci_set_quirk(hdev, 3502 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3503 3504 /* These variants don't seem to support LE Coded PHY */ 3505 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3506 3507 /* Setup MSFT Extension support */ 3508 btintel_set_msft_opcode(hdev, ver.hw_variant); 3509 3510 err = btintel_bootloader_setup(hdev, &ver); 3511 btintel_register_devcoredump_support(hdev); 3512 break; 3513 default: 3514 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3515 ver.hw_variant); 3516 err = -EINVAL; 3517 } 3518 3519 hci_set_hw_info(hdev, 3520 "INTEL platform=%u variant=%u revision=%u", 3521 ver.hw_platform, ver.hw_variant, 3522 ver.hw_revision); 3523 3524 goto exit_error; 3525 } 3526 3527 /* memset ver_tlv to start with clean state as few fields are exclusive 3528 * to bootloader mode and are not populated in operational mode 3529 */ 3530 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3531 /* For TLV type device, parse the tlv data */ 3532 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3533 if (err) { 3534 bt_dev_err(hdev, "Failed to parse TLV version information"); 3535 goto exit_error; 3536 } 3537 3538 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3539 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3540 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3541 err = -EINVAL; 3542 goto exit_error; 3543 } 3544 3545 /* Check for supported iBT hardware variants of this firmware 3546 * loading method. 3547 * 3548 * This check has been put in place to ensure correct forward 3549 * compatibility options when newer hardware variants come 3550 * along. 3551 */ 3552 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3553 case 0x11: /* JfP */ 3554 case 0x12: /* ThP */ 3555 case 0x13: /* HrP */ 3556 case 0x14: /* CcP */ 3557 /* Some legacy bootloader devices starting from JfP, 3558 * the operational firmware supports both old and TLV based 3559 * HCI_Intel_Read_Version command based on the command 3560 * parameter. 3561 * 3562 * For upgrading firmware case, the TLV based version cannot 3563 * be used because the firmware filename for legacy bootloader 3564 * is based on the old format. 3565 * 3566 * Also, it is not easy to convert TLV based version from the 3567 * legacy version format. 3568 * 3569 * So, as a workaround for those devices, use the legacy 3570 * HCI_Intel_Read_Version to get the version information and 3571 * run the legacy bootloader setup. 3572 */ 3573 err = btintel_read_version(hdev, &ver); 3574 if (err) 3575 break; 3576 3577 /* Apply the device specific HCI quirks 3578 * 3579 * All Legacy bootloader devices support WBS 3580 */ 3581 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3582 3583 /* These variants don't seem to support LE Coded PHY */ 3584 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3585 3586 /* Setup MSFT Extension support */ 3587 btintel_set_msft_opcode(hdev, ver.hw_variant); 3588 3589 err = btintel_bootloader_setup(hdev, &ver); 3590 btintel_register_devcoredump_support(hdev); 3591 break; 3592 case 0x18: /* GfP2 */ 3593 case 0x1c: /* GaP */ 3594 /* Re-classify packet type for controllers with LE audio */ 3595 hdev->classify_pkt_type = btintel_classify_pkt_type; 3596 fallthrough; 3597 case 0x17: 3598 case 0x19: 3599 case 0x1b: 3600 case 0x1d: 3601 case 0x1e: 3602 case 0x1f: 3603 case 0x22: 3604 /* Display version information of TLV type */ 3605 btintel_version_info_tlv(hdev, &ver_tlv); 3606 3607 /* Apply the device specific HCI quirks for TLV based devices 3608 * 3609 * All TLV based devices support WBS 3610 */ 3611 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3612 3613 /* Setup MSFT Extension support */ 3614 btintel_set_msft_opcode(hdev, 3615 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3616 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3617 3618 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3619 if (err) 3620 goto exit_error; 3621 3622 btintel_register_devcoredump_support(hdev); 3623 btintel_print_fseq_info(hdev); 3624 break; 3625 default: 3626 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3627 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3628 err = -EINVAL; 3629 break; 3630 } 3631 3632 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3633 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3634 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3635 3636 exit_error: 3637 kfree_skb(skb); 3638 3639 return err; 3640 } 3641 3642 int btintel_shutdown_combined(struct hci_dev *hdev) 3643 { 3644 struct sk_buff *skb; 3645 int ret; 3646 3647 /* Send HCI Reset to the controller to stop any BT activity which 3648 * were triggered. This will help to save power and maintain the 3649 * sync b/w Host and controller 3650 */ 3651 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3652 if (IS_ERR(skb)) { 3653 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3654 return PTR_ERR(skb); 3655 } 3656 kfree_skb(skb); 3657 3658 3659 /* Some platforms have an issue with BT LED when the interface is 3660 * down or BT radio is turned off, which takes 5 seconds to BT LED 3661 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3662 * device in the RFKILL ON state which turns off the BT LED immediately. 3663 */ 3664 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3665 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3666 if (IS_ERR(skb)) { 3667 ret = PTR_ERR(skb); 3668 bt_dev_err(hdev, "turning off Intel device LED failed"); 3669 return ret; 3670 } 3671 kfree_skb(skb); 3672 } 3673 3674 return 0; 3675 } 3676 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3677 3678 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3679 { 3680 hdev->manufacturer = 2; 3681 hdev->setup = btintel_setup_combined; 3682 hdev->shutdown = btintel_shutdown_combined; 3683 hdev->hw_error = btintel_hw_error; 3684 hdev->set_diag = btintel_set_diag_combined; 3685 hdev->set_bdaddr = btintel_set_bdaddr; 3686 3687 coredump_info.driver_name = driver_name; 3688 3689 return 0; 3690 } 3691 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3692 3693 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3694 { 3695 struct intel_tlv *tlv = (void *)&skb->data[5]; 3696 3697 /* The first event is always an event type TLV */ 3698 if (tlv->type != INTEL_TLV_TYPE_ID) 3699 goto recv_frame; 3700 3701 switch (tlv->val[0]) { 3702 case INTEL_TLV_SYSTEM_EXCEPTION: 3703 case INTEL_TLV_FATAL_EXCEPTION: 3704 case INTEL_TLV_DEBUG_EXCEPTION: 3705 case INTEL_TLV_TEST_EXCEPTION: 3706 /* Generate devcoredump from exception */ 3707 if (!hci_devcd_init(hdev, skb->len)) { 3708 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 3709 hci_devcd_complete(hdev); 3710 } else { 3711 bt_dev_err(hdev, "Failed to generate devcoredump"); 3712 } 3713 break; 3714 default: 3715 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3716 } 3717 3718 recv_frame: 3719 return hci_recv_frame(hdev, skb); 3720 } 3721 3722 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3723 { 3724 struct hci_event_hdr *hdr = (void *)skb->data; 3725 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3726 3727 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 3728 hdr->plen > 0) { 3729 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3730 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3731 3732 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3733 switch (skb->data[2]) { 3734 case 0x02: 3735 /* When switching to the operational firmware 3736 * the device sends a vendor specific event 3737 * indicating that the bootup completed. 3738 */ 3739 btintel_bootup(hdev, ptr, len); 3740 kfree_skb(skb); 3741 return 0; 3742 case 0x06: 3743 /* When the firmware loading completes the 3744 * device sends out a vendor specific event 3745 * indicating the result of the firmware 3746 * loading. 3747 */ 3748 btintel_secure_send_result(hdev, ptr, len); 3749 kfree_skb(skb); 3750 return 0; 3751 } 3752 } 3753 3754 /* Handle all diagnostics events separately. May still call 3755 * hci_recv_frame. 3756 */ 3757 if (len >= sizeof(diagnostics_hdr) && 3758 memcmp(&skb->data[2], diagnostics_hdr, 3759 sizeof(diagnostics_hdr)) == 0) { 3760 return btintel_diagnostics(hdev, skb); 3761 } 3762 } 3763 3764 return hci_recv_frame(hdev, skb); 3765 } 3766 EXPORT_SYMBOL_GPL(btintel_recv_event); 3767 3768 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 3769 { 3770 const struct intel_bootup *evt = ptr; 3771 3772 if (len != sizeof(*evt)) 3773 return; 3774 3775 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 3776 btintel_wake_up_flag(hdev, INTEL_BOOTING); 3777 } 3778 EXPORT_SYMBOL_GPL(btintel_bootup); 3779 3780 void btintel_secure_send_result(struct hci_dev *hdev, 3781 const void *ptr, unsigned int len) 3782 { 3783 const struct intel_secure_send_result *evt = ptr; 3784 3785 if (len != sizeof(*evt)) 3786 return; 3787 3788 if (evt->result) 3789 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 3790 3791 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 3792 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 3793 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 3794 } 3795 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 3796 3797 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3798 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 3799 MODULE_VERSION(VERSION); 3800 MODULE_LICENSE("GPL"); 3801 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 3802 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 3803 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 3804 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 3805