1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Bluetooth support for Intel devices
5 *
6 * Copyright (C) 2015 Intel Corporation
7 */
8
9 #include <linux/module.h>
10 #include <linux/firmware.h>
11 #include <linux/regmap.h>
12 #include <linux/string_choices.h>
13 #include <linux/acpi.h>
14 #include <acpi/acpi_bus.h>
15 #include <linux/unaligned.h>
16 #include <linux/efi.h>
17
18 #include <net/bluetooth/bluetooth.h>
19 #include <net/bluetooth/hci_core.h>
20
21 #include "btintel.h"
22
23 #define VERSION "0.1"
24
25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
26 #define RSA_HEADER_LEN 644
27 #define CSS_HEADER_OFFSET 8
28 #define ECDSA_OFFSET 644
29 #define ECDSA_HEADER_LEN 320
30
31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR"
32
33 enum {
34 DSM_SET_WDISABLE2_DELAY = 1,
35 DSM_SET_RESET_METHOD = 3,
36 };
37
38 /* Hybrid ECDSA + LMS */
39 #define BTINTEL_RSA_HEADER_VER 0x00010000
40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000
41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700
42 #define BTINTEL_ECDSA_OFFSET 128
43 #define BTINTEL_CSS_HEADER_SIZE 128
44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96
45 #define BTINTEL_ECDSA_SIG_SIZE 96
46 #define BTINTEL_LMS_OFFSET 320
47 #define BTINTEL_LMS_PUB_KEY_SIZE 52
48 #define BTINTEL_LMS_SIG_SIZE 1744
49 #define BTINTEL_CMD_BUFFER_OFFSET 2116
50
51 #define BTINTEL_BT_DOMAIN 0x12
52 #define BTINTEL_SAR_LEGACY 0
53 #define BTINTEL_SAR_INC_PWR 1
54 #define BTINTEL_SAR_REV2 2
55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0
56
57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e
58 struct cmd_write_boot_params {
59 __le32 boot_addr;
60 u8 fw_build_num;
61 u8 fw_build_ww;
62 u8 fw_build_yy;
63 } __packed;
64
65 static struct {
66 const char *driver_name;
67 u8 hw_variant;
68 u32 fw_build_num;
69 } coredump_info;
70
71 const guid_t btintel_guid_dsm =
72 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233,
73 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9);
74 EXPORT_SYMBOL_GPL(btintel_guid_dsm);
75
btintel_check_bdaddr(struct hci_dev * hdev)76 int btintel_check_bdaddr(struct hci_dev *hdev)
77 {
78 struct hci_rp_read_bd_addr *bda;
79 struct sk_buff *skb;
80
81 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
82 HCI_INIT_TIMEOUT);
83 if (IS_ERR(skb)) {
84 int err = PTR_ERR(skb);
85 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
86 err);
87 return err;
88 }
89
90 if (skb->len != sizeof(*bda)) {
91 bt_dev_err(hdev, "Intel device address length mismatch");
92 kfree_skb(skb);
93 return -EIO;
94 }
95
96 bda = (struct hci_rp_read_bd_addr *)skb->data;
97
98 /* For some Intel based controllers, the default Bluetooth device
99 * address 00:03:19:9E:8B:00 can be found. These controllers are
100 * fully operational, but have the danger of duplicate addresses
101 * and that in turn can cause problems with Bluetooth operation.
102 */
103 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
104 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
105 &bda->bdaddr);
106 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
107 }
108
109 kfree_skb(skb);
110
111 return 0;
112 }
113 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
114
btintel_enter_mfg(struct hci_dev * hdev)115 int btintel_enter_mfg(struct hci_dev *hdev)
116 {
117 static const u8 param[] = { 0x01, 0x00 };
118 struct sk_buff *skb;
119
120 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
121 if (IS_ERR(skb)) {
122 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
123 PTR_ERR(skb));
124 return PTR_ERR(skb);
125 }
126 kfree_skb(skb);
127
128 return 0;
129 }
130 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
131
btintel_exit_mfg(struct hci_dev * hdev,bool reset,bool patched)132 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
133 {
134 u8 param[] = { 0x00, 0x00 };
135 struct sk_buff *skb;
136
137 /* The 2nd command parameter specifies the manufacturing exit method:
138 * 0x00: Just disable the manufacturing mode (0x00).
139 * 0x01: Disable manufacturing mode and reset with patches deactivated.
140 * 0x02: Disable manufacturing mode and reset with patches activated.
141 */
142 if (reset)
143 param[1] |= patched ? 0x02 : 0x01;
144
145 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
146 if (IS_ERR(skb)) {
147 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
148 PTR_ERR(skb));
149 return PTR_ERR(skb);
150 }
151 kfree_skb(skb);
152
153 return 0;
154 }
155 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
156
btintel_set_bdaddr(struct hci_dev * hdev,const bdaddr_t * bdaddr)157 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
158 {
159 struct sk_buff *skb;
160 int err;
161
162 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
163 if (IS_ERR(skb)) {
164 err = PTR_ERR(skb);
165 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
166 err);
167 return err;
168 }
169 kfree_skb(skb);
170
171 return 0;
172 }
173 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
174
btintel_set_event_mask(struct hci_dev * hdev,bool debug)175 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
176 {
177 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
178 struct sk_buff *skb;
179 int err;
180
181 if (debug)
182 mask[1] |= 0x62;
183
184 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
185 if (IS_ERR(skb)) {
186 err = PTR_ERR(skb);
187 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
188 return err;
189 }
190 kfree_skb(skb);
191
192 return 0;
193 }
194
btintel_set_diag(struct hci_dev * hdev,bool enable)195 int btintel_set_diag(struct hci_dev *hdev, bool enable)
196 {
197 struct sk_buff *skb;
198 u8 param[3];
199 int err;
200
201 if (enable) {
202 param[0] = 0x03;
203 param[1] = 0x03;
204 param[2] = 0x03;
205 } else {
206 param[0] = 0x00;
207 param[1] = 0x00;
208 param[2] = 0x00;
209 }
210
211 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
212 if (IS_ERR(skb)) {
213 err = PTR_ERR(skb);
214 if (err == -ENODATA)
215 goto done;
216 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
217 err);
218 return err;
219 }
220 kfree_skb(skb);
221
222 done:
223 btintel_set_event_mask(hdev, enable);
224 return 0;
225 }
226 EXPORT_SYMBOL_GPL(btintel_set_diag);
227
btintel_set_diag_mfg(struct hci_dev * hdev,bool enable)228 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
229 {
230 int err, ret;
231
232 err = btintel_enter_mfg(hdev);
233 if (err)
234 return err;
235
236 ret = btintel_set_diag(hdev, enable);
237
238 err = btintel_exit_mfg(hdev, false, false);
239 if (err)
240 return err;
241
242 return ret;
243 }
244
btintel_set_diag_combined(struct hci_dev * hdev,bool enable)245 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
246 {
247 int ret;
248
249 /* Legacy ROM device needs to be in the manufacturer mode to apply
250 * diagnostic setting
251 *
252 * This flag is set after reading the Intel version.
253 */
254 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
255 ret = btintel_set_diag_mfg(hdev, enable);
256 else
257 ret = btintel_set_diag(hdev, enable);
258
259 return ret;
260 }
261
btintel_hw_error(struct hci_dev * hdev,u8 code)262 void btintel_hw_error(struct hci_dev *hdev, u8 code)
263 {
264 struct sk_buff *skb;
265 u8 type = 0x00;
266
267 bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
268
269 hci_req_sync_lock(hdev);
270
271 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
272 if (IS_ERR(skb)) {
273 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
274 PTR_ERR(skb));
275 goto unlock;
276 }
277 kfree_skb(skb);
278
279 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
280 if (IS_ERR(skb)) {
281 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
282 PTR_ERR(skb));
283 goto unlock;
284 }
285
286 if (skb->len != 13) {
287 bt_dev_err(hdev, "Exception info size mismatch");
288 kfree_skb(skb);
289 goto unlock;
290 }
291
292 bt_dev_err(hdev, "Exception info %.*s", (int)(skb->len - 1),
293 (char *)(skb->data + 1));
294
295 kfree_skb(skb);
296
297 unlock:
298 hci_req_sync_unlock(hdev);
299 }
300 EXPORT_SYMBOL_GPL(btintel_hw_error);
301
btintel_version_info(struct hci_dev * hdev,struct intel_version * ver)302 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
303 {
304 const char *variant;
305
306 /* The hardware platform number has a fixed value of 0x37 and
307 * for now only accept this single value.
308 */
309 if (ver->hw_platform != 0x37) {
310 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
311 ver->hw_platform);
312 return -EINVAL;
313 }
314
315 /* Check for supported iBT hardware variants of this firmware
316 * loading method.
317 *
318 * This check has been put in place to ensure correct forward
319 * compatibility options when newer hardware variants come along.
320 */
321 switch (ver->hw_variant) {
322 case 0x07: /* WP - Legacy ROM */
323 case 0x08: /* StP - Legacy ROM */
324 case 0x0b: /* SfP */
325 case 0x0c: /* WsP */
326 case 0x11: /* JfP */
327 case 0x12: /* ThP */
328 case 0x13: /* HrP */
329 case 0x14: /* CcP */
330 break;
331 default:
332 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
333 ver->hw_variant);
334 return -EINVAL;
335 }
336
337 switch (ver->fw_variant) {
338 case 0x01:
339 variant = "Legacy ROM 2.5";
340 break;
341 case 0x06:
342 variant = "Bootloader";
343 break;
344 case 0x22:
345 variant = "Legacy ROM 2.x";
346 break;
347 case 0x23:
348 variant = "Firmware";
349 break;
350 default:
351 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
352 return -EINVAL;
353 }
354
355 coredump_info.hw_variant = ver->hw_variant;
356 coredump_info.fw_build_num = ver->fw_build_num;
357
358 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
359 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
360 ver->fw_build_num, ver->fw_build_ww,
361 2000 + ver->fw_build_yy);
362
363 return 0;
364 }
365 EXPORT_SYMBOL_GPL(btintel_version_info);
366
btintel_secure_send(struct hci_dev * hdev,u8 fragment_type,u32 plen,const void * param)367 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
368 const void *param)
369 {
370 while (plen > 0) {
371 struct sk_buff *skb;
372 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
373
374 cmd_param[0] = fragment_type;
375 memcpy(cmd_param + 1, param, fragment_len);
376
377 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
378 cmd_param, HCI_INIT_TIMEOUT);
379 if (IS_ERR(skb))
380 return PTR_ERR(skb);
381
382 kfree_skb(skb);
383
384 plen -= fragment_len;
385 param += fragment_len;
386 }
387
388 return 0;
389 }
390
btintel_load_ddc_config(struct hci_dev * hdev,const char * ddc_name)391 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
392 {
393 const struct firmware *fw;
394 struct sk_buff *skb;
395 const u8 *fw_ptr;
396 int err;
397
398 err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
399 if (err < 0) {
400 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
401 ddc_name, err);
402 return err;
403 }
404
405 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
406
407 fw_ptr = fw->data;
408
409 /* DDC file contains one or more DDC structure which has
410 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
411 */
412 while (fw->size > (size_t)(fw_ptr - fw->data)) {
413 size_t remaining = fw->size - (fw_ptr - fw->data);
414 unsigned int cmd_plen = fw_ptr[0] + 1U;
415
416 if (cmd_plen < 3 || cmd_plen > U8_MAX || cmd_plen > remaining) {
417 bt_dev_err(hdev, "Malformed DDC record (plen=%u, remaining=%zu)",
418 cmd_plen, remaining);
419 release_firmware(fw);
420 return -EINVAL;
421 }
422
423 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
424 HCI_INIT_TIMEOUT);
425 if (IS_ERR(skb)) {
426 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
427 PTR_ERR(skb));
428 release_firmware(fw);
429 return PTR_ERR(skb);
430 }
431
432 fw_ptr += cmd_plen;
433 kfree_skb(skb);
434 }
435
436 release_firmware(fw);
437
438 bt_dev_info(hdev, "Applying Intel DDC parameters completed");
439
440 return 0;
441 }
442 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
443
btintel_set_event_mask_mfg(struct hci_dev * hdev,bool debug)444 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
445 {
446 int err, ret;
447
448 err = btintel_enter_mfg(hdev);
449 if (err)
450 return err;
451
452 ret = btintel_set_event_mask(hdev, debug);
453
454 err = btintel_exit_mfg(hdev, false, false);
455 if (err)
456 return err;
457
458 return ret;
459 }
460 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
461
btintel_read_version(struct hci_dev * hdev,struct intel_version * ver)462 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
463 {
464 struct sk_buff *skb;
465
466 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
467 if (IS_ERR(skb)) {
468 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
469 PTR_ERR(skb));
470 return PTR_ERR(skb);
471 }
472
473 if (!skb || skb->len != sizeof(*ver)) {
474 bt_dev_err(hdev, "Intel version event size mismatch");
475 kfree_skb(skb);
476 return -EILSEQ;
477 }
478
479 memcpy(ver, skb->data, sizeof(*ver));
480
481 kfree_skb(skb);
482
483 return 0;
484 }
485 EXPORT_SYMBOL_GPL(btintel_read_version);
486
btintel_version_info_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)487 int btintel_version_info_tlv(struct hci_dev *hdev,
488 struct intel_version_tlv *version)
489 {
490 const char *variant;
491
492 /* The hardware platform number has a fixed value of 0x37 and
493 * for now only accept this single value.
494 */
495 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
496 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
497 INTEL_HW_PLATFORM(version->cnvi_bt));
498 return -EINVAL;
499 }
500
501 /* Check for supported iBT hardware variants of this firmware
502 * loading method.
503 *
504 * This check has been put in place to ensure correct forward
505 * compatibility options when newer hardware variants come along.
506 */
507 switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
508 case 0x17: /* TyP */
509 case 0x18: /* Slr */
510 case 0x19: /* Slr-F */
511 case 0x1b: /* Mgr */
512 case 0x1c: /* Gale Peak (GaP) */
513 case 0x1d: /* BlazarU (BzrU) */
514 case 0x1e: /* BlazarI (Bzr) */
515 case 0x1f: /* Scorpious Peak */
516 case 0x20: /* Scorpious Peak2 */
517 case 0x21: /* Scorpious Peak2 F */
518 case 0x22: /* BlazarIW (BzrIW) */
519 break;
520 default:
521 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
522 INTEL_HW_VARIANT(version->cnvi_bt));
523 return -EINVAL;
524 }
525
526 switch (version->img_type) {
527 case BTINTEL_IMG_BOOTLOADER:
528 variant = "Bootloader";
529 /* It is required that every single firmware fragment is acknowledged
530 * with a command complete event. If the boot parameters indicate
531 * that this bootloader does not send them, then abort the setup.
532 */
533 if (version->limited_cce != 0x00) {
534 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
535 version->limited_cce);
536 return -EINVAL;
537 }
538
539 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */
540 if (version->sbe_type > 0x03) {
541 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
542 version->sbe_type);
543 return -EINVAL;
544 }
545
546 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
547 bt_dev_info(hdev, "Secure boot is %s",
548 str_enabled_disabled(version->secure_boot));
549 bt_dev_info(hdev, "OTP lock is %s",
550 str_enabled_disabled(version->otp_lock));
551 bt_dev_info(hdev, "API lock is %s",
552 str_enabled_disabled(version->api_lock));
553 bt_dev_info(hdev, "Debug lock is %s",
554 str_enabled_disabled(version->debug_lock));
555 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
556 version->min_fw_build_nn, version->min_fw_build_cw,
557 2000 + version->min_fw_build_yy);
558 break;
559 case BTINTEL_IMG_IML:
560 variant = "Intermediate loader";
561 break;
562 case BTINTEL_IMG_OP:
563 variant = "Firmware";
564 break;
565 default:
566 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
567 return -EINVAL;
568 }
569
570 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt);
571 coredump_info.fw_build_num = version->build_num;
572
573 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
574 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
575 version->build_type, version->build_num);
576 if (version->img_type == BTINTEL_IMG_OP)
577 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1);
578
579 return 0;
580 }
581 EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
582
btintel_version_tlv_min_len(u8 type)583 static u8 btintel_version_tlv_min_len(u8 type)
584 {
585 switch (type) {
586 case INTEL_TLV_CNVI_TOP:
587 case INTEL_TLV_CNVR_TOP:
588 case INTEL_TLV_CNVI_BT:
589 case INTEL_TLV_CNVR_BT:
590 case INTEL_TLV_BUILD_NUM:
591 case INTEL_TLV_GIT_SHA1:
592 return sizeof(u32);
593 case INTEL_TLV_DEV_REV_ID:
594 case INTEL_TLV_TIME_STAMP:
595 return sizeof(u16);
596 case INTEL_TLV_IMAGE_TYPE:
597 case INTEL_TLV_BUILD_TYPE:
598 case INTEL_TLV_SECURE_BOOT:
599 case INTEL_TLV_OTP_LOCK:
600 case INTEL_TLV_API_LOCK:
601 case INTEL_TLV_DEBUG_LOCK:
602 case INTEL_TLV_LIMITED_CCE:
603 case INTEL_TLV_SBE_TYPE:
604 return sizeof(u8);
605 case INTEL_TLV_MIN_FW:
606 return 3;
607 case INTEL_TLV_OTP_BDADDR:
608 return sizeof(bdaddr_t);
609 default:
610 return 0;
611 }
612 }
613
btintel_parse_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version,struct sk_buff * skb)614 int btintel_parse_version_tlv(struct hci_dev *hdev,
615 struct intel_version_tlv *version,
616 struct sk_buff *skb)
617 {
618 /* Consume Command Complete Status field */
619 if (!skb_pull(skb, 1))
620 return -EINVAL;
621
622 /* Event parameters contain multiple TLVs. Read each of them
623 * and only keep the required data. Also, it use existing legacy
624 * version field like hw_platform, hw_variant, and fw_variant
625 * to keep the existing setup flow
626 */
627 while (skb->len) {
628 struct intel_tlv *tlv;
629
630 /* Make sure skb has a minimum length of the header */
631 if (skb->len < sizeof(*tlv))
632 return -EINVAL;
633
634 tlv = (struct intel_tlv *)skb->data;
635
636 /* Make sure skb has a enough data */
637 if (skb->len < tlv->len + sizeof(*tlv))
638 return -EINVAL;
639
640 if (tlv->len < btintel_version_tlv_min_len(tlv->type))
641 return -EINVAL;
642
643 switch (tlv->type) {
644 case INTEL_TLV_CNVI_TOP:
645 version->cnvi_top = get_unaligned_le32(tlv->val);
646 break;
647 case INTEL_TLV_CNVR_TOP:
648 version->cnvr_top = get_unaligned_le32(tlv->val);
649 break;
650 case INTEL_TLV_CNVI_BT:
651 version->cnvi_bt = get_unaligned_le32(tlv->val);
652 break;
653 case INTEL_TLV_CNVR_BT:
654 version->cnvr_bt = get_unaligned_le32(tlv->val);
655 break;
656 case INTEL_TLV_DEV_REV_ID:
657 version->dev_rev_id = get_unaligned_le16(tlv->val);
658 break;
659 case INTEL_TLV_IMAGE_TYPE:
660 version->img_type = tlv->val[0];
661 break;
662 case INTEL_TLV_TIME_STAMP:
663 /* If image type is Operational firmware (0x03), then
664 * running FW Calendar Week and Year information can
665 * be extracted from Timestamp information
666 */
667 version->min_fw_build_cw = tlv->val[0];
668 version->min_fw_build_yy = tlv->val[1];
669 version->timestamp = get_unaligned_le16(tlv->val);
670 break;
671 case INTEL_TLV_BUILD_TYPE:
672 version->build_type = tlv->val[0];
673 break;
674 case INTEL_TLV_BUILD_NUM:
675 /* If image type is Operational firmware (0x03), then
676 * running FW build number can be extracted from the
677 * Build information
678 */
679 version->min_fw_build_nn = tlv->val[0];
680 version->build_num = get_unaligned_le32(tlv->val);
681 break;
682 case INTEL_TLV_SECURE_BOOT:
683 version->secure_boot = tlv->val[0];
684 break;
685 case INTEL_TLV_OTP_LOCK:
686 version->otp_lock = tlv->val[0];
687 break;
688 case INTEL_TLV_API_LOCK:
689 version->api_lock = tlv->val[0];
690 break;
691 case INTEL_TLV_DEBUG_LOCK:
692 version->debug_lock = tlv->val[0];
693 break;
694 case INTEL_TLV_MIN_FW:
695 version->min_fw_build_nn = tlv->val[0];
696 version->min_fw_build_cw = tlv->val[1];
697 version->min_fw_build_yy = tlv->val[2];
698 break;
699 case INTEL_TLV_LIMITED_CCE:
700 version->limited_cce = tlv->val[0];
701 break;
702 case INTEL_TLV_SBE_TYPE:
703 version->sbe_type = tlv->val[0];
704 break;
705 case INTEL_TLV_OTP_BDADDR:
706 memcpy(&version->otp_bd_addr, tlv->val,
707 sizeof(bdaddr_t));
708 break;
709 case INTEL_TLV_GIT_SHA1:
710 version->git_sha1 = get_unaligned_le32(tlv->val);
711 break;
712 case INTEL_TLV_FW_ID:
713 snprintf(version->fw_id, sizeof(version->fw_id),
714 "%.*s", tlv->len, tlv->val);
715 break;
716 default:
717 /* Ignore rest of information */
718 break;
719 }
720 /* consume the current tlv and move to next*/
721 skb_pull(skb, tlv->len + sizeof(*tlv));
722 }
723
724 return 0;
725 }
726 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv);
727
btintel_read_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)728 static int btintel_read_version_tlv(struct hci_dev *hdev,
729 struct intel_version_tlv *version)
730 {
731 struct sk_buff *skb;
732 const u8 param[1] = { 0xFF };
733 int err;
734
735 if (!version)
736 return -EINVAL;
737
738 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
739 if (IS_ERR(skb)) {
740 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
741 PTR_ERR(skb));
742 return PTR_ERR(skb);
743 }
744
745 if (skb->data[0]) {
746 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
747 skb->data[0]);
748 kfree_skb(skb);
749 return -EIO;
750 }
751
752 err = btintel_parse_version_tlv(hdev, version, skb);
753
754 kfree_skb(skb);
755 return err;
756 }
757
758 /* ------- REGMAP IBT SUPPORT ------- */
759
760 #define IBT_REG_MODE_8BIT 0x00
761 #define IBT_REG_MODE_16BIT 0x01
762 #define IBT_REG_MODE_32BIT 0x02
763
764 struct regmap_ibt_context {
765 struct hci_dev *hdev;
766 __u16 op_write;
767 __u16 op_read;
768 };
769
770 struct ibt_cp_reg_access {
771 __le32 addr;
772 __u8 mode;
773 __u8 len;
774 __u8 data[];
775 } __packed;
776
777 struct ibt_rp_reg_access {
778 __u8 status;
779 __le32 addr;
780 __u8 data[];
781 } __packed;
782
regmap_ibt_read(void * context,const void * addr,size_t reg_size,void * val,size_t val_size)783 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
784 void *val, size_t val_size)
785 {
786 struct regmap_ibt_context *ctx = context;
787 struct ibt_cp_reg_access cp;
788 struct ibt_rp_reg_access *rp;
789 struct sk_buff *skb;
790 int err = 0;
791
792 if (reg_size != sizeof(__le32))
793 return -EINVAL;
794
795 switch (val_size) {
796 case 1:
797 cp.mode = IBT_REG_MODE_8BIT;
798 break;
799 case 2:
800 cp.mode = IBT_REG_MODE_16BIT;
801 break;
802 case 4:
803 cp.mode = IBT_REG_MODE_32BIT;
804 break;
805 default:
806 return -EINVAL;
807 }
808
809 /* regmap provides a little-endian formatted addr */
810 cp.addr = *(__le32 *)addr;
811 cp.len = val_size;
812
813 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
814
815 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
816 HCI_CMD_TIMEOUT);
817 if (IS_ERR(skb)) {
818 err = PTR_ERR(skb);
819 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
820 le32_to_cpu(cp.addr), err);
821 return err;
822 }
823
824 if (skb->len != sizeof(*rp) + val_size) {
825 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
826 le32_to_cpu(cp.addr));
827 err = -EINVAL;
828 goto done;
829 }
830
831 rp = (struct ibt_rp_reg_access *)skb->data;
832
833 if (rp->addr != cp.addr) {
834 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
835 le32_to_cpu(rp->addr));
836 err = -EINVAL;
837 goto done;
838 }
839
840 memcpy(val, rp->data, val_size);
841
842 done:
843 kfree_skb(skb);
844 return err;
845 }
846
regmap_ibt_gather_write(void * context,const void * addr,size_t reg_size,const void * val,size_t val_size)847 static int regmap_ibt_gather_write(void *context,
848 const void *addr, size_t reg_size,
849 const void *val, size_t val_size)
850 {
851 struct regmap_ibt_context *ctx = context;
852 struct ibt_cp_reg_access *cp;
853 struct sk_buff *skb;
854 int plen = sizeof(*cp) + val_size;
855 u8 mode;
856 int err = 0;
857
858 if (reg_size != sizeof(__le32))
859 return -EINVAL;
860
861 switch (val_size) {
862 case 1:
863 mode = IBT_REG_MODE_8BIT;
864 break;
865 case 2:
866 mode = IBT_REG_MODE_16BIT;
867 break;
868 case 4:
869 mode = IBT_REG_MODE_32BIT;
870 break;
871 default:
872 return -EINVAL;
873 }
874
875 cp = kmalloc(plen, GFP_KERNEL);
876 if (!cp)
877 return -ENOMEM;
878
879 /* regmap provides a little-endian formatted addr/value */
880 cp->addr = *(__le32 *)addr;
881 cp->mode = mode;
882 cp->len = val_size;
883 memcpy(&cp->data, val, val_size);
884
885 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
886
887 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
888 if (IS_ERR(skb)) {
889 err = PTR_ERR(skb);
890 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
891 le32_to_cpu(cp->addr), err);
892 goto done;
893 }
894 kfree_skb(skb);
895
896 done:
897 kfree(cp);
898 return err;
899 }
900
regmap_ibt_write(void * context,const void * data,size_t count)901 static int regmap_ibt_write(void *context, const void *data, size_t count)
902 {
903 /* data contains register+value, since we only support 32bit addr,
904 * minimum data size is 4 bytes.
905 */
906 if (WARN_ONCE(count < 4, "Invalid register access"))
907 return -EINVAL;
908
909 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
910 }
911
regmap_ibt_free_context(void * context)912 static void regmap_ibt_free_context(void *context)
913 {
914 kfree(context);
915 }
916
917 static const struct regmap_bus regmap_ibt = {
918 .read = regmap_ibt_read,
919 .write = regmap_ibt_write,
920 .gather_write = regmap_ibt_gather_write,
921 .free_context = regmap_ibt_free_context,
922 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
923 .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
924 };
925
926 /* Config is the same for all register regions */
927 static const struct regmap_config regmap_ibt_cfg = {
928 .name = "btintel_regmap",
929 .reg_bits = 32,
930 .val_bits = 32,
931 };
932
btintel_regmap_init(struct hci_dev * hdev,u16 opcode_read,u16 opcode_write)933 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
934 u16 opcode_write)
935 {
936 struct regmap_ibt_context *ctx;
937
938 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
939 opcode_write);
940
941 ctx = kzalloc_obj(*ctx);
942 if (!ctx)
943 return ERR_PTR(-ENOMEM);
944
945 ctx->op_read = opcode_read;
946 ctx->op_write = opcode_write;
947 ctx->hdev = hdev;
948
949 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg);
950 }
951 EXPORT_SYMBOL_GPL(btintel_regmap_init);
952
btintel_send_intel_reset(struct hci_dev * hdev,u32 boot_param)953 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
954 {
955 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
956 struct sk_buff *skb;
957
958 params.boot_param = cpu_to_le32(boot_param);
959
960 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms,
961 HCI_INIT_TIMEOUT);
962 if (IS_ERR(skb)) {
963 bt_dev_err(hdev, "Failed to send Intel Reset command");
964 return PTR_ERR(skb);
965 }
966
967 kfree_skb(skb);
968
969 return 0;
970 }
971 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
972
btintel_read_boot_params(struct hci_dev * hdev,struct intel_boot_params * params)973 int btintel_read_boot_params(struct hci_dev *hdev,
974 struct intel_boot_params *params)
975 {
976 struct sk_buff *skb;
977
978 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
979 if (IS_ERR(skb)) {
980 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
981 PTR_ERR(skb));
982 return PTR_ERR(skb);
983 }
984
985 if (skb->len != sizeof(*params)) {
986 bt_dev_err(hdev, "Intel boot parameters size mismatch");
987 kfree_skb(skb);
988 return -EILSEQ;
989 }
990
991 memcpy(params, skb->data, sizeof(*params));
992
993 kfree_skb(skb);
994
995 if (params->status) {
996 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
997 params->status);
998 return -bt_to_errno(params->status);
999 }
1000
1001 bt_dev_info(hdev, "Device revision is %u",
1002 le16_to_cpu(params->dev_revid));
1003
1004 bt_dev_info(hdev, "Secure boot is %s",
1005 str_enabled_disabled(params->secure_boot));
1006
1007 bt_dev_info(hdev, "OTP lock is %s",
1008 str_enabled_disabled(params->otp_lock));
1009
1010 bt_dev_info(hdev, "API lock is %s",
1011 str_enabled_disabled(params->api_lock));
1012
1013 bt_dev_info(hdev, "Debug lock is %s",
1014 str_enabled_disabled(params->debug_lock));
1015
1016 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
1017 params->min_fw_build_nn, params->min_fw_build_cw,
1018 2000 + params->min_fw_build_yy);
1019
1020 return 0;
1021 }
1022 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
1023
btintel_sfi_rsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)1024 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
1025 const struct firmware *fw)
1026 {
1027 int err;
1028
1029 /* Start the firmware download transaction with the Init fragment
1030 * represented by the 128 bytes of CSS header.
1031 */
1032 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
1033 if (err < 0) {
1034 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
1035 goto done;
1036 }
1037
1038 /* Send the 256 bytes of public key information from the firmware
1039 * as the PKey fragment.
1040 */
1041 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
1042 if (err < 0) {
1043 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
1044 goto done;
1045 }
1046
1047 /* Send the 256 bytes of signature information from the firmware
1048 * as the Sign fragment.
1049 */
1050 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
1051 if (err < 0) {
1052 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
1053 goto done;
1054 }
1055
1056 done:
1057 return err;
1058 }
1059
btintel_sfi_ecdsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)1060 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
1061 const struct firmware *fw)
1062 {
1063 int err;
1064
1065 /* Start the firmware download transaction with the Init fragment
1066 * represented by the 128 bytes of CSS header.
1067 */
1068 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
1069 if (err < 0) {
1070 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
1071 return err;
1072 }
1073
1074 /* Send the 96 bytes of public key information from the firmware
1075 * as the PKey fragment.
1076 */
1077 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
1078 if (err < 0) {
1079 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
1080 return err;
1081 }
1082
1083 /* Send the 96 bytes of signature information from the firmware
1084 * as the Sign fragment
1085 */
1086 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
1087 if (err < 0) {
1088 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
1089 err);
1090 return err;
1091 }
1092 return 0;
1093 }
1094
btintel_sfi_hybrid_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)1095 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev,
1096 const struct firmware *fw)
1097 {
1098 int err;
1099
1100 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data);
1101 if (err < 0) {
1102 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err);
1103 return err;
1104 }
1105
1106 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE,
1107 fw->data + BTINTEL_ECDSA_OFFSET);
1108 if (err < 0) {
1109 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err);
1110 return err;
1111 }
1112
1113 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE,
1114 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE);
1115 if (err < 0) {
1116 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err);
1117 return err;
1118 }
1119
1120 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE,
1121 fw->data + BTINTEL_LMS_OFFSET);
1122 if (err < 0) {
1123 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err);
1124 return err;
1125 }
1126
1127 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE,
1128 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE);
1129 if (err < 0) {
1130 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err);
1131 return err;
1132 }
1133
1134 return 0;
1135 }
1136
btintel_download_firmware_payload(struct hci_dev * hdev,const struct firmware * fw,size_t offset)1137 static int btintel_download_firmware_payload(struct hci_dev *hdev,
1138 const struct firmware *fw,
1139 size_t offset)
1140 {
1141 int err;
1142 const u8 *fw_ptr;
1143 u32 frag_len;
1144
1145 fw_ptr = fw->data + offset;
1146 frag_len = 0;
1147 err = -EINVAL;
1148
1149 while (fw_ptr - fw->data < fw->size) {
1150 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
1151
1152 frag_len += sizeof(*cmd) + cmd->plen;
1153
1154 /* The parameter length of the secure send command requires
1155 * a 4 byte alignment. It happens so that the firmware file
1156 * contains proper Intel_NOP commands to align the fragments
1157 * as needed.
1158 *
1159 * Send set of commands with 4 byte alignment from the
1160 * firmware data buffer as a single Data fragment.
1161 */
1162 if (!(frag_len % 4)) {
1163 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1164 if (err < 0) {
1165 bt_dev_err(hdev,
1166 "Failed to send firmware data (%d)",
1167 err);
1168 goto done;
1169 }
1170
1171 fw_ptr += frag_len;
1172 frag_len = 0;
1173 }
1174 }
1175
1176 done:
1177 return err;
1178 }
1179
btintel_firmware_version(struct hci_dev * hdev,u8 num,u8 ww,u8 yy,const struct firmware * fw,u32 * boot_addr)1180 static bool btintel_firmware_version(struct hci_dev *hdev,
1181 u8 num, u8 ww, u8 yy,
1182 const struct firmware *fw,
1183 u32 *boot_addr)
1184 {
1185 const u8 *fw_ptr;
1186
1187 fw_ptr = fw->data;
1188
1189 while (fw_ptr - fw->data < fw->size) {
1190 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1191
1192 /* Each SKU has a different reset parameter to use in the
1193 * HCI_Intel_Reset command and it is embedded in the firmware
1194 * data. So, instead of using static value per SKU, check
1195 * the firmware data and save it for later use.
1196 */
1197 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1198 struct cmd_write_boot_params *params;
1199
1200 params = (void *)(fw_ptr + sizeof(*cmd));
1201
1202 *boot_addr = le32_to_cpu(params->boot_addr);
1203
1204 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr);
1205
1206 bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1207 params->fw_build_num, params->fw_build_ww,
1208 params->fw_build_yy);
1209
1210 return (num == params->fw_build_num &&
1211 ww == params->fw_build_ww &&
1212 yy == params->fw_build_yy);
1213 }
1214
1215 fw_ptr += sizeof(*cmd) + cmd->plen;
1216 }
1217
1218 return false;
1219 }
1220
btintel_download_firmware(struct hci_dev * hdev,struct intel_version * ver,const struct firmware * fw,u32 * boot_param)1221 int btintel_download_firmware(struct hci_dev *hdev,
1222 struct intel_version *ver,
1223 const struct firmware *fw,
1224 u32 *boot_param)
1225 {
1226 int err;
1227
1228 /* SfP and WsP don't seem to update the firmware version on file
1229 * so version checking is currently not possible.
1230 */
1231 switch (ver->hw_variant) {
1232 case 0x0b: /* SfP */
1233 case 0x0c: /* WsP */
1234 /* Skip version checking */
1235 break;
1236 default:
1237
1238 /* Skip download if firmware has the same version */
1239 if (btintel_firmware_version(hdev, ver->fw_build_num,
1240 ver->fw_build_ww, ver->fw_build_yy,
1241 fw, boot_param)) {
1242 bt_dev_info(hdev, "Firmware already loaded");
1243 /* Return -EALREADY to indicate that the firmware has
1244 * already been loaded.
1245 */
1246 return -EALREADY;
1247 }
1248 }
1249
1250 /* The firmware variant determines if the device is in bootloader
1251 * mode or is running operational firmware. The value 0x06 identifies
1252 * the bootloader and the value 0x23 identifies the operational
1253 * firmware.
1254 *
1255 * If the firmware version has changed that means it needs to be reset
1256 * to bootloader when operational so the new firmware can be loaded.
1257 */
1258 if (ver->fw_variant == 0x23)
1259 return -EINVAL;
1260
1261 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1262 if (err)
1263 return err;
1264
1265 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1266 }
1267 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1268
btintel_download_fw_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,const struct firmware * fw,u32 * boot_param,u8 hw_variant,u8 sbe_type)1269 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1270 struct intel_version_tlv *ver,
1271 const struct firmware *fw, u32 *boot_param,
1272 u8 hw_variant, u8 sbe_type)
1273 {
1274 int err;
1275 u32 css_header_ver;
1276
1277 /* Skip download if firmware has the same version */
1278 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1279 ver->min_fw_build_cw,
1280 ver->min_fw_build_yy,
1281 fw, boot_param)) {
1282 bt_dev_info(hdev, "Firmware already loaded");
1283 /* Return -EALREADY to indicate that firmware has
1284 * already been loaded.
1285 */
1286 return -EALREADY;
1287 }
1288
1289 /* The firmware variant determines if the device is in bootloader
1290 * mode or is running operational firmware. The value 0x01 identifies
1291 * the bootloader and the value 0x03 identifies the operational
1292 * firmware.
1293 *
1294 * If the firmware version has changed that means it needs to be reset
1295 * to bootloader when operational so the new firmware can be loaded.
1296 */
1297 if (ver->img_type == BTINTEL_IMG_OP)
1298 return -EINVAL;
1299
1300 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1301 * only RSA secure boot engine. Hence, the corresponding sfi file will
1302 * have RSA header of 644 bytes followed by Command Buffer.
1303 *
1304 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1305 * secure boot engine. As a result, the corresponding sfi file will
1306 * have RSA header of 644, ECDSA header of 320 bytes followed by
1307 * Command Buffer.
1308 *
1309 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1310 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700)
1311 */
1312 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1313 if (css_header_ver != BTINTEL_RSA_HEADER_VER &&
1314 css_header_ver != BTINTEL_HYBRID_HEADER_VER) {
1315 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver);
1316 return -EINVAL;
1317 }
1318
1319 if (hw_variant <= 0x14) {
1320 if (sbe_type != 0x00) {
1321 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1322 hw_variant);
1323 return -EINVAL;
1324 }
1325
1326 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1327 if (err)
1328 return err;
1329
1330 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1331 if (err)
1332 return err;
1333 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) {
1334 /* Check if CSS header for ECDSA follows the RSA header */
1335 if (fw->data[ECDSA_OFFSET] != 0x06)
1336 return -EINVAL;
1337
1338 /* Check if the CSS Header version is ECDSA(0x00020000) */
1339 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1340 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) {
1341 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver);
1342 return -EINVAL;
1343 }
1344
1345 if (sbe_type == 0x00) {
1346 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1347 if (err)
1348 return err;
1349
1350 err = btintel_download_firmware_payload(hdev, fw,
1351 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1352 if (err)
1353 return err;
1354 } else if (sbe_type == 0x01) {
1355 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1356 if (err)
1357 return err;
1358
1359 err = btintel_download_firmware_payload(hdev, fw,
1360 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1361 if (err)
1362 return err;
1363 }
1364 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) {
1365 err = btintel_sfi_hybrid_header_secure_send(hdev, fw);
1366 if (err)
1367 return err;
1368
1369 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET);
1370 if (err)
1371 return err;
1372 }
1373 return 0;
1374 }
1375
btintel_reset_to_bootloader(struct hci_dev * hdev)1376 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1377 {
1378 struct intel_reset params;
1379 struct sk_buff *skb;
1380
1381 /* PCIe transport uses shared hardware reset mechanism for recovery
1382 * which gets triggered in pcie *setup* function on error.
1383 */
1384 if (hdev->bus == HCI_PCI)
1385 return;
1386
1387 /* Send Intel Reset command. This will result in
1388 * re-enumeration of BT controller.
1389 *
1390 * Intel Reset parameter description:
1391 * reset_type : 0x00 (Soft reset),
1392 * 0x01 (Hard reset)
1393 * patch_enable : 0x00 (Do not enable),
1394 * 0x01 (Enable)
1395 * ddc_reload : 0x00 (Do not reload),
1396 * 0x01 (Reload)
1397 * boot_option: 0x00 (Current image),
1398 * 0x01 (Specified boot address)
1399 * boot_param: Boot address
1400 *
1401 */
1402
1403 params.reset_type = 0x01;
1404 params.patch_enable = 0x01;
1405 params.ddc_reload = 0x01;
1406 params.boot_option = 0x00;
1407 params.boot_param = cpu_to_le32(0x00000000);
1408
1409 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params),
1410 ¶ms, HCI_INIT_TIMEOUT);
1411 if (IS_ERR(skb)) {
1412 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1413 PTR_ERR(skb));
1414 return;
1415 }
1416 bt_dev_info(hdev, "Intel reset sent to retry FW download");
1417 kfree_skb(skb);
1418
1419 /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1420 * lines for 2ms when it receives Intel Reset in bootloader mode.
1421 * Whereas, the upcoming Intel BT controllers will hold USB reset
1422 * for 150ms. To keep the delay generic, 150ms is chosen here.
1423 */
1424 msleep(150);
1425 }
1426
btintel_read_debug_features(struct hci_dev * hdev,struct intel_debug_features * features)1427 static int btintel_read_debug_features(struct hci_dev *hdev,
1428 struct intel_debug_features *features)
1429 {
1430 struct sk_buff *skb;
1431 u8 page_no = 1;
1432
1433 /* Intel controller supports two pages, each page is of 128-bit
1434 * feature bit mask. And each bit defines specific feature support
1435 */
1436 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1437 HCI_INIT_TIMEOUT);
1438 if (IS_ERR(skb)) {
1439 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1440 PTR_ERR(skb));
1441 return PTR_ERR(skb);
1442 }
1443
1444 if (skb->len != (sizeof(features->page1) + 3)) {
1445 bt_dev_err(hdev, "Supported features event size mismatch");
1446 kfree_skb(skb);
1447 return -EILSEQ;
1448 }
1449
1450 memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1451
1452 /* Read the supported features page2 if required in future.
1453 */
1454 kfree_skb(skb);
1455 return 0;
1456 }
1457
btintel_set_debug_features(struct hci_dev * hdev,const struct intel_debug_features * features)1458 static int btintel_set_debug_features(struct hci_dev *hdev,
1459 const struct intel_debug_features *features)
1460 {
1461 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
1462 0x00, 0x00, 0x00 };
1463 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1464 u8 trace_enable = 0x02;
1465 struct sk_buff *skb;
1466
1467 if (!features) {
1468 bt_dev_warn(hdev, "Debug features not read");
1469 return -EINVAL;
1470 }
1471
1472 if (!(features->page1[0] & 0x3f)) {
1473 bt_dev_info(hdev, "Telemetry exception format not supported");
1474 return 0;
1475 }
1476
1477 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1478 if (IS_ERR(skb)) {
1479 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1480 PTR_ERR(skb));
1481 return PTR_ERR(skb);
1482 }
1483 kfree_skb(skb);
1484
1485 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1486 if (IS_ERR(skb)) {
1487 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1488 PTR_ERR(skb));
1489 return PTR_ERR(skb);
1490 }
1491 kfree_skb(skb);
1492
1493 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1494 if (IS_ERR(skb)) {
1495 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1496 PTR_ERR(skb));
1497 return PTR_ERR(skb);
1498 }
1499 kfree_skb(skb);
1500
1501 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x",
1502 trace_enable, mask[3]);
1503
1504 return 0;
1505 }
1506
btintel_reset_debug_features(struct hci_dev * hdev,const struct intel_debug_features * features)1507 static int btintel_reset_debug_features(struct hci_dev *hdev,
1508 const struct intel_debug_features *features)
1509 {
1510 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
1511 0x00, 0x00, 0x00 };
1512 u8 trace_enable = 0x00;
1513 struct sk_buff *skb;
1514
1515 if (!features) {
1516 bt_dev_warn(hdev, "Debug features not read");
1517 return -EINVAL;
1518 }
1519
1520 if (!(features->page1[0] & 0x3f)) {
1521 bt_dev_info(hdev, "Telemetry exception format not supported");
1522 return 0;
1523 }
1524
1525 /* Should stop the trace before writing ddc event mask. */
1526 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1527 if (IS_ERR(skb)) {
1528 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)",
1529 PTR_ERR(skb));
1530 return PTR_ERR(skb);
1531 }
1532 kfree_skb(skb);
1533
1534 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1535 if (IS_ERR(skb)) {
1536 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1537 PTR_ERR(skb));
1538 return PTR_ERR(skb);
1539 }
1540 kfree_skb(skb);
1541
1542 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x",
1543 trace_enable, mask[3]);
1544
1545 return 0;
1546 }
1547
btintel_set_quality_report(struct hci_dev * hdev,bool enable)1548 int btintel_set_quality_report(struct hci_dev *hdev, bool enable)
1549 {
1550 struct intel_debug_features features;
1551 int err;
1552
1553 bt_dev_dbg(hdev, "enable %d", enable);
1554
1555 /* Read the Intel supported features and if new exception formats
1556 * supported, need to load the additional DDC config to enable.
1557 */
1558 err = btintel_read_debug_features(hdev, &features);
1559 if (err)
1560 return err;
1561
1562 /* Set or reset the debug features. */
1563 if (enable)
1564 err = btintel_set_debug_features(hdev, &features);
1565 else
1566 err = btintel_reset_debug_features(hdev, &features);
1567
1568 return err;
1569 }
1570 EXPORT_SYMBOL_GPL(btintel_set_quality_report);
1571
btintel_coredump(struct hci_dev * hdev)1572 static void btintel_coredump(struct hci_dev *hdev)
1573 {
1574 struct sk_buff *skb;
1575
1576 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT);
1577 if (IS_ERR(skb)) {
1578 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb));
1579 return;
1580 }
1581
1582 kfree_skb(skb);
1583 }
1584
btintel_dmp_hdr(struct hci_dev * hdev,struct sk_buff * skb)1585 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
1586 {
1587 char buf[80];
1588
1589 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
1590 coredump_info.hw_variant);
1591 skb_put_data(skb, buf, strlen(buf));
1592
1593 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
1594 coredump_info.fw_build_num);
1595 skb_put_data(skb, buf, strlen(buf));
1596
1597 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name);
1598 skb_put_data(skb, buf, strlen(buf));
1599
1600 snprintf(buf, sizeof(buf), "Vendor: Intel\n");
1601 skb_put_data(skb, buf, strlen(buf));
1602 }
1603
btintel_register_devcoredump_support(struct hci_dev * hdev)1604 static int btintel_register_devcoredump_support(struct hci_dev *hdev)
1605 {
1606 struct intel_debug_features features;
1607 int err;
1608
1609 err = btintel_read_debug_features(hdev, &features);
1610 if (err) {
1611 bt_dev_info(hdev, "Error reading debug features");
1612 return err;
1613 }
1614
1615 if (!(features.page1[0] & 0x3f)) {
1616 bt_dev_dbg(hdev, "Telemetry exception format not supported");
1617 return -EOPNOTSUPP;
1618 }
1619
1620 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL);
1621
1622 return err;
1623 }
1624
btintel_legacy_rom_get_fw(struct hci_dev * hdev,struct intel_version * ver)1625 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1626 struct intel_version *ver)
1627 {
1628 const struct firmware *fw;
1629 char fwname[64];
1630 int ret;
1631
1632 snprintf(fwname, sizeof(fwname),
1633 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1634 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1635 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1636 ver->fw_build_ww, ver->fw_build_yy);
1637
1638 ret = request_firmware(&fw, fwname, &hdev->dev);
1639 if (ret < 0) {
1640 if (ret == -EINVAL) {
1641 bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1642 ret);
1643 return NULL;
1644 }
1645
1646 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1647 fwname, ret);
1648
1649 /* If the correct firmware patch file is not found, use the
1650 * default firmware patch file instead
1651 */
1652 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1653 ver->hw_platform, ver->hw_variant);
1654 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1655 bt_dev_err(hdev, "failed to open default fw file: %s",
1656 fwname);
1657 return NULL;
1658 }
1659 }
1660
1661 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1662
1663 return fw;
1664 }
1665
btintel_legacy_rom_patching(struct hci_dev * hdev,const struct firmware * fw,const u8 ** fw_ptr,int * disable_patch)1666 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1667 const struct firmware *fw,
1668 const u8 **fw_ptr, int *disable_patch)
1669 {
1670 struct sk_buff *skb;
1671 struct hci_command_hdr *cmd;
1672 const u8 *cmd_param;
1673 struct hci_event_hdr *evt = NULL;
1674 const u8 *evt_param = NULL;
1675 int remain = fw->size - (*fw_ptr - fw->data);
1676
1677 /* The first byte indicates the types of the patch command or event.
1678 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1679 * in the current firmware buffer doesn't start with 0x01 or
1680 * the size of remain buffer is smaller than HCI command header,
1681 * the firmware file is corrupted and it should stop the patching
1682 * process.
1683 */
1684 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1685 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1686 return -EINVAL;
1687 }
1688 (*fw_ptr)++;
1689 remain--;
1690
1691 cmd = (struct hci_command_hdr *)(*fw_ptr);
1692 *fw_ptr += sizeof(*cmd);
1693 remain -= sizeof(*cmd);
1694
1695 /* Ensure that the remain firmware data is long enough than the length
1696 * of command parameter. If not, the firmware file is corrupted.
1697 */
1698 if (remain < cmd->plen) {
1699 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1700 return -EFAULT;
1701 }
1702
1703 /* If there is a command that loads a patch in the firmware
1704 * file, then enable the patch upon success, otherwise just
1705 * disable the manufacturer mode, for example patch activation
1706 * is not required when the default firmware patch file is used
1707 * because there are no patch data to load.
1708 */
1709 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1710 *disable_patch = 0;
1711
1712 cmd_param = *fw_ptr;
1713 *fw_ptr += cmd->plen;
1714 remain -= cmd->plen;
1715
1716 /* This reads the expected events when the above command is sent to the
1717 * device. Some vendor commands expects more than one events, for
1718 * example command status event followed by vendor specific event.
1719 * For this case, it only keeps the last expected event. so the command
1720 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1721 * last expected event.
1722 */
1723 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1724 (*fw_ptr)++;
1725 remain--;
1726
1727 evt = (struct hci_event_hdr *)(*fw_ptr);
1728 *fw_ptr += sizeof(*evt);
1729 remain -= sizeof(*evt);
1730
1731 if (remain < evt->plen) {
1732 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1733 return -EFAULT;
1734 }
1735
1736 evt_param = *fw_ptr;
1737 *fw_ptr += evt->plen;
1738 remain -= evt->plen;
1739 }
1740
1741 /* Every HCI commands in the firmware file has its correspond event.
1742 * If event is not found or remain is smaller than zero, the firmware
1743 * file is corrupted.
1744 */
1745 if (!evt || !evt_param || remain < 0) {
1746 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1747 return -EFAULT;
1748 }
1749
1750 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1751 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1752 if (IS_ERR(skb)) {
1753 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1754 cmd->opcode, PTR_ERR(skb));
1755 return PTR_ERR(skb);
1756 }
1757
1758 /* It ensures that the returned event matches the event data read from
1759 * the firmware file. At fist, it checks the length and then
1760 * the contents of the event.
1761 */
1762 if (skb->len != evt->plen) {
1763 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1764 le16_to_cpu(cmd->opcode));
1765 kfree_skb(skb);
1766 return -EFAULT;
1767 }
1768
1769 if (memcmp(skb->data, evt_param, evt->plen)) {
1770 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1771 le16_to_cpu(cmd->opcode));
1772 kfree_skb(skb);
1773 return -EFAULT;
1774 }
1775 kfree_skb(skb);
1776
1777 return 0;
1778 }
1779
btintel_legacy_rom_setup(struct hci_dev * hdev,struct intel_version * ver)1780 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1781 struct intel_version *ver)
1782 {
1783 const struct firmware *fw;
1784 const u8 *fw_ptr;
1785 int disable_patch, err;
1786 struct intel_version new_ver;
1787
1788 BT_DBG("%s", hdev->name);
1789
1790 /* fw_patch_num indicates the version of patch the device currently
1791 * have. If there is no patch data in the device, it is always 0x00.
1792 * So, if it is other than 0x00, no need to patch the device again.
1793 */
1794 if (ver->fw_patch_num) {
1795 bt_dev_info(hdev,
1796 "Intel device is already patched. patch num: %02x",
1797 ver->fw_patch_num);
1798 goto complete;
1799 }
1800
1801 /* Opens the firmware patch file based on the firmware version read
1802 * from the controller. If it fails to open the matching firmware
1803 * patch file, it tries to open the default firmware patch file.
1804 * If no patch file is found, allow the device to operate without
1805 * a patch.
1806 */
1807 fw = btintel_legacy_rom_get_fw(hdev, ver);
1808 if (!fw)
1809 goto complete;
1810 fw_ptr = fw->data;
1811
1812 /* Enable the manufacturer mode of the controller.
1813 * Only while this mode is enabled, the driver can download the
1814 * firmware patch data and configuration parameters.
1815 */
1816 err = btintel_enter_mfg(hdev);
1817 if (err) {
1818 release_firmware(fw);
1819 return err;
1820 }
1821
1822 disable_patch = 1;
1823
1824 /* The firmware data file consists of list of Intel specific HCI
1825 * commands and its expected events. The first byte indicates the
1826 * type of the message, either HCI command or HCI event.
1827 *
1828 * It reads the command and its expected event from the firmware file,
1829 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1830 * the returned event is compared with the event read from the firmware
1831 * file and it will continue until all the messages are downloaded to
1832 * the controller.
1833 *
1834 * Once the firmware patching is completed successfully,
1835 * the manufacturer mode is disabled with reset and activating the
1836 * downloaded patch.
1837 *
1838 * If the firmware patching fails, the manufacturer mode is
1839 * disabled with reset and deactivating the patch.
1840 *
1841 * If the default patch file is used, no reset is done when disabling
1842 * the manufacturer.
1843 */
1844 while (fw->size > fw_ptr - fw->data) {
1845 int ret;
1846
1847 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1848 &disable_patch);
1849 if (ret < 0)
1850 goto exit_mfg_deactivate;
1851 }
1852
1853 release_firmware(fw);
1854
1855 if (disable_patch)
1856 goto exit_mfg_disable;
1857
1858 /* Patching completed successfully and disable the manufacturer mode
1859 * with reset and activate the downloaded firmware patches.
1860 */
1861 err = btintel_exit_mfg(hdev, true, true);
1862 if (err)
1863 return err;
1864
1865 /* Need build number for downloaded fw patches in
1866 * every power-on boot
1867 */
1868 err = btintel_read_version(hdev, &new_ver);
1869 if (err)
1870 return err;
1871
1872 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1873 new_ver.fw_patch_num);
1874
1875 goto complete;
1876
1877 exit_mfg_disable:
1878 /* Disable the manufacturer mode without reset */
1879 err = btintel_exit_mfg(hdev, false, false);
1880 if (err)
1881 return err;
1882
1883 bt_dev_info(hdev, "Intel firmware patch completed");
1884
1885 goto complete;
1886
1887 exit_mfg_deactivate:
1888 release_firmware(fw);
1889
1890 /* Patching failed. Disable the manufacturer mode with reset and
1891 * deactivate the downloaded firmware patches.
1892 */
1893 err = btintel_exit_mfg(hdev, true, false);
1894 if (err)
1895 return err;
1896
1897 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1898
1899 complete:
1900 /* Set the event mask for Intel specific vendor events. This enables
1901 * a few extra events that are useful during general operation.
1902 */
1903 btintel_set_event_mask_mfg(hdev, false);
1904
1905 btintel_check_bdaddr(hdev);
1906
1907 return 0;
1908 }
1909
btintel_download_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1910 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1911 {
1912 ktime_t delta, rettime;
1913 unsigned long long duration;
1914 int err;
1915
1916 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1917
1918 bt_dev_info(hdev, "Waiting for firmware download to complete");
1919
1920 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1921 TASK_INTERRUPTIBLE,
1922 msecs_to_jiffies(msec));
1923 if (err == -EINTR) {
1924 bt_dev_err(hdev, "Firmware loading interrupted");
1925 return err;
1926 }
1927
1928 if (err) {
1929 bt_dev_err(hdev, "Firmware loading timeout");
1930 return -ETIMEDOUT;
1931 }
1932
1933 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1934 bt_dev_err(hdev, "Firmware loading failed");
1935 return -ENOEXEC;
1936 }
1937
1938 rettime = ktime_get();
1939 delta = ktime_sub(rettime, calltime);
1940 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1941
1942 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1943
1944 return 0;
1945 }
1946
btintel_boot_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1947 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1948 {
1949 ktime_t delta, rettime;
1950 unsigned long long duration;
1951 int err;
1952
1953 bt_dev_info(hdev, "Waiting for device to boot");
1954
1955 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1956 TASK_INTERRUPTIBLE,
1957 msecs_to_jiffies(msec));
1958 if (err == -EINTR) {
1959 bt_dev_err(hdev, "Device boot interrupted");
1960 return -EINTR;
1961 }
1962
1963 if (err) {
1964 bt_dev_err(hdev, "Device boot timeout");
1965 return -ETIMEDOUT;
1966 }
1967
1968 rettime = ktime_get();
1969 delta = ktime_sub(rettime, calltime);
1970 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1971
1972 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1973
1974 return 0;
1975 }
1976
btintel_boot_wait_d0(struct hci_dev * hdev,ktime_t calltime,int msec)1977 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime,
1978 int msec)
1979 {
1980 ktime_t delta, rettime;
1981 unsigned long long duration;
1982 int err;
1983
1984 bt_dev_info(hdev, "Waiting for device transition to d0");
1985
1986 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0,
1987 TASK_INTERRUPTIBLE,
1988 msecs_to_jiffies(msec));
1989 if (err == -EINTR) {
1990 bt_dev_err(hdev, "Device d0 move interrupted");
1991 return -EINTR;
1992 }
1993
1994 if (err) {
1995 bt_dev_err(hdev, "Device d0 move timeout");
1996 return -ETIMEDOUT;
1997 }
1998
1999 rettime = ktime_get();
2000 delta = ktime_sub(rettime, calltime);
2001 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
2002
2003 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration);
2004
2005 return 0;
2006 }
2007
btintel_boot(struct hci_dev * hdev,u32 boot_addr)2008 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
2009 {
2010 ktime_t calltime;
2011 int err;
2012
2013 calltime = ktime_get();
2014
2015 btintel_set_flag(hdev, INTEL_BOOTING);
2016 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0);
2017
2018 err = btintel_send_intel_reset(hdev, boot_addr);
2019 if (err) {
2020 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
2021 btintel_reset_to_bootloader(hdev);
2022 return err;
2023 }
2024
2025 /* The bootloader will not indicate when the device is ready. This
2026 * is done by the operational firmware sending bootup notification.
2027 *
2028 * Booting into operational firmware should not take longer than
2029 * 5 second. However if that happens, then just fail the setup
2030 * since something went wrong.
2031 */
2032 err = btintel_boot_wait(hdev, calltime, 5000);
2033 if (err == -ETIMEDOUT) {
2034 btintel_reset_to_bootloader(hdev);
2035 goto exit_error;
2036 }
2037
2038 if (hdev->bus == HCI_PCI) {
2039 /* In case of PCIe, after receiving bootup event, driver performs
2040 * D0 entry by writing 0 to sleep control register (check
2041 * btintel_pcie_recv_event())
2042 * Firmware acks with alive interrupt indicating host is full ready to
2043 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0
2044 * bit is cleared.
2045 */
2046 calltime = ktime_get();
2047 err = btintel_boot_wait_d0(hdev, calltime, 2000);
2048 }
2049
2050 exit_error:
2051 return err;
2052 }
2053
btintel_get_fw_name(struct intel_version * ver,struct intel_boot_params * params,char * fw_name,size_t len,const char * suffix)2054 static int btintel_get_fw_name(struct intel_version *ver,
2055 struct intel_boot_params *params,
2056 char *fw_name, size_t len,
2057 const char *suffix)
2058 {
2059 switch (ver->hw_variant) {
2060 case 0x0b: /* SfP */
2061 case 0x0c: /* WsP */
2062 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
2063 ver->hw_variant,
2064 le16_to_cpu(params->dev_revid),
2065 suffix);
2066 break;
2067 case 0x11: /* JfP */
2068 case 0x12: /* ThP */
2069 case 0x13: /* HrP */
2070 case 0x14: /* CcP */
2071 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
2072 ver->hw_variant,
2073 ver->hw_revision,
2074 ver->fw_revision,
2075 suffix);
2076 break;
2077 default:
2078 return -EINVAL;
2079 }
2080
2081 return 0;
2082 }
2083
btintel_download_fw(struct hci_dev * hdev,struct intel_version * ver,struct intel_boot_params * params,u32 * boot_param)2084 static int btintel_download_fw(struct hci_dev *hdev,
2085 struct intel_version *ver,
2086 struct intel_boot_params *params,
2087 u32 *boot_param)
2088 {
2089 const struct firmware *fw;
2090 char fwname[64];
2091 int err;
2092 ktime_t calltime;
2093
2094 if (!ver || !params)
2095 return -EINVAL;
2096
2097 /* The firmware variant determines if the device is in bootloader
2098 * mode or is running operational firmware. The value 0x06 identifies
2099 * the bootloader and the value 0x23 identifies the operational
2100 * firmware.
2101 *
2102 * When the operational firmware is already present, then only
2103 * the check for valid Bluetooth device address is needed. This
2104 * determines if the device will be added as configured or
2105 * unconfigured controller.
2106 *
2107 * It is not possible to use the Secure Boot Parameters in this
2108 * case since that command is only available in bootloader mode.
2109 */
2110 if (ver->fw_variant == 0x23) {
2111 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2112 btintel_check_bdaddr(hdev);
2113
2114 /* SfP and WsP don't seem to update the firmware version on file
2115 * so version checking is currently possible.
2116 */
2117 switch (ver->hw_variant) {
2118 case 0x0b: /* SfP */
2119 case 0x0c: /* WsP */
2120 return 0;
2121 }
2122
2123 /* Proceed to download to check if the version matches */
2124 goto download;
2125 }
2126
2127 /* Read the secure boot parameters to identify the operating
2128 * details of the bootloader.
2129 */
2130 err = btintel_read_boot_params(hdev, params);
2131 if (err)
2132 return err;
2133
2134 /* It is required that every single firmware fragment is acknowledged
2135 * with a command complete event. If the boot parameters indicate
2136 * that this bootloader does not send them, then abort the setup.
2137 */
2138 if (params->limited_cce != 0x00) {
2139 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
2140 params->limited_cce);
2141 return -EINVAL;
2142 }
2143
2144 /* If the OTP has no valid Bluetooth device address, then there will
2145 * also be no valid address for the operational firmware.
2146 */
2147 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) {
2148 bt_dev_info(hdev, "No device address configured");
2149 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
2150 }
2151
2152 download:
2153 /* With this Intel bootloader only the hardware variant and device
2154 * revision information are used to select the right firmware for SfP
2155 * and WsP.
2156 *
2157 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2158 *
2159 * Currently the supported hardware variants are:
2160 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2161 * 12 (0x0c) for iBT3.5 (WsP)
2162 *
2163 * For ThP/JfP and for future SKU's, the FW name varies based on HW
2164 * variant, HW revision and FW revision, as these are dependent on CNVi
2165 * and RF Combination.
2166 *
2167 * 17 (0x11) for iBT3.5 (JfP)
2168 * 18 (0x12) for iBT3.5 (ThP)
2169 *
2170 * The firmware file name for these will be
2171 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2172 *
2173 */
2174 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
2175 if (err < 0) {
2176 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2177 /* Firmware has already been loaded */
2178 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2179 return 0;
2180 }
2181
2182 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2183 return -EINVAL;
2184 }
2185
2186 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2187 if (err < 0) {
2188 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2189 /* Firmware has already been loaded */
2190 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2191 return 0;
2192 }
2193
2194 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2195 fwname, err);
2196 return err;
2197 }
2198
2199 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2200
2201 if (fw->size < 644) {
2202 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2203 fw->size);
2204 err = -EBADF;
2205 goto done;
2206 }
2207
2208 calltime = ktime_get();
2209
2210 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2211
2212 /* Start firmware downloading and get boot parameter */
2213 err = btintel_download_firmware(hdev, ver, fw, boot_param);
2214 if (err < 0) {
2215 if (err == -EALREADY) {
2216 /* Firmware has already been loaded */
2217 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2218 err = 0;
2219 goto done;
2220 }
2221
2222 /* When FW download fails, send Intel Reset to retry
2223 * FW download.
2224 */
2225 btintel_reset_to_bootloader(hdev);
2226 goto done;
2227 }
2228
2229 /* Before switching the device into operational mode and with that
2230 * booting the loaded firmware, wait for the bootloader notification
2231 * that all fragments have been successfully received.
2232 *
2233 * When the event processing receives the notification, then the
2234 * INTEL_DOWNLOADING flag will be cleared.
2235 *
2236 * The firmware loading should not take longer than 5 seconds
2237 * and thus just timeout if that happens and fail the setup
2238 * of this device.
2239 */
2240 err = btintel_download_wait(hdev, calltime, 5000);
2241 if (err == -ETIMEDOUT)
2242 btintel_reset_to_bootloader(hdev);
2243
2244 done:
2245 release_firmware(fw);
2246 return err;
2247 }
2248
btintel_bootloader_setup(struct hci_dev * hdev,struct intel_version * ver)2249 static int btintel_bootloader_setup(struct hci_dev *hdev,
2250 struct intel_version *ver)
2251 {
2252 struct intel_version new_ver;
2253 struct intel_boot_params params;
2254 u32 boot_param;
2255 char ddcname[64];
2256 int err;
2257
2258 BT_DBG("%s", hdev->name);
2259
2260 /* Set the default boot parameter to 0x0 and it is updated to
2261 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2262 * command while downloading the firmware.
2263 */
2264 boot_param = 0x00000000;
2265
2266 btintel_set_flag(hdev, INTEL_BOOTLOADER);
2267
2268 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param);
2269 if (err)
2270 return err;
2271
2272 /* controller is already having an operational firmware */
2273 if (ver->fw_variant == 0x23)
2274 goto finish;
2275
2276 err = btintel_boot(hdev, boot_param);
2277 if (err)
2278 return err;
2279
2280 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2281
2282 err = btintel_get_fw_name(ver, ¶ms, ddcname,
2283 sizeof(ddcname), "ddc");
2284
2285 if (err < 0) {
2286 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2287 } else {
2288 /* Once the device is running in operational mode, it needs to
2289 * apply the device configuration (DDC) parameters.
2290 *
2291 * The device can work without DDC parameters, so even if it
2292 * fails to load the file, no need to fail the setup.
2293 */
2294 btintel_load_ddc_config(hdev, ddcname);
2295 }
2296
2297 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2298
2299 /* Read the Intel version information after loading the FW */
2300 err = btintel_read_version(hdev, &new_ver);
2301 if (err)
2302 return err;
2303
2304 btintel_version_info(hdev, &new_ver);
2305
2306 finish:
2307 /* Set the event mask for Intel specific vendor events. This enables
2308 * a few extra events that are useful during general operation. It
2309 * does not enable any debugging related events.
2310 *
2311 * The device will function correctly without these events enabled
2312 * and thus no need to fail the setup.
2313 */
2314 btintel_set_event_mask(hdev, false);
2315
2316 return 0;
2317 }
2318
btintel_get_fw_name_tlv(const struct intel_version_tlv * ver,char * fw_name,size_t len,const char * suffix)2319 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
2320 char *fw_name, size_t len,
2321 const char *suffix)
2322 {
2323 const char *format;
2324 u32 cnvi, cnvr;
2325
2326 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2327 INTEL_CNVX_TOP_STEP(ver->cnvi_top));
2328
2329 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2330 INTEL_CNVX_TOP_STEP(ver->cnvr_top));
2331
2332 /* Only Blazar product supports downloading of intermediate loader
2333 * image
2334 */
2335 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) {
2336 u8 zero[BTINTEL_FWID_MAXLEN];
2337
2338 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) {
2339 format = "intel/ibt-%04x-%04x-iml.%s";
2340 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2341 return;
2342 }
2343
2344 memset(zero, 0, sizeof(zero));
2345
2346 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */
2347 if (memcmp(ver->fw_id, zero, sizeof(zero))) {
2348 format = "intel/ibt-%04x-%04x-%s.%s";
2349 snprintf(fw_name, len, format, cnvi, cnvr,
2350 ver->fw_id, suffix);
2351 return;
2352 }
2353 /* If firmware id is not present, fallback to legacy naming
2354 * convention
2355 */
2356 }
2357 /* Fallback to legacy naming convention for other controllers
2358 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2359 */
2360 format = "intel/ibt-%04x-%04x.%s";
2361 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2362 }
2363
btintel_get_iml_tlv(const struct intel_version_tlv * ver,char * fw_name,size_t len,const char * suffix)2364 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver,
2365 char *fw_name, size_t len,
2366 const char *suffix)
2367 {
2368 const char *format;
2369 u32 cnvi, cnvr;
2370
2371 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2372 INTEL_CNVX_TOP_STEP(ver->cnvi_top));
2373
2374 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2375 INTEL_CNVX_TOP_STEP(ver->cnvr_top));
2376
2377 format = "intel/ibt-%04x-%04x-iml.%s";
2378 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2379 }
2380
btintel_prepare_fw_download_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,u32 * boot_param)2381 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
2382 struct intel_version_tlv *ver,
2383 u32 *boot_param)
2384 {
2385 const struct firmware *fw;
2386 char fwname[128];
2387 int err;
2388 ktime_t calltime;
2389
2390 if (!ver || !boot_param)
2391 return -EINVAL;
2392
2393 /* The firmware variant determines if the device is in bootloader
2394 * mode or is running operational firmware. The value 0x03 identifies
2395 * the bootloader and the value 0x23 identifies the operational
2396 * firmware.
2397 *
2398 * When the operational firmware is already present, then only
2399 * the check for valid Bluetooth device address is needed. This
2400 * determines if the device will be added as configured or
2401 * unconfigured controller.
2402 *
2403 * It is not possible to use the Secure Boot Parameters in this
2404 * case since that command is only available in bootloader mode.
2405 */
2406 if (ver->img_type == BTINTEL_IMG_OP) {
2407 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2408 btintel_check_bdaddr(hdev);
2409 } else {
2410 /*
2411 * Check for valid bd address in boot loader mode. Device
2412 * will be marked as unconfigured if empty bd address is
2413 * found.
2414 */
2415 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2416 bt_dev_info(hdev, "No device address configured");
2417 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
2418 }
2419 }
2420
2421 if (ver->img_type == BTINTEL_IMG_OP) {
2422 /* Controller running OP image. In case of FW downgrade,
2423 * FWID TLV may not be present and driver may attempt to load
2424 * firmware image which doesn't exist. Lets compare the version
2425 * of IML image
2426 */
2427 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e)
2428 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi");
2429 else
2430 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2431 } else {
2432 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2433 }
2434
2435 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2436 if (err < 0) {
2437 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2438 /* Firmware has already been loaded */
2439 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2440 return 0;
2441 }
2442
2443 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2444 fwname, err);
2445
2446 return err;
2447 }
2448
2449 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2450
2451 if (fw->size < 644) {
2452 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2453 fw->size);
2454 err = -EBADF;
2455 goto done;
2456 }
2457
2458 calltime = ktime_get();
2459
2460 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2461
2462 /* Start firmware downloading and get boot parameter */
2463 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2464 INTEL_HW_VARIANT(ver->cnvi_bt),
2465 ver->sbe_type);
2466 if (err < 0) {
2467 if (err == -EALREADY) {
2468 /* Firmware has already been loaded */
2469 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2470 err = 0;
2471 goto done;
2472 }
2473
2474 /* When FW download fails, send Intel Reset to retry
2475 * FW download.
2476 */
2477 btintel_reset_to_bootloader(hdev);
2478 goto done;
2479 }
2480
2481 /* Before switching the device into operational mode and with that
2482 * booting the loaded firmware, wait for the bootloader notification
2483 * that all fragments have been successfully received.
2484 *
2485 * When the event processing receives the notification, then the
2486 * BTUSB_DOWNLOADING flag will be cleared.
2487 *
2488 * The firmware loading should not take longer than 5 seconds
2489 * and thus just timeout if that happens and fail the setup
2490 * of this device.
2491 */
2492 err = btintel_download_wait(hdev, calltime, 5000);
2493 if (err == -ETIMEDOUT)
2494 btintel_reset_to_bootloader(hdev);
2495
2496 done:
2497 release_firmware(fw);
2498 return err;
2499 }
2500
btintel_get_codec_config_data(struct hci_dev * hdev,__u8 link,struct bt_codec * codec,__u8 * ven_len,__u8 ** ven_data)2501 static int btintel_get_codec_config_data(struct hci_dev *hdev,
2502 __u8 link, struct bt_codec *codec,
2503 __u8 *ven_len, __u8 **ven_data)
2504 {
2505 int err = 0;
2506
2507 if (!ven_data || !ven_len)
2508 return -EINVAL;
2509
2510 *ven_len = 0;
2511 *ven_data = NULL;
2512
2513 if (link != ESCO_LINK) {
2514 bt_dev_err(hdev, "Invalid link type(%u)", link);
2515 return -EINVAL;
2516 }
2517
2518 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
2519 if (!*ven_data) {
2520 err = -ENOMEM;
2521 goto error;
2522 }
2523
2524 /* supports only CVSD and mSBC offload codecs */
2525 switch (codec->id) {
2526 case 0x02:
2527 **ven_data = 0x00;
2528 break;
2529 case 0x05:
2530 **ven_data = 0x01;
2531 break;
2532 default:
2533 err = -EINVAL;
2534 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
2535 goto error;
2536 }
2537 /* codec and its capabilities are pre-defined to ids
2538 * preset id = 0x00 represents CVSD codec with sampling rate 8K
2539 * preset id = 0x01 represents mSBC codec with sampling rate 16K
2540 */
2541 *ven_len = sizeof(__u8);
2542 return err;
2543
2544 error:
2545 kfree(*ven_data);
2546 *ven_data = NULL;
2547 return err;
2548 }
2549
btintel_get_data_path_id(struct hci_dev * hdev,__u8 * data_path_id)2550 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
2551 {
2552 /* Intel uses 1 as data path id for all the usecases */
2553 *data_path_id = 1;
2554 return 0;
2555 }
2556
btintel_configure_offload(struct hci_dev * hdev)2557 static int btintel_configure_offload(struct hci_dev *hdev)
2558 {
2559 struct sk_buff *skb;
2560 int err = 0;
2561 struct intel_offload_use_cases *use_cases;
2562
2563 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT);
2564 if (IS_ERR(skb)) {
2565 bt_dev_err(hdev, "Reading offload use cases failed (%ld)",
2566 PTR_ERR(skb));
2567 return PTR_ERR(skb);
2568 }
2569
2570 if (skb->len < sizeof(*use_cases)) {
2571 err = -EIO;
2572 goto error;
2573 }
2574
2575 use_cases = (void *)skb->data;
2576
2577 if (use_cases->status) {
2578 err = -bt_to_errno(skb->data[0]);
2579 goto error;
2580 }
2581
2582 if (use_cases->preset[0] & 0x03) {
2583 hdev->get_data_path_id = btintel_get_data_path_id;
2584 hdev->get_codec_config_data = btintel_get_codec_config_data;
2585 }
2586 error:
2587 kfree_skb(skb);
2588 return err;
2589 }
2590
btintel_set_ppag(struct hci_dev * hdev,struct intel_version_tlv * ver)2591 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver)
2592 {
2593 struct sk_buff *skb;
2594 struct hci_ppag_enable_cmd ppag_cmd;
2595 acpi_handle handle;
2596 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
2597 union acpi_object *p, *elements;
2598 u32 domain, mode;
2599 acpi_status status;
2600
2601 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */
2602 switch (ver->cnvr_top & 0xFFF) {
2603 case 0x504: /* Hrp2 */
2604 case 0x202: /* Jfp2 */
2605 case 0x201: /* Jfp1 */
2606 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)",
2607 ver->cnvr_top & 0xFFF);
2608 return;
2609 }
2610
2611 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2612 if (!handle) {
2613 bt_dev_info(hdev, "No support for BT device in ACPI firmware");
2614 return;
2615 }
2616
2617 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer);
2618 if (ACPI_FAILURE(status)) {
2619 if (status == AE_NOT_FOUND) {
2620 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found");
2621 return;
2622 }
2623 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status));
2624 return;
2625 }
2626
2627 p = buffer.pointer;
2628 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) {
2629 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d",
2630 p->type, p->package.count);
2631 kfree(buffer.pointer);
2632 return;
2633 }
2634
2635 elements = p->package.elements;
2636
2637 /* PPAG table is located at element[1] */
2638 p = &elements[1];
2639
2640 domain = (u32)p->package.elements[0].integer.value;
2641 mode = (u32)p->package.elements[1].integer.value;
2642 kfree(buffer.pointer);
2643
2644 if (domain != 0x12) {
2645 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware");
2646 return;
2647 }
2648
2649 /* PPAG mode
2650 * BIT 0 : 0 Disabled in EU
2651 * 1 Enabled in EU
2652 * BIT 1 : 0 Disabled in China
2653 * 1 Enabled in China
2654 */
2655 mode &= 0x03;
2656
2657 if (!mode) {
2658 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS");
2659 return;
2660 }
2661
2662 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode);
2663
2664 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd),
2665 &ppag_cmd, HCI_CMD_TIMEOUT);
2666 if (IS_ERR(skb)) {
2667 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb));
2668 return;
2669 }
2670 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode);
2671 kfree_skb(skb);
2672 }
2673
btintel_acpi_reset_method(struct hci_dev * hdev)2674 int btintel_acpi_reset_method(struct hci_dev *hdev)
2675 {
2676 int ret = 0;
2677 acpi_status status;
2678 union acpi_object *p, *ref;
2679 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
2680
2681 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer);
2682 if (ACPI_FAILURE(status) || !buffer.pointer) {
2683 bt_dev_err(hdev, "Failed to run _PRR method");
2684 ret = -ENODEV;
2685 return ret;
2686 }
2687 p = buffer.pointer;
2688
2689 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) {
2690 bt_dev_err(hdev, "Invalid arguments");
2691 ret = -EINVAL;
2692 goto exit_on_error;
2693 }
2694
2695 ref = &p->package.elements[0];
2696 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) {
2697 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type);
2698 ret = -EINVAL;
2699 goto exit_on_error;
2700 }
2701
2702 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL);
2703 if (ACPI_FAILURE(status)) {
2704 bt_dev_err(hdev, "Failed to run_RST method");
2705 ret = -ENODEV;
2706 goto exit_on_error;
2707 }
2708
2709 exit_on_error:
2710 kfree(buffer.pointer);
2711 return ret;
2712 }
2713 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method);
2714
btintel_set_dsm_reset_method(struct hci_dev * hdev,struct intel_version_tlv * ver_tlv)2715 static void btintel_set_dsm_reset_method(struct hci_dev *hdev,
2716 struct intel_version_tlv *ver_tlv)
2717 {
2718 struct btintel_data *data = hci_get_priv(hdev);
2719 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2720 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00};
2721 union acpi_object *obj, argv4;
2722 enum {
2723 RESET_TYPE_WDISABLE2,
2724 RESET_TYPE_VSEC
2725 };
2726
2727 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2728
2729 if (!handle) {
2730 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware");
2731 return;
2732 }
2733
2734 if (!acpi_has_method(handle, "_PRR")) {
2735 bt_dev_err(hdev, "No support for _PRR ACPI method");
2736 return;
2737 }
2738
2739 switch (ver_tlv->cnvi_top & 0xfff) {
2740 case 0x910: /* GalePeak2 */
2741 reset_payload[2] = RESET_TYPE_VSEC;
2742 break;
2743 default:
2744 /* WDISABLE2 is the default reset method */
2745 reset_payload[2] = RESET_TYPE_WDISABLE2;
2746
2747 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0,
2748 BIT(DSM_SET_WDISABLE2_DELAY))) {
2749 bt_dev_err(hdev, "No dsm support to set reset delay");
2750 return;
2751 }
2752 argv4.integer.type = ACPI_TYPE_INTEGER;
2753 /* delay required to toggle BT power */
2754 argv4.integer.value = 160;
2755 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0,
2756 DSM_SET_WDISABLE2_DELAY, &argv4);
2757 if (!obj) {
2758 bt_dev_err(hdev, "Failed to call dsm to set reset delay");
2759 return;
2760 }
2761 ACPI_FREE(obj);
2762 }
2763
2764 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]);
2765
2766 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0,
2767 DSM_SET_RESET_METHOD)) {
2768 bt_dev_warn(hdev, "No support for dsm to set reset method");
2769 return;
2770 }
2771 argv4.buffer.type = ACPI_TYPE_BUFFER;
2772 argv4.buffer.length = sizeof(reset_payload);
2773 argv4.buffer.pointer = reset_payload;
2774
2775 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0,
2776 DSM_SET_RESET_METHOD, &argv4);
2777 if (!obj) {
2778 bt_dev_err(hdev, "Failed to call dsm to set reset method");
2779 return;
2780 }
2781 ACPI_FREE(obj);
2782 data->acpi_reset_method = btintel_acpi_reset_method;
2783 }
2784
2785 #define BTINTEL_ISODATA_HANDLE_BASE 0x900
2786
btintel_classify_pkt_type(struct hci_dev * hdev,struct sk_buff * skb)2787 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
2788 {
2789 /*
2790 * Distinguish ISO data packets form ACL data packets
2791 * based on their connection handle value range.
2792 */
2793 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) {
2794 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE)
2795 return HCI_ISODATA_PKT;
2796 }
2797
2798 return hci_skb_pkt_type(skb);
2799 }
2800
2801 /*
2802 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms
2803 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to
2804 * overcome the potential STEP errors on their designs. Based on the
2805 * configauration, bluetooth firmware shall adjust the BRI response line drive
2806 * strength. The below structure represents DSBR data.
2807 * struct {
2808 * u8 header;
2809 * u32 dsbr;
2810 * } __packed;
2811 *
2812 * header - defines revision number of the structure
2813 * dsbr - defines drive strength BRI response
2814 * bit0
2815 * 0 - instructs bluetooth firmware to use default values
2816 * 1 - instructs bluetooth firmware to override default values
2817 * bit3:1
2818 * Reserved
2819 * bit7:4
2820 * DSBR override values (only if bit0 is set. Default value is 0xF
2821 * bit31:7
2822 * Reserved
2823 * Expected values for dsbr field:
2824 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm
2825 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm
2826 * 3. Non existing UEFI variable or invalid (none of the above) - indicates
2827 * that the resistor on board is 10 Ohm
2828 * Even if uefi variable is not present, driver shall send 0xfc0a command to
2829 * firmware to use default values.
2830 *
2831 */
btintel_uefi_get_dsbr(u32 * dsbr_var)2832 static int btintel_uefi_get_dsbr(u32 *dsbr_var)
2833 {
2834 struct btintel_dsbr {
2835 u8 header;
2836 u32 dsbr;
2837 } __packed data;
2838
2839 efi_status_t status;
2840 unsigned long data_size = sizeof(data);
2841 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03,
2842 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31);
2843
2844 if (!IS_ENABLED(CONFIG_EFI))
2845 return -EOPNOTSUPP;
2846
2847 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
2848 return -EOPNOTSUPP;
2849
2850 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size,
2851 &data);
2852
2853 if (status != EFI_SUCCESS || data_size != sizeof(data))
2854 return -ENXIO;
2855
2856 *dsbr_var = data.dsbr;
2857 return 0;
2858 }
2859
btintel_set_dsbr(struct hci_dev * hdev,struct intel_version_tlv * ver)2860 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver)
2861 {
2862 struct btintel_dsbr_cmd {
2863 u8 enable;
2864 u8 dsbr;
2865 } __packed;
2866
2867 struct btintel_dsbr_cmd cmd;
2868 struct sk_buff *skb;
2869 u32 dsbr;
2870 u8 status, hw_variant;
2871 int err;
2872
2873 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt);
2874 /* DSBR command needs to be sent for,
2875 * 1. BlazarI or BlazarIW + B0 step product in IML image.
2876 * 2. Gale Peak2 or BlazarU in OP image.
2877 * 3. Scorpious Peak in IML image.
2878 * 4. Scorpious Peak2 onwards + PCIe transport in IML image.
2879 */
2880
2881 switch (hw_variant) {
2882 case BTINTEL_HWID_BZRI:
2883 case BTINTEL_HWID_BZRIW:
2884 if (ver->img_type == BTINTEL_IMG_IML &&
2885 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01)
2886 break;
2887 return 0;
2888 case BTINTEL_HWID_GAP:
2889 case BTINTEL_HWID_BZRU:
2890 if (ver->img_type == BTINTEL_IMG_OP &&
2891 hdev->bus == HCI_USB)
2892 break;
2893 return 0;
2894 case BTINTEL_HWID_SCP:
2895 if (ver->img_type == BTINTEL_IMG_IML)
2896 break;
2897 return 0;
2898 default:
2899 /* Scorpius Peak2 onwards */
2900 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI
2901 && ver->img_type == BTINTEL_IMG_IML)
2902 break;
2903 return 0;
2904 }
2905
2906 dsbr = 0;
2907 err = btintel_uefi_get_dsbr(&dsbr);
2908 if (err < 0)
2909 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)",
2910 BTINTEL_EFI_DSBR, err);
2911
2912 cmd.enable = dsbr & BIT(0);
2913 cmd.dsbr = dsbr >> 4 & 0xF;
2914
2915 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable,
2916 cmd.dsbr);
2917
2918 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT);
2919 if (IS_ERR(skb))
2920 return -bt_to_errno(PTR_ERR(skb));
2921
2922 status = skb->data[0];
2923 kfree_skb(skb);
2924
2925 if (status)
2926 return -bt_to_errno(status);
2927
2928 return 0;
2929 }
2930
2931 #ifdef CONFIG_ACPI
btintel_evaluate_acpi_method(struct hci_dev * hdev,acpi_string method,union acpi_object ** ptr,u8 pkg_size)2932 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev,
2933 acpi_string method,
2934 union acpi_object **ptr,
2935 u8 pkg_size)
2936 {
2937 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
2938 union acpi_object *p;
2939 acpi_status status;
2940 acpi_handle handle;
2941
2942 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2943 if (!handle) {
2944 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device");
2945 return AE_NOT_EXIST;
2946 }
2947
2948 status = acpi_evaluate_object(handle, method, NULL, &buffer);
2949
2950 if (ACPI_FAILURE(status)) {
2951 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s",
2952 acpi_format_exception(status), method);
2953 return status;
2954 }
2955
2956 p = buffer.pointer;
2957
2958 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) {
2959 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d",
2960 p->type, p->package.count);
2961 kfree(buffer.pointer);
2962 return AE_ERROR;
2963 }
2964
2965 *ptr = buffer.pointer;
2966 return 0;
2967 }
2968
btintel_acpi_get_bt_pkg(union acpi_object * buffer)2969 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer)
2970 {
2971 union acpi_object *domain, *bt_pkg;
2972 int i;
2973
2974 for (i = 1; i < buffer->package.count; i++) {
2975 bt_pkg = &buffer->package.elements[i];
2976 domain = &bt_pkg->package.elements[0];
2977 if (domain->type == ACPI_TYPE_INTEGER &&
2978 domain->integer.value == BTINTEL_BT_DOMAIN)
2979 return bt_pkg;
2980 }
2981 return ERR_PTR(-ENOENT);
2982 }
2983
btintel_send_sar_ddc(struct hci_dev * hdev,struct btintel_cp_ddc_write * data,u8 len)2984 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len)
2985 {
2986 struct sk_buff *skb;
2987
2988 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT);
2989 if (IS_ERR(skb)) {
2990 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)",
2991 le16_to_cpu(data->id), PTR_ERR(skb));
2992 return PTR_ERR(skb);
2993 }
2994 kfree_skb(skb);
2995 return 0;
2996 }
2997
btintel_send_edr(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2998 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2999 int id, struct btintel_sar_inc_pwr *sar)
3000 {
3001 cmd->len = 5;
3002 cmd->id = cpu_to_le16(id);
3003 cmd->data[0] = sar->br >> 3;
3004 cmd->data[1] = sar->edr2 >> 3;
3005 cmd->data[2] = sar->edr3 >> 3;
3006 return btintel_send_sar_ddc(hdev, cmd, 6);
3007 }
3008
btintel_send_le(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3009 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3010 int id, struct btintel_sar_inc_pwr *sar)
3011 {
3012 cmd->len = 3;
3013 cmd->id = cpu_to_le16(id);
3014 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3;
3015 return btintel_send_sar_ddc(hdev, cmd, 4);
3016 }
3017
btintel_send_br(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3018 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3019 int id, struct btintel_sar_inc_pwr *sar)
3020 {
3021 cmd->len = 3;
3022 cmd->id = cpu_to_le16(id);
3023 cmd->data[0] = sar->br >> 3;
3024 return btintel_send_sar_ddc(hdev, cmd, 4);
3025 }
3026
btintel_send_br_mutual(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3027 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3028 int id, struct btintel_sar_inc_pwr *sar)
3029 {
3030 cmd->len = 3;
3031 cmd->id = cpu_to_le16(id);
3032 cmd->data[0] = sar->br;
3033 return btintel_send_sar_ddc(hdev, cmd, 4);
3034 }
3035
btintel_send_edr2(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3036 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3037 int id, struct btintel_sar_inc_pwr *sar)
3038 {
3039 cmd->len = 3;
3040 cmd->id = cpu_to_le16(id);
3041 cmd->data[0] = sar->edr2;
3042 return btintel_send_sar_ddc(hdev, cmd, 4);
3043 }
3044
btintel_send_edr3(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3045 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3046 int id, struct btintel_sar_inc_pwr *sar)
3047 {
3048 cmd->len = 3;
3049 cmd->id = cpu_to_le16(id);
3050 cmd->data[0] = sar->edr3;
3051 return btintel_send_sar_ddc(hdev, cmd, 4);
3052 }
3053
btintel_set_legacy_sar(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar)3054 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar)
3055 {
3056 struct btintel_cp_ddc_write *cmd;
3057 u8 buffer[64];
3058 int ret;
3059
3060 cmd = (void *)buffer;
3061 ret = btintel_send_br(hdev, cmd, 0x0131, sar);
3062 if (ret)
3063 return ret;
3064
3065 ret = btintel_send_br(hdev, cmd, 0x0132, sar);
3066 if (ret)
3067 return ret;
3068
3069 ret = btintel_send_le(hdev, cmd, 0x0133, sar);
3070 if (ret)
3071 return ret;
3072
3073 ret = btintel_send_edr(hdev, cmd, 0x0137, sar);
3074 if (ret)
3075 return ret;
3076
3077 ret = btintel_send_edr(hdev, cmd, 0x0138, sar);
3078 if (ret)
3079 return ret;
3080
3081 ret = btintel_send_edr(hdev, cmd, 0x013b, sar);
3082 if (ret)
3083 return ret;
3084
3085 ret = btintel_send_edr(hdev, cmd, 0x013c, sar);
3086
3087 return ret;
3088 }
3089
btintel_set_mutual_sar(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar)3090 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar)
3091 {
3092 struct btintel_cp_ddc_write *cmd;
3093 struct sk_buff *skb;
3094 u8 buffer[64];
3095 bool enable;
3096 int ret;
3097
3098 cmd = (void *)buffer;
3099
3100 cmd->len = 3;
3101 cmd->id = cpu_to_le16(0x019e);
3102
3103 if (sar->revision == BTINTEL_SAR_INC_PWR &&
3104 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED)
3105 cmd->data[0] = 0x01;
3106 else
3107 cmd->data[0] = 0x00;
3108
3109 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3110 if (ret)
3111 return ret;
3112
3113 if (sar->revision == BTINTEL_SAR_INC_PWR &&
3114 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) {
3115 cmd->len = 3;
3116 cmd->id = cpu_to_le16(0x019f);
3117 cmd->data[0] = sar->sar_2400_chain_a;
3118
3119 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3120 if (ret)
3121 return ret;
3122 }
3123
3124 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar);
3125 if (ret)
3126 return ret;
3127
3128 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar);
3129 if (ret)
3130 return ret;
3131
3132 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar);
3133 if (ret)
3134 return ret;
3135
3136 ret = btintel_send_le(hdev, cmd, 0x01a3, sar);
3137 if (ret)
3138 return ret;
3139
3140 enable = true;
3141 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT);
3142 if (IS_ERR(skb)) {
3143 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb));
3144 return PTR_ERR(skb);
3145 }
3146
3147 kfree_skb(skb);
3148 return 0;
3149 }
3150
3151 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band
3152 *
3153 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value].
3154 * cmd->len = 4 (2 id + 2 data)
3155 * HCI total = 5 bytes (1 len + 4)
3156 */
btintel_send_sar_rev2_band(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,u16 id,u8 chain_a,u8 chain_b)3157 static int btintel_send_sar_rev2_band(struct hci_dev *hdev,
3158 struct btintel_cp_ddc_write *cmd,
3159 u16 id, u8 chain_a, u8 chain_b)
3160 {
3161 cmd->len = 4;
3162 cmd->id = cpu_to_le16(id);
3163 cmd->data[0] = chain_a;
3164 cmd->data[1] = chain_b;
3165 return btintel_send_sar_ddc(hdev, cmd, 5);
3166 }
3167
btintel_set_sar_rev2(struct hci_dev * hdev,struct btintel_sar_rev2 * sar)3168 static int btintel_set_sar_rev2(struct hci_dev *hdev,
3169 struct btintel_sar_rev2 *sar)
3170 {
3171 struct btintel_cp_ddc_write *cmd;
3172 struct sk_buff *skb;
3173 u8 buffer[64];
3174 u8 enable;
3175 int ret;
3176
3177 cmd = (void *)buffer;
3178
3179 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */
3180 cmd->len = 3;
3181 cmd->id = cpu_to_le16(0x019e);
3182 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ?
3183 0x01 : 0x00;
3184 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3185 if (ret)
3186 return ret;
3187
3188 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */
3189 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311,
3190 sar->chain_a.subband_2g4,
3191 sar->chain_b.subband_2g4);
3192 if (ret)
3193 return ret;
3194
3195 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312,
3196 sar->chain_a.subband_5g2,
3197 sar->chain_b.subband_5g2);
3198 if (ret)
3199 return ret;
3200
3201 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */
3202 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313,
3203 sar->chain_a.subband_5g8_5g9,
3204 sar->chain_b.subband_5g8_5g9);
3205 if (ret)
3206 return ret;
3207
3208 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314,
3209 sar->chain_a.subband_5g8_5g9,
3210 sar->chain_b.subband_5g8_5g9);
3211 if (ret)
3212 return ret;
3213
3214 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315,
3215 sar->chain_a.subband_6g1,
3216 sar->chain_b.subband_6g1);
3217 if (ret)
3218 return ret;
3219
3220 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316,
3221 sar->chain_a.subband_6g3,
3222 sar->chain_b.subband_6g3);
3223 if (ret)
3224 return ret;
3225
3226 /* Notify firmware that SAR initialisation is complete */
3227 enable = 0x01;
3228 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT);
3229 if (IS_ERR(skb)) {
3230 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)",
3231 PTR_ERR(skb));
3232 return PTR_ERR(skb);
3233 }
3234
3235 kfree_skb(skb);
3236 return 0;
3237 }
3238
btintel_sar_rev2_send_to_device(struct hci_dev * hdev,struct btintel_sar_rev2 * sar,struct intel_version_tlv * ver)3239 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev,
3240 struct btintel_sar_rev2 *sar,
3241 struct intel_version_tlv *ver)
3242 {
3243 u16 cnvi = ver->cnvi_top & 0xfff;
3244 u16 cnvr = ver->cnvr_top & 0xfff;
3245
3246 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) {
3247 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)",
3248 cnvi, cnvr);
3249 return -EOPNOTSUPP;
3250 }
3251
3252 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2");
3253 return btintel_set_sar_rev2(hdev, sar);
3254 }
3255
btintel_sar_send_to_device(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar,struct intel_version_tlv * ver)3256 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar,
3257 struct intel_version_tlv *ver)
3258 {
3259 u16 cnvi, cnvr;
3260 int ret;
3261
3262 cnvi = ver->cnvi_top & 0xfff;
3263 cnvr = ver->cnvr_top & 0xfff;
3264
3265 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) {
3266 bt_dev_info(hdev, "Applying legacy Bluetooth SAR");
3267 ret = btintel_set_legacy_sar(hdev, sar);
3268 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) {
3269 bt_dev_info(hdev, "Applying mutual Bluetooth SAR");
3270 ret = btintel_set_mutual_sar(hdev, sar);
3271 } else {
3272 ret = -EOPNOTSUPP;
3273 }
3274
3275 return ret;
3276 }
3277
btintel_acpi_set_sar(struct hci_dev * hdev,struct intel_version_tlv * ver)3278 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver)
3279 {
3280 union acpi_object *bt_pkg, *buffer = NULL;
3281 struct btintel_sar_inc_pwr sar;
3282 struct btintel_sar_rev2 sar_rev2;
3283 acpi_status status;
3284 u8 revision;
3285 int ret;
3286
3287 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2);
3288 if (ACPI_FAILURE(status))
3289 return -ENOENT;
3290
3291 bt_pkg = btintel_acpi_get_bt_pkg(buffer);
3292
3293 if (IS_ERR(bt_pkg)) {
3294 ret = PTR_ERR(bt_pkg);
3295 goto error;
3296 }
3297
3298 if (!bt_pkg->package.count) {
3299 ret = -EINVAL;
3300 goto error;
3301 }
3302
3303 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) {
3304 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field");
3305 ret = -EINVAL;
3306 goto error;
3307 }
3308
3309 revision = buffer->package.elements[0].integer.value;
3310
3311 if (revision > BTINTEL_SAR_REV2) {
3312 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision);
3313 ret = -EOPNOTSUPP;
3314 goto error;
3315 }
3316
3317 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) {
3318 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12),
3319 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32),
3320 * 3..12 = per-chain sub-band limits (u8 each).
3321 */
3322 static const u64 rev2_max[13] = {
3323 U8_MAX, /* domain ID */
3324 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */
3325 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */
3326 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */
3327 };
3328 union acpi_object *e;
3329 int i;
3330
3331 for (i = 0; i < 13; i++) {
3332 e = &bt_pkg->package.elements[i];
3333 if (e->type != ACPI_TYPE_INTEGER) {
3334 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d",
3335 i);
3336 ret = -EINVAL;
3337 goto error;
3338 }
3339 if (e->integer.value > rev2_max[i]) {
3340 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range",
3341 i, e->integer.value);
3342 ret = -ERANGE;
3343 goto error;
3344 }
3345 }
3346
3347 memset(&sar_rev2, 0, sizeof(sar_rev2));
3348 sar_rev2.revision = revision;
3349 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3350
3351 if (sar_rev2.bt_sar_bios != 1) {
3352 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled");
3353 ret = -EOPNOTSUPP;
3354 goto error;
3355 }
3356
3357 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value;
3358
3359 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value;
3360 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value;
3361 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value;
3362 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value;
3363 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value;
3364
3365 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value;
3366 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value;
3367 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value;
3368 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value;
3369 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value;
3370
3371 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u",
3372 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode);
3373 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
3374 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2,
3375 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1,
3376 sar_rev2.chain_a.subband_6g3);
3377 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
3378 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2,
3379 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1,
3380 sar_rev2.chain_b.subband_6g3);
3381
3382 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver);
3383 goto error;
3384 }
3385
3386 if (revision == BTINTEL_SAR_REV2) {
3387 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)",
3388 bt_pkg->package.count);
3389 ret = -EINVAL;
3390 goto error;
3391 }
3392
3393 memset(&sar, 0, sizeof(sar));
3394
3395 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) {
3396 sar.revision = revision;
3397 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3398 sar.br = bt_pkg->package.elements[2].integer.value;
3399 sar.edr2 = bt_pkg->package.elements[3].integer.value;
3400 sar.edr3 = bt_pkg->package.elements[4].integer.value;
3401 sar.le = bt_pkg->package.elements[5].integer.value;
3402 sar.le_2mhz = bt_pkg->package.elements[6].integer.value;
3403 sar.le_lr = bt_pkg->package.elements[7].integer.value;
3404
3405 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) {
3406 sar.revision = revision;
3407 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3408 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value;
3409 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value;
3410 sar.br = bt_pkg->package.elements[4].integer.value;
3411 sar.edr2 = bt_pkg->package.elements[5].integer.value;
3412 sar.edr3 = bt_pkg->package.elements[6].integer.value;
3413 sar.le = bt_pkg->package.elements[7].integer.value;
3414 sar.le_2mhz = bt_pkg->package.elements[8].integer.value;
3415 sar.le_lr = bt_pkg->package.elements[9].integer.value;
3416 } else {
3417 ret = -EINVAL;
3418 goto error;
3419 }
3420
3421 /* Apply only if it is enabled in BIOS */
3422 if (sar.bt_sar_bios != 1) {
3423 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled");
3424 ret = -EOPNOTSUPP;
3425 goto error;
3426 }
3427
3428 ret = btintel_sar_send_to_device(hdev, &sar, ver);
3429 error:
3430 kfree(buffer);
3431 return ret;
3432 }
3433 #endif /* CONFIG_ACPI */
3434
btintel_set_specific_absorption_rate(struct hci_dev * hdev,struct intel_version_tlv * ver)3435 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev,
3436 struct intel_version_tlv *ver)
3437 {
3438 #ifdef CONFIG_ACPI
3439 return btintel_acpi_set_sar(hdev, ver);
3440 #endif
3441 return 0;
3442 }
3443
btintel_bootloader_setup_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver)3444 int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
3445 struct intel_version_tlv *ver)
3446 {
3447 u32 boot_param;
3448 char ddcname[64];
3449 int err;
3450 struct intel_version_tlv new_ver;
3451
3452 bt_dev_dbg(hdev, "");
3453
3454 /* Set the default boot parameter to 0x0 and it is updated to
3455 * SKU specific boot parameter after reading Intel_Write_Boot_Params
3456 * command while downloading the firmware.
3457 */
3458 boot_param = 0x00000000;
3459
3460 /* In case of PCIe, this function might get called multiple times with
3461 * same hdev instance if there is any error on firmware download.
3462 * Need to clear stale bits of previous firmware download attempt.
3463 */
3464 for (int i = 0; i < __INTEL_NUM_FLAGS; i++)
3465 btintel_clear_flag(hdev, i);
3466
3467 btintel_set_flag(hdev, INTEL_BOOTLOADER);
3468
3469 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
3470 if (err)
3471 return err;
3472
3473 /* check if controller is already having an operational firmware */
3474 if (ver->img_type == BTINTEL_IMG_OP)
3475 goto finish;
3476
3477 err = btintel_boot(hdev, boot_param);
3478 if (err)
3479 return err;
3480
3481 err = btintel_read_version_tlv(hdev, ver);
3482 if (err)
3483 return err;
3484
3485 /* set drive strength of BRI response */
3486 err = btintel_set_dsbr(hdev, ver);
3487 if (err) {
3488 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err);
3489 return err;
3490 }
3491
3492 /* If image type returned is BTINTEL_IMG_IML, then controller supports
3493 * intermediate loader image
3494 */
3495 if (ver->img_type == BTINTEL_IMG_IML) {
3496 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
3497 if (err)
3498 return err;
3499
3500 err = btintel_boot(hdev, boot_param);
3501 if (err)
3502 return err;
3503 }
3504
3505 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
3506
3507 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
3508 /* Once the device is running in operational mode, it needs to
3509 * apply the device configuration (DDC) parameters.
3510 *
3511 * The device can work without DDC parameters, so even if it
3512 * fails to load the file, no need to fail the setup.
3513 */
3514 btintel_load_ddc_config(hdev, ddcname);
3515
3516 /* Read supported use cases and set callbacks to fetch datapath id */
3517 btintel_configure_offload(hdev);
3518
3519 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
3520
3521 /* Send sar values to controller */
3522 btintel_set_specific_absorption_rate(hdev, ver);
3523
3524 /* Set PPAG feature */
3525 btintel_set_ppag(hdev, ver);
3526
3527 /* Read the Intel version information after loading the FW */
3528 err = btintel_read_version_tlv(hdev, &new_ver);
3529 if (err)
3530 return err;
3531
3532 btintel_version_info_tlv(hdev, &new_ver);
3533
3534 finish:
3535 /* Set the event mask for Intel specific vendor events. This enables
3536 * a few extra events that are useful during general operation. It
3537 * does not enable any debugging related events.
3538 *
3539 * The device will function correctly without these events enabled
3540 * and thus no need to fail the setup.
3541 */
3542 btintel_set_event_mask(hdev, false);
3543
3544 return 0;
3545 }
3546 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv);
3547
btintel_set_msft_opcode(struct hci_dev * hdev,u8 hw_variant)3548 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
3549 {
3550 switch (hw_variant) {
3551 /* Legacy bootloader devices that supports MSFT Extension */
3552 case 0x11: /* JfP */
3553 case 0x12: /* ThP */
3554 case 0x13: /* HrP */
3555 case 0x14: /* CcP */
3556 /* All Intel new generation controllers support the Microsoft vendor
3557 * extension are using 0xFC1E for VsMsftOpCode.
3558 */
3559 case 0x17:
3560 case 0x18:
3561 case 0x19:
3562 case 0x1b:
3563 case 0x1c:
3564 case 0x1d:
3565 case 0x1e:
3566 case 0x1f:
3567 case 0x20:
3568 case 0x21:
3569 case 0x22:
3570 hci_set_msft_opcode(hdev, 0xFC1E);
3571 break;
3572 default:
3573 /* Not supported */
3574 break;
3575 }
3576 }
3577 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode);
3578
btintel_print_fseq_info(struct hci_dev * hdev)3579 void btintel_print_fseq_info(struct hci_dev *hdev)
3580 {
3581 struct sk_buff *skb;
3582 u8 *p;
3583 u32 val;
3584 const char *str;
3585
3586 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT);
3587 if (IS_ERR(skb)) {
3588 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)",
3589 PTR_ERR(skb));
3590 return;
3591 }
3592
3593 if (skb->len < (sizeof(u32) * 16 + 2)) {
3594 bt_dev_dbg(hdev, "Malformed packet of length %u received",
3595 skb->len);
3596 kfree_skb(skb);
3597 return;
3598 }
3599
3600 p = skb_pull_data(skb, 1);
3601 if (*p) {
3602 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p);
3603 kfree_skb(skb);
3604 return;
3605 }
3606
3607 p = skb_pull_data(skb, 1);
3608 switch (*p) {
3609 case 0:
3610 str = "Success";
3611 break;
3612 case 1:
3613 str = "Fatal error";
3614 break;
3615 case 2:
3616 str = "Semaphore acquire error";
3617 break;
3618 default:
3619 str = "Unknown error";
3620 break;
3621 }
3622
3623 if (*p) {
3624 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
3625 kfree_skb(skb);
3626 return;
3627 }
3628
3629 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
3630
3631 val = get_unaligned_le32(skb_pull_data(skb, 4));
3632 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val);
3633
3634 val = get_unaligned_le32(skb_pull_data(skb, 4));
3635 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val);
3636
3637 val = get_unaligned_le32(skb_pull_data(skb, 4));
3638 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val);
3639
3640 p = skb->data;
3641 skb_pull_data(skb, 4);
3642 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
3643 p[2], p[3]);
3644
3645 p = skb->data;
3646 skb_pull_data(skb, 4);
3647 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
3648 p[2], p[3]);
3649
3650 val = get_unaligned_le32(skb_pull_data(skb, 4));
3651 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val);
3652
3653 val = get_unaligned_le32(skb_pull_data(skb, 4));
3654 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val);
3655
3656 val = get_unaligned_le32(skb_pull_data(skb, 4));
3657 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val);
3658
3659 val = get_unaligned_le32(skb_pull_data(skb, 4));
3660 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val);
3661
3662 val = get_unaligned_le32(skb_pull_data(skb, 4));
3663 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val);
3664
3665 val = get_unaligned_le32(skb_pull_data(skb, 4));
3666 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val);
3667
3668 val = get_unaligned_le32(skb_pull_data(skb, 4));
3669 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val);
3670
3671 val = get_unaligned_le32(skb_pull_data(skb, 4));
3672 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val);
3673
3674 val = get_unaligned_le32(skb_pull_data(skb, 4));
3675 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val);
3676
3677 val = get_unaligned_le32(skb_pull_data(skb, 4));
3678 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val);
3679
3680 val = get_unaligned_le32(skb_pull_data(skb, 4));
3681 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val);
3682
3683 val = get_unaligned_le32(skb_pull_data(skb, 4));
3684 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val);
3685
3686 val = get_unaligned_le32(skb_pull_data(skb, 4));
3687 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val);
3688
3689 kfree_skb(skb);
3690 }
3691 EXPORT_SYMBOL_GPL(btintel_print_fseq_info);
3692
btintel_setup_combined(struct hci_dev * hdev)3693 static int btintel_setup_combined(struct hci_dev *hdev)
3694 {
3695 const u8 param[1] = { 0xFF };
3696 struct intel_version ver;
3697 struct intel_version_tlv ver_tlv;
3698 struct sk_buff *skb;
3699 int err;
3700
3701 BT_DBG("%s", hdev->name);
3702
3703 /* The some controllers have a bug with the first HCI command sent to it
3704 * returning number of completed commands as zero. This would stall the
3705 * command processing in the Bluetooth core.
3706 *
3707 * As a workaround, send HCI Reset command first which will reset the
3708 * number of completed commands and allow normal command processing
3709 * from now on.
3710 *
3711 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe
3712 * in the SW_RFKILL ON state as a workaround of fixing LED issue during
3713 * the shutdown() procedure, and once the device is in SW_RFKILL ON
3714 * state, the only way to exit out of it is sending the HCI_Reset
3715 * command.
3716 */
3717 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) ||
3718 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
3719 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
3720 HCI_INIT_TIMEOUT);
3721 if (IS_ERR(skb)) {
3722 bt_dev_err(hdev,
3723 "sending initial HCI reset failed (%ld)",
3724 PTR_ERR(skb));
3725 return PTR_ERR(skb);
3726 }
3727 kfree_skb(skb);
3728 }
3729
3730 /* Starting from TyP device, the command parameter and response are
3731 * changed even though the OCF for HCI_Intel_Read_Version command
3732 * remains same. The legacy devices can handle even if the
3733 * command has a parameter and returns a correct version information.
3734 * So, it uses new format to support both legacy and new format.
3735 */
3736 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
3737 if (IS_ERR(skb)) {
3738 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
3739 PTR_ERR(skb));
3740 return PTR_ERR(skb);
3741 }
3742
3743 /* Check the status */
3744 if (skb->data[0]) {
3745 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
3746 skb->data[0]);
3747 err = -EIO;
3748 goto exit_error;
3749 }
3750
3751 /* Apply the common HCI quirks for Intel device */
3752 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);
3753 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
3754 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG);
3755
3756 /* Set up the quality report callback for Intel devices */
3757 hdev->set_quality_report = btintel_set_quality_report;
3758
3759 /* For Legacy device, check the HW platform value and size */
3760 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
3761 bt_dev_dbg(hdev, "Read the legacy Intel version information");
3762
3763 memcpy(&ver, skb->data, sizeof(ver));
3764
3765 /* Display version information */
3766 btintel_version_info(hdev, &ver);
3767
3768 /* Check for supported iBT hardware variants of this firmware
3769 * loading method.
3770 *
3771 * This check has been put in place to ensure correct forward
3772 * compatibility options when newer hardware variants come
3773 * along.
3774 */
3775 switch (ver.hw_variant) {
3776 case 0x07: /* WP */
3777 case 0x08: /* StP */
3778 /* Legacy ROM product */
3779 btintel_set_flag(hdev, INTEL_ROM_LEGACY);
3780
3781 /* Apply the device specific HCI quirks
3782 *
3783 * WBS for SdP - For the Legacy ROM products, only SdP
3784 * supports the WBS. But the version information is not
3785 * enough to use here because the StP2 and SdP have same
3786 * hw_variant and fw_variant. So, this flag is set by
3787 * the transport driver (btusb) based on the HW info
3788 * (idProduct)
3789 */
3790 if (!btintel_test_flag(hdev,
3791 INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
3792 hci_set_quirk(hdev,
3793 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3794
3795 err = btintel_legacy_rom_setup(hdev, &ver);
3796 break;
3797 case 0x0b: /* SfP */
3798 case 0x11: /* JfP */
3799 case 0x12: /* ThP */
3800 case 0x13: /* HrP */
3801 case 0x14: /* CcP */
3802 fallthrough;
3803 case 0x0c: /* WsP */
3804 /* Apply the device specific HCI quirks
3805 *
3806 * All Legacy bootloader devices support WBS
3807 */
3808 hci_set_quirk(hdev,
3809 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3810
3811 /* These variants don't seem to support LE Coded PHY */
3812 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);
3813
3814 /* Setup MSFT Extension support */
3815 btintel_set_msft_opcode(hdev, ver.hw_variant);
3816
3817 err = btintel_bootloader_setup(hdev, &ver);
3818 btintel_register_devcoredump_support(hdev);
3819 break;
3820 default:
3821 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
3822 ver.hw_variant);
3823 err = -EINVAL;
3824 }
3825
3826 hci_set_hw_info(hdev,
3827 "INTEL platform=%u variant=%u revision=%u",
3828 ver.hw_platform, ver.hw_variant,
3829 ver.hw_revision);
3830
3831 goto exit_error;
3832 }
3833
3834 /* memset ver_tlv to start with clean state as few fields are exclusive
3835 * to bootloader mode and are not populated in operational mode
3836 */
3837 memset(&ver_tlv, 0, sizeof(ver_tlv));
3838 /* For TLV type device, parse the tlv data */
3839 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
3840 if (err) {
3841 bt_dev_err(hdev, "Failed to parse TLV version information");
3842 goto exit_error;
3843 }
3844
3845 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
3846 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
3847 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
3848 err = -EINVAL;
3849 goto exit_error;
3850 }
3851
3852 /* Check for supported iBT hardware variants of this firmware
3853 * loading method.
3854 *
3855 * This check has been put in place to ensure correct forward
3856 * compatibility options when newer hardware variants come
3857 * along.
3858 */
3859 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
3860 case 0x11: /* JfP */
3861 case 0x12: /* ThP */
3862 case 0x13: /* HrP */
3863 case 0x14: /* CcP */
3864 /* Some legacy bootloader devices starting from JfP,
3865 * the operational firmware supports both old and TLV based
3866 * HCI_Intel_Read_Version command based on the command
3867 * parameter.
3868 *
3869 * For upgrading firmware case, the TLV based version cannot
3870 * be used because the firmware filename for legacy bootloader
3871 * is based on the old format.
3872 *
3873 * Also, it is not easy to convert TLV based version from the
3874 * legacy version format.
3875 *
3876 * So, as a workaround for those devices, use the legacy
3877 * HCI_Intel_Read_Version to get the version information and
3878 * run the legacy bootloader setup.
3879 */
3880 err = btintel_read_version(hdev, &ver);
3881 if (err)
3882 break;
3883
3884 /* Apply the device specific HCI quirks
3885 *
3886 * All Legacy bootloader devices support WBS
3887 */
3888 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3889
3890 /* These variants don't seem to support LE Coded PHY */
3891 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);
3892
3893 /* Setup MSFT Extension support */
3894 btintel_set_msft_opcode(hdev, ver.hw_variant);
3895
3896 err = btintel_bootloader_setup(hdev, &ver);
3897 btintel_register_devcoredump_support(hdev);
3898 break;
3899 case 0x18: /* GfP2 */
3900 case 0x1c: /* GaP */
3901 /* Re-classify packet type for controllers with LE audio */
3902 hdev->classify_pkt_type = btintel_classify_pkt_type;
3903 fallthrough;
3904 case 0x17:
3905 case 0x19:
3906 case 0x1b:
3907 case 0x1d:
3908 case 0x1e:
3909 case 0x1f:
3910 case 0x20:
3911 case 0x21:
3912 case 0x22:
3913 /* Display version information of TLV type */
3914 btintel_version_info_tlv(hdev, &ver_tlv);
3915
3916 /* Apply the device specific HCI quirks for TLV based devices
3917 *
3918 * All TLV based devices support WBS
3919 */
3920 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3921
3922 /* Setup MSFT Extension support */
3923 btintel_set_msft_opcode(hdev,
3924 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3925 btintel_set_dsm_reset_method(hdev, &ver_tlv);
3926
3927 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
3928 if (err)
3929 goto exit_error;
3930
3931 btintel_register_devcoredump_support(hdev);
3932 btintel_print_fseq_info(hdev);
3933 break;
3934 default:
3935 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
3936 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3937 err = -EINVAL;
3938 break;
3939 }
3940
3941 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u",
3942 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt),
3943 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3944
3945 exit_error:
3946 kfree_skb(skb);
3947
3948 return err;
3949 }
3950
btintel_shutdown_combined(struct hci_dev * hdev)3951 int btintel_shutdown_combined(struct hci_dev *hdev)
3952 {
3953 struct sk_buff *skb;
3954 int ret;
3955
3956 /* Send HCI Reset to the controller to stop any BT activity which
3957 * were triggered. This will help to save power and maintain the
3958 * sync b/w Host and controller
3959 */
3960 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3961 if (IS_ERR(skb)) {
3962 bt_dev_err(hdev, "HCI reset during shutdown failed");
3963 return PTR_ERR(skb);
3964 }
3965 kfree_skb(skb);
3966
3967
3968 /* Some platforms have an issue with BT LED when the interface is
3969 * down or BT radio is turned off, which takes 5 seconds to BT LED
3970 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the
3971 * device in the RFKILL ON state which turns off the BT LED immediately.
3972 */
3973 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
3974 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
3975 if (IS_ERR(skb)) {
3976 ret = PTR_ERR(skb);
3977 bt_dev_err(hdev, "turning off Intel device LED failed");
3978 return ret;
3979 }
3980 kfree_skb(skb);
3981 }
3982
3983 return 0;
3984 }
3985 EXPORT_SYMBOL_GPL(btintel_shutdown_combined);
3986
btintel_configure_setup(struct hci_dev * hdev,const char * driver_name)3987 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name)
3988 {
3989 hdev->manufacturer = 2;
3990 hdev->setup = btintel_setup_combined;
3991 hdev->shutdown = btintel_shutdown_combined;
3992 hdev->hw_error = btintel_hw_error;
3993 hdev->set_diag = btintel_set_diag_combined;
3994 hdev->set_bdaddr = btintel_set_bdaddr;
3995
3996 coredump_info.driver_name = driver_name;
3997
3998 return 0;
3999 }
4000 EXPORT_SYMBOL_GPL(btintel_configure_setup);
4001
btintel_diagnostics(struct hci_dev * hdev,struct sk_buff * skb)4002 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb)
4003 {
4004 struct intel_tlv *tlv = (void *)&skb->data[5];
4005
4006 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0]))
4007 goto recv_frame;
4008
4009 /* The first event is always an event type TLV */
4010 if (tlv->type != INTEL_TLV_TYPE_ID)
4011 goto recv_frame;
4012
4013 switch (tlv->val[0]) {
4014 case INTEL_TLV_SYSTEM_EXCEPTION:
4015 case INTEL_TLV_FATAL_EXCEPTION:
4016 case INTEL_TLV_DEBUG_EXCEPTION:
4017 case INTEL_TLV_TEST_EXCEPTION:
4018 /* Generate devcoredump from exception */
4019 if (!hci_devcd_init(hdev, skb->len)) {
4020 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
4021 hci_devcd_complete(hdev);
4022 } else {
4023 bt_dev_err(hdev, "Failed to generate devcoredump");
4024 }
4025 break;
4026 default:
4027 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]);
4028 }
4029
4030 recv_frame:
4031 return hci_recv_frame(hdev, skb);
4032 }
4033
btintel_recv_event(struct hci_dev * hdev,struct sk_buff * skb)4034 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
4035 {
4036 struct hci_event_hdr *hdr = (void *)skb->data;
4037 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 };
4038
4039 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) {
4040 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
4041 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
4042
4043 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
4044 switch (skb->data[2]) {
4045 case 0x02:
4046 /* When switching to the operational firmware
4047 * the device sends a vendor specific event
4048 * indicating that the bootup completed.
4049 */
4050 btintel_bootup(hdev, ptr, len);
4051 kfree_skb(skb);
4052 return 0;
4053 case 0x06:
4054 /* When the firmware loading completes the
4055 * device sends out a vendor specific event
4056 * indicating the result of the firmware
4057 * loading.
4058 */
4059 btintel_secure_send_result(hdev, ptr, len);
4060 kfree_skb(skb);
4061 return 0;
4062 }
4063 }
4064
4065 /* Handle all diagnostics events separately. May still call
4066 * hci_recv_frame.
4067 */
4068 if (len + 1 >= sizeof(diagnostics_hdr) &&
4069 memcmp(&skb->data[2], diagnostics_hdr,
4070 sizeof(diagnostics_hdr)) == 0) {
4071 return btintel_diagnostics(hdev, skb);
4072 }
4073 }
4074
4075 return hci_recv_frame(hdev, skb);
4076 }
4077 EXPORT_SYMBOL_GPL(btintel_recv_event);
4078
btintel_bootup(struct hci_dev * hdev,const void * ptr,unsigned int len)4079 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
4080 {
4081 const struct intel_bootup *evt = ptr;
4082
4083 if (len != sizeof(*evt))
4084 return;
4085
4086 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
4087 btintel_wake_up_flag(hdev, INTEL_BOOTING);
4088 }
4089 EXPORT_SYMBOL_GPL(btintel_bootup);
4090
btintel_secure_send_result(struct hci_dev * hdev,const void * ptr,unsigned int len)4091 void btintel_secure_send_result(struct hci_dev *hdev,
4092 const void *ptr, unsigned int len)
4093 {
4094 const struct intel_secure_send_result *evt = ptr;
4095
4096 if (len != sizeof(*evt))
4097 return;
4098
4099 if (evt->result)
4100 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
4101
4102 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
4103 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
4104 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
4105 }
4106 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
4107
4108 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4109 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
4110 MODULE_VERSION(VERSION);
4111 MODULE_LICENSE("GPL");
4112 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
4113 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
4114 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
4115 MODULE_FIRMWARE("intel/ibt-12-16.ddc");
4116