1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 55 56 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 57 struct cmd_write_boot_params { 58 __le32 boot_addr; 59 u8 fw_build_num; 60 u8 fw_build_ww; 61 u8 fw_build_yy; 62 } __packed; 63 64 static struct { 65 const char *driver_name; 66 u8 hw_variant; 67 u32 fw_build_num; 68 } coredump_info; 69 70 static const guid_t btintel_guid_dsm = 71 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 72 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 73 74 int btintel_check_bdaddr(struct hci_dev *hdev) 75 { 76 struct hci_rp_read_bd_addr *bda; 77 struct sk_buff *skb; 78 79 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 80 HCI_INIT_TIMEOUT); 81 if (IS_ERR(skb)) { 82 int err = PTR_ERR(skb); 83 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 84 err); 85 return err; 86 } 87 88 if (skb->len != sizeof(*bda)) { 89 bt_dev_err(hdev, "Intel device address length mismatch"); 90 kfree_skb(skb); 91 return -EIO; 92 } 93 94 bda = (struct hci_rp_read_bd_addr *)skb->data; 95 96 /* For some Intel based controllers, the default Bluetooth device 97 * address 00:03:19:9E:8B:00 can be found. These controllers are 98 * fully operational, but have the danger of duplicate addresses 99 * and that in turn can cause problems with Bluetooth operation. 100 */ 101 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 102 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 103 &bda->bdaddr); 104 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 105 } 106 107 kfree_skb(skb); 108 109 return 0; 110 } 111 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 112 113 int btintel_enter_mfg(struct hci_dev *hdev) 114 { 115 static const u8 param[] = { 0x01, 0x00 }; 116 struct sk_buff *skb; 117 118 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 119 if (IS_ERR(skb)) { 120 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 121 PTR_ERR(skb)); 122 return PTR_ERR(skb); 123 } 124 kfree_skb(skb); 125 126 return 0; 127 } 128 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 129 130 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 131 { 132 u8 param[] = { 0x00, 0x00 }; 133 struct sk_buff *skb; 134 135 /* The 2nd command parameter specifies the manufacturing exit method: 136 * 0x00: Just disable the manufacturing mode (0x00). 137 * 0x01: Disable manufacturing mode and reset with patches deactivated. 138 * 0x02: Disable manufacturing mode and reset with patches activated. 139 */ 140 if (reset) 141 param[1] |= patched ? 0x02 : 0x01; 142 143 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 144 if (IS_ERR(skb)) { 145 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 146 PTR_ERR(skb)); 147 return PTR_ERR(skb); 148 } 149 kfree_skb(skb); 150 151 return 0; 152 } 153 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 154 155 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 156 { 157 struct sk_buff *skb; 158 int err; 159 160 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 161 if (IS_ERR(skb)) { 162 err = PTR_ERR(skb); 163 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 164 err); 165 return err; 166 } 167 kfree_skb(skb); 168 169 return 0; 170 } 171 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 172 173 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 174 { 175 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 176 struct sk_buff *skb; 177 int err; 178 179 if (debug) 180 mask[1] |= 0x62; 181 182 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 183 if (IS_ERR(skb)) { 184 err = PTR_ERR(skb); 185 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 186 return err; 187 } 188 kfree_skb(skb); 189 190 return 0; 191 } 192 193 int btintel_set_diag(struct hci_dev *hdev, bool enable) 194 { 195 struct sk_buff *skb; 196 u8 param[3]; 197 int err; 198 199 if (enable) { 200 param[0] = 0x03; 201 param[1] = 0x03; 202 param[2] = 0x03; 203 } else { 204 param[0] = 0x00; 205 param[1] = 0x00; 206 param[2] = 0x00; 207 } 208 209 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 210 if (IS_ERR(skb)) { 211 err = PTR_ERR(skb); 212 if (err == -ENODATA) 213 goto done; 214 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 215 err); 216 return err; 217 } 218 kfree_skb(skb); 219 220 done: 221 btintel_set_event_mask(hdev, enable); 222 return 0; 223 } 224 EXPORT_SYMBOL_GPL(btintel_set_diag); 225 226 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 227 { 228 int err, ret; 229 230 err = btintel_enter_mfg(hdev); 231 if (err) 232 return err; 233 234 ret = btintel_set_diag(hdev, enable); 235 236 err = btintel_exit_mfg(hdev, false, false); 237 if (err) 238 return err; 239 240 return ret; 241 } 242 243 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 244 { 245 int ret; 246 247 /* Legacy ROM device needs to be in the manufacturer mode to apply 248 * diagnostic setting 249 * 250 * This flag is set after reading the Intel version. 251 */ 252 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 253 ret = btintel_set_diag_mfg(hdev, enable); 254 else 255 ret = btintel_set_diag(hdev, enable); 256 257 return ret; 258 } 259 260 void btintel_hw_error(struct hci_dev *hdev, u8 code) 261 { 262 struct sk_buff *skb; 263 u8 type = 0x00; 264 265 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 266 267 hci_req_sync_lock(hdev); 268 269 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 270 if (IS_ERR(skb)) { 271 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 272 PTR_ERR(skb)); 273 goto unlock; 274 } 275 kfree_skb(skb); 276 277 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 278 if (IS_ERR(skb)) { 279 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 280 PTR_ERR(skb)); 281 goto unlock; 282 } 283 284 if (skb->len != 13) { 285 bt_dev_err(hdev, "Exception info size mismatch"); 286 kfree_skb(skb); 287 goto unlock; 288 } 289 290 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 291 292 kfree_skb(skb); 293 294 unlock: 295 hci_req_sync_unlock(hdev); 296 } 297 EXPORT_SYMBOL_GPL(btintel_hw_error); 298 299 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 300 { 301 const char *variant; 302 303 /* The hardware platform number has a fixed value of 0x37 and 304 * for now only accept this single value. 305 */ 306 if (ver->hw_platform != 0x37) { 307 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 308 ver->hw_platform); 309 return -EINVAL; 310 } 311 312 /* Check for supported iBT hardware variants of this firmware 313 * loading method. 314 * 315 * This check has been put in place to ensure correct forward 316 * compatibility options when newer hardware variants come along. 317 */ 318 switch (ver->hw_variant) { 319 case 0x07: /* WP - Legacy ROM */ 320 case 0x08: /* StP - Legacy ROM */ 321 case 0x0b: /* SfP */ 322 case 0x0c: /* WsP */ 323 case 0x11: /* JfP */ 324 case 0x12: /* ThP */ 325 case 0x13: /* HrP */ 326 case 0x14: /* CcP */ 327 break; 328 default: 329 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 330 ver->hw_variant); 331 return -EINVAL; 332 } 333 334 switch (ver->fw_variant) { 335 case 0x01: 336 variant = "Legacy ROM 2.5"; 337 break; 338 case 0x06: 339 variant = "Bootloader"; 340 break; 341 case 0x22: 342 variant = "Legacy ROM 2.x"; 343 break; 344 case 0x23: 345 variant = "Firmware"; 346 break; 347 default: 348 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 349 return -EINVAL; 350 } 351 352 coredump_info.hw_variant = ver->hw_variant; 353 coredump_info.fw_build_num = ver->fw_build_num; 354 355 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 356 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 357 ver->fw_build_num, ver->fw_build_ww, 358 2000 + ver->fw_build_yy); 359 360 return 0; 361 } 362 EXPORT_SYMBOL_GPL(btintel_version_info); 363 364 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 365 const void *param) 366 { 367 while (plen > 0) { 368 struct sk_buff *skb; 369 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 370 371 cmd_param[0] = fragment_type; 372 memcpy(cmd_param + 1, param, fragment_len); 373 374 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 375 cmd_param, HCI_INIT_TIMEOUT); 376 if (IS_ERR(skb)) 377 return PTR_ERR(skb); 378 379 kfree_skb(skb); 380 381 plen -= fragment_len; 382 param += fragment_len; 383 } 384 385 return 0; 386 } 387 388 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 389 { 390 const struct firmware *fw; 391 struct sk_buff *skb; 392 const u8 *fw_ptr; 393 int err; 394 395 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 396 if (err < 0) { 397 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 398 ddc_name, err); 399 return err; 400 } 401 402 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 403 404 fw_ptr = fw->data; 405 406 /* DDC file contains one or more DDC structure which has 407 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 408 */ 409 while (fw->size > fw_ptr - fw->data) { 410 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 411 412 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 413 HCI_INIT_TIMEOUT); 414 if (IS_ERR(skb)) { 415 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 416 PTR_ERR(skb)); 417 release_firmware(fw); 418 return PTR_ERR(skb); 419 } 420 421 fw_ptr += cmd_plen; 422 kfree_skb(skb); 423 } 424 425 release_firmware(fw); 426 427 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 428 429 return 0; 430 } 431 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 432 433 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 434 { 435 int err, ret; 436 437 err = btintel_enter_mfg(hdev); 438 if (err) 439 return err; 440 441 ret = btintel_set_event_mask(hdev, debug); 442 443 err = btintel_exit_mfg(hdev, false, false); 444 if (err) 445 return err; 446 447 return ret; 448 } 449 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 450 451 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 452 { 453 struct sk_buff *skb; 454 455 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 456 if (IS_ERR(skb)) { 457 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 458 PTR_ERR(skb)); 459 return PTR_ERR(skb); 460 } 461 462 if (!skb || skb->len != sizeof(*ver)) { 463 bt_dev_err(hdev, "Intel version event size mismatch"); 464 kfree_skb(skb); 465 return -EILSEQ; 466 } 467 468 memcpy(ver, skb->data, sizeof(*ver)); 469 470 kfree_skb(skb); 471 472 return 0; 473 } 474 EXPORT_SYMBOL_GPL(btintel_read_version); 475 476 int btintel_version_info_tlv(struct hci_dev *hdev, 477 struct intel_version_tlv *version) 478 { 479 const char *variant; 480 481 /* The hardware platform number has a fixed value of 0x37 and 482 * for now only accept this single value. 483 */ 484 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 485 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 486 INTEL_HW_PLATFORM(version->cnvi_bt)); 487 return -EINVAL; 488 } 489 490 /* Check for supported iBT hardware variants of this firmware 491 * loading method. 492 * 493 * This check has been put in place to ensure correct forward 494 * compatibility options when newer hardware variants come along. 495 */ 496 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 497 case 0x17: /* TyP */ 498 case 0x18: /* Slr */ 499 case 0x19: /* Slr-F */ 500 case 0x1b: /* Mgr */ 501 case 0x1c: /* Gale Peak (GaP) */ 502 case 0x1d: /* BlazarU (BzrU) */ 503 case 0x1e: /* BlazarI (Bzr) */ 504 case 0x1f: /* Scorpious Peak */ 505 case 0x20: /* Scorpious Peak2 */ 506 case 0x21: /* Scorpious Peak2 F */ 507 case 0x22: /* BlazarIW (BzrIW) */ 508 break; 509 default: 510 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 511 INTEL_HW_VARIANT(version->cnvi_bt)); 512 return -EINVAL; 513 } 514 515 switch (version->img_type) { 516 case BTINTEL_IMG_BOOTLOADER: 517 variant = "Bootloader"; 518 /* It is required that every single firmware fragment is acknowledged 519 * with a command complete event. If the boot parameters indicate 520 * that this bootloader does not send them, then abort the setup. 521 */ 522 if (version->limited_cce != 0x00) { 523 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 524 version->limited_cce); 525 return -EINVAL; 526 } 527 528 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 529 if (version->sbe_type > 0x03) { 530 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 531 version->sbe_type); 532 return -EINVAL; 533 } 534 535 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 536 bt_dev_info(hdev, "Secure boot is %s", 537 str_enabled_disabled(version->secure_boot)); 538 bt_dev_info(hdev, "OTP lock is %s", 539 str_enabled_disabled(version->otp_lock)); 540 bt_dev_info(hdev, "API lock is %s", 541 str_enabled_disabled(version->api_lock)); 542 bt_dev_info(hdev, "Debug lock is %s", 543 str_enabled_disabled(version->debug_lock)); 544 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 545 version->min_fw_build_nn, version->min_fw_build_cw, 546 2000 + version->min_fw_build_yy); 547 break; 548 case BTINTEL_IMG_IML: 549 variant = "Intermediate loader"; 550 break; 551 case BTINTEL_IMG_OP: 552 variant = "Firmware"; 553 break; 554 default: 555 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 556 return -EINVAL; 557 } 558 559 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 560 coredump_info.fw_build_num = version->build_num; 561 562 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 563 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 564 version->build_type, version->build_num); 565 if (version->img_type == BTINTEL_IMG_OP) 566 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 567 568 return 0; 569 } 570 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 571 572 int btintel_parse_version_tlv(struct hci_dev *hdev, 573 struct intel_version_tlv *version, 574 struct sk_buff *skb) 575 { 576 /* Consume Command Complete Status field */ 577 skb_pull(skb, 1); 578 579 /* Event parameters contain multiple TLVs. Read each of them 580 * and only keep the required data. Also, it use existing legacy 581 * version field like hw_platform, hw_variant, and fw_variant 582 * to keep the existing setup flow 583 */ 584 while (skb->len) { 585 struct intel_tlv *tlv; 586 587 /* Make sure skb has a minimum length of the header */ 588 if (skb->len < sizeof(*tlv)) 589 return -EINVAL; 590 591 tlv = (struct intel_tlv *)skb->data; 592 593 /* Make sure skb has a enough data */ 594 if (skb->len < tlv->len + sizeof(*tlv)) 595 return -EINVAL; 596 597 switch (tlv->type) { 598 case INTEL_TLV_CNVI_TOP: 599 version->cnvi_top = get_unaligned_le32(tlv->val); 600 break; 601 case INTEL_TLV_CNVR_TOP: 602 version->cnvr_top = get_unaligned_le32(tlv->val); 603 break; 604 case INTEL_TLV_CNVI_BT: 605 version->cnvi_bt = get_unaligned_le32(tlv->val); 606 break; 607 case INTEL_TLV_CNVR_BT: 608 version->cnvr_bt = get_unaligned_le32(tlv->val); 609 break; 610 case INTEL_TLV_DEV_REV_ID: 611 version->dev_rev_id = get_unaligned_le16(tlv->val); 612 break; 613 case INTEL_TLV_IMAGE_TYPE: 614 version->img_type = tlv->val[0]; 615 break; 616 case INTEL_TLV_TIME_STAMP: 617 /* If image type is Operational firmware (0x03), then 618 * running FW Calendar Week and Year information can 619 * be extracted from Timestamp information 620 */ 621 version->min_fw_build_cw = tlv->val[0]; 622 version->min_fw_build_yy = tlv->val[1]; 623 version->timestamp = get_unaligned_le16(tlv->val); 624 break; 625 case INTEL_TLV_BUILD_TYPE: 626 version->build_type = tlv->val[0]; 627 break; 628 case INTEL_TLV_BUILD_NUM: 629 /* If image type is Operational firmware (0x03), then 630 * running FW build number can be extracted from the 631 * Build information 632 */ 633 version->min_fw_build_nn = tlv->val[0]; 634 version->build_num = get_unaligned_le32(tlv->val); 635 break; 636 case INTEL_TLV_SECURE_BOOT: 637 version->secure_boot = tlv->val[0]; 638 break; 639 case INTEL_TLV_OTP_LOCK: 640 version->otp_lock = tlv->val[0]; 641 break; 642 case INTEL_TLV_API_LOCK: 643 version->api_lock = tlv->val[0]; 644 break; 645 case INTEL_TLV_DEBUG_LOCK: 646 version->debug_lock = tlv->val[0]; 647 break; 648 case INTEL_TLV_MIN_FW: 649 version->min_fw_build_nn = tlv->val[0]; 650 version->min_fw_build_cw = tlv->val[1]; 651 version->min_fw_build_yy = tlv->val[2]; 652 break; 653 case INTEL_TLV_LIMITED_CCE: 654 version->limited_cce = tlv->val[0]; 655 break; 656 case INTEL_TLV_SBE_TYPE: 657 version->sbe_type = tlv->val[0]; 658 break; 659 case INTEL_TLV_OTP_BDADDR: 660 memcpy(&version->otp_bd_addr, tlv->val, 661 sizeof(bdaddr_t)); 662 break; 663 case INTEL_TLV_GIT_SHA1: 664 version->git_sha1 = get_unaligned_le32(tlv->val); 665 break; 666 case INTEL_TLV_FW_ID: 667 snprintf(version->fw_id, sizeof(version->fw_id), 668 "%s", tlv->val); 669 break; 670 default: 671 /* Ignore rest of information */ 672 break; 673 } 674 /* consume the current tlv and move to next*/ 675 skb_pull(skb, tlv->len + sizeof(*tlv)); 676 } 677 678 return 0; 679 } 680 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 681 682 static int btintel_read_version_tlv(struct hci_dev *hdev, 683 struct intel_version_tlv *version) 684 { 685 struct sk_buff *skb; 686 const u8 param[1] = { 0xFF }; 687 688 if (!version) 689 return -EINVAL; 690 691 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 692 if (IS_ERR(skb)) { 693 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 694 PTR_ERR(skb)); 695 return PTR_ERR(skb); 696 } 697 698 if (skb->data[0]) { 699 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 700 skb->data[0]); 701 kfree_skb(skb); 702 return -EIO; 703 } 704 705 btintel_parse_version_tlv(hdev, version, skb); 706 707 kfree_skb(skb); 708 return 0; 709 } 710 711 /* ------- REGMAP IBT SUPPORT ------- */ 712 713 #define IBT_REG_MODE_8BIT 0x00 714 #define IBT_REG_MODE_16BIT 0x01 715 #define IBT_REG_MODE_32BIT 0x02 716 717 struct regmap_ibt_context { 718 struct hci_dev *hdev; 719 __u16 op_write; 720 __u16 op_read; 721 }; 722 723 struct ibt_cp_reg_access { 724 __le32 addr; 725 __u8 mode; 726 __u8 len; 727 __u8 data[]; 728 } __packed; 729 730 struct ibt_rp_reg_access { 731 __u8 status; 732 __le32 addr; 733 __u8 data[]; 734 } __packed; 735 736 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 737 void *val, size_t val_size) 738 { 739 struct regmap_ibt_context *ctx = context; 740 struct ibt_cp_reg_access cp; 741 struct ibt_rp_reg_access *rp; 742 struct sk_buff *skb; 743 int err = 0; 744 745 if (reg_size != sizeof(__le32)) 746 return -EINVAL; 747 748 switch (val_size) { 749 case 1: 750 cp.mode = IBT_REG_MODE_8BIT; 751 break; 752 case 2: 753 cp.mode = IBT_REG_MODE_16BIT; 754 break; 755 case 4: 756 cp.mode = IBT_REG_MODE_32BIT; 757 break; 758 default: 759 return -EINVAL; 760 } 761 762 /* regmap provides a little-endian formatted addr */ 763 cp.addr = *(__le32 *)addr; 764 cp.len = val_size; 765 766 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 767 768 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 769 HCI_CMD_TIMEOUT); 770 if (IS_ERR(skb)) { 771 err = PTR_ERR(skb); 772 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 773 le32_to_cpu(cp.addr), err); 774 return err; 775 } 776 777 if (skb->len != sizeof(*rp) + val_size) { 778 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 779 le32_to_cpu(cp.addr)); 780 err = -EINVAL; 781 goto done; 782 } 783 784 rp = (struct ibt_rp_reg_access *)skb->data; 785 786 if (rp->addr != cp.addr) { 787 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 788 le32_to_cpu(rp->addr)); 789 err = -EINVAL; 790 goto done; 791 } 792 793 memcpy(val, rp->data, val_size); 794 795 done: 796 kfree_skb(skb); 797 return err; 798 } 799 800 static int regmap_ibt_gather_write(void *context, 801 const void *addr, size_t reg_size, 802 const void *val, size_t val_size) 803 { 804 struct regmap_ibt_context *ctx = context; 805 struct ibt_cp_reg_access *cp; 806 struct sk_buff *skb; 807 int plen = sizeof(*cp) + val_size; 808 u8 mode; 809 int err = 0; 810 811 if (reg_size != sizeof(__le32)) 812 return -EINVAL; 813 814 switch (val_size) { 815 case 1: 816 mode = IBT_REG_MODE_8BIT; 817 break; 818 case 2: 819 mode = IBT_REG_MODE_16BIT; 820 break; 821 case 4: 822 mode = IBT_REG_MODE_32BIT; 823 break; 824 default: 825 return -EINVAL; 826 } 827 828 cp = kmalloc(plen, GFP_KERNEL); 829 if (!cp) 830 return -ENOMEM; 831 832 /* regmap provides a little-endian formatted addr/value */ 833 cp->addr = *(__le32 *)addr; 834 cp->mode = mode; 835 cp->len = val_size; 836 memcpy(&cp->data, val, val_size); 837 838 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 839 840 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 841 if (IS_ERR(skb)) { 842 err = PTR_ERR(skb); 843 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 844 le32_to_cpu(cp->addr), err); 845 goto done; 846 } 847 kfree_skb(skb); 848 849 done: 850 kfree(cp); 851 return err; 852 } 853 854 static int regmap_ibt_write(void *context, const void *data, size_t count) 855 { 856 /* data contains register+value, since we only support 32bit addr, 857 * minimum data size is 4 bytes. 858 */ 859 if (WARN_ONCE(count < 4, "Invalid register access")) 860 return -EINVAL; 861 862 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 863 } 864 865 static void regmap_ibt_free_context(void *context) 866 { 867 kfree(context); 868 } 869 870 static const struct regmap_bus regmap_ibt = { 871 .read = regmap_ibt_read, 872 .write = regmap_ibt_write, 873 .gather_write = regmap_ibt_gather_write, 874 .free_context = regmap_ibt_free_context, 875 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 876 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 877 }; 878 879 /* Config is the same for all register regions */ 880 static const struct regmap_config regmap_ibt_cfg = { 881 .name = "btintel_regmap", 882 .reg_bits = 32, 883 .val_bits = 32, 884 }; 885 886 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 887 u16 opcode_write) 888 { 889 struct regmap_ibt_context *ctx; 890 891 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 892 opcode_write); 893 894 ctx = kzalloc_obj(*ctx); 895 if (!ctx) 896 return ERR_PTR(-ENOMEM); 897 898 ctx->op_read = opcode_read; 899 ctx->op_write = opcode_write; 900 ctx->hdev = hdev; 901 902 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 903 } 904 EXPORT_SYMBOL_GPL(btintel_regmap_init); 905 906 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 907 { 908 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 909 struct sk_buff *skb; 910 911 params.boot_param = cpu_to_le32(boot_param); 912 913 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 914 HCI_INIT_TIMEOUT); 915 if (IS_ERR(skb)) { 916 bt_dev_err(hdev, "Failed to send Intel Reset command"); 917 return PTR_ERR(skb); 918 } 919 920 kfree_skb(skb); 921 922 return 0; 923 } 924 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 925 926 int btintel_read_boot_params(struct hci_dev *hdev, 927 struct intel_boot_params *params) 928 { 929 struct sk_buff *skb; 930 931 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 932 if (IS_ERR(skb)) { 933 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 934 PTR_ERR(skb)); 935 return PTR_ERR(skb); 936 } 937 938 if (skb->len != sizeof(*params)) { 939 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 940 kfree_skb(skb); 941 return -EILSEQ; 942 } 943 944 memcpy(params, skb->data, sizeof(*params)); 945 946 kfree_skb(skb); 947 948 if (params->status) { 949 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 950 params->status); 951 return -bt_to_errno(params->status); 952 } 953 954 bt_dev_info(hdev, "Device revision is %u", 955 le16_to_cpu(params->dev_revid)); 956 957 bt_dev_info(hdev, "Secure boot is %s", 958 str_enabled_disabled(params->secure_boot)); 959 960 bt_dev_info(hdev, "OTP lock is %s", 961 str_enabled_disabled(params->otp_lock)); 962 963 bt_dev_info(hdev, "API lock is %s", 964 str_enabled_disabled(params->api_lock)); 965 966 bt_dev_info(hdev, "Debug lock is %s", 967 str_enabled_disabled(params->debug_lock)); 968 969 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 970 params->min_fw_build_nn, params->min_fw_build_cw, 971 2000 + params->min_fw_build_yy); 972 973 return 0; 974 } 975 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 976 977 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 978 const struct firmware *fw) 979 { 980 int err; 981 982 /* Start the firmware download transaction with the Init fragment 983 * represented by the 128 bytes of CSS header. 984 */ 985 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 986 if (err < 0) { 987 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 988 goto done; 989 } 990 991 /* Send the 256 bytes of public key information from the firmware 992 * as the PKey fragment. 993 */ 994 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 995 if (err < 0) { 996 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 997 goto done; 998 } 999 1000 /* Send the 256 bytes of signature information from the firmware 1001 * as the Sign fragment. 1002 */ 1003 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1004 if (err < 0) { 1005 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1006 goto done; 1007 } 1008 1009 done: 1010 return err; 1011 } 1012 1013 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1014 const struct firmware *fw) 1015 { 1016 int err; 1017 1018 /* Start the firmware download transaction with the Init fragment 1019 * represented by the 128 bytes of CSS header. 1020 */ 1021 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1022 if (err < 0) { 1023 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1024 return err; 1025 } 1026 1027 /* Send the 96 bytes of public key information from the firmware 1028 * as the PKey fragment. 1029 */ 1030 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1031 if (err < 0) { 1032 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1033 return err; 1034 } 1035 1036 /* Send the 96 bytes of signature information from the firmware 1037 * as the Sign fragment 1038 */ 1039 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1040 if (err < 0) { 1041 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1042 err); 1043 return err; 1044 } 1045 return 0; 1046 } 1047 1048 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1049 const struct firmware *fw) 1050 { 1051 int err; 1052 1053 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1054 if (err < 0) { 1055 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1056 return err; 1057 } 1058 1059 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1060 fw->data + BTINTEL_ECDSA_OFFSET); 1061 if (err < 0) { 1062 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1063 return err; 1064 } 1065 1066 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1067 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1068 if (err < 0) { 1069 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1070 return err; 1071 } 1072 1073 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1074 fw->data + BTINTEL_LMS_OFFSET); 1075 if (err < 0) { 1076 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1077 return err; 1078 } 1079 1080 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1081 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1082 if (err < 0) { 1083 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1084 return err; 1085 } 1086 1087 return 0; 1088 } 1089 1090 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1091 const struct firmware *fw, 1092 size_t offset) 1093 { 1094 int err; 1095 const u8 *fw_ptr; 1096 u32 frag_len; 1097 1098 fw_ptr = fw->data + offset; 1099 frag_len = 0; 1100 err = -EINVAL; 1101 1102 while (fw_ptr - fw->data < fw->size) { 1103 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1104 1105 frag_len += sizeof(*cmd) + cmd->plen; 1106 1107 /* The parameter length of the secure send command requires 1108 * a 4 byte alignment. It happens so that the firmware file 1109 * contains proper Intel_NOP commands to align the fragments 1110 * as needed. 1111 * 1112 * Send set of commands with 4 byte alignment from the 1113 * firmware data buffer as a single Data fragment. 1114 */ 1115 if (!(frag_len % 4)) { 1116 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1117 if (err < 0) { 1118 bt_dev_err(hdev, 1119 "Failed to send firmware data (%d)", 1120 err); 1121 goto done; 1122 } 1123 1124 fw_ptr += frag_len; 1125 frag_len = 0; 1126 } 1127 } 1128 1129 done: 1130 return err; 1131 } 1132 1133 static bool btintel_firmware_version(struct hci_dev *hdev, 1134 u8 num, u8 ww, u8 yy, 1135 const struct firmware *fw, 1136 u32 *boot_addr) 1137 { 1138 const u8 *fw_ptr; 1139 1140 fw_ptr = fw->data; 1141 1142 while (fw_ptr - fw->data < fw->size) { 1143 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1144 1145 /* Each SKU has a different reset parameter to use in the 1146 * HCI_Intel_Reset command and it is embedded in the firmware 1147 * data. So, instead of using static value per SKU, check 1148 * the firmware data and save it for later use. 1149 */ 1150 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1151 struct cmd_write_boot_params *params; 1152 1153 params = (void *)(fw_ptr + sizeof(*cmd)); 1154 1155 *boot_addr = le32_to_cpu(params->boot_addr); 1156 1157 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1158 1159 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1160 params->fw_build_num, params->fw_build_ww, 1161 params->fw_build_yy); 1162 1163 return (num == params->fw_build_num && 1164 ww == params->fw_build_ww && 1165 yy == params->fw_build_yy); 1166 } 1167 1168 fw_ptr += sizeof(*cmd) + cmd->plen; 1169 } 1170 1171 return false; 1172 } 1173 1174 int btintel_download_firmware(struct hci_dev *hdev, 1175 struct intel_version *ver, 1176 const struct firmware *fw, 1177 u32 *boot_param) 1178 { 1179 int err; 1180 1181 /* SfP and WsP don't seem to update the firmware version on file 1182 * so version checking is currently not possible. 1183 */ 1184 switch (ver->hw_variant) { 1185 case 0x0b: /* SfP */ 1186 case 0x0c: /* WsP */ 1187 /* Skip version checking */ 1188 break; 1189 default: 1190 1191 /* Skip download if firmware has the same version */ 1192 if (btintel_firmware_version(hdev, ver->fw_build_num, 1193 ver->fw_build_ww, ver->fw_build_yy, 1194 fw, boot_param)) { 1195 bt_dev_info(hdev, "Firmware already loaded"); 1196 /* Return -EALREADY to indicate that the firmware has 1197 * already been loaded. 1198 */ 1199 return -EALREADY; 1200 } 1201 } 1202 1203 /* The firmware variant determines if the device is in bootloader 1204 * mode or is running operational firmware. The value 0x06 identifies 1205 * the bootloader and the value 0x23 identifies the operational 1206 * firmware. 1207 * 1208 * If the firmware version has changed that means it needs to be reset 1209 * to bootloader when operational so the new firmware can be loaded. 1210 */ 1211 if (ver->fw_variant == 0x23) 1212 return -EINVAL; 1213 1214 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1215 if (err) 1216 return err; 1217 1218 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1219 } 1220 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1221 1222 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1223 struct intel_version_tlv *ver, 1224 const struct firmware *fw, u32 *boot_param, 1225 u8 hw_variant, u8 sbe_type) 1226 { 1227 int err; 1228 u32 css_header_ver; 1229 1230 /* Skip download if firmware has the same version */ 1231 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1232 ver->min_fw_build_cw, 1233 ver->min_fw_build_yy, 1234 fw, boot_param)) { 1235 bt_dev_info(hdev, "Firmware already loaded"); 1236 /* Return -EALREADY to indicate that firmware has 1237 * already been loaded. 1238 */ 1239 return -EALREADY; 1240 } 1241 1242 /* The firmware variant determines if the device is in bootloader 1243 * mode or is running operational firmware. The value 0x01 identifies 1244 * the bootloader and the value 0x03 identifies the operational 1245 * firmware. 1246 * 1247 * If the firmware version has changed that means it needs to be reset 1248 * to bootloader when operational so the new firmware can be loaded. 1249 */ 1250 if (ver->img_type == BTINTEL_IMG_OP) 1251 return -EINVAL; 1252 1253 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1254 * only RSA secure boot engine. Hence, the corresponding sfi file will 1255 * have RSA header of 644 bytes followed by Command Buffer. 1256 * 1257 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1258 * secure boot engine. As a result, the corresponding sfi file will 1259 * have RSA header of 644, ECDSA header of 320 bytes followed by 1260 * Command Buffer. 1261 * 1262 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1263 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1264 */ 1265 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1266 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1267 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1268 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1269 return -EINVAL; 1270 } 1271 1272 if (hw_variant <= 0x14) { 1273 if (sbe_type != 0x00) { 1274 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1275 hw_variant); 1276 return -EINVAL; 1277 } 1278 1279 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1280 if (err) 1281 return err; 1282 1283 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1284 if (err) 1285 return err; 1286 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1287 /* Check if CSS header for ECDSA follows the RSA header */ 1288 if (fw->data[ECDSA_OFFSET] != 0x06) 1289 return -EINVAL; 1290 1291 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1292 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1293 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1294 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1295 return -EINVAL; 1296 } 1297 1298 if (sbe_type == 0x00) { 1299 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1300 if (err) 1301 return err; 1302 1303 err = btintel_download_firmware_payload(hdev, fw, 1304 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1305 if (err) 1306 return err; 1307 } else if (sbe_type == 0x01) { 1308 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1309 if (err) 1310 return err; 1311 1312 err = btintel_download_firmware_payload(hdev, fw, 1313 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1314 if (err) 1315 return err; 1316 } 1317 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1318 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1319 if (err) 1320 return err; 1321 1322 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1323 if (err) 1324 return err; 1325 } 1326 return 0; 1327 } 1328 1329 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1330 { 1331 struct intel_reset params; 1332 struct sk_buff *skb; 1333 1334 /* PCIe transport uses shared hardware reset mechanism for recovery 1335 * which gets triggered in pcie *setup* function on error. 1336 */ 1337 if (hdev->bus == HCI_PCI) 1338 return; 1339 1340 /* Send Intel Reset command. This will result in 1341 * re-enumeration of BT controller. 1342 * 1343 * Intel Reset parameter description: 1344 * reset_type : 0x00 (Soft reset), 1345 * 0x01 (Hard reset) 1346 * patch_enable : 0x00 (Do not enable), 1347 * 0x01 (Enable) 1348 * ddc_reload : 0x00 (Do not reload), 1349 * 0x01 (Reload) 1350 * boot_option: 0x00 (Current image), 1351 * 0x01 (Specified boot address) 1352 * boot_param: Boot address 1353 * 1354 */ 1355 1356 params.reset_type = 0x01; 1357 params.patch_enable = 0x01; 1358 params.ddc_reload = 0x01; 1359 params.boot_option = 0x00; 1360 params.boot_param = cpu_to_le32(0x00000000); 1361 1362 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1363 ¶ms, HCI_INIT_TIMEOUT); 1364 if (IS_ERR(skb)) { 1365 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1366 PTR_ERR(skb)); 1367 return; 1368 } 1369 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1370 kfree_skb(skb); 1371 1372 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1373 * lines for 2ms when it receives Intel Reset in bootloader mode. 1374 * Whereas, the upcoming Intel BT controllers will hold USB reset 1375 * for 150ms. To keep the delay generic, 150ms is chosen here. 1376 */ 1377 msleep(150); 1378 } 1379 1380 static int btintel_read_debug_features(struct hci_dev *hdev, 1381 struct intel_debug_features *features) 1382 { 1383 struct sk_buff *skb; 1384 u8 page_no = 1; 1385 1386 /* Intel controller supports two pages, each page is of 128-bit 1387 * feature bit mask. And each bit defines specific feature support 1388 */ 1389 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1390 HCI_INIT_TIMEOUT); 1391 if (IS_ERR(skb)) { 1392 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1393 PTR_ERR(skb)); 1394 return PTR_ERR(skb); 1395 } 1396 1397 if (skb->len != (sizeof(features->page1) + 3)) { 1398 bt_dev_err(hdev, "Supported features event size mismatch"); 1399 kfree_skb(skb); 1400 return -EILSEQ; 1401 } 1402 1403 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1404 1405 /* Read the supported features page2 if required in future. 1406 */ 1407 kfree_skb(skb); 1408 return 0; 1409 } 1410 1411 static int btintel_set_debug_features(struct hci_dev *hdev, 1412 const struct intel_debug_features *features) 1413 { 1414 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1415 0x00, 0x00, 0x00 }; 1416 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1417 u8 trace_enable = 0x02; 1418 struct sk_buff *skb; 1419 1420 if (!features) { 1421 bt_dev_warn(hdev, "Debug features not read"); 1422 return -EINVAL; 1423 } 1424 1425 if (!(features->page1[0] & 0x3f)) { 1426 bt_dev_info(hdev, "Telemetry exception format not supported"); 1427 return 0; 1428 } 1429 1430 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1431 if (IS_ERR(skb)) { 1432 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1433 PTR_ERR(skb)); 1434 return PTR_ERR(skb); 1435 } 1436 kfree_skb(skb); 1437 1438 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1439 if (IS_ERR(skb)) { 1440 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1441 PTR_ERR(skb)); 1442 return PTR_ERR(skb); 1443 } 1444 kfree_skb(skb); 1445 1446 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1447 if (IS_ERR(skb)) { 1448 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1449 PTR_ERR(skb)); 1450 return PTR_ERR(skb); 1451 } 1452 kfree_skb(skb); 1453 1454 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1455 trace_enable, mask[3]); 1456 1457 return 0; 1458 } 1459 1460 static int btintel_reset_debug_features(struct hci_dev *hdev, 1461 const struct intel_debug_features *features) 1462 { 1463 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1464 0x00, 0x00, 0x00 }; 1465 u8 trace_enable = 0x00; 1466 struct sk_buff *skb; 1467 1468 if (!features) { 1469 bt_dev_warn(hdev, "Debug features not read"); 1470 return -EINVAL; 1471 } 1472 1473 if (!(features->page1[0] & 0x3f)) { 1474 bt_dev_info(hdev, "Telemetry exception format not supported"); 1475 return 0; 1476 } 1477 1478 /* Should stop the trace before writing ddc event mask. */ 1479 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1480 if (IS_ERR(skb)) { 1481 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1482 PTR_ERR(skb)); 1483 return PTR_ERR(skb); 1484 } 1485 kfree_skb(skb); 1486 1487 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1488 if (IS_ERR(skb)) { 1489 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1490 PTR_ERR(skb)); 1491 return PTR_ERR(skb); 1492 } 1493 kfree_skb(skb); 1494 1495 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1496 trace_enable, mask[3]); 1497 1498 return 0; 1499 } 1500 1501 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1502 { 1503 struct intel_debug_features features; 1504 int err; 1505 1506 bt_dev_dbg(hdev, "enable %d", enable); 1507 1508 /* Read the Intel supported features and if new exception formats 1509 * supported, need to load the additional DDC config to enable. 1510 */ 1511 err = btintel_read_debug_features(hdev, &features); 1512 if (err) 1513 return err; 1514 1515 /* Set or reset the debug features. */ 1516 if (enable) 1517 err = btintel_set_debug_features(hdev, &features); 1518 else 1519 err = btintel_reset_debug_features(hdev, &features); 1520 1521 return err; 1522 } 1523 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1524 1525 static void btintel_coredump(struct hci_dev *hdev) 1526 { 1527 struct sk_buff *skb; 1528 1529 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1530 if (IS_ERR(skb)) { 1531 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1532 return; 1533 } 1534 1535 kfree_skb(skb); 1536 } 1537 1538 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1539 { 1540 char buf[80]; 1541 1542 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1543 coredump_info.hw_variant); 1544 skb_put_data(skb, buf, strlen(buf)); 1545 1546 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1547 coredump_info.fw_build_num); 1548 skb_put_data(skb, buf, strlen(buf)); 1549 1550 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1551 skb_put_data(skb, buf, strlen(buf)); 1552 1553 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1554 skb_put_data(skb, buf, strlen(buf)); 1555 } 1556 1557 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1558 { 1559 struct intel_debug_features features; 1560 int err; 1561 1562 err = btintel_read_debug_features(hdev, &features); 1563 if (err) { 1564 bt_dev_info(hdev, "Error reading debug features"); 1565 return err; 1566 } 1567 1568 if (!(features.page1[0] & 0x3f)) { 1569 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1570 return -EOPNOTSUPP; 1571 } 1572 1573 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1574 1575 return err; 1576 } 1577 1578 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1579 struct intel_version *ver) 1580 { 1581 const struct firmware *fw; 1582 char fwname[64]; 1583 int ret; 1584 1585 snprintf(fwname, sizeof(fwname), 1586 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1587 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1588 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1589 ver->fw_build_ww, ver->fw_build_yy); 1590 1591 ret = request_firmware(&fw, fwname, &hdev->dev); 1592 if (ret < 0) { 1593 if (ret == -EINVAL) { 1594 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1595 ret); 1596 return NULL; 1597 } 1598 1599 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1600 fwname, ret); 1601 1602 /* If the correct firmware patch file is not found, use the 1603 * default firmware patch file instead 1604 */ 1605 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1606 ver->hw_platform, ver->hw_variant); 1607 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1608 bt_dev_err(hdev, "failed to open default fw file: %s", 1609 fwname); 1610 return NULL; 1611 } 1612 } 1613 1614 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1615 1616 return fw; 1617 } 1618 1619 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1620 const struct firmware *fw, 1621 const u8 **fw_ptr, int *disable_patch) 1622 { 1623 struct sk_buff *skb; 1624 struct hci_command_hdr *cmd; 1625 const u8 *cmd_param; 1626 struct hci_event_hdr *evt = NULL; 1627 const u8 *evt_param = NULL; 1628 int remain = fw->size - (*fw_ptr - fw->data); 1629 1630 /* The first byte indicates the types of the patch command or event. 1631 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1632 * in the current firmware buffer doesn't start with 0x01 or 1633 * the size of remain buffer is smaller than HCI command header, 1634 * the firmware file is corrupted and it should stop the patching 1635 * process. 1636 */ 1637 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1638 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1639 return -EINVAL; 1640 } 1641 (*fw_ptr)++; 1642 remain--; 1643 1644 cmd = (struct hci_command_hdr *)(*fw_ptr); 1645 *fw_ptr += sizeof(*cmd); 1646 remain -= sizeof(*cmd); 1647 1648 /* Ensure that the remain firmware data is long enough than the length 1649 * of command parameter. If not, the firmware file is corrupted. 1650 */ 1651 if (remain < cmd->plen) { 1652 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1653 return -EFAULT; 1654 } 1655 1656 /* If there is a command that loads a patch in the firmware 1657 * file, then enable the patch upon success, otherwise just 1658 * disable the manufacturer mode, for example patch activation 1659 * is not required when the default firmware patch file is used 1660 * because there are no patch data to load. 1661 */ 1662 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1663 *disable_patch = 0; 1664 1665 cmd_param = *fw_ptr; 1666 *fw_ptr += cmd->plen; 1667 remain -= cmd->plen; 1668 1669 /* This reads the expected events when the above command is sent to the 1670 * device. Some vendor commands expects more than one events, for 1671 * example command status event followed by vendor specific event. 1672 * For this case, it only keeps the last expected event. so the command 1673 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1674 * last expected event. 1675 */ 1676 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1677 (*fw_ptr)++; 1678 remain--; 1679 1680 evt = (struct hci_event_hdr *)(*fw_ptr); 1681 *fw_ptr += sizeof(*evt); 1682 remain -= sizeof(*evt); 1683 1684 if (remain < evt->plen) { 1685 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1686 return -EFAULT; 1687 } 1688 1689 evt_param = *fw_ptr; 1690 *fw_ptr += evt->plen; 1691 remain -= evt->plen; 1692 } 1693 1694 /* Every HCI commands in the firmware file has its correspond event. 1695 * If event is not found or remain is smaller than zero, the firmware 1696 * file is corrupted. 1697 */ 1698 if (!evt || !evt_param || remain < 0) { 1699 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1700 return -EFAULT; 1701 } 1702 1703 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1704 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1705 if (IS_ERR(skb)) { 1706 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1707 cmd->opcode, PTR_ERR(skb)); 1708 return PTR_ERR(skb); 1709 } 1710 1711 /* It ensures that the returned event matches the event data read from 1712 * the firmware file. At fist, it checks the length and then 1713 * the contents of the event. 1714 */ 1715 if (skb->len != evt->plen) { 1716 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1717 le16_to_cpu(cmd->opcode)); 1718 kfree_skb(skb); 1719 return -EFAULT; 1720 } 1721 1722 if (memcmp(skb->data, evt_param, evt->plen)) { 1723 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1724 le16_to_cpu(cmd->opcode)); 1725 kfree_skb(skb); 1726 return -EFAULT; 1727 } 1728 kfree_skb(skb); 1729 1730 return 0; 1731 } 1732 1733 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1734 struct intel_version *ver) 1735 { 1736 const struct firmware *fw; 1737 const u8 *fw_ptr; 1738 int disable_patch, err; 1739 struct intel_version new_ver; 1740 1741 BT_DBG("%s", hdev->name); 1742 1743 /* fw_patch_num indicates the version of patch the device currently 1744 * have. If there is no patch data in the device, it is always 0x00. 1745 * So, if it is other than 0x00, no need to patch the device again. 1746 */ 1747 if (ver->fw_patch_num) { 1748 bt_dev_info(hdev, 1749 "Intel device is already patched. patch num: %02x", 1750 ver->fw_patch_num); 1751 goto complete; 1752 } 1753 1754 /* Opens the firmware patch file based on the firmware version read 1755 * from the controller. If it fails to open the matching firmware 1756 * patch file, it tries to open the default firmware patch file. 1757 * If no patch file is found, allow the device to operate without 1758 * a patch. 1759 */ 1760 fw = btintel_legacy_rom_get_fw(hdev, ver); 1761 if (!fw) 1762 goto complete; 1763 fw_ptr = fw->data; 1764 1765 /* Enable the manufacturer mode of the controller. 1766 * Only while this mode is enabled, the driver can download the 1767 * firmware patch data and configuration parameters. 1768 */ 1769 err = btintel_enter_mfg(hdev); 1770 if (err) { 1771 release_firmware(fw); 1772 return err; 1773 } 1774 1775 disable_patch = 1; 1776 1777 /* The firmware data file consists of list of Intel specific HCI 1778 * commands and its expected events. The first byte indicates the 1779 * type of the message, either HCI command or HCI event. 1780 * 1781 * It reads the command and its expected event from the firmware file, 1782 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1783 * the returned event is compared with the event read from the firmware 1784 * file and it will continue until all the messages are downloaded to 1785 * the controller. 1786 * 1787 * Once the firmware patching is completed successfully, 1788 * the manufacturer mode is disabled with reset and activating the 1789 * downloaded patch. 1790 * 1791 * If the firmware patching fails, the manufacturer mode is 1792 * disabled with reset and deactivating the patch. 1793 * 1794 * If the default patch file is used, no reset is done when disabling 1795 * the manufacturer. 1796 */ 1797 while (fw->size > fw_ptr - fw->data) { 1798 int ret; 1799 1800 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1801 &disable_patch); 1802 if (ret < 0) 1803 goto exit_mfg_deactivate; 1804 } 1805 1806 release_firmware(fw); 1807 1808 if (disable_patch) 1809 goto exit_mfg_disable; 1810 1811 /* Patching completed successfully and disable the manufacturer mode 1812 * with reset and activate the downloaded firmware patches. 1813 */ 1814 err = btintel_exit_mfg(hdev, true, true); 1815 if (err) 1816 return err; 1817 1818 /* Need build number for downloaded fw patches in 1819 * every power-on boot 1820 */ 1821 err = btintel_read_version(hdev, &new_ver); 1822 if (err) 1823 return err; 1824 1825 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1826 new_ver.fw_patch_num); 1827 1828 goto complete; 1829 1830 exit_mfg_disable: 1831 /* Disable the manufacturer mode without reset */ 1832 err = btintel_exit_mfg(hdev, false, false); 1833 if (err) 1834 return err; 1835 1836 bt_dev_info(hdev, "Intel firmware patch completed"); 1837 1838 goto complete; 1839 1840 exit_mfg_deactivate: 1841 release_firmware(fw); 1842 1843 /* Patching failed. Disable the manufacturer mode with reset and 1844 * deactivate the downloaded firmware patches. 1845 */ 1846 err = btintel_exit_mfg(hdev, true, false); 1847 if (err) 1848 return err; 1849 1850 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1851 1852 complete: 1853 /* Set the event mask for Intel specific vendor events. This enables 1854 * a few extra events that are useful during general operation. 1855 */ 1856 btintel_set_event_mask_mfg(hdev, false); 1857 1858 btintel_check_bdaddr(hdev); 1859 1860 return 0; 1861 } 1862 1863 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1864 { 1865 ktime_t delta, rettime; 1866 unsigned long long duration; 1867 int err; 1868 1869 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1870 1871 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1872 1873 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1874 TASK_INTERRUPTIBLE, 1875 msecs_to_jiffies(msec)); 1876 if (err == -EINTR) { 1877 bt_dev_err(hdev, "Firmware loading interrupted"); 1878 return err; 1879 } 1880 1881 if (err) { 1882 bt_dev_err(hdev, "Firmware loading timeout"); 1883 return -ETIMEDOUT; 1884 } 1885 1886 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1887 bt_dev_err(hdev, "Firmware loading failed"); 1888 return -ENOEXEC; 1889 } 1890 1891 rettime = ktime_get(); 1892 delta = ktime_sub(rettime, calltime); 1893 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1894 1895 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1896 1897 return 0; 1898 } 1899 1900 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1901 { 1902 ktime_t delta, rettime; 1903 unsigned long long duration; 1904 int err; 1905 1906 bt_dev_info(hdev, "Waiting for device to boot"); 1907 1908 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1909 TASK_INTERRUPTIBLE, 1910 msecs_to_jiffies(msec)); 1911 if (err == -EINTR) { 1912 bt_dev_err(hdev, "Device boot interrupted"); 1913 return -EINTR; 1914 } 1915 1916 if (err) { 1917 bt_dev_err(hdev, "Device boot timeout"); 1918 return -ETIMEDOUT; 1919 } 1920 1921 rettime = ktime_get(); 1922 delta = ktime_sub(rettime, calltime); 1923 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1924 1925 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1926 1927 return 0; 1928 } 1929 1930 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1931 int msec) 1932 { 1933 ktime_t delta, rettime; 1934 unsigned long long duration; 1935 int err; 1936 1937 bt_dev_info(hdev, "Waiting for device transition to d0"); 1938 1939 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1940 TASK_INTERRUPTIBLE, 1941 msecs_to_jiffies(msec)); 1942 if (err == -EINTR) { 1943 bt_dev_err(hdev, "Device d0 move interrupted"); 1944 return -EINTR; 1945 } 1946 1947 if (err) { 1948 bt_dev_err(hdev, "Device d0 move timeout"); 1949 return -ETIMEDOUT; 1950 } 1951 1952 rettime = ktime_get(); 1953 delta = ktime_sub(rettime, calltime); 1954 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1955 1956 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 1957 1958 return 0; 1959 } 1960 1961 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1962 { 1963 ktime_t calltime; 1964 int err; 1965 1966 calltime = ktime_get(); 1967 1968 btintel_set_flag(hdev, INTEL_BOOTING); 1969 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 1970 1971 err = btintel_send_intel_reset(hdev, boot_addr); 1972 if (err) { 1973 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1974 btintel_reset_to_bootloader(hdev); 1975 return err; 1976 } 1977 1978 /* The bootloader will not indicate when the device is ready. This 1979 * is done by the operational firmware sending bootup notification. 1980 * 1981 * Booting into operational firmware should not take longer than 1982 * 5 second. However if that happens, then just fail the setup 1983 * since something went wrong. 1984 */ 1985 err = btintel_boot_wait(hdev, calltime, 5000); 1986 if (err == -ETIMEDOUT) { 1987 btintel_reset_to_bootloader(hdev); 1988 goto exit_error; 1989 } 1990 1991 if (hdev->bus == HCI_PCI) { 1992 /* In case of PCIe, after receiving bootup event, driver performs 1993 * D0 entry by writing 0 to sleep control register (check 1994 * btintel_pcie_recv_event()) 1995 * Firmware acks with alive interrupt indicating host is full ready to 1996 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 1997 * bit is cleared. 1998 */ 1999 calltime = ktime_get(); 2000 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2001 } 2002 2003 exit_error: 2004 return err; 2005 } 2006 2007 static int btintel_get_fw_name(struct intel_version *ver, 2008 struct intel_boot_params *params, 2009 char *fw_name, size_t len, 2010 const char *suffix) 2011 { 2012 switch (ver->hw_variant) { 2013 case 0x0b: /* SfP */ 2014 case 0x0c: /* WsP */ 2015 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2016 ver->hw_variant, 2017 le16_to_cpu(params->dev_revid), 2018 suffix); 2019 break; 2020 case 0x11: /* JfP */ 2021 case 0x12: /* ThP */ 2022 case 0x13: /* HrP */ 2023 case 0x14: /* CcP */ 2024 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2025 ver->hw_variant, 2026 ver->hw_revision, 2027 ver->fw_revision, 2028 suffix); 2029 break; 2030 default: 2031 return -EINVAL; 2032 } 2033 2034 return 0; 2035 } 2036 2037 static int btintel_download_fw(struct hci_dev *hdev, 2038 struct intel_version *ver, 2039 struct intel_boot_params *params, 2040 u32 *boot_param) 2041 { 2042 const struct firmware *fw; 2043 char fwname[64]; 2044 int err; 2045 ktime_t calltime; 2046 2047 if (!ver || !params) 2048 return -EINVAL; 2049 2050 /* The firmware variant determines if the device is in bootloader 2051 * mode or is running operational firmware. The value 0x06 identifies 2052 * the bootloader and the value 0x23 identifies the operational 2053 * firmware. 2054 * 2055 * When the operational firmware is already present, then only 2056 * the check for valid Bluetooth device address is needed. This 2057 * determines if the device will be added as configured or 2058 * unconfigured controller. 2059 * 2060 * It is not possible to use the Secure Boot Parameters in this 2061 * case since that command is only available in bootloader mode. 2062 */ 2063 if (ver->fw_variant == 0x23) { 2064 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2065 btintel_check_bdaddr(hdev); 2066 2067 /* SfP and WsP don't seem to update the firmware version on file 2068 * so version checking is currently possible. 2069 */ 2070 switch (ver->hw_variant) { 2071 case 0x0b: /* SfP */ 2072 case 0x0c: /* WsP */ 2073 return 0; 2074 } 2075 2076 /* Proceed to download to check if the version matches */ 2077 goto download; 2078 } 2079 2080 /* Read the secure boot parameters to identify the operating 2081 * details of the bootloader. 2082 */ 2083 err = btintel_read_boot_params(hdev, params); 2084 if (err) 2085 return err; 2086 2087 /* It is required that every single firmware fragment is acknowledged 2088 * with a command complete event. If the boot parameters indicate 2089 * that this bootloader does not send them, then abort the setup. 2090 */ 2091 if (params->limited_cce != 0x00) { 2092 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2093 params->limited_cce); 2094 return -EINVAL; 2095 } 2096 2097 /* If the OTP has no valid Bluetooth device address, then there will 2098 * also be no valid address for the operational firmware. 2099 */ 2100 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2101 bt_dev_info(hdev, "No device address configured"); 2102 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2103 } 2104 2105 download: 2106 /* With this Intel bootloader only the hardware variant and device 2107 * revision information are used to select the right firmware for SfP 2108 * and WsP. 2109 * 2110 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2111 * 2112 * Currently the supported hardware variants are: 2113 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2114 * 12 (0x0c) for iBT3.5 (WsP) 2115 * 2116 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2117 * variant, HW revision and FW revision, as these are dependent on CNVi 2118 * and RF Combination. 2119 * 2120 * 17 (0x11) for iBT3.5 (JfP) 2121 * 18 (0x12) for iBT3.5 (ThP) 2122 * 2123 * The firmware file name for these will be 2124 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2125 * 2126 */ 2127 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2128 if (err < 0) { 2129 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2130 /* Firmware has already been loaded */ 2131 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2132 return 0; 2133 } 2134 2135 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2136 return -EINVAL; 2137 } 2138 2139 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2140 if (err < 0) { 2141 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2142 /* Firmware has already been loaded */ 2143 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2144 return 0; 2145 } 2146 2147 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2148 fwname, err); 2149 return err; 2150 } 2151 2152 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2153 2154 if (fw->size < 644) { 2155 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2156 fw->size); 2157 err = -EBADF; 2158 goto done; 2159 } 2160 2161 calltime = ktime_get(); 2162 2163 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2164 2165 /* Start firmware downloading and get boot parameter */ 2166 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2167 if (err < 0) { 2168 if (err == -EALREADY) { 2169 /* Firmware has already been loaded */ 2170 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2171 err = 0; 2172 goto done; 2173 } 2174 2175 /* When FW download fails, send Intel Reset to retry 2176 * FW download. 2177 */ 2178 btintel_reset_to_bootloader(hdev); 2179 goto done; 2180 } 2181 2182 /* Before switching the device into operational mode and with that 2183 * booting the loaded firmware, wait for the bootloader notification 2184 * that all fragments have been successfully received. 2185 * 2186 * When the event processing receives the notification, then the 2187 * INTEL_DOWNLOADING flag will be cleared. 2188 * 2189 * The firmware loading should not take longer than 5 seconds 2190 * and thus just timeout if that happens and fail the setup 2191 * of this device. 2192 */ 2193 err = btintel_download_wait(hdev, calltime, 5000); 2194 if (err == -ETIMEDOUT) 2195 btintel_reset_to_bootloader(hdev); 2196 2197 done: 2198 release_firmware(fw); 2199 return err; 2200 } 2201 2202 static int btintel_bootloader_setup(struct hci_dev *hdev, 2203 struct intel_version *ver) 2204 { 2205 struct intel_version new_ver; 2206 struct intel_boot_params params; 2207 u32 boot_param; 2208 char ddcname[64]; 2209 int err; 2210 2211 BT_DBG("%s", hdev->name); 2212 2213 /* Set the default boot parameter to 0x0 and it is updated to 2214 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2215 * command while downloading the firmware. 2216 */ 2217 boot_param = 0x00000000; 2218 2219 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2220 2221 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2222 if (err) 2223 return err; 2224 2225 /* controller is already having an operational firmware */ 2226 if (ver->fw_variant == 0x23) 2227 goto finish; 2228 2229 err = btintel_boot(hdev, boot_param); 2230 if (err) 2231 return err; 2232 2233 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2234 2235 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2236 sizeof(ddcname), "ddc"); 2237 2238 if (err < 0) { 2239 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2240 } else { 2241 /* Once the device is running in operational mode, it needs to 2242 * apply the device configuration (DDC) parameters. 2243 * 2244 * The device can work without DDC parameters, so even if it 2245 * fails to load the file, no need to fail the setup. 2246 */ 2247 btintel_load_ddc_config(hdev, ddcname); 2248 } 2249 2250 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2251 2252 /* Read the Intel version information after loading the FW */ 2253 err = btintel_read_version(hdev, &new_ver); 2254 if (err) 2255 return err; 2256 2257 btintel_version_info(hdev, &new_ver); 2258 2259 finish: 2260 /* Set the event mask for Intel specific vendor events. This enables 2261 * a few extra events that are useful during general operation. It 2262 * does not enable any debugging related events. 2263 * 2264 * The device will function correctly without these events enabled 2265 * and thus no need to fail the setup. 2266 */ 2267 btintel_set_event_mask(hdev, false); 2268 2269 return 0; 2270 } 2271 2272 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2273 char *fw_name, size_t len, 2274 const char *suffix) 2275 { 2276 const char *format; 2277 u32 cnvi, cnvr; 2278 2279 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2280 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2281 2282 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2283 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2284 2285 /* Only Blazar product supports downloading of intermediate loader 2286 * image 2287 */ 2288 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2289 u8 zero[BTINTEL_FWID_MAXLEN]; 2290 2291 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2292 format = "intel/ibt-%04x-%04x-iml.%s"; 2293 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2294 return; 2295 } 2296 2297 memset(zero, 0, sizeof(zero)); 2298 2299 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2300 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2301 format = "intel/ibt-%04x-%04x-%s.%s"; 2302 snprintf(fw_name, len, format, cnvi, cnvr, 2303 ver->fw_id, suffix); 2304 return; 2305 } 2306 /* If firmware id is not present, fallback to legacy naming 2307 * convention 2308 */ 2309 } 2310 /* Fallback to legacy naming convention for other controllers 2311 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2312 */ 2313 format = "intel/ibt-%04x-%04x.%s"; 2314 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2315 } 2316 2317 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2318 char *fw_name, size_t len, 2319 const char *suffix) 2320 { 2321 const char *format; 2322 u32 cnvi, cnvr; 2323 2324 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2325 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2326 2327 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2328 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2329 2330 format = "intel/ibt-%04x-%04x-iml.%s"; 2331 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2332 } 2333 2334 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2335 struct intel_version_tlv *ver, 2336 u32 *boot_param) 2337 { 2338 const struct firmware *fw; 2339 char fwname[128]; 2340 int err; 2341 ktime_t calltime; 2342 2343 if (!ver || !boot_param) 2344 return -EINVAL; 2345 2346 /* The firmware variant determines if the device is in bootloader 2347 * mode or is running operational firmware. The value 0x03 identifies 2348 * the bootloader and the value 0x23 identifies the operational 2349 * firmware. 2350 * 2351 * When the operational firmware is already present, then only 2352 * the check for valid Bluetooth device address is needed. This 2353 * determines if the device will be added as configured or 2354 * unconfigured controller. 2355 * 2356 * It is not possible to use the Secure Boot Parameters in this 2357 * case since that command is only available in bootloader mode. 2358 */ 2359 if (ver->img_type == BTINTEL_IMG_OP) { 2360 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2361 btintel_check_bdaddr(hdev); 2362 } else { 2363 /* 2364 * Check for valid bd address in boot loader mode. Device 2365 * will be marked as unconfigured if empty bd address is 2366 * found. 2367 */ 2368 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2369 bt_dev_info(hdev, "No device address configured"); 2370 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2371 } 2372 } 2373 2374 if (ver->img_type == BTINTEL_IMG_OP) { 2375 /* Controller running OP image. In case of FW downgrade, 2376 * FWID TLV may not be present and driver may attempt to load 2377 * firmware image which doesn't exist. Lets compare the version 2378 * of IML image 2379 */ 2380 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2381 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2382 else 2383 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2384 } else { 2385 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2386 } 2387 2388 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2389 if (err < 0) { 2390 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2391 /* Firmware has already been loaded */ 2392 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2393 return 0; 2394 } 2395 2396 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2397 fwname, err); 2398 2399 return err; 2400 } 2401 2402 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2403 2404 if (fw->size < 644) { 2405 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2406 fw->size); 2407 err = -EBADF; 2408 goto done; 2409 } 2410 2411 calltime = ktime_get(); 2412 2413 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2414 2415 /* Start firmware downloading and get boot parameter */ 2416 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2417 INTEL_HW_VARIANT(ver->cnvi_bt), 2418 ver->sbe_type); 2419 if (err < 0) { 2420 if (err == -EALREADY) { 2421 /* Firmware has already been loaded */ 2422 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2423 err = 0; 2424 goto done; 2425 } 2426 2427 /* When FW download fails, send Intel Reset to retry 2428 * FW download. 2429 */ 2430 btintel_reset_to_bootloader(hdev); 2431 goto done; 2432 } 2433 2434 /* Before switching the device into operational mode and with that 2435 * booting the loaded firmware, wait for the bootloader notification 2436 * that all fragments have been successfully received. 2437 * 2438 * When the event processing receives the notification, then the 2439 * BTUSB_DOWNLOADING flag will be cleared. 2440 * 2441 * The firmware loading should not take longer than 5 seconds 2442 * and thus just timeout if that happens and fail the setup 2443 * of this device. 2444 */ 2445 err = btintel_download_wait(hdev, calltime, 5000); 2446 if (err == -ETIMEDOUT) 2447 btintel_reset_to_bootloader(hdev); 2448 2449 done: 2450 release_firmware(fw); 2451 return err; 2452 } 2453 2454 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2455 __u8 link, struct bt_codec *codec, 2456 __u8 *ven_len, __u8 **ven_data) 2457 { 2458 int err = 0; 2459 2460 if (!ven_data || !ven_len) 2461 return -EINVAL; 2462 2463 *ven_len = 0; 2464 *ven_data = NULL; 2465 2466 if (link != ESCO_LINK) { 2467 bt_dev_err(hdev, "Invalid link type(%u)", link); 2468 return -EINVAL; 2469 } 2470 2471 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2472 if (!*ven_data) { 2473 err = -ENOMEM; 2474 goto error; 2475 } 2476 2477 /* supports only CVSD and mSBC offload codecs */ 2478 switch (codec->id) { 2479 case 0x02: 2480 **ven_data = 0x00; 2481 break; 2482 case 0x05: 2483 **ven_data = 0x01; 2484 break; 2485 default: 2486 err = -EINVAL; 2487 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2488 goto error; 2489 } 2490 /* codec and its capabilities are pre-defined to ids 2491 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2492 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2493 */ 2494 *ven_len = sizeof(__u8); 2495 return err; 2496 2497 error: 2498 kfree(*ven_data); 2499 *ven_data = NULL; 2500 return err; 2501 } 2502 2503 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2504 { 2505 /* Intel uses 1 as data path id for all the usecases */ 2506 *data_path_id = 1; 2507 return 0; 2508 } 2509 2510 static int btintel_configure_offload(struct hci_dev *hdev) 2511 { 2512 struct sk_buff *skb; 2513 int err = 0; 2514 struct intel_offload_use_cases *use_cases; 2515 2516 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2517 if (IS_ERR(skb)) { 2518 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2519 PTR_ERR(skb)); 2520 return PTR_ERR(skb); 2521 } 2522 2523 if (skb->len < sizeof(*use_cases)) { 2524 err = -EIO; 2525 goto error; 2526 } 2527 2528 use_cases = (void *)skb->data; 2529 2530 if (use_cases->status) { 2531 err = -bt_to_errno(skb->data[0]); 2532 goto error; 2533 } 2534 2535 if (use_cases->preset[0] & 0x03) { 2536 hdev->get_data_path_id = btintel_get_data_path_id; 2537 hdev->get_codec_config_data = btintel_get_codec_config_data; 2538 } 2539 error: 2540 kfree_skb(skb); 2541 return err; 2542 } 2543 2544 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2545 { 2546 struct sk_buff *skb; 2547 struct hci_ppag_enable_cmd ppag_cmd; 2548 acpi_handle handle; 2549 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2550 union acpi_object *p, *elements; 2551 u32 domain, mode; 2552 acpi_status status; 2553 2554 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2555 switch (ver->cnvr_top & 0xFFF) { 2556 case 0x504: /* Hrp2 */ 2557 case 0x202: /* Jfp2 */ 2558 case 0x201: /* Jfp1 */ 2559 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2560 ver->cnvr_top & 0xFFF); 2561 return; 2562 } 2563 2564 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2565 if (!handle) { 2566 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2567 return; 2568 } 2569 2570 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2571 if (ACPI_FAILURE(status)) { 2572 if (status == AE_NOT_FOUND) { 2573 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2574 return; 2575 } 2576 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2577 return; 2578 } 2579 2580 p = buffer.pointer; 2581 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2582 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2583 p->type, p->package.count); 2584 kfree(buffer.pointer); 2585 return; 2586 } 2587 2588 elements = p->package.elements; 2589 2590 /* PPAG table is located at element[1] */ 2591 p = &elements[1]; 2592 2593 domain = (u32)p->package.elements[0].integer.value; 2594 mode = (u32)p->package.elements[1].integer.value; 2595 kfree(buffer.pointer); 2596 2597 if (domain != 0x12) { 2598 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2599 return; 2600 } 2601 2602 /* PPAG mode 2603 * BIT 0 : 0 Disabled in EU 2604 * 1 Enabled in EU 2605 * BIT 1 : 0 Disabled in China 2606 * 1 Enabled in China 2607 */ 2608 mode &= 0x03; 2609 2610 if (!mode) { 2611 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2612 return; 2613 } 2614 2615 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2616 2617 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2618 &ppag_cmd, HCI_CMD_TIMEOUT); 2619 if (IS_ERR(skb)) { 2620 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2621 return; 2622 } 2623 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2624 kfree_skb(skb); 2625 } 2626 2627 static int btintel_acpi_reset_method(struct hci_dev *hdev) 2628 { 2629 int ret = 0; 2630 acpi_status status; 2631 union acpi_object *p, *ref; 2632 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2633 2634 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2635 if (ACPI_FAILURE(status)) { 2636 bt_dev_err(hdev, "Failed to run _PRR method"); 2637 ret = -ENODEV; 2638 return ret; 2639 } 2640 p = buffer.pointer; 2641 2642 if (p->package.count != 1 || p->type != ACPI_TYPE_PACKAGE) { 2643 bt_dev_err(hdev, "Invalid arguments"); 2644 ret = -EINVAL; 2645 goto exit_on_error; 2646 } 2647 2648 ref = &p->package.elements[0]; 2649 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2650 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2651 ret = -EINVAL; 2652 goto exit_on_error; 2653 } 2654 2655 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2656 if (ACPI_FAILURE(status)) { 2657 bt_dev_err(hdev, "Failed to run_RST method"); 2658 ret = -ENODEV; 2659 goto exit_on_error; 2660 } 2661 2662 exit_on_error: 2663 kfree(buffer.pointer); 2664 return ret; 2665 } 2666 2667 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2668 struct intel_version_tlv *ver_tlv) 2669 { 2670 struct btintel_data *data = hci_get_priv(hdev); 2671 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2672 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2673 union acpi_object *obj, argv4; 2674 enum { 2675 RESET_TYPE_WDISABLE2, 2676 RESET_TYPE_VSEC 2677 }; 2678 2679 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2680 2681 if (!handle) { 2682 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2683 return; 2684 } 2685 2686 if (!acpi_has_method(handle, "_PRR")) { 2687 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2688 return; 2689 } 2690 2691 switch (ver_tlv->cnvi_top & 0xfff) { 2692 case 0x910: /* GalePeak2 */ 2693 reset_payload[2] = RESET_TYPE_VSEC; 2694 break; 2695 default: 2696 /* WDISABLE2 is the default reset method */ 2697 reset_payload[2] = RESET_TYPE_WDISABLE2; 2698 2699 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2700 BIT(DSM_SET_WDISABLE2_DELAY))) { 2701 bt_dev_err(hdev, "No dsm support to set reset delay"); 2702 return; 2703 } 2704 argv4.integer.type = ACPI_TYPE_INTEGER; 2705 /* delay required to toggle BT power */ 2706 argv4.integer.value = 160; 2707 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2708 DSM_SET_WDISABLE2_DELAY, &argv4); 2709 if (!obj) { 2710 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2711 return; 2712 } 2713 ACPI_FREE(obj); 2714 } 2715 2716 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2717 2718 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2719 DSM_SET_RESET_METHOD)) { 2720 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2721 return; 2722 } 2723 argv4.buffer.type = ACPI_TYPE_BUFFER; 2724 argv4.buffer.length = sizeof(reset_payload); 2725 argv4.buffer.pointer = reset_payload; 2726 2727 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2728 DSM_SET_RESET_METHOD, &argv4); 2729 if (!obj) { 2730 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2731 return; 2732 } 2733 ACPI_FREE(obj); 2734 data->acpi_reset_method = btintel_acpi_reset_method; 2735 } 2736 2737 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2738 2739 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2740 { 2741 /* 2742 * Distinguish ISO data packets form ACL data packets 2743 * based on their connection handle value range. 2744 */ 2745 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2746 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2747 2748 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) 2749 return HCI_ISODATA_PKT; 2750 } 2751 2752 return hci_skb_pkt_type(skb); 2753 } 2754 2755 /* 2756 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2757 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2758 * overcome the potential STEP errors on their designs. Based on the 2759 * configauration, bluetooth firmware shall adjust the BRI response line drive 2760 * strength. The below structure represents DSBR data. 2761 * struct { 2762 * u8 header; 2763 * u32 dsbr; 2764 * } __packed; 2765 * 2766 * header - defines revision number of the structure 2767 * dsbr - defines drive strength BRI response 2768 * bit0 2769 * 0 - instructs bluetooth firmware to use default values 2770 * 1 - instructs bluetooth firmware to override default values 2771 * bit3:1 2772 * Reserved 2773 * bit7:4 2774 * DSBR override values (only if bit0 is set. Default value is 0xF 2775 * bit31:7 2776 * Reserved 2777 * Expected values for dsbr field: 2778 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2779 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2780 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2781 * that the resistor on board is 10 Ohm 2782 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2783 * firmware to use default values. 2784 * 2785 */ 2786 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2787 { 2788 struct btintel_dsbr { 2789 u8 header; 2790 u32 dsbr; 2791 } __packed data; 2792 2793 efi_status_t status; 2794 unsigned long data_size = sizeof(data); 2795 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2796 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2797 2798 if (!IS_ENABLED(CONFIG_EFI)) 2799 return -EOPNOTSUPP; 2800 2801 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2802 return -EOPNOTSUPP; 2803 2804 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2805 &data); 2806 2807 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2808 return -ENXIO; 2809 2810 *dsbr_var = data.dsbr; 2811 return 0; 2812 } 2813 2814 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2815 { 2816 struct btintel_dsbr_cmd { 2817 u8 enable; 2818 u8 dsbr; 2819 } __packed; 2820 2821 struct btintel_dsbr_cmd cmd; 2822 struct sk_buff *skb; 2823 u32 dsbr; 2824 u8 status, hw_variant; 2825 int err; 2826 2827 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2828 /* DSBR command needs to be sent for, 2829 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2830 * 2. Gale Peak2 or BlazarU in OP image. 2831 * 3. Scorpious Peak in IML image. 2832 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2833 */ 2834 2835 switch (hw_variant) { 2836 case BTINTEL_HWID_BZRI: 2837 case BTINTEL_HWID_BZRIW: 2838 if (ver->img_type == BTINTEL_IMG_IML && 2839 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2840 break; 2841 return 0; 2842 case BTINTEL_HWID_GAP: 2843 case BTINTEL_HWID_BZRU: 2844 if (ver->img_type == BTINTEL_IMG_OP && 2845 hdev->bus == HCI_USB) 2846 break; 2847 return 0; 2848 case BTINTEL_HWID_SCP: 2849 if (ver->img_type == BTINTEL_IMG_IML) 2850 break; 2851 return 0; 2852 default: 2853 /* Scorpius Peak2 onwards */ 2854 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2855 && ver->img_type == BTINTEL_IMG_IML) 2856 break; 2857 return 0; 2858 } 2859 2860 dsbr = 0; 2861 err = btintel_uefi_get_dsbr(&dsbr); 2862 if (err < 0) 2863 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2864 BTINTEL_EFI_DSBR, err); 2865 2866 cmd.enable = dsbr & BIT(0); 2867 cmd.dsbr = dsbr >> 4 & 0xF; 2868 2869 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2870 cmd.dsbr); 2871 2872 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2873 if (IS_ERR(skb)) 2874 return -bt_to_errno(PTR_ERR(skb)); 2875 2876 status = skb->data[0]; 2877 kfree_skb(skb); 2878 2879 if (status) 2880 return -bt_to_errno(status); 2881 2882 return 0; 2883 } 2884 2885 #ifdef CONFIG_ACPI 2886 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2887 acpi_string method, 2888 union acpi_object **ptr, 2889 u8 pkg_size) 2890 { 2891 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2892 union acpi_object *p; 2893 acpi_status status; 2894 acpi_handle handle; 2895 2896 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2897 if (!handle) { 2898 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2899 return AE_NOT_EXIST; 2900 } 2901 2902 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2903 2904 if (ACPI_FAILURE(status)) { 2905 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2906 acpi_format_exception(status), method); 2907 return status; 2908 } 2909 2910 p = buffer.pointer; 2911 2912 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2913 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2914 p->type, p->package.count); 2915 kfree(buffer.pointer); 2916 return AE_ERROR; 2917 } 2918 2919 *ptr = buffer.pointer; 2920 return 0; 2921 } 2922 2923 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2924 { 2925 union acpi_object *domain, *bt_pkg; 2926 int i; 2927 2928 for (i = 1; i < buffer->package.count; i++) { 2929 bt_pkg = &buffer->package.elements[i]; 2930 domain = &bt_pkg->package.elements[0]; 2931 if (domain->type == ACPI_TYPE_INTEGER && 2932 domain->integer.value == BTINTEL_BT_DOMAIN) 2933 return bt_pkg; 2934 } 2935 return ERR_PTR(-ENOENT); 2936 } 2937 2938 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2939 { 2940 struct sk_buff *skb; 2941 2942 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2943 if (IS_ERR(skb)) { 2944 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2945 le16_to_cpu(data->id), PTR_ERR(skb)); 2946 return PTR_ERR(skb); 2947 } 2948 kfree_skb(skb); 2949 return 0; 2950 } 2951 2952 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2953 int id, struct btintel_sar_inc_pwr *sar) 2954 { 2955 cmd->len = 5; 2956 cmd->id = cpu_to_le16(id); 2957 cmd->data[0] = sar->br >> 3; 2958 cmd->data[1] = sar->edr2 >> 3; 2959 cmd->data[2] = sar->edr3 >> 3; 2960 return btintel_send_sar_ddc(hdev, cmd, 6); 2961 } 2962 2963 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2964 int id, struct btintel_sar_inc_pwr *sar) 2965 { 2966 cmd->len = 3; 2967 cmd->id = cpu_to_le16(id); 2968 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 2969 return btintel_send_sar_ddc(hdev, cmd, 4); 2970 } 2971 2972 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2973 int id, struct btintel_sar_inc_pwr *sar) 2974 { 2975 cmd->len = 3; 2976 cmd->id = cpu_to_le16(id); 2977 cmd->data[0] = sar->br >> 3; 2978 return btintel_send_sar_ddc(hdev, cmd, 4); 2979 } 2980 2981 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2982 int id, struct btintel_sar_inc_pwr *sar) 2983 { 2984 cmd->len = 3; 2985 cmd->id = cpu_to_le16(id); 2986 cmd->data[0] = sar->br; 2987 return btintel_send_sar_ddc(hdev, cmd, 4); 2988 } 2989 2990 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2991 int id, struct btintel_sar_inc_pwr *sar) 2992 { 2993 cmd->len = 3; 2994 cmd->id = cpu_to_le16(id); 2995 cmd->data[0] = sar->edr2; 2996 return btintel_send_sar_ddc(hdev, cmd, 4); 2997 } 2998 2999 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3000 int id, struct btintel_sar_inc_pwr *sar) 3001 { 3002 cmd->len = 3; 3003 cmd->id = cpu_to_le16(id); 3004 cmd->data[0] = sar->edr3; 3005 return btintel_send_sar_ddc(hdev, cmd, 4); 3006 } 3007 3008 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3009 { 3010 struct btintel_cp_ddc_write *cmd; 3011 u8 buffer[64]; 3012 int ret; 3013 3014 cmd = (void *)buffer; 3015 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3016 if (ret) 3017 return ret; 3018 3019 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3020 if (ret) 3021 return ret; 3022 3023 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3024 if (ret) 3025 return ret; 3026 3027 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3028 if (ret) 3029 return ret; 3030 3031 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3032 if (ret) 3033 return ret; 3034 3035 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3036 if (ret) 3037 return ret; 3038 3039 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3040 3041 return ret; 3042 } 3043 3044 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3045 { 3046 struct btintel_cp_ddc_write *cmd; 3047 struct sk_buff *skb; 3048 u8 buffer[64]; 3049 bool enable; 3050 int ret; 3051 3052 cmd = (void *)buffer; 3053 3054 cmd->len = 3; 3055 cmd->id = cpu_to_le16(0x019e); 3056 3057 if (sar->revision == BTINTEL_SAR_INC_PWR && 3058 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3059 cmd->data[0] = 0x01; 3060 else 3061 cmd->data[0] = 0x00; 3062 3063 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3064 if (ret) 3065 return ret; 3066 3067 if (sar->revision == BTINTEL_SAR_INC_PWR && 3068 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3069 cmd->len = 3; 3070 cmd->id = cpu_to_le16(0x019f); 3071 cmd->data[0] = sar->sar_2400_chain_a; 3072 3073 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3074 if (ret) 3075 return ret; 3076 } 3077 3078 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3079 if (ret) 3080 return ret; 3081 3082 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3083 if (ret) 3084 return ret; 3085 3086 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3087 if (ret) 3088 return ret; 3089 3090 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3091 if (ret) 3092 return ret; 3093 3094 enable = true; 3095 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3096 if (IS_ERR(skb)) { 3097 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3098 return PTR_ERR(skb); 3099 } 3100 3101 kfree_skb(skb); 3102 return 0; 3103 } 3104 3105 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3106 struct intel_version_tlv *ver) 3107 { 3108 u16 cnvi, cnvr; 3109 int ret; 3110 3111 cnvi = ver->cnvi_top & 0xfff; 3112 cnvr = ver->cnvr_top & 0xfff; 3113 3114 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3115 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3116 ret = btintel_set_legacy_sar(hdev, sar); 3117 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3118 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3119 ret = btintel_set_mutual_sar(hdev, sar); 3120 } else { 3121 ret = -EOPNOTSUPP; 3122 } 3123 3124 return ret; 3125 } 3126 3127 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3128 { 3129 union acpi_object *bt_pkg, *buffer = NULL; 3130 struct btintel_sar_inc_pwr sar; 3131 acpi_status status; 3132 u8 revision; 3133 int ret; 3134 3135 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3136 if (ACPI_FAILURE(status)) 3137 return -ENOENT; 3138 3139 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3140 3141 if (IS_ERR(bt_pkg)) { 3142 ret = PTR_ERR(bt_pkg); 3143 goto error; 3144 } 3145 3146 if (!bt_pkg->package.count) { 3147 ret = -EINVAL; 3148 goto error; 3149 } 3150 3151 revision = buffer->package.elements[0].integer.value; 3152 3153 if (revision > BTINTEL_SAR_INC_PWR) { 3154 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3155 ret = -EOPNOTSUPP; 3156 goto error; 3157 } 3158 3159 memset(&sar, 0, sizeof(sar)); 3160 3161 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3162 sar.revision = revision; 3163 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3164 sar.br = bt_pkg->package.elements[2].integer.value; 3165 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3166 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3167 sar.le = bt_pkg->package.elements[5].integer.value; 3168 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3169 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3170 3171 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3172 sar.revision = revision; 3173 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3174 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3175 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3176 sar.br = bt_pkg->package.elements[4].integer.value; 3177 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3178 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3179 sar.le = bt_pkg->package.elements[7].integer.value; 3180 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3181 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3182 } else { 3183 ret = -EINVAL; 3184 goto error; 3185 } 3186 3187 /* Apply only if it is enabled in BIOS */ 3188 if (sar.bt_sar_bios != 1) { 3189 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3190 ret = -EOPNOTSUPP; 3191 goto error; 3192 } 3193 3194 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3195 error: 3196 kfree(buffer); 3197 return ret; 3198 } 3199 #endif /* CONFIG_ACPI */ 3200 3201 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3202 struct intel_version_tlv *ver) 3203 { 3204 #ifdef CONFIG_ACPI 3205 return btintel_acpi_set_sar(hdev, ver); 3206 #endif 3207 return 0; 3208 } 3209 3210 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3211 struct intel_version_tlv *ver) 3212 { 3213 u32 boot_param; 3214 char ddcname[64]; 3215 int err; 3216 struct intel_version_tlv new_ver; 3217 3218 bt_dev_dbg(hdev, ""); 3219 3220 /* Set the default boot parameter to 0x0 and it is updated to 3221 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3222 * command while downloading the firmware. 3223 */ 3224 boot_param = 0x00000000; 3225 3226 /* In case of PCIe, this function might get called multiple times with 3227 * same hdev instance if there is any error on firmware download. 3228 * Need to clear stale bits of previous firmware download attempt. 3229 */ 3230 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3231 btintel_clear_flag(hdev, i); 3232 3233 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3234 3235 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3236 if (err) 3237 return err; 3238 3239 /* check if controller is already having an operational firmware */ 3240 if (ver->img_type == BTINTEL_IMG_OP) 3241 goto finish; 3242 3243 err = btintel_boot(hdev, boot_param); 3244 if (err) 3245 return err; 3246 3247 err = btintel_read_version_tlv(hdev, ver); 3248 if (err) 3249 return err; 3250 3251 /* set drive strength of BRI response */ 3252 err = btintel_set_dsbr(hdev, ver); 3253 if (err) { 3254 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3255 return err; 3256 } 3257 3258 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3259 * intermediate loader image 3260 */ 3261 if (ver->img_type == BTINTEL_IMG_IML) { 3262 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3263 if (err) 3264 return err; 3265 3266 err = btintel_boot(hdev, boot_param); 3267 if (err) 3268 return err; 3269 } 3270 3271 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3272 3273 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3274 /* Once the device is running in operational mode, it needs to 3275 * apply the device configuration (DDC) parameters. 3276 * 3277 * The device can work without DDC parameters, so even if it 3278 * fails to load the file, no need to fail the setup. 3279 */ 3280 btintel_load_ddc_config(hdev, ddcname); 3281 3282 /* Read supported use cases and set callbacks to fetch datapath id */ 3283 btintel_configure_offload(hdev); 3284 3285 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3286 3287 /* Send sar values to controller */ 3288 btintel_set_specific_absorption_rate(hdev, ver); 3289 3290 /* Set PPAG feature */ 3291 btintel_set_ppag(hdev, ver); 3292 3293 /* Read the Intel version information after loading the FW */ 3294 err = btintel_read_version_tlv(hdev, &new_ver); 3295 if (err) 3296 return err; 3297 3298 btintel_version_info_tlv(hdev, &new_ver); 3299 3300 finish: 3301 /* Set the event mask for Intel specific vendor events. This enables 3302 * a few extra events that are useful during general operation. It 3303 * does not enable any debugging related events. 3304 * 3305 * The device will function correctly without these events enabled 3306 * and thus no need to fail the setup. 3307 */ 3308 btintel_set_event_mask(hdev, false); 3309 3310 return 0; 3311 } 3312 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3313 3314 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3315 { 3316 switch (hw_variant) { 3317 /* Legacy bootloader devices that supports MSFT Extension */ 3318 case 0x11: /* JfP */ 3319 case 0x12: /* ThP */ 3320 case 0x13: /* HrP */ 3321 case 0x14: /* CcP */ 3322 /* All Intel new generation controllers support the Microsoft vendor 3323 * extension are using 0xFC1E for VsMsftOpCode. 3324 */ 3325 case 0x17: 3326 case 0x18: 3327 case 0x19: 3328 case 0x1b: 3329 case 0x1c: 3330 case 0x1d: 3331 case 0x1e: 3332 case 0x1f: 3333 case 0x20: 3334 case 0x21: 3335 case 0x22: 3336 hci_set_msft_opcode(hdev, 0xFC1E); 3337 break; 3338 default: 3339 /* Not supported */ 3340 break; 3341 } 3342 } 3343 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3344 3345 void btintel_print_fseq_info(struct hci_dev *hdev) 3346 { 3347 struct sk_buff *skb; 3348 u8 *p; 3349 u32 val; 3350 const char *str; 3351 3352 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3353 if (IS_ERR(skb)) { 3354 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3355 PTR_ERR(skb)); 3356 return; 3357 } 3358 3359 if (skb->len < (sizeof(u32) * 16 + 2)) { 3360 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3361 skb->len); 3362 kfree_skb(skb); 3363 return; 3364 } 3365 3366 p = skb_pull_data(skb, 1); 3367 if (*p) { 3368 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3369 kfree_skb(skb); 3370 return; 3371 } 3372 3373 p = skb_pull_data(skb, 1); 3374 switch (*p) { 3375 case 0: 3376 str = "Success"; 3377 break; 3378 case 1: 3379 str = "Fatal error"; 3380 break; 3381 case 2: 3382 str = "Semaphore acquire error"; 3383 break; 3384 default: 3385 str = "Unknown error"; 3386 break; 3387 } 3388 3389 if (*p) { 3390 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3391 kfree_skb(skb); 3392 return; 3393 } 3394 3395 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3396 3397 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3398 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3399 3400 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3401 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3402 3403 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3404 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3405 3406 p = skb->data; 3407 skb_pull_data(skb, 4); 3408 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3409 p[2], p[3]); 3410 3411 p = skb->data; 3412 skb_pull_data(skb, 4); 3413 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3414 p[2], p[3]); 3415 3416 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3417 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3418 3419 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3420 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3421 3422 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3423 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3424 3425 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3426 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3427 3428 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3429 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3430 3431 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3432 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3433 3434 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3435 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3436 3437 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3438 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3439 3440 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3441 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3442 3443 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3444 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3445 3446 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3447 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3448 3449 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3450 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3451 3452 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3453 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3454 3455 kfree_skb(skb); 3456 } 3457 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3458 3459 static int btintel_setup_combined(struct hci_dev *hdev) 3460 { 3461 const u8 param[1] = { 0xFF }; 3462 struct intel_version ver; 3463 struct intel_version_tlv ver_tlv; 3464 struct sk_buff *skb; 3465 int err; 3466 3467 BT_DBG("%s", hdev->name); 3468 3469 /* The some controllers have a bug with the first HCI command sent to it 3470 * returning number of completed commands as zero. This would stall the 3471 * command processing in the Bluetooth core. 3472 * 3473 * As a workaround, send HCI Reset command first which will reset the 3474 * number of completed commands and allow normal command processing 3475 * from now on. 3476 * 3477 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3478 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3479 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3480 * state, the only way to exit out of it is sending the HCI_Reset 3481 * command. 3482 */ 3483 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3484 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3485 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3486 HCI_INIT_TIMEOUT); 3487 if (IS_ERR(skb)) { 3488 bt_dev_err(hdev, 3489 "sending initial HCI reset failed (%ld)", 3490 PTR_ERR(skb)); 3491 return PTR_ERR(skb); 3492 } 3493 kfree_skb(skb); 3494 } 3495 3496 /* Starting from TyP device, the command parameter and response are 3497 * changed even though the OCF for HCI_Intel_Read_Version command 3498 * remains same. The legacy devices can handle even if the 3499 * command has a parameter and returns a correct version information. 3500 * So, it uses new format to support both legacy and new format. 3501 */ 3502 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3503 if (IS_ERR(skb)) { 3504 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3505 PTR_ERR(skb)); 3506 return PTR_ERR(skb); 3507 } 3508 3509 /* Check the status */ 3510 if (skb->data[0]) { 3511 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3512 skb->data[0]); 3513 err = -EIO; 3514 goto exit_error; 3515 } 3516 3517 /* Apply the common HCI quirks for Intel device */ 3518 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3519 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3520 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3521 3522 /* Set up the quality report callback for Intel devices */ 3523 hdev->set_quality_report = btintel_set_quality_report; 3524 3525 /* For Legacy device, check the HW platform value and size */ 3526 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3527 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3528 3529 memcpy(&ver, skb->data, sizeof(ver)); 3530 3531 /* Display version information */ 3532 btintel_version_info(hdev, &ver); 3533 3534 /* Check for supported iBT hardware variants of this firmware 3535 * loading method. 3536 * 3537 * This check has been put in place to ensure correct forward 3538 * compatibility options when newer hardware variants come 3539 * along. 3540 */ 3541 switch (ver.hw_variant) { 3542 case 0x07: /* WP */ 3543 case 0x08: /* StP */ 3544 /* Legacy ROM product */ 3545 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3546 3547 /* Apply the device specific HCI quirks 3548 * 3549 * WBS for SdP - For the Legacy ROM products, only SdP 3550 * supports the WBS. But the version information is not 3551 * enough to use here because the StP2 and SdP have same 3552 * hw_variant and fw_variant. So, this flag is set by 3553 * the transport driver (btusb) based on the HW info 3554 * (idProduct) 3555 */ 3556 if (!btintel_test_flag(hdev, 3557 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3558 hci_set_quirk(hdev, 3559 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3560 3561 err = btintel_legacy_rom_setup(hdev, &ver); 3562 break; 3563 case 0x0b: /* SfP */ 3564 case 0x11: /* JfP */ 3565 case 0x12: /* ThP */ 3566 case 0x13: /* HrP */ 3567 case 0x14: /* CcP */ 3568 fallthrough; 3569 case 0x0c: /* WsP */ 3570 /* Apply the device specific HCI quirks 3571 * 3572 * All Legacy bootloader devices support WBS 3573 */ 3574 hci_set_quirk(hdev, 3575 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3576 3577 /* These variants don't seem to support LE Coded PHY */ 3578 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3579 3580 /* Setup MSFT Extension support */ 3581 btintel_set_msft_opcode(hdev, ver.hw_variant); 3582 3583 err = btintel_bootloader_setup(hdev, &ver); 3584 btintel_register_devcoredump_support(hdev); 3585 break; 3586 default: 3587 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3588 ver.hw_variant); 3589 err = -EINVAL; 3590 } 3591 3592 hci_set_hw_info(hdev, 3593 "INTEL platform=%u variant=%u revision=%u", 3594 ver.hw_platform, ver.hw_variant, 3595 ver.hw_revision); 3596 3597 goto exit_error; 3598 } 3599 3600 /* memset ver_tlv to start with clean state as few fields are exclusive 3601 * to bootloader mode and are not populated in operational mode 3602 */ 3603 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3604 /* For TLV type device, parse the tlv data */ 3605 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3606 if (err) { 3607 bt_dev_err(hdev, "Failed to parse TLV version information"); 3608 goto exit_error; 3609 } 3610 3611 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3612 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3613 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3614 err = -EINVAL; 3615 goto exit_error; 3616 } 3617 3618 /* Check for supported iBT hardware variants of this firmware 3619 * loading method. 3620 * 3621 * This check has been put in place to ensure correct forward 3622 * compatibility options when newer hardware variants come 3623 * along. 3624 */ 3625 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3626 case 0x11: /* JfP */ 3627 case 0x12: /* ThP */ 3628 case 0x13: /* HrP */ 3629 case 0x14: /* CcP */ 3630 /* Some legacy bootloader devices starting from JfP, 3631 * the operational firmware supports both old and TLV based 3632 * HCI_Intel_Read_Version command based on the command 3633 * parameter. 3634 * 3635 * For upgrading firmware case, the TLV based version cannot 3636 * be used because the firmware filename for legacy bootloader 3637 * is based on the old format. 3638 * 3639 * Also, it is not easy to convert TLV based version from the 3640 * legacy version format. 3641 * 3642 * So, as a workaround for those devices, use the legacy 3643 * HCI_Intel_Read_Version to get the version information and 3644 * run the legacy bootloader setup. 3645 */ 3646 err = btintel_read_version(hdev, &ver); 3647 if (err) 3648 break; 3649 3650 /* Apply the device specific HCI quirks 3651 * 3652 * All Legacy bootloader devices support WBS 3653 */ 3654 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3655 3656 /* These variants don't seem to support LE Coded PHY */ 3657 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3658 3659 /* Setup MSFT Extension support */ 3660 btintel_set_msft_opcode(hdev, ver.hw_variant); 3661 3662 err = btintel_bootloader_setup(hdev, &ver); 3663 btintel_register_devcoredump_support(hdev); 3664 break; 3665 case 0x18: /* GfP2 */ 3666 case 0x1c: /* GaP */ 3667 /* Re-classify packet type for controllers with LE audio */ 3668 hdev->classify_pkt_type = btintel_classify_pkt_type; 3669 fallthrough; 3670 case 0x17: 3671 case 0x19: 3672 case 0x1b: 3673 case 0x1d: 3674 case 0x1e: 3675 case 0x1f: 3676 case 0x20: 3677 case 0x21: 3678 case 0x22: 3679 /* Display version information of TLV type */ 3680 btintel_version_info_tlv(hdev, &ver_tlv); 3681 3682 /* Apply the device specific HCI quirks for TLV based devices 3683 * 3684 * All TLV based devices support WBS 3685 */ 3686 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3687 3688 /* Setup MSFT Extension support */ 3689 btintel_set_msft_opcode(hdev, 3690 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3691 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3692 3693 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3694 if (err) 3695 goto exit_error; 3696 3697 btintel_register_devcoredump_support(hdev); 3698 btintel_print_fseq_info(hdev); 3699 break; 3700 default: 3701 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3702 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3703 err = -EINVAL; 3704 break; 3705 } 3706 3707 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3708 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3709 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3710 3711 exit_error: 3712 kfree_skb(skb); 3713 3714 return err; 3715 } 3716 3717 int btintel_shutdown_combined(struct hci_dev *hdev) 3718 { 3719 struct sk_buff *skb; 3720 int ret; 3721 3722 /* Send HCI Reset to the controller to stop any BT activity which 3723 * were triggered. This will help to save power and maintain the 3724 * sync b/w Host and controller 3725 */ 3726 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3727 if (IS_ERR(skb)) { 3728 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3729 return PTR_ERR(skb); 3730 } 3731 kfree_skb(skb); 3732 3733 3734 /* Some platforms have an issue with BT LED when the interface is 3735 * down or BT radio is turned off, which takes 5 seconds to BT LED 3736 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3737 * device in the RFKILL ON state which turns off the BT LED immediately. 3738 */ 3739 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3740 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3741 if (IS_ERR(skb)) { 3742 ret = PTR_ERR(skb); 3743 bt_dev_err(hdev, "turning off Intel device LED failed"); 3744 return ret; 3745 } 3746 kfree_skb(skb); 3747 } 3748 3749 return 0; 3750 } 3751 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3752 3753 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3754 { 3755 hdev->manufacturer = 2; 3756 hdev->setup = btintel_setup_combined; 3757 hdev->shutdown = btintel_shutdown_combined; 3758 hdev->hw_error = btintel_hw_error; 3759 hdev->set_diag = btintel_set_diag_combined; 3760 hdev->set_bdaddr = btintel_set_bdaddr; 3761 3762 coredump_info.driver_name = driver_name; 3763 3764 return 0; 3765 } 3766 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3767 3768 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3769 { 3770 struct intel_tlv *tlv = (void *)&skb->data[5]; 3771 3772 /* The first event is always an event type TLV */ 3773 if (tlv->type != INTEL_TLV_TYPE_ID) 3774 goto recv_frame; 3775 3776 switch (tlv->val[0]) { 3777 case INTEL_TLV_SYSTEM_EXCEPTION: 3778 case INTEL_TLV_FATAL_EXCEPTION: 3779 case INTEL_TLV_DEBUG_EXCEPTION: 3780 case INTEL_TLV_TEST_EXCEPTION: 3781 /* Generate devcoredump from exception */ 3782 if (!hci_devcd_init(hdev, skb->len)) { 3783 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 3784 hci_devcd_complete(hdev); 3785 } else { 3786 bt_dev_err(hdev, "Failed to generate devcoredump"); 3787 } 3788 break; 3789 default: 3790 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3791 } 3792 3793 recv_frame: 3794 return hci_recv_frame(hdev, skb); 3795 } 3796 3797 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3798 { 3799 struct hci_event_hdr *hdr = (void *)skb->data; 3800 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3801 3802 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 3803 hdr->plen > 0) { 3804 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3805 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3806 3807 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3808 switch (skb->data[2]) { 3809 case 0x02: 3810 /* When switching to the operational firmware 3811 * the device sends a vendor specific event 3812 * indicating that the bootup completed. 3813 */ 3814 btintel_bootup(hdev, ptr, len); 3815 kfree_skb(skb); 3816 return 0; 3817 case 0x06: 3818 /* When the firmware loading completes the 3819 * device sends out a vendor specific event 3820 * indicating the result of the firmware 3821 * loading. 3822 */ 3823 btintel_secure_send_result(hdev, ptr, len); 3824 kfree_skb(skb); 3825 return 0; 3826 } 3827 } 3828 3829 /* Handle all diagnostics events separately. May still call 3830 * hci_recv_frame. 3831 */ 3832 if (len >= sizeof(diagnostics_hdr) && 3833 memcmp(&skb->data[2], diagnostics_hdr, 3834 sizeof(diagnostics_hdr)) == 0) { 3835 return btintel_diagnostics(hdev, skb); 3836 } 3837 } 3838 3839 return hci_recv_frame(hdev, skb); 3840 } 3841 EXPORT_SYMBOL_GPL(btintel_recv_event); 3842 3843 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 3844 { 3845 const struct intel_bootup *evt = ptr; 3846 3847 if (len != sizeof(*evt)) 3848 return; 3849 3850 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 3851 btintel_wake_up_flag(hdev, INTEL_BOOTING); 3852 } 3853 EXPORT_SYMBOL_GPL(btintel_bootup); 3854 3855 void btintel_secure_send_result(struct hci_dev *hdev, 3856 const void *ptr, unsigned int len) 3857 { 3858 const struct intel_secure_send_result *evt = ptr; 3859 3860 if (len != sizeof(*evt)) 3861 return; 3862 3863 if (evt->result) 3864 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 3865 3866 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 3867 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 3868 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 3869 } 3870 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 3871 3872 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3873 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 3874 MODULE_VERSION(VERSION); 3875 MODULE_LICENSE("GPL"); 3876 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 3877 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 3878 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 3879 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 3880