1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_REV2 2 55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 56 57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 58 struct cmd_write_boot_params { 59 __le32 boot_addr; 60 u8 fw_build_num; 61 u8 fw_build_ww; 62 u8 fw_build_yy; 63 } __packed; 64 65 static struct { 66 const char *driver_name; 67 u8 hw_variant; 68 u32 fw_build_num; 69 } coredump_info; 70 71 const guid_t btintel_guid_dsm = 72 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 73 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 74 EXPORT_SYMBOL_GPL(btintel_guid_dsm); 75 76 int btintel_check_bdaddr(struct hci_dev *hdev) 77 { 78 struct hci_rp_read_bd_addr *bda; 79 struct sk_buff *skb; 80 81 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 82 HCI_INIT_TIMEOUT); 83 if (IS_ERR(skb)) { 84 int err = PTR_ERR(skb); 85 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 86 err); 87 return err; 88 } 89 90 if (skb->len != sizeof(*bda)) { 91 bt_dev_err(hdev, "Intel device address length mismatch"); 92 kfree_skb(skb); 93 return -EIO; 94 } 95 96 bda = (struct hci_rp_read_bd_addr *)skb->data; 97 98 /* For some Intel based controllers, the default Bluetooth device 99 * address 00:03:19:9E:8B:00 can be found. These controllers are 100 * fully operational, but have the danger of duplicate addresses 101 * and that in turn can cause problems with Bluetooth operation. 102 */ 103 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 104 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 105 &bda->bdaddr); 106 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 107 } 108 109 kfree_skb(skb); 110 111 return 0; 112 } 113 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 114 115 int btintel_enter_mfg(struct hci_dev *hdev) 116 { 117 static const u8 param[] = { 0x01, 0x00 }; 118 struct sk_buff *skb; 119 120 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 121 if (IS_ERR(skb)) { 122 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 123 PTR_ERR(skb)); 124 return PTR_ERR(skb); 125 } 126 kfree_skb(skb); 127 128 return 0; 129 } 130 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 131 132 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 133 { 134 u8 param[] = { 0x00, 0x00 }; 135 struct sk_buff *skb; 136 137 /* The 2nd command parameter specifies the manufacturing exit method: 138 * 0x00: Just disable the manufacturing mode (0x00). 139 * 0x01: Disable manufacturing mode and reset with patches deactivated. 140 * 0x02: Disable manufacturing mode and reset with patches activated. 141 */ 142 if (reset) 143 param[1] |= patched ? 0x02 : 0x01; 144 145 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 146 if (IS_ERR(skb)) { 147 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 148 PTR_ERR(skb)); 149 return PTR_ERR(skb); 150 } 151 kfree_skb(skb); 152 153 return 0; 154 } 155 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 156 157 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 158 { 159 struct sk_buff *skb; 160 int err; 161 162 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 163 if (IS_ERR(skb)) { 164 err = PTR_ERR(skb); 165 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 166 err); 167 return err; 168 } 169 kfree_skb(skb); 170 171 return 0; 172 } 173 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 174 175 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 176 { 177 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 178 struct sk_buff *skb; 179 int err; 180 181 if (debug) 182 mask[1] |= 0x62; 183 184 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 185 if (IS_ERR(skb)) { 186 err = PTR_ERR(skb); 187 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 188 return err; 189 } 190 kfree_skb(skb); 191 192 return 0; 193 } 194 195 int btintel_set_diag(struct hci_dev *hdev, bool enable) 196 { 197 struct sk_buff *skb; 198 u8 param[3]; 199 int err; 200 201 if (enable) { 202 param[0] = 0x03; 203 param[1] = 0x03; 204 param[2] = 0x03; 205 } else { 206 param[0] = 0x00; 207 param[1] = 0x00; 208 param[2] = 0x00; 209 } 210 211 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 212 if (IS_ERR(skb)) { 213 err = PTR_ERR(skb); 214 if (err == -ENODATA) 215 goto done; 216 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 217 err); 218 return err; 219 } 220 kfree_skb(skb); 221 222 done: 223 btintel_set_event_mask(hdev, enable); 224 return 0; 225 } 226 EXPORT_SYMBOL_GPL(btintel_set_diag); 227 228 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 229 { 230 int err, ret; 231 232 err = btintel_enter_mfg(hdev); 233 if (err) 234 return err; 235 236 ret = btintel_set_diag(hdev, enable); 237 238 err = btintel_exit_mfg(hdev, false, false); 239 if (err) 240 return err; 241 242 return ret; 243 } 244 245 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 246 { 247 int ret; 248 249 /* Legacy ROM device needs to be in the manufacturer mode to apply 250 * diagnostic setting 251 * 252 * This flag is set after reading the Intel version. 253 */ 254 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 255 ret = btintel_set_diag_mfg(hdev, enable); 256 else 257 ret = btintel_set_diag(hdev, enable); 258 259 return ret; 260 } 261 262 void btintel_hw_error(struct hci_dev *hdev, u8 code) 263 { 264 struct sk_buff *skb; 265 u8 type = 0x00; 266 267 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 268 269 hci_req_sync_lock(hdev); 270 271 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 272 if (IS_ERR(skb)) { 273 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 274 PTR_ERR(skb)); 275 goto unlock; 276 } 277 kfree_skb(skb); 278 279 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 280 if (IS_ERR(skb)) { 281 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 282 PTR_ERR(skb)); 283 goto unlock; 284 } 285 286 if (skb->len != 13) { 287 bt_dev_err(hdev, "Exception info size mismatch"); 288 kfree_skb(skb); 289 goto unlock; 290 } 291 292 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 293 294 kfree_skb(skb); 295 296 unlock: 297 hci_req_sync_unlock(hdev); 298 } 299 EXPORT_SYMBOL_GPL(btintel_hw_error); 300 301 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 302 { 303 const char *variant; 304 305 /* The hardware platform number has a fixed value of 0x37 and 306 * for now only accept this single value. 307 */ 308 if (ver->hw_platform != 0x37) { 309 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 310 ver->hw_platform); 311 return -EINVAL; 312 } 313 314 /* Check for supported iBT hardware variants of this firmware 315 * loading method. 316 * 317 * This check has been put in place to ensure correct forward 318 * compatibility options when newer hardware variants come along. 319 */ 320 switch (ver->hw_variant) { 321 case 0x07: /* WP - Legacy ROM */ 322 case 0x08: /* StP - Legacy ROM */ 323 case 0x0b: /* SfP */ 324 case 0x0c: /* WsP */ 325 case 0x11: /* JfP */ 326 case 0x12: /* ThP */ 327 case 0x13: /* HrP */ 328 case 0x14: /* CcP */ 329 break; 330 default: 331 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 332 ver->hw_variant); 333 return -EINVAL; 334 } 335 336 switch (ver->fw_variant) { 337 case 0x01: 338 variant = "Legacy ROM 2.5"; 339 break; 340 case 0x06: 341 variant = "Bootloader"; 342 break; 343 case 0x22: 344 variant = "Legacy ROM 2.x"; 345 break; 346 case 0x23: 347 variant = "Firmware"; 348 break; 349 default: 350 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 351 return -EINVAL; 352 } 353 354 coredump_info.hw_variant = ver->hw_variant; 355 coredump_info.fw_build_num = ver->fw_build_num; 356 357 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 358 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 359 ver->fw_build_num, ver->fw_build_ww, 360 2000 + ver->fw_build_yy); 361 362 return 0; 363 } 364 EXPORT_SYMBOL_GPL(btintel_version_info); 365 366 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 367 const void *param) 368 { 369 while (plen > 0) { 370 struct sk_buff *skb; 371 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 372 373 cmd_param[0] = fragment_type; 374 memcpy(cmd_param + 1, param, fragment_len); 375 376 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 377 cmd_param, HCI_INIT_TIMEOUT); 378 if (IS_ERR(skb)) 379 return PTR_ERR(skb); 380 381 kfree_skb(skb); 382 383 plen -= fragment_len; 384 param += fragment_len; 385 } 386 387 return 0; 388 } 389 390 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 391 { 392 const struct firmware *fw; 393 struct sk_buff *skb; 394 const u8 *fw_ptr; 395 int err; 396 397 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 398 if (err < 0) { 399 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 400 ddc_name, err); 401 return err; 402 } 403 404 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 405 406 fw_ptr = fw->data; 407 408 /* DDC file contains one or more DDC structure which has 409 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 410 */ 411 while (fw->size > fw_ptr - fw->data) { 412 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 413 414 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 415 HCI_INIT_TIMEOUT); 416 if (IS_ERR(skb)) { 417 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 418 PTR_ERR(skb)); 419 release_firmware(fw); 420 return PTR_ERR(skb); 421 } 422 423 fw_ptr += cmd_plen; 424 kfree_skb(skb); 425 } 426 427 release_firmware(fw); 428 429 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 430 431 return 0; 432 } 433 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 434 435 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 436 { 437 int err, ret; 438 439 err = btintel_enter_mfg(hdev); 440 if (err) 441 return err; 442 443 ret = btintel_set_event_mask(hdev, debug); 444 445 err = btintel_exit_mfg(hdev, false, false); 446 if (err) 447 return err; 448 449 return ret; 450 } 451 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 452 453 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 454 { 455 struct sk_buff *skb; 456 457 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 458 if (IS_ERR(skb)) { 459 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 460 PTR_ERR(skb)); 461 return PTR_ERR(skb); 462 } 463 464 if (!skb || skb->len != sizeof(*ver)) { 465 bt_dev_err(hdev, "Intel version event size mismatch"); 466 kfree_skb(skb); 467 return -EILSEQ; 468 } 469 470 memcpy(ver, skb->data, sizeof(*ver)); 471 472 kfree_skb(skb); 473 474 return 0; 475 } 476 EXPORT_SYMBOL_GPL(btintel_read_version); 477 478 int btintel_version_info_tlv(struct hci_dev *hdev, 479 struct intel_version_tlv *version) 480 { 481 const char *variant; 482 483 /* The hardware platform number has a fixed value of 0x37 and 484 * for now only accept this single value. 485 */ 486 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 487 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 488 INTEL_HW_PLATFORM(version->cnvi_bt)); 489 return -EINVAL; 490 } 491 492 /* Check for supported iBT hardware variants of this firmware 493 * loading method. 494 * 495 * This check has been put in place to ensure correct forward 496 * compatibility options when newer hardware variants come along. 497 */ 498 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 499 case 0x17: /* TyP */ 500 case 0x18: /* Slr */ 501 case 0x19: /* Slr-F */ 502 case 0x1b: /* Mgr */ 503 case 0x1c: /* Gale Peak (GaP) */ 504 case 0x1d: /* BlazarU (BzrU) */ 505 case 0x1e: /* BlazarI (Bzr) */ 506 case 0x1f: /* Scorpious Peak */ 507 case 0x20: /* Scorpious Peak2 */ 508 case 0x21: /* Scorpious Peak2 F */ 509 case 0x22: /* BlazarIW (BzrIW) */ 510 break; 511 default: 512 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 513 INTEL_HW_VARIANT(version->cnvi_bt)); 514 return -EINVAL; 515 } 516 517 switch (version->img_type) { 518 case BTINTEL_IMG_BOOTLOADER: 519 variant = "Bootloader"; 520 /* It is required that every single firmware fragment is acknowledged 521 * with a command complete event. If the boot parameters indicate 522 * that this bootloader does not send them, then abort the setup. 523 */ 524 if (version->limited_cce != 0x00) { 525 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 526 version->limited_cce); 527 return -EINVAL; 528 } 529 530 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 531 if (version->sbe_type > 0x03) { 532 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 533 version->sbe_type); 534 return -EINVAL; 535 } 536 537 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 538 bt_dev_info(hdev, "Secure boot is %s", 539 str_enabled_disabled(version->secure_boot)); 540 bt_dev_info(hdev, "OTP lock is %s", 541 str_enabled_disabled(version->otp_lock)); 542 bt_dev_info(hdev, "API lock is %s", 543 str_enabled_disabled(version->api_lock)); 544 bt_dev_info(hdev, "Debug lock is %s", 545 str_enabled_disabled(version->debug_lock)); 546 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 547 version->min_fw_build_nn, version->min_fw_build_cw, 548 2000 + version->min_fw_build_yy); 549 break; 550 case BTINTEL_IMG_IML: 551 variant = "Intermediate loader"; 552 break; 553 case BTINTEL_IMG_OP: 554 variant = "Firmware"; 555 break; 556 default: 557 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 558 return -EINVAL; 559 } 560 561 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 562 coredump_info.fw_build_num = version->build_num; 563 564 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 565 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 566 version->build_type, version->build_num); 567 if (version->img_type == BTINTEL_IMG_OP) 568 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 569 570 return 0; 571 } 572 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 573 574 static u8 btintel_version_tlv_min_len(u8 type) 575 { 576 switch (type) { 577 case INTEL_TLV_CNVI_TOP: 578 case INTEL_TLV_CNVR_TOP: 579 case INTEL_TLV_CNVI_BT: 580 case INTEL_TLV_CNVR_BT: 581 case INTEL_TLV_BUILD_NUM: 582 case INTEL_TLV_GIT_SHA1: 583 return sizeof(u32); 584 case INTEL_TLV_DEV_REV_ID: 585 case INTEL_TLV_TIME_STAMP: 586 return sizeof(u16); 587 case INTEL_TLV_IMAGE_TYPE: 588 case INTEL_TLV_BUILD_TYPE: 589 case INTEL_TLV_SECURE_BOOT: 590 case INTEL_TLV_OTP_LOCK: 591 case INTEL_TLV_API_LOCK: 592 case INTEL_TLV_DEBUG_LOCK: 593 case INTEL_TLV_LIMITED_CCE: 594 case INTEL_TLV_SBE_TYPE: 595 return sizeof(u8); 596 case INTEL_TLV_MIN_FW: 597 return 3; 598 case INTEL_TLV_OTP_BDADDR: 599 return sizeof(bdaddr_t); 600 default: 601 return 0; 602 } 603 } 604 605 int btintel_parse_version_tlv(struct hci_dev *hdev, 606 struct intel_version_tlv *version, 607 struct sk_buff *skb) 608 { 609 /* Consume Command Complete Status field */ 610 if (!skb_pull(skb, 1)) 611 return -EINVAL; 612 613 /* Event parameters contain multiple TLVs. Read each of them 614 * and only keep the required data. Also, it use existing legacy 615 * version field like hw_platform, hw_variant, and fw_variant 616 * to keep the existing setup flow 617 */ 618 while (skb->len) { 619 struct intel_tlv *tlv; 620 621 /* Make sure skb has a minimum length of the header */ 622 if (skb->len < sizeof(*tlv)) 623 return -EINVAL; 624 625 tlv = (struct intel_tlv *)skb->data; 626 627 /* Make sure skb has a enough data */ 628 if (skb->len < tlv->len + sizeof(*tlv)) 629 return -EINVAL; 630 631 if (tlv->len < btintel_version_tlv_min_len(tlv->type)) 632 return -EINVAL; 633 634 switch (tlv->type) { 635 case INTEL_TLV_CNVI_TOP: 636 version->cnvi_top = get_unaligned_le32(tlv->val); 637 break; 638 case INTEL_TLV_CNVR_TOP: 639 version->cnvr_top = get_unaligned_le32(tlv->val); 640 break; 641 case INTEL_TLV_CNVI_BT: 642 version->cnvi_bt = get_unaligned_le32(tlv->val); 643 break; 644 case INTEL_TLV_CNVR_BT: 645 version->cnvr_bt = get_unaligned_le32(tlv->val); 646 break; 647 case INTEL_TLV_DEV_REV_ID: 648 version->dev_rev_id = get_unaligned_le16(tlv->val); 649 break; 650 case INTEL_TLV_IMAGE_TYPE: 651 version->img_type = tlv->val[0]; 652 break; 653 case INTEL_TLV_TIME_STAMP: 654 /* If image type is Operational firmware (0x03), then 655 * running FW Calendar Week and Year information can 656 * be extracted from Timestamp information 657 */ 658 version->min_fw_build_cw = tlv->val[0]; 659 version->min_fw_build_yy = tlv->val[1]; 660 version->timestamp = get_unaligned_le16(tlv->val); 661 break; 662 case INTEL_TLV_BUILD_TYPE: 663 version->build_type = tlv->val[0]; 664 break; 665 case INTEL_TLV_BUILD_NUM: 666 /* If image type is Operational firmware (0x03), then 667 * running FW build number can be extracted from the 668 * Build information 669 */ 670 version->min_fw_build_nn = tlv->val[0]; 671 version->build_num = get_unaligned_le32(tlv->val); 672 break; 673 case INTEL_TLV_SECURE_BOOT: 674 version->secure_boot = tlv->val[0]; 675 break; 676 case INTEL_TLV_OTP_LOCK: 677 version->otp_lock = tlv->val[0]; 678 break; 679 case INTEL_TLV_API_LOCK: 680 version->api_lock = tlv->val[0]; 681 break; 682 case INTEL_TLV_DEBUG_LOCK: 683 version->debug_lock = tlv->val[0]; 684 break; 685 case INTEL_TLV_MIN_FW: 686 version->min_fw_build_nn = tlv->val[0]; 687 version->min_fw_build_cw = tlv->val[1]; 688 version->min_fw_build_yy = tlv->val[2]; 689 break; 690 case INTEL_TLV_LIMITED_CCE: 691 version->limited_cce = tlv->val[0]; 692 break; 693 case INTEL_TLV_SBE_TYPE: 694 version->sbe_type = tlv->val[0]; 695 break; 696 case INTEL_TLV_OTP_BDADDR: 697 memcpy(&version->otp_bd_addr, tlv->val, 698 sizeof(bdaddr_t)); 699 break; 700 case INTEL_TLV_GIT_SHA1: 701 version->git_sha1 = get_unaligned_le32(tlv->val); 702 break; 703 case INTEL_TLV_FW_ID: 704 snprintf(version->fw_id, sizeof(version->fw_id), 705 "%.*s", tlv->len, tlv->val); 706 break; 707 default: 708 /* Ignore rest of information */ 709 break; 710 } 711 /* consume the current tlv and move to next*/ 712 skb_pull(skb, tlv->len + sizeof(*tlv)); 713 } 714 715 return 0; 716 } 717 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 718 719 static int btintel_read_version_tlv(struct hci_dev *hdev, 720 struct intel_version_tlv *version) 721 { 722 struct sk_buff *skb; 723 const u8 param[1] = { 0xFF }; 724 int err; 725 726 if (!version) 727 return -EINVAL; 728 729 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 730 if (IS_ERR(skb)) { 731 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 732 PTR_ERR(skb)); 733 return PTR_ERR(skb); 734 } 735 736 if (skb->data[0]) { 737 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 738 skb->data[0]); 739 kfree_skb(skb); 740 return -EIO; 741 } 742 743 err = btintel_parse_version_tlv(hdev, version, skb); 744 745 kfree_skb(skb); 746 return err; 747 } 748 749 /* ------- REGMAP IBT SUPPORT ------- */ 750 751 #define IBT_REG_MODE_8BIT 0x00 752 #define IBT_REG_MODE_16BIT 0x01 753 #define IBT_REG_MODE_32BIT 0x02 754 755 struct regmap_ibt_context { 756 struct hci_dev *hdev; 757 __u16 op_write; 758 __u16 op_read; 759 }; 760 761 struct ibt_cp_reg_access { 762 __le32 addr; 763 __u8 mode; 764 __u8 len; 765 __u8 data[]; 766 } __packed; 767 768 struct ibt_rp_reg_access { 769 __u8 status; 770 __le32 addr; 771 __u8 data[]; 772 } __packed; 773 774 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 775 void *val, size_t val_size) 776 { 777 struct regmap_ibt_context *ctx = context; 778 struct ibt_cp_reg_access cp; 779 struct ibt_rp_reg_access *rp; 780 struct sk_buff *skb; 781 int err = 0; 782 783 if (reg_size != sizeof(__le32)) 784 return -EINVAL; 785 786 switch (val_size) { 787 case 1: 788 cp.mode = IBT_REG_MODE_8BIT; 789 break; 790 case 2: 791 cp.mode = IBT_REG_MODE_16BIT; 792 break; 793 case 4: 794 cp.mode = IBT_REG_MODE_32BIT; 795 break; 796 default: 797 return -EINVAL; 798 } 799 800 /* regmap provides a little-endian formatted addr */ 801 cp.addr = *(__le32 *)addr; 802 cp.len = val_size; 803 804 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 805 806 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 807 HCI_CMD_TIMEOUT); 808 if (IS_ERR(skb)) { 809 err = PTR_ERR(skb); 810 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 811 le32_to_cpu(cp.addr), err); 812 return err; 813 } 814 815 if (skb->len != sizeof(*rp) + val_size) { 816 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 817 le32_to_cpu(cp.addr)); 818 err = -EINVAL; 819 goto done; 820 } 821 822 rp = (struct ibt_rp_reg_access *)skb->data; 823 824 if (rp->addr != cp.addr) { 825 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 826 le32_to_cpu(rp->addr)); 827 err = -EINVAL; 828 goto done; 829 } 830 831 memcpy(val, rp->data, val_size); 832 833 done: 834 kfree_skb(skb); 835 return err; 836 } 837 838 static int regmap_ibt_gather_write(void *context, 839 const void *addr, size_t reg_size, 840 const void *val, size_t val_size) 841 { 842 struct regmap_ibt_context *ctx = context; 843 struct ibt_cp_reg_access *cp; 844 struct sk_buff *skb; 845 int plen = sizeof(*cp) + val_size; 846 u8 mode; 847 int err = 0; 848 849 if (reg_size != sizeof(__le32)) 850 return -EINVAL; 851 852 switch (val_size) { 853 case 1: 854 mode = IBT_REG_MODE_8BIT; 855 break; 856 case 2: 857 mode = IBT_REG_MODE_16BIT; 858 break; 859 case 4: 860 mode = IBT_REG_MODE_32BIT; 861 break; 862 default: 863 return -EINVAL; 864 } 865 866 cp = kmalloc(plen, GFP_KERNEL); 867 if (!cp) 868 return -ENOMEM; 869 870 /* regmap provides a little-endian formatted addr/value */ 871 cp->addr = *(__le32 *)addr; 872 cp->mode = mode; 873 cp->len = val_size; 874 memcpy(&cp->data, val, val_size); 875 876 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 877 878 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 879 if (IS_ERR(skb)) { 880 err = PTR_ERR(skb); 881 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 882 le32_to_cpu(cp->addr), err); 883 goto done; 884 } 885 kfree_skb(skb); 886 887 done: 888 kfree(cp); 889 return err; 890 } 891 892 static int regmap_ibt_write(void *context, const void *data, size_t count) 893 { 894 /* data contains register+value, since we only support 32bit addr, 895 * minimum data size is 4 bytes. 896 */ 897 if (WARN_ONCE(count < 4, "Invalid register access")) 898 return -EINVAL; 899 900 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 901 } 902 903 static void regmap_ibt_free_context(void *context) 904 { 905 kfree(context); 906 } 907 908 static const struct regmap_bus regmap_ibt = { 909 .read = regmap_ibt_read, 910 .write = regmap_ibt_write, 911 .gather_write = regmap_ibt_gather_write, 912 .free_context = regmap_ibt_free_context, 913 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 914 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 915 }; 916 917 /* Config is the same for all register regions */ 918 static const struct regmap_config regmap_ibt_cfg = { 919 .name = "btintel_regmap", 920 .reg_bits = 32, 921 .val_bits = 32, 922 }; 923 924 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 925 u16 opcode_write) 926 { 927 struct regmap_ibt_context *ctx; 928 929 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 930 opcode_write); 931 932 ctx = kzalloc_obj(*ctx); 933 if (!ctx) 934 return ERR_PTR(-ENOMEM); 935 936 ctx->op_read = opcode_read; 937 ctx->op_write = opcode_write; 938 ctx->hdev = hdev; 939 940 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 941 } 942 EXPORT_SYMBOL_GPL(btintel_regmap_init); 943 944 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 945 { 946 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 947 struct sk_buff *skb; 948 949 params.boot_param = cpu_to_le32(boot_param); 950 951 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 952 HCI_INIT_TIMEOUT); 953 if (IS_ERR(skb)) { 954 bt_dev_err(hdev, "Failed to send Intel Reset command"); 955 return PTR_ERR(skb); 956 } 957 958 kfree_skb(skb); 959 960 return 0; 961 } 962 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 963 964 int btintel_read_boot_params(struct hci_dev *hdev, 965 struct intel_boot_params *params) 966 { 967 struct sk_buff *skb; 968 969 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 970 if (IS_ERR(skb)) { 971 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 972 PTR_ERR(skb)); 973 return PTR_ERR(skb); 974 } 975 976 if (skb->len != sizeof(*params)) { 977 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 978 kfree_skb(skb); 979 return -EILSEQ; 980 } 981 982 memcpy(params, skb->data, sizeof(*params)); 983 984 kfree_skb(skb); 985 986 if (params->status) { 987 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 988 params->status); 989 return -bt_to_errno(params->status); 990 } 991 992 bt_dev_info(hdev, "Device revision is %u", 993 le16_to_cpu(params->dev_revid)); 994 995 bt_dev_info(hdev, "Secure boot is %s", 996 str_enabled_disabled(params->secure_boot)); 997 998 bt_dev_info(hdev, "OTP lock is %s", 999 str_enabled_disabled(params->otp_lock)); 1000 1001 bt_dev_info(hdev, "API lock is %s", 1002 str_enabled_disabled(params->api_lock)); 1003 1004 bt_dev_info(hdev, "Debug lock is %s", 1005 str_enabled_disabled(params->debug_lock)); 1006 1007 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 1008 params->min_fw_build_nn, params->min_fw_build_cw, 1009 2000 + params->min_fw_build_yy); 1010 1011 return 0; 1012 } 1013 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 1014 1015 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 1016 const struct firmware *fw) 1017 { 1018 int err; 1019 1020 /* Start the firmware download transaction with the Init fragment 1021 * represented by the 128 bytes of CSS header. 1022 */ 1023 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 1024 if (err < 0) { 1025 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1026 goto done; 1027 } 1028 1029 /* Send the 256 bytes of public key information from the firmware 1030 * as the PKey fragment. 1031 */ 1032 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 1033 if (err < 0) { 1034 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1035 goto done; 1036 } 1037 1038 /* Send the 256 bytes of signature information from the firmware 1039 * as the Sign fragment. 1040 */ 1041 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1042 if (err < 0) { 1043 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1044 goto done; 1045 } 1046 1047 done: 1048 return err; 1049 } 1050 1051 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1052 const struct firmware *fw) 1053 { 1054 int err; 1055 1056 /* Start the firmware download transaction with the Init fragment 1057 * represented by the 128 bytes of CSS header. 1058 */ 1059 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1060 if (err < 0) { 1061 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1062 return err; 1063 } 1064 1065 /* Send the 96 bytes of public key information from the firmware 1066 * as the PKey fragment. 1067 */ 1068 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1069 if (err < 0) { 1070 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1071 return err; 1072 } 1073 1074 /* Send the 96 bytes of signature information from the firmware 1075 * as the Sign fragment 1076 */ 1077 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1078 if (err < 0) { 1079 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1080 err); 1081 return err; 1082 } 1083 return 0; 1084 } 1085 1086 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1087 const struct firmware *fw) 1088 { 1089 int err; 1090 1091 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1092 if (err < 0) { 1093 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1094 return err; 1095 } 1096 1097 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1098 fw->data + BTINTEL_ECDSA_OFFSET); 1099 if (err < 0) { 1100 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1101 return err; 1102 } 1103 1104 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1105 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1106 if (err < 0) { 1107 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1108 return err; 1109 } 1110 1111 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1112 fw->data + BTINTEL_LMS_OFFSET); 1113 if (err < 0) { 1114 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1115 return err; 1116 } 1117 1118 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1119 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1120 if (err < 0) { 1121 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1122 return err; 1123 } 1124 1125 return 0; 1126 } 1127 1128 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1129 const struct firmware *fw, 1130 size_t offset) 1131 { 1132 int err; 1133 const u8 *fw_ptr; 1134 u32 frag_len; 1135 1136 fw_ptr = fw->data + offset; 1137 frag_len = 0; 1138 err = -EINVAL; 1139 1140 while (fw_ptr - fw->data < fw->size) { 1141 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1142 1143 frag_len += sizeof(*cmd) + cmd->plen; 1144 1145 /* The parameter length of the secure send command requires 1146 * a 4 byte alignment. It happens so that the firmware file 1147 * contains proper Intel_NOP commands to align the fragments 1148 * as needed. 1149 * 1150 * Send set of commands with 4 byte alignment from the 1151 * firmware data buffer as a single Data fragment. 1152 */ 1153 if (!(frag_len % 4)) { 1154 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1155 if (err < 0) { 1156 bt_dev_err(hdev, 1157 "Failed to send firmware data (%d)", 1158 err); 1159 goto done; 1160 } 1161 1162 fw_ptr += frag_len; 1163 frag_len = 0; 1164 } 1165 } 1166 1167 done: 1168 return err; 1169 } 1170 1171 static bool btintel_firmware_version(struct hci_dev *hdev, 1172 u8 num, u8 ww, u8 yy, 1173 const struct firmware *fw, 1174 u32 *boot_addr) 1175 { 1176 const u8 *fw_ptr; 1177 1178 fw_ptr = fw->data; 1179 1180 while (fw_ptr - fw->data < fw->size) { 1181 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1182 1183 /* Each SKU has a different reset parameter to use in the 1184 * HCI_Intel_Reset command and it is embedded in the firmware 1185 * data. So, instead of using static value per SKU, check 1186 * the firmware data and save it for later use. 1187 */ 1188 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1189 struct cmd_write_boot_params *params; 1190 1191 params = (void *)(fw_ptr + sizeof(*cmd)); 1192 1193 *boot_addr = le32_to_cpu(params->boot_addr); 1194 1195 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1196 1197 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1198 params->fw_build_num, params->fw_build_ww, 1199 params->fw_build_yy); 1200 1201 return (num == params->fw_build_num && 1202 ww == params->fw_build_ww && 1203 yy == params->fw_build_yy); 1204 } 1205 1206 fw_ptr += sizeof(*cmd) + cmd->plen; 1207 } 1208 1209 return false; 1210 } 1211 1212 int btintel_download_firmware(struct hci_dev *hdev, 1213 struct intel_version *ver, 1214 const struct firmware *fw, 1215 u32 *boot_param) 1216 { 1217 int err; 1218 1219 /* SfP and WsP don't seem to update the firmware version on file 1220 * so version checking is currently not possible. 1221 */ 1222 switch (ver->hw_variant) { 1223 case 0x0b: /* SfP */ 1224 case 0x0c: /* WsP */ 1225 /* Skip version checking */ 1226 break; 1227 default: 1228 1229 /* Skip download if firmware has the same version */ 1230 if (btintel_firmware_version(hdev, ver->fw_build_num, 1231 ver->fw_build_ww, ver->fw_build_yy, 1232 fw, boot_param)) { 1233 bt_dev_info(hdev, "Firmware already loaded"); 1234 /* Return -EALREADY to indicate that the firmware has 1235 * already been loaded. 1236 */ 1237 return -EALREADY; 1238 } 1239 } 1240 1241 /* The firmware variant determines if the device is in bootloader 1242 * mode or is running operational firmware. The value 0x06 identifies 1243 * the bootloader and the value 0x23 identifies the operational 1244 * firmware. 1245 * 1246 * If the firmware version has changed that means it needs to be reset 1247 * to bootloader when operational so the new firmware can be loaded. 1248 */ 1249 if (ver->fw_variant == 0x23) 1250 return -EINVAL; 1251 1252 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1253 if (err) 1254 return err; 1255 1256 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1257 } 1258 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1259 1260 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1261 struct intel_version_tlv *ver, 1262 const struct firmware *fw, u32 *boot_param, 1263 u8 hw_variant, u8 sbe_type) 1264 { 1265 int err; 1266 u32 css_header_ver; 1267 1268 /* Skip download if firmware has the same version */ 1269 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1270 ver->min_fw_build_cw, 1271 ver->min_fw_build_yy, 1272 fw, boot_param)) { 1273 bt_dev_info(hdev, "Firmware already loaded"); 1274 /* Return -EALREADY to indicate that firmware has 1275 * already been loaded. 1276 */ 1277 return -EALREADY; 1278 } 1279 1280 /* The firmware variant determines if the device is in bootloader 1281 * mode or is running operational firmware. The value 0x01 identifies 1282 * the bootloader and the value 0x03 identifies the operational 1283 * firmware. 1284 * 1285 * If the firmware version has changed that means it needs to be reset 1286 * to bootloader when operational so the new firmware can be loaded. 1287 */ 1288 if (ver->img_type == BTINTEL_IMG_OP) 1289 return -EINVAL; 1290 1291 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1292 * only RSA secure boot engine. Hence, the corresponding sfi file will 1293 * have RSA header of 644 bytes followed by Command Buffer. 1294 * 1295 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1296 * secure boot engine. As a result, the corresponding sfi file will 1297 * have RSA header of 644, ECDSA header of 320 bytes followed by 1298 * Command Buffer. 1299 * 1300 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1301 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1302 */ 1303 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1304 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1305 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1306 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1307 return -EINVAL; 1308 } 1309 1310 if (hw_variant <= 0x14) { 1311 if (sbe_type != 0x00) { 1312 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1313 hw_variant); 1314 return -EINVAL; 1315 } 1316 1317 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1318 if (err) 1319 return err; 1320 1321 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1322 if (err) 1323 return err; 1324 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1325 /* Check if CSS header for ECDSA follows the RSA header */ 1326 if (fw->data[ECDSA_OFFSET] != 0x06) 1327 return -EINVAL; 1328 1329 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1330 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1331 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1332 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1333 return -EINVAL; 1334 } 1335 1336 if (sbe_type == 0x00) { 1337 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1338 if (err) 1339 return err; 1340 1341 err = btintel_download_firmware_payload(hdev, fw, 1342 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1343 if (err) 1344 return err; 1345 } else if (sbe_type == 0x01) { 1346 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1347 if (err) 1348 return err; 1349 1350 err = btintel_download_firmware_payload(hdev, fw, 1351 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1352 if (err) 1353 return err; 1354 } 1355 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1356 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1357 if (err) 1358 return err; 1359 1360 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1361 if (err) 1362 return err; 1363 } 1364 return 0; 1365 } 1366 1367 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1368 { 1369 struct intel_reset params; 1370 struct sk_buff *skb; 1371 1372 /* PCIe transport uses shared hardware reset mechanism for recovery 1373 * which gets triggered in pcie *setup* function on error. 1374 */ 1375 if (hdev->bus == HCI_PCI) 1376 return; 1377 1378 /* Send Intel Reset command. This will result in 1379 * re-enumeration of BT controller. 1380 * 1381 * Intel Reset parameter description: 1382 * reset_type : 0x00 (Soft reset), 1383 * 0x01 (Hard reset) 1384 * patch_enable : 0x00 (Do not enable), 1385 * 0x01 (Enable) 1386 * ddc_reload : 0x00 (Do not reload), 1387 * 0x01 (Reload) 1388 * boot_option: 0x00 (Current image), 1389 * 0x01 (Specified boot address) 1390 * boot_param: Boot address 1391 * 1392 */ 1393 1394 params.reset_type = 0x01; 1395 params.patch_enable = 0x01; 1396 params.ddc_reload = 0x01; 1397 params.boot_option = 0x00; 1398 params.boot_param = cpu_to_le32(0x00000000); 1399 1400 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1401 ¶ms, HCI_INIT_TIMEOUT); 1402 if (IS_ERR(skb)) { 1403 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1404 PTR_ERR(skb)); 1405 return; 1406 } 1407 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1408 kfree_skb(skb); 1409 1410 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1411 * lines for 2ms when it receives Intel Reset in bootloader mode. 1412 * Whereas, the upcoming Intel BT controllers will hold USB reset 1413 * for 150ms. To keep the delay generic, 150ms is chosen here. 1414 */ 1415 msleep(150); 1416 } 1417 1418 static int btintel_read_debug_features(struct hci_dev *hdev, 1419 struct intel_debug_features *features) 1420 { 1421 struct sk_buff *skb; 1422 u8 page_no = 1; 1423 1424 /* Intel controller supports two pages, each page is of 128-bit 1425 * feature bit mask. And each bit defines specific feature support 1426 */ 1427 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1428 HCI_INIT_TIMEOUT); 1429 if (IS_ERR(skb)) { 1430 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1431 PTR_ERR(skb)); 1432 return PTR_ERR(skb); 1433 } 1434 1435 if (skb->len != (sizeof(features->page1) + 3)) { 1436 bt_dev_err(hdev, "Supported features event size mismatch"); 1437 kfree_skb(skb); 1438 return -EILSEQ; 1439 } 1440 1441 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1442 1443 /* Read the supported features page2 if required in future. 1444 */ 1445 kfree_skb(skb); 1446 return 0; 1447 } 1448 1449 static int btintel_set_debug_features(struct hci_dev *hdev, 1450 const struct intel_debug_features *features) 1451 { 1452 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1453 0x00, 0x00, 0x00 }; 1454 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1455 u8 trace_enable = 0x02; 1456 struct sk_buff *skb; 1457 1458 if (!features) { 1459 bt_dev_warn(hdev, "Debug features not read"); 1460 return -EINVAL; 1461 } 1462 1463 if (!(features->page1[0] & 0x3f)) { 1464 bt_dev_info(hdev, "Telemetry exception format not supported"); 1465 return 0; 1466 } 1467 1468 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1469 if (IS_ERR(skb)) { 1470 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1471 PTR_ERR(skb)); 1472 return PTR_ERR(skb); 1473 } 1474 kfree_skb(skb); 1475 1476 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1477 if (IS_ERR(skb)) { 1478 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1479 PTR_ERR(skb)); 1480 return PTR_ERR(skb); 1481 } 1482 kfree_skb(skb); 1483 1484 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1485 if (IS_ERR(skb)) { 1486 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1487 PTR_ERR(skb)); 1488 return PTR_ERR(skb); 1489 } 1490 kfree_skb(skb); 1491 1492 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1493 trace_enable, mask[3]); 1494 1495 return 0; 1496 } 1497 1498 static int btintel_reset_debug_features(struct hci_dev *hdev, 1499 const struct intel_debug_features *features) 1500 { 1501 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1502 0x00, 0x00, 0x00 }; 1503 u8 trace_enable = 0x00; 1504 struct sk_buff *skb; 1505 1506 if (!features) { 1507 bt_dev_warn(hdev, "Debug features not read"); 1508 return -EINVAL; 1509 } 1510 1511 if (!(features->page1[0] & 0x3f)) { 1512 bt_dev_info(hdev, "Telemetry exception format not supported"); 1513 return 0; 1514 } 1515 1516 /* Should stop the trace before writing ddc event mask. */ 1517 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1518 if (IS_ERR(skb)) { 1519 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1520 PTR_ERR(skb)); 1521 return PTR_ERR(skb); 1522 } 1523 kfree_skb(skb); 1524 1525 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1526 if (IS_ERR(skb)) { 1527 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1528 PTR_ERR(skb)); 1529 return PTR_ERR(skb); 1530 } 1531 kfree_skb(skb); 1532 1533 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1534 trace_enable, mask[3]); 1535 1536 return 0; 1537 } 1538 1539 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1540 { 1541 struct intel_debug_features features; 1542 int err; 1543 1544 bt_dev_dbg(hdev, "enable %d", enable); 1545 1546 /* Read the Intel supported features and if new exception formats 1547 * supported, need to load the additional DDC config to enable. 1548 */ 1549 err = btintel_read_debug_features(hdev, &features); 1550 if (err) 1551 return err; 1552 1553 /* Set or reset the debug features. */ 1554 if (enable) 1555 err = btintel_set_debug_features(hdev, &features); 1556 else 1557 err = btintel_reset_debug_features(hdev, &features); 1558 1559 return err; 1560 } 1561 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1562 1563 static void btintel_coredump(struct hci_dev *hdev) 1564 { 1565 struct sk_buff *skb; 1566 1567 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1568 if (IS_ERR(skb)) { 1569 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1570 return; 1571 } 1572 1573 kfree_skb(skb); 1574 } 1575 1576 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1577 { 1578 char buf[80]; 1579 1580 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1581 coredump_info.hw_variant); 1582 skb_put_data(skb, buf, strlen(buf)); 1583 1584 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1585 coredump_info.fw_build_num); 1586 skb_put_data(skb, buf, strlen(buf)); 1587 1588 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1589 skb_put_data(skb, buf, strlen(buf)); 1590 1591 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1592 skb_put_data(skb, buf, strlen(buf)); 1593 } 1594 1595 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1596 { 1597 struct intel_debug_features features; 1598 int err; 1599 1600 err = btintel_read_debug_features(hdev, &features); 1601 if (err) { 1602 bt_dev_info(hdev, "Error reading debug features"); 1603 return err; 1604 } 1605 1606 if (!(features.page1[0] & 0x3f)) { 1607 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1608 return -EOPNOTSUPP; 1609 } 1610 1611 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1612 1613 return err; 1614 } 1615 1616 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1617 struct intel_version *ver) 1618 { 1619 const struct firmware *fw; 1620 char fwname[64]; 1621 int ret; 1622 1623 snprintf(fwname, sizeof(fwname), 1624 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1625 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1626 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1627 ver->fw_build_ww, ver->fw_build_yy); 1628 1629 ret = request_firmware(&fw, fwname, &hdev->dev); 1630 if (ret < 0) { 1631 if (ret == -EINVAL) { 1632 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1633 ret); 1634 return NULL; 1635 } 1636 1637 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1638 fwname, ret); 1639 1640 /* If the correct firmware patch file is not found, use the 1641 * default firmware patch file instead 1642 */ 1643 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1644 ver->hw_platform, ver->hw_variant); 1645 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1646 bt_dev_err(hdev, "failed to open default fw file: %s", 1647 fwname); 1648 return NULL; 1649 } 1650 } 1651 1652 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1653 1654 return fw; 1655 } 1656 1657 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1658 const struct firmware *fw, 1659 const u8 **fw_ptr, int *disable_patch) 1660 { 1661 struct sk_buff *skb; 1662 struct hci_command_hdr *cmd; 1663 const u8 *cmd_param; 1664 struct hci_event_hdr *evt = NULL; 1665 const u8 *evt_param = NULL; 1666 int remain = fw->size - (*fw_ptr - fw->data); 1667 1668 /* The first byte indicates the types of the patch command or event. 1669 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1670 * in the current firmware buffer doesn't start with 0x01 or 1671 * the size of remain buffer is smaller than HCI command header, 1672 * the firmware file is corrupted and it should stop the patching 1673 * process. 1674 */ 1675 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1676 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1677 return -EINVAL; 1678 } 1679 (*fw_ptr)++; 1680 remain--; 1681 1682 cmd = (struct hci_command_hdr *)(*fw_ptr); 1683 *fw_ptr += sizeof(*cmd); 1684 remain -= sizeof(*cmd); 1685 1686 /* Ensure that the remain firmware data is long enough than the length 1687 * of command parameter. If not, the firmware file is corrupted. 1688 */ 1689 if (remain < cmd->plen) { 1690 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1691 return -EFAULT; 1692 } 1693 1694 /* If there is a command that loads a patch in the firmware 1695 * file, then enable the patch upon success, otherwise just 1696 * disable the manufacturer mode, for example patch activation 1697 * is not required when the default firmware patch file is used 1698 * because there are no patch data to load. 1699 */ 1700 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1701 *disable_patch = 0; 1702 1703 cmd_param = *fw_ptr; 1704 *fw_ptr += cmd->plen; 1705 remain -= cmd->plen; 1706 1707 /* This reads the expected events when the above command is sent to the 1708 * device. Some vendor commands expects more than one events, for 1709 * example command status event followed by vendor specific event. 1710 * For this case, it only keeps the last expected event. so the command 1711 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1712 * last expected event. 1713 */ 1714 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1715 (*fw_ptr)++; 1716 remain--; 1717 1718 evt = (struct hci_event_hdr *)(*fw_ptr); 1719 *fw_ptr += sizeof(*evt); 1720 remain -= sizeof(*evt); 1721 1722 if (remain < evt->plen) { 1723 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1724 return -EFAULT; 1725 } 1726 1727 evt_param = *fw_ptr; 1728 *fw_ptr += evt->plen; 1729 remain -= evt->plen; 1730 } 1731 1732 /* Every HCI commands in the firmware file has its correspond event. 1733 * If event is not found or remain is smaller than zero, the firmware 1734 * file is corrupted. 1735 */ 1736 if (!evt || !evt_param || remain < 0) { 1737 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1738 return -EFAULT; 1739 } 1740 1741 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1742 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1743 if (IS_ERR(skb)) { 1744 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1745 cmd->opcode, PTR_ERR(skb)); 1746 return PTR_ERR(skb); 1747 } 1748 1749 /* It ensures that the returned event matches the event data read from 1750 * the firmware file. At fist, it checks the length and then 1751 * the contents of the event. 1752 */ 1753 if (skb->len != evt->plen) { 1754 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1755 le16_to_cpu(cmd->opcode)); 1756 kfree_skb(skb); 1757 return -EFAULT; 1758 } 1759 1760 if (memcmp(skb->data, evt_param, evt->plen)) { 1761 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1762 le16_to_cpu(cmd->opcode)); 1763 kfree_skb(skb); 1764 return -EFAULT; 1765 } 1766 kfree_skb(skb); 1767 1768 return 0; 1769 } 1770 1771 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1772 struct intel_version *ver) 1773 { 1774 const struct firmware *fw; 1775 const u8 *fw_ptr; 1776 int disable_patch, err; 1777 struct intel_version new_ver; 1778 1779 BT_DBG("%s", hdev->name); 1780 1781 /* fw_patch_num indicates the version of patch the device currently 1782 * have. If there is no patch data in the device, it is always 0x00. 1783 * So, if it is other than 0x00, no need to patch the device again. 1784 */ 1785 if (ver->fw_patch_num) { 1786 bt_dev_info(hdev, 1787 "Intel device is already patched. patch num: %02x", 1788 ver->fw_patch_num); 1789 goto complete; 1790 } 1791 1792 /* Opens the firmware patch file based on the firmware version read 1793 * from the controller. If it fails to open the matching firmware 1794 * patch file, it tries to open the default firmware patch file. 1795 * If no patch file is found, allow the device to operate without 1796 * a patch. 1797 */ 1798 fw = btintel_legacy_rom_get_fw(hdev, ver); 1799 if (!fw) 1800 goto complete; 1801 fw_ptr = fw->data; 1802 1803 /* Enable the manufacturer mode of the controller. 1804 * Only while this mode is enabled, the driver can download the 1805 * firmware patch data and configuration parameters. 1806 */ 1807 err = btintel_enter_mfg(hdev); 1808 if (err) { 1809 release_firmware(fw); 1810 return err; 1811 } 1812 1813 disable_patch = 1; 1814 1815 /* The firmware data file consists of list of Intel specific HCI 1816 * commands and its expected events. The first byte indicates the 1817 * type of the message, either HCI command or HCI event. 1818 * 1819 * It reads the command and its expected event from the firmware file, 1820 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1821 * the returned event is compared with the event read from the firmware 1822 * file and it will continue until all the messages are downloaded to 1823 * the controller. 1824 * 1825 * Once the firmware patching is completed successfully, 1826 * the manufacturer mode is disabled with reset and activating the 1827 * downloaded patch. 1828 * 1829 * If the firmware patching fails, the manufacturer mode is 1830 * disabled with reset and deactivating the patch. 1831 * 1832 * If the default patch file is used, no reset is done when disabling 1833 * the manufacturer. 1834 */ 1835 while (fw->size > fw_ptr - fw->data) { 1836 int ret; 1837 1838 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1839 &disable_patch); 1840 if (ret < 0) 1841 goto exit_mfg_deactivate; 1842 } 1843 1844 release_firmware(fw); 1845 1846 if (disable_patch) 1847 goto exit_mfg_disable; 1848 1849 /* Patching completed successfully and disable the manufacturer mode 1850 * with reset and activate the downloaded firmware patches. 1851 */ 1852 err = btintel_exit_mfg(hdev, true, true); 1853 if (err) 1854 return err; 1855 1856 /* Need build number for downloaded fw patches in 1857 * every power-on boot 1858 */ 1859 err = btintel_read_version(hdev, &new_ver); 1860 if (err) 1861 return err; 1862 1863 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1864 new_ver.fw_patch_num); 1865 1866 goto complete; 1867 1868 exit_mfg_disable: 1869 /* Disable the manufacturer mode without reset */ 1870 err = btintel_exit_mfg(hdev, false, false); 1871 if (err) 1872 return err; 1873 1874 bt_dev_info(hdev, "Intel firmware patch completed"); 1875 1876 goto complete; 1877 1878 exit_mfg_deactivate: 1879 release_firmware(fw); 1880 1881 /* Patching failed. Disable the manufacturer mode with reset and 1882 * deactivate the downloaded firmware patches. 1883 */ 1884 err = btintel_exit_mfg(hdev, true, false); 1885 if (err) 1886 return err; 1887 1888 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1889 1890 complete: 1891 /* Set the event mask for Intel specific vendor events. This enables 1892 * a few extra events that are useful during general operation. 1893 */ 1894 btintel_set_event_mask_mfg(hdev, false); 1895 1896 btintel_check_bdaddr(hdev); 1897 1898 return 0; 1899 } 1900 1901 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1902 { 1903 ktime_t delta, rettime; 1904 unsigned long long duration; 1905 int err; 1906 1907 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1908 1909 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1910 1911 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1912 TASK_INTERRUPTIBLE, 1913 msecs_to_jiffies(msec)); 1914 if (err == -EINTR) { 1915 bt_dev_err(hdev, "Firmware loading interrupted"); 1916 return err; 1917 } 1918 1919 if (err) { 1920 bt_dev_err(hdev, "Firmware loading timeout"); 1921 return -ETIMEDOUT; 1922 } 1923 1924 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1925 bt_dev_err(hdev, "Firmware loading failed"); 1926 return -ENOEXEC; 1927 } 1928 1929 rettime = ktime_get(); 1930 delta = ktime_sub(rettime, calltime); 1931 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1932 1933 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1934 1935 return 0; 1936 } 1937 1938 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1939 { 1940 ktime_t delta, rettime; 1941 unsigned long long duration; 1942 int err; 1943 1944 bt_dev_info(hdev, "Waiting for device to boot"); 1945 1946 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1947 TASK_INTERRUPTIBLE, 1948 msecs_to_jiffies(msec)); 1949 if (err == -EINTR) { 1950 bt_dev_err(hdev, "Device boot interrupted"); 1951 return -EINTR; 1952 } 1953 1954 if (err) { 1955 bt_dev_err(hdev, "Device boot timeout"); 1956 return -ETIMEDOUT; 1957 } 1958 1959 rettime = ktime_get(); 1960 delta = ktime_sub(rettime, calltime); 1961 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1962 1963 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1964 1965 return 0; 1966 } 1967 1968 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1969 int msec) 1970 { 1971 ktime_t delta, rettime; 1972 unsigned long long duration; 1973 int err; 1974 1975 bt_dev_info(hdev, "Waiting for device transition to d0"); 1976 1977 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1978 TASK_INTERRUPTIBLE, 1979 msecs_to_jiffies(msec)); 1980 if (err == -EINTR) { 1981 bt_dev_err(hdev, "Device d0 move interrupted"); 1982 return -EINTR; 1983 } 1984 1985 if (err) { 1986 bt_dev_err(hdev, "Device d0 move timeout"); 1987 return -ETIMEDOUT; 1988 } 1989 1990 rettime = ktime_get(); 1991 delta = ktime_sub(rettime, calltime); 1992 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1993 1994 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 1995 1996 return 0; 1997 } 1998 1999 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 2000 { 2001 ktime_t calltime; 2002 int err; 2003 2004 calltime = ktime_get(); 2005 2006 btintel_set_flag(hdev, INTEL_BOOTING); 2007 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 2008 2009 err = btintel_send_intel_reset(hdev, boot_addr); 2010 if (err) { 2011 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 2012 btintel_reset_to_bootloader(hdev); 2013 return err; 2014 } 2015 2016 /* The bootloader will not indicate when the device is ready. This 2017 * is done by the operational firmware sending bootup notification. 2018 * 2019 * Booting into operational firmware should not take longer than 2020 * 5 second. However if that happens, then just fail the setup 2021 * since something went wrong. 2022 */ 2023 err = btintel_boot_wait(hdev, calltime, 5000); 2024 if (err == -ETIMEDOUT) { 2025 btintel_reset_to_bootloader(hdev); 2026 goto exit_error; 2027 } 2028 2029 if (hdev->bus == HCI_PCI) { 2030 /* In case of PCIe, after receiving bootup event, driver performs 2031 * D0 entry by writing 0 to sleep control register (check 2032 * btintel_pcie_recv_event()) 2033 * Firmware acks with alive interrupt indicating host is full ready to 2034 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 2035 * bit is cleared. 2036 */ 2037 calltime = ktime_get(); 2038 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2039 } 2040 2041 exit_error: 2042 return err; 2043 } 2044 2045 static int btintel_get_fw_name(struct intel_version *ver, 2046 struct intel_boot_params *params, 2047 char *fw_name, size_t len, 2048 const char *suffix) 2049 { 2050 switch (ver->hw_variant) { 2051 case 0x0b: /* SfP */ 2052 case 0x0c: /* WsP */ 2053 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2054 ver->hw_variant, 2055 le16_to_cpu(params->dev_revid), 2056 suffix); 2057 break; 2058 case 0x11: /* JfP */ 2059 case 0x12: /* ThP */ 2060 case 0x13: /* HrP */ 2061 case 0x14: /* CcP */ 2062 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2063 ver->hw_variant, 2064 ver->hw_revision, 2065 ver->fw_revision, 2066 suffix); 2067 break; 2068 default: 2069 return -EINVAL; 2070 } 2071 2072 return 0; 2073 } 2074 2075 static int btintel_download_fw(struct hci_dev *hdev, 2076 struct intel_version *ver, 2077 struct intel_boot_params *params, 2078 u32 *boot_param) 2079 { 2080 const struct firmware *fw; 2081 char fwname[64]; 2082 int err; 2083 ktime_t calltime; 2084 2085 if (!ver || !params) 2086 return -EINVAL; 2087 2088 /* The firmware variant determines if the device is in bootloader 2089 * mode or is running operational firmware. The value 0x06 identifies 2090 * the bootloader and the value 0x23 identifies the operational 2091 * firmware. 2092 * 2093 * When the operational firmware is already present, then only 2094 * the check for valid Bluetooth device address is needed. This 2095 * determines if the device will be added as configured or 2096 * unconfigured controller. 2097 * 2098 * It is not possible to use the Secure Boot Parameters in this 2099 * case since that command is only available in bootloader mode. 2100 */ 2101 if (ver->fw_variant == 0x23) { 2102 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2103 btintel_check_bdaddr(hdev); 2104 2105 /* SfP and WsP don't seem to update the firmware version on file 2106 * so version checking is currently possible. 2107 */ 2108 switch (ver->hw_variant) { 2109 case 0x0b: /* SfP */ 2110 case 0x0c: /* WsP */ 2111 return 0; 2112 } 2113 2114 /* Proceed to download to check if the version matches */ 2115 goto download; 2116 } 2117 2118 /* Read the secure boot parameters to identify the operating 2119 * details of the bootloader. 2120 */ 2121 err = btintel_read_boot_params(hdev, params); 2122 if (err) 2123 return err; 2124 2125 /* It is required that every single firmware fragment is acknowledged 2126 * with a command complete event. If the boot parameters indicate 2127 * that this bootloader does not send them, then abort the setup. 2128 */ 2129 if (params->limited_cce != 0x00) { 2130 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2131 params->limited_cce); 2132 return -EINVAL; 2133 } 2134 2135 /* If the OTP has no valid Bluetooth device address, then there will 2136 * also be no valid address for the operational firmware. 2137 */ 2138 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2139 bt_dev_info(hdev, "No device address configured"); 2140 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2141 } 2142 2143 download: 2144 /* With this Intel bootloader only the hardware variant and device 2145 * revision information are used to select the right firmware for SfP 2146 * and WsP. 2147 * 2148 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2149 * 2150 * Currently the supported hardware variants are: 2151 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2152 * 12 (0x0c) for iBT3.5 (WsP) 2153 * 2154 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2155 * variant, HW revision and FW revision, as these are dependent on CNVi 2156 * and RF Combination. 2157 * 2158 * 17 (0x11) for iBT3.5 (JfP) 2159 * 18 (0x12) for iBT3.5 (ThP) 2160 * 2161 * The firmware file name for these will be 2162 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2163 * 2164 */ 2165 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2166 if (err < 0) { 2167 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2168 /* Firmware has already been loaded */ 2169 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2170 return 0; 2171 } 2172 2173 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2174 return -EINVAL; 2175 } 2176 2177 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2178 if (err < 0) { 2179 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2180 /* Firmware has already been loaded */ 2181 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2182 return 0; 2183 } 2184 2185 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2186 fwname, err); 2187 return err; 2188 } 2189 2190 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2191 2192 if (fw->size < 644) { 2193 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2194 fw->size); 2195 err = -EBADF; 2196 goto done; 2197 } 2198 2199 calltime = ktime_get(); 2200 2201 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2202 2203 /* Start firmware downloading and get boot parameter */ 2204 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2205 if (err < 0) { 2206 if (err == -EALREADY) { 2207 /* Firmware has already been loaded */ 2208 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2209 err = 0; 2210 goto done; 2211 } 2212 2213 /* When FW download fails, send Intel Reset to retry 2214 * FW download. 2215 */ 2216 btintel_reset_to_bootloader(hdev); 2217 goto done; 2218 } 2219 2220 /* Before switching the device into operational mode and with that 2221 * booting the loaded firmware, wait for the bootloader notification 2222 * that all fragments have been successfully received. 2223 * 2224 * When the event processing receives the notification, then the 2225 * INTEL_DOWNLOADING flag will be cleared. 2226 * 2227 * The firmware loading should not take longer than 5 seconds 2228 * and thus just timeout if that happens and fail the setup 2229 * of this device. 2230 */ 2231 err = btintel_download_wait(hdev, calltime, 5000); 2232 if (err == -ETIMEDOUT) 2233 btintel_reset_to_bootloader(hdev); 2234 2235 done: 2236 release_firmware(fw); 2237 return err; 2238 } 2239 2240 static int btintel_bootloader_setup(struct hci_dev *hdev, 2241 struct intel_version *ver) 2242 { 2243 struct intel_version new_ver; 2244 struct intel_boot_params params; 2245 u32 boot_param; 2246 char ddcname[64]; 2247 int err; 2248 2249 BT_DBG("%s", hdev->name); 2250 2251 /* Set the default boot parameter to 0x0 and it is updated to 2252 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2253 * command while downloading the firmware. 2254 */ 2255 boot_param = 0x00000000; 2256 2257 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2258 2259 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2260 if (err) 2261 return err; 2262 2263 /* controller is already having an operational firmware */ 2264 if (ver->fw_variant == 0x23) 2265 goto finish; 2266 2267 err = btintel_boot(hdev, boot_param); 2268 if (err) 2269 return err; 2270 2271 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2272 2273 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2274 sizeof(ddcname), "ddc"); 2275 2276 if (err < 0) { 2277 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2278 } else { 2279 /* Once the device is running in operational mode, it needs to 2280 * apply the device configuration (DDC) parameters. 2281 * 2282 * The device can work without DDC parameters, so even if it 2283 * fails to load the file, no need to fail the setup. 2284 */ 2285 btintel_load_ddc_config(hdev, ddcname); 2286 } 2287 2288 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2289 2290 /* Read the Intel version information after loading the FW */ 2291 err = btintel_read_version(hdev, &new_ver); 2292 if (err) 2293 return err; 2294 2295 btintel_version_info(hdev, &new_ver); 2296 2297 finish: 2298 /* Set the event mask for Intel specific vendor events. This enables 2299 * a few extra events that are useful during general operation. It 2300 * does not enable any debugging related events. 2301 * 2302 * The device will function correctly without these events enabled 2303 * and thus no need to fail the setup. 2304 */ 2305 btintel_set_event_mask(hdev, false); 2306 2307 return 0; 2308 } 2309 2310 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2311 char *fw_name, size_t len, 2312 const char *suffix) 2313 { 2314 const char *format; 2315 u32 cnvi, cnvr; 2316 2317 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2318 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2319 2320 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2321 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2322 2323 /* Only Blazar product supports downloading of intermediate loader 2324 * image 2325 */ 2326 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2327 u8 zero[BTINTEL_FWID_MAXLEN]; 2328 2329 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2330 format = "intel/ibt-%04x-%04x-iml.%s"; 2331 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2332 return; 2333 } 2334 2335 memset(zero, 0, sizeof(zero)); 2336 2337 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2338 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2339 format = "intel/ibt-%04x-%04x-%s.%s"; 2340 snprintf(fw_name, len, format, cnvi, cnvr, 2341 ver->fw_id, suffix); 2342 return; 2343 } 2344 /* If firmware id is not present, fallback to legacy naming 2345 * convention 2346 */ 2347 } 2348 /* Fallback to legacy naming convention for other controllers 2349 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2350 */ 2351 format = "intel/ibt-%04x-%04x.%s"; 2352 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2353 } 2354 2355 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2356 char *fw_name, size_t len, 2357 const char *suffix) 2358 { 2359 const char *format; 2360 u32 cnvi, cnvr; 2361 2362 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2363 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2364 2365 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2366 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2367 2368 format = "intel/ibt-%04x-%04x-iml.%s"; 2369 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2370 } 2371 2372 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2373 struct intel_version_tlv *ver, 2374 u32 *boot_param) 2375 { 2376 const struct firmware *fw; 2377 char fwname[128]; 2378 int err; 2379 ktime_t calltime; 2380 2381 if (!ver || !boot_param) 2382 return -EINVAL; 2383 2384 /* The firmware variant determines if the device is in bootloader 2385 * mode or is running operational firmware. The value 0x03 identifies 2386 * the bootloader and the value 0x23 identifies the operational 2387 * firmware. 2388 * 2389 * When the operational firmware is already present, then only 2390 * the check for valid Bluetooth device address is needed. This 2391 * determines if the device will be added as configured or 2392 * unconfigured controller. 2393 * 2394 * It is not possible to use the Secure Boot Parameters in this 2395 * case since that command is only available in bootloader mode. 2396 */ 2397 if (ver->img_type == BTINTEL_IMG_OP) { 2398 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2399 btintel_check_bdaddr(hdev); 2400 } else { 2401 /* 2402 * Check for valid bd address in boot loader mode. Device 2403 * will be marked as unconfigured if empty bd address is 2404 * found. 2405 */ 2406 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2407 bt_dev_info(hdev, "No device address configured"); 2408 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2409 } 2410 } 2411 2412 if (ver->img_type == BTINTEL_IMG_OP) { 2413 /* Controller running OP image. In case of FW downgrade, 2414 * FWID TLV may not be present and driver may attempt to load 2415 * firmware image which doesn't exist. Lets compare the version 2416 * of IML image 2417 */ 2418 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2419 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2420 else 2421 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2422 } else { 2423 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2424 } 2425 2426 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2427 if (err < 0) { 2428 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2429 /* Firmware has already been loaded */ 2430 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2431 return 0; 2432 } 2433 2434 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2435 fwname, err); 2436 2437 return err; 2438 } 2439 2440 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2441 2442 if (fw->size < 644) { 2443 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2444 fw->size); 2445 err = -EBADF; 2446 goto done; 2447 } 2448 2449 calltime = ktime_get(); 2450 2451 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2452 2453 /* Start firmware downloading and get boot parameter */ 2454 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2455 INTEL_HW_VARIANT(ver->cnvi_bt), 2456 ver->sbe_type); 2457 if (err < 0) { 2458 if (err == -EALREADY) { 2459 /* Firmware has already been loaded */ 2460 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2461 err = 0; 2462 goto done; 2463 } 2464 2465 /* When FW download fails, send Intel Reset to retry 2466 * FW download. 2467 */ 2468 btintel_reset_to_bootloader(hdev); 2469 goto done; 2470 } 2471 2472 /* Before switching the device into operational mode and with that 2473 * booting the loaded firmware, wait for the bootloader notification 2474 * that all fragments have been successfully received. 2475 * 2476 * When the event processing receives the notification, then the 2477 * BTUSB_DOWNLOADING flag will be cleared. 2478 * 2479 * The firmware loading should not take longer than 5 seconds 2480 * and thus just timeout if that happens and fail the setup 2481 * of this device. 2482 */ 2483 err = btintel_download_wait(hdev, calltime, 5000); 2484 if (err == -ETIMEDOUT) 2485 btintel_reset_to_bootloader(hdev); 2486 2487 done: 2488 release_firmware(fw); 2489 return err; 2490 } 2491 2492 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2493 __u8 link, struct bt_codec *codec, 2494 __u8 *ven_len, __u8 **ven_data) 2495 { 2496 int err = 0; 2497 2498 if (!ven_data || !ven_len) 2499 return -EINVAL; 2500 2501 *ven_len = 0; 2502 *ven_data = NULL; 2503 2504 if (link != ESCO_LINK) { 2505 bt_dev_err(hdev, "Invalid link type(%u)", link); 2506 return -EINVAL; 2507 } 2508 2509 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2510 if (!*ven_data) { 2511 err = -ENOMEM; 2512 goto error; 2513 } 2514 2515 /* supports only CVSD and mSBC offload codecs */ 2516 switch (codec->id) { 2517 case 0x02: 2518 **ven_data = 0x00; 2519 break; 2520 case 0x05: 2521 **ven_data = 0x01; 2522 break; 2523 default: 2524 err = -EINVAL; 2525 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2526 goto error; 2527 } 2528 /* codec and its capabilities are pre-defined to ids 2529 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2530 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2531 */ 2532 *ven_len = sizeof(__u8); 2533 return err; 2534 2535 error: 2536 kfree(*ven_data); 2537 *ven_data = NULL; 2538 return err; 2539 } 2540 2541 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2542 { 2543 /* Intel uses 1 as data path id for all the usecases */ 2544 *data_path_id = 1; 2545 return 0; 2546 } 2547 2548 static int btintel_configure_offload(struct hci_dev *hdev) 2549 { 2550 struct sk_buff *skb; 2551 int err = 0; 2552 struct intel_offload_use_cases *use_cases; 2553 2554 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2555 if (IS_ERR(skb)) { 2556 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2557 PTR_ERR(skb)); 2558 return PTR_ERR(skb); 2559 } 2560 2561 if (skb->len < sizeof(*use_cases)) { 2562 err = -EIO; 2563 goto error; 2564 } 2565 2566 use_cases = (void *)skb->data; 2567 2568 if (use_cases->status) { 2569 err = -bt_to_errno(skb->data[0]); 2570 goto error; 2571 } 2572 2573 if (use_cases->preset[0] & 0x03) { 2574 hdev->get_data_path_id = btintel_get_data_path_id; 2575 hdev->get_codec_config_data = btintel_get_codec_config_data; 2576 } 2577 error: 2578 kfree_skb(skb); 2579 return err; 2580 } 2581 2582 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2583 { 2584 struct sk_buff *skb; 2585 struct hci_ppag_enable_cmd ppag_cmd; 2586 acpi_handle handle; 2587 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2588 union acpi_object *p, *elements; 2589 u32 domain, mode; 2590 acpi_status status; 2591 2592 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2593 switch (ver->cnvr_top & 0xFFF) { 2594 case 0x504: /* Hrp2 */ 2595 case 0x202: /* Jfp2 */ 2596 case 0x201: /* Jfp1 */ 2597 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2598 ver->cnvr_top & 0xFFF); 2599 return; 2600 } 2601 2602 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2603 if (!handle) { 2604 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2605 return; 2606 } 2607 2608 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2609 if (ACPI_FAILURE(status)) { 2610 if (status == AE_NOT_FOUND) { 2611 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2612 return; 2613 } 2614 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2615 return; 2616 } 2617 2618 p = buffer.pointer; 2619 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2620 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2621 p->type, p->package.count); 2622 kfree(buffer.pointer); 2623 return; 2624 } 2625 2626 elements = p->package.elements; 2627 2628 /* PPAG table is located at element[1] */ 2629 p = &elements[1]; 2630 2631 domain = (u32)p->package.elements[0].integer.value; 2632 mode = (u32)p->package.elements[1].integer.value; 2633 kfree(buffer.pointer); 2634 2635 if (domain != 0x12) { 2636 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2637 return; 2638 } 2639 2640 /* PPAG mode 2641 * BIT 0 : 0 Disabled in EU 2642 * 1 Enabled in EU 2643 * BIT 1 : 0 Disabled in China 2644 * 1 Enabled in China 2645 */ 2646 mode &= 0x03; 2647 2648 if (!mode) { 2649 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2650 return; 2651 } 2652 2653 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2654 2655 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2656 &ppag_cmd, HCI_CMD_TIMEOUT); 2657 if (IS_ERR(skb)) { 2658 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2659 return; 2660 } 2661 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2662 kfree_skb(skb); 2663 } 2664 2665 int btintel_acpi_reset_method(struct hci_dev *hdev) 2666 { 2667 int ret = 0; 2668 acpi_status status; 2669 union acpi_object *p, *ref; 2670 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2671 2672 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2673 if (ACPI_FAILURE(status) || !buffer.pointer) { 2674 bt_dev_err(hdev, "Failed to run _PRR method"); 2675 ret = -ENODEV; 2676 return ret; 2677 } 2678 p = buffer.pointer; 2679 2680 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) { 2681 bt_dev_err(hdev, "Invalid arguments"); 2682 ret = -EINVAL; 2683 goto exit_on_error; 2684 } 2685 2686 ref = &p->package.elements[0]; 2687 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2688 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2689 ret = -EINVAL; 2690 goto exit_on_error; 2691 } 2692 2693 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2694 if (ACPI_FAILURE(status)) { 2695 bt_dev_err(hdev, "Failed to run_RST method"); 2696 ret = -ENODEV; 2697 goto exit_on_error; 2698 } 2699 2700 exit_on_error: 2701 kfree(buffer.pointer); 2702 return ret; 2703 } 2704 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method); 2705 2706 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2707 struct intel_version_tlv *ver_tlv) 2708 { 2709 struct btintel_data *data = hci_get_priv(hdev); 2710 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2711 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2712 union acpi_object *obj, argv4; 2713 enum { 2714 RESET_TYPE_WDISABLE2, 2715 RESET_TYPE_VSEC 2716 }; 2717 2718 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2719 2720 if (!handle) { 2721 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2722 return; 2723 } 2724 2725 if (!acpi_has_method(handle, "_PRR")) { 2726 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2727 return; 2728 } 2729 2730 switch (ver_tlv->cnvi_top & 0xfff) { 2731 case 0x910: /* GalePeak2 */ 2732 reset_payload[2] = RESET_TYPE_VSEC; 2733 break; 2734 default: 2735 /* WDISABLE2 is the default reset method */ 2736 reset_payload[2] = RESET_TYPE_WDISABLE2; 2737 2738 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2739 BIT(DSM_SET_WDISABLE2_DELAY))) { 2740 bt_dev_err(hdev, "No dsm support to set reset delay"); 2741 return; 2742 } 2743 argv4.integer.type = ACPI_TYPE_INTEGER; 2744 /* delay required to toggle BT power */ 2745 argv4.integer.value = 160; 2746 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2747 DSM_SET_WDISABLE2_DELAY, &argv4); 2748 if (!obj) { 2749 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2750 return; 2751 } 2752 ACPI_FREE(obj); 2753 } 2754 2755 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2756 2757 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2758 DSM_SET_RESET_METHOD)) { 2759 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2760 return; 2761 } 2762 argv4.buffer.type = ACPI_TYPE_BUFFER; 2763 argv4.buffer.length = sizeof(reset_payload); 2764 argv4.buffer.pointer = reset_payload; 2765 2766 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2767 DSM_SET_RESET_METHOD, &argv4); 2768 if (!obj) { 2769 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2770 return; 2771 } 2772 ACPI_FREE(obj); 2773 data->acpi_reset_method = btintel_acpi_reset_method; 2774 } 2775 2776 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2777 2778 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2779 { 2780 /* 2781 * Distinguish ISO data packets form ACL data packets 2782 * based on their connection handle value range. 2783 */ 2784 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2785 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE) 2786 return HCI_ISODATA_PKT; 2787 } 2788 2789 return hci_skb_pkt_type(skb); 2790 } 2791 2792 /* 2793 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2794 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2795 * overcome the potential STEP errors on their designs. Based on the 2796 * configauration, bluetooth firmware shall adjust the BRI response line drive 2797 * strength. The below structure represents DSBR data. 2798 * struct { 2799 * u8 header; 2800 * u32 dsbr; 2801 * } __packed; 2802 * 2803 * header - defines revision number of the structure 2804 * dsbr - defines drive strength BRI response 2805 * bit0 2806 * 0 - instructs bluetooth firmware to use default values 2807 * 1 - instructs bluetooth firmware to override default values 2808 * bit3:1 2809 * Reserved 2810 * bit7:4 2811 * DSBR override values (only if bit0 is set. Default value is 0xF 2812 * bit31:7 2813 * Reserved 2814 * Expected values for dsbr field: 2815 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2816 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2817 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2818 * that the resistor on board is 10 Ohm 2819 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2820 * firmware to use default values. 2821 * 2822 */ 2823 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2824 { 2825 struct btintel_dsbr { 2826 u8 header; 2827 u32 dsbr; 2828 } __packed data; 2829 2830 efi_status_t status; 2831 unsigned long data_size = sizeof(data); 2832 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2833 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2834 2835 if (!IS_ENABLED(CONFIG_EFI)) 2836 return -EOPNOTSUPP; 2837 2838 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2839 return -EOPNOTSUPP; 2840 2841 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2842 &data); 2843 2844 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2845 return -ENXIO; 2846 2847 *dsbr_var = data.dsbr; 2848 return 0; 2849 } 2850 2851 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2852 { 2853 struct btintel_dsbr_cmd { 2854 u8 enable; 2855 u8 dsbr; 2856 } __packed; 2857 2858 struct btintel_dsbr_cmd cmd; 2859 struct sk_buff *skb; 2860 u32 dsbr; 2861 u8 status, hw_variant; 2862 int err; 2863 2864 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2865 /* DSBR command needs to be sent for, 2866 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2867 * 2. Gale Peak2 or BlazarU in OP image. 2868 * 3. Scorpious Peak in IML image. 2869 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2870 */ 2871 2872 switch (hw_variant) { 2873 case BTINTEL_HWID_BZRI: 2874 case BTINTEL_HWID_BZRIW: 2875 if (ver->img_type == BTINTEL_IMG_IML && 2876 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2877 break; 2878 return 0; 2879 case BTINTEL_HWID_GAP: 2880 case BTINTEL_HWID_BZRU: 2881 if (ver->img_type == BTINTEL_IMG_OP && 2882 hdev->bus == HCI_USB) 2883 break; 2884 return 0; 2885 case BTINTEL_HWID_SCP: 2886 if (ver->img_type == BTINTEL_IMG_IML) 2887 break; 2888 return 0; 2889 default: 2890 /* Scorpius Peak2 onwards */ 2891 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2892 && ver->img_type == BTINTEL_IMG_IML) 2893 break; 2894 return 0; 2895 } 2896 2897 dsbr = 0; 2898 err = btintel_uefi_get_dsbr(&dsbr); 2899 if (err < 0) 2900 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2901 BTINTEL_EFI_DSBR, err); 2902 2903 cmd.enable = dsbr & BIT(0); 2904 cmd.dsbr = dsbr >> 4 & 0xF; 2905 2906 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2907 cmd.dsbr); 2908 2909 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2910 if (IS_ERR(skb)) 2911 return -bt_to_errno(PTR_ERR(skb)); 2912 2913 status = skb->data[0]; 2914 kfree_skb(skb); 2915 2916 if (status) 2917 return -bt_to_errno(status); 2918 2919 return 0; 2920 } 2921 2922 #ifdef CONFIG_ACPI 2923 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2924 acpi_string method, 2925 union acpi_object **ptr, 2926 u8 pkg_size) 2927 { 2928 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2929 union acpi_object *p; 2930 acpi_status status; 2931 acpi_handle handle; 2932 2933 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2934 if (!handle) { 2935 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2936 return AE_NOT_EXIST; 2937 } 2938 2939 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2940 2941 if (ACPI_FAILURE(status)) { 2942 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2943 acpi_format_exception(status), method); 2944 return status; 2945 } 2946 2947 p = buffer.pointer; 2948 2949 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2950 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2951 p->type, p->package.count); 2952 kfree(buffer.pointer); 2953 return AE_ERROR; 2954 } 2955 2956 *ptr = buffer.pointer; 2957 return 0; 2958 } 2959 2960 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2961 { 2962 union acpi_object *domain, *bt_pkg; 2963 int i; 2964 2965 for (i = 1; i < buffer->package.count; i++) { 2966 bt_pkg = &buffer->package.elements[i]; 2967 domain = &bt_pkg->package.elements[0]; 2968 if (domain->type == ACPI_TYPE_INTEGER && 2969 domain->integer.value == BTINTEL_BT_DOMAIN) 2970 return bt_pkg; 2971 } 2972 return ERR_PTR(-ENOENT); 2973 } 2974 2975 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2976 { 2977 struct sk_buff *skb; 2978 2979 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2980 if (IS_ERR(skb)) { 2981 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2982 le16_to_cpu(data->id), PTR_ERR(skb)); 2983 return PTR_ERR(skb); 2984 } 2985 kfree_skb(skb); 2986 return 0; 2987 } 2988 2989 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2990 int id, struct btintel_sar_inc_pwr *sar) 2991 { 2992 cmd->len = 5; 2993 cmd->id = cpu_to_le16(id); 2994 cmd->data[0] = sar->br >> 3; 2995 cmd->data[1] = sar->edr2 >> 3; 2996 cmd->data[2] = sar->edr3 >> 3; 2997 return btintel_send_sar_ddc(hdev, cmd, 6); 2998 } 2999 3000 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3001 int id, struct btintel_sar_inc_pwr *sar) 3002 { 3003 cmd->len = 3; 3004 cmd->id = cpu_to_le16(id); 3005 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 3006 return btintel_send_sar_ddc(hdev, cmd, 4); 3007 } 3008 3009 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3010 int id, struct btintel_sar_inc_pwr *sar) 3011 { 3012 cmd->len = 3; 3013 cmd->id = cpu_to_le16(id); 3014 cmd->data[0] = sar->br >> 3; 3015 return btintel_send_sar_ddc(hdev, cmd, 4); 3016 } 3017 3018 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3019 int id, struct btintel_sar_inc_pwr *sar) 3020 { 3021 cmd->len = 3; 3022 cmd->id = cpu_to_le16(id); 3023 cmd->data[0] = sar->br; 3024 return btintel_send_sar_ddc(hdev, cmd, 4); 3025 } 3026 3027 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3028 int id, struct btintel_sar_inc_pwr *sar) 3029 { 3030 cmd->len = 3; 3031 cmd->id = cpu_to_le16(id); 3032 cmd->data[0] = sar->edr2; 3033 return btintel_send_sar_ddc(hdev, cmd, 4); 3034 } 3035 3036 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3037 int id, struct btintel_sar_inc_pwr *sar) 3038 { 3039 cmd->len = 3; 3040 cmd->id = cpu_to_le16(id); 3041 cmd->data[0] = sar->edr3; 3042 return btintel_send_sar_ddc(hdev, cmd, 4); 3043 } 3044 3045 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3046 { 3047 struct btintel_cp_ddc_write *cmd; 3048 u8 buffer[64]; 3049 int ret; 3050 3051 cmd = (void *)buffer; 3052 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3053 if (ret) 3054 return ret; 3055 3056 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3057 if (ret) 3058 return ret; 3059 3060 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3061 if (ret) 3062 return ret; 3063 3064 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3065 if (ret) 3066 return ret; 3067 3068 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3069 if (ret) 3070 return ret; 3071 3072 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3073 if (ret) 3074 return ret; 3075 3076 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3077 3078 return ret; 3079 } 3080 3081 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3082 { 3083 struct btintel_cp_ddc_write *cmd; 3084 struct sk_buff *skb; 3085 u8 buffer[64]; 3086 bool enable; 3087 int ret; 3088 3089 cmd = (void *)buffer; 3090 3091 cmd->len = 3; 3092 cmd->id = cpu_to_le16(0x019e); 3093 3094 if (sar->revision == BTINTEL_SAR_INC_PWR && 3095 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3096 cmd->data[0] = 0x01; 3097 else 3098 cmd->data[0] = 0x00; 3099 3100 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3101 if (ret) 3102 return ret; 3103 3104 if (sar->revision == BTINTEL_SAR_INC_PWR && 3105 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3106 cmd->len = 3; 3107 cmd->id = cpu_to_le16(0x019f); 3108 cmd->data[0] = sar->sar_2400_chain_a; 3109 3110 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3111 if (ret) 3112 return ret; 3113 } 3114 3115 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3116 if (ret) 3117 return ret; 3118 3119 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3120 if (ret) 3121 return ret; 3122 3123 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3124 if (ret) 3125 return ret; 3126 3127 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3128 if (ret) 3129 return ret; 3130 3131 enable = true; 3132 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3133 if (IS_ERR(skb)) { 3134 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3135 return PTR_ERR(skb); 3136 } 3137 3138 kfree_skb(skb); 3139 return 0; 3140 } 3141 3142 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band 3143 * 3144 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value]. 3145 * cmd->len = 4 (2 id + 2 data) 3146 * HCI total = 5 bytes (1 len + 4) 3147 */ 3148 static int btintel_send_sar_rev2_band(struct hci_dev *hdev, 3149 struct btintel_cp_ddc_write *cmd, 3150 u16 id, u8 chain_a, u8 chain_b) 3151 { 3152 cmd->len = 4; 3153 cmd->id = cpu_to_le16(id); 3154 cmd->data[0] = chain_a; 3155 cmd->data[1] = chain_b; 3156 return btintel_send_sar_ddc(hdev, cmd, 5); 3157 } 3158 3159 static int btintel_set_sar_rev2(struct hci_dev *hdev, 3160 struct btintel_sar_rev2 *sar) 3161 { 3162 struct btintel_cp_ddc_write *cmd; 3163 struct sk_buff *skb; 3164 u8 buffer[64]; 3165 u8 enable; 3166 int ret; 3167 3168 cmd = (void *)buffer; 3169 3170 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */ 3171 cmd->len = 3; 3172 cmd->id = cpu_to_le16(0x019e); 3173 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ? 3174 0x01 : 0x00; 3175 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3176 if (ret) 3177 return ret; 3178 3179 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */ 3180 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311, 3181 sar->chain_a.subband_2g4, 3182 sar->chain_b.subband_2g4); 3183 if (ret) 3184 return ret; 3185 3186 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312, 3187 sar->chain_a.subband_5g2, 3188 sar->chain_b.subband_5g2); 3189 if (ret) 3190 return ret; 3191 3192 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */ 3193 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313, 3194 sar->chain_a.subband_5g8_5g9, 3195 sar->chain_b.subband_5g8_5g9); 3196 if (ret) 3197 return ret; 3198 3199 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314, 3200 sar->chain_a.subband_5g8_5g9, 3201 sar->chain_b.subband_5g8_5g9); 3202 if (ret) 3203 return ret; 3204 3205 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315, 3206 sar->chain_a.subband_6g1, 3207 sar->chain_b.subband_6g1); 3208 if (ret) 3209 return ret; 3210 3211 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316, 3212 sar->chain_a.subband_6g3, 3213 sar->chain_b.subband_6g3); 3214 if (ret) 3215 return ret; 3216 3217 /* Notify firmware that SAR initialisation is complete */ 3218 enable = 0x01; 3219 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT); 3220 if (IS_ERR(skb)) { 3221 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)", 3222 PTR_ERR(skb)); 3223 return PTR_ERR(skb); 3224 } 3225 3226 kfree_skb(skb); 3227 return 0; 3228 } 3229 3230 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev, 3231 struct btintel_sar_rev2 *sar, 3232 struct intel_version_tlv *ver) 3233 { 3234 u16 cnvi = ver->cnvi_top & 0xfff; 3235 u16 cnvr = ver->cnvr_top & 0xfff; 3236 3237 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) { 3238 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)", 3239 cnvi, cnvr); 3240 return -EOPNOTSUPP; 3241 } 3242 3243 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2"); 3244 return btintel_set_sar_rev2(hdev, sar); 3245 } 3246 3247 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3248 struct intel_version_tlv *ver) 3249 { 3250 u16 cnvi, cnvr; 3251 int ret; 3252 3253 cnvi = ver->cnvi_top & 0xfff; 3254 cnvr = ver->cnvr_top & 0xfff; 3255 3256 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3257 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3258 ret = btintel_set_legacy_sar(hdev, sar); 3259 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3260 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3261 ret = btintel_set_mutual_sar(hdev, sar); 3262 } else { 3263 ret = -EOPNOTSUPP; 3264 } 3265 3266 return ret; 3267 } 3268 3269 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3270 { 3271 union acpi_object *bt_pkg, *buffer = NULL; 3272 struct btintel_sar_inc_pwr sar; 3273 struct btintel_sar_rev2 sar_rev2; 3274 acpi_status status; 3275 u8 revision; 3276 int ret; 3277 3278 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3279 if (ACPI_FAILURE(status)) 3280 return -ENOENT; 3281 3282 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3283 3284 if (IS_ERR(bt_pkg)) { 3285 ret = PTR_ERR(bt_pkg); 3286 goto error; 3287 } 3288 3289 if (!bt_pkg->package.count) { 3290 ret = -EINVAL; 3291 goto error; 3292 } 3293 3294 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) { 3295 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field"); 3296 ret = -EINVAL; 3297 goto error; 3298 } 3299 3300 revision = buffer->package.elements[0].integer.value; 3301 3302 if (revision > BTINTEL_SAR_REV2) { 3303 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3304 ret = -EOPNOTSUPP; 3305 goto error; 3306 } 3307 3308 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) { 3309 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12), 3310 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32), 3311 * 3..12 = per-chain sub-band limits (u8 each). 3312 */ 3313 static const u64 rev2_max[13] = { 3314 U8_MAX, /* domain ID */ 3315 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */ 3316 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */ 3317 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */ 3318 }; 3319 union acpi_object *e; 3320 int i; 3321 3322 for (i = 0; i < 13; i++) { 3323 e = &bt_pkg->package.elements[i]; 3324 if (e->type != ACPI_TYPE_INTEGER) { 3325 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d", 3326 i); 3327 ret = -EINVAL; 3328 goto error; 3329 } 3330 if (e->integer.value > rev2_max[i]) { 3331 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range", 3332 i, e->integer.value); 3333 ret = -ERANGE; 3334 goto error; 3335 } 3336 } 3337 3338 memset(&sar_rev2, 0, sizeof(sar_rev2)); 3339 sar_rev2.revision = revision; 3340 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3341 3342 if (sar_rev2.bt_sar_bios != 1) { 3343 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled"); 3344 ret = -EOPNOTSUPP; 3345 goto error; 3346 } 3347 3348 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3349 3350 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value; 3351 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value; 3352 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value; 3353 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value; 3354 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value; 3355 3356 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value; 3357 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value; 3358 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value; 3359 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value; 3360 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value; 3361 3362 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u", 3363 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode); 3364 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3365 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2, 3366 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1, 3367 sar_rev2.chain_a.subband_6g3); 3368 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3369 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2, 3370 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1, 3371 sar_rev2.chain_b.subband_6g3); 3372 3373 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver); 3374 goto error; 3375 } 3376 3377 if (revision == BTINTEL_SAR_REV2) { 3378 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)", 3379 bt_pkg->package.count); 3380 ret = -EINVAL; 3381 goto error; 3382 } 3383 3384 memset(&sar, 0, sizeof(sar)); 3385 3386 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3387 sar.revision = revision; 3388 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3389 sar.br = bt_pkg->package.elements[2].integer.value; 3390 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3391 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3392 sar.le = bt_pkg->package.elements[5].integer.value; 3393 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3394 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3395 3396 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3397 sar.revision = revision; 3398 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3399 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3400 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3401 sar.br = bt_pkg->package.elements[4].integer.value; 3402 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3403 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3404 sar.le = bt_pkg->package.elements[7].integer.value; 3405 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3406 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3407 } else { 3408 ret = -EINVAL; 3409 goto error; 3410 } 3411 3412 /* Apply only if it is enabled in BIOS */ 3413 if (sar.bt_sar_bios != 1) { 3414 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3415 ret = -EOPNOTSUPP; 3416 goto error; 3417 } 3418 3419 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3420 error: 3421 kfree(buffer); 3422 return ret; 3423 } 3424 #endif /* CONFIG_ACPI */ 3425 3426 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3427 struct intel_version_tlv *ver) 3428 { 3429 #ifdef CONFIG_ACPI 3430 return btintel_acpi_set_sar(hdev, ver); 3431 #endif 3432 return 0; 3433 } 3434 3435 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3436 struct intel_version_tlv *ver) 3437 { 3438 u32 boot_param; 3439 char ddcname[64]; 3440 int err; 3441 struct intel_version_tlv new_ver; 3442 3443 bt_dev_dbg(hdev, ""); 3444 3445 /* Set the default boot parameter to 0x0 and it is updated to 3446 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3447 * command while downloading the firmware. 3448 */ 3449 boot_param = 0x00000000; 3450 3451 /* In case of PCIe, this function might get called multiple times with 3452 * same hdev instance if there is any error on firmware download. 3453 * Need to clear stale bits of previous firmware download attempt. 3454 */ 3455 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3456 btintel_clear_flag(hdev, i); 3457 3458 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3459 3460 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3461 if (err) 3462 return err; 3463 3464 /* check if controller is already having an operational firmware */ 3465 if (ver->img_type == BTINTEL_IMG_OP) 3466 goto finish; 3467 3468 err = btintel_boot(hdev, boot_param); 3469 if (err) 3470 return err; 3471 3472 err = btintel_read_version_tlv(hdev, ver); 3473 if (err) 3474 return err; 3475 3476 /* set drive strength of BRI response */ 3477 err = btintel_set_dsbr(hdev, ver); 3478 if (err) { 3479 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3480 return err; 3481 } 3482 3483 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3484 * intermediate loader image 3485 */ 3486 if (ver->img_type == BTINTEL_IMG_IML) { 3487 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3488 if (err) 3489 return err; 3490 3491 err = btintel_boot(hdev, boot_param); 3492 if (err) 3493 return err; 3494 } 3495 3496 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3497 3498 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3499 /* Once the device is running in operational mode, it needs to 3500 * apply the device configuration (DDC) parameters. 3501 * 3502 * The device can work without DDC parameters, so even if it 3503 * fails to load the file, no need to fail the setup. 3504 */ 3505 btintel_load_ddc_config(hdev, ddcname); 3506 3507 /* Read supported use cases and set callbacks to fetch datapath id */ 3508 btintel_configure_offload(hdev); 3509 3510 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3511 3512 /* Send sar values to controller */ 3513 btintel_set_specific_absorption_rate(hdev, ver); 3514 3515 /* Set PPAG feature */ 3516 btintel_set_ppag(hdev, ver); 3517 3518 /* Read the Intel version information after loading the FW */ 3519 err = btintel_read_version_tlv(hdev, &new_ver); 3520 if (err) 3521 return err; 3522 3523 btintel_version_info_tlv(hdev, &new_ver); 3524 3525 finish: 3526 /* Set the event mask for Intel specific vendor events. This enables 3527 * a few extra events that are useful during general operation. It 3528 * does not enable any debugging related events. 3529 * 3530 * The device will function correctly without these events enabled 3531 * and thus no need to fail the setup. 3532 */ 3533 btintel_set_event_mask(hdev, false); 3534 3535 return 0; 3536 } 3537 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3538 3539 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3540 { 3541 switch (hw_variant) { 3542 /* Legacy bootloader devices that supports MSFT Extension */ 3543 case 0x11: /* JfP */ 3544 case 0x12: /* ThP */ 3545 case 0x13: /* HrP */ 3546 case 0x14: /* CcP */ 3547 /* All Intel new generation controllers support the Microsoft vendor 3548 * extension are using 0xFC1E for VsMsftOpCode. 3549 */ 3550 case 0x17: 3551 case 0x18: 3552 case 0x19: 3553 case 0x1b: 3554 case 0x1c: 3555 case 0x1d: 3556 case 0x1e: 3557 case 0x1f: 3558 case 0x20: 3559 case 0x21: 3560 case 0x22: 3561 hci_set_msft_opcode(hdev, 0xFC1E); 3562 break; 3563 default: 3564 /* Not supported */ 3565 break; 3566 } 3567 } 3568 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3569 3570 void btintel_print_fseq_info(struct hci_dev *hdev) 3571 { 3572 struct sk_buff *skb; 3573 u8 *p; 3574 u32 val; 3575 const char *str; 3576 3577 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3578 if (IS_ERR(skb)) { 3579 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3580 PTR_ERR(skb)); 3581 return; 3582 } 3583 3584 if (skb->len < (sizeof(u32) * 16 + 2)) { 3585 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3586 skb->len); 3587 kfree_skb(skb); 3588 return; 3589 } 3590 3591 p = skb_pull_data(skb, 1); 3592 if (*p) { 3593 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3594 kfree_skb(skb); 3595 return; 3596 } 3597 3598 p = skb_pull_data(skb, 1); 3599 switch (*p) { 3600 case 0: 3601 str = "Success"; 3602 break; 3603 case 1: 3604 str = "Fatal error"; 3605 break; 3606 case 2: 3607 str = "Semaphore acquire error"; 3608 break; 3609 default: 3610 str = "Unknown error"; 3611 break; 3612 } 3613 3614 if (*p) { 3615 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3616 kfree_skb(skb); 3617 return; 3618 } 3619 3620 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3621 3622 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3623 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3624 3625 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3626 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3627 3628 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3629 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3630 3631 p = skb->data; 3632 skb_pull_data(skb, 4); 3633 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3634 p[2], p[3]); 3635 3636 p = skb->data; 3637 skb_pull_data(skb, 4); 3638 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3639 p[2], p[3]); 3640 3641 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3642 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3643 3644 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3645 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3646 3647 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3648 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3649 3650 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3651 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3652 3653 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3654 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3655 3656 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3657 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3658 3659 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3660 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3661 3662 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3663 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3664 3665 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3666 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3667 3668 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3669 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3670 3671 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3672 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3673 3674 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3675 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3676 3677 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3678 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3679 3680 kfree_skb(skb); 3681 } 3682 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3683 3684 static int btintel_setup_combined(struct hci_dev *hdev) 3685 { 3686 const u8 param[1] = { 0xFF }; 3687 struct intel_version ver; 3688 struct intel_version_tlv ver_tlv; 3689 struct sk_buff *skb; 3690 int err; 3691 3692 BT_DBG("%s", hdev->name); 3693 3694 /* The some controllers have a bug with the first HCI command sent to it 3695 * returning number of completed commands as zero. This would stall the 3696 * command processing in the Bluetooth core. 3697 * 3698 * As a workaround, send HCI Reset command first which will reset the 3699 * number of completed commands and allow normal command processing 3700 * from now on. 3701 * 3702 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3703 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3704 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3705 * state, the only way to exit out of it is sending the HCI_Reset 3706 * command. 3707 */ 3708 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3709 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3710 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3711 HCI_INIT_TIMEOUT); 3712 if (IS_ERR(skb)) { 3713 bt_dev_err(hdev, 3714 "sending initial HCI reset failed (%ld)", 3715 PTR_ERR(skb)); 3716 return PTR_ERR(skb); 3717 } 3718 kfree_skb(skb); 3719 } 3720 3721 /* Starting from TyP device, the command parameter and response are 3722 * changed even though the OCF for HCI_Intel_Read_Version command 3723 * remains same. The legacy devices can handle even if the 3724 * command has a parameter and returns a correct version information. 3725 * So, it uses new format to support both legacy and new format. 3726 */ 3727 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3728 if (IS_ERR(skb)) { 3729 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3730 PTR_ERR(skb)); 3731 return PTR_ERR(skb); 3732 } 3733 3734 /* Check the status */ 3735 if (skb->data[0]) { 3736 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3737 skb->data[0]); 3738 err = -EIO; 3739 goto exit_error; 3740 } 3741 3742 /* Apply the common HCI quirks for Intel device */ 3743 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3744 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3745 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3746 3747 /* Set up the quality report callback for Intel devices */ 3748 hdev->set_quality_report = btintel_set_quality_report; 3749 3750 /* For Legacy device, check the HW platform value and size */ 3751 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3752 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3753 3754 memcpy(&ver, skb->data, sizeof(ver)); 3755 3756 /* Display version information */ 3757 btintel_version_info(hdev, &ver); 3758 3759 /* Check for supported iBT hardware variants of this firmware 3760 * loading method. 3761 * 3762 * This check has been put in place to ensure correct forward 3763 * compatibility options when newer hardware variants come 3764 * along. 3765 */ 3766 switch (ver.hw_variant) { 3767 case 0x07: /* WP */ 3768 case 0x08: /* StP */ 3769 /* Legacy ROM product */ 3770 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3771 3772 /* Apply the device specific HCI quirks 3773 * 3774 * WBS for SdP - For the Legacy ROM products, only SdP 3775 * supports the WBS. But the version information is not 3776 * enough to use here because the StP2 and SdP have same 3777 * hw_variant and fw_variant. So, this flag is set by 3778 * the transport driver (btusb) based on the HW info 3779 * (idProduct) 3780 */ 3781 if (!btintel_test_flag(hdev, 3782 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3783 hci_set_quirk(hdev, 3784 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3785 3786 err = btintel_legacy_rom_setup(hdev, &ver); 3787 break; 3788 case 0x0b: /* SfP */ 3789 case 0x11: /* JfP */ 3790 case 0x12: /* ThP */ 3791 case 0x13: /* HrP */ 3792 case 0x14: /* CcP */ 3793 fallthrough; 3794 case 0x0c: /* WsP */ 3795 /* Apply the device specific HCI quirks 3796 * 3797 * All Legacy bootloader devices support WBS 3798 */ 3799 hci_set_quirk(hdev, 3800 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3801 3802 /* These variants don't seem to support LE Coded PHY */ 3803 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3804 3805 /* Setup MSFT Extension support */ 3806 btintel_set_msft_opcode(hdev, ver.hw_variant); 3807 3808 err = btintel_bootloader_setup(hdev, &ver); 3809 btintel_register_devcoredump_support(hdev); 3810 break; 3811 default: 3812 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3813 ver.hw_variant); 3814 err = -EINVAL; 3815 } 3816 3817 hci_set_hw_info(hdev, 3818 "INTEL platform=%u variant=%u revision=%u", 3819 ver.hw_platform, ver.hw_variant, 3820 ver.hw_revision); 3821 3822 goto exit_error; 3823 } 3824 3825 /* memset ver_tlv to start with clean state as few fields are exclusive 3826 * to bootloader mode and are not populated in operational mode 3827 */ 3828 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3829 /* For TLV type device, parse the tlv data */ 3830 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3831 if (err) { 3832 bt_dev_err(hdev, "Failed to parse TLV version information"); 3833 goto exit_error; 3834 } 3835 3836 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3837 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3838 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3839 err = -EINVAL; 3840 goto exit_error; 3841 } 3842 3843 /* Check for supported iBT hardware variants of this firmware 3844 * loading method. 3845 * 3846 * This check has been put in place to ensure correct forward 3847 * compatibility options when newer hardware variants come 3848 * along. 3849 */ 3850 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3851 case 0x11: /* JfP */ 3852 case 0x12: /* ThP */ 3853 case 0x13: /* HrP */ 3854 case 0x14: /* CcP */ 3855 /* Some legacy bootloader devices starting from JfP, 3856 * the operational firmware supports both old and TLV based 3857 * HCI_Intel_Read_Version command based on the command 3858 * parameter. 3859 * 3860 * For upgrading firmware case, the TLV based version cannot 3861 * be used because the firmware filename for legacy bootloader 3862 * is based on the old format. 3863 * 3864 * Also, it is not easy to convert TLV based version from the 3865 * legacy version format. 3866 * 3867 * So, as a workaround for those devices, use the legacy 3868 * HCI_Intel_Read_Version to get the version information and 3869 * run the legacy bootloader setup. 3870 */ 3871 err = btintel_read_version(hdev, &ver); 3872 if (err) 3873 break; 3874 3875 /* Apply the device specific HCI quirks 3876 * 3877 * All Legacy bootloader devices support WBS 3878 */ 3879 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3880 3881 /* These variants don't seem to support LE Coded PHY */ 3882 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3883 3884 /* Setup MSFT Extension support */ 3885 btintel_set_msft_opcode(hdev, ver.hw_variant); 3886 3887 err = btintel_bootloader_setup(hdev, &ver); 3888 btintel_register_devcoredump_support(hdev); 3889 break; 3890 case 0x18: /* GfP2 */ 3891 case 0x1c: /* GaP */ 3892 /* Re-classify packet type for controllers with LE audio */ 3893 hdev->classify_pkt_type = btintel_classify_pkt_type; 3894 fallthrough; 3895 case 0x17: 3896 case 0x19: 3897 case 0x1b: 3898 case 0x1d: 3899 case 0x1e: 3900 case 0x1f: 3901 case 0x20: 3902 case 0x21: 3903 case 0x22: 3904 /* Display version information of TLV type */ 3905 btintel_version_info_tlv(hdev, &ver_tlv); 3906 3907 /* Apply the device specific HCI quirks for TLV based devices 3908 * 3909 * All TLV based devices support WBS 3910 */ 3911 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3912 3913 /* Setup MSFT Extension support */ 3914 btintel_set_msft_opcode(hdev, 3915 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3916 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3917 3918 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3919 if (err) 3920 goto exit_error; 3921 3922 btintel_register_devcoredump_support(hdev); 3923 btintel_print_fseq_info(hdev); 3924 break; 3925 default: 3926 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3927 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3928 err = -EINVAL; 3929 break; 3930 } 3931 3932 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3933 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3934 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3935 3936 exit_error: 3937 kfree_skb(skb); 3938 3939 return err; 3940 } 3941 3942 int btintel_shutdown_combined(struct hci_dev *hdev) 3943 { 3944 struct sk_buff *skb; 3945 int ret; 3946 3947 /* Send HCI Reset to the controller to stop any BT activity which 3948 * were triggered. This will help to save power and maintain the 3949 * sync b/w Host and controller 3950 */ 3951 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3952 if (IS_ERR(skb)) { 3953 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3954 return PTR_ERR(skb); 3955 } 3956 kfree_skb(skb); 3957 3958 3959 /* Some platforms have an issue with BT LED when the interface is 3960 * down or BT radio is turned off, which takes 5 seconds to BT LED 3961 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3962 * device in the RFKILL ON state which turns off the BT LED immediately. 3963 */ 3964 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3965 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3966 if (IS_ERR(skb)) { 3967 ret = PTR_ERR(skb); 3968 bt_dev_err(hdev, "turning off Intel device LED failed"); 3969 return ret; 3970 } 3971 kfree_skb(skb); 3972 } 3973 3974 return 0; 3975 } 3976 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3977 3978 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3979 { 3980 hdev->manufacturer = 2; 3981 hdev->setup = btintel_setup_combined; 3982 hdev->shutdown = btintel_shutdown_combined; 3983 hdev->hw_error = btintel_hw_error; 3984 hdev->set_diag = btintel_set_diag_combined; 3985 hdev->set_bdaddr = btintel_set_bdaddr; 3986 3987 coredump_info.driver_name = driver_name; 3988 3989 return 0; 3990 } 3991 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3992 3993 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3994 { 3995 struct intel_tlv *tlv = (void *)&skb->data[5]; 3996 3997 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0])) 3998 goto recv_frame; 3999 4000 /* The first event is always an event type TLV */ 4001 if (tlv->type != INTEL_TLV_TYPE_ID) 4002 goto recv_frame; 4003 4004 switch (tlv->val[0]) { 4005 case INTEL_TLV_SYSTEM_EXCEPTION: 4006 case INTEL_TLV_FATAL_EXCEPTION: 4007 case INTEL_TLV_DEBUG_EXCEPTION: 4008 case INTEL_TLV_TEST_EXCEPTION: 4009 /* Generate devcoredump from exception */ 4010 if (!hci_devcd_init(hdev, skb->len)) { 4011 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 4012 hci_devcd_complete(hdev); 4013 } else { 4014 bt_dev_err(hdev, "Failed to generate devcoredump"); 4015 } 4016 break; 4017 default: 4018 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 4019 } 4020 4021 recv_frame: 4022 return hci_recv_frame(hdev, skb); 4023 } 4024 4025 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 4026 { 4027 struct hci_event_hdr *hdr = (void *)skb->data; 4028 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 4029 4030 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) { 4031 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 4032 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 4033 4034 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 4035 switch (skb->data[2]) { 4036 case 0x02: 4037 /* When switching to the operational firmware 4038 * the device sends a vendor specific event 4039 * indicating that the bootup completed. 4040 */ 4041 btintel_bootup(hdev, ptr, len); 4042 kfree_skb(skb); 4043 return 0; 4044 case 0x06: 4045 /* When the firmware loading completes the 4046 * device sends out a vendor specific event 4047 * indicating the result of the firmware 4048 * loading. 4049 */ 4050 btintel_secure_send_result(hdev, ptr, len); 4051 kfree_skb(skb); 4052 return 0; 4053 } 4054 } 4055 4056 /* Handle all diagnostics events separately. May still call 4057 * hci_recv_frame. 4058 */ 4059 if (len + 1 >= sizeof(diagnostics_hdr) && 4060 memcmp(&skb->data[2], diagnostics_hdr, 4061 sizeof(diagnostics_hdr)) == 0) { 4062 return btintel_diagnostics(hdev, skb); 4063 } 4064 } 4065 4066 return hci_recv_frame(hdev, skb); 4067 } 4068 EXPORT_SYMBOL_GPL(btintel_recv_event); 4069 4070 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 4071 { 4072 const struct intel_bootup *evt = ptr; 4073 4074 if (len != sizeof(*evt)) 4075 return; 4076 4077 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 4078 btintel_wake_up_flag(hdev, INTEL_BOOTING); 4079 } 4080 EXPORT_SYMBOL_GPL(btintel_bootup); 4081 4082 void btintel_secure_send_result(struct hci_dev *hdev, 4083 const void *ptr, unsigned int len) 4084 { 4085 const struct intel_secure_send_result *evt = ptr; 4086 4087 if (len != sizeof(*evt)) 4088 return; 4089 4090 if (evt->result) 4091 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 4092 4093 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 4094 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 4095 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 4096 } 4097 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 4098 4099 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 4100 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 4101 MODULE_VERSION(VERSION); 4102 MODULE_LICENSE("GPL"); 4103 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 4104 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 4105 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 4106 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 4107