1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Bluetooth support for Intel devices
5 *
6 * Copyright (C) 2015 Intel Corporation
7 */
8
9 #include <linux/module.h>
10 #include <linux/firmware.h>
11 #include <linux/regmap.h>
12 #include <linux/string_choices.h>
13 #include <linux/acpi.h>
14 #include <acpi/acpi_bus.h>
15 #include <linux/unaligned.h>
16 #include <linux/efi.h>
17
18 #include <net/bluetooth/bluetooth.h>
19 #include <net/bluetooth/hci_core.h>
20
21 #include "btintel.h"
22
23 #define VERSION "0.1"
24
25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
26 #define RSA_HEADER_LEN 644
27 #define CSS_HEADER_OFFSET 8
28 #define ECDSA_OFFSET 644
29 #define ECDSA_HEADER_LEN 320
30
31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR"
32
33 enum {
34 DSM_SET_WDISABLE2_DELAY = 1,
35 DSM_SET_RESET_METHOD = 3,
36 };
37
38 /* Hybrid ECDSA + LMS */
39 #define BTINTEL_RSA_HEADER_VER 0x00010000
40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000
41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700
42 #define BTINTEL_ECDSA_OFFSET 128
43 #define BTINTEL_CSS_HEADER_SIZE 128
44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96
45 #define BTINTEL_ECDSA_SIG_SIZE 96
46 #define BTINTEL_LMS_OFFSET 320
47 #define BTINTEL_LMS_PUB_KEY_SIZE 52
48 #define BTINTEL_LMS_SIG_SIZE 1744
49 #define BTINTEL_CMD_BUFFER_OFFSET 2116
50
51 #define BTINTEL_BT_DOMAIN 0x12
52 #define BTINTEL_SAR_LEGACY 0
53 #define BTINTEL_SAR_INC_PWR 1
54 #define BTINTEL_SAR_REV2 2
55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0
56
57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e
58 struct cmd_write_boot_params {
59 __le32 boot_addr;
60 u8 fw_build_num;
61 u8 fw_build_ww;
62 u8 fw_build_yy;
63 } __packed;
64
65 static struct {
66 const char *driver_name;
67 u8 hw_variant;
68 u32 fw_build_num;
69 } coredump_info;
70
71 const guid_t btintel_guid_dsm =
72 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233,
73 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9);
74 EXPORT_SYMBOL_GPL(btintel_guid_dsm);
75
btintel_check_bdaddr(struct hci_dev * hdev)76 int btintel_check_bdaddr(struct hci_dev *hdev)
77 {
78 struct hci_rp_read_bd_addr *bda;
79 struct sk_buff *skb;
80
81 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
82 HCI_INIT_TIMEOUT);
83 if (IS_ERR(skb)) {
84 int err = PTR_ERR(skb);
85 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
86 err);
87 return err;
88 }
89
90 if (skb->len != sizeof(*bda)) {
91 bt_dev_err(hdev, "Intel device address length mismatch");
92 kfree_skb(skb);
93 return -EIO;
94 }
95
96 bda = (struct hci_rp_read_bd_addr *)skb->data;
97
98 /* For some Intel based controllers, the default Bluetooth device
99 * address 00:03:19:9E:8B:00 can be found. These controllers are
100 * fully operational, but have the danger of duplicate addresses
101 * and that in turn can cause problems with Bluetooth operation.
102 */
103 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
104 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
105 &bda->bdaddr);
106 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
107 }
108
109 kfree_skb(skb);
110
111 return 0;
112 }
113 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
114
btintel_enter_mfg(struct hci_dev * hdev)115 int btintel_enter_mfg(struct hci_dev *hdev)
116 {
117 static const u8 param[] = { 0x01, 0x00 };
118 struct sk_buff *skb;
119
120 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
121 if (IS_ERR(skb)) {
122 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
123 PTR_ERR(skb));
124 return PTR_ERR(skb);
125 }
126 kfree_skb(skb);
127
128 return 0;
129 }
130 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
131
btintel_exit_mfg(struct hci_dev * hdev,bool reset,bool patched)132 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
133 {
134 u8 param[] = { 0x00, 0x00 };
135 struct sk_buff *skb;
136
137 /* The 2nd command parameter specifies the manufacturing exit method:
138 * 0x00: Just disable the manufacturing mode (0x00).
139 * 0x01: Disable manufacturing mode and reset with patches deactivated.
140 * 0x02: Disable manufacturing mode and reset with patches activated.
141 */
142 if (reset)
143 param[1] |= patched ? 0x02 : 0x01;
144
145 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
146 if (IS_ERR(skb)) {
147 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
148 PTR_ERR(skb));
149 return PTR_ERR(skb);
150 }
151 kfree_skb(skb);
152
153 return 0;
154 }
155 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
156
btintel_set_bdaddr(struct hci_dev * hdev,const bdaddr_t * bdaddr)157 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
158 {
159 struct sk_buff *skb;
160 int err;
161
162 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
163 if (IS_ERR(skb)) {
164 err = PTR_ERR(skb);
165 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
166 err);
167 return err;
168 }
169 kfree_skb(skb);
170
171 return 0;
172 }
173 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
174
btintel_set_event_mask(struct hci_dev * hdev,bool debug)175 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
176 {
177 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
178 struct sk_buff *skb;
179 int err;
180
181 if (debug)
182 mask[1] |= 0x62;
183
184 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
185 if (IS_ERR(skb)) {
186 err = PTR_ERR(skb);
187 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
188 return err;
189 }
190 kfree_skb(skb);
191
192 return 0;
193 }
194
btintel_set_diag(struct hci_dev * hdev,bool enable)195 int btintel_set_diag(struct hci_dev *hdev, bool enable)
196 {
197 struct sk_buff *skb;
198 u8 param[3];
199 int err;
200
201 if (enable) {
202 param[0] = 0x03;
203 param[1] = 0x03;
204 param[2] = 0x03;
205 } else {
206 param[0] = 0x00;
207 param[1] = 0x00;
208 param[2] = 0x00;
209 }
210
211 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
212 if (IS_ERR(skb)) {
213 err = PTR_ERR(skb);
214 if (err == -ENODATA)
215 goto done;
216 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
217 err);
218 return err;
219 }
220 kfree_skb(skb);
221
222 done:
223 btintel_set_event_mask(hdev, enable);
224 return 0;
225 }
226 EXPORT_SYMBOL_GPL(btintel_set_diag);
227
btintel_set_diag_mfg(struct hci_dev * hdev,bool enable)228 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
229 {
230 int err, ret;
231
232 err = btintel_enter_mfg(hdev);
233 if (err)
234 return err;
235
236 ret = btintel_set_diag(hdev, enable);
237
238 err = btintel_exit_mfg(hdev, false, false);
239 if (err)
240 return err;
241
242 return ret;
243 }
244
btintel_set_diag_combined(struct hci_dev * hdev,bool enable)245 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
246 {
247 int ret;
248
249 /* Legacy ROM device needs to be in the manufacturer mode to apply
250 * diagnostic setting
251 *
252 * This flag is set after reading the Intel version.
253 */
254 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
255 ret = btintel_set_diag_mfg(hdev, enable);
256 else
257 ret = btintel_set_diag(hdev, enable);
258
259 return ret;
260 }
261
btintel_hw_error(struct hci_dev * hdev,u8 code)262 void btintel_hw_error(struct hci_dev *hdev, u8 code)
263 {
264 struct sk_buff *skb;
265 u8 type = 0x00;
266
267 bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
268
269 hci_req_sync_lock(hdev);
270
271 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
272 if (IS_ERR(skb)) {
273 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
274 PTR_ERR(skb));
275 goto unlock;
276 }
277 kfree_skb(skb);
278
279 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
280 if (IS_ERR(skb)) {
281 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
282 PTR_ERR(skb));
283 goto unlock;
284 }
285
286 if (skb->len != 13) {
287 bt_dev_err(hdev, "Exception info size mismatch");
288 kfree_skb(skb);
289 goto unlock;
290 }
291
292 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
293
294 kfree_skb(skb);
295
296 unlock:
297 hci_req_sync_unlock(hdev);
298 }
299 EXPORT_SYMBOL_GPL(btintel_hw_error);
300
btintel_version_info(struct hci_dev * hdev,struct intel_version * ver)301 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
302 {
303 const char *variant;
304
305 /* The hardware platform number has a fixed value of 0x37 and
306 * for now only accept this single value.
307 */
308 if (ver->hw_platform != 0x37) {
309 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
310 ver->hw_platform);
311 return -EINVAL;
312 }
313
314 /* Check for supported iBT hardware variants of this firmware
315 * loading method.
316 *
317 * This check has been put in place to ensure correct forward
318 * compatibility options when newer hardware variants come along.
319 */
320 switch (ver->hw_variant) {
321 case 0x07: /* WP - Legacy ROM */
322 case 0x08: /* StP - Legacy ROM */
323 case 0x0b: /* SfP */
324 case 0x0c: /* WsP */
325 case 0x11: /* JfP */
326 case 0x12: /* ThP */
327 case 0x13: /* HrP */
328 case 0x14: /* CcP */
329 break;
330 default:
331 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
332 ver->hw_variant);
333 return -EINVAL;
334 }
335
336 switch (ver->fw_variant) {
337 case 0x01:
338 variant = "Legacy ROM 2.5";
339 break;
340 case 0x06:
341 variant = "Bootloader";
342 break;
343 case 0x22:
344 variant = "Legacy ROM 2.x";
345 break;
346 case 0x23:
347 variant = "Firmware";
348 break;
349 default:
350 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
351 return -EINVAL;
352 }
353
354 coredump_info.hw_variant = ver->hw_variant;
355 coredump_info.fw_build_num = ver->fw_build_num;
356
357 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
358 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
359 ver->fw_build_num, ver->fw_build_ww,
360 2000 + ver->fw_build_yy);
361
362 return 0;
363 }
364 EXPORT_SYMBOL_GPL(btintel_version_info);
365
btintel_secure_send(struct hci_dev * hdev,u8 fragment_type,u32 plen,const void * param)366 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
367 const void *param)
368 {
369 while (plen > 0) {
370 struct sk_buff *skb;
371 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
372
373 cmd_param[0] = fragment_type;
374 memcpy(cmd_param + 1, param, fragment_len);
375
376 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
377 cmd_param, HCI_INIT_TIMEOUT);
378 if (IS_ERR(skb))
379 return PTR_ERR(skb);
380
381 kfree_skb(skb);
382
383 plen -= fragment_len;
384 param += fragment_len;
385 }
386
387 return 0;
388 }
389
btintel_load_ddc_config(struct hci_dev * hdev,const char * ddc_name)390 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
391 {
392 const struct firmware *fw;
393 struct sk_buff *skb;
394 const u8 *fw_ptr;
395 int err;
396
397 err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
398 if (err < 0) {
399 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
400 ddc_name, err);
401 return err;
402 }
403
404 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
405
406 fw_ptr = fw->data;
407
408 /* DDC file contains one or more DDC structure which has
409 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
410 */
411 while (fw->size > fw_ptr - fw->data) {
412 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
413
414 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
415 HCI_INIT_TIMEOUT);
416 if (IS_ERR(skb)) {
417 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
418 PTR_ERR(skb));
419 release_firmware(fw);
420 return PTR_ERR(skb);
421 }
422
423 fw_ptr += cmd_plen;
424 kfree_skb(skb);
425 }
426
427 release_firmware(fw);
428
429 bt_dev_info(hdev, "Applying Intel DDC parameters completed");
430
431 return 0;
432 }
433 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
434
btintel_set_event_mask_mfg(struct hci_dev * hdev,bool debug)435 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
436 {
437 int err, ret;
438
439 err = btintel_enter_mfg(hdev);
440 if (err)
441 return err;
442
443 ret = btintel_set_event_mask(hdev, debug);
444
445 err = btintel_exit_mfg(hdev, false, false);
446 if (err)
447 return err;
448
449 return ret;
450 }
451 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
452
btintel_read_version(struct hci_dev * hdev,struct intel_version * ver)453 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
454 {
455 struct sk_buff *skb;
456
457 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
458 if (IS_ERR(skb)) {
459 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
460 PTR_ERR(skb));
461 return PTR_ERR(skb);
462 }
463
464 if (!skb || skb->len != sizeof(*ver)) {
465 bt_dev_err(hdev, "Intel version event size mismatch");
466 kfree_skb(skb);
467 return -EILSEQ;
468 }
469
470 memcpy(ver, skb->data, sizeof(*ver));
471
472 kfree_skb(skb);
473
474 return 0;
475 }
476 EXPORT_SYMBOL_GPL(btintel_read_version);
477
btintel_version_info_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)478 int btintel_version_info_tlv(struct hci_dev *hdev,
479 struct intel_version_tlv *version)
480 {
481 const char *variant;
482
483 /* The hardware platform number has a fixed value of 0x37 and
484 * for now only accept this single value.
485 */
486 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
487 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
488 INTEL_HW_PLATFORM(version->cnvi_bt));
489 return -EINVAL;
490 }
491
492 /* Check for supported iBT hardware variants of this firmware
493 * loading method.
494 *
495 * This check has been put in place to ensure correct forward
496 * compatibility options when newer hardware variants come along.
497 */
498 switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
499 case 0x17: /* TyP */
500 case 0x18: /* Slr */
501 case 0x19: /* Slr-F */
502 case 0x1b: /* Mgr */
503 case 0x1c: /* Gale Peak (GaP) */
504 case 0x1d: /* BlazarU (BzrU) */
505 case 0x1e: /* BlazarI (Bzr) */
506 case 0x1f: /* Scorpious Peak */
507 case 0x20: /* Scorpious Peak2 */
508 case 0x21: /* Scorpious Peak2 F */
509 case 0x22: /* BlazarIW (BzrIW) */
510 break;
511 default:
512 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
513 INTEL_HW_VARIANT(version->cnvi_bt));
514 return -EINVAL;
515 }
516
517 switch (version->img_type) {
518 case BTINTEL_IMG_BOOTLOADER:
519 variant = "Bootloader";
520 /* It is required that every single firmware fragment is acknowledged
521 * with a command complete event. If the boot parameters indicate
522 * that this bootloader does not send them, then abort the setup.
523 */
524 if (version->limited_cce != 0x00) {
525 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
526 version->limited_cce);
527 return -EINVAL;
528 }
529
530 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */
531 if (version->sbe_type > 0x03) {
532 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
533 version->sbe_type);
534 return -EINVAL;
535 }
536
537 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
538 bt_dev_info(hdev, "Secure boot is %s",
539 str_enabled_disabled(version->secure_boot));
540 bt_dev_info(hdev, "OTP lock is %s",
541 str_enabled_disabled(version->otp_lock));
542 bt_dev_info(hdev, "API lock is %s",
543 str_enabled_disabled(version->api_lock));
544 bt_dev_info(hdev, "Debug lock is %s",
545 str_enabled_disabled(version->debug_lock));
546 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
547 version->min_fw_build_nn, version->min_fw_build_cw,
548 2000 + version->min_fw_build_yy);
549 break;
550 case BTINTEL_IMG_IML:
551 variant = "Intermediate loader";
552 break;
553 case BTINTEL_IMG_OP:
554 variant = "Firmware";
555 break;
556 default:
557 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
558 return -EINVAL;
559 }
560
561 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt);
562 coredump_info.fw_build_num = version->build_num;
563
564 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
565 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
566 version->build_type, version->build_num);
567 if (version->img_type == BTINTEL_IMG_OP)
568 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1);
569
570 return 0;
571 }
572 EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
573
btintel_parse_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version,struct sk_buff * skb)574 int btintel_parse_version_tlv(struct hci_dev *hdev,
575 struct intel_version_tlv *version,
576 struct sk_buff *skb)
577 {
578 /* Consume Command Complete Status field */
579 skb_pull(skb, 1);
580
581 /* Event parameters contain multiple TLVs. Read each of them
582 * and only keep the required data. Also, it use existing legacy
583 * version field like hw_platform, hw_variant, and fw_variant
584 * to keep the existing setup flow
585 */
586 while (skb->len) {
587 struct intel_tlv *tlv;
588
589 /* Make sure skb has a minimum length of the header */
590 if (skb->len < sizeof(*tlv))
591 return -EINVAL;
592
593 tlv = (struct intel_tlv *)skb->data;
594
595 /* Make sure skb has a enough data */
596 if (skb->len < tlv->len + sizeof(*tlv))
597 return -EINVAL;
598
599 switch (tlv->type) {
600 case INTEL_TLV_CNVI_TOP:
601 version->cnvi_top = get_unaligned_le32(tlv->val);
602 break;
603 case INTEL_TLV_CNVR_TOP:
604 version->cnvr_top = get_unaligned_le32(tlv->val);
605 break;
606 case INTEL_TLV_CNVI_BT:
607 version->cnvi_bt = get_unaligned_le32(tlv->val);
608 break;
609 case INTEL_TLV_CNVR_BT:
610 version->cnvr_bt = get_unaligned_le32(tlv->val);
611 break;
612 case INTEL_TLV_DEV_REV_ID:
613 version->dev_rev_id = get_unaligned_le16(tlv->val);
614 break;
615 case INTEL_TLV_IMAGE_TYPE:
616 version->img_type = tlv->val[0];
617 break;
618 case INTEL_TLV_TIME_STAMP:
619 /* If image type is Operational firmware (0x03), then
620 * running FW Calendar Week and Year information can
621 * be extracted from Timestamp information
622 */
623 version->min_fw_build_cw = tlv->val[0];
624 version->min_fw_build_yy = tlv->val[1];
625 version->timestamp = get_unaligned_le16(tlv->val);
626 break;
627 case INTEL_TLV_BUILD_TYPE:
628 version->build_type = tlv->val[0];
629 break;
630 case INTEL_TLV_BUILD_NUM:
631 /* If image type is Operational firmware (0x03), then
632 * running FW build number can be extracted from the
633 * Build information
634 */
635 version->min_fw_build_nn = tlv->val[0];
636 version->build_num = get_unaligned_le32(tlv->val);
637 break;
638 case INTEL_TLV_SECURE_BOOT:
639 version->secure_boot = tlv->val[0];
640 break;
641 case INTEL_TLV_OTP_LOCK:
642 version->otp_lock = tlv->val[0];
643 break;
644 case INTEL_TLV_API_LOCK:
645 version->api_lock = tlv->val[0];
646 break;
647 case INTEL_TLV_DEBUG_LOCK:
648 version->debug_lock = tlv->val[0];
649 break;
650 case INTEL_TLV_MIN_FW:
651 version->min_fw_build_nn = tlv->val[0];
652 version->min_fw_build_cw = tlv->val[1];
653 version->min_fw_build_yy = tlv->val[2];
654 break;
655 case INTEL_TLV_LIMITED_CCE:
656 version->limited_cce = tlv->val[0];
657 break;
658 case INTEL_TLV_SBE_TYPE:
659 version->sbe_type = tlv->val[0];
660 break;
661 case INTEL_TLV_OTP_BDADDR:
662 memcpy(&version->otp_bd_addr, tlv->val,
663 sizeof(bdaddr_t));
664 break;
665 case INTEL_TLV_GIT_SHA1:
666 version->git_sha1 = get_unaligned_le32(tlv->val);
667 break;
668 case INTEL_TLV_FW_ID:
669 snprintf(version->fw_id, sizeof(version->fw_id),
670 "%s", tlv->val);
671 break;
672 default:
673 /* Ignore rest of information */
674 break;
675 }
676 /* consume the current tlv and move to next*/
677 skb_pull(skb, tlv->len + sizeof(*tlv));
678 }
679
680 return 0;
681 }
682 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv);
683
btintel_read_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)684 static int btintel_read_version_tlv(struct hci_dev *hdev,
685 struct intel_version_tlv *version)
686 {
687 struct sk_buff *skb;
688 const u8 param[1] = { 0xFF };
689
690 if (!version)
691 return -EINVAL;
692
693 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
694 if (IS_ERR(skb)) {
695 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
696 PTR_ERR(skb));
697 return PTR_ERR(skb);
698 }
699
700 if (skb->data[0]) {
701 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
702 skb->data[0]);
703 kfree_skb(skb);
704 return -EIO;
705 }
706
707 btintel_parse_version_tlv(hdev, version, skb);
708
709 kfree_skb(skb);
710 return 0;
711 }
712
713 /* ------- REGMAP IBT SUPPORT ------- */
714
715 #define IBT_REG_MODE_8BIT 0x00
716 #define IBT_REG_MODE_16BIT 0x01
717 #define IBT_REG_MODE_32BIT 0x02
718
719 struct regmap_ibt_context {
720 struct hci_dev *hdev;
721 __u16 op_write;
722 __u16 op_read;
723 };
724
725 struct ibt_cp_reg_access {
726 __le32 addr;
727 __u8 mode;
728 __u8 len;
729 __u8 data[];
730 } __packed;
731
732 struct ibt_rp_reg_access {
733 __u8 status;
734 __le32 addr;
735 __u8 data[];
736 } __packed;
737
regmap_ibt_read(void * context,const void * addr,size_t reg_size,void * val,size_t val_size)738 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
739 void *val, size_t val_size)
740 {
741 struct regmap_ibt_context *ctx = context;
742 struct ibt_cp_reg_access cp;
743 struct ibt_rp_reg_access *rp;
744 struct sk_buff *skb;
745 int err = 0;
746
747 if (reg_size != sizeof(__le32))
748 return -EINVAL;
749
750 switch (val_size) {
751 case 1:
752 cp.mode = IBT_REG_MODE_8BIT;
753 break;
754 case 2:
755 cp.mode = IBT_REG_MODE_16BIT;
756 break;
757 case 4:
758 cp.mode = IBT_REG_MODE_32BIT;
759 break;
760 default:
761 return -EINVAL;
762 }
763
764 /* regmap provides a little-endian formatted addr */
765 cp.addr = *(__le32 *)addr;
766 cp.len = val_size;
767
768 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
769
770 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
771 HCI_CMD_TIMEOUT);
772 if (IS_ERR(skb)) {
773 err = PTR_ERR(skb);
774 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
775 le32_to_cpu(cp.addr), err);
776 return err;
777 }
778
779 if (skb->len != sizeof(*rp) + val_size) {
780 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
781 le32_to_cpu(cp.addr));
782 err = -EINVAL;
783 goto done;
784 }
785
786 rp = (struct ibt_rp_reg_access *)skb->data;
787
788 if (rp->addr != cp.addr) {
789 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
790 le32_to_cpu(rp->addr));
791 err = -EINVAL;
792 goto done;
793 }
794
795 memcpy(val, rp->data, val_size);
796
797 done:
798 kfree_skb(skb);
799 return err;
800 }
801
regmap_ibt_gather_write(void * context,const void * addr,size_t reg_size,const void * val,size_t val_size)802 static int regmap_ibt_gather_write(void *context,
803 const void *addr, size_t reg_size,
804 const void *val, size_t val_size)
805 {
806 struct regmap_ibt_context *ctx = context;
807 struct ibt_cp_reg_access *cp;
808 struct sk_buff *skb;
809 int plen = sizeof(*cp) + val_size;
810 u8 mode;
811 int err = 0;
812
813 if (reg_size != sizeof(__le32))
814 return -EINVAL;
815
816 switch (val_size) {
817 case 1:
818 mode = IBT_REG_MODE_8BIT;
819 break;
820 case 2:
821 mode = IBT_REG_MODE_16BIT;
822 break;
823 case 4:
824 mode = IBT_REG_MODE_32BIT;
825 break;
826 default:
827 return -EINVAL;
828 }
829
830 cp = kmalloc(plen, GFP_KERNEL);
831 if (!cp)
832 return -ENOMEM;
833
834 /* regmap provides a little-endian formatted addr/value */
835 cp->addr = *(__le32 *)addr;
836 cp->mode = mode;
837 cp->len = val_size;
838 memcpy(&cp->data, val, val_size);
839
840 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
841
842 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
843 if (IS_ERR(skb)) {
844 err = PTR_ERR(skb);
845 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
846 le32_to_cpu(cp->addr), err);
847 goto done;
848 }
849 kfree_skb(skb);
850
851 done:
852 kfree(cp);
853 return err;
854 }
855
regmap_ibt_write(void * context,const void * data,size_t count)856 static int regmap_ibt_write(void *context, const void *data, size_t count)
857 {
858 /* data contains register+value, since we only support 32bit addr,
859 * minimum data size is 4 bytes.
860 */
861 if (WARN_ONCE(count < 4, "Invalid register access"))
862 return -EINVAL;
863
864 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
865 }
866
regmap_ibt_free_context(void * context)867 static void regmap_ibt_free_context(void *context)
868 {
869 kfree(context);
870 }
871
872 static const struct regmap_bus regmap_ibt = {
873 .read = regmap_ibt_read,
874 .write = regmap_ibt_write,
875 .gather_write = regmap_ibt_gather_write,
876 .free_context = regmap_ibt_free_context,
877 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
878 .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
879 };
880
881 /* Config is the same for all register regions */
882 static const struct regmap_config regmap_ibt_cfg = {
883 .name = "btintel_regmap",
884 .reg_bits = 32,
885 .val_bits = 32,
886 };
887
btintel_regmap_init(struct hci_dev * hdev,u16 opcode_read,u16 opcode_write)888 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
889 u16 opcode_write)
890 {
891 struct regmap_ibt_context *ctx;
892
893 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
894 opcode_write);
895
896 ctx = kzalloc_obj(*ctx);
897 if (!ctx)
898 return ERR_PTR(-ENOMEM);
899
900 ctx->op_read = opcode_read;
901 ctx->op_write = opcode_write;
902 ctx->hdev = hdev;
903
904 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg);
905 }
906 EXPORT_SYMBOL_GPL(btintel_regmap_init);
907
btintel_send_intel_reset(struct hci_dev * hdev,u32 boot_param)908 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
909 {
910 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
911 struct sk_buff *skb;
912
913 params.boot_param = cpu_to_le32(boot_param);
914
915 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms,
916 HCI_INIT_TIMEOUT);
917 if (IS_ERR(skb)) {
918 bt_dev_err(hdev, "Failed to send Intel Reset command");
919 return PTR_ERR(skb);
920 }
921
922 kfree_skb(skb);
923
924 return 0;
925 }
926 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
927
btintel_read_boot_params(struct hci_dev * hdev,struct intel_boot_params * params)928 int btintel_read_boot_params(struct hci_dev *hdev,
929 struct intel_boot_params *params)
930 {
931 struct sk_buff *skb;
932
933 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
934 if (IS_ERR(skb)) {
935 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
936 PTR_ERR(skb));
937 return PTR_ERR(skb);
938 }
939
940 if (skb->len != sizeof(*params)) {
941 bt_dev_err(hdev, "Intel boot parameters size mismatch");
942 kfree_skb(skb);
943 return -EILSEQ;
944 }
945
946 memcpy(params, skb->data, sizeof(*params));
947
948 kfree_skb(skb);
949
950 if (params->status) {
951 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
952 params->status);
953 return -bt_to_errno(params->status);
954 }
955
956 bt_dev_info(hdev, "Device revision is %u",
957 le16_to_cpu(params->dev_revid));
958
959 bt_dev_info(hdev, "Secure boot is %s",
960 str_enabled_disabled(params->secure_boot));
961
962 bt_dev_info(hdev, "OTP lock is %s",
963 str_enabled_disabled(params->otp_lock));
964
965 bt_dev_info(hdev, "API lock is %s",
966 str_enabled_disabled(params->api_lock));
967
968 bt_dev_info(hdev, "Debug lock is %s",
969 str_enabled_disabled(params->debug_lock));
970
971 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
972 params->min_fw_build_nn, params->min_fw_build_cw,
973 2000 + params->min_fw_build_yy);
974
975 return 0;
976 }
977 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
978
btintel_sfi_rsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)979 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
980 const struct firmware *fw)
981 {
982 int err;
983
984 /* Start the firmware download transaction with the Init fragment
985 * represented by the 128 bytes of CSS header.
986 */
987 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
988 if (err < 0) {
989 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
990 goto done;
991 }
992
993 /* Send the 256 bytes of public key information from the firmware
994 * as the PKey fragment.
995 */
996 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
997 if (err < 0) {
998 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
999 goto done;
1000 }
1001
1002 /* Send the 256 bytes of signature information from the firmware
1003 * as the Sign fragment.
1004 */
1005 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
1006 if (err < 0) {
1007 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
1008 goto done;
1009 }
1010
1011 done:
1012 return err;
1013 }
1014
btintel_sfi_ecdsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)1015 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
1016 const struct firmware *fw)
1017 {
1018 int err;
1019
1020 /* Start the firmware download transaction with the Init fragment
1021 * represented by the 128 bytes of CSS header.
1022 */
1023 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
1024 if (err < 0) {
1025 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
1026 return err;
1027 }
1028
1029 /* Send the 96 bytes of public key information from the firmware
1030 * as the PKey fragment.
1031 */
1032 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
1033 if (err < 0) {
1034 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
1035 return err;
1036 }
1037
1038 /* Send the 96 bytes of signature information from the firmware
1039 * as the Sign fragment
1040 */
1041 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
1042 if (err < 0) {
1043 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
1044 err);
1045 return err;
1046 }
1047 return 0;
1048 }
1049
btintel_sfi_hybrid_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)1050 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev,
1051 const struct firmware *fw)
1052 {
1053 int err;
1054
1055 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data);
1056 if (err < 0) {
1057 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err);
1058 return err;
1059 }
1060
1061 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE,
1062 fw->data + BTINTEL_ECDSA_OFFSET);
1063 if (err < 0) {
1064 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err);
1065 return err;
1066 }
1067
1068 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE,
1069 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE);
1070 if (err < 0) {
1071 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err);
1072 return err;
1073 }
1074
1075 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE,
1076 fw->data + BTINTEL_LMS_OFFSET);
1077 if (err < 0) {
1078 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err);
1079 return err;
1080 }
1081
1082 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE,
1083 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE);
1084 if (err < 0) {
1085 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err);
1086 return err;
1087 }
1088
1089 return 0;
1090 }
1091
btintel_download_firmware_payload(struct hci_dev * hdev,const struct firmware * fw,size_t offset)1092 static int btintel_download_firmware_payload(struct hci_dev *hdev,
1093 const struct firmware *fw,
1094 size_t offset)
1095 {
1096 int err;
1097 const u8 *fw_ptr;
1098 u32 frag_len;
1099
1100 fw_ptr = fw->data + offset;
1101 frag_len = 0;
1102 err = -EINVAL;
1103
1104 while (fw_ptr - fw->data < fw->size) {
1105 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
1106
1107 frag_len += sizeof(*cmd) + cmd->plen;
1108
1109 /* The parameter length of the secure send command requires
1110 * a 4 byte alignment. It happens so that the firmware file
1111 * contains proper Intel_NOP commands to align the fragments
1112 * as needed.
1113 *
1114 * Send set of commands with 4 byte alignment from the
1115 * firmware data buffer as a single Data fragment.
1116 */
1117 if (!(frag_len % 4)) {
1118 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1119 if (err < 0) {
1120 bt_dev_err(hdev,
1121 "Failed to send firmware data (%d)",
1122 err);
1123 goto done;
1124 }
1125
1126 fw_ptr += frag_len;
1127 frag_len = 0;
1128 }
1129 }
1130
1131 done:
1132 return err;
1133 }
1134
btintel_firmware_version(struct hci_dev * hdev,u8 num,u8 ww,u8 yy,const struct firmware * fw,u32 * boot_addr)1135 static bool btintel_firmware_version(struct hci_dev *hdev,
1136 u8 num, u8 ww, u8 yy,
1137 const struct firmware *fw,
1138 u32 *boot_addr)
1139 {
1140 const u8 *fw_ptr;
1141
1142 fw_ptr = fw->data;
1143
1144 while (fw_ptr - fw->data < fw->size) {
1145 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1146
1147 /* Each SKU has a different reset parameter to use in the
1148 * HCI_Intel_Reset command and it is embedded in the firmware
1149 * data. So, instead of using static value per SKU, check
1150 * the firmware data and save it for later use.
1151 */
1152 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1153 struct cmd_write_boot_params *params;
1154
1155 params = (void *)(fw_ptr + sizeof(*cmd));
1156
1157 *boot_addr = le32_to_cpu(params->boot_addr);
1158
1159 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr);
1160
1161 bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1162 params->fw_build_num, params->fw_build_ww,
1163 params->fw_build_yy);
1164
1165 return (num == params->fw_build_num &&
1166 ww == params->fw_build_ww &&
1167 yy == params->fw_build_yy);
1168 }
1169
1170 fw_ptr += sizeof(*cmd) + cmd->plen;
1171 }
1172
1173 return false;
1174 }
1175
btintel_download_firmware(struct hci_dev * hdev,struct intel_version * ver,const struct firmware * fw,u32 * boot_param)1176 int btintel_download_firmware(struct hci_dev *hdev,
1177 struct intel_version *ver,
1178 const struct firmware *fw,
1179 u32 *boot_param)
1180 {
1181 int err;
1182
1183 /* SfP and WsP don't seem to update the firmware version on file
1184 * so version checking is currently not possible.
1185 */
1186 switch (ver->hw_variant) {
1187 case 0x0b: /* SfP */
1188 case 0x0c: /* WsP */
1189 /* Skip version checking */
1190 break;
1191 default:
1192
1193 /* Skip download if firmware has the same version */
1194 if (btintel_firmware_version(hdev, ver->fw_build_num,
1195 ver->fw_build_ww, ver->fw_build_yy,
1196 fw, boot_param)) {
1197 bt_dev_info(hdev, "Firmware already loaded");
1198 /* Return -EALREADY to indicate that the firmware has
1199 * already been loaded.
1200 */
1201 return -EALREADY;
1202 }
1203 }
1204
1205 /* The firmware variant determines if the device is in bootloader
1206 * mode or is running operational firmware. The value 0x06 identifies
1207 * the bootloader and the value 0x23 identifies the operational
1208 * firmware.
1209 *
1210 * If the firmware version has changed that means it needs to be reset
1211 * to bootloader when operational so the new firmware can be loaded.
1212 */
1213 if (ver->fw_variant == 0x23)
1214 return -EINVAL;
1215
1216 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1217 if (err)
1218 return err;
1219
1220 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1221 }
1222 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1223
btintel_download_fw_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,const struct firmware * fw,u32 * boot_param,u8 hw_variant,u8 sbe_type)1224 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1225 struct intel_version_tlv *ver,
1226 const struct firmware *fw, u32 *boot_param,
1227 u8 hw_variant, u8 sbe_type)
1228 {
1229 int err;
1230 u32 css_header_ver;
1231
1232 /* Skip download if firmware has the same version */
1233 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1234 ver->min_fw_build_cw,
1235 ver->min_fw_build_yy,
1236 fw, boot_param)) {
1237 bt_dev_info(hdev, "Firmware already loaded");
1238 /* Return -EALREADY to indicate that firmware has
1239 * already been loaded.
1240 */
1241 return -EALREADY;
1242 }
1243
1244 /* The firmware variant determines if the device is in bootloader
1245 * mode or is running operational firmware. The value 0x01 identifies
1246 * the bootloader and the value 0x03 identifies the operational
1247 * firmware.
1248 *
1249 * If the firmware version has changed that means it needs to be reset
1250 * to bootloader when operational so the new firmware can be loaded.
1251 */
1252 if (ver->img_type == BTINTEL_IMG_OP)
1253 return -EINVAL;
1254
1255 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1256 * only RSA secure boot engine. Hence, the corresponding sfi file will
1257 * have RSA header of 644 bytes followed by Command Buffer.
1258 *
1259 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1260 * secure boot engine. As a result, the corresponding sfi file will
1261 * have RSA header of 644, ECDSA header of 320 bytes followed by
1262 * Command Buffer.
1263 *
1264 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1265 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700)
1266 */
1267 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1268 if (css_header_ver != BTINTEL_RSA_HEADER_VER &&
1269 css_header_ver != BTINTEL_HYBRID_HEADER_VER) {
1270 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver);
1271 return -EINVAL;
1272 }
1273
1274 if (hw_variant <= 0x14) {
1275 if (sbe_type != 0x00) {
1276 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1277 hw_variant);
1278 return -EINVAL;
1279 }
1280
1281 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1282 if (err)
1283 return err;
1284
1285 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1286 if (err)
1287 return err;
1288 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) {
1289 /* Check if CSS header for ECDSA follows the RSA header */
1290 if (fw->data[ECDSA_OFFSET] != 0x06)
1291 return -EINVAL;
1292
1293 /* Check if the CSS Header version is ECDSA(0x00020000) */
1294 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1295 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) {
1296 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver);
1297 return -EINVAL;
1298 }
1299
1300 if (sbe_type == 0x00) {
1301 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1302 if (err)
1303 return err;
1304
1305 err = btintel_download_firmware_payload(hdev, fw,
1306 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1307 if (err)
1308 return err;
1309 } else if (sbe_type == 0x01) {
1310 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1311 if (err)
1312 return err;
1313
1314 err = btintel_download_firmware_payload(hdev, fw,
1315 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1316 if (err)
1317 return err;
1318 }
1319 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) {
1320 err = btintel_sfi_hybrid_header_secure_send(hdev, fw);
1321 if (err)
1322 return err;
1323
1324 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET);
1325 if (err)
1326 return err;
1327 }
1328 return 0;
1329 }
1330
btintel_reset_to_bootloader(struct hci_dev * hdev)1331 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1332 {
1333 struct intel_reset params;
1334 struct sk_buff *skb;
1335
1336 /* PCIe transport uses shared hardware reset mechanism for recovery
1337 * which gets triggered in pcie *setup* function on error.
1338 */
1339 if (hdev->bus == HCI_PCI)
1340 return;
1341
1342 /* Send Intel Reset command. This will result in
1343 * re-enumeration of BT controller.
1344 *
1345 * Intel Reset parameter description:
1346 * reset_type : 0x00 (Soft reset),
1347 * 0x01 (Hard reset)
1348 * patch_enable : 0x00 (Do not enable),
1349 * 0x01 (Enable)
1350 * ddc_reload : 0x00 (Do not reload),
1351 * 0x01 (Reload)
1352 * boot_option: 0x00 (Current image),
1353 * 0x01 (Specified boot address)
1354 * boot_param: Boot address
1355 *
1356 */
1357
1358 params.reset_type = 0x01;
1359 params.patch_enable = 0x01;
1360 params.ddc_reload = 0x01;
1361 params.boot_option = 0x00;
1362 params.boot_param = cpu_to_le32(0x00000000);
1363
1364 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params),
1365 ¶ms, HCI_INIT_TIMEOUT);
1366 if (IS_ERR(skb)) {
1367 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1368 PTR_ERR(skb));
1369 return;
1370 }
1371 bt_dev_info(hdev, "Intel reset sent to retry FW download");
1372 kfree_skb(skb);
1373
1374 /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1375 * lines for 2ms when it receives Intel Reset in bootloader mode.
1376 * Whereas, the upcoming Intel BT controllers will hold USB reset
1377 * for 150ms. To keep the delay generic, 150ms is chosen here.
1378 */
1379 msleep(150);
1380 }
1381
btintel_read_debug_features(struct hci_dev * hdev,struct intel_debug_features * features)1382 static int btintel_read_debug_features(struct hci_dev *hdev,
1383 struct intel_debug_features *features)
1384 {
1385 struct sk_buff *skb;
1386 u8 page_no = 1;
1387
1388 /* Intel controller supports two pages, each page is of 128-bit
1389 * feature bit mask. And each bit defines specific feature support
1390 */
1391 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1392 HCI_INIT_TIMEOUT);
1393 if (IS_ERR(skb)) {
1394 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1395 PTR_ERR(skb));
1396 return PTR_ERR(skb);
1397 }
1398
1399 if (skb->len != (sizeof(features->page1) + 3)) {
1400 bt_dev_err(hdev, "Supported features event size mismatch");
1401 kfree_skb(skb);
1402 return -EILSEQ;
1403 }
1404
1405 memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1406
1407 /* Read the supported features page2 if required in future.
1408 */
1409 kfree_skb(skb);
1410 return 0;
1411 }
1412
btintel_set_debug_features(struct hci_dev * hdev,const struct intel_debug_features * features)1413 static int btintel_set_debug_features(struct hci_dev *hdev,
1414 const struct intel_debug_features *features)
1415 {
1416 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
1417 0x00, 0x00, 0x00 };
1418 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1419 u8 trace_enable = 0x02;
1420 struct sk_buff *skb;
1421
1422 if (!features) {
1423 bt_dev_warn(hdev, "Debug features not read");
1424 return -EINVAL;
1425 }
1426
1427 if (!(features->page1[0] & 0x3f)) {
1428 bt_dev_info(hdev, "Telemetry exception format not supported");
1429 return 0;
1430 }
1431
1432 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1433 if (IS_ERR(skb)) {
1434 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1435 PTR_ERR(skb));
1436 return PTR_ERR(skb);
1437 }
1438 kfree_skb(skb);
1439
1440 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1441 if (IS_ERR(skb)) {
1442 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1443 PTR_ERR(skb));
1444 return PTR_ERR(skb);
1445 }
1446 kfree_skb(skb);
1447
1448 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1449 if (IS_ERR(skb)) {
1450 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1451 PTR_ERR(skb));
1452 return PTR_ERR(skb);
1453 }
1454 kfree_skb(skb);
1455
1456 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x",
1457 trace_enable, mask[3]);
1458
1459 return 0;
1460 }
1461
btintel_reset_debug_features(struct hci_dev * hdev,const struct intel_debug_features * features)1462 static int btintel_reset_debug_features(struct hci_dev *hdev,
1463 const struct intel_debug_features *features)
1464 {
1465 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
1466 0x00, 0x00, 0x00 };
1467 u8 trace_enable = 0x00;
1468 struct sk_buff *skb;
1469
1470 if (!features) {
1471 bt_dev_warn(hdev, "Debug features not read");
1472 return -EINVAL;
1473 }
1474
1475 if (!(features->page1[0] & 0x3f)) {
1476 bt_dev_info(hdev, "Telemetry exception format not supported");
1477 return 0;
1478 }
1479
1480 /* Should stop the trace before writing ddc event mask. */
1481 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1482 if (IS_ERR(skb)) {
1483 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)",
1484 PTR_ERR(skb));
1485 return PTR_ERR(skb);
1486 }
1487 kfree_skb(skb);
1488
1489 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1490 if (IS_ERR(skb)) {
1491 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1492 PTR_ERR(skb));
1493 return PTR_ERR(skb);
1494 }
1495 kfree_skb(skb);
1496
1497 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x",
1498 trace_enable, mask[3]);
1499
1500 return 0;
1501 }
1502
btintel_set_quality_report(struct hci_dev * hdev,bool enable)1503 int btintel_set_quality_report(struct hci_dev *hdev, bool enable)
1504 {
1505 struct intel_debug_features features;
1506 int err;
1507
1508 bt_dev_dbg(hdev, "enable %d", enable);
1509
1510 /* Read the Intel supported features and if new exception formats
1511 * supported, need to load the additional DDC config to enable.
1512 */
1513 err = btintel_read_debug_features(hdev, &features);
1514 if (err)
1515 return err;
1516
1517 /* Set or reset the debug features. */
1518 if (enable)
1519 err = btintel_set_debug_features(hdev, &features);
1520 else
1521 err = btintel_reset_debug_features(hdev, &features);
1522
1523 return err;
1524 }
1525 EXPORT_SYMBOL_GPL(btintel_set_quality_report);
1526
btintel_coredump(struct hci_dev * hdev)1527 static void btintel_coredump(struct hci_dev *hdev)
1528 {
1529 struct sk_buff *skb;
1530
1531 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT);
1532 if (IS_ERR(skb)) {
1533 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb));
1534 return;
1535 }
1536
1537 kfree_skb(skb);
1538 }
1539
btintel_dmp_hdr(struct hci_dev * hdev,struct sk_buff * skb)1540 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
1541 {
1542 char buf[80];
1543
1544 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n",
1545 coredump_info.hw_variant);
1546 skb_put_data(skb, buf, strlen(buf));
1547
1548 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n",
1549 coredump_info.fw_build_num);
1550 skb_put_data(skb, buf, strlen(buf));
1551
1552 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name);
1553 skb_put_data(skb, buf, strlen(buf));
1554
1555 snprintf(buf, sizeof(buf), "Vendor: Intel\n");
1556 skb_put_data(skb, buf, strlen(buf));
1557 }
1558
btintel_register_devcoredump_support(struct hci_dev * hdev)1559 static int btintel_register_devcoredump_support(struct hci_dev *hdev)
1560 {
1561 struct intel_debug_features features;
1562 int err;
1563
1564 err = btintel_read_debug_features(hdev, &features);
1565 if (err) {
1566 bt_dev_info(hdev, "Error reading debug features");
1567 return err;
1568 }
1569
1570 if (!(features.page1[0] & 0x3f)) {
1571 bt_dev_dbg(hdev, "Telemetry exception format not supported");
1572 return -EOPNOTSUPP;
1573 }
1574
1575 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL);
1576
1577 return err;
1578 }
1579
btintel_legacy_rom_get_fw(struct hci_dev * hdev,struct intel_version * ver)1580 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1581 struct intel_version *ver)
1582 {
1583 const struct firmware *fw;
1584 char fwname[64];
1585 int ret;
1586
1587 snprintf(fwname, sizeof(fwname),
1588 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1589 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1590 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1591 ver->fw_build_ww, ver->fw_build_yy);
1592
1593 ret = request_firmware(&fw, fwname, &hdev->dev);
1594 if (ret < 0) {
1595 if (ret == -EINVAL) {
1596 bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1597 ret);
1598 return NULL;
1599 }
1600
1601 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1602 fwname, ret);
1603
1604 /* If the correct firmware patch file is not found, use the
1605 * default firmware patch file instead
1606 */
1607 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1608 ver->hw_platform, ver->hw_variant);
1609 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1610 bt_dev_err(hdev, "failed to open default fw file: %s",
1611 fwname);
1612 return NULL;
1613 }
1614 }
1615
1616 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1617
1618 return fw;
1619 }
1620
btintel_legacy_rom_patching(struct hci_dev * hdev,const struct firmware * fw,const u8 ** fw_ptr,int * disable_patch)1621 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1622 const struct firmware *fw,
1623 const u8 **fw_ptr, int *disable_patch)
1624 {
1625 struct sk_buff *skb;
1626 struct hci_command_hdr *cmd;
1627 const u8 *cmd_param;
1628 struct hci_event_hdr *evt = NULL;
1629 const u8 *evt_param = NULL;
1630 int remain = fw->size - (*fw_ptr - fw->data);
1631
1632 /* The first byte indicates the types of the patch command or event.
1633 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1634 * in the current firmware buffer doesn't start with 0x01 or
1635 * the size of remain buffer is smaller than HCI command header,
1636 * the firmware file is corrupted and it should stop the patching
1637 * process.
1638 */
1639 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1640 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1641 return -EINVAL;
1642 }
1643 (*fw_ptr)++;
1644 remain--;
1645
1646 cmd = (struct hci_command_hdr *)(*fw_ptr);
1647 *fw_ptr += sizeof(*cmd);
1648 remain -= sizeof(*cmd);
1649
1650 /* Ensure that the remain firmware data is long enough than the length
1651 * of command parameter. If not, the firmware file is corrupted.
1652 */
1653 if (remain < cmd->plen) {
1654 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1655 return -EFAULT;
1656 }
1657
1658 /* If there is a command that loads a patch in the firmware
1659 * file, then enable the patch upon success, otherwise just
1660 * disable the manufacturer mode, for example patch activation
1661 * is not required when the default firmware patch file is used
1662 * because there are no patch data to load.
1663 */
1664 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1665 *disable_patch = 0;
1666
1667 cmd_param = *fw_ptr;
1668 *fw_ptr += cmd->plen;
1669 remain -= cmd->plen;
1670
1671 /* This reads the expected events when the above command is sent to the
1672 * device. Some vendor commands expects more than one events, for
1673 * example command status event followed by vendor specific event.
1674 * For this case, it only keeps the last expected event. so the command
1675 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1676 * last expected event.
1677 */
1678 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1679 (*fw_ptr)++;
1680 remain--;
1681
1682 evt = (struct hci_event_hdr *)(*fw_ptr);
1683 *fw_ptr += sizeof(*evt);
1684 remain -= sizeof(*evt);
1685
1686 if (remain < evt->plen) {
1687 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1688 return -EFAULT;
1689 }
1690
1691 evt_param = *fw_ptr;
1692 *fw_ptr += evt->plen;
1693 remain -= evt->plen;
1694 }
1695
1696 /* Every HCI commands in the firmware file has its correspond event.
1697 * If event is not found or remain is smaller than zero, the firmware
1698 * file is corrupted.
1699 */
1700 if (!evt || !evt_param || remain < 0) {
1701 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1702 return -EFAULT;
1703 }
1704
1705 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1706 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1707 if (IS_ERR(skb)) {
1708 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1709 cmd->opcode, PTR_ERR(skb));
1710 return PTR_ERR(skb);
1711 }
1712
1713 /* It ensures that the returned event matches the event data read from
1714 * the firmware file. At fist, it checks the length and then
1715 * the contents of the event.
1716 */
1717 if (skb->len != evt->plen) {
1718 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1719 le16_to_cpu(cmd->opcode));
1720 kfree_skb(skb);
1721 return -EFAULT;
1722 }
1723
1724 if (memcmp(skb->data, evt_param, evt->plen)) {
1725 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1726 le16_to_cpu(cmd->opcode));
1727 kfree_skb(skb);
1728 return -EFAULT;
1729 }
1730 kfree_skb(skb);
1731
1732 return 0;
1733 }
1734
btintel_legacy_rom_setup(struct hci_dev * hdev,struct intel_version * ver)1735 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1736 struct intel_version *ver)
1737 {
1738 const struct firmware *fw;
1739 const u8 *fw_ptr;
1740 int disable_patch, err;
1741 struct intel_version new_ver;
1742
1743 BT_DBG("%s", hdev->name);
1744
1745 /* fw_patch_num indicates the version of patch the device currently
1746 * have. If there is no patch data in the device, it is always 0x00.
1747 * So, if it is other than 0x00, no need to patch the device again.
1748 */
1749 if (ver->fw_patch_num) {
1750 bt_dev_info(hdev,
1751 "Intel device is already patched. patch num: %02x",
1752 ver->fw_patch_num);
1753 goto complete;
1754 }
1755
1756 /* Opens the firmware patch file based on the firmware version read
1757 * from the controller. If it fails to open the matching firmware
1758 * patch file, it tries to open the default firmware patch file.
1759 * If no patch file is found, allow the device to operate without
1760 * a patch.
1761 */
1762 fw = btintel_legacy_rom_get_fw(hdev, ver);
1763 if (!fw)
1764 goto complete;
1765 fw_ptr = fw->data;
1766
1767 /* Enable the manufacturer mode of the controller.
1768 * Only while this mode is enabled, the driver can download the
1769 * firmware patch data and configuration parameters.
1770 */
1771 err = btintel_enter_mfg(hdev);
1772 if (err) {
1773 release_firmware(fw);
1774 return err;
1775 }
1776
1777 disable_patch = 1;
1778
1779 /* The firmware data file consists of list of Intel specific HCI
1780 * commands and its expected events. The first byte indicates the
1781 * type of the message, either HCI command or HCI event.
1782 *
1783 * It reads the command and its expected event from the firmware file,
1784 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1785 * the returned event is compared with the event read from the firmware
1786 * file and it will continue until all the messages are downloaded to
1787 * the controller.
1788 *
1789 * Once the firmware patching is completed successfully,
1790 * the manufacturer mode is disabled with reset and activating the
1791 * downloaded patch.
1792 *
1793 * If the firmware patching fails, the manufacturer mode is
1794 * disabled with reset and deactivating the patch.
1795 *
1796 * If the default patch file is used, no reset is done when disabling
1797 * the manufacturer.
1798 */
1799 while (fw->size > fw_ptr - fw->data) {
1800 int ret;
1801
1802 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1803 &disable_patch);
1804 if (ret < 0)
1805 goto exit_mfg_deactivate;
1806 }
1807
1808 release_firmware(fw);
1809
1810 if (disable_patch)
1811 goto exit_mfg_disable;
1812
1813 /* Patching completed successfully and disable the manufacturer mode
1814 * with reset and activate the downloaded firmware patches.
1815 */
1816 err = btintel_exit_mfg(hdev, true, true);
1817 if (err)
1818 return err;
1819
1820 /* Need build number for downloaded fw patches in
1821 * every power-on boot
1822 */
1823 err = btintel_read_version(hdev, &new_ver);
1824 if (err)
1825 return err;
1826
1827 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1828 new_ver.fw_patch_num);
1829
1830 goto complete;
1831
1832 exit_mfg_disable:
1833 /* Disable the manufacturer mode without reset */
1834 err = btintel_exit_mfg(hdev, false, false);
1835 if (err)
1836 return err;
1837
1838 bt_dev_info(hdev, "Intel firmware patch completed");
1839
1840 goto complete;
1841
1842 exit_mfg_deactivate:
1843 release_firmware(fw);
1844
1845 /* Patching failed. Disable the manufacturer mode with reset and
1846 * deactivate the downloaded firmware patches.
1847 */
1848 err = btintel_exit_mfg(hdev, true, false);
1849 if (err)
1850 return err;
1851
1852 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1853
1854 complete:
1855 /* Set the event mask for Intel specific vendor events. This enables
1856 * a few extra events that are useful during general operation.
1857 */
1858 btintel_set_event_mask_mfg(hdev, false);
1859
1860 btintel_check_bdaddr(hdev);
1861
1862 return 0;
1863 }
1864
btintel_download_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1865 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1866 {
1867 ktime_t delta, rettime;
1868 unsigned long long duration;
1869 int err;
1870
1871 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1872
1873 bt_dev_info(hdev, "Waiting for firmware download to complete");
1874
1875 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1876 TASK_INTERRUPTIBLE,
1877 msecs_to_jiffies(msec));
1878 if (err == -EINTR) {
1879 bt_dev_err(hdev, "Firmware loading interrupted");
1880 return err;
1881 }
1882
1883 if (err) {
1884 bt_dev_err(hdev, "Firmware loading timeout");
1885 return -ETIMEDOUT;
1886 }
1887
1888 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1889 bt_dev_err(hdev, "Firmware loading failed");
1890 return -ENOEXEC;
1891 }
1892
1893 rettime = ktime_get();
1894 delta = ktime_sub(rettime, calltime);
1895 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1896
1897 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1898
1899 return 0;
1900 }
1901
btintel_boot_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1902 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1903 {
1904 ktime_t delta, rettime;
1905 unsigned long long duration;
1906 int err;
1907
1908 bt_dev_info(hdev, "Waiting for device to boot");
1909
1910 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1911 TASK_INTERRUPTIBLE,
1912 msecs_to_jiffies(msec));
1913 if (err == -EINTR) {
1914 bt_dev_err(hdev, "Device boot interrupted");
1915 return -EINTR;
1916 }
1917
1918 if (err) {
1919 bt_dev_err(hdev, "Device boot timeout");
1920 return -ETIMEDOUT;
1921 }
1922
1923 rettime = ktime_get();
1924 delta = ktime_sub(rettime, calltime);
1925 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1926
1927 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1928
1929 return 0;
1930 }
1931
btintel_boot_wait_d0(struct hci_dev * hdev,ktime_t calltime,int msec)1932 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime,
1933 int msec)
1934 {
1935 ktime_t delta, rettime;
1936 unsigned long long duration;
1937 int err;
1938
1939 bt_dev_info(hdev, "Waiting for device transition to d0");
1940
1941 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0,
1942 TASK_INTERRUPTIBLE,
1943 msecs_to_jiffies(msec));
1944 if (err == -EINTR) {
1945 bt_dev_err(hdev, "Device d0 move interrupted");
1946 return -EINTR;
1947 }
1948
1949 if (err) {
1950 bt_dev_err(hdev, "Device d0 move timeout");
1951 return -ETIMEDOUT;
1952 }
1953
1954 rettime = ktime_get();
1955 delta = ktime_sub(rettime, calltime);
1956 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1957
1958 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration);
1959
1960 return 0;
1961 }
1962
btintel_boot(struct hci_dev * hdev,u32 boot_addr)1963 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1964 {
1965 ktime_t calltime;
1966 int err;
1967
1968 calltime = ktime_get();
1969
1970 btintel_set_flag(hdev, INTEL_BOOTING);
1971 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0);
1972
1973 err = btintel_send_intel_reset(hdev, boot_addr);
1974 if (err) {
1975 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1976 btintel_reset_to_bootloader(hdev);
1977 return err;
1978 }
1979
1980 /* The bootloader will not indicate when the device is ready. This
1981 * is done by the operational firmware sending bootup notification.
1982 *
1983 * Booting into operational firmware should not take longer than
1984 * 5 second. However if that happens, then just fail the setup
1985 * since something went wrong.
1986 */
1987 err = btintel_boot_wait(hdev, calltime, 5000);
1988 if (err == -ETIMEDOUT) {
1989 btintel_reset_to_bootloader(hdev);
1990 goto exit_error;
1991 }
1992
1993 if (hdev->bus == HCI_PCI) {
1994 /* In case of PCIe, after receiving bootup event, driver performs
1995 * D0 entry by writing 0 to sleep control register (check
1996 * btintel_pcie_recv_event())
1997 * Firmware acks with alive interrupt indicating host is full ready to
1998 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0
1999 * bit is cleared.
2000 */
2001 calltime = ktime_get();
2002 err = btintel_boot_wait_d0(hdev, calltime, 2000);
2003 }
2004
2005 exit_error:
2006 return err;
2007 }
2008
btintel_get_fw_name(struct intel_version * ver,struct intel_boot_params * params,char * fw_name,size_t len,const char * suffix)2009 static int btintel_get_fw_name(struct intel_version *ver,
2010 struct intel_boot_params *params,
2011 char *fw_name, size_t len,
2012 const char *suffix)
2013 {
2014 switch (ver->hw_variant) {
2015 case 0x0b: /* SfP */
2016 case 0x0c: /* WsP */
2017 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
2018 ver->hw_variant,
2019 le16_to_cpu(params->dev_revid),
2020 suffix);
2021 break;
2022 case 0x11: /* JfP */
2023 case 0x12: /* ThP */
2024 case 0x13: /* HrP */
2025 case 0x14: /* CcP */
2026 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
2027 ver->hw_variant,
2028 ver->hw_revision,
2029 ver->fw_revision,
2030 suffix);
2031 break;
2032 default:
2033 return -EINVAL;
2034 }
2035
2036 return 0;
2037 }
2038
btintel_download_fw(struct hci_dev * hdev,struct intel_version * ver,struct intel_boot_params * params,u32 * boot_param)2039 static int btintel_download_fw(struct hci_dev *hdev,
2040 struct intel_version *ver,
2041 struct intel_boot_params *params,
2042 u32 *boot_param)
2043 {
2044 const struct firmware *fw;
2045 char fwname[64];
2046 int err;
2047 ktime_t calltime;
2048
2049 if (!ver || !params)
2050 return -EINVAL;
2051
2052 /* The firmware variant determines if the device is in bootloader
2053 * mode or is running operational firmware. The value 0x06 identifies
2054 * the bootloader and the value 0x23 identifies the operational
2055 * firmware.
2056 *
2057 * When the operational firmware is already present, then only
2058 * the check for valid Bluetooth device address is needed. This
2059 * determines if the device will be added as configured or
2060 * unconfigured controller.
2061 *
2062 * It is not possible to use the Secure Boot Parameters in this
2063 * case since that command is only available in bootloader mode.
2064 */
2065 if (ver->fw_variant == 0x23) {
2066 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2067 btintel_check_bdaddr(hdev);
2068
2069 /* SfP and WsP don't seem to update the firmware version on file
2070 * so version checking is currently possible.
2071 */
2072 switch (ver->hw_variant) {
2073 case 0x0b: /* SfP */
2074 case 0x0c: /* WsP */
2075 return 0;
2076 }
2077
2078 /* Proceed to download to check if the version matches */
2079 goto download;
2080 }
2081
2082 /* Read the secure boot parameters to identify the operating
2083 * details of the bootloader.
2084 */
2085 err = btintel_read_boot_params(hdev, params);
2086 if (err)
2087 return err;
2088
2089 /* It is required that every single firmware fragment is acknowledged
2090 * with a command complete event. If the boot parameters indicate
2091 * that this bootloader does not send them, then abort the setup.
2092 */
2093 if (params->limited_cce != 0x00) {
2094 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
2095 params->limited_cce);
2096 return -EINVAL;
2097 }
2098
2099 /* If the OTP has no valid Bluetooth device address, then there will
2100 * also be no valid address for the operational firmware.
2101 */
2102 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) {
2103 bt_dev_info(hdev, "No device address configured");
2104 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
2105 }
2106
2107 download:
2108 /* With this Intel bootloader only the hardware variant and device
2109 * revision information are used to select the right firmware for SfP
2110 * and WsP.
2111 *
2112 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2113 *
2114 * Currently the supported hardware variants are:
2115 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2116 * 12 (0x0c) for iBT3.5 (WsP)
2117 *
2118 * For ThP/JfP and for future SKU's, the FW name varies based on HW
2119 * variant, HW revision and FW revision, as these are dependent on CNVi
2120 * and RF Combination.
2121 *
2122 * 17 (0x11) for iBT3.5 (JfP)
2123 * 18 (0x12) for iBT3.5 (ThP)
2124 *
2125 * The firmware file name for these will be
2126 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2127 *
2128 */
2129 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
2130 if (err < 0) {
2131 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2132 /* Firmware has already been loaded */
2133 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2134 return 0;
2135 }
2136
2137 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2138 return -EINVAL;
2139 }
2140
2141 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2142 if (err < 0) {
2143 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2144 /* Firmware has already been loaded */
2145 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2146 return 0;
2147 }
2148
2149 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2150 fwname, err);
2151 return err;
2152 }
2153
2154 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2155
2156 if (fw->size < 644) {
2157 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2158 fw->size);
2159 err = -EBADF;
2160 goto done;
2161 }
2162
2163 calltime = ktime_get();
2164
2165 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2166
2167 /* Start firmware downloading and get boot parameter */
2168 err = btintel_download_firmware(hdev, ver, fw, boot_param);
2169 if (err < 0) {
2170 if (err == -EALREADY) {
2171 /* Firmware has already been loaded */
2172 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2173 err = 0;
2174 goto done;
2175 }
2176
2177 /* When FW download fails, send Intel Reset to retry
2178 * FW download.
2179 */
2180 btintel_reset_to_bootloader(hdev);
2181 goto done;
2182 }
2183
2184 /* Before switching the device into operational mode and with that
2185 * booting the loaded firmware, wait for the bootloader notification
2186 * that all fragments have been successfully received.
2187 *
2188 * When the event processing receives the notification, then the
2189 * INTEL_DOWNLOADING flag will be cleared.
2190 *
2191 * The firmware loading should not take longer than 5 seconds
2192 * and thus just timeout if that happens and fail the setup
2193 * of this device.
2194 */
2195 err = btintel_download_wait(hdev, calltime, 5000);
2196 if (err == -ETIMEDOUT)
2197 btintel_reset_to_bootloader(hdev);
2198
2199 done:
2200 release_firmware(fw);
2201 return err;
2202 }
2203
btintel_bootloader_setup(struct hci_dev * hdev,struct intel_version * ver)2204 static int btintel_bootloader_setup(struct hci_dev *hdev,
2205 struct intel_version *ver)
2206 {
2207 struct intel_version new_ver;
2208 struct intel_boot_params params;
2209 u32 boot_param;
2210 char ddcname[64];
2211 int err;
2212
2213 BT_DBG("%s", hdev->name);
2214
2215 /* Set the default boot parameter to 0x0 and it is updated to
2216 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2217 * command while downloading the firmware.
2218 */
2219 boot_param = 0x00000000;
2220
2221 btintel_set_flag(hdev, INTEL_BOOTLOADER);
2222
2223 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param);
2224 if (err)
2225 return err;
2226
2227 /* controller is already having an operational firmware */
2228 if (ver->fw_variant == 0x23)
2229 goto finish;
2230
2231 err = btintel_boot(hdev, boot_param);
2232 if (err)
2233 return err;
2234
2235 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2236
2237 err = btintel_get_fw_name(ver, ¶ms, ddcname,
2238 sizeof(ddcname), "ddc");
2239
2240 if (err < 0) {
2241 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2242 } else {
2243 /* Once the device is running in operational mode, it needs to
2244 * apply the device configuration (DDC) parameters.
2245 *
2246 * The device can work without DDC parameters, so even if it
2247 * fails to load the file, no need to fail the setup.
2248 */
2249 btintel_load_ddc_config(hdev, ddcname);
2250 }
2251
2252 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2253
2254 /* Read the Intel version information after loading the FW */
2255 err = btintel_read_version(hdev, &new_ver);
2256 if (err)
2257 return err;
2258
2259 btintel_version_info(hdev, &new_ver);
2260
2261 finish:
2262 /* Set the event mask for Intel specific vendor events. This enables
2263 * a few extra events that are useful during general operation. It
2264 * does not enable any debugging related events.
2265 *
2266 * The device will function correctly without these events enabled
2267 * and thus no need to fail the setup.
2268 */
2269 btintel_set_event_mask(hdev, false);
2270
2271 return 0;
2272 }
2273
btintel_get_fw_name_tlv(const struct intel_version_tlv * ver,char * fw_name,size_t len,const char * suffix)2274 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
2275 char *fw_name, size_t len,
2276 const char *suffix)
2277 {
2278 const char *format;
2279 u32 cnvi, cnvr;
2280
2281 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2282 INTEL_CNVX_TOP_STEP(ver->cnvi_top));
2283
2284 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2285 INTEL_CNVX_TOP_STEP(ver->cnvr_top));
2286
2287 /* Only Blazar product supports downloading of intermediate loader
2288 * image
2289 */
2290 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) {
2291 u8 zero[BTINTEL_FWID_MAXLEN];
2292
2293 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) {
2294 format = "intel/ibt-%04x-%04x-iml.%s";
2295 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2296 return;
2297 }
2298
2299 memset(zero, 0, sizeof(zero));
2300
2301 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */
2302 if (memcmp(ver->fw_id, zero, sizeof(zero))) {
2303 format = "intel/ibt-%04x-%04x-%s.%s";
2304 snprintf(fw_name, len, format, cnvi, cnvr,
2305 ver->fw_id, suffix);
2306 return;
2307 }
2308 /* If firmware id is not present, fallback to legacy naming
2309 * convention
2310 */
2311 }
2312 /* Fallback to legacy naming convention for other controllers
2313 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2314 */
2315 format = "intel/ibt-%04x-%04x.%s";
2316 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2317 }
2318
btintel_get_iml_tlv(const struct intel_version_tlv * ver,char * fw_name,size_t len,const char * suffix)2319 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver,
2320 char *fw_name, size_t len,
2321 const char *suffix)
2322 {
2323 const char *format;
2324 u32 cnvi, cnvr;
2325
2326 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2327 INTEL_CNVX_TOP_STEP(ver->cnvi_top));
2328
2329 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2330 INTEL_CNVX_TOP_STEP(ver->cnvr_top));
2331
2332 format = "intel/ibt-%04x-%04x-iml.%s";
2333 snprintf(fw_name, len, format, cnvi, cnvr, suffix);
2334 }
2335
btintel_prepare_fw_download_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,u32 * boot_param)2336 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
2337 struct intel_version_tlv *ver,
2338 u32 *boot_param)
2339 {
2340 const struct firmware *fw;
2341 char fwname[128];
2342 int err;
2343 ktime_t calltime;
2344
2345 if (!ver || !boot_param)
2346 return -EINVAL;
2347
2348 /* The firmware variant determines if the device is in bootloader
2349 * mode or is running operational firmware. The value 0x03 identifies
2350 * the bootloader and the value 0x23 identifies the operational
2351 * firmware.
2352 *
2353 * When the operational firmware is already present, then only
2354 * the check for valid Bluetooth device address is needed. This
2355 * determines if the device will be added as configured or
2356 * unconfigured controller.
2357 *
2358 * It is not possible to use the Secure Boot Parameters in this
2359 * case since that command is only available in bootloader mode.
2360 */
2361 if (ver->img_type == BTINTEL_IMG_OP) {
2362 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2363 btintel_check_bdaddr(hdev);
2364 } else {
2365 /*
2366 * Check for valid bd address in boot loader mode. Device
2367 * will be marked as unconfigured if empty bd address is
2368 * found.
2369 */
2370 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2371 bt_dev_info(hdev, "No device address configured");
2372 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR);
2373 }
2374 }
2375
2376 if (ver->img_type == BTINTEL_IMG_OP) {
2377 /* Controller running OP image. In case of FW downgrade,
2378 * FWID TLV may not be present and driver may attempt to load
2379 * firmware image which doesn't exist. Lets compare the version
2380 * of IML image
2381 */
2382 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e)
2383 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi");
2384 else
2385 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2386 } else {
2387 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2388 }
2389
2390 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2391 if (err < 0) {
2392 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2393 /* Firmware has already been loaded */
2394 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2395 return 0;
2396 }
2397
2398 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2399 fwname, err);
2400
2401 return err;
2402 }
2403
2404 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2405
2406 if (fw->size < 644) {
2407 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2408 fw->size);
2409 err = -EBADF;
2410 goto done;
2411 }
2412
2413 calltime = ktime_get();
2414
2415 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2416
2417 /* Start firmware downloading and get boot parameter */
2418 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2419 INTEL_HW_VARIANT(ver->cnvi_bt),
2420 ver->sbe_type);
2421 if (err < 0) {
2422 if (err == -EALREADY) {
2423 /* Firmware has already been loaded */
2424 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2425 err = 0;
2426 goto done;
2427 }
2428
2429 /* When FW download fails, send Intel Reset to retry
2430 * FW download.
2431 */
2432 btintel_reset_to_bootloader(hdev);
2433 goto done;
2434 }
2435
2436 /* Before switching the device into operational mode and with that
2437 * booting the loaded firmware, wait for the bootloader notification
2438 * that all fragments have been successfully received.
2439 *
2440 * When the event processing receives the notification, then the
2441 * BTUSB_DOWNLOADING flag will be cleared.
2442 *
2443 * The firmware loading should not take longer than 5 seconds
2444 * and thus just timeout if that happens and fail the setup
2445 * of this device.
2446 */
2447 err = btintel_download_wait(hdev, calltime, 5000);
2448 if (err == -ETIMEDOUT)
2449 btintel_reset_to_bootloader(hdev);
2450
2451 done:
2452 release_firmware(fw);
2453 return err;
2454 }
2455
btintel_get_codec_config_data(struct hci_dev * hdev,__u8 link,struct bt_codec * codec,__u8 * ven_len,__u8 ** ven_data)2456 static int btintel_get_codec_config_data(struct hci_dev *hdev,
2457 __u8 link, struct bt_codec *codec,
2458 __u8 *ven_len, __u8 **ven_data)
2459 {
2460 int err = 0;
2461
2462 if (!ven_data || !ven_len)
2463 return -EINVAL;
2464
2465 *ven_len = 0;
2466 *ven_data = NULL;
2467
2468 if (link != ESCO_LINK) {
2469 bt_dev_err(hdev, "Invalid link type(%u)", link);
2470 return -EINVAL;
2471 }
2472
2473 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
2474 if (!*ven_data) {
2475 err = -ENOMEM;
2476 goto error;
2477 }
2478
2479 /* supports only CVSD and mSBC offload codecs */
2480 switch (codec->id) {
2481 case 0x02:
2482 **ven_data = 0x00;
2483 break;
2484 case 0x05:
2485 **ven_data = 0x01;
2486 break;
2487 default:
2488 err = -EINVAL;
2489 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
2490 goto error;
2491 }
2492 /* codec and its capabilities are pre-defined to ids
2493 * preset id = 0x00 represents CVSD codec with sampling rate 8K
2494 * preset id = 0x01 represents mSBC codec with sampling rate 16K
2495 */
2496 *ven_len = sizeof(__u8);
2497 return err;
2498
2499 error:
2500 kfree(*ven_data);
2501 *ven_data = NULL;
2502 return err;
2503 }
2504
btintel_get_data_path_id(struct hci_dev * hdev,__u8 * data_path_id)2505 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
2506 {
2507 /* Intel uses 1 as data path id for all the usecases */
2508 *data_path_id = 1;
2509 return 0;
2510 }
2511
btintel_configure_offload(struct hci_dev * hdev)2512 static int btintel_configure_offload(struct hci_dev *hdev)
2513 {
2514 struct sk_buff *skb;
2515 int err = 0;
2516 struct intel_offload_use_cases *use_cases;
2517
2518 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT);
2519 if (IS_ERR(skb)) {
2520 bt_dev_err(hdev, "Reading offload use cases failed (%ld)",
2521 PTR_ERR(skb));
2522 return PTR_ERR(skb);
2523 }
2524
2525 if (skb->len < sizeof(*use_cases)) {
2526 err = -EIO;
2527 goto error;
2528 }
2529
2530 use_cases = (void *)skb->data;
2531
2532 if (use_cases->status) {
2533 err = -bt_to_errno(skb->data[0]);
2534 goto error;
2535 }
2536
2537 if (use_cases->preset[0] & 0x03) {
2538 hdev->get_data_path_id = btintel_get_data_path_id;
2539 hdev->get_codec_config_data = btintel_get_codec_config_data;
2540 }
2541 error:
2542 kfree_skb(skb);
2543 return err;
2544 }
2545
btintel_set_ppag(struct hci_dev * hdev,struct intel_version_tlv * ver)2546 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver)
2547 {
2548 struct sk_buff *skb;
2549 struct hci_ppag_enable_cmd ppag_cmd;
2550 acpi_handle handle;
2551 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
2552 union acpi_object *p, *elements;
2553 u32 domain, mode;
2554 acpi_status status;
2555
2556 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */
2557 switch (ver->cnvr_top & 0xFFF) {
2558 case 0x504: /* Hrp2 */
2559 case 0x202: /* Jfp2 */
2560 case 0x201: /* Jfp1 */
2561 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)",
2562 ver->cnvr_top & 0xFFF);
2563 return;
2564 }
2565
2566 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2567 if (!handle) {
2568 bt_dev_info(hdev, "No support for BT device in ACPI firmware");
2569 return;
2570 }
2571
2572 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer);
2573 if (ACPI_FAILURE(status)) {
2574 if (status == AE_NOT_FOUND) {
2575 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found");
2576 return;
2577 }
2578 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status));
2579 return;
2580 }
2581
2582 p = buffer.pointer;
2583 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) {
2584 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d",
2585 p->type, p->package.count);
2586 kfree(buffer.pointer);
2587 return;
2588 }
2589
2590 elements = p->package.elements;
2591
2592 /* PPAG table is located at element[1] */
2593 p = &elements[1];
2594
2595 domain = (u32)p->package.elements[0].integer.value;
2596 mode = (u32)p->package.elements[1].integer.value;
2597 kfree(buffer.pointer);
2598
2599 if (domain != 0x12) {
2600 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware");
2601 return;
2602 }
2603
2604 /* PPAG mode
2605 * BIT 0 : 0 Disabled in EU
2606 * 1 Enabled in EU
2607 * BIT 1 : 0 Disabled in China
2608 * 1 Enabled in China
2609 */
2610 mode &= 0x03;
2611
2612 if (!mode) {
2613 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS");
2614 return;
2615 }
2616
2617 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode);
2618
2619 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd),
2620 &ppag_cmd, HCI_CMD_TIMEOUT);
2621 if (IS_ERR(skb)) {
2622 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb));
2623 return;
2624 }
2625 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode);
2626 kfree_skb(skb);
2627 }
2628
btintel_acpi_reset_method(struct hci_dev * hdev)2629 int btintel_acpi_reset_method(struct hci_dev *hdev)
2630 {
2631 int ret = 0;
2632 acpi_status status;
2633 union acpi_object *p, *ref;
2634 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
2635
2636 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer);
2637 if (ACPI_FAILURE(status) || !buffer.pointer) {
2638 bt_dev_err(hdev, "Failed to run _PRR method");
2639 ret = -ENODEV;
2640 return ret;
2641 }
2642 p = buffer.pointer;
2643
2644 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) {
2645 bt_dev_err(hdev, "Invalid arguments");
2646 ret = -EINVAL;
2647 goto exit_on_error;
2648 }
2649
2650 ref = &p->package.elements[0];
2651 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) {
2652 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type);
2653 ret = -EINVAL;
2654 goto exit_on_error;
2655 }
2656
2657 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL);
2658 if (ACPI_FAILURE(status)) {
2659 bt_dev_err(hdev, "Failed to run_RST method");
2660 ret = -ENODEV;
2661 goto exit_on_error;
2662 }
2663
2664 exit_on_error:
2665 kfree(buffer.pointer);
2666 return ret;
2667 }
2668 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method);
2669
btintel_set_dsm_reset_method(struct hci_dev * hdev,struct intel_version_tlv * ver_tlv)2670 static void btintel_set_dsm_reset_method(struct hci_dev *hdev,
2671 struct intel_version_tlv *ver_tlv)
2672 {
2673 struct btintel_data *data = hci_get_priv(hdev);
2674 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2675 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00};
2676 union acpi_object *obj, argv4;
2677 enum {
2678 RESET_TYPE_WDISABLE2,
2679 RESET_TYPE_VSEC
2680 };
2681
2682 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2683
2684 if (!handle) {
2685 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware");
2686 return;
2687 }
2688
2689 if (!acpi_has_method(handle, "_PRR")) {
2690 bt_dev_err(hdev, "No support for _PRR ACPI method");
2691 return;
2692 }
2693
2694 switch (ver_tlv->cnvi_top & 0xfff) {
2695 case 0x910: /* GalePeak2 */
2696 reset_payload[2] = RESET_TYPE_VSEC;
2697 break;
2698 default:
2699 /* WDISABLE2 is the default reset method */
2700 reset_payload[2] = RESET_TYPE_WDISABLE2;
2701
2702 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0,
2703 BIT(DSM_SET_WDISABLE2_DELAY))) {
2704 bt_dev_err(hdev, "No dsm support to set reset delay");
2705 return;
2706 }
2707 argv4.integer.type = ACPI_TYPE_INTEGER;
2708 /* delay required to toggle BT power */
2709 argv4.integer.value = 160;
2710 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0,
2711 DSM_SET_WDISABLE2_DELAY, &argv4);
2712 if (!obj) {
2713 bt_dev_err(hdev, "Failed to call dsm to set reset delay");
2714 return;
2715 }
2716 ACPI_FREE(obj);
2717 }
2718
2719 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]);
2720
2721 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0,
2722 DSM_SET_RESET_METHOD)) {
2723 bt_dev_warn(hdev, "No support for dsm to set reset method");
2724 return;
2725 }
2726 argv4.buffer.type = ACPI_TYPE_BUFFER;
2727 argv4.buffer.length = sizeof(reset_payload);
2728 argv4.buffer.pointer = reset_payload;
2729
2730 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0,
2731 DSM_SET_RESET_METHOD, &argv4);
2732 if (!obj) {
2733 bt_dev_err(hdev, "Failed to call dsm to set reset method");
2734 return;
2735 }
2736 ACPI_FREE(obj);
2737 data->acpi_reset_method = btintel_acpi_reset_method;
2738 }
2739
2740 #define BTINTEL_ISODATA_HANDLE_BASE 0x900
2741
btintel_classify_pkt_type(struct hci_dev * hdev,struct sk_buff * skb)2742 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
2743 {
2744 /*
2745 * Distinguish ISO data packets form ACL data packets
2746 * based on their connection handle value range.
2747 */
2748 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) {
2749 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE)
2750 return HCI_ISODATA_PKT;
2751 }
2752
2753 return hci_skb_pkt_type(skb);
2754 }
2755
2756 /*
2757 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms
2758 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to
2759 * overcome the potential STEP errors on their designs. Based on the
2760 * configauration, bluetooth firmware shall adjust the BRI response line drive
2761 * strength. The below structure represents DSBR data.
2762 * struct {
2763 * u8 header;
2764 * u32 dsbr;
2765 * } __packed;
2766 *
2767 * header - defines revision number of the structure
2768 * dsbr - defines drive strength BRI response
2769 * bit0
2770 * 0 - instructs bluetooth firmware to use default values
2771 * 1 - instructs bluetooth firmware to override default values
2772 * bit3:1
2773 * Reserved
2774 * bit7:4
2775 * DSBR override values (only if bit0 is set. Default value is 0xF
2776 * bit31:7
2777 * Reserved
2778 * Expected values for dsbr field:
2779 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm
2780 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm
2781 * 3. Non existing UEFI variable or invalid (none of the above) - indicates
2782 * that the resistor on board is 10 Ohm
2783 * Even if uefi variable is not present, driver shall send 0xfc0a command to
2784 * firmware to use default values.
2785 *
2786 */
btintel_uefi_get_dsbr(u32 * dsbr_var)2787 static int btintel_uefi_get_dsbr(u32 *dsbr_var)
2788 {
2789 struct btintel_dsbr {
2790 u8 header;
2791 u32 dsbr;
2792 } __packed data;
2793
2794 efi_status_t status;
2795 unsigned long data_size = sizeof(data);
2796 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03,
2797 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31);
2798
2799 if (!IS_ENABLED(CONFIG_EFI))
2800 return -EOPNOTSUPP;
2801
2802 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
2803 return -EOPNOTSUPP;
2804
2805 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size,
2806 &data);
2807
2808 if (status != EFI_SUCCESS || data_size != sizeof(data))
2809 return -ENXIO;
2810
2811 *dsbr_var = data.dsbr;
2812 return 0;
2813 }
2814
btintel_set_dsbr(struct hci_dev * hdev,struct intel_version_tlv * ver)2815 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver)
2816 {
2817 struct btintel_dsbr_cmd {
2818 u8 enable;
2819 u8 dsbr;
2820 } __packed;
2821
2822 struct btintel_dsbr_cmd cmd;
2823 struct sk_buff *skb;
2824 u32 dsbr;
2825 u8 status, hw_variant;
2826 int err;
2827
2828 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt);
2829 /* DSBR command needs to be sent for,
2830 * 1. BlazarI or BlazarIW + B0 step product in IML image.
2831 * 2. Gale Peak2 or BlazarU in OP image.
2832 * 3. Scorpious Peak in IML image.
2833 * 4. Scorpious Peak2 onwards + PCIe transport in IML image.
2834 */
2835
2836 switch (hw_variant) {
2837 case BTINTEL_HWID_BZRI:
2838 case BTINTEL_HWID_BZRIW:
2839 if (ver->img_type == BTINTEL_IMG_IML &&
2840 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01)
2841 break;
2842 return 0;
2843 case BTINTEL_HWID_GAP:
2844 case BTINTEL_HWID_BZRU:
2845 if (ver->img_type == BTINTEL_IMG_OP &&
2846 hdev->bus == HCI_USB)
2847 break;
2848 return 0;
2849 case BTINTEL_HWID_SCP:
2850 if (ver->img_type == BTINTEL_IMG_IML)
2851 break;
2852 return 0;
2853 default:
2854 /* Scorpius Peak2 onwards */
2855 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI
2856 && ver->img_type == BTINTEL_IMG_IML)
2857 break;
2858 return 0;
2859 }
2860
2861 dsbr = 0;
2862 err = btintel_uefi_get_dsbr(&dsbr);
2863 if (err < 0)
2864 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)",
2865 BTINTEL_EFI_DSBR, err);
2866
2867 cmd.enable = dsbr & BIT(0);
2868 cmd.dsbr = dsbr >> 4 & 0xF;
2869
2870 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable,
2871 cmd.dsbr);
2872
2873 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT);
2874 if (IS_ERR(skb))
2875 return -bt_to_errno(PTR_ERR(skb));
2876
2877 status = skb->data[0];
2878 kfree_skb(skb);
2879
2880 if (status)
2881 return -bt_to_errno(status);
2882
2883 return 0;
2884 }
2885
2886 #ifdef CONFIG_ACPI
btintel_evaluate_acpi_method(struct hci_dev * hdev,acpi_string method,union acpi_object ** ptr,u8 pkg_size)2887 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev,
2888 acpi_string method,
2889 union acpi_object **ptr,
2890 u8 pkg_size)
2891 {
2892 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
2893 union acpi_object *p;
2894 acpi_status status;
2895 acpi_handle handle;
2896
2897 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
2898 if (!handle) {
2899 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device");
2900 return AE_NOT_EXIST;
2901 }
2902
2903 status = acpi_evaluate_object(handle, method, NULL, &buffer);
2904
2905 if (ACPI_FAILURE(status)) {
2906 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s",
2907 acpi_format_exception(status), method);
2908 return status;
2909 }
2910
2911 p = buffer.pointer;
2912
2913 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) {
2914 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d",
2915 p->type, p->package.count);
2916 kfree(buffer.pointer);
2917 return AE_ERROR;
2918 }
2919
2920 *ptr = buffer.pointer;
2921 return 0;
2922 }
2923
btintel_acpi_get_bt_pkg(union acpi_object * buffer)2924 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer)
2925 {
2926 union acpi_object *domain, *bt_pkg;
2927 int i;
2928
2929 for (i = 1; i < buffer->package.count; i++) {
2930 bt_pkg = &buffer->package.elements[i];
2931 domain = &bt_pkg->package.elements[0];
2932 if (domain->type == ACPI_TYPE_INTEGER &&
2933 domain->integer.value == BTINTEL_BT_DOMAIN)
2934 return bt_pkg;
2935 }
2936 return ERR_PTR(-ENOENT);
2937 }
2938
btintel_send_sar_ddc(struct hci_dev * hdev,struct btintel_cp_ddc_write * data,u8 len)2939 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len)
2940 {
2941 struct sk_buff *skb;
2942
2943 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT);
2944 if (IS_ERR(skb)) {
2945 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)",
2946 le16_to_cpu(data->id), PTR_ERR(skb));
2947 return PTR_ERR(skb);
2948 }
2949 kfree_skb(skb);
2950 return 0;
2951 }
2952
btintel_send_edr(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2953 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2954 int id, struct btintel_sar_inc_pwr *sar)
2955 {
2956 cmd->len = 5;
2957 cmd->id = cpu_to_le16(id);
2958 cmd->data[0] = sar->br >> 3;
2959 cmd->data[1] = sar->edr2 >> 3;
2960 cmd->data[2] = sar->edr3 >> 3;
2961 return btintel_send_sar_ddc(hdev, cmd, 6);
2962 }
2963
btintel_send_le(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2964 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2965 int id, struct btintel_sar_inc_pwr *sar)
2966 {
2967 cmd->len = 3;
2968 cmd->id = cpu_to_le16(id);
2969 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3;
2970 return btintel_send_sar_ddc(hdev, cmd, 4);
2971 }
2972
btintel_send_br(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2973 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2974 int id, struct btintel_sar_inc_pwr *sar)
2975 {
2976 cmd->len = 3;
2977 cmd->id = cpu_to_le16(id);
2978 cmd->data[0] = sar->br >> 3;
2979 return btintel_send_sar_ddc(hdev, cmd, 4);
2980 }
2981
btintel_send_br_mutual(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2982 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2983 int id, struct btintel_sar_inc_pwr *sar)
2984 {
2985 cmd->len = 3;
2986 cmd->id = cpu_to_le16(id);
2987 cmd->data[0] = sar->br;
2988 return btintel_send_sar_ddc(hdev, cmd, 4);
2989 }
2990
btintel_send_edr2(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)2991 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
2992 int id, struct btintel_sar_inc_pwr *sar)
2993 {
2994 cmd->len = 3;
2995 cmd->id = cpu_to_le16(id);
2996 cmd->data[0] = sar->edr2;
2997 return btintel_send_sar_ddc(hdev, cmd, 4);
2998 }
2999
btintel_send_edr3(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,int id,struct btintel_sar_inc_pwr * sar)3000 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd,
3001 int id, struct btintel_sar_inc_pwr *sar)
3002 {
3003 cmd->len = 3;
3004 cmd->id = cpu_to_le16(id);
3005 cmd->data[0] = sar->edr3;
3006 return btintel_send_sar_ddc(hdev, cmd, 4);
3007 }
3008
btintel_set_legacy_sar(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar)3009 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar)
3010 {
3011 struct btintel_cp_ddc_write *cmd;
3012 u8 buffer[64];
3013 int ret;
3014
3015 cmd = (void *)buffer;
3016 ret = btintel_send_br(hdev, cmd, 0x0131, sar);
3017 if (ret)
3018 return ret;
3019
3020 ret = btintel_send_br(hdev, cmd, 0x0132, sar);
3021 if (ret)
3022 return ret;
3023
3024 ret = btintel_send_le(hdev, cmd, 0x0133, sar);
3025 if (ret)
3026 return ret;
3027
3028 ret = btintel_send_edr(hdev, cmd, 0x0137, sar);
3029 if (ret)
3030 return ret;
3031
3032 ret = btintel_send_edr(hdev, cmd, 0x0138, sar);
3033 if (ret)
3034 return ret;
3035
3036 ret = btintel_send_edr(hdev, cmd, 0x013b, sar);
3037 if (ret)
3038 return ret;
3039
3040 ret = btintel_send_edr(hdev, cmd, 0x013c, sar);
3041
3042 return ret;
3043 }
3044
btintel_set_mutual_sar(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar)3045 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar)
3046 {
3047 struct btintel_cp_ddc_write *cmd;
3048 struct sk_buff *skb;
3049 u8 buffer[64];
3050 bool enable;
3051 int ret;
3052
3053 cmd = (void *)buffer;
3054
3055 cmd->len = 3;
3056 cmd->id = cpu_to_le16(0x019e);
3057
3058 if (sar->revision == BTINTEL_SAR_INC_PWR &&
3059 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED)
3060 cmd->data[0] = 0x01;
3061 else
3062 cmd->data[0] = 0x00;
3063
3064 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3065 if (ret)
3066 return ret;
3067
3068 if (sar->revision == BTINTEL_SAR_INC_PWR &&
3069 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) {
3070 cmd->len = 3;
3071 cmd->id = cpu_to_le16(0x019f);
3072 cmd->data[0] = sar->sar_2400_chain_a;
3073
3074 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3075 if (ret)
3076 return ret;
3077 }
3078
3079 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar);
3080 if (ret)
3081 return ret;
3082
3083 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar);
3084 if (ret)
3085 return ret;
3086
3087 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar);
3088 if (ret)
3089 return ret;
3090
3091 ret = btintel_send_le(hdev, cmd, 0x01a3, sar);
3092 if (ret)
3093 return ret;
3094
3095 enable = true;
3096 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT);
3097 if (IS_ERR(skb)) {
3098 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb));
3099 return PTR_ERR(skb);
3100 }
3101
3102 kfree_skb(skb);
3103 return 0;
3104 }
3105
3106 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band
3107 *
3108 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value].
3109 * cmd->len = 4 (2 id + 2 data)
3110 * HCI total = 5 bytes (1 len + 4)
3111 */
btintel_send_sar_rev2_band(struct hci_dev * hdev,struct btintel_cp_ddc_write * cmd,u16 id,u8 chain_a,u8 chain_b)3112 static int btintel_send_sar_rev2_band(struct hci_dev *hdev,
3113 struct btintel_cp_ddc_write *cmd,
3114 u16 id, u8 chain_a, u8 chain_b)
3115 {
3116 cmd->len = 4;
3117 cmd->id = cpu_to_le16(id);
3118 cmd->data[0] = chain_a;
3119 cmd->data[1] = chain_b;
3120 return btintel_send_sar_ddc(hdev, cmd, 5);
3121 }
3122
btintel_set_sar_rev2(struct hci_dev * hdev,struct btintel_sar_rev2 * sar)3123 static int btintel_set_sar_rev2(struct hci_dev *hdev,
3124 struct btintel_sar_rev2 *sar)
3125 {
3126 struct btintel_cp_ddc_write *cmd;
3127 struct sk_buff *skb;
3128 u8 buffer[64];
3129 u8 enable;
3130 int ret;
3131
3132 cmd = (void *)buffer;
3133
3134 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */
3135 cmd->len = 3;
3136 cmd->id = cpu_to_le16(0x019e);
3137 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ?
3138 0x01 : 0x00;
3139 ret = btintel_send_sar_ddc(hdev, cmd, 4);
3140 if (ret)
3141 return ret;
3142
3143 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */
3144 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311,
3145 sar->chain_a.subband_2g4,
3146 sar->chain_b.subband_2g4);
3147 if (ret)
3148 return ret;
3149
3150 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312,
3151 sar->chain_a.subband_5g2,
3152 sar->chain_b.subband_5g2);
3153 if (ret)
3154 return ret;
3155
3156 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */
3157 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313,
3158 sar->chain_a.subband_5g8_5g9,
3159 sar->chain_b.subband_5g8_5g9);
3160 if (ret)
3161 return ret;
3162
3163 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314,
3164 sar->chain_a.subband_5g8_5g9,
3165 sar->chain_b.subband_5g8_5g9);
3166 if (ret)
3167 return ret;
3168
3169 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315,
3170 sar->chain_a.subband_6g1,
3171 sar->chain_b.subband_6g1);
3172 if (ret)
3173 return ret;
3174
3175 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316,
3176 sar->chain_a.subband_6g3,
3177 sar->chain_b.subband_6g3);
3178 if (ret)
3179 return ret;
3180
3181 /* Notify firmware that SAR initialisation is complete */
3182 enable = 0x01;
3183 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT);
3184 if (IS_ERR(skb)) {
3185 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)",
3186 PTR_ERR(skb));
3187 return PTR_ERR(skb);
3188 }
3189
3190 kfree_skb(skb);
3191 return 0;
3192 }
3193
btintel_sar_rev2_send_to_device(struct hci_dev * hdev,struct btintel_sar_rev2 * sar,struct intel_version_tlv * ver)3194 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev,
3195 struct btintel_sar_rev2 *sar,
3196 struct intel_version_tlv *ver)
3197 {
3198 u16 cnvi = ver->cnvi_top & 0xfff;
3199 u16 cnvr = ver->cnvr_top & 0xfff;
3200
3201 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) {
3202 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)",
3203 cnvi, cnvr);
3204 return -EOPNOTSUPP;
3205 }
3206
3207 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2");
3208 return btintel_set_sar_rev2(hdev, sar);
3209 }
3210
btintel_sar_send_to_device(struct hci_dev * hdev,struct btintel_sar_inc_pwr * sar,struct intel_version_tlv * ver)3211 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar,
3212 struct intel_version_tlv *ver)
3213 {
3214 u16 cnvi, cnvr;
3215 int ret;
3216
3217 cnvi = ver->cnvi_top & 0xfff;
3218 cnvr = ver->cnvr_top & 0xfff;
3219
3220 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) {
3221 bt_dev_info(hdev, "Applying legacy Bluetooth SAR");
3222 ret = btintel_set_legacy_sar(hdev, sar);
3223 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) {
3224 bt_dev_info(hdev, "Applying mutual Bluetooth SAR");
3225 ret = btintel_set_mutual_sar(hdev, sar);
3226 } else {
3227 ret = -EOPNOTSUPP;
3228 }
3229
3230 return ret;
3231 }
3232
btintel_acpi_set_sar(struct hci_dev * hdev,struct intel_version_tlv * ver)3233 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver)
3234 {
3235 union acpi_object *bt_pkg, *buffer = NULL;
3236 struct btintel_sar_inc_pwr sar;
3237 struct btintel_sar_rev2 sar_rev2;
3238 acpi_status status;
3239 u8 revision;
3240 int ret;
3241
3242 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2);
3243 if (ACPI_FAILURE(status))
3244 return -ENOENT;
3245
3246 bt_pkg = btintel_acpi_get_bt_pkg(buffer);
3247
3248 if (IS_ERR(bt_pkg)) {
3249 ret = PTR_ERR(bt_pkg);
3250 goto error;
3251 }
3252
3253 if (!bt_pkg->package.count) {
3254 ret = -EINVAL;
3255 goto error;
3256 }
3257
3258 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) {
3259 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field");
3260 ret = -EINVAL;
3261 goto error;
3262 }
3263
3264 revision = buffer->package.elements[0].integer.value;
3265
3266 if (revision > BTINTEL_SAR_REV2) {
3267 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision);
3268 ret = -EOPNOTSUPP;
3269 goto error;
3270 }
3271
3272 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) {
3273 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12),
3274 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32),
3275 * 3..12 = per-chain sub-band limits (u8 each).
3276 */
3277 static const u64 rev2_max[13] = {
3278 U8_MAX, /* domain ID */
3279 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */
3280 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */
3281 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */
3282 };
3283 union acpi_object *e;
3284 int i;
3285
3286 for (i = 0; i < 13; i++) {
3287 e = &bt_pkg->package.elements[i];
3288 if (e->type != ACPI_TYPE_INTEGER) {
3289 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d",
3290 i);
3291 ret = -EINVAL;
3292 goto error;
3293 }
3294 if (e->integer.value > rev2_max[i]) {
3295 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range",
3296 i, e->integer.value);
3297 ret = -ERANGE;
3298 goto error;
3299 }
3300 }
3301
3302 memset(&sar_rev2, 0, sizeof(sar_rev2));
3303 sar_rev2.revision = revision;
3304 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3305
3306 if (sar_rev2.bt_sar_bios != 1) {
3307 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled");
3308 ret = -EOPNOTSUPP;
3309 goto error;
3310 }
3311
3312 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value;
3313
3314 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value;
3315 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value;
3316 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value;
3317 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value;
3318 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value;
3319
3320 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value;
3321 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value;
3322 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value;
3323 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value;
3324 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value;
3325
3326 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u",
3327 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode);
3328 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
3329 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2,
3330 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1,
3331 sar_rev2.chain_a.subband_6g3);
3332 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u",
3333 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2,
3334 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1,
3335 sar_rev2.chain_b.subband_6g3);
3336
3337 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver);
3338 goto error;
3339 }
3340
3341 if (revision == BTINTEL_SAR_REV2) {
3342 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)",
3343 bt_pkg->package.count);
3344 ret = -EINVAL;
3345 goto error;
3346 }
3347
3348 memset(&sar, 0, sizeof(sar));
3349
3350 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) {
3351 sar.revision = revision;
3352 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3353 sar.br = bt_pkg->package.elements[2].integer.value;
3354 sar.edr2 = bt_pkg->package.elements[3].integer.value;
3355 sar.edr3 = bt_pkg->package.elements[4].integer.value;
3356 sar.le = bt_pkg->package.elements[5].integer.value;
3357 sar.le_2mhz = bt_pkg->package.elements[6].integer.value;
3358 sar.le_lr = bt_pkg->package.elements[7].integer.value;
3359
3360 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) {
3361 sar.revision = revision;
3362 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value;
3363 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value;
3364 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value;
3365 sar.br = bt_pkg->package.elements[4].integer.value;
3366 sar.edr2 = bt_pkg->package.elements[5].integer.value;
3367 sar.edr3 = bt_pkg->package.elements[6].integer.value;
3368 sar.le = bt_pkg->package.elements[7].integer.value;
3369 sar.le_2mhz = bt_pkg->package.elements[8].integer.value;
3370 sar.le_lr = bt_pkg->package.elements[9].integer.value;
3371 } else {
3372 ret = -EINVAL;
3373 goto error;
3374 }
3375
3376 /* Apply only if it is enabled in BIOS */
3377 if (sar.bt_sar_bios != 1) {
3378 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled");
3379 ret = -EOPNOTSUPP;
3380 goto error;
3381 }
3382
3383 ret = btintel_sar_send_to_device(hdev, &sar, ver);
3384 error:
3385 kfree(buffer);
3386 return ret;
3387 }
3388 #endif /* CONFIG_ACPI */
3389
btintel_set_specific_absorption_rate(struct hci_dev * hdev,struct intel_version_tlv * ver)3390 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev,
3391 struct intel_version_tlv *ver)
3392 {
3393 #ifdef CONFIG_ACPI
3394 return btintel_acpi_set_sar(hdev, ver);
3395 #endif
3396 return 0;
3397 }
3398
btintel_bootloader_setup_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver)3399 int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
3400 struct intel_version_tlv *ver)
3401 {
3402 u32 boot_param;
3403 char ddcname[64];
3404 int err;
3405 struct intel_version_tlv new_ver;
3406
3407 bt_dev_dbg(hdev, "");
3408
3409 /* Set the default boot parameter to 0x0 and it is updated to
3410 * SKU specific boot parameter after reading Intel_Write_Boot_Params
3411 * command while downloading the firmware.
3412 */
3413 boot_param = 0x00000000;
3414
3415 /* In case of PCIe, this function might get called multiple times with
3416 * same hdev instance if there is any error on firmware download.
3417 * Need to clear stale bits of previous firmware download attempt.
3418 */
3419 for (int i = 0; i < __INTEL_NUM_FLAGS; i++)
3420 btintel_clear_flag(hdev, i);
3421
3422 btintel_set_flag(hdev, INTEL_BOOTLOADER);
3423
3424 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
3425 if (err)
3426 return err;
3427
3428 /* check if controller is already having an operational firmware */
3429 if (ver->img_type == BTINTEL_IMG_OP)
3430 goto finish;
3431
3432 err = btintel_boot(hdev, boot_param);
3433 if (err)
3434 return err;
3435
3436 err = btintel_read_version_tlv(hdev, ver);
3437 if (err)
3438 return err;
3439
3440 /* set drive strength of BRI response */
3441 err = btintel_set_dsbr(hdev, ver);
3442 if (err) {
3443 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err);
3444 return err;
3445 }
3446
3447 /* If image type returned is BTINTEL_IMG_IML, then controller supports
3448 * intermediate loader image
3449 */
3450 if (ver->img_type == BTINTEL_IMG_IML) {
3451 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
3452 if (err)
3453 return err;
3454
3455 err = btintel_boot(hdev, boot_param);
3456 if (err)
3457 return err;
3458 }
3459
3460 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
3461
3462 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
3463 /* Once the device is running in operational mode, it needs to
3464 * apply the device configuration (DDC) parameters.
3465 *
3466 * The device can work without DDC parameters, so even if it
3467 * fails to load the file, no need to fail the setup.
3468 */
3469 btintel_load_ddc_config(hdev, ddcname);
3470
3471 /* Read supported use cases and set callbacks to fetch datapath id */
3472 btintel_configure_offload(hdev);
3473
3474 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
3475
3476 /* Send sar values to controller */
3477 btintel_set_specific_absorption_rate(hdev, ver);
3478
3479 /* Set PPAG feature */
3480 btintel_set_ppag(hdev, ver);
3481
3482 /* Read the Intel version information after loading the FW */
3483 err = btintel_read_version_tlv(hdev, &new_ver);
3484 if (err)
3485 return err;
3486
3487 btintel_version_info_tlv(hdev, &new_ver);
3488
3489 finish:
3490 /* Set the event mask for Intel specific vendor events. This enables
3491 * a few extra events that are useful during general operation. It
3492 * does not enable any debugging related events.
3493 *
3494 * The device will function correctly without these events enabled
3495 * and thus no need to fail the setup.
3496 */
3497 btintel_set_event_mask(hdev, false);
3498
3499 return 0;
3500 }
3501 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv);
3502
btintel_set_msft_opcode(struct hci_dev * hdev,u8 hw_variant)3503 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
3504 {
3505 switch (hw_variant) {
3506 /* Legacy bootloader devices that supports MSFT Extension */
3507 case 0x11: /* JfP */
3508 case 0x12: /* ThP */
3509 case 0x13: /* HrP */
3510 case 0x14: /* CcP */
3511 /* All Intel new generation controllers support the Microsoft vendor
3512 * extension are using 0xFC1E for VsMsftOpCode.
3513 */
3514 case 0x17:
3515 case 0x18:
3516 case 0x19:
3517 case 0x1b:
3518 case 0x1c:
3519 case 0x1d:
3520 case 0x1e:
3521 case 0x1f:
3522 case 0x20:
3523 case 0x21:
3524 case 0x22:
3525 hci_set_msft_opcode(hdev, 0xFC1E);
3526 break;
3527 default:
3528 /* Not supported */
3529 break;
3530 }
3531 }
3532 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode);
3533
btintel_print_fseq_info(struct hci_dev * hdev)3534 void btintel_print_fseq_info(struct hci_dev *hdev)
3535 {
3536 struct sk_buff *skb;
3537 u8 *p;
3538 u32 val;
3539 const char *str;
3540
3541 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT);
3542 if (IS_ERR(skb)) {
3543 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)",
3544 PTR_ERR(skb));
3545 return;
3546 }
3547
3548 if (skb->len < (sizeof(u32) * 16 + 2)) {
3549 bt_dev_dbg(hdev, "Malformed packet of length %u received",
3550 skb->len);
3551 kfree_skb(skb);
3552 return;
3553 }
3554
3555 p = skb_pull_data(skb, 1);
3556 if (*p) {
3557 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p);
3558 kfree_skb(skb);
3559 return;
3560 }
3561
3562 p = skb_pull_data(skb, 1);
3563 switch (*p) {
3564 case 0:
3565 str = "Success";
3566 break;
3567 case 1:
3568 str = "Fatal error";
3569 break;
3570 case 2:
3571 str = "Semaphore acquire error";
3572 break;
3573 default:
3574 str = "Unknown error";
3575 break;
3576 }
3577
3578 if (*p) {
3579 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
3580 kfree_skb(skb);
3581 return;
3582 }
3583
3584 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p);
3585
3586 val = get_unaligned_le32(skb_pull_data(skb, 4));
3587 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val);
3588
3589 val = get_unaligned_le32(skb_pull_data(skb, 4));
3590 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val);
3591
3592 val = get_unaligned_le32(skb_pull_data(skb, 4));
3593 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val);
3594
3595 p = skb->data;
3596 skb_pull_data(skb, 4);
3597 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
3598 p[2], p[3]);
3599
3600 p = skb->data;
3601 skb_pull_data(skb, 4);
3602 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1],
3603 p[2], p[3]);
3604
3605 val = get_unaligned_le32(skb_pull_data(skb, 4));
3606 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val);
3607
3608 val = get_unaligned_le32(skb_pull_data(skb, 4));
3609 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val);
3610
3611 val = get_unaligned_le32(skb_pull_data(skb, 4));
3612 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val);
3613
3614 val = get_unaligned_le32(skb_pull_data(skb, 4));
3615 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val);
3616
3617 val = get_unaligned_le32(skb_pull_data(skb, 4));
3618 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val);
3619
3620 val = get_unaligned_le32(skb_pull_data(skb, 4));
3621 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val);
3622
3623 val = get_unaligned_le32(skb_pull_data(skb, 4));
3624 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val);
3625
3626 val = get_unaligned_le32(skb_pull_data(skb, 4));
3627 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val);
3628
3629 val = get_unaligned_le32(skb_pull_data(skb, 4));
3630 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val);
3631
3632 val = get_unaligned_le32(skb_pull_data(skb, 4));
3633 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val);
3634
3635 val = get_unaligned_le32(skb_pull_data(skb, 4));
3636 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val);
3637
3638 val = get_unaligned_le32(skb_pull_data(skb, 4));
3639 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val);
3640
3641 val = get_unaligned_le32(skb_pull_data(skb, 4));
3642 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val);
3643
3644 kfree_skb(skb);
3645 }
3646 EXPORT_SYMBOL_GPL(btintel_print_fseq_info);
3647
btintel_setup_combined(struct hci_dev * hdev)3648 static int btintel_setup_combined(struct hci_dev *hdev)
3649 {
3650 const u8 param[1] = { 0xFF };
3651 struct intel_version ver;
3652 struct intel_version_tlv ver_tlv;
3653 struct sk_buff *skb;
3654 int err;
3655
3656 BT_DBG("%s", hdev->name);
3657
3658 /* The some controllers have a bug with the first HCI command sent to it
3659 * returning number of completed commands as zero. This would stall the
3660 * command processing in the Bluetooth core.
3661 *
3662 * As a workaround, send HCI Reset command first which will reset the
3663 * number of completed commands and allow normal command processing
3664 * from now on.
3665 *
3666 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe
3667 * in the SW_RFKILL ON state as a workaround of fixing LED issue during
3668 * the shutdown() procedure, and once the device is in SW_RFKILL ON
3669 * state, the only way to exit out of it is sending the HCI_Reset
3670 * command.
3671 */
3672 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) ||
3673 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
3674 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
3675 HCI_INIT_TIMEOUT);
3676 if (IS_ERR(skb)) {
3677 bt_dev_err(hdev,
3678 "sending initial HCI reset failed (%ld)",
3679 PTR_ERR(skb));
3680 return PTR_ERR(skb);
3681 }
3682 kfree_skb(skb);
3683 }
3684
3685 /* Starting from TyP device, the command parameter and response are
3686 * changed even though the OCF for HCI_Intel_Read_Version command
3687 * remains same. The legacy devices can handle even if the
3688 * command has a parameter and returns a correct version information.
3689 * So, it uses new format to support both legacy and new format.
3690 */
3691 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
3692 if (IS_ERR(skb)) {
3693 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
3694 PTR_ERR(skb));
3695 return PTR_ERR(skb);
3696 }
3697
3698 /* Check the status */
3699 if (skb->data[0]) {
3700 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
3701 skb->data[0]);
3702 err = -EIO;
3703 goto exit_error;
3704 }
3705
3706 /* Apply the common HCI quirks for Intel device */
3707 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);
3708 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
3709 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG);
3710
3711 /* Set up the quality report callback for Intel devices */
3712 hdev->set_quality_report = btintel_set_quality_report;
3713
3714 /* For Legacy device, check the HW platform value and size */
3715 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
3716 bt_dev_dbg(hdev, "Read the legacy Intel version information");
3717
3718 memcpy(&ver, skb->data, sizeof(ver));
3719
3720 /* Display version information */
3721 btintel_version_info(hdev, &ver);
3722
3723 /* Check for supported iBT hardware variants of this firmware
3724 * loading method.
3725 *
3726 * This check has been put in place to ensure correct forward
3727 * compatibility options when newer hardware variants come
3728 * along.
3729 */
3730 switch (ver.hw_variant) {
3731 case 0x07: /* WP */
3732 case 0x08: /* StP */
3733 /* Legacy ROM product */
3734 btintel_set_flag(hdev, INTEL_ROM_LEGACY);
3735
3736 /* Apply the device specific HCI quirks
3737 *
3738 * WBS for SdP - For the Legacy ROM products, only SdP
3739 * supports the WBS. But the version information is not
3740 * enough to use here because the StP2 and SdP have same
3741 * hw_variant and fw_variant. So, this flag is set by
3742 * the transport driver (btusb) based on the HW info
3743 * (idProduct)
3744 */
3745 if (!btintel_test_flag(hdev,
3746 INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
3747 hci_set_quirk(hdev,
3748 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3749
3750 err = btintel_legacy_rom_setup(hdev, &ver);
3751 break;
3752 case 0x0b: /* SfP */
3753 case 0x11: /* JfP */
3754 case 0x12: /* ThP */
3755 case 0x13: /* HrP */
3756 case 0x14: /* CcP */
3757 fallthrough;
3758 case 0x0c: /* WsP */
3759 /* Apply the device specific HCI quirks
3760 *
3761 * All Legacy bootloader devices support WBS
3762 */
3763 hci_set_quirk(hdev,
3764 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3765
3766 /* These variants don't seem to support LE Coded PHY */
3767 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);
3768
3769 /* Setup MSFT Extension support */
3770 btintel_set_msft_opcode(hdev, ver.hw_variant);
3771
3772 err = btintel_bootloader_setup(hdev, &ver);
3773 btintel_register_devcoredump_support(hdev);
3774 break;
3775 default:
3776 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
3777 ver.hw_variant);
3778 err = -EINVAL;
3779 }
3780
3781 hci_set_hw_info(hdev,
3782 "INTEL platform=%u variant=%u revision=%u",
3783 ver.hw_platform, ver.hw_variant,
3784 ver.hw_revision);
3785
3786 goto exit_error;
3787 }
3788
3789 /* memset ver_tlv to start with clean state as few fields are exclusive
3790 * to bootloader mode and are not populated in operational mode
3791 */
3792 memset(&ver_tlv, 0, sizeof(ver_tlv));
3793 /* For TLV type device, parse the tlv data */
3794 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
3795 if (err) {
3796 bt_dev_err(hdev, "Failed to parse TLV version information");
3797 goto exit_error;
3798 }
3799
3800 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
3801 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
3802 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
3803 err = -EINVAL;
3804 goto exit_error;
3805 }
3806
3807 /* Check for supported iBT hardware variants of this firmware
3808 * loading method.
3809 *
3810 * This check has been put in place to ensure correct forward
3811 * compatibility options when newer hardware variants come
3812 * along.
3813 */
3814 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
3815 case 0x11: /* JfP */
3816 case 0x12: /* ThP */
3817 case 0x13: /* HrP */
3818 case 0x14: /* CcP */
3819 /* Some legacy bootloader devices starting from JfP,
3820 * the operational firmware supports both old and TLV based
3821 * HCI_Intel_Read_Version command based on the command
3822 * parameter.
3823 *
3824 * For upgrading firmware case, the TLV based version cannot
3825 * be used because the firmware filename for legacy bootloader
3826 * is based on the old format.
3827 *
3828 * Also, it is not easy to convert TLV based version from the
3829 * legacy version format.
3830 *
3831 * So, as a workaround for those devices, use the legacy
3832 * HCI_Intel_Read_Version to get the version information and
3833 * run the legacy bootloader setup.
3834 */
3835 err = btintel_read_version(hdev, &ver);
3836 if (err)
3837 break;
3838
3839 /* Apply the device specific HCI quirks
3840 *
3841 * All Legacy bootloader devices support WBS
3842 */
3843 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3844
3845 /* These variants don't seem to support LE Coded PHY */
3846 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED);
3847
3848 /* Setup MSFT Extension support */
3849 btintel_set_msft_opcode(hdev, ver.hw_variant);
3850
3851 err = btintel_bootloader_setup(hdev, &ver);
3852 btintel_register_devcoredump_support(hdev);
3853 break;
3854 case 0x18: /* GfP2 */
3855 case 0x1c: /* GaP */
3856 /* Re-classify packet type for controllers with LE audio */
3857 hdev->classify_pkt_type = btintel_classify_pkt_type;
3858 fallthrough;
3859 case 0x17:
3860 case 0x19:
3861 case 0x1b:
3862 case 0x1d:
3863 case 0x1e:
3864 case 0x1f:
3865 case 0x20:
3866 case 0x21:
3867 case 0x22:
3868 /* Display version information of TLV type */
3869 btintel_version_info_tlv(hdev, &ver_tlv);
3870
3871 /* Apply the device specific HCI quirks for TLV based devices
3872 *
3873 * All TLV based devices support WBS
3874 */
3875 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
3876
3877 /* Setup MSFT Extension support */
3878 btintel_set_msft_opcode(hdev,
3879 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3880 btintel_set_dsm_reset_method(hdev, &ver_tlv);
3881
3882 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
3883 if (err)
3884 goto exit_error;
3885
3886 btintel_register_devcoredump_support(hdev);
3887 btintel_print_fseq_info(hdev);
3888 break;
3889 default:
3890 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
3891 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3892 err = -EINVAL;
3893 break;
3894 }
3895
3896 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u",
3897 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt),
3898 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
3899
3900 exit_error:
3901 kfree_skb(skb);
3902
3903 return err;
3904 }
3905
btintel_shutdown_combined(struct hci_dev * hdev)3906 int btintel_shutdown_combined(struct hci_dev *hdev)
3907 {
3908 struct sk_buff *skb;
3909 int ret;
3910
3911 /* Send HCI Reset to the controller to stop any BT activity which
3912 * were triggered. This will help to save power and maintain the
3913 * sync b/w Host and controller
3914 */
3915 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3916 if (IS_ERR(skb)) {
3917 bt_dev_err(hdev, "HCI reset during shutdown failed");
3918 return PTR_ERR(skb);
3919 }
3920 kfree_skb(skb);
3921
3922
3923 /* Some platforms have an issue with BT LED when the interface is
3924 * down or BT radio is turned off, which takes 5 seconds to BT LED
3925 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the
3926 * device in the RFKILL ON state which turns off the BT LED immediately.
3927 */
3928 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
3929 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
3930 if (IS_ERR(skb)) {
3931 ret = PTR_ERR(skb);
3932 bt_dev_err(hdev, "turning off Intel device LED failed");
3933 return ret;
3934 }
3935 kfree_skb(skb);
3936 }
3937
3938 return 0;
3939 }
3940 EXPORT_SYMBOL_GPL(btintel_shutdown_combined);
3941
btintel_configure_setup(struct hci_dev * hdev,const char * driver_name)3942 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name)
3943 {
3944 hdev->manufacturer = 2;
3945 hdev->setup = btintel_setup_combined;
3946 hdev->shutdown = btintel_shutdown_combined;
3947 hdev->hw_error = btintel_hw_error;
3948 hdev->set_diag = btintel_set_diag_combined;
3949 hdev->set_bdaddr = btintel_set_bdaddr;
3950
3951 coredump_info.driver_name = driver_name;
3952
3953 return 0;
3954 }
3955 EXPORT_SYMBOL_GPL(btintel_configure_setup);
3956
btintel_diagnostics(struct hci_dev * hdev,struct sk_buff * skb)3957 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb)
3958 {
3959 struct intel_tlv *tlv = (void *)&skb->data[5];
3960
3961 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0]))
3962 goto recv_frame;
3963
3964 /* The first event is always an event type TLV */
3965 if (tlv->type != INTEL_TLV_TYPE_ID)
3966 goto recv_frame;
3967
3968 switch (tlv->val[0]) {
3969 case INTEL_TLV_SYSTEM_EXCEPTION:
3970 case INTEL_TLV_FATAL_EXCEPTION:
3971 case INTEL_TLV_DEBUG_EXCEPTION:
3972 case INTEL_TLV_TEST_EXCEPTION:
3973 /* Generate devcoredump from exception */
3974 if (!hci_devcd_init(hdev, skb->len)) {
3975 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
3976 hci_devcd_complete(hdev);
3977 } else {
3978 bt_dev_err(hdev, "Failed to generate devcoredump");
3979 }
3980 break;
3981 default:
3982 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]);
3983 }
3984
3985 recv_frame:
3986 return hci_recv_frame(hdev, skb);
3987 }
3988
btintel_recv_event(struct hci_dev * hdev,struct sk_buff * skb)3989 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb)
3990 {
3991 struct hci_event_hdr *hdr = (void *)skb->data;
3992 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 };
3993
3994 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) {
3995 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
3996 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
3997
3998 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
3999 switch (skb->data[2]) {
4000 case 0x02:
4001 /* When switching to the operational firmware
4002 * the device sends a vendor specific event
4003 * indicating that the bootup completed.
4004 */
4005 btintel_bootup(hdev, ptr, len);
4006 kfree_skb(skb);
4007 return 0;
4008 case 0x06:
4009 /* When the firmware loading completes the
4010 * device sends out a vendor specific event
4011 * indicating the result of the firmware
4012 * loading.
4013 */
4014 btintel_secure_send_result(hdev, ptr, len);
4015 kfree_skb(skb);
4016 return 0;
4017 }
4018 }
4019
4020 /* Handle all diagnostics events separately. May still call
4021 * hci_recv_frame.
4022 */
4023 if (len + 1 >= sizeof(diagnostics_hdr) &&
4024 memcmp(&skb->data[2], diagnostics_hdr,
4025 sizeof(diagnostics_hdr)) == 0) {
4026 return btintel_diagnostics(hdev, skb);
4027 }
4028 }
4029
4030 return hci_recv_frame(hdev, skb);
4031 }
4032 EXPORT_SYMBOL_GPL(btintel_recv_event);
4033
btintel_bootup(struct hci_dev * hdev,const void * ptr,unsigned int len)4034 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
4035 {
4036 const struct intel_bootup *evt = ptr;
4037
4038 if (len != sizeof(*evt))
4039 return;
4040
4041 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
4042 btintel_wake_up_flag(hdev, INTEL_BOOTING);
4043 }
4044 EXPORT_SYMBOL_GPL(btintel_bootup);
4045
btintel_secure_send_result(struct hci_dev * hdev,const void * ptr,unsigned int len)4046 void btintel_secure_send_result(struct hci_dev *hdev,
4047 const void *ptr, unsigned int len)
4048 {
4049 const struct intel_secure_send_result *evt = ptr;
4050
4051 if (len != sizeof(*evt))
4052 return;
4053
4054 if (evt->result)
4055 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
4056
4057 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
4058 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
4059 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
4060 }
4061 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
4062
4063 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4064 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
4065 MODULE_VERSION(VERSION);
4066 MODULE_LICENSE("GPL");
4067 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
4068 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
4069 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
4070 MODULE_FIRMWARE("intel/ibt-12-16.ddc");
4071