1 /* 2 * ng_ubt_intel.c 3 */ 4 5 /*- 6 * SPDX-License-Identifier: BSD-2-Clause 7 * 8 * Copyright (c) 2019, 2021 Vladimir Kondratyev <wulf@FreeBSD.org> 9 * Copyright (c) 2023 Future Crew LLC. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Attempt to initialize FreeBSD bluetooth stack while Intel Wireless 8260/8265 35 * device is in bootloader mode locks the adapter hardly so it requires power 36 * on/off cycle to restore. This driver blocks ng_ubt attachment until 37 * operational firmware is loaded by iwmbtfw utility thus avoiding the lock up. 38 */ 39 40 #include <sys/types.h> 41 #include <sys/bus.h> 42 #include <sys/kernel.h> 43 #include <sys/mbuf.h> 44 #include <sys/module.h> 45 #include <sys/systm.h> 46 #include <sys/taskqueue.h> 47 48 #include "usbdevs.h" 49 #include <dev/usb/usb.h> 50 #include <dev/usb/usbdi.h> 51 52 #include <netgraph/ng_message.h> 53 #include <netgraph/netgraph.h> 54 #include <netgraph/ng_parse.h> 55 #include <netgraph/bluetooth/include/ng_bluetooth.h> 56 #include <netgraph/bluetooth/include/ng_hci.h> 57 #include <netgraph/bluetooth/include/ng_ubt.h> 58 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h> 59 60 #define UBT_INTEL_HCICMD_TIMEOUT 2000 /* ms */ 61 #define UBT_INTEL_TLV_IMAGE_TYPE 0x1c 62 63 enum { 64 UBT_INTEL_DEVICE_7260, 65 UBT_INTEL_DEVICE_8260, 66 UBT_INTEL_DEVICE_9260, 67 }; 68 69 struct ubt_intel_version_rp { 70 uint8_t status; 71 uint8_t hw_platform; 72 uint8_t hw_variant; 73 uint8_t hw_revision; 74 uint8_t fw_variant; 75 uint8_t fw_revision; 76 uint8_t fw_build_num; 77 uint8_t fw_build_ww; 78 uint8_t fw_build_yy; 79 uint8_t fw_patch_num; 80 } __attribute__ ((packed)); 81 82 static device_probe_t ubt_intel_probe; 83 84 /* 85 * List of supported bluetooth devices. If you add a new device PID here ensure 86 * that it is blacklisted in ng_ubt.c and is supported by iwmbtfw utility. 87 */ 88 89 static const STRUCT_USB_HOST_ID ubt_intel_devs[] = 90 { 91 /* Intel Wireless 7260/7265 and successors */ 92 { USB_VPI(USB_VENDOR_INTEL2, 0x07dc, UBT_INTEL_DEVICE_7260) }, 93 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2a, UBT_INTEL_DEVICE_7260) }, 94 { USB_VPI(USB_VENDOR_INTEL2, 0x0aa7, UBT_INTEL_DEVICE_7260) }, 95 /* Intel Wireless 8260/8265 and successors */ 96 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2b, UBT_INTEL_DEVICE_8260) }, 97 { USB_VPI(USB_VENDOR_INTEL2, 0x0aaa, UBT_INTEL_DEVICE_8260) }, 98 { USB_VPI(USB_VENDOR_INTEL2, 0x0025, UBT_INTEL_DEVICE_8260) }, 99 { USB_VPI(USB_VENDOR_INTEL2, 0x0026, UBT_INTEL_DEVICE_8260) }, 100 { USB_VPI(USB_VENDOR_INTEL2, 0x0029, UBT_INTEL_DEVICE_8260) }, 101 /* Intel Wireless 9260/9560 and successors */ 102 { USB_VPI(USB_VENDOR_INTEL2, 0x0032, UBT_INTEL_DEVICE_9260) }, 103 { USB_VPI(USB_VENDOR_INTEL2, 0x0033, UBT_INTEL_DEVICE_9260) }, 104 }; 105 106 /* 107 * Execute generic HCI command and return response in provided buffer. 108 */ 109 110 static usb_error_t 111 ubt_intel_do_hci_request(struct usb_device *udev, uint16_t opcode, 112 void *resp, uint8_t resp_len) 113 { 114 struct ubt_hci_event_command_compl *evt; 115 struct ubt_hci_cmd cmd; 116 usb_error_t error; 117 118 memset(&cmd, 0, sizeof(cmd)); 119 cmd.opcode = htole16(opcode); 120 evt = malloc(offsetof(struct ubt_hci_event_command_compl, data) + 121 resp_len, M_TEMP, M_ZERO | M_WAITOK); 122 evt->header.event = NG_HCI_EVENT_COMMAND_COMPL; 123 evt->header.length = resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE; 124 125 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT); 126 if (error != USB_ERR_NORMAL_COMPLETION) 127 goto exit; 128 129 if (evt->header.length == resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE) 130 memcpy(resp, evt->data, resp_len); 131 else 132 error = USB_ERR_INVAL; 133 exit: 134 free(evt, M_TEMP); 135 return (error); 136 } 137 138 static uint8_t 139 ubt_intel_get_img_type(struct usb_device *udev) 140 { 141 #define UBT_INTEL_MAX_EVT_SIZE 256 142 static struct ubt_hci_cmd cmd = { 143 .opcode = htole16(NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05)), 144 .length = 1, 145 .data = { 0xff }, 146 }; 147 struct ubt_hci_event_command_compl *evt; 148 usb_error_t error; 149 uint8_t status, datalen, type, len, img_type = 0; 150 uint8_t *data; 151 152 evt = malloc(UBT_INTEL_MAX_EVT_SIZE, M_TEMP, M_ZERO | M_WAITOK); 153 evt->header.event = NG_HCI_EVENT_COMMAND_COMPL; 154 evt->header.length = 155 UBT_INTEL_MAX_EVT_SIZE - sizeof(struct ubt_hci_evhdr); 156 157 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT); 158 if (error != USB_ERR_NORMAL_COMPLETION) 159 goto exit; 160 161 datalen = evt->header.length - UBT_HCI_EVENT_COMPL_HEAD_SIZE; 162 data = evt->data; 163 status = *data++; 164 if (status != 0) 165 goto exit; 166 datalen--; 167 168 while (datalen >= 2) { 169 type = *data++; 170 len = *data++; 171 datalen -= 2; 172 if (datalen < len) 173 break; 174 if (type == UBT_INTEL_TLV_IMAGE_TYPE && len == 1) { 175 img_type = *data; 176 break; 177 } 178 datalen -= len; 179 data += len; 180 } 181 exit: 182 free(evt, M_TEMP); 183 return (img_type); 184 } 185 186 /* 187 * Probe for a Intel Wireless Bluetooth device. 188 */ 189 190 static int 191 ubt_intel_probe(device_t dev) 192 { 193 struct usb_attach_arg *uaa = device_get_ivars(dev); 194 struct ubt_intel_version_rp version; 195 ng_hci_reset_rp reset; 196 int error; 197 uint8_t img_type; 198 199 if (uaa->usb_mode != USB_MODE_HOST) 200 return (ENXIO); 201 202 if (uaa->info.bIfaceIndex != 0) 203 return (ENXIO); 204 205 error = usbd_lookup_id_by_uaa(ubt_intel_devs, sizeof(ubt_intel_devs), 206 uaa); 207 if (error != 0) 208 return (error); 209 210 switch (USB_GET_DRIVER_INFO(uaa)) { 211 case UBT_INTEL_DEVICE_7260: 212 /* 213 * Send HCI Reset command to workaround controller bug with the 214 * first HCI command sent to it returning number of completed 215 * commands as zero. This will reset the number of completed 216 * commands and allow further normal command processing. 217 */ 218 if (ubt_intel_do_hci_request(uaa->device, 219 NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND, NG_HCI_OCF_RESET), 220 &reset, sizeof(reset)) != USB_ERR_NORMAL_COMPLETION) 221 return (ENXIO); 222 if (reset.status != 0) 223 return (ENXIO); 224 /* 225 * fw_patch_num indicates the version of patch the device 226 * currently have. If there is no patch data in the device, 227 * it is always 0x00 and we need to patch the device again. 228 */ 229 if (ubt_intel_do_hci_request(uaa->device, 230 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05), 231 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION) 232 return (ENXIO); 233 if (version.fw_patch_num == 0) 234 return (ENXIO); 235 break; 236 237 case UBT_INTEL_DEVICE_8260: 238 /* 239 * Find if the Intel Wireless 8260/8265 device is in bootloader 240 * mode or is running operational firmware with checking of 241 * variant byte of "Intel version" HCI command response. 242 * The value 0x23 identifies the operational firmware. 243 */ 244 if (ubt_intel_do_hci_request(uaa->device, 245 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05), 246 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION) 247 return (ENXIO); 248 if (version.fw_variant != 0x23) 249 return (ENXIO); 250 break; 251 252 case UBT_INTEL_DEVICE_9260: 253 /* 254 * Find if the Intel Wireless 9260/9560 device is in bootloader 255 * mode or is running operational firmware with checking of 256 * image type byte of "Intel version" HCI command response. 257 * The value 0x03 identifies the operational firmware. 258 */ 259 img_type = ubt_intel_get_img_type(uaa->device); 260 if (img_type != 0x03) 261 return (ENXIO); 262 break; 263 264 default: 265 KASSERT(0 == 1, ("Unknown DRIVER_INFO")); 266 } 267 268 return (BUS_PROBE_DEFAULT); 269 } 270 271 /* 272 * Module interface. Attach and detach methods, netgraph node type 273 * registration and PNP string are inherited from ng_ubt.c driver. 274 */ 275 276 static device_method_t ubt_intel_methods[] = 277 { 278 DEVMETHOD(device_probe, ubt_intel_probe), 279 DEVMETHOD_END 280 }; 281 282 DEFINE_CLASS_1(ubt, ubt_intel_driver, ubt_intel_methods, 283 sizeof(struct ubt_softc), ubt_driver); 284 DRIVER_MODULE(ng_ubt_intel, uhub, ubt_intel_driver, 0, 0); 285 MODULE_VERSION(ng_ubt_intel, NG_BLUETOOTH_VERSION); 286 MODULE_DEPEND(ng_ubt_intel, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION); 287 MODULE_DEPEND(ng_ubt_intel, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION); 288 MODULE_DEPEND(ng_ubt_intel, usb, 1, 1, 1); 289