1 /* 2 * ng_ubt_intel.c 3 */ 4 5 /*- 6 * SPDX-License-Identifier: BSD-2-Clause 7 * 8 * Copyright (c) 2019, 2021 Vladimir Kondratyev <wulf@FreeBSD.org> 9 * Copyright (c) 2023 Future Crew LLC. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 /* 34 * Attempt to initialize FreeBSD bluetooth stack while Intel Wireless 8260/8265 35 * device is in bootloader mode locks the adapter hardly so it requires power 36 * on/off cycle to restore. This driver blocks ng_ubt attachment until 37 * operational firmware is loaded by iwmbtfw utility thus avoiding the lock up. 38 */ 39 40 #include <sys/types.h> 41 #include <sys/bus.h> 42 #include <sys/kernel.h> 43 #include <sys/mbuf.h> 44 #include <sys/module.h> 45 #include <sys/systm.h> 46 #include <sys/taskqueue.h> 47 48 #include "usbdevs.h" 49 #include <dev/usb/usb.h> 50 #include <dev/usb/usbdi.h> 51 52 #include <netgraph/ng_message.h> 53 #include <netgraph/netgraph.h> 54 #include <netgraph/ng_parse.h> 55 #include <netgraph/bluetooth/include/ng_bluetooth.h> 56 #include <netgraph/bluetooth/include/ng_hci.h> 57 #include <netgraph/bluetooth/include/ng_ubt.h> 58 #include <netgraph/bluetooth/drivers/ubt/ng_ubt_var.h> 59 60 #define UBT_INTEL_HCICMD_TIMEOUT 2000 /* ms */ 61 #define UBT_INTEL_TLV_IMAGE_TYPE 0x1c 62 63 enum { 64 UBT_INTEL_DEVICE_7260, 65 UBT_INTEL_DEVICE_8260, 66 UBT_INTEL_DEVICE_9260, 67 }; 68 69 struct ubt_intel_version_rp { 70 uint8_t status; 71 uint8_t hw_platform; 72 uint8_t hw_variant; 73 uint8_t hw_revision; 74 uint8_t fw_variant; 75 uint8_t fw_revision; 76 uint8_t fw_build_num; 77 uint8_t fw_build_ww; 78 uint8_t fw_build_yy; 79 uint8_t fw_patch_num; 80 } __attribute__ ((packed)); 81 82 static device_probe_t ubt_intel_probe; 83 84 /* 85 * List of supported bluetooth devices. If you add a new device PID here ensure 86 * that it is blacklisted in ng_ubt.c and is supported by iwmbtfw utility. 87 */ 88 89 static const STRUCT_USB_HOST_ID ubt_intel_devs[] = 90 { 91 /* Intel Wireless 7260/7265 and successors */ 92 { USB_VPI(USB_VENDOR_INTEL2, 0x07dc, UBT_INTEL_DEVICE_7260) }, 93 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2a, UBT_INTEL_DEVICE_7260) }, 94 { USB_VPI(USB_VENDOR_INTEL2, 0x0aa7, UBT_INTEL_DEVICE_7260) }, 95 /* Intel Wireless 8260/8265 and successors */ 96 { USB_VPI(USB_VENDOR_INTEL2, 0x0a2b, UBT_INTEL_DEVICE_8260) }, 97 { USB_VPI(USB_VENDOR_INTEL2, 0x0aaa, UBT_INTEL_DEVICE_8260) }, 98 { USB_VPI(USB_VENDOR_INTEL2, 0x0025, UBT_INTEL_DEVICE_8260) }, 99 { USB_VPI(USB_VENDOR_INTEL2, 0x0026, UBT_INTEL_DEVICE_8260) }, 100 { USB_VPI(USB_VENDOR_INTEL2, 0x0029, UBT_INTEL_DEVICE_8260) }, 101 /* Intel Wireless 9260/9560 and successors */ 102 { USB_VPI(USB_VENDOR_INTEL2, 0x0032, UBT_INTEL_DEVICE_9260) }, 103 { USB_VPI(USB_VENDOR_INTEL2, 0x0033, UBT_INTEL_DEVICE_9260) }, 104 }; 105 106 /* 107 * Execute generic HCI command and return response in provided buffer. 108 */ 109 110 static usb_error_t 111 ubt_intel_do_hci_request(struct usb_device *udev, uint16_t opcode, 112 void *resp, uint8_t resp_len) 113 { 114 struct ubt_hci_event_command_compl *evt; 115 struct ubt_hci_cmd cmd; 116 usb_error_t error; 117 118 memset(&cmd, 0, sizeof(cmd)); 119 cmd.opcode = htole16(opcode); 120 evt = malloc(offsetof(struct ubt_hci_event_command_compl, data) + 121 resp_len, M_TEMP, M_ZERO | M_WAITOK); 122 evt->header.length = resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE; 123 124 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT); 125 if (error != USB_ERR_NORMAL_COMPLETION) 126 goto exit; 127 128 if (evt->header.event == NG_HCI_EVENT_COMMAND_COMPL && 129 evt->header.length == resp_len + UBT_HCI_EVENT_COMPL_HEAD_SIZE) 130 memcpy(resp, evt->data, resp_len); 131 else 132 error = USB_ERR_INVAL; 133 exit: 134 free(evt, M_TEMP); 135 return (error); 136 } 137 138 static uint8_t 139 ubt_intel_get_img_type(struct usb_device *udev) 140 { 141 #define UBT_INTEL_MAX_EVT_SIZE 256 142 static struct ubt_hci_cmd cmd = { 143 .opcode = htole16(NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05)), 144 .length = 1, 145 .data = { 0xff }, 146 }; 147 struct ubt_hci_event_command_compl *evt; 148 usb_error_t error; 149 uint8_t status, datalen, type, len, img_type = 0; 150 uint8_t *data; 151 152 evt = malloc(UBT_INTEL_MAX_EVT_SIZE, M_TEMP, M_ZERO | M_WAITOK); 153 evt->header.length = 154 UBT_INTEL_MAX_EVT_SIZE - sizeof(struct ubt_hci_evhdr); 155 156 error = ubt_do_hci_request(udev, &cmd, evt, UBT_INTEL_HCICMD_TIMEOUT); 157 if (error != USB_ERR_NORMAL_COMPLETION) 158 goto exit; 159 160 datalen = evt->header.length - UBT_HCI_EVENT_COMPL_HEAD_SIZE; 161 data = evt->data; 162 status = *data++; 163 if (status != 0) 164 goto exit; 165 datalen--; 166 167 while (datalen >= 2) { 168 type = *data++; 169 len = *data++; 170 datalen -= 2; 171 if (datalen < len) 172 break; 173 if (type == UBT_INTEL_TLV_IMAGE_TYPE && len == 1) { 174 img_type = *data; 175 break; 176 } 177 datalen -= len; 178 data += len; 179 } 180 exit: 181 free(evt, M_TEMP); 182 return (img_type); 183 } 184 185 /* 186 * Probe for a Intel Wireless Bluetooth device. 187 */ 188 189 static int 190 ubt_intel_probe(device_t dev) 191 { 192 struct usb_attach_arg *uaa = device_get_ivars(dev); 193 struct ubt_intel_version_rp version; 194 ng_hci_reset_rp reset; 195 int error; 196 uint8_t img_type; 197 198 if (uaa->usb_mode != USB_MODE_HOST) 199 return (ENXIO); 200 201 if (uaa->info.bIfaceIndex != 0) 202 return (ENXIO); 203 204 error = usbd_lookup_id_by_uaa(ubt_intel_devs, sizeof(ubt_intel_devs), 205 uaa); 206 if (error != 0) 207 return (error); 208 209 switch (USB_GET_DRIVER_INFO(uaa)) { 210 case UBT_INTEL_DEVICE_7260: 211 /* 212 * Send HCI Reset command to workaround controller bug with the 213 * first HCI command sent to it returning number of completed 214 * commands as zero. This will reset the number of completed 215 * commands and allow further normal command processing. 216 */ 217 if (ubt_intel_do_hci_request(uaa->device, 218 NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND, NG_HCI_OCF_RESET), 219 &reset, sizeof(reset)) != USB_ERR_NORMAL_COMPLETION) 220 return (ENXIO); 221 if (reset.status != 0) 222 return (ENXIO); 223 /* 224 * fw_patch_num indicates the version of patch the device 225 * currently have. If there is no patch data in the device, 226 * it is always 0x00 and we need to patch the device again. 227 */ 228 if (ubt_intel_do_hci_request(uaa->device, 229 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05), 230 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION) 231 return (ENXIO); 232 if (version.fw_patch_num == 0) 233 return (ENXIO); 234 break; 235 236 case UBT_INTEL_DEVICE_8260: 237 /* 238 * Find if the Intel Wireless 8260/8265 device is in bootloader 239 * mode or is running operational firmware with checking of 240 * variant byte of "Intel version" HCI command response. 241 * The value 0x23 identifies the operational firmware. 242 */ 243 if (ubt_intel_do_hci_request(uaa->device, 244 NG_HCI_OPCODE(NG_HCI_OGF_VENDOR, 0x05), 245 &version, sizeof(version)) != USB_ERR_NORMAL_COMPLETION) 246 return (ENXIO); 247 if (version.fw_variant != 0x23) 248 return (ENXIO); 249 break; 250 251 case UBT_INTEL_DEVICE_9260: 252 /* 253 * Find if the Intel Wireless 9260/9560 device is in bootloader 254 * mode or is running operational firmware with checking of 255 * image type byte of "Intel version" HCI command response. 256 * The value 0x03 identifies the operational firmware. 257 */ 258 img_type = ubt_intel_get_img_type(uaa->device); 259 if (img_type != 0x03) 260 return (ENXIO); 261 break; 262 263 default: 264 KASSERT(0 == 1, ("Unknown DRIVER_INFO")); 265 } 266 267 return (BUS_PROBE_DEFAULT); 268 } 269 270 /* 271 * Module interface. Attach and detach methods, netgraph node type 272 * registration and PNP string are inherited from ng_ubt.c driver. 273 */ 274 275 static device_method_t ubt_intel_methods[] = 276 { 277 DEVMETHOD(device_probe, ubt_intel_probe), 278 DEVMETHOD_END 279 }; 280 281 DEFINE_CLASS_1(ubt, ubt_intel_driver, ubt_intel_methods, 282 sizeof(struct ubt_softc), ubt_driver); 283 DRIVER_MODULE(ng_ubt_intel, uhub, ubt_intel_driver, 0, 0); 284 MODULE_VERSION(ng_ubt_intel, NG_BLUETOOTH_VERSION); 285 MODULE_DEPEND(ng_ubt_intel, netgraph, NG_ABI_VERSION, NG_ABI_VERSION, NG_ABI_VERSION); 286 MODULE_DEPEND(ng_ubt_intel, ng_hci, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION); 287 MODULE_DEPEND(ng_ubt_intel, usb, 1, 1, 1); 288