1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_REV2 2 55 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 56 57 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 58 struct cmd_write_boot_params { 59 __le32 boot_addr; 60 u8 fw_build_num; 61 u8 fw_build_ww; 62 u8 fw_build_yy; 63 } __packed; 64 65 static struct { 66 const char *driver_name; 67 u8 hw_variant; 68 u32 fw_build_num; 69 } coredump_info; 70 71 const guid_t btintel_guid_dsm = 72 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 73 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 74 EXPORT_SYMBOL_GPL(btintel_guid_dsm); 75 76 int btintel_check_bdaddr(struct hci_dev *hdev) 77 { 78 struct hci_rp_read_bd_addr *bda; 79 struct sk_buff *skb; 80 81 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 82 HCI_INIT_TIMEOUT); 83 if (IS_ERR(skb)) { 84 int err = PTR_ERR(skb); 85 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 86 err); 87 return err; 88 } 89 90 if (skb->len != sizeof(*bda)) { 91 bt_dev_err(hdev, "Intel device address length mismatch"); 92 kfree_skb(skb); 93 return -EIO; 94 } 95 96 bda = (struct hci_rp_read_bd_addr *)skb->data; 97 98 /* For some Intel based controllers, the default Bluetooth device 99 * address 00:03:19:9E:8B:00 can be found. These controllers are 100 * fully operational, but have the danger of duplicate addresses 101 * and that in turn can cause problems with Bluetooth operation. 102 */ 103 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 104 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 105 &bda->bdaddr); 106 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 107 } 108 109 kfree_skb(skb); 110 111 return 0; 112 } 113 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 114 115 int btintel_enter_mfg(struct hci_dev *hdev) 116 { 117 static const u8 param[] = { 0x01, 0x00 }; 118 struct sk_buff *skb; 119 120 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 121 if (IS_ERR(skb)) { 122 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 123 PTR_ERR(skb)); 124 return PTR_ERR(skb); 125 } 126 kfree_skb(skb); 127 128 return 0; 129 } 130 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 131 132 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 133 { 134 u8 param[] = { 0x00, 0x00 }; 135 struct sk_buff *skb; 136 137 /* The 2nd command parameter specifies the manufacturing exit method: 138 * 0x00: Just disable the manufacturing mode (0x00). 139 * 0x01: Disable manufacturing mode and reset with patches deactivated. 140 * 0x02: Disable manufacturing mode and reset with patches activated. 141 */ 142 if (reset) 143 param[1] |= patched ? 0x02 : 0x01; 144 145 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 146 if (IS_ERR(skb)) { 147 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 148 PTR_ERR(skb)); 149 return PTR_ERR(skb); 150 } 151 kfree_skb(skb); 152 153 return 0; 154 } 155 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 156 157 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 158 { 159 struct sk_buff *skb; 160 int err; 161 162 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 163 if (IS_ERR(skb)) { 164 err = PTR_ERR(skb); 165 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 166 err); 167 return err; 168 } 169 kfree_skb(skb); 170 171 return 0; 172 } 173 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 174 175 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 176 { 177 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 178 struct sk_buff *skb; 179 int err; 180 181 if (debug) 182 mask[1] |= 0x62; 183 184 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 185 if (IS_ERR(skb)) { 186 err = PTR_ERR(skb); 187 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 188 return err; 189 } 190 kfree_skb(skb); 191 192 return 0; 193 } 194 195 int btintel_set_diag(struct hci_dev *hdev, bool enable) 196 { 197 struct sk_buff *skb; 198 u8 param[3]; 199 int err; 200 201 if (enable) { 202 param[0] = 0x03; 203 param[1] = 0x03; 204 param[2] = 0x03; 205 } else { 206 param[0] = 0x00; 207 param[1] = 0x00; 208 param[2] = 0x00; 209 } 210 211 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 212 if (IS_ERR(skb)) { 213 err = PTR_ERR(skb); 214 if (err == -ENODATA) 215 goto done; 216 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 217 err); 218 return err; 219 } 220 kfree_skb(skb); 221 222 done: 223 btintel_set_event_mask(hdev, enable); 224 return 0; 225 } 226 EXPORT_SYMBOL_GPL(btintel_set_diag); 227 228 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 229 { 230 int err, ret; 231 232 err = btintel_enter_mfg(hdev); 233 if (err) 234 return err; 235 236 ret = btintel_set_diag(hdev, enable); 237 238 err = btintel_exit_mfg(hdev, false, false); 239 if (err) 240 return err; 241 242 return ret; 243 } 244 245 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 246 { 247 int ret; 248 249 /* Legacy ROM device needs to be in the manufacturer mode to apply 250 * diagnostic setting 251 * 252 * This flag is set after reading the Intel version. 253 */ 254 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 255 ret = btintel_set_diag_mfg(hdev, enable); 256 else 257 ret = btintel_set_diag(hdev, enable); 258 259 return ret; 260 } 261 262 void btintel_hw_error(struct hci_dev *hdev, u8 code) 263 { 264 struct sk_buff *skb; 265 u8 type = 0x00; 266 267 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 268 269 hci_req_sync_lock(hdev); 270 271 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 272 if (IS_ERR(skb)) { 273 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 274 PTR_ERR(skb)); 275 goto unlock; 276 } 277 kfree_skb(skb); 278 279 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 280 if (IS_ERR(skb)) { 281 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 282 PTR_ERR(skb)); 283 goto unlock; 284 } 285 286 if (skb->len != 13) { 287 bt_dev_err(hdev, "Exception info size mismatch"); 288 kfree_skb(skb); 289 goto unlock; 290 } 291 292 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 293 294 kfree_skb(skb); 295 296 unlock: 297 hci_req_sync_unlock(hdev); 298 } 299 EXPORT_SYMBOL_GPL(btintel_hw_error); 300 301 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 302 { 303 const char *variant; 304 305 /* The hardware platform number has a fixed value of 0x37 and 306 * for now only accept this single value. 307 */ 308 if (ver->hw_platform != 0x37) { 309 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 310 ver->hw_platform); 311 return -EINVAL; 312 } 313 314 /* Check for supported iBT hardware variants of this firmware 315 * loading method. 316 * 317 * This check has been put in place to ensure correct forward 318 * compatibility options when newer hardware variants come along. 319 */ 320 switch (ver->hw_variant) { 321 case 0x07: /* WP - Legacy ROM */ 322 case 0x08: /* StP - Legacy ROM */ 323 case 0x0b: /* SfP */ 324 case 0x0c: /* WsP */ 325 case 0x11: /* JfP */ 326 case 0x12: /* ThP */ 327 case 0x13: /* HrP */ 328 case 0x14: /* CcP */ 329 break; 330 default: 331 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 332 ver->hw_variant); 333 return -EINVAL; 334 } 335 336 switch (ver->fw_variant) { 337 case 0x01: 338 variant = "Legacy ROM 2.5"; 339 break; 340 case 0x06: 341 variant = "Bootloader"; 342 break; 343 case 0x22: 344 variant = "Legacy ROM 2.x"; 345 break; 346 case 0x23: 347 variant = "Firmware"; 348 break; 349 default: 350 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 351 return -EINVAL; 352 } 353 354 coredump_info.hw_variant = ver->hw_variant; 355 coredump_info.fw_build_num = ver->fw_build_num; 356 357 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 358 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 359 ver->fw_build_num, ver->fw_build_ww, 360 2000 + ver->fw_build_yy); 361 362 return 0; 363 } 364 EXPORT_SYMBOL_GPL(btintel_version_info); 365 366 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 367 const void *param) 368 { 369 while (plen > 0) { 370 struct sk_buff *skb; 371 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 372 373 cmd_param[0] = fragment_type; 374 memcpy(cmd_param + 1, param, fragment_len); 375 376 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 377 cmd_param, HCI_INIT_TIMEOUT); 378 if (IS_ERR(skb)) 379 return PTR_ERR(skb); 380 381 kfree_skb(skb); 382 383 plen -= fragment_len; 384 param += fragment_len; 385 } 386 387 return 0; 388 } 389 390 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 391 { 392 const struct firmware *fw; 393 struct sk_buff *skb; 394 const u8 *fw_ptr; 395 int err; 396 397 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 398 if (err < 0) { 399 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 400 ddc_name, err); 401 return err; 402 } 403 404 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 405 406 fw_ptr = fw->data; 407 408 /* DDC file contains one or more DDC structure which has 409 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 410 */ 411 while (fw->size > fw_ptr - fw->data) { 412 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 413 414 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 415 HCI_INIT_TIMEOUT); 416 if (IS_ERR(skb)) { 417 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 418 PTR_ERR(skb)); 419 release_firmware(fw); 420 return PTR_ERR(skb); 421 } 422 423 fw_ptr += cmd_plen; 424 kfree_skb(skb); 425 } 426 427 release_firmware(fw); 428 429 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 430 431 return 0; 432 } 433 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 434 435 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 436 { 437 int err, ret; 438 439 err = btintel_enter_mfg(hdev); 440 if (err) 441 return err; 442 443 ret = btintel_set_event_mask(hdev, debug); 444 445 err = btintel_exit_mfg(hdev, false, false); 446 if (err) 447 return err; 448 449 return ret; 450 } 451 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 452 453 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 454 { 455 struct sk_buff *skb; 456 457 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 458 if (IS_ERR(skb)) { 459 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 460 PTR_ERR(skb)); 461 return PTR_ERR(skb); 462 } 463 464 if (!skb || skb->len != sizeof(*ver)) { 465 bt_dev_err(hdev, "Intel version event size mismatch"); 466 kfree_skb(skb); 467 return -EILSEQ; 468 } 469 470 memcpy(ver, skb->data, sizeof(*ver)); 471 472 kfree_skb(skb); 473 474 return 0; 475 } 476 EXPORT_SYMBOL_GPL(btintel_read_version); 477 478 int btintel_version_info_tlv(struct hci_dev *hdev, 479 struct intel_version_tlv *version) 480 { 481 const char *variant; 482 483 /* The hardware platform number has a fixed value of 0x37 and 484 * for now only accept this single value. 485 */ 486 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 487 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 488 INTEL_HW_PLATFORM(version->cnvi_bt)); 489 return -EINVAL; 490 } 491 492 /* Check for supported iBT hardware variants of this firmware 493 * loading method. 494 * 495 * This check has been put in place to ensure correct forward 496 * compatibility options when newer hardware variants come along. 497 */ 498 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 499 case 0x17: /* TyP */ 500 case 0x18: /* Slr */ 501 case 0x19: /* Slr-F */ 502 case 0x1b: /* Mgr */ 503 case 0x1c: /* Gale Peak (GaP) */ 504 case 0x1d: /* BlazarU (BzrU) */ 505 case 0x1e: /* BlazarI (Bzr) */ 506 case 0x1f: /* Scorpious Peak */ 507 case 0x20: /* Scorpious Peak2 */ 508 case 0x21: /* Scorpious Peak2 F */ 509 case 0x22: /* BlazarIW (BzrIW) */ 510 break; 511 default: 512 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 513 INTEL_HW_VARIANT(version->cnvi_bt)); 514 return -EINVAL; 515 } 516 517 switch (version->img_type) { 518 case BTINTEL_IMG_BOOTLOADER: 519 variant = "Bootloader"; 520 /* It is required that every single firmware fragment is acknowledged 521 * with a command complete event. If the boot parameters indicate 522 * that this bootloader does not send them, then abort the setup. 523 */ 524 if (version->limited_cce != 0x00) { 525 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 526 version->limited_cce); 527 return -EINVAL; 528 } 529 530 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 531 if (version->sbe_type > 0x03) { 532 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 533 version->sbe_type); 534 return -EINVAL; 535 } 536 537 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 538 bt_dev_info(hdev, "Secure boot is %s", 539 str_enabled_disabled(version->secure_boot)); 540 bt_dev_info(hdev, "OTP lock is %s", 541 str_enabled_disabled(version->otp_lock)); 542 bt_dev_info(hdev, "API lock is %s", 543 str_enabled_disabled(version->api_lock)); 544 bt_dev_info(hdev, "Debug lock is %s", 545 str_enabled_disabled(version->debug_lock)); 546 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 547 version->min_fw_build_nn, version->min_fw_build_cw, 548 2000 + version->min_fw_build_yy); 549 break; 550 case BTINTEL_IMG_IML: 551 variant = "Intermediate loader"; 552 break; 553 case BTINTEL_IMG_OP: 554 variant = "Firmware"; 555 break; 556 default: 557 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 558 return -EINVAL; 559 } 560 561 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 562 coredump_info.fw_build_num = version->build_num; 563 564 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 565 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 566 version->build_type, version->build_num); 567 if (version->img_type == BTINTEL_IMG_OP) 568 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 569 570 return 0; 571 } 572 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 573 574 int btintel_parse_version_tlv(struct hci_dev *hdev, 575 struct intel_version_tlv *version, 576 struct sk_buff *skb) 577 { 578 /* Consume Command Complete Status field */ 579 skb_pull(skb, 1); 580 581 /* Event parameters contain multiple TLVs. Read each of them 582 * and only keep the required data. Also, it use existing legacy 583 * version field like hw_platform, hw_variant, and fw_variant 584 * to keep the existing setup flow 585 */ 586 while (skb->len) { 587 struct intel_tlv *tlv; 588 589 /* Make sure skb has a minimum length of the header */ 590 if (skb->len < sizeof(*tlv)) 591 return -EINVAL; 592 593 tlv = (struct intel_tlv *)skb->data; 594 595 /* Make sure skb has a enough data */ 596 if (skb->len < tlv->len + sizeof(*tlv)) 597 return -EINVAL; 598 599 switch (tlv->type) { 600 case INTEL_TLV_CNVI_TOP: 601 version->cnvi_top = get_unaligned_le32(tlv->val); 602 break; 603 case INTEL_TLV_CNVR_TOP: 604 version->cnvr_top = get_unaligned_le32(tlv->val); 605 break; 606 case INTEL_TLV_CNVI_BT: 607 version->cnvi_bt = get_unaligned_le32(tlv->val); 608 break; 609 case INTEL_TLV_CNVR_BT: 610 version->cnvr_bt = get_unaligned_le32(tlv->val); 611 break; 612 case INTEL_TLV_DEV_REV_ID: 613 version->dev_rev_id = get_unaligned_le16(tlv->val); 614 break; 615 case INTEL_TLV_IMAGE_TYPE: 616 version->img_type = tlv->val[0]; 617 break; 618 case INTEL_TLV_TIME_STAMP: 619 /* If image type is Operational firmware (0x03), then 620 * running FW Calendar Week and Year information can 621 * be extracted from Timestamp information 622 */ 623 version->min_fw_build_cw = tlv->val[0]; 624 version->min_fw_build_yy = tlv->val[1]; 625 version->timestamp = get_unaligned_le16(tlv->val); 626 break; 627 case INTEL_TLV_BUILD_TYPE: 628 version->build_type = tlv->val[0]; 629 break; 630 case INTEL_TLV_BUILD_NUM: 631 /* If image type is Operational firmware (0x03), then 632 * running FW build number can be extracted from the 633 * Build information 634 */ 635 version->min_fw_build_nn = tlv->val[0]; 636 version->build_num = get_unaligned_le32(tlv->val); 637 break; 638 case INTEL_TLV_SECURE_BOOT: 639 version->secure_boot = tlv->val[0]; 640 break; 641 case INTEL_TLV_OTP_LOCK: 642 version->otp_lock = tlv->val[0]; 643 break; 644 case INTEL_TLV_API_LOCK: 645 version->api_lock = tlv->val[0]; 646 break; 647 case INTEL_TLV_DEBUG_LOCK: 648 version->debug_lock = tlv->val[0]; 649 break; 650 case INTEL_TLV_MIN_FW: 651 version->min_fw_build_nn = tlv->val[0]; 652 version->min_fw_build_cw = tlv->val[1]; 653 version->min_fw_build_yy = tlv->val[2]; 654 break; 655 case INTEL_TLV_LIMITED_CCE: 656 version->limited_cce = tlv->val[0]; 657 break; 658 case INTEL_TLV_SBE_TYPE: 659 version->sbe_type = tlv->val[0]; 660 break; 661 case INTEL_TLV_OTP_BDADDR: 662 memcpy(&version->otp_bd_addr, tlv->val, 663 sizeof(bdaddr_t)); 664 break; 665 case INTEL_TLV_GIT_SHA1: 666 version->git_sha1 = get_unaligned_le32(tlv->val); 667 break; 668 case INTEL_TLV_FW_ID: 669 snprintf(version->fw_id, sizeof(version->fw_id), 670 "%s", tlv->val); 671 break; 672 default: 673 /* Ignore rest of information */ 674 break; 675 } 676 /* consume the current tlv and move to next*/ 677 skb_pull(skb, tlv->len + sizeof(*tlv)); 678 } 679 680 return 0; 681 } 682 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 683 684 static int btintel_read_version_tlv(struct hci_dev *hdev, 685 struct intel_version_tlv *version) 686 { 687 struct sk_buff *skb; 688 const u8 param[1] = { 0xFF }; 689 690 if (!version) 691 return -EINVAL; 692 693 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 694 if (IS_ERR(skb)) { 695 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 696 PTR_ERR(skb)); 697 return PTR_ERR(skb); 698 } 699 700 if (skb->data[0]) { 701 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 702 skb->data[0]); 703 kfree_skb(skb); 704 return -EIO; 705 } 706 707 btintel_parse_version_tlv(hdev, version, skb); 708 709 kfree_skb(skb); 710 return 0; 711 } 712 713 /* ------- REGMAP IBT SUPPORT ------- */ 714 715 #define IBT_REG_MODE_8BIT 0x00 716 #define IBT_REG_MODE_16BIT 0x01 717 #define IBT_REG_MODE_32BIT 0x02 718 719 struct regmap_ibt_context { 720 struct hci_dev *hdev; 721 __u16 op_write; 722 __u16 op_read; 723 }; 724 725 struct ibt_cp_reg_access { 726 __le32 addr; 727 __u8 mode; 728 __u8 len; 729 __u8 data[]; 730 } __packed; 731 732 struct ibt_rp_reg_access { 733 __u8 status; 734 __le32 addr; 735 __u8 data[]; 736 } __packed; 737 738 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 739 void *val, size_t val_size) 740 { 741 struct regmap_ibt_context *ctx = context; 742 struct ibt_cp_reg_access cp; 743 struct ibt_rp_reg_access *rp; 744 struct sk_buff *skb; 745 int err = 0; 746 747 if (reg_size != sizeof(__le32)) 748 return -EINVAL; 749 750 switch (val_size) { 751 case 1: 752 cp.mode = IBT_REG_MODE_8BIT; 753 break; 754 case 2: 755 cp.mode = IBT_REG_MODE_16BIT; 756 break; 757 case 4: 758 cp.mode = IBT_REG_MODE_32BIT; 759 break; 760 default: 761 return -EINVAL; 762 } 763 764 /* regmap provides a little-endian formatted addr */ 765 cp.addr = *(__le32 *)addr; 766 cp.len = val_size; 767 768 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 769 770 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 771 HCI_CMD_TIMEOUT); 772 if (IS_ERR(skb)) { 773 err = PTR_ERR(skb); 774 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 775 le32_to_cpu(cp.addr), err); 776 return err; 777 } 778 779 if (skb->len != sizeof(*rp) + val_size) { 780 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 781 le32_to_cpu(cp.addr)); 782 err = -EINVAL; 783 goto done; 784 } 785 786 rp = (struct ibt_rp_reg_access *)skb->data; 787 788 if (rp->addr != cp.addr) { 789 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 790 le32_to_cpu(rp->addr)); 791 err = -EINVAL; 792 goto done; 793 } 794 795 memcpy(val, rp->data, val_size); 796 797 done: 798 kfree_skb(skb); 799 return err; 800 } 801 802 static int regmap_ibt_gather_write(void *context, 803 const void *addr, size_t reg_size, 804 const void *val, size_t val_size) 805 { 806 struct regmap_ibt_context *ctx = context; 807 struct ibt_cp_reg_access *cp; 808 struct sk_buff *skb; 809 int plen = sizeof(*cp) + val_size; 810 u8 mode; 811 int err = 0; 812 813 if (reg_size != sizeof(__le32)) 814 return -EINVAL; 815 816 switch (val_size) { 817 case 1: 818 mode = IBT_REG_MODE_8BIT; 819 break; 820 case 2: 821 mode = IBT_REG_MODE_16BIT; 822 break; 823 case 4: 824 mode = IBT_REG_MODE_32BIT; 825 break; 826 default: 827 return -EINVAL; 828 } 829 830 cp = kmalloc(plen, GFP_KERNEL); 831 if (!cp) 832 return -ENOMEM; 833 834 /* regmap provides a little-endian formatted addr/value */ 835 cp->addr = *(__le32 *)addr; 836 cp->mode = mode; 837 cp->len = val_size; 838 memcpy(&cp->data, val, val_size); 839 840 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 841 842 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 843 if (IS_ERR(skb)) { 844 err = PTR_ERR(skb); 845 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 846 le32_to_cpu(cp->addr), err); 847 goto done; 848 } 849 kfree_skb(skb); 850 851 done: 852 kfree(cp); 853 return err; 854 } 855 856 static int regmap_ibt_write(void *context, const void *data, size_t count) 857 { 858 /* data contains register+value, since we only support 32bit addr, 859 * minimum data size is 4 bytes. 860 */ 861 if (WARN_ONCE(count < 4, "Invalid register access")) 862 return -EINVAL; 863 864 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 865 } 866 867 static void regmap_ibt_free_context(void *context) 868 { 869 kfree(context); 870 } 871 872 static const struct regmap_bus regmap_ibt = { 873 .read = regmap_ibt_read, 874 .write = regmap_ibt_write, 875 .gather_write = regmap_ibt_gather_write, 876 .free_context = regmap_ibt_free_context, 877 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 878 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 879 }; 880 881 /* Config is the same for all register regions */ 882 static const struct regmap_config regmap_ibt_cfg = { 883 .name = "btintel_regmap", 884 .reg_bits = 32, 885 .val_bits = 32, 886 }; 887 888 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 889 u16 opcode_write) 890 { 891 struct regmap_ibt_context *ctx; 892 893 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 894 opcode_write); 895 896 ctx = kzalloc_obj(*ctx); 897 if (!ctx) 898 return ERR_PTR(-ENOMEM); 899 900 ctx->op_read = opcode_read; 901 ctx->op_write = opcode_write; 902 ctx->hdev = hdev; 903 904 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 905 } 906 EXPORT_SYMBOL_GPL(btintel_regmap_init); 907 908 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 909 { 910 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 911 struct sk_buff *skb; 912 913 params.boot_param = cpu_to_le32(boot_param); 914 915 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 916 HCI_INIT_TIMEOUT); 917 if (IS_ERR(skb)) { 918 bt_dev_err(hdev, "Failed to send Intel Reset command"); 919 return PTR_ERR(skb); 920 } 921 922 kfree_skb(skb); 923 924 return 0; 925 } 926 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 927 928 int btintel_read_boot_params(struct hci_dev *hdev, 929 struct intel_boot_params *params) 930 { 931 struct sk_buff *skb; 932 933 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 934 if (IS_ERR(skb)) { 935 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 936 PTR_ERR(skb)); 937 return PTR_ERR(skb); 938 } 939 940 if (skb->len != sizeof(*params)) { 941 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 942 kfree_skb(skb); 943 return -EILSEQ; 944 } 945 946 memcpy(params, skb->data, sizeof(*params)); 947 948 kfree_skb(skb); 949 950 if (params->status) { 951 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 952 params->status); 953 return -bt_to_errno(params->status); 954 } 955 956 bt_dev_info(hdev, "Device revision is %u", 957 le16_to_cpu(params->dev_revid)); 958 959 bt_dev_info(hdev, "Secure boot is %s", 960 str_enabled_disabled(params->secure_boot)); 961 962 bt_dev_info(hdev, "OTP lock is %s", 963 str_enabled_disabled(params->otp_lock)); 964 965 bt_dev_info(hdev, "API lock is %s", 966 str_enabled_disabled(params->api_lock)); 967 968 bt_dev_info(hdev, "Debug lock is %s", 969 str_enabled_disabled(params->debug_lock)); 970 971 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 972 params->min_fw_build_nn, params->min_fw_build_cw, 973 2000 + params->min_fw_build_yy); 974 975 return 0; 976 } 977 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 978 979 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 980 const struct firmware *fw) 981 { 982 int err; 983 984 /* Start the firmware download transaction with the Init fragment 985 * represented by the 128 bytes of CSS header. 986 */ 987 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 988 if (err < 0) { 989 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 990 goto done; 991 } 992 993 /* Send the 256 bytes of public key information from the firmware 994 * as the PKey fragment. 995 */ 996 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 997 if (err < 0) { 998 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 999 goto done; 1000 } 1001 1002 /* Send the 256 bytes of signature information from the firmware 1003 * as the Sign fragment. 1004 */ 1005 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1006 if (err < 0) { 1007 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1008 goto done; 1009 } 1010 1011 done: 1012 return err; 1013 } 1014 1015 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1016 const struct firmware *fw) 1017 { 1018 int err; 1019 1020 /* Start the firmware download transaction with the Init fragment 1021 * represented by the 128 bytes of CSS header. 1022 */ 1023 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1024 if (err < 0) { 1025 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1026 return err; 1027 } 1028 1029 /* Send the 96 bytes of public key information from the firmware 1030 * as the PKey fragment. 1031 */ 1032 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1033 if (err < 0) { 1034 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1035 return err; 1036 } 1037 1038 /* Send the 96 bytes of signature information from the firmware 1039 * as the Sign fragment 1040 */ 1041 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1042 if (err < 0) { 1043 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1044 err); 1045 return err; 1046 } 1047 return 0; 1048 } 1049 1050 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1051 const struct firmware *fw) 1052 { 1053 int err; 1054 1055 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1056 if (err < 0) { 1057 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1058 return err; 1059 } 1060 1061 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1062 fw->data + BTINTEL_ECDSA_OFFSET); 1063 if (err < 0) { 1064 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1065 return err; 1066 } 1067 1068 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1069 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1070 if (err < 0) { 1071 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1072 return err; 1073 } 1074 1075 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1076 fw->data + BTINTEL_LMS_OFFSET); 1077 if (err < 0) { 1078 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1079 return err; 1080 } 1081 1082 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1083 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1084 if (err < 0) { 1085 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1086 return err; 1087 } 1088 1089 return 0; 1090 } 1091 1092 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1093 const struct firmware *fw, 1094 size_t offset) 1095 { 1096 int err; 1097 const u8 *fw_ptr; 1098 u32 frag_len; 1099 1100 fw_ptr = fw->data + offset; 1101 frag_len = 0; 1102 err = -EINVAL; 1103 1104 while (fw_ptr - fw->data < fw->size) { 1105 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1106 1107 frag_len += sizeof(*cmd) + cmd->plen; 1108 1109 /* The parameter length of the secure send command requires 1110 * a 4 byte alignment. It happens so that the firmware file 1111 * contains proper Intel_NOP commands to align the fragments 1112 * as needed. 1113 * 1114 * Send set of commands with 4 byte alignment from the 1115 * firmware data buffer as a single Data fragment. 1116 */ 1117 if (!(frag_len % 4)) { 1118 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1119 if (err < 0) { 1120 bt_dev_err(hdev, 1121 "Failed to send firmware data (%d)", 1122 err); 1123 goto done; 1124 } 1125 1126 fw_ptr += frag_len; 1127 frag_len = 0; 1128 } 1129 } 1130 1131 done: 1132 return err; 1133 } 1134 1135 static bool btintel_firmware_version(struct hci_dev *hdev, 1136 u8 num, u8 ww, u8 yy, 1137 const struct firmware *fw, 1138 u32 *boot_addr) 1139 { 1140 const u8 *fw_ptr; 1141 1142 fw_ptr = fw->data; 1143 1144 while (fw_ptr - fw->data < fw->size) { 1145 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1146 1147 /* Each SKU has a different reset parameter to use in the 1148 * HCI_Intel_Reset command and it is embedded in the firmware 1149 * data. So, instead of using static value per SKU, check 1150 * the firmware data and save it for later use. 1151 */ 1152 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1153 struct cmd_write_boot_params *params; 1154 1155 params = (void *)(fw_ptr + sizeof(*cmd)); 1156 1157 *boot_addr = le32_to_cpu(params->boot_addr); 1158 1159 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1160 1161 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1162 params->fw_build_num, params->fw_build_ww, 1163 params->fw_build_yy); 1164 1165 return (num == params->fw_build_num && 1166 ww == params->fw_build_ww && 1167 yy == params->fw_build_yy); 1168 } 1169 1170 fw_ptr += sizeof(*cmd) + cmd->plen; 1171 } 1172 1173 return false; 1174 } 1175 1176 int btintel_download_firmware(struct hci_dev *hdev, 1177 struct intel_version *ver, 1178 const struct firmware *fw, 1179 u32 *boot_param) 1180 { 1181 int err; 1182 1183 /* SfP and WsP don't seem to update the firmware version on file 1184 * so version checking is currently not possible. 1185 */ 1186 switch (ver->hw_variant) { 1187 case 0x0b: /* SfP */ 1188 case 0x0c: /* WsP */ 1189 /* Skip version checking */ 1190 break; 1191 default: 1192 1193 /* Skip download if firmware has the same version */ 1194 if (btintel_firmware_version(hdev, ver->fw_build_num, 1195 ver->fw_build_ww, ver->fw_build_yy, 1196 fw, boot_param)) { 1197 bt_dev_info(hdev, "Firmware already loaded"); 1198 /* Return -EALREADY to indicate that the firmware has 1199 * already been loaded. 1200 */ 1201 return -EALREADY; 1202 } 1203 } 1204 1205 /* The firmware variant determines if the device is in bootloader 1206 * mode or is running operational firmware. The value 0x06 identifies 1207 * the bootloader and the value 0x23 identifies the operational 1208 * firmware. 1209 * 1210 * If the firmware version has changed that means it needs to be reset 1211 * to bootloader when operational so the new firmware can be loaded. 1212 */ 1213 if (ver->fw_variant == 0x23) 1214 return -EINVAL; 1215 1216 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1217 if (err) 1218 return err; 1219 1220 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1221 } 1222 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1223 1224 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1225 struct intel_version_tlv *ver, 1226 const struct firmware *fw, u32 *boot_param, 1227 u8 hw_variant, u8 sbe_type) 1228 { 1229 int err; 1230 u32 css_header_ver; 1231 1232 /* Skip download if firmware has the same version */ 1233 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1234 ver->min_fw_build_cw, 1235 ver->min_fw_build_yy, 1236 fw, boot_param)) { 1237 bt_dev_info(hdev, "Firmware already loaded"); 1238 /* Return -EALREADY to indicate that firmware has 1239 * already been loaded. 1240 */ 1241 return -EALREADY; 1242 } 1243 1244 /* The firmware variant determines if the device is in bootloader 1245 * mode or is running operational firmware. The value 0x01 identifies 1246 * the bootloader and the value 0x03 identifies the operational 1247 * firmware. 1248 * 1249 * If the firmware version has changed that means it needs to be reset 1250 * to bootloader when operational so the new firmware can be loaded. 1251 */ 1252 if (ver->img_type == BTINTEL_IMG_OP) 1253 return -EINVAL; 1254 1255 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1256 * only RSA secure boot engine. Hence, the corresponding sfi file will 1257 * have RSA header of 644 bytes followed by Command Buffer. 1258 * 1259 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1260 * secure boot engine. As a result, the corresponding sfi file will 1261 * have RSA header of 644, ECDSA header of 320 bytes followed by 1262 * Command Buffer. 1263 * 1264 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1265 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1266 */ 1267 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1268 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1269 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1270 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1271 return -EINVAL; 1272 } 1273 1274 if (hw_variant <= 0x14) { 1275 if (sbe_type != 0x00) { 1276 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1277 hw_variant); 1278 return -EINVAL; 1279 } 1280 1281 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1282 if (err) 1283 return err; 1284 1285 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1286 if (err) 1287 return err; 1288 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1289 /* Check if CSS header for ECDSA follows the RSA header */ 1290 if (fw->data[ECDSA_OFFSET] != 0x06) 1291 return -EINVAL; 1292 1293 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1294 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1295 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1296 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1297 return -EINVAL; 1298 } 1299 1300 if (sbe_type == 0x00) { 1301 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1302 if (err) 1303 return err; 1304 1305 err = btintel_download_firmware_payload(hdev, fw, 1306 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1307 if (err) 1308 return err; 1309 } else if (sbe_type == 0x01) { 1310 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1311 if (err) 1312 return err; 1313 1314 err = btintel_download_firmware_payload(hdev, fw, 1315 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1316 if (err) 1317 return err; 1318 } 1319 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1320 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1321 if (err) 1322 return err; 1323 1324 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1325 if (err) 1326 return err; 1327 } 1328 return 0; 1329 } 1330 1331 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1332 { 1333 struct intel_reset params; 1334 struct sk_buff *skb; 1335 1336 /* PCIe transport uses shared hardware reset mechanism for recovery 1337 * which gets triggered in pcie *setup* function on error. 1338 */ 1339 if (hdev->bus == HCI_PCI) 1340 return; 1341 1342 /* Send Intel Reset command. This will result in 1343 * re-enumeration of BT controller. 1344 * 1345 * Intel Reset parameter description: 1346 * reset_type : 0x00 (Soft reset), 1347 * 0x01 (Hard reset) 1348 * patch_enable : 0x00 (Do not enable), 1349 * 0x01 (Enable) 1350 * ddc_reload : 0x00 (Do not reload), 1351 * 0x01 (Reload) 1352 * boot_option: 0x00 (Current image), 1353 * 0x01 (Specified boot address) 1354 * boot_param: Boot address 1355 * 1356 */ 1357 1358 params.reset_type = 0x01; 1359 params.patch_enable = 0x01; 1360 params.ddc_reload = 0x01; 1361 params.boot_option = 0x00; 1362 params.boot_param = cpu_to_le32(0x00000000); 1363 1364 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1365 ¶ms, HCI_INIT_TIMEOUT); 1366 if (IS_ERR(skb)) { 1367 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1368 PTR_ERR(skb)); 1369 return; 1370 } 1371 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1372 kfree_skb(skb); 1373 1374 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1375 * lines for 2ms when it receives Intel Reset in bootloader mode. 1376 * Whereas, the upcoming Intel BT controllers will hold USB reset 1377 * for 150ms. To keep the delay generic, 150ms is chosen here. 1378 */ 1379 msleep(150); 1380 } 1381 1382 static int btintel_read_debug_features(struct hci_dev *hdev, 1383 struct intel_debug_features *features) 1384 { 1385 struct sk_buff *skb; 1386 u8 page_no = 1; 1387 1388 /* Intel controller supports two pages, each page is of 128-bit 1389 * feature bit mask. And each bit defines specific feature support 1390 */ 1391 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1392 HCI_INIT_TIMEOUT); 1393 if (IS_ERR(skb)) { 1394 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1395 PTR_ERR(skb)); 1396 return PTR_ERR(skb); 1397 } 1398 1399 if (skb->len != (sizeof(features->page1) + 3)) { 1400 bt_dev_err(hdev, "Supported features event size mismatch"); 1401 kfree_skb(skb); 1402 return -EILSEQ; 1403 } 1404 1405 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1406 1407 /* Read the supported features page2 if required in future. 1408 */ 1409 kfree_skb(skb); 1410 return 0; 1411 } 1412 1413 static int btintel_set_debug_features(struct hci_dev *hdev, 1414 const struct intel_debug_features *features) 1415 { 1416 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1417 0x00, 0x00, 0x00 }; 1418 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1419 u8 trace_enable = 0x02; 1420 struct sk_buff *skb; 1421 1422 if (!features) { 1423 bt_dev_warn(hdev, "Debug features not read"); 1424 return -EINVAL; 1425 } 1426 1427 if (!(features->page1[0] & 0x3f)) { 1428 bt_dev_info(hdev, "Telemetry exception format not supported"); 1429 return 0; 1430 } 1431 1432 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1433 if (IS_ERR(skb)) { 1434 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1435 PTR_ERR(skb)); 1436 return PTR_ERR(skb); 1437 } 1438 kfree_skb(skb); 1439 1440 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1441 if (IS_ERR(skb)) { 1442 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1443 PTR_ERR(skb)); 1444 return PTR_ERR(skb); 1445 } 1446 kfree_skb(skb); 1447 1448 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1449 if (IS_ERR(skb)) { 1450 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1451 PTR_ERR(skb)); 1452 return PTR_ERR(skb); 1453 } 1454 kfree_skb(skb); 1455 1456 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1457 trace_enable, mask[3]); 1458 1459 return 0; 1460 } 1461 1462 static int btintel_reset_debug_features(struct hci_dev *hdev, 1463 const struct intel_debug_features *features) 1464 { 1465 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1466 0x00, 0x00, 0x00 }; 1467 u8 trace_enable = 0x00; 1468 struct sk_buff *skb; 1469 1470 if (!features) { 1471 bt_dev_warn(hdev, "Debug features not read"); 1472 return -EINVAL; 1473 } 1474 1475 if (!(features->page1[0] & 0x3f)) { 1476 bt_dev_info(hdev, "Telemetry exception format not supported"); 1477 return 0; 1478 } 1479 1480 /* Should stop the trace before writing ddc event mask. */ 1481 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1482 if (IS_ERR(skb)) { 1483 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1484 PTR_ERR(skb)); 1485 return PTR_ERR(skb); 1486 } 1487 kfree_skb(skb); 1488 1489 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1490 if (IS_ERR(skb)) { 1491 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1492 PTR_ERR(skb)); 1493 return PTR_ERR(skb); 1494 } 1495 kfree_skb(skb); 1496 1497 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1498 trace_enable, mask[3]); 1499 1500 return 0; 1501 } 1502 1503 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1504 { 1505 struct intel_debug_features features; 1506 int err; 1507 1508 bt_dev_dbg(hdev, "enable %d", enable); 1509 1510 /* Read the Intel supported features and if new exception formats 1511 * supported, need to load the additional DDC config to enable. 1512 */ 1513 err = btintel_read_debug_features(hdev, &features); 1514 if (err) 1515 return err; 1516 1517 /* Set or reset the debug features. */ 1518 if (enable) 1519 err = btintel_set_debug_features(hdev, &features); 1520 else 1521 err = btintel_reset_debug_features(hdev, &features); 1522 1523 return err; 1524 } 1525 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1526 1527 static void btintel_coredump(struct hci_dev *hdev) 1528 { 1529 struct sk_buff *skb; 1530 1531 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1532 if (IS_ERR(skb)) { 1533 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1534 return; 1535 } 1536 1537 kfree_skb(skb); 1538 } 1539 1540 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1541 { 1542 char buf[80]; 1543 1544 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1545 coredump_info.hw_variant); 1546 skb_put_data(skb, buf, strlen(buf)); 1547 1548 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1549 coredump_info.fw_build_num); 1550 skb_put_data(skb, buf, strlen(buf)); 1551 1552 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1553 skb_put_data(skb, buf, strlen(buf)); 1554 1555 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1556 skb_put_data(skb, buf, strlen(buf)); 1557 } 1558 1559 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1560 { 1561 struct intel_debug_features features; 1562 int err; 1563 1564 err = btintel_read_debug_features(hdev, &features); 1565 if (err) { 1566 bt_dev_info(hdev, "Error reading debug features"); 1567 return err; 1568 } 1569 1570 if (!(features.page1[0] & 0x3f)) { 1571 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1572 return -EOPNOTSUPP; 1573 } 1574 1575 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1576 1577 return err; 1578 } 1579 1580 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1581 struct intel_version *ver) 1582 { 1583 const struct firmware *fw; 1584 char fwname[64]; 1585 int ret; 1586 1587 snprintf(fwname, sizeof(fwname), 1588 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1589 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1590 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1591 ver->fw_build_ww, ver->fw_build_yy); 1592 1593 ret = request_firmware(&fw, fwname, &hdev->dev); 1594 if (ret < 0) { 1595 if (ret == -EINVAL) { 1596 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1597 ret); 1598 return NULL; 1599 } 1600 1601 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1602 fwname, ret); 1603 1604 /* If the correct firmware patch file is not found, use the 1605 * default firmware patch file instead 1606 */ 1607 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1608 ver->hw_platform, ver->hw_variant); 1609 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1610 bt_dev_err(hdev, "failed to open default fw file: %s", 1611 fwname); 1612 return NULL; 1613 } 1614 } 1615 1616 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1617 1618 return fw; 1619 } 1620 1621 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1622 const struct firmware *fw, 1623 const u8 **fw_ptr, int *disable_patch) 1624 { 1625 struct sk_buff *skb; 1626 struct hci_command_hdr *cmd; 1627 const u8 *cmd_param; 1628 struct hci_event_hdr *evt = NULL; 1629 const u8 *evt_param = NULL; 1630 int remain = fw->size - (*fw_ptr - fw->data); 1631 1632 /* The first byte indicates the types of the patch command or event. 1633 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1634 * in the current firmware buffer doesn't start with 0x01 or 1635 * the size of remain buffer is smaller than HCI command header, 1636 * the firmware file is corrupted and it should stop the patching 1637 * process. 1638 */ 1639 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1640 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1641 return -EINVAL; 1642 } 1643 (*fw_ptr)++; 1644 remain--; 1645 1646 cmd = (struct hci_command_hdr *)(*fw_ptr); 1647 *fw_ptr += sizeof(*cmd); 1648 remain -= sizeof(*cmd); 1649 1650 /* Ensure that the remain firmware data is long enough than the length 1651 * of command parameter. If not, the firmware file is corrupted. 1652 */ 1653 if (remain < cmd->plen) { 1654 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1655 return -EFAULT; 1656 } 1657 1658 /* If there is a command that loads a patch in the firmware 1659 * file, then enable the patch upon success, otherwise just 1660 * disable the manufacturer mode, for example patch activation 1661 * is not required when the default firmware patch file is used 1662 * because there are no patch data to load. 1663 */ 1664 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1665 *disable_patch = 0; 1666 1667 cmd_param = *fw_ptr; 1668 *fw_ptr += cmd->plen; 1669 remain -= cmd->plen; 1670 1671 /* This reads the expected events when the above command is sent to the 1672 * device. Some vendor commands expects more than one events, for 1673 * example command status event followed by vendor specific event. 1674 * For this case, it only keeps the last expected event. so the command 1675 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1676 * last expected event. 1677 */ 1678 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1679 (*fw_ptr)++; 1680 remain--; 1681 1682 evt = (struct hci_event_hdr *)(*fw_ptr); 1683 *fw_ptr += sizeof(*evt); 1684 remain -= sizeof(*evt); 1685 1686 if (remain < evt->plen) { 1687 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1688 return -EFAULT; 1689 } 1690 1691 evt_param = *fw_ptr; 1692 *fw_ptr += evt->plen; 1693 remain -= evt->plen; 1694 } 1695 1696 /* Every HCI commands in the firmware file has its correspond event. 1697 * If event is not found or remain is smaller than zero, the firmware 1698 * file is corrupted. 1699 */ 1700 if (!evt || !evt_param || remain < 0) { 1701 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1702 return -EFAULT; 1703 } 1704 1705 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1706 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1707 if (IS_ERR(skb)) { 1708 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1709 cmd->opcode, PTR_ERR(skb)); 1710 return PTR_ERR(skb); 1711 } 1712 1713 /* It ensures that the returned event matches the event data read from 1714 * the firmware file. At fist, it checks the length and then 1715 * the contents of the event. 1716 */ 1717 if (skb->len != evt->plen) { 1718 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1719 le16_to_cpu(cmd->opcode)); 1720 kfree_skb(skb); 1721 return -EFAULT; 1722 } 1723 1724 if (memcmp(skb->data, evt_param, evt->plen)) { 1725 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1726 le16_to_cpu(cmd->opcode)); 1727 kfree_skb(skb); 1728 return -EFAULT; 1729 } 1730 kfree_skb(skb); 1731 1732 return 0; 1733 } 1734 1735 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1736 struct intel_version *ver) 1737 { 1738 const struct firmware *fw; 1739 const u8 *fw_ptr; 1740 int disable_patch, err; 1741 struct intel_version new_ver; 1742 1743 BT_DBG("%s", hdev->name); 1744 1745 /* fw_patch_num indicates the version of patch the device currently 1746 * have. If there is no patch data in the device, it is always 0x00. 1747 * So, if it is other than 0x00, no need to patch the device again. 1748 */ 1749 if (ver->fw_patch_num) { 1750 bt_dev_info(hdev, 1751 "Intel device is already patched. patch num: %02x", 1752 ver->fw_patch_num); 1753 goto complete; 1754 } 1755 1756 /* Opens the firmware patch file based on the firmware version read 1757 * from the controller. If it fails to open the matching firmware 1758 * patch file, it tries to open the default firmware patch file. 1759 * If no patch file is found, allow the device to operate without 1760 * a patch. 1761 */ 1762 fw = btintel_legacy_rom_get_fw(hdev, ver); 1763 if (!fw) 1764 goto complete; 1765 fw_ptr = fw->data; 1766 1767 /* Enable the manufacturer mode of the controller. 1768 * Only while this mode is enabled, the driver can download the 1769 * firmware patch data and configuration parameters. 1770 */ 1771 err = btintel_enter_mfg(hdev); 1772 if (err) { 1773 release_firmware(fw); 1774 return err; 1775 } 1776 1777 disable_patch = 1; 1778 1779 /* The firmware data file consists of list of Intel specific HCI 1780 * commands and its expected events. The first byte indicates the 1781 * type of the message, either HCI command or HCI event. 1782 * 1783 * It reads the command and its expected event from the firmware file, 1784 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1785 * the returned event is compared with the event read from the firmware 1786 * file and it will continue until all the messages are downloaded to 1787 * the controller. 1788 * 1789 * Once the firmware patching is completed successfully, 1790 * the manufacturer mode is disabled with reset and activating the 1791 * downloaded patch. 1792 * 1793 * If the firmware patching fails, the manufacturer mode is 1794 * disabled with reset and deactivating the patch. 1795 * 1796 * If the default patch file is used, no reset is done when disabling 1797 * the manufacturer. 1798 */ 1799 while (fw->size > fw_ptr - fw->data) { 1800 int ret; 1801 1802 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1803 &disable_patch); 1804 if (ret < 0) 1805 goto exit_mfg_deactivate; 1806 } 1807 1808 release_firmware(fw); 1809 1810 if (disable_patch) 1811 goto exit_mfg_disable; 1812 1813 /* Patching completed successfully and disable the manufacturer mode 1814 * with reset and activate the downloaded firmware patches. 1815 */ 1816 err = btintel_exit_mfg(hdev, true, true); 1817 if (err) 1818 return err; 1819 1820 /* Need build number for downloaded fw patches in 1821 * every power-on boot 1822 */ 1823 err = btintel_read_version(hdev, &new_ver); 1824 if (err) 1825 return err; 1826 1827 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1828 new_ver.fw_patch_num); 1829 1830 goto complete; 1831 1832 exit_mfg_disable: 1833 /* Disable the manufacturer mode without reset */ 1834 err = btintel_exit_mfg(hdev, false, false); 1835 if (err) 1836 return err; 1837 1838 bt_dev_info(hdev, "Intel firmware patch completed"); 1839 1840 goto complete; 1841 1842 exit_mfg_deactivate: 1843 release_firmware(fw); 1844 1845 /* Patching failed. Disable the manufacturer mode with reset and 1846 * deactivate the downloaded firmware patches. 1847 */ 1848 err = btintel_exit_mfg(hdev, true, false); 1849 if (err) 1850 return err; 1851 1852 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1853 1854 complete: 1855 /* Set the event mask for Intel specific vendor events. This enables 1856 * a few extra events that are useful during general operation. 1857 */ 1858 btintel_set_event_mask_mfg(hdev, false); 1859 1860 btintel_check_bdaddr(hdev); 1861 1862 return 0; 1863 } 1864 1865 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1866 { 1867 ktime_t delta, rettime; 1868 unsigned long long duration; 1869 int err; 1870 1871 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1872 1873 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1874 1875 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1876 TASK_INTERRUPTIBLE, 1877 msecs_to_jiffies(msec)); 1878 if (err == -EINTR) { 1879 bt_dev_err(hdev, "Firmware loading interrupted"); 1880 return err; 1881 } 1882 1883 if (err) { 1884 bt_dev_err(hdev, "Firmware loading timeout"); 1885 return -ETIMEDOUT; 1886 } 1887 1888 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1889 bt_dev_err(hdev, "Firmware loading failed"); 1890 return -ENOEXEC; 1891 } 1892 1893 rettime = ktime_get(); 1894 delta = ktime_sub(rettime, calltime); 1895 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1896 1897 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1898 1899 return 0; 1900 } 1901 1902 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1903 { 1904 ktime_t delta, rettime; 1905 unsigned long long duration; 1906 int err; 1907 1908 bt_dev_info(hdev, "Waiting for device to boot"); 1909 1910 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1911 TASK_INTERRUPTIBLE, 1912 msecs_to_jiffies(msec)); 1913 if (err == -EINTR) { 1914 bt_dev_err(hdev, "Device boot interrupted"); 1915 return -EINTR; 1916 } 1917 1918 if (err) { 1919 bt_dev_err(hdev, "Device boot timeout"); 1920 return -ETIMEDOUT; 1921 } 1922 1923 rettime = ktime_get(); 1924 delta = ktime_sub(rettime, calltime); 1925 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1926 1927 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1928 1929 return 0; 1930 } 1931 1932 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1933 int msec) 1934 { 1935 ktime_t delta, rettime; 1936 unsigned long long duration; 1937 int err; 1938 1939 bt_dev_info(hdev, "Waiting for device transition to d0"); 1940 1941 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1942 TASK_INTERRUPTIBLE, 1943 msecs_to_jiffies(msec)); 1944 if (err == -EINTR) { 1945 bt_dev_err(hdev, "Device d0 move interrupted"); 1946 return -EINTR; 1947 } 1948 1949 if (err) { 1950 bt_dev_err(hdev, "Device d0 move timeout"); 1951 return -ETIMEDOUT; 1952 } 1953 1954 rettime = ktime_get(); 1955 delta = ktime_sub(rettime, calltime); 1956 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1957 1958 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 1959 1960 return 0; 1961 } 1962 1963 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1964 { 1965 ktime_t calltime; 1966 int err; 1967 1968 calltime = ktime_get(); 1969 1970 btintel_set_flag(hdev, INTEL_BOOTING); 1971 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 1972 1973 err = btintel_send_intel_reset(hdev, boot_addr); 1974 if (err) { 1975 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1976 btintel_reset_to_bootloader(hdev); 1977 return err; 1978 } 1979 1980 /* The bootloader will not indicate when the device is ready. This 1981 * is done by the operational firmware sending bootup notification. 1982 * 1983 * Booting into operational firmware should not take longer than 1984 * 5 second. However if that happens, then just fail the setup 1985 * since something went wrong. 1986 */ 1987 err = btintel_boot_wait(hdev, calltime, 5000); 1988 if (err == -ETIMEDOUT) { 1989 btintel_reset_to_bootloader(hdev); 1990 goto exit_error; 1991 } 1992 1993 if (hdev->bus == HCI_PCI) { 1994 /* In case of PCIe, after receiving bootup event, driver performs 1995 * D0 entry by writing 0 to sleep control register (check 1996 * btintel_pcie_recv_event()) 1997 * Firmware acks with alive interrupt indicating host is full ready to 1998 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 1999 * bit is cleared. 2000 */ 2001 calltime = ktime_get(); 2002 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2003 } 2004 2005 exit_error: 2006 return err; 2007 } 2008 2009 static int btintel_get_fw_name(struct intel_version *ver, 2010 struct intel_boot_params *params, 2011 char *fw_name, size_t len, 2012 const char *suffix) 2013 { 2014 switch (ver->hw_variant) { 2015 case 0x0b: /* SfP */ 2016 case 0x0c: /* WsP */ 2017 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2018 ver->hw_variant, 2019 le16_to_cpu(params->dev_revid), 2020 suffix); 2021 break; 2022 case 0x11: /* JfP */ 2023 case 0x12: /* ThP */ 2024 case 0x13: /* HrP */ 2025 case 0x14: /* CcP */ 2026 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2027 ver->hw_variant, 2028 ver->hw_revision, 2029 ver->fw_revision, 2030 suffix); 2031 break; 2032 default: 2033 return -EINVAL; 2034 } 2035 2036 return 0; 2037 } 2038 2039 static int btintel_download_fw(struct hci_dev *hdev, 2040 struct intel_version *ver, 2041 struct intel_boot_params *params, 2042 u32 *boot_param) 2043 { 2044 const struct firmware *fw; 2045 char fwname[64]; 2046 int err; 2047 ktime_t calltime; 2048 2049 if (!ver || !params) 2050 return -EINVAL; 2051 2052 /* The firmware variant determines if the device is in bootloader 2053 * mode or is running operational firmware. The value 0x06 identifies 2054 * the bootloader and the value 0x23 identifies the operational 2055 * firmware. 2056 * 2057 * When the operational firmware is already present, then only 2058 * the check for valid Bluetooth device address is needed. This 2059 * determines if the device will be added as configured or 2060 * unconfigured controller. 2061 * 2062 * It is not possible to use the Secure Boot Parameters in this 2063 * case since that command is only available in bootloader mode. 2064 */ 2065 if (ver->fw_variant == 0x23) { 2066 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2067 btintel_check_bdaddr(hdev); 2068 2069 /* SfP and WsP don't seem to update the firmware version on file 2070 * so version checking is currently possible. 2071 */ 2072 switch (ver->hw_variant) { 2073 case 0x0b: /* SfP */ 2074 case 0x0c: /* WsP */ 2075 return 0; 2076 } 2077 2078 /* Proceed to download to check if the version matches */ 2079 goto download; 2080 } 2081 2082 /* Read the secure boot parameters to identify the operating 2083 * details of the bootloader. 2084 */ 2085 err = btintel_read_boot_params(hdev, params); 2086 if (err) 2087 return err; 2088 2089 /* It is required that every single firmware fragment is acknowledged 2090 * with a command complete event. If the boot parameters indicate 2091 * that this bootloader does not send them, then abort the setup. 2092 */ 2093 if (params->limited_cce != 0x00) { 2094 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2095 params->limited_cce); 2096 return -EINVAL; 2097 } 2098 2099 /* If the OTP has no valid Bluetooth device address, then there will 2100 * also be no valid address for the operational firmware. 2101 */ 2102 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2103 bt_dev_info(hdev, "No device address configured"); 2104 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2105 } 2106 2107 download: 2108 /* With this Intel bootloader only the hardware variant and device 2109 * revision information are used to select the right firmware for SfP 2110 * and WsP. 2111 * 2112 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2113 * 2114 * Currently the supported hardware variants are: 2115 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2116 * 12 (0x0c) for iBT3.5 (WsP) 2117 * 2118 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2119 * variant, HW revision and FW revision, as these are dependent on CNVi 2120 * and RF Combination. 2121 * 2122 * 17 (0x11) for iBT3.5 (JfP) 2123 * 18 (0x12) for iBT3.5 (ThP) 2124 * 2125 * The firmware file name for these will be 2126 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2127 * 2128 */ 2129 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2130 if (err < 0) { 2131 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2132 /* Firmware has already been loaded */ 2133 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2134 return 0; 2135 } 2136 2137 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2138 return -EINVAL; 2139 } 2140 2141 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2142 if (err < 0) { 2143 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2144 /* Firmware has already been loaded */ 2145 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2146 return 0; 2147 } 2148 2149 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2150 fwname, err); 2151 return err; 2152 } 2153 2154 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2155 2156 if (fw->size < 644) { 2157 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2158 fw->size); 2159 err = -EBADF; 2160 goto done; 2161 } 2162 2163 calltime = ktime_get(); 2164 2165 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2166 2167 /* Start firmware downloading and get boot parameter */ 2168 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2169 if (err < 0) { 2170 if (err == -EALREADY) { 2171 /* Firmware has already been loaded */ 2172 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2173 err = 0; 2174 goto done; 2175 } 2176 2177 /* When FW download fails, send Intel Reset to retry 2178 * FW download. 2179 */ 2180 btintel_reset_to_bootloader(hdev); 2181 goto done; 2182 } 2183 2184 /* Before switching the device into operational mode and with that 2185 * booting the loaded firmware, wait for the bootloader notification 2186 * that all fragments have been successfully received. 2187 * 2188 * When the event processing receives the notification, then the 2189 * INTEL_DOWNLOADING flag will be cleared. 2190 * 2191 * The firmware loading should not take longer than 5 seconds 2192 * and thus just timeout if that happens and fail the setup 2193 * of this device. 2194 */ 2195 err = btintel_download_wait(hdev, calltime, 5000); 2196 if (err == -ETIMEDOUT) 2197 btintel_reset_to_bootloader(hdev); 2198 2199 done: 2200 release_firmware(fw); 2201 return err; 2202 } 2203 2204 static int btintel_bootloader_setup(struct hci_dev *hdev, 2205 struct intel_version *ver) 2206 { 2207 struct intel_version new_ver; 2208 struct intel_boot_params params; 2209 u32 boot_param; 2210 char ddcname[64]; 2211 int err; 2212 2213 BT_DBG("%s", hdev->name); 2214 2215 /* Set the default boot parameter to 0x0 and it is updated to 2216 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2217 * command while downloading the firmware. 2218 */ 2219 boot_param = 0x00000000; 2220 2221 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2222 2223 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2224 if (err) 2225 return err; 2226 2227 /* controller is already having an operational firmware */ 2228 if (ver->fw_variant == 0x23) 2229 goto finish; 2230 2231 err = btintel_boot(hdev, boot_param); 2232 if (err) 2233 return err; 2234 2235 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2236 2237 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2238 sizeof(ddcname), "ddc"); 2239 2240 if (err < 0) { 2241 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2242 } else { 2243 /* Once the device is running in operational mode, it needs to 2244 * apply the device configuration (DDC) parameters. 2245 * 2246 * The device can work without DDC parameters, so even if it 2247 * fails to load the file, no need to fail the setup. 2248 */ 2249 btintel_load_ddc_config(hdev, ddcname); 2250 } 2251 2252 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2253 2254 /* Read the Intel version information after loading the FW */ 2255 err = btintel_read_version(hdev, &new_ver); 2256 if (err) 2257 return err; 2258 2259 btintel_version_info(hdev, &new_ver); 2260 2261 finish: 2262 /* Set the event mask for Intel specific vendor events. This enables 2263 * a few extra events that are useful during general operation. It 2264 * does not enable any debugging related events. 2265 * 2266 * The device will function correctly without these events enabled 2267 * and thus no need to fail the setup. 2268 */ 2269 btintel_set_event_mask(hdev, false); 2270 2271 return 0; 2272 } 2273 2274 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2275 char *fw_name, size_t len, 2276 const char *suffix) 2277 { 2278 const char *format; 2279 u32 cnvi, cnvr; 2280 2281 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2282 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2283 2284 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2285 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2286 2287 /* Only Blazar product supports downloading of intermediate loader 2288 * image 2289 */ 2290 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2291 u8 zero[BTINTEL_FWID_MAXLEN]; 2292 2293 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2294 format = "intel/ibt-%04x-%04x-iml.%s"; 2295 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2296 return; 2297 } 2298 2299 memset(zero, 0, sizeof(zero)); 2300 2301 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2302 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2303 format = "intel/ibt-%04x-%04x-%s.%s"; 2304 snprintf(fw_name, len, format, cnvi, cnvr, 2305 ver->fw_id, suffix); 2306 return; 2307 } 2308 /* If firmware id is not present, fallback to legacy naming 2309 * convention 2310 */ 2311 } 2312 /* Fallback to legacy naming convention for other controllers 2313 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2314 */ 2315 format = "intel/ibt-%04x-%04x.%s"; 2316 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2317 } 2318 2319 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2320 char *fw_name, size_t len, 2321 const char *suffix) 2322 { 2323 const char *format; 2324 u32 cnvi, cnvr; 2325 2326 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2327 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2328 2329 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2330 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2331 2332 format = "intel/ibt-%04x-%04x-iml.%s"; 2333 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2334 } 2335 2336 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2337 struct intel_version_tlv *ver, 2338 u32 *boot_param) 2339 { 2340 const struct firmware *fw; 2341 char fwname[128]; 2342 int err; 2343 ktime_t calltime; 2344 2345 if (!ver || !boot_param) 2346 return -EINVAL; 2347 2348 /* The firmware variant determines if the device is in bootloader 2349 * mode or is running operational firmware. The value 0x03 identifies 2350 * the bootloader and the value 0x23 identifies the operational 2351 * firmware. 2352 * 2353 * When the operational firmware is already present, then only 2354 * the check for valid Bluetooth device address is needed. This 2355 * determines if the device will be added as configured or 2356 * unconfigured controller. 2357 * 2358 * It is not possible to use the Secure Boot Parameters in this 2359 * case since that command is only available in bootloader mode. 2360 */ 2361 if (ver->img_type == BTINTEL_IMG_OP) { 2362 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2363 btintel_check_bdaddr(hdev); 2364 } else { 2365 /* 2366 * Check for valid bd address in boot loader mode. Device 2367 * will be marked as unconfigured if empty bd address is 2368 * found. 2369 */ 2370 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2371 bt_dev_info(hdev, "No device address configured"); 2372 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2373 } 2374 } 2375 2376 if (ver->img_type == BTINTEL_IMG_OP) { 2377 /* Controller running OP image. In case of FW downgrade, 2378 * FWID TLV may not be present and driver may attempt to load 2379 * firmware image which doesn't exist. Lets compare the version 2380 * of IML image 2381 */ 2382 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2383 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2384 else 2385 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2386 } else { 2387 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2388 } 2389 2390 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2391 if (err < 0) { 2392 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2393 /* Firmware has already been loaded */ 2394 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2395 return 0; 2396 } 2397 2398 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2399 fwname, err); 2400 2401 return err; 2402 } 2403 2404 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2405 2406 if (fw->size < 644) { 2407 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2408 fw->size); 2409 err = -EBADF; 2410 goto done; 2411 } 2412 2413 calltime = ktime_get(); 2414 2415 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2416 2417 /* Start firmware downloading and get boot parameter */ 2418 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2419 INTEL_HW_VARIANT(ver->cnvi_bt), 2420 ver->sbe_type); 2421 if (err < 0) { 2422 if (err == -EALREADY) { 2423 /* Firmware has already been loaded */ 2424 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2425 err = 0; 2426 goto done; 2427 } 2428 2429 /* When FW download fails, send Intel Reset to retry 2430 * FW download. 2431 */ 2432 btintel_reset_to_bootloader(hdev); 2433 goto done; 2434 } 2435 2436 /* Before switching the device into operational mode and with that 2437 * booting the loaded firmware, wait for the bootloader notification 2438 * that all fragments have been successfully received. 2439 * 2440 * When the event processing receives the notification, then the 2441 * BTUSB_DOWNLOADING flag will be cleared. 2442 * 2443 * The firmware loading should not take longer than 5 seconds 2444 * and thus just timeout if that happens and fail the setup 2445 * of this device. 2446 */ 2447 err = btintel_download_wait(hdev, calltime, 5000); 2448 if (err == -ETIMEDOUT) 2449 btintel_reset_to_bootloader(hdev); 2450 2451 done: 2452 release_firmware(fw); 2453 return err; 2454 } 2455 2456 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2457 __u8 link, struct bt_codec *codec, 2458 __u8 *ven_len, __u8 **ven_data) 2459 { 2460 int err = 0; 2461 2462 if (!ven_data || !ven_len) 2463 return -EINVAL; 2464 2465 *ven_len = 0; 2466 *ven_data = NULL; 2467 2468 if (link != ESCO_LINK) { 2469 bt_dev_err(hdev, "Invalid link type(%u)", link); 2470 return -EINVAL; 2471 } 2472 2473 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2474 if (!*ven_data) { 2475 err = -ENOMEM; 2476 goto error; 2477 } 2478 2479 /* supports only CVSD and mSBC offload codecs */ 2480 switch (codec->id) { 2481 case 0x02: 2482 **ven_data = 0x00; 2483 break; 2484 case 0x05: 2485 **ven_data = 0x01; 2486 break; 2487 default: 2488 err = -EINVAL; 2489 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2490 goto error; 2491 } 2492 /* codec and its capabilities are pre-defined to ids 2493 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2494 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2495 */ 2496 *ven_len = sizeof(__u8); 2497 return err; 2498 2499 error: 2500 kfree(*ven_data); 2501 *ven_data = NULL; 2502 return err; 2503 } 2504 2505 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2506 { 2507 /* Intel uses 1 as data path id for all the usecases */ 2508 *data_path_id = 1; 2509 return 0; 2510 } 2511 2512 static int btintel_configure_offload(struct hci_dev *hdev) 2513 { 2514 struct sk_buff *skb; 2515 int err = 0; 2516 struct intel_offload_use_cases *use_cases; 2517 2518 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2519 if (IS_ERR(skb)) { 2520 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2521 PTR_ERR(skb)); 2522 return PTR_ERR(skb); 2523 } 2524 2525 if (skb->len < sizeof(*use_cases)) { 2526 err = -EIO; 2527 goto error; 2528 } 2529 2530 use_cases = (void *)skb->data; 2531 2532 if (use_cases->status) { 2533 err = -bt_to_errno(skb->data[0]); 2534 goto error; 2535 } 2536 2537 if (use_cases->preset[0] & 0x03) { 2538 hdev->get_data_path_id = btintel_get_data_path_id; 2539 hdev->get_codec_config_data = btintel_get_codec_config_data; 2540 } 2541 error: 2542 kfree_skb(skb); 2543 return err; 2544 } 2545 2546 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2547 { 2548 struct sk_buff *skb; 2549 struct hci_ppag_enable_cmd ppag_cmd; 2550 acpi_handle handle; 2551 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2552 union acpi_object *p, *elements; 2553 u32 domain, mode; 2554 acpi_status status; 2555 2556 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2557 switch (ver->cnvr_top & 0xFFF) { 2558 case 0x504: /* Hrp2 */ 2559 case 0x202: /* Jfp2 */ 2560 case 0x201: /* Jfp1 */ 2561 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2562 ver->cnvr_top & 0xFFF); 2563 return; 2564 } 2565 2566 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2567 if (!handle) { 2568 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2569 return; 2570 } 2571 2572 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2573 if (ACPI_FAILURE(status)) { 2574 if (status == AE_NOT_FOUND) { 2575 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2576 return; 2577 } 2578 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2579 return; 2580 } 2581 2582 p = buffer.pointer; 2583 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2584 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2585 p->type, p->package.count); 2586 kfree(buffer.pointer); 2587 return; 2588 } 2589 2590 elements = p->package.elements; 2591 2592 /* PPAG table is located at element[1] */ 2593 p = &elements[1]; 2594 2595 domain = (u32)p->package.elements[0].integer.value; 2596 mode = (u32)p->package.elements[1].integer.value; 2597 kfree(buffer.pointer); 2598 2599 if (domain != 0x12) { 2600 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2601 return; 2602 } 2603 2604 /* PPAG mode 2605 * BIT 0 : 0 Disabled in EU 2606 * 1 Enabled in EU 2607 * BIT 1 : 0 Disabled in China 2608 * 1 Enabled in China 2609 */ 2610 mode &= 0x03; 2611 2612 if (!mode) { 2613 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2614 return; 2615 } 2616 2617 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2618 2619 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2620 &ppag_cmd, HCI_CMD_TIMEOUT); 2621 if (IS_ERR(skb)) { 2622 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2623 return; 2624 } 2625 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2626 kfree_skb(skb); 2627 } 2628 2629 int btintel_acpi_reset_method(struct hci_dev *hdev) 2630 { 2631 int ret = 0; 2632 acpi_status status; 2633 union acpi_object *p, *ref; 2634 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2635 2636 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2637 if (ACPI_FAILURE(status) || !buffer.pointer) { 2638 bt_dev_err(hdev, "Failed to run _PRR method"); 2639 ret = -ENODEV; 2640 return ret; 2641 } 2642 p = buffer.pointer; 2643 2644 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) { 2645 bt_dev_err(hdev, "Invalid arguments"); 2646 ret = -EINVAL; 2647 goto exit_on_error; 2648 } 2649 2650 ref = &p->package.elements[0]; 2651 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2652 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2653 ret = -EINVAL; 2654 goto exit_on_error; 2655 } 2656 2657 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2658 if (ACPI_FAILURE(status)) { 2659 bt_dev_err(hdev, "Failed to run_RST method"); 2660 ret = -ENODEV; 2661 goto exit_on_error; 2662 } 2663 2664 exit_on_error: 2665 kfree(buffer.pointer); 2666 return ret; 2667 } 2668 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method); 2669 2670 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2671 struct intel_version_tlv *ver_tlv) 2672 { 2673 struct btintel_data *data = hci_get_priv(hdev); 2674 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2675 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2676 union acpi_object *obj, argv4; 2677 enum { 2678 RESET_TYPE_WDISABLE2, 2679 RESET_TYPE_VSEC 2680 }; 2681 2682 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2683 2684 if (!handle) { 2685 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2686 return; 2687 } 2688 2689 if (!acpi_has_method(handle, "_PRR")) { 2690 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2691 return; 2692 } 2693 2694 switch (ver_tlv->cnvi_top & 0xfff) { 2695 case 0x910: /* GalePeak2 */ 2696 reset_payload[2] = RESET_TYPE_VSEC; 2697 break; 2698 default: 2699 /* WDISABLE2 is the default reset method */ 2700 reset_payload[2] = RESET_TYPE_WDISABLE2; 2701 2702 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2703 BIT(DSM_SET_WDISABLE2_DELAY))) { 2704 bt_dev_err(hdev, "No dsm support to set reset delay"); 2705 return; 2706 } 2707 argv4.integer.type = ACPI_TYPE_INTEGER; 2708 /* delay required to toggle BT power */ 2709 argv4.integer.value = 160; 2710 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2711 DSM_SET_WDISABLE2_DELAY, &argv4); 2712 if (!obj) { 2713 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2714 return; 2715 } 2716 ACPI_FREE(obj); 2717 } 2718 2719 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2720 2721 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2722 DSM_SET_RESET_METHOD)) { 2723 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2724 return; 2725 } 2726 argv4.buffer.type = ACPI_TYPE_BUFFER; 2727 argv4.buffer.length = sizeof(reset_payload); 2728 argv4.buffer.pointer = reset_payload; 2729 2730 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2731 DSM_SET_RESET_METHOD, &argv4); 2732 if (!obj) { 2733 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2734 return; 2735 } 2736 ACPI_FREE(obj); 2737 data->acpi_reset_method = btintel_acpi_reset_method; 2738 } 2739 2740 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2741 2742 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2743 { 2744 /* 2745 * Distinguish ISO data packets form ACL data packets 2746 * based on their connection handle value range. 2747 */ 2748 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2749 if (hci_acl_handle(skb) >= BTINTEL_ISODATA_HANDLE_BASE) 2750 return HCI_ISODATA_PKT; 2751 } 2752 2753 return hci_skb_pkt_type(skb); 2754 } 2755 2756 /* 2757 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2758 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2759 * overcome the potential STEP errors on their designs. Based on the 2760 * configauration, bluetooth firmware shall adjust the BRI response line drive 2761 * strength. The below structure represents DSBR data. 2762 * struct { 2763 * u8 header; 2764 * u32 dsbr; 2765 * } __packed; 2766 * 2767 * header - defines revision number of the structure 2768 * dsbr - defines drive strength BRI response 2769 * bit0 2770 * 0 - instructs bluetooth firmware to use default values 2771 * 1 - instructs bluetooth firmware to override default values 2772 * bit3:1 2773 * Reserved 2774 * bit7:4 2775 * DSBR override values (only if bit0 is set. Default value is 0xF 2776 * bit31:7 2777 * Reserved 2778 * Expected values for dsbr field: 2779 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2780 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2781 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2782 * that the resistor on board is 10 Ohm 2783 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2784 * firmware to use default values. 2785 * 2786 */ 2787 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2788 { 2789 struct btintel_dsbr { 2790 u8 header; 2791 u32 dsbr; 2792 } __packed data; 2793 2794 efi_status_t status; 2795 unsigned long data_size = sizeof(data); 2796 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2797 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2798 2799 if (!IS_ENABLED(CONFIG_EFI)) 2800 return -EOPNOTSUPP; 2801 2802 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2803 return -EOPNOTSUPP; 2804 2805 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2806 &data); 2807 2808 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2809 return -ENXIO; 2810 2811 *dsbr_var = data.dsbr; 2812 return 0; 2813 } 2814 2815 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2816 { 2817 struct btintel_dsbr_cmd { 2818 u8 enable; 2819 u8 dsbr; 2820 } __packed; 2821 2822 struct btintel_dsbr_cmd cmd; 2823 struct sk_buff *skb; 2824 u32 dsbr; 2825 u8 status, hw_variant; 2826 int err; 2827 2828 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2829 /* DSBR command needs to be sent for, 2830 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2831 * 2. Gale Peak2 or BlazarU in OP image. 2832 * 3. Scorpious Peak in IML image. 2833 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2834 */ 2835 2836 switch (hw_variant) { 2837 case BTINTEL_HWID_BZRI: 2838 case BTINTEL_HWID_BZRIW: 2839 if (ver->img_type == BTINTEL_IMG_IML && 2840 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2841 break; 2842 return 0; 2843 case BTINTEL_HWID_GAP: 2844 case BTINTEL_HWID_BZRU: 2845 if (ver->img_type == BTINTEL_IMG_OP && 2846 hdev->bus == HCI_USB) 2847 break; 2848 return 0; 2849 case BTINTEL_HWID_SCP: 2850 if (ver->img_type == BTINTEL_IMG_IML) 2851 break; 2852 return 0; 2853 default: 2854 /* Scorpius Peak2 onwards */ 2855 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2856 && ver->img_type == BTINTEL_IMG_IML) 2857 break; 2858 return 0; 2859 } 2860 2861 dsbr = 0; 2862 err = btintel_uefi_get_dsbr(&dsbr); 2863 if (err < 0) 2864 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2865 BTINTEL_EFI_DSBR, err); 2866 2867 cmd.enable = dsbr & BIT(0); 2868 cmd.dsbr = dsbr >> 4 & 0xF; 2869 2870 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2871 cmd.dsbr); 2872 2873 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2874 if (IS_ERR(skb)) 2875 return -bt_to_errno(PTR_ERR(skb)); 2876 2877 status = skb->data[0]; 2878 kfree_skb(skb); 2879 2880 if (status) 2881 return -bt_to_errno(status); 2882 2883 return 0; 2884 } 2885 2886 #ifdef CONFIG_ACPI 2887 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2888 acpi_string method, 2889 union acpi_object **ptr, 2890 u8 pkg_size) 2891 { 2892 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2893 union acpi_object *p; 2894 acpi_status status; 2895 acpi_handle handle; 2896 2897 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2898 if (!handle) { 2899 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2900 return AE_NOT_EXIST; 2901 } 2902 2903 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2904 2905 if (ACPI_FAILURE(status)) { 2906 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2907 acpi_format_exception(status), method); 2908 return status; 2909 } 2910 2911 p = buffer.pointer; 2912 2913 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2914 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2915 p->type, p->package.count); 2916 kfree(buffer.pointer); 2917 return AE_ERROR; 2918 } 2919 2920 *ptr = buffer.pointer; 2921 return 0; 2922 } 2923 2924 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2925 { 2926 union acpi_object *domain, *bt_pkg; 2927 int i; 2928 2929 for (i = 1; i < buffer->package.count; i++) { 2930 bt_pkg = &buffer->package.elements[i]; 2931 domain = &bt_pkg->package.elements[0]; 2932 if (domain->type == ACPI_TYPE_INTEGER && 2933 domain->integer.value == BTINTEL_BT_DOMAIN) 2934 return bt_pkg; 2935 } 2936 return ERR_PTR(-ENOENT); 2937 } 2938 2939 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2940 { 2941 struct sk_buff *skb; 2942 2943 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2944 if (IS_ERR(skb)) { 2945 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2946 le16_to_cpu(data->id), PTR_ERR(skb)); 2947 return PTR_ERR(skb); 2948 } 2949 kfree_skb(skb); 2950 return 0; 2951 } 2952 2953 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2954 int id, struct btintel_sar_inc_pwr *sar) 2955 { 2956 cmd->len = 5; 2957 cmd->id = cpu_to_le16(id); 2958 cmd->data[0] = sar->br >> 3; 2959 cmd->data[1] = sar->edr2 >> 3; 2960 cmd->data[2] = sar->edr3 >> 3; 2961 return btintel_send_sar_ddc(hdev, cmd, 6); 2962 } 2963 2964 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2965 int id, struct btintel_sar_inc_pwr *sar) 2966 { 2967 cmd->len = 3; 2968 cmd->id = cpu_to_le16(id); 2969 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 2970 return btintel_send_sar_ddc(hdev, cmd, 4); 2971 } 2972 2973 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2974 int id, struct btintel_sar_inc_pwr *sar) 2975 { 2976 cmd->len = 3; 2977 cmd->id = cpu_to_le16(id); 2978 cmd->data[0] = sar->br >> 3; 2979 return btintel_send_sar_ddc(hdev, cmd, 4); 2980 } 2981 2982 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2983 int id, struct btintel_sar_inc_pwr *sar) 2984 { 2985 cmd->len = 3; 2986 cmd->id = cpu_to_le16(id); 2987 cmd->data[0] = sar->br; 2988 return btintel_send_sar_ddc(hdev, cmd, 4); 2989 } 2990 2991 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2992 int id, struct btintel_sar_inc_pwr *sar) 2993 { 2994 cmd->len = 3; 2995 cmd->id = cpu_to_le16(id); 2996 cmd->data[0] = sar->edr2; 2997 return btintel_send_sar_ddc(hdev, cmd, 4); 2998 } 2999 3000 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3001 int id, struct btintel_sar_inc_pwr *sar) 3002 { 3003 cmd->len = 3; 3004 cmd->id = cpu_to_le16(id); 3005 cmd->data[0] = sar->edr3; 3006 return btintel_send_sar_ddc(hdev, cmd, 4); 3007 } 3008 3009 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3010 { 3011 struct btintel_cp_ddc_write *cmd; 3012 u8 buffer[64]; 3013 int ret; 3014 3015 cmd = (void *)buffer; 3016 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3017 if (ret) 3018 return ret; 3019 3020 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3021 if (ret) 3022 return ret; 3023 3024 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3025 if (ret) 3026 return ret; 3027 3028 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3029 if (ret) 3030 return ret; 3031 3032 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3033 if (ret) 3034 return ret; 3035 3036 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3037 if (ret) 3038 return ret; 3039 3040 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3041 3042 return ret; 3043 } 3044 3045 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3046 { 3047 struct btintel_cp_ddc_write *cmd; 3048 struct sk_buff *skb; 3049 u8 buffer[64]; 3050 bool enable; 3051 int ret; 3052 3053 cmd = (void *)buffer; 3054 3055 cmd->len = 3; 3056 cmd->id = cpu_to_le16(0x019e); 3057 3058 if (sar->revision == BTINTEL_SAR_INC_PWR && 3059 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3060 cmd->data[0] = 0x01; 3061 else 3062 cmd->data[0] = 0x00; 3063 3064 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3065 if (ret) 3066 return ret; 3067 3068 if (sar->revision == BTINTEL_SAR_INC_PWR && 3069 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3070 cmd->len = 3; 3071 cmd->id = cpu_to_le16(0x019f); 3072 cmd->data[0] = sar->sar_2400_chain_a; 3073 3074 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3075 if (ret) 3076 return ret; 3077 } 3078 3079 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3080 if (ret) 3081 return ret; 3082 3083 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3084 if (ret) 3085 return ret; 3086 3087 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3088 if (ret) 3089 return ret; 3090 3091 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3092 if (ret) 3093 return ret; 3094 3095 enable = true; 3096 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3097 if (IS_ERR(skb)) { 3098 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3099 return PTR_ERR(skb); 3100 } 3101 3102 kfree_skb(skb); 3103 return 0; 3104 } 3105 3106 /* btintel_send_sar_rev2_band - send DDC command for one Rev2 sub-band 3107 * 3108 * Each DDC 0x0311-0x0316 carries 2 bytes: [ChainA_value, ChainB_value]. 3109 * cmd->len = 4 (2 id + 2 data) 3110 * HCI total = 5 bytes (1 len + 4) 3111 */ 3112 static int btintel_send_sar_rev2_band(struct hci_dev *hdev, 3113 struct btintel_cp_ddc_write *cmd, 3114 u16 id, u8 chain_a, u8 chain_b) 3115 { 3116 cmd->len = 4; 3117 cmd->id = cpu_to_le16(id); 3118 cmd->data[0] = chain_a; 3119 cmd->data[1] = chain_b; 3120 return btintel_send_sar_ddc(hdev, cmd, 5); 3121 } 3122 3123 static int btintel_set_sar_rev2(struct hci_dev *hdev, 3124 struct btintel_sar_rev2 *sar) 3125 { 3126 struct btintel_cp_ddc_write *cmd; 3127 struct sk_buff *skb; 3128 u8 buffer[64]; 3129 u8 enable; 3130 int ret; 3131 3132 cmd = (void *)buffer; 3133 3134 /* DDC 0x019e: enable/disable increased power mode SAR (1 byte) */ 3135 cmd->len = 3; 3136 cmd->id = cpu_to_le16(0x019e); 3137 cmd->data[0] = (sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) ? 3138 0x01 : 0x00; 3139 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3140 if (ret) 3141 return ret; 3142 3143 /* DDC 0x0311-0x0316: per sub-band ChainA + ChainB limits */ 3144 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0311, 3145 sar->chain_a.subband_2g4, 3146 sar->chain_b.subband_2g4); 3147 if (ret) 3148 return ret; 3149 3150 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0312, 3151 sar->chain_a.subband_5g2, 3152 sar->chain_b.subband_5g2); 3153 if (ret) 3154 return ret; 3155 3156 /* 0x0313 and 0x0314 both carry the 5G8/5G9 value */ 3157 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0313, 3158 sar->chain_a.subband_5g8_5g9, 3159 sar->chain_b.subband_5g8_5g9); 3160 if (ret) 3161 return ret; 3162 3163 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0314, 3164 sar->chain_a.subband_5g8_5g9, 3165 sar->chain_b.subband_5g8_5g9); 3166 if (ret) 3167 return ret; 3168 3169 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0315, 3170 sar->chain_a.subband_6g1, 3171 sar->chain_b.subband_6g1); 3172 if (ret) 3173 return ret; 3174 3175 ret = btintel_send_sar_rev2_band(hdev, cmd, 0x0316, 3176 sar->chain_a.subband_6g3, 3177 sar->chain_b.subband_6g3); 3178 if (ret) 3179 return ret; 3180 3181 /* Notify firmware that SAR initialisation is complete */ 3182 enable = 0x01; 3183 skb = __hci_cmd_sync(hdev, 0xfe25, sizeof(enable), &enable, HCI_CMD_TIMEOUT); 3184 if (IS_ERR(skb)) { 3185 bt_dev_warn(hdev, "Failed to send Intel SAR Rev2 Enable (%ld)", 3186 PTR_ERR(skb)); 3187 return PTR_ERR(skb); 3188 } 3189 3190 kfree_skb(skb); 3191 return 0; 3192 } 3193 3194 static int btintel_sar_rev2_send_to_device(struct hci_dev *hdev, 3195 struct btintel_sar_rev2 *sar, 3196 struct intel_version_tlv *ver) 3197 { 3198 u16 cnvi = ver->cnvi_top & 0xfff; 3199 u16 cnvr = ver->cnvr_top & 0xfff; 3200 3201 if (cnvi < BTINTEL_CNVI_BLAZARI || cnvr != BTINTEL_CNVR_WHP2) { 3202 bt_dev_dbg(hdev, "BT SAR Rev2 not supported on this platform (cnvi=0x%x cnvr=0x%x)", 3203 cnvi, cnvr); 3204 return -EOPNOTSUPP; 3205 } 3206 3207 bt_dev_info(hdev, "Applying Bluetooth SAR Rev2"); 3208 return btintel_set_sar_rev2(hdev, sar); 3209 } 3210 3211 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3212 struct intel_version_tlv *ver) 3213 { 3214 u16 cnvi, cnvr; 3215 int ret; 3216 3217 cnvi = ver->cnvi_top & 0xfff; 3218 cnvr = ver->cnvr_top & 0xfff; 3219 3220 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3221 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3222 ret = btintel_set_legacy_sar(hdev, sar); 3223 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3224 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3225 ret = btintel_set_mutual_sar(hdev, sar); 3226 } else { 3227 ret = -EOPNOTSUPP; 3228 } 3229 3230 return ret; 3231 } 3232 3233 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3234 { 3235 union acpi_object *bt_pkg, *buffer = NULL; 3236 struct btintel_sar_inc_pwr sar; 3237 struct btintel_sar_rev2 sar_rev2; 3238 acpi_status status; 3239 u8 revision; 3240 int ret; 3241 3242 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3243 if (ACPI_FAILURE(status)) 3244 return -ENOENT; 3245 3246 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3247 3248 if (IS_ERR(bt_pkg)) { 3249 ret = PTR_ERR(bt_pkg); 3250 goto error; 3251 } 3252 3253 if (!bt_pkg->package.count) { 3254 ret = -EINVAL; 3255 goto error; 3256 } 3257 3258 if (buffer->package.elements[0].type != ACPI_TYPE_INTEGER) { 3259 bt_dev_warn(hdev, "BT_SAR: unexpected ACPI type for revision field"); 3260 ret = -EINVAL; 3261 goto error; 3262 } 3263 3264 revision = buffer->package.elements[0].integer.value; 3265 3266 if (revision > BTINTEL_SAR_REV2) { 3267 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3268 ret = -EOPNOTSUPP; 3269 goto error; 3270 } 3271 3272 if (revision == BTINTEL_SAR_REV2 && bt_pkg->package.count == 13) { 3273 /* Element layout: 0 = domain ID (BTINTEL_BT_DOMAIN, 0x12), 3274 * 1 = bt_sar_bios (u32), 2 = inc_power_mode (u32), 3275 * 3..12 = per-chain sub-band limits (u8 each). 3276 */ 3277 static const u64 rev2_max[13] = { 3278 U8_MAX, /* domain ID */ 3279 U32_MAX, U32_MAX, /* bt_sar_bios, inc_power_mode */ 3280 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain A */ 3281 U8_MAX, U8_MAX, U8_MAX, U8_MAX, U8_MAX, /* chain B */ 3282 }; 3283 union acpi_object *e; 3284 int i; 3285 3286 for (i = 0; i < 13; i++) { 3287 e = &bt_pkg->package.elements[i]; 3288 if (e->type != ACPI_TYPE_INTEGER) { 3289 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI type at element %d", 3290 i); 3291 ret = -EINVAL; 3292 goto error; 3293 } 3294 if (e->integer.value > rev2_max[i]) { 3295 bt_dev_warn(hdev, "BT SAR Rev2: element %d value 0x%llx out of range", 3296 i, e->integer.value); 3297 ret = -ERANGE; 3298 goto error; 3299 } 3300 } 3301 3302 memset(&sar_rev2, 0, sizeof(sar_rev2)); 3303 sar_rev2.revision = revision; 3304 sar_rev2.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3305 3306 if (sar_rev2.bt_sar_bios != 1) { 3307 bt_dev_warn(hdev, "Bluetooth SAR Rev2 is not enabled"); 3308 ret = -EOPNOTSUPP; 3309 goto error; 3310 } 3311 3312 sar_rev2.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3313 3314 sar_rev2.chain_a.subband_2g4 = bt_pkg->package.elements[3].integer.value; 3315 sar_rev2.chain_a.subband_5g2 = bt_pkg->package.elements[4].integer.value; 3316 sar_rev2.chain_a.subband_5g8_5g9 = bt_pkg->package.elements[5].integer.value; 3317 sar_rev2.chain_a.subband_6g1 = bt_pkg->package.elements[6].integer.value; 3318 sar_rev2.chain_a.subband_6g3 = bt_pkg->package.elements[7].integer.value; 3319 3320 sar_rev2.chain_b.subband_2g4 = bt_pkg->package.elements[8].integer.value; 3321 sar_rev2.chain_b.subband_5g2 = bt_pkg->package.elements[9].integer.value; 3322 sar_rev2.chain_b.subband_5g8_5g9 = bt_pkg->package.elements[10].integer.value; 3323 sar_rev2.chain_b.subband_6g1 = bt_pkg->package.elements[11].integer.value; 3324 sar_rev2.chain_b.subband_6g3 = bt_pkg->package.elements[12].integer.value; 3325 3326 bt_dev_dbg(hdev, "BT SAR Rev2: revision=%u bt_sar_bios=%u inc_power_mode=%u", 3327 sar_rev2.revision, sar_rev2.bt_sar_bios, sar_rev2.inc_power_mode); 3328 bt_dev_dbg(hdev, "BT SAR Rev2 Chain A: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3329 sar_rev2.chain_a.subband_2g4, sar_rev2.chain_a.subband_5g2, 3330 sar_rev2.chain_a.subband_5g8_5g9, sar_rev2.chain_a.subband_6g1, 3331 sar_rev2.chain_a.subband_6g3); 3332 bt_dev_dbg(hdev, "BT SAR Rev2 Chain B: 2g4=%u 5g2=%u 5g8_5g9=%u 6g1=%u 6g3=%u", 3333 sar_rev2.chain_b.subband_2g4, sar_rev2.chain_b.subband_5g2, 3334 sar_rev2.chain_b.subband_5g8_5g9, sar_rev2.chain_b.subband_6g1, 3335 sar_rev2.chain_b.subband_6g3); 3336 3337 ret = btintel_sar_rev2_send_to_device(hdev, &sar_rev2, ver); 3338 goto error; 3339 } 3340 3341 if (revision == BTINTEL_SAR_REV2) { 3342 bt_dev_warn(hdev, "BT SAR Rev2: unexpected ACPI package count %d (expected 13)", 3343 bt_pkg->package.count); 3344 ret = -EINVAL; 3345 goto error; 3346 } 3347 3348 memset(&sar, 0, sizeof(sar)); 3349 3350 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3351 sar.revision = revision; 3352 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3353 sar.br = bt_pkg->package.elements[2].integer.value; 3354 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3355 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3356 sar.le = bt_pkg->package.elements[5].integer.value; 3357 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3358 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3359 3360 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3361 sar.revision = revision; 3362 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3363 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3364 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3365 sar.br = bt_pkg->package.elements[4].integer.value; 3366 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3367 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3368 sar.le = bt_pkg->package.elements[7].integer.value; 3369 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3370 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3371 } else { 3372 ret = -EINVAL; 3373 goto error; 3374 } 3375 3376 /* Apply only if it is enabled in BIOS */ 3377 if (sar.bt_sar_bios != 1) { 3378 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3379 ret = -EOPNOTSUPP; 3380 goto error; 3381 } 3382 3383 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3384 error: 3385 kfree(buffer); 3386 return ret; 3387 } 3388 #endif /* CONFIG_ACPI */ 3389 3390 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3391 struct intel_version_tlv *ver) 3392 { 3393 #ifdef CONFIG_ACPI 3394 return btintel_acpi_set_sar(hdev, ver); 3395 #endif 3396 return 0; 3397 } 3398 3399 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3400 struct intel_version_tlv *ver) 3401 { 3402 u32 boot_param; 3403 char ddcname[64]; 3404 int err; 3405 struct intel_version_tlv new_ver; 3406 3407 bt_dev_dbg(hdev, ""); 3408 3409 /* Set the default boot parameter to 0x0 and it is updated to 3410 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3411 * command while downloading the firmware. 3412 */ 3413 boot_param = 0x00000000; 3414 3415 /* In case of PCIe, this function might get called multiple times with 3416 * same hdev instance if there is any error on firmware download. 3417 * Need to clear stale bits of previous firmware download attempt. 3418 */ 3419 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3420 btintel_clear_flag(hdev, i); 3421 3422 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3423 3424 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3425 if (err) 3426 return err; 3427 3428 /* check if controller is already having an operational firmware */ 3429 if (ver->img_type == BTINTEL_IMG_OP) 3430 goto finish; 3431 3432 err = btintel_boot(hdev, boot_param); 3433 if (err) 3434 return err; 3435 3436 err = btintel_read_version_tlv(hdev, ver); 3437 if (err) 3438 return err; 3439 3440 /* set drive strength of BRI response */ 3441 err = btintel_set_dsbr(hdev, ver); 3442 if (err) { 3443 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3444 return err; 3445 } 3446 3447 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3448 * intermediate loader image 3449 */ 3450 if (ver->img_type == BTINTEL_IMG_IML) { 3451 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3452 if (err) 3453 return err; 3454 3455 err = btintel_boot(hdev, boot_param); 3456 if (err) 3457 return err; 3458 } 3459 3460 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3461 3462 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3463 /* Once the device is running in operational mode, it needs to 3464 * apply the device configuration (DDC) parameters. 3465 * 3466 * The device can work without DDC parameters, so even if it 3467 * fails to load the file, no need to fail the setup. 3468 */ 3469 btintel_load_ddc_config(hdev, ddcname); 3470 3471 /* Read supported use cases and set callbacks to fetch datapath id */ 3472 btintel_configure_offload(hdev); 3473 3474 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3475 3476 /* Send sar values to controller */ 3477 btintel_set_specific_absorption_rate(hdev, ver); 3478 3479 /* Set PPAG feature */ 3480 btintel_set_ppag(hdev, ver); 3481 3482 /* Read the Intel version information after loading the FW */ 3483 err = btintel_read_version_tlv(hdev, &new_ver); 3484 if (err) 3485 return err; 3486 3487 btintel_version_info_tlv(hdev, &new_ver); 3488 3489 finish: 3490 /* Set the event mask for Intel specific vendor events. This enables 3491 * a few extra events that are useful during general operation. It 3492 * does not enable any debugging related events. 3493 * 3494 * The device will function correctly without these events enabled 3495 * and thus no need to fail the setup. 3496 */ 3497 btintel_set_event_mask(hdev, false); 3498 3499 return 0; 3500 } 3501 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3502 3503 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3504 { 3505 switch (hw_variant) { 3506 /* Legacy bootloader devices that supports MSFT Extension */ 3507 case 0x11: /* JfP */ 3508 case 0x12: /* ThP */ 3509 case 0x13: /* HrP */ 3510 case 0x14: /* CcP */ 3511 /* All Intel new generation controllers support the Microsoft vendor 3512 * extension are using 0xFC1E for VsMsftOpCode. 3513 */ 3514 case 0x17: 3515 case 0x18: 3516 case 0x19: 3517 case 0x1b: 3518 case 0x1c: 3519 case 0x1d: 3520 case 0x1e: 3521 case 0x1f: 3522 case 0x20: 3523 case 0x21: 3524 case 0x22: 3525 hci_set_msft_opcode(hdev, 0xFC1E); 3526 break; 3527 default: 3528 /* Not supported */ 3529 break; 3530 } 3531 } 3532 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3533 3534 void btintel_print_fseq_info(struct hci_dev *hdev) 3535 { 3536 struct sk_buff *skb; 3537 u8 *p; 3538 u32 val; 3539 const char *str; 3540 3541 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3542 if (IS_ERR(skb)) { 3543 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3544 PTR_ERR(skb)); 3545 return; 3546 } 3547 3548 if (skb->len < (sizeof(u32) * 16 + 2)) { 3549 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3550 skb->len); 3551 kfree_skb(skb); 3552 return; 3553 } 3554 3555 p = skb_pull_data(skb, 1); 3556 if (*p) { 3557 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3558 kfree_skb(skb); 3559 return; 3560 } 3561 3562 p = skb_pull_data(skb, 1); 3563 switch (*p) { 3564 case 0: 3565 str = "Success"; 3566 break; 3567 case 1: 3568 str = "Fatal error"; 3569 break; 3570 case 2: 3571 str = "Semaphore acquire error"; 3572 break; 3573 default: 3574 str = "Unknown error"; 3575 break; 3576 } 3577 3578 if (*p) { 3579 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3580 kfree_skb(skb); 3581 return; 3582 } 3583 3584 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3585 3586 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3587 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3588 3589 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3590 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3591 3592 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3593 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3594 3595 p = skb->data; 3596 skb_pull_data(skb, 4); 3597 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3598 p[2], p[3]); 3599 3600 p = skb->data; 3601 skb_pull_data(skb, 4); 3602 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3603 p[2], p[3]); 3604 3605 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3606 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3607 3608 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3609 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3610 3611 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3612 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3613 3614 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3615 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3616 3617 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3618 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3619 3620 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3621 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3622 3623 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3624 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3625 3626 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3627 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3628 3629 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3630 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3631 3632 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3633 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3634 3635 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3636 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3637 3638 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3639 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3640 3641 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3642 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3643 3644 kfree_skb(skb); 3645 } 3646 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3647 3648 static int btintel_setup_combined(struct hci_dev *hdev) 3649 { 3650 const u8 param[1] = { 0xFF }; 3651 struct intel_version ver; 3652 struct intel_version_tlv ver_tlv; 3653 struct sk_buff *skb; 3654 int err; 3655 3656 BT_DBG("%s", hdev->name); 3657 3658 /* The some controllers have a bug with the first HCI command sent to it 3659 * returning number of completed commands as zero. This would stall the 3660 * command processing in the Bluetooth core. 3661 * 3662 * As a workaround, send HCI Reset command first which will reset the 3663 * number of completed commands and allow normal command processing 3664 * from now on. 3665 * 3666 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3667 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3668 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3669 * state, the only way to exit out of it is sending the HCI_Reset 3670 * command. 3671 */ 3672 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3673 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3674 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3675 HCI_INIT_TIMEOUT); 3676 if (IS_ERR(skb)) { 3677 bt_dev_err(hdev, 3678 "sending initial HCI reset failed (%ld)", 3679 PTR_ERR(skb)); 3680 return PTR_ERR(skb); 3681 } 3682 kfree_skb(skb); 3683 } 3684 3685 /* Starting from TyP device, the command parameter and response are 3686 * changed even though the OCF for HCI_Intel_Read_Version command 3687 * remains same. The legacy devices can handle even if the 3688 * command has a parameter and returns a correct version information. 3689 * So, it uses new format to support both legacy and new format. 3690 */ 3691 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3692 if (IS_ERR(skb)) { 3693 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3694 PTR_ERR(skb)); 3695 return PTR_ERR(skb); 3696 } 3697 3698 /* Check the status */ 3699 if (skb->data[0]) { 3700 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3701 skb->data[0]); 3702 err = -EIO; 3703 goto exit_error; 3704 } 3705 3706 /* Apply the common HCI quirks for Intel device */ 3707 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3708 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3709 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3710 3711 /* Set up the quality report callback for Intel devices */ 3712 hdev->set_quality_report = btintel_set_quality_report; 3713 3714 /* For Legacy device, check the HW platform value and size */ 3715 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3716 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3717 3718 memcpy(&ver, skb->data, sizeof(ver)); 3719 3720 /* Display version information */ 3721 btintel_version_info(hdev, &ver); 3722 3723 /* Check for supported iBT hardware variants of this firmware 3724 * loading method. 3725 * 3726 * This check has been put in place to ensure correct forward 3727 * compatibility options when newer hardware variants come 3728 * along. 3729 */ 3730 switch (ver.hw_variant) { 3731 case 0x07: /* WP */ 3732 case 0x08: /* StP */ 3733 /* Legacy ROM product */ 3734 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3735 3736 /* Apply the device specific HCI quirks 3737 * 3738 * WBS for SdP - For the Legacy ROM products, only SdP 3739 * supports the WBS. But the version information is not 3740 * enough to use here because the StP2 and SdP have same 3741 * hw_variant and fw_variant. So, this flag is set by 3742 * the transport driver (btusb) based on the HW info 3743 * (idProduct) 3744 */ 3745 if (!btintel_test_flag(hdev, 3746 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3747 hci_set_quirk(hdev, 3748 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3749 3750 err = btintel_legacy_rom_setup(hdev, &ver); 3751 break; 3752 case 0x0b: /* SfP */ 3753 case 0x11: /* JfP */ 3754 case 0x12: /* ThP */ 3755 case 0x13: /* HrP */ 3756 case 0x14: /* CcP */ 3757 fallthrough; 3758 case 0x0c: /* WsP */ 3759 /* Apply the device specific HCI quirks 3760 * 3761 * All Legacy bootloader devices support WBS 3762 */ 3763 hci_set_quirk(hdev, 3764 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3765 3766 /* These variants don't seem to support LE Coded PHY */ 3767 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3768 3769 /* Setup MSFT Extension support */ 3770 btintel_set_msft_opcode(hdev, ver.hw_variant); 3771 3772 err = btintel_bootloader_setup(hdev, &ver); 3773 btintel_register_devcoredump_support(hdev); 3774 break; 3775 default: 3776 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3777 ver.hw_variant); 3778 err = -EINVAL; 3779 } 3780 3781 hci_set_hw_info(hdev, 3782 "INTEL platform=%u variant=%u revision=%u", 3783 ver.hw_platform, ver.hw_variant, 3784 ver.hw_revision); 3785 3786 goto exit_error; 3787 } 3788 3789 /* memset ver_tlv to start with clean state as few fields are exclusive 3790 * to bootloader mode and are not populated in operational mode 3791 */ 3792 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3793 /* For TLV type device, parse the tlv data */ 3794 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3795 if (err) { 3796 bt_dev_err(hdev, "Failed to parse TLV version information"); 3797 goto exit_error; 3798 } 3799 3800 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3801 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3802 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3803 err = -EINVAL; 3804 goto exit_error; 3805 } 3806 3807 /* Check for supported iBT hardware variants of this firmware 3808 * loading method. 3809 * 3810 * This check has been put in place to ensure correct forward 3811 * compatibility options when newer hardware variants come 3812 * along. 3813 */ 3814 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3815 case 0x11: /* JfP */ 3816 case 0x12: /* ThP */ 3817 case 0x13: /* HrP */ 3818 case 0x14: /* CcP */ 3819 /* Some legacy bootloader devices starting from JfP, 3820 * the operational firmware supports both old and TLV based 3821 * HCI_Intel_Read_Version command based on the command 3822 * parameter. 3823 * 3824 * For upgrading firmware case, the TLV based version cannot 3825 * be used because the firmware filename for legacy bootloader 3826 * is based on the old format. 3827 * 3828 * Also, it is not easy to convert TLV based version from the 3829 * legacy version format. 3830 * 3831 * So, as a workaround for those devices, use the legacy 3832 * HCI_Intel_Read_Version to get the version information and 3833 * run the legacy bootloader setup. 3834 */ 3835 err = btintel_read_version(hdev, &ver); 3836 if (err) 3837 break; 3838 3839 /* Apply the device specific HCI quirks 3840 * 3841 * All Legacy bootloader devices support WBS 3842 */ 3843 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3844 3845 /* These variants don't seem to support LE Coded PHY */ 3846 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3847 3848 /* Setup MSFT Extension support */ 3849 btintel_set_msft_opcode(hdev, ver.hw_variant); 3850 3851 err = btintel_bootloader_setup(hdev, &ver); 3852 btintel_register_devcoredump_support(hdev); 3853 break; 3854 case 0x18: /* GfP2 */ 3855 case 0x1c: /* GaP */ 3856 /* Re-classify packet type for controllers with LE audio */ 3857 hdev->classify_pkt_type = btintel_classify_pkt_type; 3858 fallthrough; 3859 case 0x17: 3860 case 0x19: 3861 case 0x1b: 3862 case 0x1d: 3863 case 0x1e: 3864 case 0x1f: 3865 case 0x20: 3866 case 0x21: 3867 case 0x22: 3868 /* Display version information of TLV type */ 3869 btintel_version_info_tlv(hdev, &ver_tlv); 3870 3871 /* Apply the device specific HCI quirks for TLV based devices 3872 * 3873 * All TLV based devices support WBS 3874 */ 3875 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3876 3877 /* Setup MSFT Extension support */ 3878 btintel_set_msft_opcode(hdev, 3879 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3880 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3881 3882 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3883 if (err) 3884 goto exit_error; 3885 3886 btintel_register_devcoredump_support(hdev); 3887 btintel_print_fseq_info(hdev); 3888 break; 3889 default: 3890 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3891 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3892 err = -EINVAL; 3893 break; 3894 } 3895 3896 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3897 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3898 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3899 3900 exit_error: 3901 kfree_skb(skb); 3902 3903 return err; 3904 } 3905 3906 int btintel_shutdown_combined(struct hci_dev *hdev) 3907 { 3908 struct sk_buff *skb; 3909 int ret; 3910 3911 /* Send HCI Reset to the controller to stop any BT activity which 3912 * were triggered. This will help to save power and maintain the 3913 * sync b/w Host and controller 3914 */ 3915 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3916 if (IS_ERR(skb)) { 3917 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3918 return PTR_ERR(skb); 3919 } 3920 kfree_skb(skb); 3921 3922 3923 /* Some platforms have an issue with BT LED when the interface is 3924 * down or BT radio is turned off, which takes 5 seconds to BT LED 3925 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3926 * device in the RFKILL ON state which turns off the BT LED immediately. 3927 */ 3928 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3929 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3930 if (IS_ERR(skb)) { 3931 ret = PTR_ERR(skb); 3932 bt_dev_err(hdev, "turning off Intel device LED failed"); 3933 return ret; 3934 } 3935 kfree_skb(skb); 3936 } 3937 3938 return 0; 3939 } 3940 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3941 3942 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3943 { 3944 hdev->manufacturer = 2; 3945 hdev->setup = btintel_setup_combined; 3946 hdev->shutdown = btintel_shutdown_combined; 3947 hdev->hw_error = btintel_hw_error; 3948 hdev->set_diag = btintel_set_diag_combined; 3949 hdev->set_bdaddr = btintel_set_bdaddr; 3950 3951 coredump_info.driver_name = driver_name; 3952 3953 return 0; 3954 } 3955 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3956 3957 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3958 { 3959 struct intel_tlv *tlv = (void *)&skb->data[5]; 3960 3961 if (skb->len < 5 + sizeof(*tlv) + sizeof(tlv->val[0])) 3962 goto recv_frame; 3963 3964 /* The first event is always an event type TLV */ 3965 if (tlv->type != INTEL_TLV_TYPE_ID) 3966 goto recv_frame; 3967 3968 switch (tlv->val[0]) { 3969 case INTEL_TLV_SYSTEM_EXCEPTION: 3970 case INTEL_TLV_FATAL_EXCEPTION: 3971 case INTEL_TLV_DEBUG_EXCEPTION: 3972 case INTEL_TLV_TEST_EXCEPTION: 3973 /* Generate devcoredump from exception */ 3974 if (!hci_devcd_init(hdev, skb->len)) { 3975 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 3976 hci_devcd_complete(hdev); 3977 } else { 3978 bt_dev_err(hdev, "Failed to generate devcoredump"); 3979 } 3980 break; 3981 default: 3982 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3983 } 3984 3985 recv_frame: 3986 return hci_recv_frame(hdev, skb); 3987 } 3988 3989 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3990 { 3991 struct hci_event_hdr *hdr = (void *)skb->data; 3992 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3993 3994 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff) { 3995 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3996 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3997 3998 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3999 switch (skb->data[2]) { 4000 case 0x02: 4001 /* When switching to the operational firmware 4002 * the device sends a vendor specific event 4003 * indicating that the bootup completed. 4004 */ 4005 btintel_bootup(hdev, ptr, len); 4006 kfree_skb(skb); 4007 return 0; 4008 case 0x06: 4009 /* When the firmware loading completes the 4010 * device sends out a vendor specific event 4011 * indicating the result of the firmware 4012 * loading. 4013 */ 4014 btintel_secure_send_result(hdev, ptr, len); 4015 kfree_skb(skb); 4016 return 0; 4017 } 4018 } 4019 4020 /* Handle all diagnostics events separately. May still call 4021 * hci_recv_frame. 4022 */ 4023 if (len + 1 >= sizeof(diagnostics_hdr) && 4024 memcmp(&skb->data[2], diagnostics_hdr, 4025 sizeof(diagnostics_hdr)) == 0) { 4026 return btintel_diagnostics(hdev, skb); 4027 } 4028 } 4029 4030 return hci_recv_frame(hdev, skb); 4031 } 4032 EXPORT_SYMBOL_GPL(btintel_recv_event); 4033 4034 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 4035 { 4036 const struct intel_bootup *evt = ptr; 4037 4038 if (len != sizeof(*evt)) 4039 return; 4040 4041 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 4042 btintel_wake_up_flag(hdev, INTEL_BOOTING); 4043 } 4044 EXPORT_SYMBOL_GPL(btintel_bootup); 4045 4046 void btintel_secure_send_result(struct hci_dev *hdev, 4047 const void *ptr, unsigned int len) 4048 { 4049 const struct intel_secure_send_result *evt = ptr; 4050 4051 if (len != sizeof(*evt)) 4052 return; 4053 4054 if (evt->result) 4055 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 4056 4057 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 4058 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 4059 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 4060 } 4061 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 4062 4063 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 4064 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 4065 MODULE_VERSION(VERSION); 4066 MODULE_LICENSE("GPL"); 4067 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 4068 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 4069 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 4070 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 4071